freedombone-app-jitsi 15KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Jitsi meet + videobridge
  12. #
  13. # Instructions: https://github.com/jitsi/jitsi-meet/blob/master/doc/manual-install.md
  14. #
  15. # License
  16. # =======
  17. #
  18. # Copyright (C) 2016-2017 Bob Mottram <bob@freedombone.net>
  19. #
  20. # This program is free software: you can redistribute it and/or modify
  21. # it under the terms of the GNU Affero General Public License as published by
  22. # the Free Software Foundation, either version 3 of the License, or
  23. # (at your option) any later version.
  24. #
  25. # This program is distributed in the hope that it will be useful,
  26. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  27. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  28. # GNU Affero General Public License for more details.
  29. #
  30. # You should have received a copy of the GNU Affero General Public License
  31. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  32. VARIANTS=""
  33. IN_DEFAULT_INSTALL=0
  34. SHOW_ON_ABOUT=0
  35. VIDEOBRIDGE_PORT=5347
  36. JITSI_ONION_PORT=8102
  37. JITSI_PORT=5280
  38. # domains
  39. JITSI_DOMAIN_NAME=
  40. JITSI_CODE=
  41. JITSI_ONION_HOSTNAME=
  42. jitsi_variables=(ONION_ONLY
  43. JITSI_DOMAIN_NAME
  44. JITSI_ONION_HOSTNAME
  45. JITSI_CODE
  46. DEFAULT_DOMAIN_NAME
  47. MY_USERNAME)
  48. function logging_on_jitsi {
  49. echo -n ''
  50. }
  51. function logging_off_jitsi {
  52. echo -n ''
  53. }
  54. function jitsi_disable_google_spyware {
  55. # Presumably they included Google Analytics for benign reasons, but it's
  56. # an obvious security problem. This should disable it.
  57. sed -i "s|Google Analytics|Google Spyware deactivated|g" /usr/share/jitsi-meet/analytics.js
  58. sed -i "s|www.google-analytics.com|${JITSI_DOMAIN_NAME}|g" /usr/share/jitsi-meet/analytics.js
  59. if ! grep -q '//ga(' /usr/share/jitsi-meet/analytics.js; then
  60. sed -i 's|ga(|//ga(|g' /usr/share/jitsi-meet/analytics.js
  61. fi
  62. if ! grep -q '//action +' /usr/share/jitsi-meet/analytics.js; then
  63. sed -i 's|action +|//action +|g' /usr/share/jitsi-meet/analytics.js
  64. fi
  65. sed -i "s|Google Analytics|Google Spyware deactivated|g" /usr/share/jitsi-meet/libs/analytics.js
  66. sed -i "s|www.google-analytics.com|${JITSI_DOMAIN_NAME}|g" /usr/share/jitsi-meet/libs/analytics.js
  67. if ! grep -q '//ga(' /usr/share/jitsi-meet/libs/analytics.js; then
  68. sed -i 's|ga(|//ga(|g' /usr/share/jitsi-meet/libs/analytics.js
  69. fi
  70. if ! grep -q '//action +' /usr/share/jitsi-meet/libs/analytics.js; then
  71. sed -i 's|action +|//action +|g' /usr/share/jitsi-meet/libs/analytics.js
  72. fi
  73. }
  74. function can_install_videobridge {
  75. check_architecture=$(uname -a)
  76. if [[ "$check_architecture" == *"amd64"* || "$check_architecture" == *"i386"* ]]; then
  77. echo "1"
  78. else
  79. echo "0"
  80. fi
  81. }
  82. function remove_jitsi_subdomains {
  83. function_check remove_onion_service
  84. remove_onion_service jitsi ${JITSI_ONION_PORT}
  85. }
  86. function remove_user_jitsi {
  87. remove_username="$1"
  88. }
  89. function add_user_jitsi {
  90. new_username="$1"
  91. new_user_password="$2"
  92. }
  93. function install_interactive_jitsi {
  94. if [ ! ${ONION_ONLY} ]; then
  95. ONION_ONLY='no'
  96. fi
  97. if [[ ${ONION_ONLY} != "no" ]]; then
  98. JITSI_DOMAIN_NAME='jitsi.local'
  99. write_config_param "JITSI_DOMAIN_NAME" "$JITSI_DOMAIN_NAME"
  100. else
  101. function_check interactive_site_details
  102. interactive_site_details "jitsi" "JITSI_DOMAIN_NAME" "JITSI_CODE"
  103. fi
  104. APP_INSTALLED=1
  105. }
  106. function configure_interactive_jitsi {
  107. echo -n ''
  108. }
  109. function reconfigure_jitsi {
  110. echo -n ''
  111. }
  112. function upgrade_jitsi {
  113. jitsi_disable_google_spyware
  114. }
  115. function backup_local_jitsi {
  116. echo -n ''
  117. }
  118. function restore_local_jitsi {
  119. echo -n ''
  120. }
  121. function backup_remote_jitsi {
  122. echo -n ''
  123. }
  124. function restore_remote_jitsi {
  125. echo -n ''
  126. }
  127. function remove_jitsi {
  128. read_config_param JITSI_DOMAIN_NAME
  129. if [ ${#JITSI_DOMAIN_NAME} -eq 0 ]; then
  130. return
  131. fi
  132. if [ -f /etc/nginx/sites-available/${JITSI_DOMAIN_NAME} ]; then
  133. nginx_dissite ${JITSI_DOMAIN_NAME}
  134. if [ -d /var/www/${JITSI_DOMAIN_NAME} ]; then
  135. rm -rf /var/www/${JITSI_DOMAIN_NAME}
  136. fi
  137. rm /etc/nginx/sites-available/${JITSI_DOMAIN_NAME}
  138. function_check remove_certs
  139. remove_certs ${JITSI_DOMAIN_NAME}
  140. systemctl reload nginx
  141. fi
  142. remove_jitsi_subdomains
  143. systemctl stop prosody
  144. if [ -f /etc/prosody/conf.d/${JITSI_DOMAIN_NAME}.cfg.lua ]; then
  145. rm /etc/prosody/conf.d/${JITSI_DOMAIN_NAME}.cfg.lua
  146. fi
  147. if [ -f /etc/prosody/conf.avail/${JITSI_DOMAIN_NAME}.cfg.lua ]; then
  148. rm /etc/prosody/conf.avail/${JITSI_DOMAIN_NAME}.cfg.lua
  149. fi
  150. prosodyctl unregister focus auth.${JITSI_DOMAIN_NAME}
  151. systemctl start prosody
  152. remove_nodejs jitsi
  153. # remove videobridge
  154. firewall_remove ${VIDEOBRIDGE_PORT}
  155. firewall_remove "10000:20000"
  156. apt-get -yq remove --purge jitsi-videobridge jicofo jitsi-meet jitsi-meet-prosody
  157. if [ -d /etc/jitsi ]; then
  158. rm -rf /etc/jitsi
  159. fi
  160. if [ -d /usr/share/jitsi-videobridge ]; then
  161. rm -rf /usr/share/jitsi-videobridge
  162. fi
  163. if [ -d /usr/share/jitsi-meet ]; then
  164. rm -rf /usr/share/jitsi-meet
  165. fi
  166. if [ -d /etc/jitsi ]; then
  167. rm -rf /etc/jitsi
  168. fi
  169. sed -i "/jitsi/d" /etc/apt/sources.list
  170. rm /etc/apt/sources.list.d/jitsi*
  171. apt-get update
  172. remove_app jitsi
  173. remove_completion_param install_jitsi
  174. sed -i '/jitsi/d' ${COMPLETION_FILE}
  175. function_check remove_ddns_domain
  176. remove_ddns_domain $JITSI_DOMAIN_NAME
  177. }
  178. function install_jitsi {
  179. if [[ "$(can_install_videobridge)" == "0" ]]; then
  180. echo $'jitsi meet/videobridge can only be installed on i386 or amd64 architectures'
  181. exit 83562
  182. fi
  183. if [ ! ${JITSI_DOMAIN_NAME} ]; then
  184. echo $'No domain name was given for jitsi'
  185. exit 47682
  186. fi
  187. if [ ! -d /etc/prosody ]; then
  188. echo $'xmpp must be installed before installing jitsi'
  189. exit 62394
  190. fi
  191. if [[ "${JITSI_DOMAIN_NAME}" == "${DEFAULT_DOMAIN_NAME}" ]]; then
  192. echo $'The jitsi domain name should not be the same as the main domain name'
  193. exit 78372
  194. fi
  195. # add jitsi repo
  196. jitsi_deb_repo=unstable #binary
  197. apt-get -yq install wget debconf-utils default-jre
  198. install_nodejs jitsi
  199. npm install -g browserify@13.1.1
  200. if [ ! "$?" = "0" ]; then
  201. remove_nodejs jitsi
  202. exit 638352
  203. fi
  204. if ! grep -q "jitsi" /etc/apt/sources.list; then
  205. echo "deb http://download.jitsi.org/nightly/deb ${jitsi_deb_repo}/" >> /etc/apt/sources.list
  206. fi
  207. wget -qO - https://download.jitsi.org/nightly/deb/${jitsi_deb_repo}/archive.key | apt-key add -
  208. apt-get update
  209. JITSI_ONION_HOSTNAME=$(add_onion_service jitsi 80 ${JITSI_ONION_PORT})
  210. # videobridge
  211. if [[ $ONION_ONLY == 'no' ]]; then
  212. debconf-set-selections <<< "jitsi-videobridge jitsi-videobridge/jvb-hostname string ${JITSI_DOMAIN_NAME}"
  213. else
  214. debconf-set-selections <<< "jitsi-videobridge jitsi-videobridge/jvb-hostname string ${JITSI_ONION_HOSTNAME}"
  215. fi
  216. apt-get -yq install jitsi-videobridge
  217. if [ ! -d /etc/jitsi ]; then
  218. echo $'Videobridge package failed to install'
  219. exit 63983
  220. fi
  221. firewall_add videobridge ${VIDEOBRIDGE_PORT}
  222. firewall_add_range jitsi 10000 20000 udp
  223. # meet
  224. debconf-set-selections <<< "jitsi-meet jitsi-meet/cert-choice multiselect 1"
  225. apt-get -yq install jitsi-meet jitsi-meet-prosody
  226. jitsi_nginx_site=/etc/nginx/sites-available/${JITSI_DOMAIN_NAME}
  227. if [ -f ${jitsi_nginx_site}.conf ]; then
  228. rm ${jitsi_nginx_site}.conf
  229. fi
  230. echo 'server_names_hash_bucket_size 64;' > $jitsi_nginx_site
  231. if [[ $ONION_ONLY == "no" ]]; then
  232. echo '' >> $jitsi_nginx_site
  233. echo 'server {' >> $jitsi_nginx_site
  234. echo ' listen 80;' >> $jitsi_nginx_site
  235. echo " server_name ${JITSI_DOMAIN_NAME};" >> $jitsi_nginx_site
  236. echo ' return 301 https://$host$request_uri;' >> $jitsi_nginx_site
  237. echo '}' >> $jitsi_nginx_site
  238. echo 'server {' >> $jitsi_nginx_site
  239. echo ' listen 443 ssl;' >> $jitsi_nginx_site
  240. echo ' listen [::]:443 ssl;' >> $jitsi_nginx_site
  241. echo " server_name ${JITSI_DOMAIN_NAME};" >> $jitsi_nginx_site
  242. echo '' >> $jitsi_nginx_site
  243. function_check nginx_ssl
  244. nginx_ssl ${JITSI_DOMAIN_NAME}
  245. function_check nginx_disable_sniffing
  246. nginx_disable_sniffing ${JITSI_DOMAIN_NAME}
  247. echo ' add_header Strict-Transport-Security max-age=15768000;' >> $jitsi_nginx_site
  248. echo '' >> $jitsi_nginx_site
  249. echo ' root /usr/share/jitsi-meet;' >> $jitsi_nginx_site
  250. echo ' index index.html index.htm;' >> $jitsi_nginx_site
  251. echo '' >> $jitsi_nginx_site
  252. echo ' location /config.js {' >> $jitsi_nginx_site
  253. echo " alias /etc/jitsi/meet/${JITSI_DOMAIN_NAME}-config.js;" >> $jitsi_nginx_site
  254. echo ' }' >> $jitsi_nginx_site
  255. echo '' >> $jitsi_nginx_site
  256. echo ' location ~ ^/([a-zA-Z0-9=\?]+)$ {' >> $jitsi_nginx_site
  257. echo ' rewrite ^/(.*)$ / break;' >> $jitsi_nginx_site
  258. echo ' }' >> $jitsi_nginx_site
  259. echo '' >> $jitsi_nginx_site
  260. echo ' location / {' >> $jitsi_nginx_site
  261. echo ' ssi on;' >> $jitsi_nginx_site
  262. echo ' }' >> $jitsi_nginx_site
  263. echo '' >> $jitsi_nginx_site
  264. echo ' # Backward compatibility' >> $jitsi_nginx_site
  265. echo ' location ~ /external_api.* {' >> $jitsi_nginx_site
  266. echo ' root /usr/share/jitsi-meet/libs;' >> $jitsi_nginx_site
  267. echo ' }' >> $jitsi_nginx_site
  268. echo '' >> $jitsi_nginx_site
  269. echo ' # Logs' >> $jitsi_nginx_site
  270. echo ' access_log /dev/null;' >> $jitsi_nginx_site
  271. echo ' error_log /dev/null;' >> $jitsi_nginx_site
  272. echo '' >> $jitsi_nginx_site
  273. echo ' # BOSH' >> $jitsi_nginx_site
  274. echo ' location /http-bind {' >> $jitsi_nginx_site
  275. echo ' proxy_pass http://localhost:5280/http-bind;' >> $jitsi_nginx_site
  276. echo ' proxy_set_header X-Forwarded-For $remote_addr;' >> $jitsi_nginx_site
  277. echo ' proxy_set_header Host $http_host;' >> $jitsi_nginx_site
  278. echo ' }' >> $jitsi_nginx_site
  279. echo '}' >> $jitsi_nginx_site
  280. fi
  281. echo '' >> $jitsi_nginx_site
  282. echo 'server {' >> $jitsi_nginx_site
  283. echo " listen 127.0.0.1:$JITSI_ONION_PORT default_server;" >> $jitsi_nginx_site
  284. if [[ $ONION_ONLY == 'no' ]]; then
  285. echo " server_name ${JITSI_DOMAIN_NAME};" >> $jitsi_nginx_site
  286. else
  287. echo " server_name ${JITSI_ONION_HOSTNAME};" >> $jitsi_nginx_site
  288. fi
  289. echo '' >> $jitsi_nginx_site
  290. echo ' root /usr/share/jitsi-meet;' >> $jitsi_nginx_site
  291. echo ' index index.html index.htm;' >> $jitsi_nginx_site
  292. echo '' >> $jitsi_nginx_site
  293. echo ' location /config.js {' >> $jitsi_nginx_site
  294. echo " alias /etc/jitsi/meet/${JITSI_DOMAIN_NAME}-config.js;" >> $jitsi_nginx_site
  295. echo ' }' >> $jitsi_nginx_site
  296. echo '' >> $jitsi_nginx_site
  297. echo ' location ~ ^/([a-zA-Z0-9=\?]+)$ {' >> $jitsi_nginx_site
  298. echo ' rewrite ^/(.*)$ / break;' >> $jitsi_nginx_site
  299. echo ' }' >> $jitsi_nginx_site
  300. echo '' >> $jitsi_nginx_site
  301. echo ' location / {' >> $jitsi_nginx_site
  302. echo ' ssi off;' >> $jitsi_nginx_site
  303. echo ' }' >> $jitsi_nginx_site
  304. echo '' >> $jitsi_nginx_site
  305. echo ' # Backward compatibility' >> $jitsi_nginx_site
  306. echo ' location ~ /external_api.* {' >> $jitsi_nginx_site
  307. echo ' root /usr/share/jitsi-meet/libs;' >> $jitsi_nginx_site
  308. echo ' }' >> $jitsi_nginx_site
  309. echo '' >> $jitsi_nginx_site
  310. echo ' # Logs' >> $jitsi_nginx_site
  311. echo ' access_log /dev/null;' >> $jitsi_nginx_site
  312. echo ' error_log /dev/null;' >> $jitsi_nginx_site
  313. echo '' >> $jitsi_nginx_site
  314. echo ' # BOSH' >> $jitsi_nginx_site
  315. echo ' location /http-bind {' >> $jitsi_nginx_site
  316. echo ' proxy_pass http://localhost:5280/http-bind;' >> $jitsi_nginx_site
  317. echo ' proxy_set_header X-Forwarded-For $remote_addr;' >> $jitsi_nginx_site
  318. echo ' proxy_set_header Host $http_host;' >> $jitsi_nginx_site
  319. echo ' }' >> $jitsi_nginx_site
  320. echo '}' >> $jitsi_nginx_site
  321. sed -i "s|/var/www/${JITSI_DOMAIN_NAME}/htdocs|/usr/share/jitsi-meet|g" $jitsi_nginx_site
  322. if [ ! -f /etc/ssl/certs/${JITSI_DOMAIN_NAME}.pem ]; then
  323. if [ -f /etc/ssl/certs/${JITSI_DOMAIN_NAME}.crt ]; then
  324. rm /etc/ssl/certs/${JITSI_DOMAIN_NAME}.crt
  325. fi
  326. if [ -f /etc/ssl/certs/${JITSI_DOMAIN_NAME}.dhparam ]; then
  327. rm /etc/ssl/certs/${JITSI_DOMAIN_NAME}.dhparam
  328. fi
  329. function_check create_site_certificate
  330. create_site_certificate ${JITSI_DOMAIN_NAME} 'yes'
  331. if [[ $ONION_ONLY == "no" ]]; then
  332. if [ ! -f /etc/ssl/certs/${JITSI_DOMAIN_NAME}.pem ]; then
  333. exit 678363
  334. fi
  335. fi
  336. fi
  337. if [ -d /etc/letsencrypt ]; then
  338. usermod -a -G www-data jitsi
  339. usermod -a -G ssl-cert jitsi
  340. fi
  341. if [ -f /etc/ssl/certs/${JITSI_DOMAIN_NAME}.pem ]; then
  342. sed -i "s|.crt|.pem|g" /etc/prosody/conf.d/${JITSI_DOMAIN_NAME}.cfg.lua
  343. fi
  344. sed -i "s|key =.*|key = \"/etc/ssl/private/${JITSI_DOMAIN_NAME}.key\"|g" /etc/prosody/conf.avail/${JITSI_DOMAIN_NAME}.cfg.lua
  345. sed -i "s|certificate =.*|certificate = \"/etc/ssl/certs/${JITSI_DOMAIN_NAME}.pem\"|g" /etc/prosody/conf.avail/${JITSI_DOMAIN_NAME}.cfg.lua
  346. sed -i "s|enableWelcomePage:.*|enableWelcomePage: false,|g" /etc/jitsi/meet/${JITSI_DOMAIN_NAME}-config.js
  347. sed -i "s|disableStats:.*|disableStats: true,|g" /etc/jitsi/meet/${JITSI_DOMAIN_NAME}-config.js
  348. sed -i "s|minHDHeight:.*|minHDHeight: 800,|g" /etc/jitsi/meet/${JITSI_DOMAIN_NAME}-config.js
  349. sed -i "s|clientNode:.*|clientNode: 'https://${JITSI_DOMAIN_NAME}',|g" /etc/jitsi/meet/${JITSI_DOMAIN_NAME}-config.js
  350. sed -i "s|navigator.mozGetUserMedia|navigator.mediaDevices.getUserMedia|g" /usr/share/jitsi-meet/libs/lib-jitsi-meet.min.js
  351. # generated certs which aren't used
  352. if [ -f /usr/lib/ssl/certs/${JITSI_DOMAIN_NAME}.pem ]; then
  353. rm /usr/lib/ssl/certs/${JITSI_DOMAIN_NAME}.pem
  354. fi
  355. if [ -f /usr/lib/ssl/private/${JITSI_DOMAIN_NAME}.key ]; then
  356. rm /usr/lib/ssl/private/${JITSI_DOMAIN_NAME}.key
  357. fi
  358. if [ -f /usr/lib/ssl/certs/${JITSI_DOMAIN_NAME}.dhparam ]; then
  359. rm /usr/lib/ssl/certs/${JITSI_DOMAIN_NAME}.dhparam
  360. fi
  361. function_check nginx_ensite
  362. nginx_ensite ${JITSI_DOMAIN_NAME}
  363. set_completion_param "jitsi domain" "$JITSI_DOMAIN_NAME"
  364. jitsi_disable_google_spyware
  365. systemctl restart nginx
  366. systemctl restart prosody
  367. function_check add_ddns_domain
  368. add_ddns_domain $JITSI_DOMAIN_NAME
  369. APP_INSTALLED=1
  370. }