From fa02a84e07ef83f1f19e5127e607f81d521e01ba Mon Sep 17 00:00:00 2001 From: Daniel Allaire Date: Sun, 8 Feb 2026 20:47:25 -0500 Subject: [PATCH] Installation de BBB proprement dite --- Makefile | 11 ++- README.md | 18 ++++ Runbook_BBB_VPS_Ubuntu22.04.md | 25 +++++ group_vars/all.yml | 10 +- inventory.ini | 3 +- roles/bbb_install/defaults/main.yml | 9 ++ roles/bbb_install/handlers/main.yml | 15 +++ roles/bbb_install/tasks/main.yml | 97 +++++++++++++++++++ .../bbb_vps_prep/templates/hostfilter.nft.j2 | 3 +- site.yml | 11 ++- 10 files changed, 196 insertions(+), 6 deletions(-) create mode 100644 roles/bbb_install/defaults/main.yml create mode 100644 roles/bbb_install/handlers/main.yml create mode 100644 roles/bbb_install/tasks/main.yml diff --git a/Makefile b/Makefile index d6d4305..4c864ea 100644 --- a/Makefile +++ b/Makefile @@ -5,7 +5,7 @@ PLAYBOOK ?= site.yml EXTRA_VARS ?= ANSIBLE ?= ansible-playbook -.PHONY: help ping check run dry-run diff vars tree clean +.PHONY: help ping check run dry-run diff vars tree clean prep bbb bbb-dry-run help: @echo "Targets:" @@ -45,3 +45,12 @@ tree: clean: @find . -name "*.retry" -delete + +prep: + $(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags prep $(EXTRA_VARS) + +bbb: + $(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags bbb $(EXTRA_VARS) + +bbb-dry-run: + $(ANSIBLE) -i $(INVENTORY) $(PLAYBOOK) --become --tags bbb --check --diff $(EXTRA_VARS) diff --git a/README.md b/README.md index 48f9e78..50c35f6 100644 --- a/README.md +++ b/README.md @@ -34,3 +34,21 @@ make dry-run ## Notes - Docker gardera ses règles nécessaires au bridge/NAT; ce dépôt ajoute une couche “policy” via nftables. - TURN sur 443 “exclusif” n’est pas compatible cohabitation 1 IP avec nginx/BBB (on utilise 5349/TLS). + + +## Installation BBB + TURN (suite) + +1) Renseigne `letsencrypt_email` dans `group_vars/all.yml`. +2) Applique uniquement l'installation BBB : + +```bash +make bbb +``` + +Pour un dry-run (vérification) : + +```bash +make bbb-dry-run +``` + +> Note: BBB 3.x installe un TURN local + HAProxy pour partager le port 443 avec HTTPS. Le firewall `hostfilter` doit donc autoriser **UDP/443** en plus de TCP/443. diff --git a/Runbook_BBB_VPS_Ubuntu22.04.md b/Runbook_BBB_VPS_Ubuntu22.04.md index 02d114b..4de01eb 100644 --- a/Runbook_BBB_VPS_Ubuntu22.04.md +++ b/Runbook_BBB_VPS_Ubuntu22.04.md @@ -196,3 +196,28 @@ Créer un rôle `bbb_install` séparé qui : ### Historique - 2026-02-08 : Base VPS opérationnelle (SSH, nftables, fail2ban, docker, journald, sysctl, swap idempotent). + + +## Installation BBB 3.x + TURN local (coturn + haproxy) + +### Pré-requis +- DNS `{{fqdn}}` -> IP publique du VPS +- Ports ouverts côté pare-feu (nftables): TCP 80/443, UDP 16384-32768, TURN 3478 TCP/UDP + **443 TCP/UDP**, et la plage relay UDP configurée (par défaut 50000-55000). + +### Procédure (Ansible) +1) Mettre à jour `group_vars/all.yml` : renseigner `letsencrypt_email`. +2) Exécuter : + +```bash +make bbb +``` + +### Vérifications +Sur le serveur : +- `bbb-conf --check` +- `systemctl is-active haproxy coturn nginx` +- `grep -E '^(min-port|max-port)=' /etc/turnserver.conf` + +Référence officielle : +- Installation BBB : https://docs.bigbluebutton.org/administration/install/ +- TURN : https://docs.bigbluebutton.org/administration/turn-server/ diff --git a/group_vars/all.yml b/group_vars/all.yml index 7ef28f1..0a7cf7b 100644 --- a/group_vars/all.yml +++ b/group_vars/all.yml @@ -27,9 +27,10 @@ bbb_udp_min: 16384 bbb_udp_max: 32768 # --- TURN cohabitation (1 IP) --- +# BBB 3.x installe un TURN local + HAProxy pour partager le port 443 avec HTTPS (recommandé pour les réseaux restrictifs). turn_enabled: true turn_listen_port: 3478 # TCP/UDP -turn_tls_port: 5349 # TURN over TLS (standard). 443 est conflictuel sur 1 IP avec nginx/BBB +turn_tls_port: 443 # TCP/UDP (TURN on 443 via haproxy, cohabite avec HTTPS) turn_relay_udp_min: 50000 turn_relay_udp_max: 55000 @@ -46,3 +47,10 @@ swapfile_size_mb: 8192 # --- Docker (BBB 3.x requires latest docker) --- docker_install: true docker_add_admin_to_group: false # IMPORTANT: groupe docker = root-equivalent + +# --- BBB install (via bbb-install.sh) --- +bbb_install_enabled: true +bbb_version: "jammy-300" # installe toujours la dernière 3.0.x +letsencrypt_email: "allaire.dan@chezlepro.ca" # OBLIGATOIRE: email pour Let's Encrypt (ex: ops@chezlepro.ca) +bbb_skip_min_requirements: true # -j: utile si IPv6 désactivé ou serveur < recommandations prod +bbb_install_greenlight: false # -g (optionnel) diff --git a/inventory.ini b/inventory.ini index deba735..d3a2c58 100644 --- a/inventory.ini +++ b/inventory.ini @@ -1,4 +1,5 @@ [vps] bbb ansible_host=158.69.198.149 ansible_user=ansible ansible_ssh_extra_args='-o PreferredAuthentications=publickey' ansible_scp_if_ssh=True -bbb ansible_python_interpreter=/usr/bin/python3 +[vps:vars] +ansible_python_interpreter=/usr/bin/python3 diff --git a/roles/bbb_install/defaults/main.yml b/roles/bbb_install/defaults/main.yml new file mode 100644 index 0000000..d89bfe4 --- /dev/null +++ b/roles/bbb_install/defaults/main.yml @@ -0,0 +1,9 @@ +--- +# URL officielle du script d'installation BBB 3.0.x +bbb_install_script_url: "https://raw.githubusercontent.com/bigbluebutton/bbb-install/v3.0.x-release/bbb-install.sh" + +# Où stocker le script sur la cible +bbb_install_script_path: "/root/bbb-install/bbb-install.sh" + +# Commande bbb-install.sh (construite dans tasks) +bbb_install_force: false diff --git a/roles/bbb_install/handlers/main.yml b/roles/bbb_install/handlers/main.yml new file mode 100644 index 0000000..efc03ef --- /dev/null +++ b/roles/bbb_install/handlers/main.yml @@ -0,0 +1,15 @@ +--- +- name: restart coturn + ansible.builtin.service: + name: coturn + state: restarted + +- name: restart haproxy + ansible.builtin.service: + name: haproxy + state: restarted + +- name: restart nginx + ansible.builtin.service: + name: nginx + state: restarted diff --git a/roles/bbb_install/tasks/main.yml b/roles/bbb_install/tasks/main.yml new file mode 100644 index 0000000..b050338 --- /dev/null +++ b/roles/bbb_install/tasks/main.yml @@ -0,0 +1,97 @@ +--- +- name: Assert letsencrypt_email is set + ansible.builtin.assert: + that: + - letsencrypt_email is defined + - (letsencrypt_email | trim) | length > 0 + fail_msg: "Définis letsencrypt_email (ex: ops@chezlepro.ca) dans group_vars/all.yml" + +- name: Ensure working directory exists for bbb-install + ansible.builtin.file: + path: "{{ bbb_install_script_path | dirname }}" + state: directory + owner: root + group: root + mode: "0700" + +# NOTE: bbb-install / bbb-conf s'appuie parfois sur des helpers UFW. On installe le paquet +# mais on ne l'active pas. Le firewall effectif reste nftables (hostfilter). +- name: Install ufw package (kept disabled) + ansible.builtin.apt: + name: ufw + state: present + update_cache: true + +- name: Ensure ufw service is disabled (nftables is authoritative) + ansible.builtin.systemd: + name: ufw + enabled: false + state: stopped + failed_when: false + +- name: Download bbb-install.sh (BBB 3.0.x) + ansible.builtin.get_url: + url: "{{ bbb_install_script_url }}" + dest: "{{ bbb_install_script_path }}" + mode: "0755" + owner: root + group: root + +- name: Detect if BBB is already installed + ansible.builtin.stat: + path: /usr/bin/bbb-conf + register: bbb_conf_bin + +- name: Run bbb-install.sh (BBB 3.x + built-in TURN/haproxy) + ansible.builtin.command: > + {{ bbb_install_script_path }} + -v {{ bbb_version }} + -s {{ fqdn }} + -e {{ letsencrypt_email }} + {% if bbb_skip_min_requirements | bool %}-j{% endif %} + {% if bbb_install_greenlight | bool %}-g{% endif %} + register: bbb_install_run + changed_when: true + when: bbb_install_force | bool or not bbb_conf_bin.stat.exists + +# --- Post-install: align coturn relay UDP range with our nftables policy --- +- name: Ensure /etc/turnserver.conf exists (installed by bbb-install) + ansible.builtin.stat: + path: /etc/turnserver.conf + register: turn_conf + +- name: Set coturn min-port (relay UDP) to match firewall + ansible.builtin.lineinfile: + path: /etc/turnserver.conf + regexp: '^min-port=' + line: "min-port={{ turn_relay_udp_min }}" + backrefs: false + when: turn_conf.stat.exists and turn_enabled | bool + notify: restart coturn + +- name: Set coturn max-port (relay UDP) to match firewall + ansible.builtin.lineinfile: + path: /etc/turnserver.conf + regexp: '^max-port=' + line: "max-port={{ turn_relay_udp_max }}" + backrefs: false + when: turn_conf.stat.exists and turn_enabled | bool + notify: restart coturn + +- name: Ensure coturn listens on standard ports (3478 + 443) - doc check + ansible.builtin.assert: + that: + - turn_listen_port | int == 3478 + - turn_tls_port | int == 443 + fail_msg: "Pour la compatibilité BBB, on recommande turn_listen_port=3478 et turn_tls_port=443 (TURN sur 443 via HAProxy)." + when: turn_enabled | bool + +# --- Verify --- +- name: Run bbb-conf --check + ansible.builtin.command: bbb-conf --check + register: bbb_check + changed_when: false + +- name: Show bbb-conf --check (first 200 lines) + ansible.builtin.debug: + msg: "{{ (bbb_check.stdout_lines | default([]))[:200] }}" diff --git a/roles/bbb_vps_prep/templates/hostfilter.nft.j2 b/roles/bbb_vps_prep/templates/hostfilter.nft.j2 index 29ed1d5..1e08360 100644 --- a/roles/bbb_vps_prep/templates/hostfilter.nft.j2 +++ b/roles/bbb_vps_prep/templates/hostfilter.nft.j2 @@ -41,9 +41,10 @@ table inet hostfilter { udp dport {{ bbb_udp_min }}-{{ bbb_udp_max }} accept {% if turn_enabled | bool %} - # TURN cohabitation (no 443) + # TURN (coturn) — ports clients recommandés: 3478 + 443 (TCP/UDP) + plage UDP relay udp dport {{ turn_listen_port }} accept tcp dport {{ turn_listen_port }} accept + udp dport {{ turn_tls_port }} accept tcp dport {{ turn_tls_port }} accept udp dport {{ turn_relay_udp_min }}-{{ turn_relay_udp_max }} accept {% endif %} diff --git a/site.yml b/site.yml index 01a6d9c..1d97ba9 100644 --- a/site.yml +++ b/site.yml @@ -1,7 +1,14 @@ --- -- name: Prepare Ubuntu 22.04 VPS for BBB (nftables + hardening + Docker) +- name: Préparer le VPS Ubuntu 22.04 (durcissement + nftables + Docker) hosts: vps become: true gather_facts: true roles: - - bbb_vps_prep + - { role: bbb_vps_prep, tags: ["prep"] } + +- name: Installer / configurer BigBlueButton (BBB 3.x) + coturn (TURN local) + hosts: vps + become: true + gather_facts: true + roles: + - { role: bbb_install, tags: ["bbb"], when: bbb_install_enabled | bool }