diff --git a/group_vars/all/09_networks.yml b/group_vars/all/09_networks.yml index f8f9a901..5f02de54 100644 --- a/group_vars/all/09_networks.yml +++ b/group_vars/all/09_networks.yml @@ -110,6 +110,8 @@ defaults_networks: subnet: 192.168.104.16/28 web-app-minio: subnet: 192.168.104.32/28 + web-svc-coturn: + subnet: 192.168.104.48/28 # /24 Networks / 254 Usable Clients web-app-bigbluebutton: diff --git a/group_vars/all/10_ports.yml b/group_vars/all/10_ports.yml index 6991c181..8c4c5200 100644 --- a/group_vars/all/10_ports.yml +++ b/group_vars/all/10_ports.yml @@ -84,16 +84,22 @@ ports: public: # The following ports should be changed to 22 on the subdomain via stream mapping ssh: - web-app-gitea: 2201 - web-app-gitlab: 2202 + web-app-gitea: 2201 + web-app-gitlab: 2202 ldaps: - svc-db-openldap: 636 + svc-db-openldap: 636 stun: - web-app-bigbluebutton: 3478 # Not sure if it's right placed here or if it should be moved to localhost section - # Occupied by BBB: 3479 - web-app-nextcloud: 3480 + web-app-bigbluebutton: 3478 # Not sure if it's right placed here or if it should be moved to localhost section + # Occupied by BBB: 3479 + web-app-nextcloud: 3480 + web-app-coturn: 3481 turn: - web-app-bigbluebutton: 5349 # Not sure if it's right placed here or if it should be moved to localhost section - web-app-nextcloud: 5350 # Not used yet + web-app-bigbluebutton: 5349 # Not sure if it's right placed here or if it should be moved to localhost section + web-app-nextcloud: 5350 # Not used yet + web-app-coturn: 5351 federation: web-app-matrix_synapse: 8448 + relay_port_ranges: + web-app-coturn_start: 49152 + web-app-coturn_end: 65535 + diff --git a/roles/web-svc-coturn/TODO.md b/roles/web-svc-coturn/TODO.md deleted file mode 100644 index eb5bfbde..00000000 --- a/roles/web-svc-coturn/TODO.md +++ /dev/null @@ -1,2 +0,0 @@ -# Todo -- Implement this role \ No newline at end of file diff --git a/roles/web-svc-coturn/config/main.yml.j2 b/roles/web-svc-coturn/config/main.yml.j2 index b619dff3..ba03ed68 100644 --- a/roles/web-svc-coturn/config/main.yml.j2 +++ b/roles/web-svc-coturn/config/main.yml.j2 @@ -1,2 +1,13 @@ -user: turnuser -credentials: \ No newline at end of file +server: + domains: + canonical: + - "coturn.{{ PRIMARY_DOMAIN }}" +docker: + services: + coturn: + image: "coturn/coturn" + version: "latest" + redis: + enabled: false + database: + enabled: false \ No newline at end of file diff --git a/roles/web-svc-coturn/schema/main.yml b/roles/web-svc-coturn/schema/main.yml new file mode 100644 index 00000000..8b2761e7 --- /dev/null +++ b/roles/web-svc-coturn/schema/main.yml @@ -0,0 +1,9 @@ +credentials: + user_password: + description: "Long-Term Credential password for clients" + algorithm: "alphanumeric_32" + validation: "^[A-Za-z0-9]{32}$" + auth_secret: + description: "TURN-REST static auth secret" + algorithm: "sha1" + validation: "^[a-f0-9]{40}$" \ No newline at end of file diff --git a/roles/web-svc-coturn/tasks/main.yml b/roles/web-svc-coturn/tasks/main.yml index 0448185f..2d9c3f2f 100644 --- a/roles/web-svc-coturn/tasks/main.yml +++ b/roles/web-svc-coturn/tasks/main.yml @@ -1,4 +1,4 @@ --- -- name: "load docker, db and proxy for {{ application_id }}" +- name: "For '{{ application_id }}': Load sys-stk-back-stateless" include_role: - name: sys-stk-full-stateful + name: sys-stk-back-stateless diff --git a/roles/web-svc-coturn/templates/docker-compose.yml.j2 b/roles/web-svc-coturn/templates/docker-compose.yml.j2 index d6f9a705..a1b9df6d 100644 --- a/roles/web-svc-coturn/templates/docker-compose.yml.j2 +++ b/roles/web-svc-coturn/templates/docker-compose.yml.j2 @@ -2,44 +2,38 @@ coturn: {% include 'roles/docker-container/templates/base.yml.j2' %} - image: coturn/coturn - restart: always - network_mode: "host" + image: {{ COTURN_IMAGE }}:{{ COTURN_VERSION }} + container_name: {{ COTURN_VOLUME }} + {% include 'roles/docker-container/templates/base.yml.j2' %} ports: - - "3478:3478/udp" - - "3478:3478/tcp" - - "5349:5349/tcp" - - "5349:5349/udp" - - "49152-65535:49152-65535/udp" # TURN-Relay-Ports (wichtig!) - #volumes: # In case customized config is required - # - coturn-config:/etc/coturn - environment: - - TURN_PORT=3478 - - TURN_PORT_TLS=5349 - - TURN_SECRET=my-secret-key - - TURN_USER=turnuser - - TURN_PASSWORD=turnpassword + - "{{ COTURN_TURN_PORT }}:{{ COTURN_TURN_PORT }}/udp" + - "{{ COTURN_TURN_PORT }}:{{ COTURN_TURN_PORT }}/tcp" + - "{{ COTURN_STUN_PORT }}:{{ COTURN_STUN_PORT }}/tcp" + - "{{ COTURN_STUN_PORT }}:{{ COTURN_STUN_PORT }}/udp" + - "{{ COTURN_RELAY_PORT_RANGE }}/udp" command: > - --log-file=stdout - --external-ip=$(detect-external-ip) + --use-auth-secret + --static-auth-secret={{ COTURN_STATIC_AUTH_SECRET }} --lt-cred-mech - --user=turnuser:turnpassword - --realm=nextcloud + --user={{ COTURN_USER_NAME }}:{{ COTURN_USER_PASSWORD }} + --log-file=stdout + --external-ip={{ networks.internet.ip4 }} +{% if networks.internet.ip6|default('') %} + --external-ip={{ networks.internet.ip6 }} +{% endif %} + --realm={{ COTURN_REALM }} + --fingerprint --total-quota=100 --stale-nonce --no-multicast-peers - --denied-peer-ip=0.0.0.0-0.255.255.255 - --denied-peer-ip=10.0.0.0-10.255.255.255 - --denied-peer-ip=100.64.0.0-100.127.255.255 - --denied-peer-ip=169.254.0.0-169.254.255.255 - --denied-peer-ip=172.16.0.0-172.31.255.255 - --denied-peer-ip=192.0.0.0-192.0.0.255 - --denied-peer-ip=192.88.99.0-192.88.99.255 - --denied-peer-ip=192.168.0.0-192.168.255.255 - --denied-peer-ip=198.18.0.0-198.19.255.255 - --denied-peer-ip=198.51.100.0-198.51.100.255 - --denied-peer-ip=203.0.113.0-203.0.113.255 - --denied-peer-ip=240.0.0.0-255.255.255.255 + --no-cli + --no-tcp-relay + --min-port={{ COTURN_RELAY_PORT_START }} + --max-port={{ COTURN_RELAY_PORT_END }} + --cert={{ COTURN_TLS_CERT_PATH }} + --pkey={{ COTURN_TLS_KEY_PATH }} + --cipher-list=DEFAULT + --dh2066 +{% include 'roles/docker-container/templates/networks.yml.j2' %} -{% include 'roles/docker-compose/templates/volumes.yml.j2' %} - coturn-config: +{% include 'roles/docker-compose/templates/networks.yml.j2' %} diff --git a/roles/web-svc-coturn/templates/env.j2 b/roles/web-svc-coturn/templates/env.j2 deleted file mode 100644 index e69de29b..00000000 diff --git a/roles/web-svc-coturn/vars/main.yml b/roles/web-svc-coturn/vars/main.yml index 4f168026..84f119cf 100644 --- a/roles/web-svc-coturn/vars/main.yml +++ b/roles/web-svc-coturn/vars/main.yml @@ -1,2 +1,28 @@ -application_id: "web-svc-coturn" -container_port: 3000 +# General +application_id: "web-svc-coturn" +entity_name: "{{ application_id | get_entity_name }}" +domain: "{{ domains | get_domain(application_id) }}" + +# Coturn + +## Docker +COTURN_VERSION: "{{ applications | get_app_conf(application_id, 'docker.services.' ~ entity_name ~ '.version') }}" +COTURN_IMAGE: "{{ applications | get_app_conf(application_id, 'docker.services.' ~ entity_name ~ '.image') }}" +COTURN_VOLUME: "{{ entity_name }}" +COTURN_REALM: "{{ domain }}" + +## Ports +COTURN_TURN_PORT: "{{ ports.public.turn[application_id] }}" +COTURN_STUN_PORT: "{{ ports.public.stun[application_id] }}" +COTURN_RELAY_PORT_START: "{{ ports.public.relay_port_ranges[application_id ~ '_start'] }}" +COTURN_RELAY_PORT_END: "{{ ports.public.relay_port_ranges[application_id ~ '_end' ] }}" +COTURN_RELAY_PORT_RANGE: "{{ COTURN_RELAY_PORT_START }}-{{ COTURN_RELAY_PORT_END }}" + +## Credentials +COTURN_USER_NAME: "{{ applications | get_app_conf(application_id, 'credentials.user_name') }}" +COTURN_USER_PASSWORD: "{{ applications | get_app_conf(application_id, 'credentials.user_password') }}" +COTURN_STATIC_AUTH_SECRET: "{{ applications | get_app_conf(application_id, 'credentials.auth_secret') }}" + +## Certificates +COTURN_TLS_CERT_PATH: "{{ [ LETSENCRYPT_LIVE_PATH, ssl_cert_folder, 'fullchain.pem' ] | path_join }}" +COTURN_TLS_KEY_PATH: "{{ [ LETSENCRYPT_LIVE_PATH, ssl_cert_folder, 'privkey.pem' ] | path_join }}" \ No newline at end of file