Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Few debian updates #5729

Merged
merged 10 commits into from
Apr 8, 2020
Merged

Few debian updates #5729

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
41ba6b1
debian: Update coturn udp port to non-privileged one.
damencho Apr 3, 2020
961820b
debian: Turnserver config requires jitsi-meet-web-config files.
damencho Apr 3, 2020
18fd4b3
doc: Updates doc, removing `--no-install-recommends`.
damencho Apr 6, 2020
be5414a
debian: Moves checks and configs to default to prosody 0.11.
damencho Apr 6, 2020
48cdc66
debian: Disable room locking on internal muc.
damencho Apr 6, 2020
d6b2718
add scripts for deploying coturn with certbot
julienfastre Apr 6, 2020
96a048e
turnserver: Removes unused variable showing error.
damencho Apr 6, 2020
d82162c
debian: updates let's encrypt and coturn scripts.
damencho Apr 6, 2020
ac893e3
debian: Detect failure to retrieve external ip address.
damencho Apr 7, 2020
1c7531f
debian: Always configure turn when the turnserver package is installed.
damencho Apr 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions debian/jitsi-meet-turnserver.install
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
doc/debian/jitsi-meet-turn/turnserver.conf /usr/share/jitsi-meet-turnserver/
doc/debian/jitsi-meet/jitsi-meet.conf /usr/share/jitsi-meet-turnserver/
doc/debian/jitsi-meet-turn/turnserver.conf /usr/share/jitsi-meet-turnserver/
doc/debian/jitsi-meet/jitsi-meet.conf /usr/share/jitsi-meet-turnserver/
doc/debian/jitsi-meet-turn/coturn-certbot-deploy.sh /usr/share/jitsi-meet-turnserver/
35 changes: 35 additions & 0 deletions doc/debian/jitsi-meet-turn/coturn-certbot-deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
#!/bin/sh

set -e

COTURN_CERT_DIR="/etc/coturn/certs"

# create a directory to store certs if it does not exists
if [ ! -d "$COTURN_CERT_DIR" ]; then
mkdir -p /etc/coturn/certs
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use the variable COTURN_CERT_DIR here?

chown -R turnserver:turnserver /etc/coturn/
chmod -R 700 /etc/coturn/
fi

for domain in $RENEWED_DOMAINS; do
case $domain in
jitsi-meet.example.com)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a comment that this is updated/replaced with the correct domain by the install script?

# Make sure the certificate and private key files are
# never world readable, even just for an instant while
# we're copying them into daemon_cert_root.
umask 077

cp "$RENEWED_LINEAGE/fullchain.pem" "$COTURN_CERT_DIR/$domain.fullchain.pem"
cp "$RENEWED_LINEAGE/privkey.pem" "$COTURN_CERT_DIR/$domain.privkey.pem"

# Apply the proper file ownership and permissions for
# the daemon to read its certificate and key.
chown turnserver "$COTURN_CERT_DIR/$domain.fullchain.pem" \
"$COTURN_CERT_DIR/$domain.privkey.pem"
chmod 400 "$COTURN_CERT_DIR/$domain.fullchain.pem" \
"$COTURN_CERT_DIR/$domain.privkey.pem"

;;
esac
done

16 changes: 13 additions & 3 deletions resources/install-letsencrypt-cert.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@ echo "- Download certbot-auto from https://dl.eff.org to /usr/local/sbin"
echo "- Install additional dependencies in order to request Let’s Encrypt certificate"
echo "- If running with jetty serving web content, will stop Jitsi Videobridge"
echo "- Configure and reload nginx or apache2, whichever is used"
echo "- Configure the coturn server to use Let's Encrypt certificate and add required deploy hooks"
echo "- Add command in weekly cron job to renew certificates regularly"
echo ""
echo "You need to agree to the ACME server's Subscriber Agreement (https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf) "
echo "by providing an email address for important account notifications"
Expand All @@ -40,6 +42,15 @@ CERT_CRT="/etc/letsencrypt/live/$DOMAIN/fullchain.pem"

if [ -f /etc/nginx/sites-enabled/$DOMAIN.conf ] ; then

TURN_CONFIG="/etc/turnserver.conf"
if [ -f $TURN_CONFIG ] && grep -q "jitsi-meet coturn config" "$TURN_CONFIG" ; then
TURN_HOOK=/etc/letsencrypt/renewal-hooks/deploy/0000-coturn-certbot-deploy.sh

cp /usr/share/jitsi-meet-turnserver/coturn-certbot-deploy.sh $TURN_HOOK
chmod u+x $TURN_HOOK
sed -i "s/jitsi-meet.example.com/$DOMAIN/g" $TURN_HOOK
fi

./certbot-auto certonly --noninteractive \
--webroot --webroot-path /usr/share/jitsi-meet \
-d $DOMAIN \
Expand All @@ -60,11 +71,10 @@ if [ -f /etc/nginx/sites-enabled/$DOMAIN.conf ] ; then
echo "service nginx reload" >> $CRON_FILE
service nginx reload

TURN_CONFIG="/etc/turnserver.conf"
if [ -f $TURN_CONFIG ] && grep -q "jitsi-meet coturn config" "$TURN_CONFIG" ; then
echo "Configuring turnserver"
sed -i "s/cert=\/etc\/jitsi\/meet\/.*crt/cert=$CERT_CRT_ESC/g" $TURN_CONFIG
sed -i "s/pkey=\/etc\/jitsi\/meet\/.*key/pkey=$CERT_KEY_ESC/g" $TURN_CONFIG
sed -i "/^cert/c\cert=\/etc\/coturn\/certs\/$DOMAIN.fullchain.pem" $TURN_CONFIG
sed -i "/^pkey/c\pkey=\/etc\/coturn\/certs\/$DOMAIN.privkey.pem" $TURN_CONFIG

echo "service coturn restart" >> $CRON_FILE
service coturn restart
Expand Down