97 lines
3 KiB
YAML
97 lines
3 KiB
YAML
---
|
|
- name: Assert letsencrypt_email is set
|
|
ansible.builtin.assert:
|
|
that:
|
|
- letsencrypt_email is defined
|
|
- (letsencrypt_email | trim) | length > 0
|
|
fail_msg: "Définis letsencrypt_email (ex: ops@chezlepro.ca) dans group_vars/all.yml"
|
|
|
|
- name: Ensure working directory exists for bbb-install
|
|
ansible.builtin.file:
|
|
path: "{{ bbb_install_script_path | dirname }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
# NOTE: bbb-install / bbb-conf s'appuie parfois sur des helpers UFW. On installe le paquet
|
|
# mais on ne l'active pas. Le firewall effectif reste nftables (hostfilter).
|
|
- name: Install ufw package (kept disabled)
|
|
ansible.builtin.apt:
|
|
name: ufw
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Ensure ufw service is disabled (nftables is authoritative)
|
|
ansible.builtin.systemd:
|
|
name: ufw
|
|
enabled: false
|
|
state: stopped
|
|
failed_when: false
|
|
|
|
- name: Download bbb-install.sh (BBB 3.0.x)
|
|
ansible.builtin.get_url:
|
|
url: "{{ bbb_install_script_url }}"
|
|
dest: "{{ bbb_install_script_path }}"
|
|
mode: "0755"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Detect if BBB is already installed
|
|
ansible.builtin.stat:
|
|
path: /usr/bin/bbb-conf
|
|
register: bbb_conf_bin
|
|
|
|
- name: Run bbb-install.sh (BBB 3.x + built-in TURN/haproxy)
|
|
ansible.builtin.command: >
|
|
{{ bbb_install_script_path }}
|
|
-v {{ bbb_version }}
|
|
-s {{ fqdn }}
|
|
-e {{ letsencrypt_email }}
|
|
{% if bbb_skip_min_requirements | bool %}-j{% endif %}
|
|
{% if bbb_install_greenlight | bool %}-g{% endif %}
|
|
register: bbb_install_run
|
|
changed_when: true
|
|
when: bbb_install_force | bool or not bbb_conf_bin.stat.exists
|
|
|
|
# --- Post-install: align coturn relay UDP range with our nftables policy ---
|
|
- name: Ensure /etc/turnserver.conf exists (installed by bbb-install)
|
|
ansible.builtin.stat:
|
|
path: /etc/turnserver.conf
|
|
register: turn_conf
|
|
|
|
- name: Set coturn min-port (relay UDP) to match firewall
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/turnserver.conf
|
|
regexp: '^min-port='
|
|
line: "min-port={{ turn_relay_udp_min }}"
|
|
backrefs: false
|
|
when: turn_conf.stat.exists and turn_enabled | bool
|
|
notify: restart coturn
|
|
|
|
- name: Set coturn max-port (relay UDP) to match firewall
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/turnserver.conf
|
|
regexp: '^max-port='
|
|
line: "max-port={{ turn_relay_udp_max }}"
|
|
backrefs: false
|
|
when: turn_conf.stat.exists and turn_enabled | bool
|
|
notify: restart coturn
|
|
|
|
- name: Ensure coturn listens on standard ports (3478 + 443) - doc check
|
|
ansible.builtin.assert:
|
|
that:
|
|
- turn_listen_port | int == 3478
|
|
- turn_tls_port | int == 443
|
|
fail_msg: "Pour la compatibilité BBB, on recommande turn_listen_port=3478 et turn_tls_port=443 (TURN sur 443 via HAProxy)."
|
|
when: turn_enabled | bool
|
|
|
|
# --- Verify ---
|
|
- name: Run bbb-conf --check
|
|
ansible.builtin.command: bbb-conf --check
|
|
register: bbb_check
|
|
changed_when: false
|
|
|
|
- name: Show bbb-conf --check (first 200 lines)
|
|
ansible.builtin.debug:
|
|
msg: "{{ (bbb_check.stdout_lines | default([]))[:200] }}"
|