Выгрузка F7cloud_HPB
This commit is contained in:
root
commit
673cb90bd0
8
.gitignore
vendored
Normal file
8
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
# Конфиг с секретами — не выгружать в git
|
||||
server.conf
|
||||
|
||||
# Резервные копии и временные файлы
|
||||
*.bak
|
||||
*.swp
|
||||
*~
|
||||
.DS_Store
|
||||
33
README.md
Normal file
33
README.md
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
# HPB — Nextcloud Spreed Signaling (f7cloud)
|
||||
|
||||
Сервисы для стека Nextcloud Talk: signaling, Janus, NATS, coTURN.
|
||||
|
||||
## Сервисы
|
||||
|
||||
| Сервис | Описание |
|
||||
|--------|----------|
|
||||
| **signaling.service** | Nextcloud Talk signaling server |
|
||||
| **janus.service** | Janus WebRTC gateway (MCU) |
|
||||
| **nats-server.service** | NATS — обмен сообщениями |
|
||||
| **coturn.service** | coTURN — STUN/TURN для WebRTC |
|
||||
|
||||
## Установка unit-файлов
|
||||
|
||||
```bash
|
||||
sudo cp systemd/*.service /etc/systemd/system/
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable signaling janus nats-server coturn
|
||||
sudo systemctl start signaling janus nats-server coturn
|
||||
```
|
||||
|
||||
## Конфигурация
|
||||
|
||||
- `server.conf` — конфиг signaling (создаётся вручную, в репозиторий не входит из соображений безопасности).
|
||||
- Пример структуры конфига: см. `server.conf.example` (заполните секреты на сервере).
|
||||
|
||||
## Зависимости конфигов
|
||||
|
||||
- **signaling**: `/etc/f7cloud-spreed-signaling/server.conf`
|
||||
- **nats-server**: `/etc/nats-server.conf`
|
||||
- **coturn**: `/etc/turnserver.conf`
|
||||
- **janus**: конфиг по умолчанию (часто `/etc/janus/janus.jcfg`)
|
||||
43
server.conf.example
Normal file
43
server.conf.example
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# Пример конфигурации signaling.
|
||||
# Скопируйте как server.conf и подставьте свои секреты.
|
||||
# server.conf добавлен в .gitignore и в репозиторий не попадает.
|
||||
|
||||
[server]
|
||||
ratelimitRequestsPerSecond = 0
|
||||
ratelimitBurst = 0
|
||||
|
||||
[http]
|
||||
listen = 127.0.0.1:8080
|
||||
|
||||
[app]
|
||||
debug = false
|
||||
|
||||
[sessions]
|
||||
hashkey = YOUR_32_OR_64_BYTE_HEX_HASHKEY
|
||||
blockkey = YOUR_16_24_OR_32_BYTE_HEX_BLOCKKEY
|
||||
|
||||
[clients]
|
||||
internalsecret = YOUR_INTERNAL_CLIENT_SECRET
|
||||
|
||||
[backend]
|
||||
backends = nextcloud-backend-0
|
||||
# allowall = true # только для тестов
|
||||
secret = YOUR_NEXTCLOUD_BACKEND_SECRET
|
||||
timeout = 10
|
||||
connectionsperhost = 8
|
||||
|
||||
[nextcloud-backend-0]
|
||||
url = https://your-nextcloud.example
|
||||
secret = YOUR_NEXTCLOUD_BACKEND_SECRET
|
||||
|
||||
[nats]
|
||||
url = nats://localhost:4222
|
||||
|
||||
[mcu]
|
||||
type = janus
|
||||
url = ws://127.0.0.1:8188
|
||||
|
||||
[turn]
|
||||
apikey = YOUR_TURN_API_KEY
|
||||
secret = YOUR_TURN_SHARED_SECRET
|
||||
servers = turn:your-turn.example:9991?transport=udp,turn:your-turn.example:9991?transport=tcp
|
||||
16
systemd/coturn.service
Normal file
16
systemd/coturn.service
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
[Unit]
|
||||
Description=coTURN STUN/TURN Server
|
||||
Documentation=man:coturn(1) man:turnadmin(1) man:turnserver(1)
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User=turnserver
|
||||
Group=turnserver
|
||||
Type=notify
|
||||
ExecStart=/usr/bin/turnserver -c /etc/turnserver.conf --pidfile=
|
||||
Restart=on-failure
|
||||
InaccessibleDirectories=/home
|
||||
PrivateTmp=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
13
systemd/janus.service
Normal file
13
systemd/janus.service
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
[Unit]
|
||||
Description=Janus WebRTC gateway
|
||||
After=network.target
|
||||
Documentation=https://janus.conf.meetecho.com/docs/index.html
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
ExecStart=/usr/bin/janus --disable-colors --daemon --log-stdout
|
||||
Restart=on-failure
|
||||
LimitNOFILE=65536
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
15
systemd/nats-server.service
Normal file
15
systemd/nats-server.service
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
[Unit]
|
||||
Description=NATS Server
|
||||
After=network.target ntp.service
|
||||
|
||||
[Service]
|
||||
PrivateTmp=true
|
||||
Type=simple
|
||||
ExecStart=/usr/sbin/nats-server -c /etc/nats-server.conf
|
||||
ExecReload=/bin/kill -s HUP $MAINPID
|
||||
ExecStop=/bin/kill -s SIGINT $MAINPID
|
||||
User=nats
|
||||
Group=nats
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
43
systemd/signaling.service
Normal file
43
systemd/signaling.service
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
[Unit]
|
||||
Description=Nextcloud Talk signaling server
|
||||
|
||||
[Service]
|
||||
ExecStart=/usr/bin/signaling --config /etc/f7cloud-spreed-signaling/server.conf
|
||||
User=_signaling
|
||||
Group=_signaling
|
||||
Restart=on-failure
|
||||
|
||||
# Makes sure that /etc/signaling is owned by this service
|
||||
ConfigurationDirectory=signaling
|
||||
|
||||
# Hardening - see systemd.exec(5)
|
||||
CapabilityBoundingSet=
|
||||
ExecPaths=/usr/bin/signaling /usr/lib /usr/lib64
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
NoExecPaths=/
|
||||
NoNewPrivileges=yes
|
||||
PrivateDevices=yes
|
||||
PrivateTmp=yes
|
||||
PrivateUsers=yes
|
||||
ProcSubset=pid
|
||||
ProtectClock=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectHome=yes
|
||||
ProtectHostname=yes
|
||||
ProtectKernelLogs=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectKernelTunables=yes
|
||||
ProtectProc=invisible
|
||||
ProtectSystem=strict
|
||||
RemoveIPC=yes
|
||||
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictSUIDSGID=yes
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
SystemCallFilter=~ @privileged
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Loading…
Reference in New Issue
Block a user