252 lines
12 KiB
Bash
252 lines
12 KiB
Bash
#!/bin/bash
|
||
# postinst script for jitsi-meet-web-config
|
||
#
|
||
# see: dh_installdeb(1)
|
||
|
||
set -e
|
||
|
||
# summary of how this script can be called:
|
||
# * <postinst> `configure' <most-recently-configured-version>
|
||
# * <old-postinst> `abort-upgrade' <new version>
|
||
# * <conflictor's-postinst> `abort-remove' `in-favour' <package>
|
||
# <new-version>
|
||
# * <postinst> `abort-remove'
|
||
# * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
|
||
# <failed-install-package> <version> `removing'
|
||
# <conflicting-package> <version>
|
||
# for details, see http://www.debian.org/doc/debian-policy/ or
|
||
# the debian-policy package
|
||
|
||
case "$1" in
|
||
configure)
|
||
|
||
# loading debconf
|
||
. /usr/share/debconf/confmodule
|
||
|
||
# try to get host from jitsi-videobridge
|
||
db_get jitsi-videobridge/jvb-hostname
|
||
if [ -z "$RET" ] ; then
|
||
# server hostname
|
||
db_set jitsi-videobridge/jvb-hostname "localhost"
|
||
db_input critical jitsi-videobridge/jvb-hostname || true
|
||
db_go
|
||
fi
|
||
JVB_HOSTNAME="$RET"
|
||
|
||
# detect dpkg-reconfigure
|
||
RECONFIGURING="false"
|
||
db_get jitsi-meet/jvb-hostname
|
||
JVB_HOSTNAME_OLD=$RET
|
||
if [ -n "$RET" ] && [ ! "$JVB_HOSTNAME_OLD" = "$JVB_HOSTNAME" ] ; then
|
||
RECONFIGURING="true"
|
||
rm -f /etc/jitsi/meet/$JVB_HOSTNAME_OLD-config.js
|
||
fi
|
||
|
||
JVB_SERVE="false"
|
||
db_get jitsi-meet/jvb-serve
|
||
if [ -n "$RET" ] && [ "$RET" = "true" ] ; then
|
||
JVB_SERVE="true"
|
||
fi
|
||
|
||
# stores the hostname so we will reuse it later, like in purge
|
||
db_set jitsi-meet/jvb-hostname $JVB_HOSTNAME
|
||
|
||
NGINX_INSTALL_CHECK="$(dpkg-query -f '${Status}' -W 'nginx' 2>/dev/null | awk '{print $3}' || true)"
|
||
if [ "$NGINX_INSTALL_CHECK" = "installed" ] || [ "$NGINX_INSTALL_CHECK" = "unpacked" ] ; then
|
||
FORCE_NGINX="true"
|
||
fi
|
||
APACHE_INSTALL_CHECK="$(dpkg-query -f '${Status}' -W 'apache2' 2>/dev/null | awk '{print $3}' || true)"
|
||
if [ "$APACHE_INSTALL_CHECK" = "installed" ] || [ "$APACHE_INSTALL_CHECK" = "unpacked" ] ; then
|
||
FORCE_APACHE="true"
|
||
fi
|
||
|
||
# if first time config ask for certs, or if we are reconfiguring
|
||
if [ -z "$JVB_HOSTNAME_OLD" ] || [ "$RECONFIGURING" = "true" ] ; then
|
||
# SSL for nginx
|
||
db_get jitsi-meet/cert-choice
|
||
CERT_CHOICE="$RET"
|
||
UPLOADED_CERT_CHOICE="I want to use my own certificate"
|
||
|
||
if [ "$CERT_CHOICE" = "$UPLOADED_CERT_CHOICE" ] ; then
|
||
db_set jitsi-meet/cert-path-key "/etc/ssl/$JVB_HOSTNAME.key"
|
||
db_input critical jitsi-meet/cert-path-key || true
|
||
db_go
|
||
db_get jitsi-meet/cert-path-key
|
||
CERT_KEY="$RET"
|
||
db_set jitsi-meet/cert-path-crt "/etc/ssl/$JVB_HOSTNAME.crt"
|
||
db_input critical jitsi-meet/cert-path-crt || true
|
||
db_go
|
||
db_get jitsi-meet/cert-path-crt
|
||
CERT_CRT="$RET"
|
||
else
|
||
# create self-signed certs
|
||
CERT_KEY="/etc/jitsi/meet/$JVB_HOSTNAME.key"
|
||
CERT_CRT="/etc/jitsi/meet/$JVB_HOSTNAME.crt"
|
||
HOST="$( (hostname -s; echo localhost) | head -n 1)"
|
||
DOMAIN="$( (hostname -d; echo localdomain) | head -n 1)"
|
||
openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj \
|
||
"/O=$DOMAIN/OU=$HOST/CN=$JVB_HOSTNAME/emailAddress=webmaster@$HOST.$DOMAIN" \
|
||
-keyout $CERT_KEY \
|
||
-out $CERT_CRT
|
||
fi
|
||
fi
|
||
|
||
# jitsi meet
|
||
JITSI_MEET_CONFIG="/etc/jitsi/meet/$JVB_HOSTNAME-config.js"
|
||
if [ ! -f $JITSI_MEET_CONFIG ] ; then
|
||
cp /usr/share/doc/jitsi-meet-web-config/config.js $JITSI_MEET_CONFIG
|
||
sed -i "s/jitsi-meet.example.com/$JVB_HOSTNAME/g" $JITSI_MEET_CONFIG
|
||
fi
|
||
|
||
# this is new install let's configure jvb to serve meet
|
||
# no-nginx, no-apache installed on machine, this is new install or reconfiguring old one which have jvb_serve set
|
||
if [[ -z "$FORCE_NGINX" && -z "$FORCE_APACHE" && ( -z "$JVB_HOSTNAME_OLD" || ( "$JVB_SERVE" = "true" && "$RECONFIGURING" = "true" )) ]] ; then
|
||
|
||
JVB_ETC_CONFIG="/etc/jitsi/videobridge/config"
|
||
JVB_CONFIG="/etc/jitsi/videobridge/sip-communicator.properties"
|
||
|
||
# this is a reconfigure, lets just delete old links
|
||
if [ "$RECONFIGURING" = "true" ] ; then
|
||
rm -f $JVB_CONFIG
|
||
fi
|
||
|
||
# we will write to the file if missing create it
|
||
if [ ! -f $JVB_CONFIG ] ; then
|
||
touch $JVB_CONFIG
|
||
fi
|
||
|
||
# configure jvb
|
||
echo "AUTHBIND=yes" >> $JVB_ETC_CONFIG
|
||
sed -i "s/JVB_OPTS=.*/JVB_OPTS=--apis=rest,xmpp/g" $JVB_ETC_CONFIG
|
||
|
||
echo "org.jitsi.videobridge.rest.jetty.host=::" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.port=443" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.ProxyServlet.hostHeader=$JVB_HOSTNAME" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.ProxyServlet.pathSpec=/http-bind" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.ProxyServlet.proxyTo=http://localhost:5280/http-bind" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.ResourceHandler.resourceBase=/usr/share/jitsi-meet" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.ResourceHandler.alias./config.js=/etc/jitsi/meet/$JVB_HOSTNAME-config.js" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.ResourceHandler.alias./interface_config.js=/usr/share/jitsi-meet/interface_config.js" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.ResourceHandler.alias./logging_config.js=/usr/share/jitsi-meet/logging_config.js" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.RewriteHandler.regex=^/([a-zA-Z0-9]+)$" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.RewriteHandler.replacement=/" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.SSIResourceHandler.paths=/" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.tls.port=443" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.TCP_HARVESTER_PORT=443" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.sslContextFactory.keyStorePath=/etc/jitsi/videobridge/$JVB_HOSTNAME.jks" >> $JVB_CONFIG
|
||
echo "org.jitsi.videobridge.rest.jetty.sslContextFactory.keyStorePassword=changeit" >> $JVB_CONFIG
|
||
|
||
# configure authbind to allow jvb to bind to privileged ports
|
||
OWNER=$(stat -c '%U' /usr/share/jitsi-videobridge)
|
||
GROUP=$(stat -c '%G' /usr/share/jitsi-videobridge)
|
||
JVB_UID="`id -u $OWNER`"
|
||
if [ ! -f "/etc/authbind/byport/443" ] ; then
|
||
if [ ! -d "/etc/authbind/byport" ] ; then
|
||
mkdir -p /etc/authbind/byport
|
||
chmod 755 /etc/authbind
|
||
chmod 755 /etc/authbind/byport
|
||
fi
|
||
touch /etc/authbind/byport/443
|
||
chown $OWNER /etc/authbind/byport/443
|
||
chmod 755 /etc/authbind/byport/443
|
||
fi
|
||
|
||
CERT_P12="/etc/jitsi/videobridge/$JVB_HOSTNAME.p12"
|
||
CERT_JKS="/etc/jitsi/videobridge/$JVB_HOSTNAME.jks"
|
||
# create jks from certs
|
||
openssl pkcs12 -export \
|
||
-in $CERT_CRT -inkey $CERT_KEY -passout pass:changeit > $CERT_P12
|
||
keytool -importkeystore -destkeystore $CERT_JKS \
|
||
-srckeystore $CERT_P12 -srcstoretype pkcs12 \
|
||
-noprompt -storepass changeit -srcstorepass changeit
|
||
|
||
db_set jitsi-meet/jvb-serve "true"
|
||
|
||
invoke-rc.d jitsi-videobridge restart
|
||
elif [[ "$FORCE_NGINX" = "true" && ( -z "$JVB_HOSTNAME_OLD" || "$RECONFIGURING" = "true" ) ]] ; then
|
||
# this is a reconfigure, lets just delete old links
|
||
if [ "$RECONFIGURING" = "true" ] ; then
|
||
rm -f /etc/nginx/sites-enabled/$JVB_HOSTNAME_OLD.conf
|
||
rm -f /etc/jitsi/meet/$JVB_HOSTNAME_OLD-config.js
|
||
fi
|
||
|
||
# nginx conf
|
||
if [ ! -f /etc/nginx/sites-available/$JVB_HOSTNAME.conf ] ; then
|
||
cp /usr/share/doc/jitsi-meet-web-config/jitsi-meet.example /etc/nginx/sites-available/$JVB_HOSTNAME.conf
|
||
if [ ! -f /etc/nginx/sites-enabled/$JVB_HOSTNAME.conf ] ; then
|
||
ln -s /etc/nginx/sites-available/$JVB_HOSTNAME.conf /etc/nginx/sites-enabled/$JVB_HOSTNAME.conf
|
||
fi
|
||
sed -i "s/jitsi-meet.example.com/$JVB_HOSTNAME/g" /etc/nginx/sites-available/$JVB_HOSTNAME.conf
|
||
fi
|
||
|
||
if [ "$CERT_CHOICE" = "$UPLOADED_CERT_CHOICE" ] ; then
|
||
# replace self-signed certificate paths with user provided ones
|
||
CERT_KEY_ESC=$(echo $CERT_KEY | sed 's/\./\\\./g')
|
||
CERT_KEY_ESC=$(echo $CERT_KEY_ESC | sed 's/\//\\\//g')
|
||
sed -i "s/ssl_certificate_key\ \/etc\/jitsi\/meet\/.*key/ssl_certificate_key\ $CERT_KEY_ESC/g" \
|
||
/etc/nginx/sites-available/$JVB_HOSTNAME.conf
|
||
CERT_CRT_ESC=$(echo $CERT_CRT | sed 's/\./\\\./g')
|
||
CERT_CRT_ESC=$(echo $CERT_CRT_ESC | sed 's/\//\\\//g')
|
||
sed -i "s/ssl_certificate\ \/etc\/jitsi\/meet\/.*crt/ssl_certificate\ $CERT_CRT_ESC/g" \
|
||
/etc/nginx/sites-available/$JVB_HOSTNAME.conf
|
||
fi
|
||
|
||
invoke-rc.d nginx reload
|
||
elif [[ "$FORCE_APACHE" = "true" && ( -z "$JVB_HOSTNAME_OLD" || "$RECONFIGURING" = "true" ) ]] ; then
|
||
# this is a reconfigure, lets just delete old links
|
||
if [ "$RECONFIGURING" = "true" ] ; then
|
||
a2dissite $JVB_HOSTNAME_OLD.conf
|
||
rm -f /etc/jitsi/meet/$JVB_HOSTNAME_OLD-config.js
|
||
fi
|
||
|
||
# apache2 config
|
||
if [ ! -f /etc/apache2/sites-available/$JVB_HOSTNAME.conf ] ; then
|
||
# when creating new config, make sure all needed modules are enabled
|
||
a2enmod rewrite ssl headers proxy_http include
|
||
cp /usr/share/doc/jitsi-meet-web-config/jitsi-meet.example-apache /etc/apache2/sites-available/$JVB_HOSTNAME.conf
|
||
a2ensite $JVB_HOSTNAME.conf
|
||
sed -i "s/jitsi-meet.example.com/$JVB_HOSTNAME/g" /etc/apache2/sites-available/$JVB_HOSTNAME.conf
|
||
fi
|
||
|
||
if [ "$CERT_CHOICE" = "$UPLOADED_CERT_CHOICE" ] ; then
|
||
# replace self-signed certificate paths with user provided ones
|
||
CERT_KEY_ESC=$(echo $CERT_KEY | sed 's/\./\\\./g')
|
||
CERT_KEY_ESC=$(echo $CERT_KEY_ESC | sed 's/\//\\\//g')
|
||
sed -i "s/SSLCertificateKeyFile\ \/etc\/jitsi\/meet\/.*key/SSLCertificateKeyFile\ $CERT_KEY_ESC/g" \
|
||
/etc/apache2/sites-available/$JVB_HOSTNAME.conf
|
||
CERT_CRT_ESC=$(echo $CERT_CRT | sed 's/\./\\\./g')
|
||
CERT_CRT_ESC=$(echo $CERT_CRT_ESC | sed 's/\//\\\//g')
|
||
sed -i "s/SSLCertificateFile\ \/etc\/jitsi\/meet\/.*crt/SSLCertificateFile\ $CERT_CRT_ESC/g" \
|
||
/etc/apache2/sites-available/$JVB_HOSTNAME.conf
|
||
fi
|
||
|
||
invoke-rc.d apache2 reload
|
||
fi
|
||
|
||
echo "----------------"
|
||
echo ""
|
||
echo "You can now switch to a Let’s Encrypt certificate. To do so, execute:"
|
||
echo "/usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh"
|
||
echo ""
|
||
echo "----------------"
|
||
|
||
# and we're done with debconf
|
||
db_stop
|
||
;;
|
||
|
||
abort-upgrade|abort-remove|abort-deconfigure)
|
||
;;
|
||
|
||
*)
|
||
echo "postinst called with unknown argument \`$1'" >&2
|
||
exit 1
|
||
;;
|
||
esac
|
||
|
||
# dh_installdeb will replace this with shell code automatically
|
||
# generated by other debhelper scripts.
|
||
|
||
#DEBHELPER#
|
||
|
||
exit 0
|