first commit
This commit is contained in:
olli
commit
dc401edc2e
260
turn.yml
Normal file
260
turn.yml
Normal file
@ -0,0 +1,260 @@
|
|||||||
|
---
|
||||||
|
- name: turn
|
||||||
|
hosts: all
|
||||||
|
tasks:
|
||||||
|
|
||||||
|
- name: Create /home/docker/turn.{{inventory_hostname}} dir
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /home/docker/turn.{{inventory_hostname}}
|
||||||
|
owner: root
|
||||||
|
group: docker
|
||||||
|
state: directory
|
||||||
|
mode: '0550'
|
||||||
|
|
||||||
|
- name: Create /home/docker/turn.{{inventory_hostname}}/coturn dir
|
||||||
|
ansible.builtin.file:
|
||||||
|
path: /home/docker/turn.{{inventory_hostname}}/coturn
|
||||||
|
owner: nobody
|
||||||
|
group: docker
|
||||||
|
state: directory
|
||||||
|
mode: '0550'
|
||||||
|
|
||||||
|
- name: /home/docker/turn.{{inventory_hostname}}/coturn/turnserver.conf
|
||||||
|
blockinfile:
|
||||||
|
path: /home/docker/turn.{{inventory_hostname}}/coturn/turnserver.conf
|
||||||
|
mode: "0400"
|
||||||
|
owner: nobody
|
||||||
|
group: root
|
||||||
|
create: yes
|
||||||
|
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||||
|
block: |
|
||||||
|
use-auth-secret
|
||||||
|
realm=turn.{{inventory_hostname}}
|
||||||
|
listening-port=3479
|
||||||
|
tls-listening-port=5349
|
||||||
|
min-port=49160
|
||||||
|
max-port=49200
|
||||||
|
verbose
|
||||||
|
allow-loopback-peers
|
||||||
|
log-file=stdout
|
||||||
|
new-log-timestamp
|
||||||
|
tls-listening-port=5349
|
||||||
|
cert=/etc/coturn/cert.pem
|
||||||
|
pkey=/etc/coturn/key.pem
|
||||||
|
backup: yes
|
||||||
|
|
||||||
|
- name: /home/docker/turn.{{inventory_hostname}}/genpw.sh (generate Random PW for Turn)
|
||||||
|
blockinfile:
|
||||||
|
path: /home/docker/turn.{{inventory_hostname}}/genpw.sh
|
||||||
|
create: yes
|
||||||
|
mode: 0550
|
||||||
|
owner: root
|
||||||
|
group: docker
|
||||||
|
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||||
|
block: |
|
||||||
|
cd /home/docker/turn.{{inventory_hostname}}
|
||||||
|
turn_secret=$(pwgen -s 32 1)
|
||||||
|
turn_cli_secret=$(pwgen -s 32 1)
|
||||||
|
|
||||||
|
[ -f env ] || echo "TURN_SECRET=!TURN_SECRET!
|
||||||
|
TURN_CLI_SECRET=!TURN_CLI_SECRET!
|
||||||
|
" >env
|
||||||
|
|
||||||
|
chmod 440 env
|
||||||
|
chown root:docker env
|
||||||
|
sed -i "s/\!TURN_SECRET\!/$turn_secret/g" env
|
||||||
|
sed -i "s/\!TURN_CLI_SECRET\!/$turn_cli_secret/g" env
|
||||||
|
|
||||||
|
. ./env
|
||||||
|
grep -q 'static-auth-secret=' coturn/turnserver.conf || echo "static-auth-secret=$TURN_SECRET" >>coturn/turnserver.conf
|
||||||
|
grep -q 'cli-password=' coturn/turnserver.conf || echo "cli-password=$TURN_CLI_SECRET" >>coturn/turnserver.conf
|
||||||
|
backup: yes
|
||||||
|
validate: /bin/bash -n %s
|
||||||
|
notify: run genpw.sh
|
||||||
|
|
||||||
|
- name: /home/docker/turn.{{inventory_hostname}}/genpw.sh shebang
|
||||||
|
lineinfile:
|
||||||
|
path: /home/docker/turn.{{inventory_hostname}}/genpw.sh
|
||||||
|
insertbefore: BOF
|
||||||
|
line: "#!/bin/bash -e"
|
||||||
|
|
||||||
|
- name: Gen initial passwords if not exists
|
||||||
|
ansible.builtin.shell: ./genpw.sh
|
||||||
|
args:
|
||||||
|
chdir: /home/docker/turn.{{inventory_hostname}}
|
||||||
|
creates: /home/docker/turn.{{inventory_hostname}}/env
|
||||||
|
|
||||||
|
- name: /home/docker/turn.{{inventory_hostname}}/newip.sh (define external and local IP in turnserver.conf)
|
||||||
|
blockinfile:
|
||||||
|
path: /home/docker/turn.{{inventory_hostname}}/newip.sh
|
||||||
|
create: yes
|
||||||
|
mode: 0550
|
||||||
|
owner: root
|
||||||
|
group: docker
|
||||||
|
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||||
|
block: |
|
||||||
|
. /etc/bash/gaboshlib.include
|
||||||
|
cd /home/docker/turn.{{inventory_hostname}}/coturn
|
||||||
|
|
||||||
|
local_ip=$(ip route get 1 | grep " src " | head -n1 | cut -d" " -f7)
|
||||||
|
g_valid_ipv4 "$local_ip" || g_echo_error_exit "Invalid local_ip $local_ip"
|
||||||
|
external_ip=$(curl -s https://checkipv4.dedyn.io)
|
||||||
|
g_valid_ipv4 "$local_ip" || g_echo_error_exit "Invalid external_ip $external_ip"
|
||||||
|
if ! grep -q "external-ip=$local_ip/$external_ip" turnserver.conf
|
||||||
|
then
|
||||||
|
sed -i '/^external-ip=.*/d' turnserver.conf
|
||||||
|
echo "external-ip=$local_ip/$external_ip" >>turnserver.conf
|
||||||
|
fi
|
||||||
|
[ -f /home/docker/turn.{{inventory_hostname}}/docker-compose.yml ] && \
|
||||||
|
docker compose -f /home/docker/turn.{{inventory_hostname}}/docker-compose.yml restart
|
||||||
|
exit 0
|
||||||
|
backup: yes
|
||||||
|
validate: /bin/bash -n %s
|
||||||
|
notify: run newip.sh
|
||||||
|
|
||||||
|
- name: /home/docker/turn.{{inventory_hostname}}/newip.sh shebang
|
||||||
|
lineinfile:
|
||||||
|
path: /home/docker/turn.{{inventory_hostname}}/newip.sh
|
||||||
|
insertbefore: BOF
|
||||||
|
line: "#!/bin/bash -e"
|
||||||
|
|
||||||
|
- name: Update external and local IP in turnserver.conf
|
||||||
|
ansible.builtin.shell: ./newip.sh
|
||||||
|
args:
|
||||||
|
chdir: /home/docker/turn.{{inventory_hostname}}
|
||||||
|
changed_when: false
|
||||||
|
|
||||||
|
- name: /home/docker/turn.{{inventory_hostname}}/docker-compose.yml Container Configuration
|
||||||
|
blockinfile:
|
||||||
|
path: /home/docker/turn.{{inventory_hostname}}/docker-compose.yml
|
||||||
|
create: yes
|
||||||
|
mode: 0440
|
||||||
|
owner: root
|
||||||
|
group: docker
|
||||||
|
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||||
|
block: |
|
||||||
|
version: '3.6'
|
||||||
|
services:
|
||||||
|
|
||||||
|
turn.{{inventory_hostname}}:
|
||||||
|
image: coturn/coturn:latest
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
- ./coturn:/etc/coturn
|
||||||
|
ports:
|
||||||
|
- 49160-49200:49160-49200/udp
|
||||||
|
- 5349:5349
|
||||||
|
- 5349:5349/udp
|
||||||
|
|
||||||
|
# Workaround for getting a letsencrypt-cert by traefik
|
||||||
|
turn.{{inventory_hostname}}--ssl:
|
||||||
|
image: nginx:latest
|
||||||
|
restart: unless-stopped
|
||||||
|
volumes:
|
||||||
|
- ./htdocs:/usr/share/nginx/html:ro
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
networks:
|
||||||
|
- traefik
|
||||||
|
labels:
|
||||||
|
- traefik.enable=true
|
||||||
|
# HTTPS
|
||||||
|
- traefik.http.routers.turn-{{ ansible_facts['hostname'] }}.rule=Host(`turn.{{inventory_hostname}}`)
|
||||||
|
- traefik.http.routers.turn-{{ ansible_facts['hostname'] }}.entrypoints=https
|
||||||
|
- traefik.http.routers.turn-{{ ansible_facts['hostname'] }}.tls=true
|
||||||
|
# Proxy to service-port
|
||||||
|
- traefik.http.services.turn-{{ ansible_facts['hostname'] }}.loadbalancer.server.port=80
|
||||||
|
- traefik.http.routers.turn-{{ ansible_facts['hostname'] }}.service=turn-{{ ansible_facts['hostname'] }}
|
||||||
|
# cert via letsencrypt
|
||||||
|
- traefik.http.routers.turn-{{ ansible_facts['hostname'] }}.tls.certresolver=letsencrypt
|
||||||
|
# activate secHeaders@file
|
||||||
|
- traefik.http.routers.turn-{{ ansible_facts['hostname'] }}.middlewares=secHeaders@file
|
||||||
|
# Traefik network
|
||||||
|
- traefik.docker.network=traefik
|
||||||
|
|
||||||
|
networks:
|
||||||
|
traefik:
|
||||||
|
external: true
|
||||||
|
|
||||||
|
notify: Restart turn
|
||||||
|
|
||||||
|
- name: /usr/local/sbin/autoupdate.d/turn.update (workaround for valid ssl-certs)
|
||||||
|
blockinfile:
|
||||||
|
path: /usr/local/sbin/autoupdate.d/turn.update
|
||||||
|
mode: "0400"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
create: yes
|
||||||
|
marker: "# {mark} ANSIBLE MANAGED BLOCK"
|
||||||
|
block: |
|
||||||
|
# take letsencrypt-certs from traefik
|
||||||
|
cd /home/docker/turn.{{inventory_hostname}}/coturn
|
||||||
|
# cleanup
|
||||||
|
rm -f key.pem cert.pem
|
||||||
|
touch key.pem cert.pem
|
||||||
|
chown nobody key.pem cert.pem
|
||||||
|
chmod 400 key.pem cert.pem
|
||||||
|
# run ssl-container
|
||||||
|
docker compose -f /home/docker/turn.{{inventory_hostname}}/docker-compose.yml up turn.defiant.dedyn.io--ssl -d
|
||||||
|
# get cert
|
||||||
|
function getcert {
|
||||||
|
cat /home/docker/traefik/letsencrypt/acme.json | jq -r ".letsencrypt.Certificates[] | select(.domain.main==\"turn.{{inventory_hostname}}\") | .certificate" | base64 -d >cert.pem
|
||||||
|
}
|
||||||
|
|
||||||
|
function getkey {
|
||||||
|
cat /home/docker/traefik/letsencrypt/acme.json | jq -r ".letsencrypt.Certificates[] | select(.domain.main==\"turn.{{inventory_hostname}}\") | .key" | base64 -d >key.pem
|
||||||
|
}
|
||||||
|
getkey
|
||||||
|
getcert
|
||||||
|
until [ -s cert.pem ]
|
||||||
|
do
|
||||||
|
getcert
|
||||||
|
sleep 31
|
||||||
|
done
|
||||||
|
until [ -s key.pem ]
|
||||||
|
do
|
||||||
|
getkey
|
||||||
|
sleep 32
|
||||||
|
done
|
||||||
|
docker compose -f /home/docker/turn.{{inventory_hostname}}/docker-compose.yml down
|
||||||
|
docker compose -f /home/docker/turn.{{inventory_hostname}}/docker-compose.yml up -d
|
||||||
|
backup: yes
|
||||||
|
validate: /bin/bash -n %s
|
||||||
|
notify: run turn.update
|
||||||
|
|
||||||
|
- name: Allow turn for audio/video tcp
|
||||||
|
community.general.ufw:
|
||||||
|
rule: allow
|
||||||
|
port: '5349'
|
||||||
|
proto: tcp
|
||||||
|
|
||||||
|
- name: Allow turn for audio/video udp
|
||||||
|
community.general.ufw:
|
||||||
|
rule: allow
|
||||||
|
port: '5349'
|
||||||
|
proto: udp
|
||||||
|
|
||||||
|
handlers:
|
||||||
|
- name: run genpw.sh
|
||||||
|
ansible.builtin.shell: ./genpw.sh
|
||||||
|
args:
|
||||||
|
chdir: /home/docker/turn.{{inventory_hostname}}
|
||||||
|
notify: Restart turn
|
||||||
|
|
||||||
|
- name: run newip.sh
|
||||||
|
ansible.builtin.shell: ./newip.sh
|
||||||
|
args:
|
||||||
|
chdir: /home/docker/turn.{{inventory_hostname}}
|
||||||
|
notify: Restart turn
|
||||||
|
|
||||||
|
- name: run turn.update
|
||||||
|
ansible.builtin.shell: bash /usr/local/sbin/autoupdate.d/turn.update
|
||||||
|
notify: Restart turn
|
||||||
|
|
||||||
|
|
||||||
|
- name: Restart turn
|
||||||
|
ansible.builtin.shell: docker-compose up -d
|
||||||
|
args:
|
||||||
|
chdir: /home/docker/turn.{{inventory_hostname}}
|
||||||
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user