From ca6c362c35a8fd2a8486b8f206a8ab7f51502871 Mon Sep 17 00:00:00 2001 From: Jim Martens Date: Sun, 22 Mar 2020 15:36:50 +0100 Subject: [PATCH] Added config files for jitsi installation (does not work yet) --- jitsi.yml | 11 ++ jitsi_vars.yml.example | 27 ++++ roles/jitsi/handlers/main.yml | 9 ++ roles/jitsi/meta/main.yml | 5 + roles/jitsi/tasks/apache.yml | 38 +++++ roles/jitsi/tasks/jitsi.yml | 22 +++ roles/jitsi/tasks/main.yml | 3 + roles/jitsi/tasks/ssl-dev.yml | 27 ++++ .../ansible_domain-le-ssl.conf.j2 | 29 ++++ .../sites-available/ansible_domain.conf.j2 | 6 + .../templates/etc/jitsi/docker-compose.yml.j2 | 135 ++++++++++++++++++ 11 files changed, 312 insertions(+) create mode 100644 jitsi.yml create mode 100644 jitsi_vars.yml.example create mode 100644 roles/jitsi/handlers/main.yml create mode 100644 roles/jitsi/meta/main.yml create mode 100644 roles/jitsi/tasks/apache.yml create mode 100644 roles/jitsi/tasks/jitsi.yml create mode 100644 roles/jitsi/tasks/main.yml create mode 100644 roles/jitsi/tasks/ssl-dev.yml create mode 100644 roles/jitsi/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 create mode 100644 roles/jitsi/templates/etc/apache2/sites-available/ansible_domain.conf.j2 create mode 100644 roles/jitsi/templates/etc/jitsi/docker-compose.yml.j2 diff --git a/jitsi.yml b/jitsi.yml new file mode 100644 index 0000000..0ffc2c9 --- /dev/null +++ b/jitsi.yml @@ -0,0 +1,11 @@ +--- +- name: Set up Jitsi + hosts: vps + vars_files: + - general_vars.yml + - jitsi_vars.yml + remote_user: "{{ ssh_user }}" + become: yes + become_user: root + roles: + - jitsi diff --git a/jitsi_vars.yml.example b/jitsi_vars.yml.example new file mode 100644 index 0000000..b8af99c --- /dev/null +++ b/jitsi_vars.yml.example @@ -0,0 +1,27 @@ +--- +jitsi_domain: "jitsi.example.com" +timezone: "Europe/Berlin" +log_level: "info" +docker_host_address: "" +enable_auth: 0 +auth_type: "internal" +enable_guests: 0 +enable_recording: 0 +xmpp_domain: "meet.jitsi" +xmpp_auth_domain: "auth.meet.jitsi" +xmpp_server: "xmpp.meet.jitsi" +xmpp_guest_domain: "guest.meet.jitsi" +xmpp_muc_domain: "muc.meet.jitsi" +xmpp_internal_muc_domain: "internal-muc.meet.jitsi" +xmpp_recorder_domain: "recorder.meet.jitsi" +jicofo_auth_user: "focus" +jicofo_auth_password: "" +jicofo_component_secret: "" +jvb_auth_user: "jvb" +jvb_auth_password: "" +jibri_xmpp_user: "jibri" +jibri_xmpp_password: "" +jibri_recorder_user: "recorder" +jibri_recorder_password: "" +jigasi_xmpp_user: "jigasi" +jigasi_xmpp_password: "" diff --git a/roles/jitsi/handlers/main.yml b/roles/jitsi/handlers/main.yml new file mode 100644 index 0000000..b7a9274 --- /dev/null +++ b/roles/jitsi/handlers/main.yml @@ -0,0 +1,9 @@ +--- +- name: restart jitsi + service: + name: jitsi + state: restarted +- name: restart prosody + service: + name: prosody + state: restarted diff --git a/roles/jitsi/meta/main.yml b/roles/jitsi/meta/main.yml new file mode 100644 index 0000000..3821742 --- /dev/null +++ b/roles/jitsi/meta/main.yml @@ -0,0 +1,5 @@ +--- +dependencies: + - role: docker + - role: apache + - role: letsencrypt diff --git a/roles/jitsi/tasks/apache.yml b/roles/jitsi/tasks/apache.yml new file mode 100644 index 0000000..89fc85c --- /dev/null +++ b/roles/jitsi/tasks/apache.yml @@ -0,0 +1,38 @@ +--- +- name: add jitsi http site + template: + src: etc/apache2/sites-available/ansible_domain.conf.j2 + dest: /etc/apache2/sites-available/{{ jitsi_domain}}.conf + owner: root + group: root + mode: 0644 + force: no + register: drone_http +- name: disable default site and enable jitsi site + block: + - name: disable default site + command: + cmd: a2dissite 000-default.conf + removes: /etc/apache2/sites-enabled/000-default.conf + - name: enable jitsi site + command: + cmd: a2ensite {{ jitsi_domain }}.conf + creates: /etc/apache2/sites-enabled/{{ jitsi_domain }}.conf +- name: run certbot + command: + cmd: certbot --apache --non-interactive --keep-until-expiring --no-eff-email --email {{ admin_mail }} --redirect --renew-with-new-domains --agree-tos -d {{ jitsi_domain }} + when: ansible_domain != 'dev' and drone_http.changed +- include: ssl-dev.yml + when: ansible_domain == 'dev' +- name: add jitsi https site + template: + src: etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 + dest: /etc/apache2/sites-available/{{ jitsi_domain }}-le-ssl.conf + owner: root + group: root + mode: 0644 +- name: enable jitsi https site + command: + cmd: a2ensite {{ jitsi_domain }}-le-ssl.conf + creates: /etc/apache2/sites-enabled/{{ jitsi_domain }}-le-ssl.conf + notify: restart apache diff --git a/roles/jitsi/tasks/jitsi.yml b/roles/jitsi/tasks/jitsi.yml new file mode 100644 index 0000000..6ea86ae --- /dev/null +++ b/roles/jitsi/tasks/jitsi.yml @@ -0,0 +1,22 @@ +--- +- name: create jitsi directory + file: + state: directory + path: /etc/jitsi +- name: create shared secret + command: + cmd: openssl rand -hex 16 + register: jitsi_rpc_secret + run_once: true +- set_fact: + jitsi_rpc_secret: "{{ jitsi_rpc_secret.stdout }}" +- name: copy docker compose file for jitsi + template: + src: etc/jitsi/docker-compose.yml.j2 + dest: /etc/jitsi/docker-compose.yml + owner: root + group: root + mode: 0644 +- name: start jitsi docker containers + docker_compose: + project_src: /etc/jitsi diff --git a/roles/jitsi/tasks/main.yml b/roles/jitsi/tasks/main.yml new file mode 100644 index 0000000..55bea04 --- /dev/null +++ b/roles/jitsi/tasks/main.yml @@ -0,0 +1,3 @@ +--- +- include: apache.yml +- include: jitsi.yml diff --git a/roles/jitsi/tasks/ssl-dev.yml b/roles/jitsi/tasks/ssl-dev.yml new file mode 100644 index 0000000..3f4053a --- /dev/null +++ b/roles/jitsi/tasks/ssl-dev.yml @@ -0,0 +1,27 @@ +--- +- name: Ensure python OpenSSL dependencies are installed. + pip: + name: pyOpenSSL + state: present + +- name: Ensure directory exists for local self-signed TLS certs. + file: + path: /etc/letsencrypt/live/{{ jitsi_domain }} + state: directory + +- name: Generate an OpenSSL private key. + openssl_privatekey: + path: /etc/letsencrypt/live/{{ jitsi_domain }}/privkey.pem + +- name: Generate an OpenSSL CSR. + openssl_csr: + path: /etc/ssl/private/{{ jitsi_domain }}.csr + privatekey_path: /etc/letsencrypt/live/{{ jitsi_domain }}/privkey.pem + common_name: "{{ jitsi_domain }}" + +- name: Generate a Self Signed OpenSSL certificate. + openssl_certificate: + path: /etc/letsencrypt/live/{{ jitsi_domain }}/fullchain.pem + privatekey_path: /etc/letsencrypt/live/{{ jitsi_domain }}/privkey.pem + csr_path: /etc/ssl/private/{{ jitsi_domain }}.csr + provider: selfsigned diff --git a/roles/jitsi/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 b/roles/jitsi/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 new file mode 100644 index 0000000..13afdb5 --- /dev/null +++ b/roles/jitsi/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2 @@ -0,0 +1,29 @@ + + + ServerName {{ jitsi_domain }} + ServerAdmin {{ admin_mail }} + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined + + SSLCertificateFile /etc/letsencrypt/live/{{ jitsi_domain }}/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/{{ jitsi_domain }}/privkey.pem + Include /etc/letsencrypt/options-ssl-apache.conf + + # Encoded slashes need to be allowed + AllowEncodedSlashes NoDecode + + # keep the host + ProxyPreserveHost On + SSLProxyEngine On + SSLProxyVerify none + SSLProxyCheckPeerCN off + SSLProxyCheckPeerName off + SSLProxyCheckPeerExpire off + + RequestHeader set X-Forwarded-Proto "https" + RequestHeader set X-Forwarded-Host "{{ jitsi_domain }}" + ProxyPass / https://127.0.0.1:8003/ + ProxyPassReverse / https://127.0.0.1:8003/ + + + diff --git a/roles/jitsi/templates/etc/apache2/sites-available/ansible_domain.conf.j2 b/roles/jitsi/templates/etc/apache2/sites-available/ansible_domain.conf.j2 new file mode 100644 index 0000000..9f6f638 --- /dev/null +++ b/roles/jitsi/templates/etc/apache2/sites-available/ansible_domain.conf.j2 @@ -0,0 +1,6 @@ + + ServerName {{ jitsi_domain }} + ServerAdmin {{ admin_mail }} + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined + diff --git a/roles/jitsi/templates/etc/jitsi/docker-compose.yml.j2 b/roles/jitsi/templates/etc/jitsi/docker-compose.yml.j2 new file mode 100644 index 0000000..cdfbb98 --- /dev/null +++ b/roles/jitsi/templates/etc/jitsi/docker-compose.yml.j2 @@ -0,0 +1,135 @@ +version: '2' + +services: + # Frontend + jitsi: + image: jitsi/web + ports: + - "8002:80" + - "8003:443" + restart: always + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - /etc/jitsi/web:/config + - /etc/jitsi/transcripts:/usr/share/jitsi-meet/transcripts + environment: + - ENABLE_AUTH={{ enable_auth }} + - ENABLE_GUESTS={{ enable_guests }} + - ENABLE_TRANSCRIPTIONS=0 + - PUBLIC_URL={{ jitsi_domain }} + - TZ={{ timezone }} + - ENABLE_RECORDING={{ enable_recording }} + - DISABLE_HTTPS=0 + - JICOFO_AUTH_USER={{ jicofo_auth_user }} + - XMPP_DOMAIN={{ xmpp_domain }} + - XMPP_AUTH_DOMAIN={{ xmpp_auth_domain }} + - XMPP_BOSH_URL_BASE=http://{{ xmpp_domain }}:5280 + - XMPP_GUEST_DOMAIN={{ xmpp_guest_domain }} + - XMPP_MUC_DOMAIN={{ xmpp_muc_domain }} + - XMPP_RECORDER_DOMAIN{{ xmpp_recorder_domain }} + - JIBRI_BREWERY_MUC=jibribrewery + - JIBRI_PENDING_TIMEOUT=90 + - JIBRI_XMPP_USER={{ jibri_xmpp_user }} + - JIBRI_XMPP_PASSWORD={{ jibri_xmpp_password }} + - JIBRI_RECORDER_USER=recorder + - JIBRI_RECORDER_PASSWORD={{ jibri_recorder_password }} + networks: + meet.jitsi: + aliases: + - {{ xmpp_domain }} + + # XMPP server + prosody: + image: jitsi/prosody + expose: + - '5222' + - '5347' + - '5280' + restart: always + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - /etc/jitsi/prosody:/config + environment: + - AUTH_TYPE={{ auth_type }} + - ENABLE_AUTH={{ enable_auth }} + - ENABLE_GUESTS={{ enable_guests }} + - XMPP_DOMAIN={{ xmpp_domain }} + - XMPP_AUTH_DOMAIN={{ xmpp_auth_domain }} + - XMPP_GUEST_DOMAIN={{ xmpp_guest_domain }} + - XMPP_MUC_DOMAIN={{ xmpp_muc_domain }} + - XMPP_INTERNAL_MUC_DOMAIN={{ xmpp_internal_muc_domain }} + - XMPP_RECORDER_DOMAIN={{ xmpp_recorder_domain }} + - JICOFO_COMPONENT_SECRET={{ jicofo_component_secret }} + - JICOFO_AUTH_USER={{ jicofo_auth_user }} + - JICOFO_AUTH_PASSWORD={{ jicofo_auth_password }} + - JVB_AUTH_USER={{ jvb_auth_user }} + - JVB_AUTH_PASSWORD={{ jvb_auth_password }} + - JIGASI_XMPP_USER={{ jigasi_xmpp_user }} + - JIGASI_XMPP_PASSWORD={{ jigasi_xmpp_password }} + - JIBRI_XMPP_USER={{ jibri_xmpp_user }} + - JIBRI_XMPP_PASSWORD={{ jibri_xmpp_password }} + - JIBRI_RECORDER_USER={{ jibri_recorder_user }} + - JIBRI_RECORDER_PASSWORD={{ jibri_recorder_password }} + - LOG_LEVEL={{ log_level }} + - TZ={{ timezone }} + networks: + meet.jitsi: + aliases: + - {{ xmpp_server }} + + # Focus component + jicofo: + image: jitsi/jicofo + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - /etc/jitsi/jicofo:/config + restart: always + environment: + - ENABLE_AUTH={{ enable_auth }} + - XMPP_DOMAIN={{ xmpp_domain }} + - XMPP_AUTH_DOMAIN={{ xmpp_auth_domain }} + - XMPP_INTERNAL_MUC_DOMAIN={{ xmpp_internal_muc_domain }} + - XMPP_SERVER={{ xmpp_server }} + - JICOFO_COMPONENT_SECRET={{ jicofo_component_secret }} + - JICOFO_AUTH_USER={{ jicofo_auth_user }} + - JICOFO_AUTH_PASSWORD={{ jicofo_auth_password }} + - JVB_BREWERY_MUC=jvbbrewery + - JIGASI_BREWERY_MUC=jigasibrewery + - JIBRI_BREWERY_MUC=jibribrewery + - JIBRI_PENDING_TIMEOUT=90 + - TZ={{ timezone }} + depends_on: + - prosody + networks: + meet.jitsi: + + # Video bridge + jvb: + image: jitsi/jvb + ports: + - '10000:10000/udp' + - '4443:4443' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - /etc/jitsi/jvb:/config + environment: + - XMPP_AUTH_DOMAIN={{ xmpp_auth_domain }} + - XMPP_INTERNAL_MUC_DOMAIN={{ xmpp_internal_muc_domain }} + - XMPP_SERVER={{ xmpp_server }} + - JVB_AUTH_USER={{ jvb_auth_user }} + - JVB_AUTH_PASSWORD={{ jvb_auth_password }} + - JVB_BREWERY_MUC=jvbbrewery + - JVB_PORT=10000 + - JVB_TCP_HARVESTER_DISABLED=true + - JVB_TCP_PORT=4443 + - JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302 + - TZ={{ timezone }} + - DOCKER_HOST_ADDRESS={{ docker_host_address }} + depends_on: + - prosody + networks: + meet.jitsi: + +# Custom network so all services can communicate using a FQDN +networks: + meet.jitsi: