freedombone-utils-turn 7.0KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # TURN server functions
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2016-2018 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. TURN_PORT=3478
  31. TURN_HTTP_PORT=3407
  32. TURN_ONION_PORT=8110
  33. function generate_turn_key {
  34. local turnkey="${1}"
  35. local filepath="${2}"
  36. { echo "lt-cred-mech";
  37. echo "use-auth-secret";
  38. echo "static-auth-secret=${turnkey}";
  39. echo "realm=turn.${DEFAULT_DOMAIN_NAME}"; } > "${filepath}"
  40. if [[ $ONION_ONLY == 'no' ]]; then
  41. echo "cert=$MATRIX_DATA_DIR/${DEFAULT_DOMAIN_NAME}.tls.crt" >> "${filepath}"
  42. echo "pkey=$MATRIX_DATA_DIR/${DEFAULT_DOMAIN_NAME}.tls.key" >> "${filepath}"
  43. fi
  44. }
  45. function remove_turn {
  46. firewall_remove ${TURN_HTTP_PORT}
  47. firewall_remove ${TURN_PORT}
  48. systemctl stop turn
  49. systemctl disable turn
  50. if [ -f /etc/systemd/system/turn.service ]; then
  51. rm /etc/systemd/system/turn.service
  52. fi
  53. systemctl daemon-reload
  54. apt-get -y remove coturn
  55. rm -rf /var/lib/turn
  56. sed -i "/# TURN Server/,/# End of TURN Server/d" "/etc/nginx/sites-available/${DEFAULT_DOMAIN_NAME}"
  57. remove_onion_service turn ${TURN_ONION_PORT}
  58. rm /etc/avahi/services/turn.service
  59. systemctl restart nginx
  60. }
  61. function install_turn {
  62. create_default_web_site
  63. # append the matrix server to the web site config
  64. turn_nginx_site=/etc/nginx/sites-available/$DEFAULT_DOMAIN_NAME
  65. if ! grep -q '# End of TURN Server' "$turn_nginx_site"; then
  66. if [[ "$ONION_ONLY" == "no" ]]; then
  67. { echo '# TURN Server';
  68. echo 'server {';
  69. echo " listen ${TURN_HTTP_PORT} ssl;";
  70. echo " listen [::]:${TURN_HTTP_PORT} ssl;";
  71. echo " server_name ${DEFAULT_DOMAIN_NAME};";
  72. echo '';
  73. echo ' # Security'; } >> "$turn_nginx_site"
  74. function_check nginx_ssl
  75. nginx_ssl "${DEFAULT_DOMAIN_NAME}"
  76. function_check nginx_disable_sniffing
  77. nginx_disable_sniffing "${DEFAULT_DOMAIN_NAME}"
  78. { echo ' add_header Strict-Transport-Security max-age=15768000;';
  79. echo '';
  80. echo ' # Logs';
  81. echo ' access_log /dev/null;';
  82. echo ' error_log /dev/null;';
  83. echo '';
  84. echo ' # Index';
  85. echo ' index index.html;';
  86. echo '';
  87. echo ' # Location';
  88. echo ' location / {'; } >> "$turn_nginx_site"
  89. function_check nginx_limits
  90. nginx_limits "${DEFAULT_DOMAIN_NAME}" '15m'
  91. { echo " proxy_pass http://localhost:${TURN_PORT};";
  92. echo " proxy_set_header X-Forwarded-For \$remote_addr;";
  93. echo ' }';
  94. echo '}';
  95. echo ''; } >> "$turn_nginx_site"
  96. else
  97. echo '# TURN Server' >> "$turn_nginx_site"
  98. fi
  99. { echo 'server {';
  100. echo " listen 127.0.0.1:$TURN_ONION_PORT default_server;";
  101. echo " server_name $DEFAULT_DOMAIN_NAME;";
  102. echo ''; } >> "$turn_nginx_site"
  103. function_check nginx_disable_sniffing
  104. nginx_disable_sniffing "$DEFAULT_DOMAIN_NAME"
  105. { echo '';
  106. echo ' # Logs';
  107. echo ' access_log /dev/null;';
  108. echo ' error_log /dev/null;';
  109. echo '';
  110. echo ' # Location';
  111. echo ' location / {'; } >> "$turn_nginx_site"
  112. function_check nginx_limits
  113. nginx_limits "$DEFAULT_DOMAIN_NAME" '15m'
  114. { echo " proxy_pass http://localhost:${TURN_PORT};";
  115. echo " proxy_set_header X-Forwarded-For \$remote_addr;";
  116. echo ' }';
  117. echo '}';
  118. echo '# End of TURN Server'; } >> "$turn_nginx_site"
  119. fi
  120. export DEBIAN_FRONTEND=noninteractive
  121. apt-get -yq install coreutils coturn \
  122. curl file gcc git libevent-2.0-5 \
  123. libevent-dev libffi-dev libffi6 \
  124. libgnutls28-dev libjpeg62-turbo \
  125. libjpeg62-turbo-dev libldap-2.4-2 \
  126. libldap2-dev libsasl2-dev \
  127. libsqlite3-dev libssl-dev \
  128. libssl1.1 libtool libxml2 \
  129. libxml2-dev libxslt1-dev libxslt1.1 \
  130. make python python-dev \
  131. python-pip python-psycopg2 \
  132. python-virtualenv sqlite unzip \
  133. zlib1g zlib1g-dev
  134. pip install --upgrade pip
  135. pip install --upgrade python-ldap
  136. pip install --upgrade lxml
  137. if [ ! -d /var/lib/turn ]; then
  138. mkdir /var/lib/turn
  139. fi
  140. turnkey="$(create_password 30)"
  141. generate_turn_key "$turnkey" /var/lib/turn/turnserver.conf
  142. chmod -R 700 /var/lib/turn/turnserver.conf
  143. chown -R matrix:matrix /var/lib/turn
  144. { echo '[Unit]';
  145. echo 'Description=TURN server';
  146. echo 'After=network.target nginx.target';
  147. echo '';
  148. echo '[Service]';
  149. echo 'Type=simple';
  150. echo 'User=matrix';
  151. echo "WorkingDirectory=/var/lib/turn";
  152. echo "ExecStart=/usr/bin/turnserver -c /var/lib/turn/turnserver.conf --pidfile /var/lib/matrix/homeserver.pid";
  153. echo "Environment=REPORT_STATS=\"no\"";
  154. echo 'Restart=always';
  155. echo 'RestartSec=10';
  156. echo '';
  157. echo '[Install]';
  158. echo 'WantedBy=multi-user.target'; } > /etc/systemd/system/turn.service
  159. systemctl enable turn
  160. systemctl daemon-reload
  161. systemctl start turn
  162. firewall_add turn ${TURN_PORT}
  163. firewall_add turn-http ${TURN_HTTP_PORT}
  164. #TURN_ONION_HOSTNAME=$(add_onion_service turn ${TURN_PORT} ${TURN_ONION_PORT})
  165. add_onion_service turn ${TURN_PORT} ${TURN_ONION_PORT}
  166. { echo '<?xml version="1.0" standalone="no"?><!--*-nxml-*-->';
  167. echo '<!DOCTYPE service-group SYSTEM "avahi-service.dtd">';
  168. echo '<service-group>';
  169. echo ' <name replace-wildcards="yes">%h TURN</name>';
  170. echo ' <service>';
  171. echo ' <type>_turn._tcp</type>';
  172. echo " <port>$TURN_PORT</port>";
  173. echo ' </service>';
  174. echo ' <service>';
  175. echo ' <type>_turn._udp</type>';
  176. echo " <port>$TURN_PORT</port>";
  177. echo ' </service>';
  178. echo '</service-group>'; } > /etc/avahi/services/turn.service
  179. systemctl restart avahi-daemon
  180. systemctl restart nginx
  181. }
  182. # NOTE: deliberately no exit 0