c73ba37202
* Adds package that can configure using turnserver for jitsi-meet. Activates http2 on the nginx host and uses the alpn send with the web requests to multiplex traffic to be served as web of proxied to the turn server. It needs nginx at least v1.13.10. Adds turncredentials module from Philipp Hancke, with small modification (all int values for hosts need to be strings/tostring()) in order to be able to use the module with prosody 0.11. * Moves loading of stream after loading stream module (50-..). * Leaves DISABLE_TCP_HARVESTER to be handled by jvb. * Fixes comments. * Properly detect first time coturn install and configure it. * Handles upgrading from jetty serving web. * Does not create jvb user if already exists. * Fixes let's encrypt and adds turnserver handling. * Enables use of turn server in config.js if available. * Adds a check whether prosody config exists. There are cases where deployments can still have configured prosody in the main prosody config in /etc/prosody.
115 lines
4.1 KiB
Bash
Executable File
115 lines
4.1 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
set -e
|
||
|
||
DEB_CONF_RESULT=`debconf-show jitsi-meet-web-config | grep jvb-hostname`
|
||
DOMAIN="${DEB_CONF_RESULT##*:}"
|
||
# remove whitespace
|
||
DOMAIN="$(echo -e "${DOMAIN}" | tr -d '[:space:]')"
|
||
|
||
echo "-------------------------------------------------------------------------"
|
||
echo "This script will:"
|
||
echo "- Need a working DNS record pointing to this machine(for domain ${DOMAIN})"
|
||
echo "- Download certbot-auto from https://dl.eff.org to /usr/local/sbin"
|
||
echo "- Install additional dependencies in order to request Let’s Encrypt certificate"
|
||
echo "- If running with jetty serving web content, will stop Jitsi Videobridge"
|
||
echo "- Configure and reload nginx or apache2, whichever is used"
|
||
echo ""
|
||
echo "You need to agree to the ACME server's Subscriber Agreement (https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf) "
|
||
echo "by providing an email address for important account notifications"
|
||
|
||
echo -n "Enter your email and press [ENTER]: "
|
||
read EMAIL
|
||
|
||
cd /usr/local/sbin
|
||
|
||
if [ ! -f certbot-auto ] ; then
|
||
wget https://dl.eff.org/certbot-auto
|
||
chmod a+x ./certbot-auto
|
||
fi
|
||
|
||
CRON_FILE="/etc/cron.weekly/letsencrypt-renew"
|
||
echo "#!/bin/bash" > $CRON_FILE
|
||
echo "/usr/local/sbin/certbot-auto renew >> /var/log/le-renew.log" >> $CRON_FILE
|
||
|
||
CERT_KEY="/etc/letsencrypt/live/$DOMAIN/privkey.pem"
|
||
CERT_CRT="/etc/letsencrypt/live/$DOMAIN/fullchain.pem"
|
||
|
||
if [ -f /etc/nginx/sites-enabled/$DOMAIN.conf ] ; then
|
||
|
||
./certbot-auto certonly --noninteractive \
|
||
--webroot --webroot-path /usr/share/jitsi-meet \
|
||
-d $DOMAIN \
|
||
--agree-tos --email $EMAIL
|
||
|
||
echo "Configuring nginx"
|
||
|
||
CONF_FILE="/etc/nginx/sites-available/$DOMAIN.conf"
|
||
CERT_KEY_ESC=$(echo $CERT_KEY | sed 's/\./\\\./g')
|
||
CERT_KEY_ESC=$(echo $CERT_KEY_ESC | sed 's/\//\\\//g')
|
||
sed -i "s/ssl_certificate_key\ \/etc\/jitsi\/meet\/.*key/ssl_certificate_key\ $CERT_KEY_ESC/g" \
|
||
$CONF_FILE
|
||
CERT_CRT_ESC=$(echo $CERT_CRT | sed 's/\./\\\./g')
|
||
CERT_CRT_ESC=$(echo $CERT_CRT_ESC | sed 's/\//\\\//g')
|
||
sed -i "s/ssl_certificate\ \/etc\/jitsi\/meet\/.*crt/ssl_certificate\ $CERT_CRT_ESC/g" \
|
||
$CONF_FILE
|
||
|
||
echo "service nginx reload" >> $CRON_FILE
|
||
service nginx reload
|
||
|
||
TURN_CONFIG="/etc/turnserver.conf"
|
||
if [ -f $TURN_CONFIG ] && grep -q "jitsi-meet coturn config" "$TURN_CONFIG" ; then
|
||
echo "Configuring turnserver"
|
||
sed -i "s/cert=\/etc\/jitsi\/meet\/.*crt/cert=$CERT_CRT_ESC/g" $TURN_CONFIG
|
||
sed -i "s/pkey=\/etc\/jitsi\/meet\/.*key/pkey=$CERT_KEY_ESC/g" $TURN_CONFIG
|
||
|
||
echo "service coturn restart" >> $CRON_FILE
|
||
service coturn restart
|
||
fi
|
||
elif [ -f /etc/apache2/sites-enabled/$DOMAIN.conf ] ; then
|
||
|
||
./certbot-auto certonly --noninteractive \
|
||
--webroot --webroot-path /usr/share/jitsi-meet \
|
||
-d $DOMAIN \
|
||
--agree-tos --email $EMAIL
|
||
|
||
echo "Configuring apache2"
|
||
|
||
CONF_FILE="/etc/apache2/sites-available/$DOMAIN.conf"
|
||
CERT_KEY_ESC=$(echo $CERT_KEY | sed 's/\./\\\./g')
|
||
CERT_KEY_ESC=$(echo $CERT_KEY_ESC | sed 's/\//\\\//g')
|
||
sed -i "s/SSLCertificateKeyFile\ \/etc\/jitsi\/meet\/.*key/SSLCertificateKeyFile\ $CERT_KEY_ESC/g" \
|
||
$CONF_FILE
|
||
CERT_CRT_ESC=$(echo $CERT_CRT | sed 's/\./\\\./g')
|
||
CERT_CRT_ESC=$(echo $CERT_CRT_ESC | sed 's/\//\\\//g')
|
||
sed -i "s/SSLCertificateFile\ \/etc\/jitsi\/meet\/.*crt/SSLCertificateFile\ $CERT_CRT_ESC/g" \
|
||
$CONF_FILE
|
||
|
||
echo "service apache2 reload" >> $CRON_FILE
|
||
service apache2 reload
|
||
else
|
||
service jitsi-videobridge stop
|
||
|
||
./certbot-auto certonly --noninteractive \
|
||
--standalone \
|
||
-d $DOMAIN \
|
||
--agree-tos --email $EMAIL
|
||
|
||
echo "Configuring jetty"
|
||
|
||
CERT_P12="/etc/jitsi/videobridge/$DOMAIN.p12"
|
||
CERT_JKS="/etc/jitsi/videobridge/$DOMAIN.jks"
|
||
# create jks from certs
|
||
openssl pkcs12 -export \
|
||
-in $CERT_CRT -inkey $CERT_KEY -passout pass:changeit > $CERT_P12
|
||
keytool -importkeystore -destkeystore $CERT_JKS \
|
||
-srckeystore $CERT_P12 -srcstoretype pkcs12 \
|
||
-noprompt -storepass changeit -srcstorepass changeit
|
||
|
||
service jitsi-videobridge start
|
||
|
||
fi
|
||
|
||
# the cron file that will renew certificates
|
||
chmod a+x $CRON_FILE
|