Installation de BBB proprement dite

Makefile

@@ -5,7 +5,7 @@ PLAYBOOK  ?= site.yml
 EXTRA_VARS ?=
 ANSIBLE   ?= ansible-playbook
 
-.PHONY: help ping check run dry-run diff vars tree clean
+.PHONY: help ping check run dry-run diff vars tree clean prep bbb bbb-dry-run
 
 help:
 	@echo "Targets:"
@@ -45,3 +45,12 @@ tree:
 
 clean:
 	@find . -name "*.retry" -delete
+
+prep:
+	$(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags prep $(EXTRA_VARS)
+
+bbb:
+	$(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags bbb $(EXTRA_VARS)
+
+bbb-dry-run:
+	$(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags bbb --check --diff $(EXTRA_VARS)

README.md

@@ -34,3 +34,21 @@ make dry-run
 ## Notes
 - Docker gardera ses règles nécessaires au bridge/NAT; ce dépôt ajoute une couche “policy” via nftables.
 - TURN sur 443 “exclusif” n’est pas compatible cohabitation 1 IP avec nginx/BBB (on utilise 5349/TLS).
+
+
+## Installation BBB + TURN (suite)
+
+1) Renseigne `letsencrypt_email` dans `group_vars/all.yml`.
+2) Applique uniquement l'installation BBB :
+
+```bash
+make bbb
+```
+
+Pour un dry-run (vérification) :
+
+```bash
+make bbb-dry-run
+```
+
+> Note: BBB 3.x installe un TURN local + HAProxy pour partager le port 443 avec HTTPS. Le firewall `hostfilter` doit donc autoriser **UDP/443** en plus de TCP/443.

Runbook_BBB_VPS_Ubuntu22.04.md

@@ -196,3 +196,28 @@ Créer un rôle `bbb_install` séparé qui :
 
 ### Historique
 - 2026-02-08 : Base VPS opérationnelle (SSH, nftables, fail2ban, docker, journald, sysctl, swap idempotent).
+
+
+## Installation BBB 3.x + TURN local (coturn + haproxy)
+
+### Pré-requis
+- DNS `{{fqdn}}` -> IP publique du VPS
+- Ports ouverts côté pare-feu (nftables): TCP 80/443, UDP 16384-32768, TURN 3478 TCP/UDP + **443 TCP/UDP**, et la plage relay UDP configurée (par défaut 50000-55000).
+
+### Procédure (Ansible)
+1) Mettre à jour `group_vars/all.yml` : renseigner `letsencrypt_email`.
+2) Exécuter :
+
+```bash
+make bbb
+```
+
+### Vérifications
+Sur le serveur :
+- `bbb-conf --check`
+- `systemctl is-active haproxy coturn nginx`
+- `grep -E '^(min-port|max-port)=' /etc/turnserver.conf`
+
+Référence officielle :
+- Installation BBB : https://docs.bigbluebutton.org/administration/install/
+- TURN : https://docs.bigbluebutton.org/administration/turn-server/

group_vars/all.yml

@@ -27,9 +27,10 @@ bbb_udp_min: 16384
 bbb_udp_max: 32768
 
 # --- TURN cohabitation (1 IP) ---
+# BBB 3.x installe un TURN local + HAProxy pour partager le port 443 avec HTTPS (recommandé pour les réseaux restrictifs).
 turn_enabled: true
 turn_listen_port: 3478          # TCP/UDP
-turn_tls_port: 5349             # TURN over TLS (standard). 443 est conflictuel sur 1 IP avec nginx/BBB
+turn_tls_port: 443            # TCP/UDP (TURN on 443 via haproxy, cohabite avec HTTPS)
 turn_relay_udp_min: 50000
 turn_relay_udp_max: 55000
 
@@ -46,3 +47,10 @@ swapfile_size_mb: 8192
 # --- Docker (BBB 3.x requires latest docker) ---
 docker_install: true
 docker_add_admin_to_group: false   # IMPORTANT: groupe docker = root-equivalent
+
+# --- BBB install (via bbb-install.sh) ---
+bbb_install_enabled: true
+bbb_version: "jammy-300"          # installe toujours la dernière 3.0.x
+letsencrypt_email: "allaire.dan@chezlepro.ca"             # OBLIGATOIRE: email pour Let's Encrypt (ex: ops@chezlepro.ca)
+bbb_skip_min_requirements: true    # -j: utile si IPv6 désactivé ou serveur < recommandations prod
+bbb_install_greenlight: false      # -g (optionnel)

inventory.ini

@@ -1,4 +1,5 @@
 [vps]
 bbb ansible_host=158.69.198.149 ansible_user=ansible ansible_ssh_extra_args='-o PreferredAuthentications=publickey' ansible_scp_if_ssh=True
-bbb ansible_python_interpreter=/usr/bin/python3
 
+[vps:vars]
+ansible_python_interpreter=/usr/bin/python3

roles/bbb_install/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+# URL officielle du script d'installation BBB 3.0.x
+bbb_install_script_url: "https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh"
+
+# Où stocker le script sur la cible
+bbb_install_script_path: "/root/bbb-install/bbb-install.sh"
+
+# Commande bbb-install.sh (construite dans tasks)
+bbb_install_force: false

roles/bbb_install/handlers/main.yml

@@ -0,0 +1,15 @@
+---
+- name: restart coturn
+  ansible.builtin.service:
+    name: coturn
+    state: restarted
+
+- name: restart haproxy
+  ansible.builtin.service:
+    name: haproxy
+    state: restarted
+
+- name: restart nginx
+  ansible.builtin.service:
+    name: nginx
+    state: restarted

roles/bbb_install/tasks/main.yml

@@ -0,0 +1,97 @@
+---
+- name: Assert letsencrypt_email is set
+  ansible.builtin.assert:
+    that:
+      - letsencrypt_email is defined
+      - (letsencrypt_email | trim) | length > 0
+    fail_msg: "Définis letsencrypt_email (ex: ops@chezlepro.ca) dans group_vars/all.yml"
+
+- name: Ensure working directory exists for bbb-install
+  ansible.builtin.file:
+    path: "{{ bbb_install_script_path | dirname }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+# NOTE: bbb-install / bbb-conf s'appuie parfois sur des helpers UFW. On installe le paquet
+# mais on ne l'active pas. Le firewall effectif reste nftables (hostfilter).
+- name: Install ufw package (kept disabled)
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+    update_cache: true
+
+- name: Ensure ufw service is disabled (nftables is authoritative)
+  ansible.builtin.systemd:
+    name: ufw
+    enabled: false
+    state: stopped
+  failed_when: false
+
+- name: Download bbb-install.sh (BBB 3.0.x)
+  ansible.builtin.get_url:
+    url: "{{ bbb_install_script_url }}"
+    dest: "{{ bbb_install_script_path }}"
+    mode: "0755"
+    owner: root
+    group: root
+
+- name: Detect if BBB is already installed
+  ansible.builtin.stat:
+    path: /usr/bin/bbb-conf
+  register: bbb_conf_bin
+
+- name: Run bbb-install.sh (BBB 3.x + built-in TURN/haproxy)
+  ansible.builtin.command: >
+    {{ bbb_install_script_path }}
+    -v {{ bbb_version }}
+    -s {{ fqdn }}
+    -e {{ letsencrypt_email }}
+    {% if bbb_skip_min_requirements | bool %}-j{% endif %}
+    {% if bbb_install_greenlight | bool %}-g{% endif %}
+  register: bbb_install_run
+  changed_when: true
+  when: bbb_install_force | bool or not bbb_conf_bin.stat.exists
+
+# --- Post-install: align coturn relay UDP range with our nftables policy ---
+- name: Ensure /etc/turnserver.conf exists (installed by bbb-install)
+  ansible.builtin.stat:
+    path: /etc/turnserver.conf
+  register: turn_conf
+
+- name: Set coturn min-port (relay UDP) to match firewall
+  ansible.builtin.lineinfile:
+    path: /etc/turnserver.conf
+    regexp: '^min-port='
+    line: "min-port={{ turn_relay_udp_min }}"
+    backrefs: false
+  when: turn_conf.stat.exists and turn_enabled | bool
+  notify: restart coturn
+
+- name: Set coturn max-port (relay UDP) to match firewall
+  ansible.builtin.lineinfile:
+    path: /etc/turnserver.conf
+    regexp: '^max-port='
+    line: "max-port={{ turn_relay_udp_max }}"
+    backrefs: false
+  when: turn_conf.stat.exists and turn_enabled | bool
+  notify: restart coturn
+
+- name: Ensure coturn listens on standard ports (3478 + 443) - doc check
+  ansible.builtin.assert:
+    that:
+      - turn_listen_port | int == 3478
+      - turn_tls_port | int == 443
+    fail_msg: "Pour la compatibilité BBB, on recommande turn_listen_port=3478 et turn_tls_port=443 (TURN sur 443 via HAProxy)."
+  when: turn_enabled | bool
+
+# --- Verify ---
+- name: Run bbb-conf --check
+  ansible.builtin.command: bbb-conf --check
+  register: bbb_check
+  changed_when: false
+
+- name: Show bbb-conf --check (first 200 lines)
+  ansible.builtin.debug:
+    msg: "{{ (bbb_check.stdout_lines | default([]))[:200] }}"

roles/bbb_vps_prep/templates/hostfilter.nft.j2

@@ -41,9 +41,10 @@ table inet hostfilter {
     udp dport {{ bbb_udp_min }}-{{ bbb_udp_max }} accept
 
     {% if turn_enabled | bool %}
-    # TURN cohabitation (no 443)
+    # TURN (coturn) — ports clients recommandés: 3478 + 443 (TCP/UDP) + plage UDP relay
     udp dport {{ turn_listen_port }} accept
     tcp dport {{ turn_listen_port }} accept
+    udp dport {{ turn_tls_port }} accept
     tcp dport {{ turn_tls_port }} accept
     udp dport {{ turn_relay_udp_min }}-{{ turn_relay_udp_max }} accept
     {% endif %}

site.yml

@@ -1,7 +1,14 @@
 ---
-- name: Prepare Ubuntu 22.04 VPS for BBB (nftables + hardening + Docker)
+- name: Préparer le VPS Ubuntu 22.04 (durcissement + nftables + Docker)
   hosts: vps
   become: true
   gather_facts: true
   roles:
-    - bbb_vps_prep
+    - { role: bbb_vps_prep, tags: ["prep"] }
+
+- name: Installer / configurer BigBlueButton (BBB 3.x) + coturn (TURN local)
+  hosts: vps
+  become: true
+  gather_facts: true
+  roles:
+    - { role: bbb_install, tags: ["bbb"], when: bbb_install_enabled | bool }