Nextcloud Talk: fix virtual-background web check by

- adding explicit MIME types for .wasm and .tflite in internal Nginx
- relaxing CSP (script-src: allow 'unsafe-eval') for WebAssembly
- removing obsolete turnserver draft.
Details: https://chatgpt.com/share/68d7dd39-50b8-800f-ab59-cfb1d3cf07cb

roles/web-app-bigbluebutton/templates/docker-compose.override.yml.j2

@@ -21,7 +21,6 @@ services:
       --fingerprint
       --no-multicast-peers
       --no-cli
-      --no-tcp-relay
       --min-port={{ BBB_RELAY_PORT_START }}
       --max-port={{ BBB_RELAY_PORT_END }}
       --external-ip=${EXTERNAL_IPv4}

roles/web-app-nextcloud/README.md

@@ -26,7 +26,6 @@ A detailled documentation for the use and administration of Nextcloud on Infinit
 - [Nextcloud Official Website](https://nextcloud.com/)
 - [Nextcloud Docker Documentation](https://github.com/nextcloud/docker)
 - [Nextcloud Admin Manual](https://docs.nextcloud.com/server/latest/admin_manual/)
-- [Nextcloud Admin Manual](https://docs.nextcloud.com/server/latest/admin_manual/)
 - [LDAP Integration Guide](https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html)
 - [OIDC Login Plugin (pulsejet)](https://github.com/pulsejet/nextcloud-oidc-login)
 - [Sociallogin Plugin (Official)](https://apps.nextcloud.com/apps/sociallogin)

roles/web-app-nextcloud/config/main.yml

@@ -6,6 +6,8 @@ server:
         unsafe-inline:  true
       script-src-elem:
         unsafe-inline:  true
+      script-src:
+        unsafe-eval:    true
     whitelist:
       font-src:
         - "data:"

roles/web-app-nextcloud/templates/config/turnserver.config.php.j2.draft

@@ -1,12 +0,0 @@
-<?php
-# Activates the turn server
-# @see https://nextcloud-talk.readthedocs.io/en/latest/TURN/
-
-return 'turn_servers' => [
-    [
-        'host' => 'coturn',
-        'port' => {{ NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT }},
-        'secret' => 'my-secret-key',
-        'protocols' => 'udp,tcp'
-    ]
-];

roles/web-app-nextcloud/templates/docker-compose.yml.j2

@@ -48,8 +48,8 @@
     network_mode: {{ NEXTCLOUD_TALK_NETWORK_MODE }}
 {% if NEXTCLOUD_TALK_NETWORK_MODE == 'bridge' %}
     ports:
-      - {{ networks.internet.ip4 }}:{{ NEXTCLOUD_TALK_STUN_PORT }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT }}/tcp
+      - {{ networks.internet.ip4 }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}/tcp
-      - {{ networks.internet.ip4 }}:{{ NEXTCLOUD_TALK_STUN_PORT }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT }}/udp
+      - {{ networks.internet.ip4 }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}/udp
       - {{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_RANGE }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_RANGE }}/udp
     expose:
       - "{{ container_port }}"

roles/web-app-nextcloud/templates/env.j2

@@ -47,7 +47,7 @@ TURN_SECRET={{ NEXTCLOUD_TALK_TURN_ONBOARD_SECRET }}
 SIGNALING_SECRET={{ NEXTCLOUD_TALK_SIGNALING_SECRET }}
 INTERNAL_SECRET={{ NEXTCLOUD_TALK_INTERNAL_SECRET }}
 TZ={{ HOST_TIMEZONE }}
-TALK_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT }}
+TALK_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}
 TURN_MIN_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_START }}
 TURN_MAX_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_END }}
 COTURN_MIN_PORT={{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_START }}

roles/web-app-nextcloud/templates/nginx/docker.conf.j2

@@ -19,6 +19,8 @@ http {
     default_type  application/octet-stream;
     types {
         application/javascript   mjs;
+        application/wasm         wasm;
+        application/octet-stream tflite;
     }
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '

roles/web-app-nextcloud/vars/main.yml

@@ -66,7 +66,7 @@ NEXTCLOUD_TALK_VERSION:               "{{ applications | get_app_conf(applicatio
 NEXTCLOUD_TALK_PLUGIN_ENABLED:        "{{ applications | get_app_conf(application_id, 'plugins.spreed.enabled') }}"
 NEXTCLOUD_TALK_NETWORK_MODE:          "{{ applications | get_app_conf(application_id, 'docker.services.talk.network_mode') }}"
 NEXTCLOUD_TALK_INTERNAL_SECRET:       "{{ applications | get_app_conf(application_id, 'credentials.talk_internal_secret') }}"
-NEXTCLOUD_TALK_DOMAIN:                "{{ NEXTCLOUD_DOMAIN if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED else (domains | get_domain(NEXTCLOUD_TALK_TURN_STANDALONE_ROLE)) }}"
+NEXTCLOUD_TALK_DOMAIN:                "{{ NEXTCLOUD_DOMAIN }}"
 
 #### Signaling
 NEXTCLOUD_TALK_SIGNALING_SECRET:      "{{ applications | get_app_conf(application_id, 'credentials.talk_signaling_secret') }}"
@@ -74,20 +74,40 @@ NEXTCLOUD_TALK_SIGNALING_LOCATION:    "/standalone-signaling/"
 NEXTCLOUD_TALK_SIGNALING_PORT:        "8081"
 NEXTCLOUD_TALK_SIGNALING_URL:         "{{ [ NEXTCLOUD_URL, NEXTCLOUD_TALK_SIGNALING_LOCATION ] | url_join }}"
 
-#### Turn (Onboard)
+#### Talk Turn (Onboard)
+NEXTCLOUD_TALK_TURN_ONBOARD_PORT:             "{{ ports.public.stun_turn[application_id] }}"
 NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED:          "{{ applications | get_app_conf(application_id, 'docker.services.talk.turn_server.onboard_enabled') if NEXTCLOUD_TALK_PLUGIN_ENABLED else false }}"
-NEXTCLOUD_TALK_TURN_ONBOARD_SECRET:           "{{ applications | get_app_conf(application_id, 'credentials.talk_turn_secret') if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED else applications | get_app_conf(NEXTCLOUD_TALK_TURN_STANDALONE_ROLE, 'credentials.auth_secret') }}"
+NEXTCLOUD_TALK_TURN_ONBOARD_SECRET:           "{{ applications | get_app_conf(application_id, 'credentials.talk_turn_secret') }}"
-NEXTCLOUD_TALK_TURN_ONBOARD_STUN_PORT:        "{{ ports.public.stun_turn[application_id] }}"
 NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_START: "{{ ports.public.relay_port_ranges[application_id ~ '_start'] }}"
 NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_END:   "{{ ports.public.relay_port_ranges[application_id ~ '_end'  ] }}"
 NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_RANGE: "{{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_START }}-{{ NEXTCLOUD_TALK_TURN_ONBOARD_RELAY_PORT_END }}"
-
+NEXTCLOUD_TALK_STUN_ONBOARD_CONFIG:           "{{ NEXTCLOUD_TALK_DOMAIN }}:{{ NEXTCLOUD_TALK_TURN_ONBOARD_PORT }}"
-#### Stun
+NEXTCLOUD_TALK_TURN_ONBOARD_CONFIG: >-
-NEXTCLOUD_TALK_STUN_PORT:                     "{{ ports.public.stun_turn[application_id] if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED else ports.public.stun_turn[NEXTCLOUD_TALK_TURN_STANDALONE_ROLE] }}"
+  {{
+    {
+      'server': NEXTCLOUD_TALK_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_TURN_ONBOARD_PORT,
+      'secret': NEXTCLOUD_TALK_TURN_ONBOARD_SECRET,
+      'ttl': 86400,
+      'protocols': 'udp,tcp'
+    }
+  }}
 
 #### Coturn (Standalone)
 NEXTCLOUD_TALK_TURN_STANDALONE_ROLE:          'web-svc-coturn'
+NEXTCLOUD_TALK_TURN_STANDALONE_PORT:          "{{ ports.public.stun_turn[NEXTCLOUD_TALK_TURN_STANDALONE_ROLE] }}"
+NEXTCLOUD_TALK_TURN_STANDALONE_SECRET:        "{{ applications | get_app_conf(NEXTCLOUD_TALK_TURN_STANDALONE_ROLE, 'credentials.auth_secret') }}"
 NEXTCLOUD_TALK_TURN_STANDALONE_ENABLED:       "{{ applications | get_app_conf(application_id, 'docker.services.talk.turn_server.standalone_enabled') if NEXTCLOUD_TALK_PLUGIN_ENABLED else false }}"
+NEXTCLOUD_TALK_TURN_STANDALONE_DOMAIN:        "{{ domains | get_domain(NEXTCLOUD_TALK_TURN_STANDALONE_ROLE) }}"
+NEXTCLOUD_TALK_STUN_STANDALONE_CONFIG:        "{{ NEXTCLOUD_TALK_TURN_STANDALONE_DOMAIN }}:{{ NEXTCLOUD_TALK_TURN_STANDALONE_PORT }}"
+NEXTCLOUD_TALK_TURN_STANDALONE_CONFIG: >-
+  {{
+    {
+      'server': NEXTCLOUD_TALK_TURN_STANDALONE_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_TURN_STANDALONE_PORT,
+      'secret': NEXTCLOUD_TALK_TURN_STANDALONE_SECRET,
+      'ttl': 86400,
+      'protocols': 'udp,tcp'
+    }
+  }}
 
 ### Whiteboard
 NEXTCLOUD_WHITEBOARD_CONTAINER:     "{{ applications | get_app_conf(application_id, 'docker.services.whiteboard.name') }}"

roles/web-app-nextcloud/vars/plugins/spreed.yml

@@ -10,21 +10,30 @@ plugin_configuration:
   # stun_servers: JSON array of strings
   - appid: "spreed"
     configkey: "stun_servers"
-    configvalue: "{{ [
+    configvalue: >-
-        NEXTCLOUD_TALK_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_STUN_PORT
+      {{
-      ] | to_json }}"
+        [
+          NEXTCLOUD_TALK_STUN_ONBOARD_CONFIG     if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED    else none,
+          NEXTCLOUD_TALK_STUN_STANDALONE_CONFIG  if NEXTCLOUD_TALK_TURN_STANDALONE_ENABLED else none
+        ]
+        | select
+        | list
+        | to_json
+      }}
 
   # turn_servers: JSON array of objects
   - appid: "spreed"
     configkey: "turn_servers"
-    configvalue: "{{ [
+    configvalue: >-
-        {
+      {{
-          'server': NEXTCLOUD_TALK_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_STUN_PORT ~ '?transport=udp',
+        [
-          'secret': NEXTCLOUD_TALK_TURN_ONBOARD_SECRET,
+          NEXTCLOUD_TALK_TURN_ONBOARD_CONFIG     if NEXTCLOUD_TALK_TURN_ONBOARD_ENABLED    else none,
-          'ttl': 86400,
+          NEXTCLOUD_TALK_TURN_STANDALONE_CONFIG  if NEXTCLOUD_TALK_TURN_STANDALONE_ENABLED else none
-          'protocols': 'udp,tcp'
+        ]
-        }
+        | select
-      ] | to_json }}"
+        | list
+        | to_json
+      }}
 
   # internal secret (plain string)
   - appid: "spreed"

roles/web-svc-coturn/config/main.yml

@@ -8,6 +8,7 @@ docker:
     coturn:
       image:              "coturn/coturn"
       version:            "latest"
+      user_auth_enabled:  false
       cpus:               1.0
       mem_reservation:    512m
       mem_limit:          1g

roles/web-svc-coturn/templates/docker-compose.yml.j2

@@ -10,7 +10,6 @@
       - "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/udp"
       - "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/tcp"
       - "{{ COTURN_STUN_TURN_PORT_TLS }}:{{ COTURN_STUN_TURN_PORT_TLS }}/tcp"
-      - "{{ COTURN_STUN_TURN_PORT_TLS }}:{{ COTURN_STUN_TURN_PORT_TLS }}/udp"
       - "{{ COTURN_RELAY_PORT_RANGE }}/udp"
 {% include 'roles/docker-container/templates/networks.yml.j2' %}
 {% endif %}
@@ -18,10 +17,13 @@
       - "{{ COTURN_TLS_CERT_PATH }}:{{ COTURN_TLS_CERT_PATH }}:ro"
       - "{{ COTURN_TLS_KEY_PATH }}:{{ COTURN_TLS_KEY_PATH }}:ro"
     command: >
-      --use-auth-secret
+{% if COTURN_USER_AUTH_ENABLED | bool %}
-      --static-auth-secret="${COTURN_STATIC_AUTH_SECRET}"
       --lt-cred-mech
       --user="${COTURN_USER_NAME}:${COTURN_USER_PASSWORD}"
+{% else %}
+      --use-auth-secret
+      --static-auth-secret="${COTURN_STATIC_AUTH_SECRET}"
+{% endif %}
       --log-file=stdout
       --external-ip={{ networks.internet.ip4 }}
 {% if networks.internet.ip6|default('') %}
@@ -33,7 +35,6 @@
       --stale-nonce
       --no-multicast-peers
       --no-cli
-      --no-tcp-relay
       --listening-port={{ COTURN_STUN_TURN_PORT }}
       --tls-listening-port={{ COTURN_STUN_TURN_PORT_TLS }}
       --min-port={{ COTURN_RELAY_PORT_START }}

roles/web-svc-coturn/vars/main.yml

@@ -23,6 +23,7 @@ COTURN_RELAY_PORT_RANGE:    "{{ COTURN_RELAY_PORT_START }}-{{ COTURN_RELAY_PORT_
 COTURN_USER_NAME:           "{{ applications | get_app_conf(application_id, 'username') }}"
 COTURN_USER_PASSWORD:       "{{ applications | get_app_conf(application_id, 'credentials.user_password') }}"
 COTURN_STATIC_AUTH_SECRET:  "{{ applications | get_app_conf(application_id, 'credentials.auth_secret') }}"
+COTURN_USER_AUTH_ENABLED:   "{{ applications | get_app_conf(application_id, 'docker.services.' ~ entity_name ~ '.user_auth_enabled') }}"
 
 ## Certificates
 COTURN_TLS_CERT_PATH:       "{{ [ LETSENCRYPT_LIVE_PATH, ssl_cert_folder, 'fullchain.pem' ] | path_join }}"