Nextcloud Talk: fix virtual-background web check by

- adding explicit MIME types for .wasm and .tflite in internal Nginx - relaxing CSP (script-src: allow 'unsafe-eval') for WebAssembly - removing obsolete turnserver draft. Details: https://chatgpt.com/share/68d7dd39-50b8-800f-ab59-cfb1d3cf07cb
Refactor TURN/STUN config:
2025-11-18 11:06:29 +00:00 · 2025-09-27 14:49:42 +02:00 · 2025-09-27 14:18:29 +02:00 · 2025-09-27 13:58:46 +02:00 · 2025-09-27 13:51:17 +02:00
12 changed files with 98 additions and 76 deletions
--- a/roles/web-app-bigbluebutton/templates/docker-compose.override.yml.j2
+++ b/roles/web-app-bigbluebutton/templates/docker-compose.override.yml.j2
@@ -21,7 +21,6 @@ services:
      --fingerprint
      --no-multicast-peers
      --no-cli
-      --no-tcp-relay
      --min-port={{ BBB_RELAY_PORT_START }}
      --max-port={{ BBB_RELAY_PORT_END }}
      --external-ip=${EXTERNAL_IPv4}
--- a/roles/web-app-nextcloud/README.md
+++ b/roles/web-app-nextcloud/README.md
@@ -26,7 +26,6 @@ A detailled documentation for the use and administration of Nextcloud on Infinit
 - [Nextcloud Official Website](https://nextcloud.com/)
 - [Nextcloud Docker Documentation](https://github.com/nextcloud/docker)
 - [Nextcloud Admin Manual](https://docs.nextcloud.com/server/latest/admin_manual/)
- [Nextcloud Admin Manual](https://docs.nextcloud.com/server/latest/admin_manual/)
 - [LDAP Integration Guide](https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html)
 - [OIDC Login Plugin (pulsejet)](https://github.com/pulsejet/nextcloud-oidc-login)
 - [Sociallogin Plugin (Official)](https://apps.nextcloud.com/apps/sociallogin)
--- a/roles/web-app-nextcloud/config/main.yml
+++ b/roles/web-app-nextcloud/config/main.yml
@@ -3,9 +3,11 @@ server:
  csp:
    flags:
      style-src:
-        unsafe-inline: true
+        unsafe-inline:  true
      script-src-elem:
-        unsafe-inline: true
+        unsafe-inline:  true
+      script-src:
+        unsafe-eval:    true
    whitelist:
      font-src:
        - "data:"
@@ -21,44 +23,44 @@ server:
    aliases: []
 docker:
  volumes:
-    data: nextcloud_data
+    data:                   nextcloud_data
  services:
    redis:
-      enabled: true
+      enabled:              true
    database:
-      enabled: true
+      enabled:              true
    nextcloud:
-      name:               "nextcloud"
-      image:              "nextcloud"
-      version:            "production-fpm-alpine"
+      name:                 "nextcloud"
+      image:                "nextcloud"
+      version:              "production-fpm-alpine"
      backup:
-        no_stop_required: true
-      cpus:               "2.0"
-      mem_reservation:    "2g"
-      mem_limit:          "3g"
-      pids_limit:         512
+        no_stop_required:   true
+      cpus:                 "2.0"
+      mem_reservation:      "2g"
+      mem_limit:            "3g"
+      pids_limit:           512
    proxy: 
-      name:               "nextcloud-proxy"
-      image:              "nginx"
-      version:            "alpine"
+      name:                 "nextcloud-proxy"
+      image:                "nginx"
+      version:              "alpine"
      backup:
-        no_stop_required: true
+        no_stop_required:   true
    cron:
-      name:               "nextcloud-cron"
+      name:                 "nextcloud-cron"
    talk:
-      name:               "nextcloud-talk"
-      image:              "nextcloud/aio-talk"
-      version:            "latest"
+      name:                 "nextcloud-talk"
+      image:                "nextcloud/aio-talk"
+      version:              "latest"
      backup:
-        no_stop_required: false
+        no_stop_required:   false
      turn_server:
        onboard_enabled:    true
        standalone_enabled: true
      network_mode:         host
    whiteboard:
-      name:               "nextcloud-whiteboard"
-      image:              "ghcr.io/nextcloud-releases/whiteboard"
-      version:            "latest"
+      name:                 "nextcloud-whiteboard"
+      image:                "ghcr.io/nextcloud-releases/whiteboard"
+      version:              "latest"
      backup:
        no_stop_required: true
  enabled:  "{{ applications | get_app_conf('web-app-nextcloud', 'features.oidc', False) }}"   # Activate OIDC for Nextcloud
--- a/roles/web-app-nextcloud/templates/config/turnserver.config.php.j2.draft
+++ b/roles/web-app-nextcloud/templates/config/turnserver.config.php.j2.draft
@@ -1,12 +0,0 @@
-<?php
-# Activates the turn server
-# @see https://nextcloud-talk.readthedocs.io/en/latest/TURN/
-
-return 'turn_servers' => [
-    [
-        'host' => 'coturn',
-        'port' => {{ NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT }},
-        'secret' => 'my-secret-key',
-        'protocols' => 'udp,tcp'
-    ]
-];
--- a/roles/web-app-nextcloud/templates/docker-compose.yml.j2
+++ b/roles/web-app-nextcloud/templates/docker-compose.yml.j2
@@ -48,8 +48,8 @@
    network_mode: {{ NEXTCLOUD_TALK_NETWORK_MODE }}
 {% if NEXTCLOUD_TALK_NETWORK_MODE == 'bridge' %}
    ports:
-      - {{ networks.internet.ip4 }}:{{ NEXTCLOUD_TALK_STUN_PORT }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT }}/tcp
-      - {{ networks.internet.ip4 }}:{{ NEXTCLOUD_TALK_STUN_PORT }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT }}/udp
+      - {{ networks.internet.ip4 }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}/tcp
+      - {{ networks.internet.ip4 }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}/udp
      - {{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_RANGE }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_RANGE }}/udp
    expose:
      - "{{ container_port }}"
--- a/roles/web-app-nextcloud/templates/env.j2
+++ b/roles/web-app-nextcloud/templates/env.j2
@@ -47,7 +47,7 @@ TURN_SECRET={{ NEXTCLOUD_TALK_TURN_ONBOARD_SECRET }}
 SIGNALING_SECRET={{ NEXTCLOUD_TALK_SIGNALING_SECRET }}
 INTERNAL_SECRET={{ NEXTCLOUD_TALK_INTERNAL_SECRET }}
 TZ={{ HOST_TIMEZONE }}
-TALK_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT }}
+TALK_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}
 TURN_MIN_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_START }}
 TURN_MAX_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_END }}
 COTURN_MIN_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_START }}
--- a/roles/web-app-nextcloud/templates/nginx/docker.conf.j2
+++ b/roles/web-app-nextcloud/templates/nginx/docker.conf.j2
@@ -18,7 +18,9 @@ http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    types {
-        application/javascript mjs;
+        application/javascript   mjs;
+        application/wasm         wasm;
+        application/octet-stream tflite;
    }
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
--- a/roles/web-app-nextcloud/vars/main.yml
+++ b/roles/web-app-nextcloud/vars/main.yml
@@ -66,7 +66,7 @@ NEXTCLOUD_TALK_VERSION:               "{{ applications | get_app_conf(applicatio
 NEXTCLOUD_TALK_PLUGIN_ENABLED:        "{{ applications | get_app_conf(application_id, 'plugins.spreed.enabled') }}"
 NEXTCLOUD_TALK_NETWORK_MODE:          "{{ applications | get_app_conf(application_id, 'docker.services.talk.network_mode') }}"
 NEXTCLOUD_TALK_INTERNAL_SECRET:       "{{ applications | get_app_conf(application_id, 'credentials.talk_internal_secret') }}"
-NEXTCLOUD_TALK_DOMAIN:                "{{ NEXTCLOUD_DOMAIN if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED else (domains | get_domain(NEXTCLOUD_TALK_TURN_STANDALONE_ROLE)) }}"
+NEXTCLOUD_TALK_DOMAIN:                "{{ NEXTCLOUD_DOMAIN }}"

 #### Signaling
 NEXTCLOUD_TALK_SIGNALING_SECRET:      "{{ applications | get_app_conf(application_id, 'credentials.talk_signaling_secret') }}"
@@ -74,20 +74,40 @@ NEXTCLOUD_TALK_SIGNALING_LOCATION:    "/standalone-signaling/"
 NEXTCLOUD_TALK_SIGNALING_PORT:        "8081"
 NEXTCLOUD_TALK_SIGNALING_URL:         "{{ [ NEXTCLOUD_URL, NEXTCLOUD_TALK_SIGNALING_LOCATION ] | url_join }}"

-#### Turn (Onboard)
-NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED:          "{{ applications | get_app_conf(application_id, 'docker.services.talk.turn_server.onboard_enabled') if NEXTCLOUD_TALK_PLUGIN_ENABLED  else false }}"
-NEXTCLOUD_TALK_TURN_ONBOARD_SECRET:           "{{ applications | get_app_conf(application_id, 'credentials.talk_turn_secret') if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED else applications | get_app_conf(NEXTCLOUD_TALK_TURN_STANDALONE_ROLE, 'credentials.auth_secret') }}"
-NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT:        "{{ ports.public.stun_turn[application_id] }}"
+#### Talk Turn (Onboard)
+NEXTCLOUD_TALK_TURN_ONBOARD_PORT:             "{{ ports.public.stun_turn[application_id] }}"
+NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED:          "{{ applications | get_app_conf(application_id, 'docker.services.talk.turn_server.onboard_enabled') if NEXTCLOUD_TALK_PLUGIN_ENABLED else false }}"
+NEXTCLOUD_TALK_TURN_ONBOARD_SECRET:           "{{ applications | get_app_conf(application_id, 'credentials.talk_turn_secret') }}"
 NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_START: "{{ ports.public.relay_port_ranges[application_id ~ '_start'] }}"
 NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_END:   "{{ ports.public.relay_port_ranges[application_id ~ '_end'  ] }}"
 NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_RANGE: "{{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_START }}-{{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_END }}"
-
-#### Stun
-NEXTCLOUD_TALK_STUN_PORT:                     "{{ ports.public.stun_turn[application_id] if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED else ports.public.stun_turn[NEXTCLOUD_TALK_TURN_STANDALONE_ROLE] }}"
+NEXTCLOUD_TALK_STUN_ONBOARD_CONFIG:           "{{ NEXTCLOUD_TALK_DOMAIN }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}"
+NEXTCLOUD_TALK_TURN_ONBOARD_CONFIG: >-
+  {{
+    {
+      'server': NEXTCLOUD_TALK_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_TURN_ONBOARD_PORT,
+      'secret': NEXTCLOUD_TALK_TURN_ONBOARD_SECRET,
+      'ttl': 86400,
+      'protocols': 'udp,tcp'
+    }
+  }}

 #### Coturn (Standalone)
 NEXTCLOUD_TALK_TURN_STANDALONE_ROLE:          'web-svc-coturn'
-NEXTCLOUD_TALK_TURN_STANDALONE_ENABLED:       "{{ applications | get_app_conf(application_id, 'docker.services.talk.turn_server.standalone_enabled') if NEXTCLOUD_TALK_PLUGIN_ENABLED  else false }}"
+NEXTCLOUD_TALK_TURN_STANDALONE_PORT:          "{{ ports.public.stun_turn[NEXTCLOUD_TALK_TURN_STANDALONE_ROLE] }}"
+NEXTCLOUD_TALK_TURN_STANDALONE_SECRET:        "{{ applications | get_app_conf(NEXTCLOUD_TALK_TURN_STANDALONE_ROLE, 'credentials.auth_secret') }}"
+NEXTCLOUD_TALK_TURN_STANDALONE_ENABLED:       "{{ applications | get_app_conf(application_id, 'docker.services.talk.turn_server.standalone_enabled') if NEXTCLOUD_TALK_PLUGIN_ENABLED else false }}"
+NEXTCLOUD_TALK_TURN_STANDALONE_DOMAIN:        "{{ domains | get_domain(NEXTCLOUD_TALK_TURN_STANDALONE_ROLE) }}"
+NEXTCLOUD_TALK_STUN_STANDALONE_CONFIG:        "{{ NEXTCLOUD_TALK_TURN_STANDALONE_DOMAIN }}:{{ NEXTCLOUD_TALK_TURN_STANDALONE_PORT }}"
+NEXTCLOUD_TALK_TURN_STANDALONE_CONFIG: >-
+  {{
+    {
+      'server': NEXTCLOUD_TALK_TURN_STANDALONE_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_TURN_STANDALONE_PORT,
+      'secret': NEXTCLOUD_TALK_TURN_STANDALONE_SECRET,
+      'ttl': 86400,
+      'protocols': 'udp,tcp'
+    }
+  }}

 ### Whiteboard
 NEXTCLOUD_WHITEBOARD_CONTAINER:     "{{ applications | get_app_conf(application_id, 'docker.services.whiteboard.name') }}"
--- a/roles/web-app-nextcloud/vars/plugins/spreed.yml
+++ b/roles/web-app-nextcloud/vars/plugins/spreed.yml
@@ -10,21 +10,30 @@ plugin_configuration:
  # stun_servers: JSON array of strings
  - appid: "spreed"
    configkey: "stun_servers"
-    configvalue: "{{ [
-        NEXTCLOUD_TALK_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_STUN_PORT
-      ] | to_json }}"
+    configvalue: >-
+      {{
+        [
+          NEXTCLOUD_TALK_STUN_ONBOARD_CONFIG     if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED    else none,
+          NEXTCLOUD_TALK_STUN_STANDALONE_CONFIG  if NEXTCLOUD_TALK_TURN_STANDALONE_ENABLED else none
+        ]
+        | select
+        | list
+        | to_json
+      }}

  # turn_servers: JSON array of objects
  - appid: "spreed"
    configkey: "turn_servers"
-    configvalue: "{{ [
-        {
-          'server': NEXTCLOUD_TALK_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_STUN_PORT ~ '?transport=udp',
-          'secret': NEXTCLOUD_TALK_TURN_ONBOARD_SECRET,
-          'ttl': 86400,
-          'protocols': 'udp,tcp'
-        }
-      ] | to_json }}"
+    configvalue: >-
+      {{
+        [
+          NEXTCLOUD_TALK_TURN_ONBOARD_CONFIG     if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED    else none,
+          NEXTCLOUD_TALK_TURN_STANDALONE_CONFIG  if NEXTCLOUD_TALK_TURN_STANDALONE_ENABLED else none
+        ]
+        | select
+        | list
+        | to_json
+      }}

  # internal secret (plain string)
  - appid: "spreed"
--- a/roles/web-svc-coturn/config/main.yml
+++ b/roles/web-svc-coturn/config/main.yml
@@ -6,14 +6,15 @@ server:
 docker:
  services:
    coturn:
-      image:            "coturn/coturn"
-      version:          "latest"
-      cpus:             1.0
-      mem_reservation:  512m
-      mem_limit:        1g
-      pids_limit:       256
-      network_mode:     host
+      image:              "coturn/coturn"
+      version:            "latest"
+      user_auth_enabled:  false
+      cpus:               1.0
+      mem_reservation:    512m
+      mem_limit:          1g
+      pids_limit:         256
+      network_mode:       host
    redis:
-      enabled:  false
+      enabled:            false
    database: 
-      enabled:  false
+      enabled:            false
--- a/roles/web-svc-coturn/templates/docker-compose.yml.j2
+++ b/roles/web-svc-coturn/templates/docker-compose.yml.j2
@@ -10,7 +10,6 @@
      - "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/udp"
      - "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/tcp"
      - "{{ COTURN_STUN_TURN_PORT_TLS }}:{{ COTURN_STUN_TURN_PORT_TLS }}/tcp"
-      - "{{ COTURN_STUN_TURN_PORT_TLS }}:{{ COTURN_STUN_TURN_PORT_TLS }}/udp"
      - "{{ COTURN_RELAY_PORT_RANGE }}/udp"
 {% include 'roles/docker-container/templates/networks.yml.j2' %}
 {% endif %}
@@ -18,10 +17,13 @@
      - "{{ COTURN_TLS_CERT_PATH }}:{{ COTURN_TLS_CERT_PATH }}:ro"
      - "{{ COTURN_TLS_KEY_PATH }}:{{ COTURN_TLS_KEY_PATH }}:ro"
    command: >
-      --use-auth-secret
-      --static-auth-secret="${COTURN_STATIC_AUTH_SECRET}"
+{% if COTURN_USER_AUTH_ENABLED | bool %}
      --lt-cred-mech
      --user="${COTURN_USER_NAME}:${COTURN_USER_PASSWORD}"
+{% else %}
+      --use-auth-secret
+      --static-auth-secret="${COTURN_STATIC_AUTH_SECRET}"
+{% endif %}
      --log-file=stdout
      --external-ip={{ networks.internet.ip4 }}
 {% if networks.internet.ip6|default('') %}
@@ -33,7 +35,6 @@
      --stale-nonce
      --no-multicast-peers
      --no-cli
-      --no-tcp-relay
      --listening-port={{ COTURN_STUN_TURN_PORT }}
      --tls-listening-port={{ COTURN_STUN_TURN_PORT_TLS }}
      --min-port={{ COTURN_RELAY_PORT_START }}
--- a/roles/web-svc-coturn/vars/main.yml
+++ b/roles/web-svc-coturn/vars/main.yml
@@ -23,6 +23,7 @@ COTURN_RELAY_PORT_RANGE:    "{{ COTURN_RELAY_PORT_START }}-{{ COTURN_RELAY_PORT_
 COTURN_USER_NAME:           "{{ applications | get_app_conf(application_id, 'username') }}"
 COTURN_USER_PASSWORD:       "{{ applications | get_app_conf(application_id, 'credentials.user_password') }}"
 COTURN_STATIC_AUTH_SECRET:  "{{ applications | get_app_conf(application_id, 'credentials.auth_secret') }}"
+COTURN_USER_AUTH_ENABLED:   "{{ applications | get_app_conf(application_id, 'docker.services.' ~ entity_name ~ '.user_auth_enabled') }}"

 ## Certificates
 COTURN_TLS_CERT_PATH:       "{{ [ LETSENCRYPT_LIVE_PATH, ssl_cert_folder, 'fullchain.pem' ] | path_join }}"
Author	SHA1	Message	Date
Kevin Veen-Birkenbach	fc59c64273	Nextcloud Talk: fix virtual-background web check by - adding explicit MIME types for .wasm and .tflite in internal Nginx - relaxing CSP (script-src: allow 'unsafe-eval') for WebAssembly - removing obsolete turnserver draft. Details: https://chatgpt.com/share/68d7dd39-50b8-800f-ab59-cfb1d3cf07cb	2025-09-27 14:49:42 +02:00
Kevin Veen-Birkenbach	dbbb3510f3	Refactor TURN/STUN config: - Removed ?transport=udp from Nextcloud Talk TURN server definitions - Dropped --no-tcp-relay to allow TCP fallback - Removed invalid UDP mapping on TLS port - Introduced switch between REST secret auth and lt-cred-mech via COTURN_USER_AUTH_ENABLED - Added user_auth_enabled flag in coturn config for flexibility See: https://chatgpt.com/share/68d7d601-3558-800f-bc84-00d7e8fc3243	2025-09-27 14:18:29 +02:00
Kevin Veen-Birkenbach	eb3bf543a4	Removed turn and stun protocol prefix	2025-09-27 13:58:46 +02:00
Kevin Veen-Birkenbach	4f5602c791	Nextcloud Talk: fix TURN/STUN config - Removed duplicate Admin Manual link in README - Fixed turnserver.config.php draft return syntax - Unified onboard port handling in docker-compose and env - Updated vars to define STUN/TURN configs with correct schemas - Ensured spreed plugin config serializes clean JSON arrays Ref: https://chatgpt.com/share/68d7cfa2-7378-800f-9ecf-09b6bb768f13	2025-09-27 13:51:17 +02:00