Création : Debian 10.4 - Buster
Ce document décrit l'Installation d'un serveur de vidéoconférence jitsi sur un PC linux Debian. Une connexion sécurisée https est mise en place, le certificat est authentifié par Let's Encrypt
Dans la mise en œuvre décrite
Références
Sommaire
$ sudo aptitude install ufw
$ sudo ufw allow in http $ sudo ufw allow in https $ sudo ufw allow in 10000/udp
$ sudo ufw enable
$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action From
-- ------ ----
80/tcp ALLOW IN Anywhere
443/tcp ALLOW IN Anywhere
10000/udp ALLOW IN Anywhere
80/tcp (v6) ALLOW IN Anywhere (v6)
443/tcp (v6) ALLOW IN Anywhere (v6)
10000/udp (v6) ALLOW IN Anywhere (v6)
$ sudo ufw delete allow in http
En cas de problème,
pour désactiver le pare-feu
$ sudo ufw disable
pour réinitialiser toutes les règles
$ sudo ufw reset
$ curl -4 icanhazip.com
109.***.***.167
$ telnet 109.***.***.167 http
Trying 109.***.***.167...
Connected to 109.***.***.167.
Escape character is '^]'.
$ telnet 109.***.***.167 https
$ nc -z -v -u 109.***.***.167 10000
Connection to 109.9.177.167 10000 port [udp/*] succeeded!
$ curl -4 icanhazip.com
109.***.***.167
$ host -t A mon_domain.xyz
mon_domain.xyz has address 109.***.***.167
$ host -t A buster.mon_domain.xyz
buster.mon_domain.xyz has address 109.***.***.167
$ sudo nano /etc/hostname
buster
$ sudo nano /etc/hosts
127.0.0.1 localhost buster.mon_domain.xyz
......
$ sudo nano /etc/hosts
127.0.0.1 localhost jitsi.mon_domain.xyz
109.***.***.167 buster
.....
jitsi utilise soit un serveur apache, soit un serveur nginx. Dans ce qui suit, on utilise un serveur apache. Il doit-être installé avant jitsi
$ sudo aptitude install apache2
$ sudo systemctl status apache2.service
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
donner un nom au serveur
$ su -c 'echo "ServerName buster" >> /etc/apache2/apache2.conf'
$ sudo systemctl restart apache2
$ sudo systemctl reload apache2
$ links2 http://localhost
$ links2 http://buster
$ sudo aptitude purge ~i~njitsi ~i~nprosody ~i~njicofo
$ sudo aptitude purge ~i~njitsi ~i~nprosody ~i~njicofo
$ aptitude search ~c
$ sudo aptitude purge ~c
$ wget -qO - https://download.jitsi.org/jitsi-key.gpg.key | sudo apt-key add -
$ sudo sh -c "echo 'deb https://download.jitsi.org stable/' > /etc/apt/sources.list.d/jitsi-stable.list"
$ sudo aptitutde update $ sudo aptitude install jitsi-meet
$ apt-cache policy jitsi-meet |grep Installé
Installé : 2.0.4627-1
$ java --version
openjdk 11.0.7 2020-04-14
OpenJDK Runtime Environment (build 11.0.7+10-post-Debian-3deb10u1)
OpenJDK 64-Bit Server VM (build 11.0.7+10-post-Debian-3deb10u1, mixed mode, sharing)
Config written to /var/lib/prosody/auth.109.***.***.167.cnf
Certificate written to /var/lib/prosody/auth.109.***.***.167.crt
$ sudo /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh
-------------------------------------------------------------------------
This script will:
- Need a working DNS record pointing to this machine(for domain jitsi.mon_domain.xyz)
- Download certbot-auto from https://dl.eff.org to /usr/local/sbin
- Install additional dependencies in order to request Let’s Encrypt certificate
- If running with jetty serving web content, will stop Jitsi Videobridge
- Configure and reload nginx or apache2, whichever is used
- Configure the coturn server to use Let's Encrypt certificate and add required deploy hooks
- Add command in weekly cron job to renew certificates regularly
You need to agree to the ACME server's Subscriber Agreement (https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf)
by providing an email address for important account notifications
Enter your email and press [ENTER]: *******@laposte.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for buster.mon_domain.xyz
Using the webroot path /usr/share/jitsi-meet for all unmatched domains.
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/jitsi.buster.xyz/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/buster.mon_domain.xyz/privkey.pem
Your cert will expire on 2020-08-14. To obtain a new or tweaked
version of this certificate in the future, simply run certbot-auto
again. To non-interactively renew *all* of your certificates, run
"certbot-auto renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
Configuring apache2
$ sudo dpkg-reconfigure jitsi-meet-web-config
$ sudo certbot-auto
Optionnel : L'installation du paquet certbot facilite la gestion des certificats
$ sudo aptitude install certbot
Affichage des certificats présents
$ sudo certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Attempting to parse the version 1.4.0 renewal configuration file found at /etc/letsencrypt/renewal/jitsi.mon_domain.xyz.conf with version 0.31.0 of Certbot. This might not work.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: jitsi.mon_domain.xyz
Domains: jitsi.mon_domain.xyz
Expiry Date: 2020-08-16 12:09:05+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/jitsi.mon_domain.xyz/fullchain.pem
Private Key Path: /etc/letsencrypt/live/jitsi.mon_domain.xyz/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
$ sudo systemctl list-timers |grep certbot
Sat 2020-05-23 10:33:13 CEST 16h left Fri 2020-05-22 18:20:28 CEST 2min 10s ago certbot.timer certbot.service
$ sudo certbot renew
$ sudo certbot revoke
$ sudo certbot delete
$ sudo nano /etc/jitsi/videobridge/sip-communicator.properties
org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS=<Local.IP.Address> org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS=<Public.IP.Address>
$ ip a show wlp0s20f3 |grep "inet "|awk '{print $2;exit}'
192.168.0.19/24
$ curl -4 icanhazip.com
109.***.***.167
org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES ......
Au final le fichier contient
$ sudo cat /etc/jitsi/videobridge/sip-communicator.properties
org.ice4j.ice.harvest.DISABLE_AWS_HARVESTER=true
# org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES=meet-jit-si-turnrelay.jitsi.net:443
org.jitsi.videobridge.ENABLE_STATISTICS=true
org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.buster.mon_domain.xyz
org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
org.jitsi.videobridge.xmpp.user.shard.PASSWORD=heLYGcOl
org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.buster.mon_domain.xyz
org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME=ccffdbba-6f65-4a6d-81ef-5fff7128b600
org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS=192.168.0.19
org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS=109.***.***.167
$ firefox hptts://jitsi.mon_domain.xyz/test
$ .....
$ sudo systemctl restart apache2
$ sudo systemctl reload apache2
$ sudo systemctl daemon-reload
$ sudo systemctl restart jicofo.service
$ sudo systemctl restart prosody.service
$ sudo systemctl restart jitsi-videobridge2.service
Vérification de la prise en charge de webrtc par un navigateur compatible (Firefox, Chromium, ... )
$ firefox https://test.webrtc.org/ &
$ firefox https://webrtc.github.io/samples/src/content/getusermedia/gum/ &
$ firefox https://webrtc.github.io/samples/src/content/getusermedia/resolution/ &
$ firefox https://webrtc.github.io/samples/src/content/getusermedia/audio/ &
$ firefox https://webrtc.github.io/samples/src/content/getusermedia/volume/ &
$ firefox https://webrtc.github.io/samples/src/content/devices/input-output/ &
$ firefox https://meet.jit.si/ &