From 6795e1979dcfd9518a479552a66be72d19b78d29 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ebbe=20Ba=C3=9F?= Date: Thu, 30 Jul 2026 09:05:37 +0200 Subject: [PATCH] different nextcloud aio solution --- .../nextcloud_full_deployment/README.txt | 8 +- .../deploy_nc_talk_hpb.yml | 196 +++--------------- .../vars/shared_vars.yml.example | 18 +- 3 files changed, 42 insertions(+), 180 deletions(-) diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/README.txt b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/README.txt index 9b97681..7a9dd15 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/README.txt +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/README.txt @@ -8,7 +8,7 @@ The optimal setup uses one server per role: - Nextcloud (Apache + PHP + MariaDB) - Collabora CODE (document editing backend) - - Nextcloud Talk HPB (NATS + Janus Gateway + signaling server, via Docker) + - Nextcloud Talk HPB (Nextcloud AIO Talk: bundled TURN/STUN + signaling server, via Docker) The current playbook stack is made for a theoretical infinite amount of Nextcloud instance setups (not load balanced or anything in that direction) and a single server each for Collabora CODE and @@ -58,7 +58,7 @@ co-locate roles on one server. After that is done, copy vars/shared_vars.yml.example to vars/shared_vars.yml and go change all the variables in it according to your needs. Every secret in that file (database password, admin -password, Collabora admin password, Talk HPB signaling/TURN/hash/block secrets) ships with a +password, Collabora admin password, Talk HPB TURN/signaling/internal secrets) ships with a "ChangeMe..." placeholder - replace all of them before deploying. /nextcloud_full_deployment @@ -78,13 +78,13 @@ this order, since each one depends on the previous: 3. Connect Collabora CODE to your Nextcloud instance(s): ansible-playbook connect_nextcloud_collabora.yml -i inventory/hosts.ini --ask-become-pass -4. Nextcloud Talk High-Performance Backend (NATS + Janus + signaling server, via Docker): +4. Nextcloud Talk High-Performance Backend (Nextcloud AIO Talk, via Docker): ansible-playbook deploy_nc_talk_hpb.yml -i inventory/hosts.ini --ask-become-pass This playbook only sets up the backend itself. Nextcloud does not pick it up automatically - finish the connection by hand on each Nextcloud instance under Administration -> Talk -> High-performance backend: - Signaling server URL: https:///standalone-signaling + Signaling server URL: https:// Shared secret: nc_talk_hpb_signaling_secret (from shared_vars.yml) TURN server: :3478, protocols UDP and TCP TURN secret: nc_talk_hpb_turn_secret (from shared_vars.yml) diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_nc_talk_hpb.yml b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_nc_talk_hpb.yml index 5a4eca8..32f8878 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_nc_talk_hpb.yml +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/deploy_nc_talk_hpb.yml @@ -80,7 +80,7 @@ state: started # ================================================================ -# PLAY 2 — Deploy the HPB stack: NATS, Janus Gateway, Signaling +# PLAY 2 — Deploy the HPB stack: Nextcloud AIO Talk (all-in-one) # ================================================================ - name: Deploy Nextcloud Talk High-Performance Backend stack hosts: nextcloud_talk_hpb @@ -91,167 +91,40 @@ - vars/shared_vars.yml tasks: - - name: Create HPB config directory structure + - name: Create HPB install directory ansible.builtin.file: - path: "{{ item }}" + path: "{{ nc_talk_hpb_install_dir }}" state: directory mode: "0750" - loop: - - "{{ nc_talk_hpb_install_dir }}/config/janus" - - name: Deploy NATS configuration - ansible.builtin.copy: - dest: "{{ nc_talk_hpb_install_dir }}/config/nats.conf" - mode: "0640" - content: | - listen: 127.0.0.1:4222 - notify: Restart HPB stack - - - name: Deploy Janus main configuration - ansible.builtin.copy: - dest: "{{ nc_talk_hpb_install_dir }}/config/janus/janus.jcfg" - mode: "0640" - content: | - general: { - configs_folder = "/usr/local/etc/janus" - plugins_folder = "/usr/local/lib/janus/plugins" - transports_folder = "/usr/local/lib/janus/transports" - events_folder = "/usr/local/lib/janus/events" - loggers_folder = "/usr/local/lib/janus/loggers" - debug_level = 4 - log_to_stdout = true - } - - nat: { - ice_lite = false - ice_tcp = false - full_trickle = true - rtp_port_range = "{{ nc_talk_hpb_rtp_port_range }}" - } - - media: { - ipv6 = false - } - - plugins: { - } - - transports: { - } - notify: Restart HPB stack - - - name: Deploy Janus WebSocket transport configuration - ansible.builtin.copy: - dest: "{{ nc_talk_hpb_install_dir }}/config/janus/janus.transport.websockets.jcfg" - mode: "0644" - content: | - general: { - ws = true - ws_port = 8188 - } - - admin: { - admin_ws = true - admin_ws_port = 7188 - } - notify: Restart HPB stack - - - name: Deploy Janus VideoRoom plugin configuration - ansible.builtin.copy: - dest: "{{ nc_talk_hpb_install_dir }}/config/janus/janus.plugin.videoroom.jcfg" - mode: "0640" - content: | - general: { - admin_key = "{{ nc_talk_hpb_janus_admin_key }}" - } - notify: Restart HPB stack - - # NOTE: only nextcloud_domain is wired up as a backend here, matching + # NOTE: only nextcloud_domain is wired up via NC_DOMAIN here, matching # the single-Nextcloud-instance scope of the rest of this playbook - # stack. To serve more Nextcloud instances from this HPB, add further - # backendN blocks below by hand and list them in [backend] backends - - # they must all share the same signaling secret. - - name: Deploy signaling server configuration - ansible.builtin.copy: - dest: "{{ nc_talk_hpb_install_dir }}/config/server.conf" - mode: "0644" - content: | - [http] - listen = 0.0.0.0:8081 - - [app] - secret = {{ nc_talk_hpb_signaling_secret }} - - [sessions] - hashkey = {{ nc_talk_hpb_hash_key }} - blockkey = {{ nc_talk_hpb_block_key }} - - [nats] - url = nats://127.0.0.1:4222 - - [mcu] - type = janus - url = ws://127.0.0.1:8188 - - [backend] - backends = backend1 - - [backend1] - url = https://{{ nextcloud_domain }} - secret = {{ nc_talk_hpb_signaling_secret }} - - [turn] - api = static - apikey = {{ nc_talk_hpb_turn_secret }} - secret = {{ nc_talk_hpb_turn_secret }} - servers = turn:{{ nc_talk_hpb_domain }}:3478?transport=udp,turn:{{ nc_talk_hpb_domain }}:3478?transport=tcp - notify: Restart HPB stack - + # stack. For multi-domain/multi-tenant setups, see the Nextcloud Talk + # HPB multi-domain documentation and adjust NC_DOMAIN by hand. - name: Deploy HPB Docker Compose stack definition ansible.builtin.copy: dest: "{{ nc_talk_hpb_install_dir }}/docker-compose.yml" mode: "0640" content: | name: 'hpb' + services: - nats: - container_name: nats_server - image: nats:latest - command: ["-c", "/config/nats.conf"] - volumes: - - {{ nc_talk_hpb_install_dir }}/config/nats.conf:/config/nats.conf:ro - network_mode: host - restart: unless-stopped - - janus: - container_name: janus_gateway - image: canyan/janus-gateway:latest - command: ["/usr/local/bin/janus", "--configs-folder=/usr/local/etc/janus"] - network_mode: host - ulimits: - nofile: - soft: 65536 - hard: 65536 + nc-talk: + container_name: talk_hpb + image: ghcr.io/nextcloud-releases/aio-talk:latest + init: true + ports: + - 3478:3478/tcp + - 3478:3478/udp + - 8181:8081/tcp environment: - - JANUS_API_HTTP=yes - - JANUS_API_HTTPS=no - - JANUS_API_WS=yes - - JANUS_API_ADMIN_WS=yes - - JANUS_RTP_PORT_RANGE={{ nc_talk_hpb_rtp_port_range }} - volumes: - - {{ nc_talk_hpb_install_dir }}/config/janus:/usr/local/etc/janus:ro - restart: unless-stopped - - signaling: - container_name: spreed_signaling - image: strukturag/nextcloud-spreed-signaling:latest - depends_on: - - nats - - janus - network_mode: host - volumes: - - {{ nc_talk_hpb_install_dir }}/config/server.conf:/config/server.conf:ro - + - NC_DOMAIN={{ nextcloud_domain }} + - TALK_HOST={{ nc_talk_hpb_domain }} + - TURN_SECRET={{ nc_talk_hpb_turn_secret }} + - SIGNALING_SECRET={{ nc_talk_hpb_signaling_secret }} + - TZ={{ nc_talk_hpb_timezone }} + - TALK_PORT=3478 + - INTERNAL_SECRET={{ nc_talk_hpb_internal_secret }} restart: unless-stopped notify: Restart HPB stack @@ -311,7 +184,6 @@ loop: - proxy - proxy_http - - proxy_wstunnel - rewrite - headers - ssl @@ -323,10 +195,11 @@ enabled: true state: started - # NOTE: coolwsd-style TLS termination happens here in Apache; the - # signaling container listens on plain HTTP/WS on 127.0.0.1:8081 - # (see server.conf's [http] listen), so the proxy targets ws/http, - # not wss/https. + # NOTE: the AIO Talk container serves its own HTTP/WSS API on + # 127.0.0.1:8181 (mapped from its internal 8081); TLS for the signal + # domain is terminated here in Apache, proxying the whole domain (no + # subpath) via mod_proxy_http's native WebSocket upgrade support + # (upgrade=websocket, Apache 2.4.47+) instead of mod_proxy_wstunnel. - name: Deploy Talk HPB Apache virtual host (HTTP redirect + HTTPS proxy) ansible.builtin.copy: dest: /etc/apache2/sites-available/nc-talk-hpb.conf @@ -347,12 +220,11 @@ ProxyPreserveHost On - RewriteEngine On - RewriteCond %{HTTP:Upgrade} =websocket [NC] - RewriteRule /standalone-signaling/(.*) ws://127.0.0.1:8081/$1 [P,L] + RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME} + RequestHeader set X-Real-IP expr=%{REMOTE_ADDR} - ProxyPass /standalone-signaling/ http://127.0.0.1:8081/ - ProxyPassReverse /standalone-signaling/ http://127.0.0.1:8081/ + ProxyPass / http://127.0.0.1:8181/ upgrade=websocket + ProxyPassReverse / http://127.0.0.1:8181/ ErrorLog ${APACHE_LOG_DIR}/nc_talk_hpb_error.log CustomLog ${APACHE_LOG_DIR}/nc_talk_hpb_access.log combined @@ -385,12 +257,6 @@ - tcp - udp - - name: Allow RTP port range through the firewall - community.general.ufw: - rule: allow - port: "{{ nc_talk_hpb_rtp_port_range | replace('-', ':') }}" - proto: udp - # --------------------------------------------------------------- # Handlers # --------------------------------------------------------------- diff --git a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml.example b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml.example index b0c32f1..4cc1658 100644 --- a/playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml.example +++ b/playbooks/linux/ubuntu-server/nextcloud_full_deployment/vars/shared_vars.yml.example @@ -42,26 +42,22 @@ fail2ban_dir: "/etc/fail2ban" nc_talk_hpb_domain: "talk-hpb.cloud.example.com" -# Where the NATS/Janus/Signaling Docker Compose stack and its config live on the HPB host. +# Where the Nextcloud AIO Talk Docker Compose stack and its config live on the HPB host. nc_talk_hpb_install_dir: "/opt/hpb" # Talk HPB TLS certificate paths (used by the Apache reverse proxy). nc_talk_hpb_ssl_cert: "/etc/ssl/certs/nc-talk-hpb-selfsigned.crt" nc_talk_hpb_ssl_key: "/etc/ssl/private/nc-talk-hpb-selfsigned.key" -# UDP port range Janus uses for WebRTC media (RTP). Must also be reachable through the firewall. -nc_talk_hpb_rtp_port_range: "20000-40000" +# Timezone used inside the Talk HPB container. +nc_talk_hpb_timezone: "Europe/Berlin" -# Admin key for the Janus VideoRoom plugin (lets the signaling server manage rooms via the admin API). -nc_talk_hpb_janus_admin_key: "ChangeMe1234_" - -# Shared secrets for the signaling server. Generate each with the given command and paste the result here. -# turn/signaling/hash: openssl rand -hex 32 (64 hex chars) -# block: openssl rand -hex 16 (32 hex chars — MUST be exactly 32, 48 or 64 hex chars or the signaling server refuses to start) +# Shared secrets for the Nextcloud AIO Talk container. Generate each with the given +# command and paste the result here (min. 24 chars, better 32). +# turn/signaling/internal: openssl rand -hex 32 nc_talk_hpb_turn_secret: "ChangeMe_RunOpensslRandHex32" nc_talk_hpb_signaling_secret: "ChangeMe_RunOpensslRandHex32" -nc_talk_hpb_hash_key: "ChangeMe_RunOpensslRandHex32" -nc_talk_hpb_block_key: "ChangeMe_RunOpensslRandHex16" +nc_talk_hpb_internal_secret: "ChangeMe_RunOpensslRandHex32" ######################################## # Collabora CODE