diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index 000a08a..0000000 --- a/.travis.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- -language: python -python: "2.7" - -# Use the new container infrastructure -sudo: required - -dist: trusty - -# Install ansible -addons: - apt: - packages: - - python-pip - -install: - # Install ansible - - pip install ansible - - # Check ansible version - - ansible --version - -script: - - . tests/test.sh - diff --git a/Makefile b/Makefile deleted file mode 100644 index 4da6ff7..0000000 --- a/Makefile +++ /dev/null @@ -1,5 +0,0 @@ -localtest: - vagrant destroy -f - vagrant up - vagrant ssh -c 'cd /ansible/roles/ansible-bigbluebutton && . tests/test.sh' - vagrant destroy -f diff --git a/README.md b/README.md index d4f99f6..0b0d16d 100644 --- a/README.md +++ b/README.md @@ -1,19 +1,54 @@ -[![Build Status](https://travis-ci.org/softwaremill/ansible-bigbluebutton.svg?branch=master)](https://travis-ci.org/softwaremill/ansible-bigbluebutton) +# Ansible BigBlueButton Installation Role -Bigbluebutton -============= +Ansible role to install [_BigBlueButton_](https://www.bigbluebutton.org) web conferencing platform with SSL support out of the box using [_LetsEncrypt_](https://letsencrypt.org/). -Ansible role for a simple bigbluebutton installation (following the documentation on http://docs.bigbluebutton.org/install/install.html) +The role follows _BigBlueButton_ official [installation instructions](http://docs.bigbluebutton.org/install/install.html). -Testing locally -=============== -Launch vagrant vm machine with: -`vagrant up` -Then run the tests with: -`vagrant ssh -c 'cd /ansible/roles/ansible-bigbluebutton && . tests/test.sh'` +Forked from [softwaremill/ansible-bigbluebutton](https://github.com/softwaremill/ansible-bigbluebutton), as it seems abandoned. Itr has the following additional features: -License -------- +## Features + * Installs latest stable version (currently _2.3_). + * Installation behind a firewall (NAT setup support) + * Automatic SSL configuration using _LetsEncrypt_ certificates using [thefinn93/ansible-letsencrypt](https://github.com/thefinn93/ansible-letsencrypt) role. + * Optionally installs the demo and check packages. -BSD +## Supported Platforms +As this role follows the official installation instructions, the supported OS version is the one specified there: Ubuntu (16.04 for the current bbb version). +Requires Ansible >= 2.4.0 + +## Usage + +To get up _BigBlueButton_ up and running the following variables can be configured: + + * `bbb_server_name`: Set the FQDN hostname that points to the server where _BigBlueButton_ is going to be installed. This is the only mandatory value, the playbook will fail if this variable is not defined. + * `bbb_configure_nat`: Configure NAT support for servers behind a firewall (Default: `False`). + * `bbb_configure_ssl`: Configure SSL support using _LetsEncrypt_ certificates (Default: `False`). + * `bbb_ssl_email`: Set _LetsEncrypt_ authorization email address. + * `bbb_install_html5`: Install the HTML5 client (Default: `True`). + * `bbb_install_demo`: Install the bbb-demo package, useful to easily test the new installation is working (Default: `False`). + * `bbb_install_check`: Install the bbb-check package, useful to debug the new installation if having issues (Default: `False`). + * `bbb_install_playback_notes`: Install the bbb-playback-notes package to play back shared notes from a recorded session (Default: `True`). + * `bbb_install_playback_podcast`: Install the bbb-playback-podcast package to play back audio from a recorded session (Default: `True`). + * `bbb_install_playback_screenshare`: Install the bbb-playback-screenshare package to play back shared screens from a recorded session (Default: `True`). + +## Example Playbook + +``` +--- +- hosts: bbb + remote_user: ansible + become: True + become_user: root + become_method: sudo + gather_facts: True + roles: + - role: ansible-bigbluebutton + bbb_server_name: bbb.example.com + bbb_configure_nat: True + bbb_install_demo: True + bbb_install_check: True + bbb_configure_ssl: True + bbb_ssl_email: foo@bar.com + +``` diff --git a/Vagrantfile b/Vagrantfile deleted file mode 100644 index 91019b3..0000000 --- a/Vagrantfile +++ /dev/null @@ -1,27 +0,0 @@ -# -*- mode: ruby -*- -# vi: set ft=ruby : - -# All Vagrant configuration is done below. The "2" in Vagrant.configure -# configures the configuration version (we support older styles for -# backwards compatibility). Please don't change it unless you know what -# you're doing. -Vagrant.configure(2) do |config| - config.vm.box = "ubuntu/trusty64" - - config.vm.network "private_network", ip: "10.10.10.10" - - config.vm.synced_folder ".", "/ansible/roles/ansible-bigbluebutton" - - config.vm.provider "virtualbox" do |vb| - vb.memory = "4096" - end - - config.vm.provision "shell", inline: <<-SHELL - export DEBIAN_FRONTEND=noninteractive - apt-get update - apt-get install --assume-yes software-properties-common - apt-add-repository --yes ppa:ansible/ansible - apt-get update - apt-get --assume-yes install ansible - SHELL -end diff --git a/defaults/main.yml b/defaults/main.yml index c273793..4b65145 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,7 +1,15 @@ --- -bbb_apt_key: '328BD16D' - -#Repositories -bbb_apt_repo_url: 'http://ubuntu.bigbluebutton.org/trusty-1-0/' -libreoffice_ppa: 'ppa:libreoffice/libreoffice-4-4' -ffmpeg_ppa: 'ppa:mc3man/trusty-media' +bbb_apt_repo_url: 'https://ubuntu.bigbluebutton.org/bionic-230/' +bbb_ubuntu_version: "18.04" +bbb_install_html5: True +bbb_install_playback_notes: True +bbb_install_playback_podcast: True +bbb_install_playback_screenshare: True +bbb_install_demo: False +bbb_install_check: False +bbb_configure_nat: False +bbb_configure_ssl: False +bbb_ssl_webroot_path: /var/www/bigbluebutton-default +bbb_ssl_renewal_command_args: '--renew-hook "systemctl restart nginx"' +## Uncoment the following line to test on test network. +# bbb_ssl_server: "https://acme-staging.api.letsencrypt.org/directory" diff --git a/meta/main.yml b/meta/main.yml index b7852a3..cc306cb 100644 --- a/meta/main.yml +++ b/meta/main.yml @@ -1,148 +1,16 @@ galaxy_info: - author: Jan Rotter + author: Juan Luis Baptiste description: Simple BigBlueButton installation (following the documentation on http://docs.bigbluebutton.org/install/install.html) - company: SoftwareMill Ltd. - - # If the issue tracker for your role is not on github, uncomment the - # next line and provide a value - # issue_tracker_url: http://example.com/issue/tracker - + license: MIT - - min_ansible_version: 2.0 - # - # Below are all platforms currently available. Just uncomment - # the ones that apply to your role. If you don't see your - # platform on this list, let us know and we'll get it added! - # + min_ansible_version: 2.4 + platforms: - #- name: EL - # versions: - # - all - # - 5 - # - 6 - # - 7 - #- name: GenericUNIX - # versions: - # - all - # - any - #- name: Solaris - # versions: - # - all - # - 10 - # - 11.0 - # - 11.1 - # - 11.2 - # - 11.3 - #- name: Fedora - # versions: - # - all - # - 16 - # - 17 - # - 18 - # - 19 - # - 20 - # - 21 - # - 22 - # - 23 - #- name: opensuse - # versions: - # - all - # - 12.1 - # - 12.2 - # - 12.3 - # - 13.1 - # - 13.2 - #- name: IOS - # versions: - # - all - # - any - #- name: SmartOS - # versions: - # - all - # - any - #- name: eos - # versions: - # - all - # - Any - #- name: Windows - # versions: - # - all - # - 2012R2 - #- name: Amazon - # versions: - # - all - # - 2013.03 - # - 2013.09 - #- name: GenericBSD - # versions: - # - all - # - any - #- name: Junos - # versions: - # - all - # - any - #- name: FreeBSD - # versions: - # - all - # - 10.0 - # - 10.1 - # - 10.2 - # - 8.0 - # - 8.1 - # - 8.2 - # - 8.3 - # - 8.4 - # - 9.0 - # - 9.1 - # - 9.1 - # - 9.2 - # - 9.3 - name: Ubuntu versions: - # - all - # - lucid - # - maverick - # - natty - # - oneiric - # - precise - # - quantal - # - raring - # - saucy - - trusty - # - utopic - # - vivid - # - wily - # - xenial - #- name: SLES - # versions: - # - all - # - 10SP3 - # - 10SP4 - # - 11 - # - 11SP1 - # - 11SP2 - # - 11SP3 - #- name: GenericLinux - # versions: - # - all - # - any - #- name: NXOS - # versions: - # - all - # - any - #- name: Debian - # versions: - # - all - # - etch - # - jessie - # - lenny - # - sid - # - squeeze - # - stretch - # - wheezy - + - xenial + galaxy_tags: [] # List tags for your role here, one per line. A tag is # a keyword that describes and categorizes the role. @@ -153,6 +21,11 @@ galaxy_info: # alphanumeric characters. Maximum 20 tags per role. dependencies: - # List your role dependencies here, one per line. - # Be sure to remove the '[]' above if you add dependencies - # to this list. + - role: thefinn93.letsencrypt + vars: + letsencrypt_webroot_path: "{{ bbb_ssl_webroot_path }}" + letsencrypt_email: "{{ bbb_ssl_email }}" + letsencrypt_cert_domains: + - "{{ bbb_server_name }}" + bbb_ssl_renewal_command_args: '--renew-hook "systemctl restart nginx"' + when: bbb_configure_ssl == True diff --git a/tasks/letsencrypt.yml b/tasks/letsencrypt.yml new file mode 100644 index 0000000..f5b2090 --- /dev/null +++ b/tasks/letsencrypt.yml @@ -0,0 +1,14 @@ +--- + - name: Create nginx SSL certificates directory + file: + state: directory + path: /etc/nginx/ssl + owner: root + group: root + tags: + - bbb_letsencript_ssl_dir + + - name: Create dhparam SSL file + command: openssl dhparam -dsaparam -out /etc/nginx/ssl/dhp-4096.pem 4096 creates=/etc/nginx/ssl/dhp-4096.pem + tags: + - bbb_create_dhpem_file diff --git a/tasks/main.yml b/tasks/main.yml index 8000917..a795c96 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,21 +1,40 @@ --- +- name: Check if OS is supported + fail: + msg: "OS not supported for BigBlueButton installation" + when: ansible_distribution != "Ubuntu" or ansible_distribution_version != "{{ bbb_ubuntu_version }}" + +- name: Check if bbb_server_name is defined + assert: + that: + - bbb_server_name != "" + tags: + - bbb-check_vars + +- name: Enable https support for apt + apt: + name: apt-transport-https + state: present + tags: + - apt_transport_https + - name: Update apt cache apt: update_cache=yes tags: - update_apt_cache -- name: BigBluebutton required packages are present +- name: Install BigBluebutton required packages apt: name={{ item }} state=present with_items: - language-pack-en - software-properties-common tags: - - bbb_dependencies + - bbb-dependencies -- name: apt_repository required packages are present +- name: Check python-apt is present apt: name=python-apt state=present tags: - - bbb_role_dependencies + - bbb-role_dependencies - name: Update locale (ensure LANG=en_US.UTF-8) lineinfile: dest=/etc/default/locale regexp=^LANG line='LANG=en_US.UTF-8' @@ -27,56 +46,184 @@ tags: - set_locale -- name: BigBlueButton apt key is present +- name: Check BigBlueButton apt key is present apt_key: - url: http://ubuntu.bigbluebutton.org/bigbluebutton.asc - id: '{{ bbb_apt_key }}' + url: https://ubuntu.bigbluebutton.org/repo/bigbluebutton.asc state: present tags: - - bbb_apt_key + - bbb-apt_key -- name: multiverse apt repositories are enabled +- name: Check multiverse apt repositories are enabled apt_repository: repo={{ item }} state=present with_items: - - 'deb http://archive.ubuntu.com/ubuntu trusty multiverse' - - 'deb-src http://archive.ubuntu.com/ubuntu trusty multiverse' - - 'deb http://archive.ubuntu.com/ubuntu trusty-updates multiverse' - - 'deb-src http://archive.ubuntu.com/ubuntu trusty-updates multiverse' + - 'deb http://archive.ubuntu.com/ubuntu xenial multiverse' + - 'deb-src http://archive.ubuntu.com/ubuntu xenial multiverse' + - 'deb http://archive.ubuntu.com/ubuntu xenial-updates multiverse' + - 'deb-src http://archive.ubuntu.com/ubuntu xenial-updates multiverse' tags: - multiverse_repositories - repositories -- name: libreoffice ppa is enabled - apt_repository: repo='{{ libreoffice_ppa }}' - tags: - - libreoffice_repositories - - repositories - -- name: ffmpeg ppa is enabled - apt_repository: repo='{{ ffmpeg_ppa }}' +- name: Check supplemental PPA repos are enabled + apt_repository: repo={{ item }} state=present + with_items: + - 'ppa:bigbluebutton/support' + - 'ppa:rmescandon/yq' tags: - - ffmpeg_repositories + - ppa-repositories - repositories -- name: BigBlueButton repo is enabled +- name: Check BigBlueButton repo is enabled apt_repository: repo={{ item }} state=present with_items: - - 'deb {{ bbb_apt_repo_url }} bigbluebutton-trusty main' + - 'deb {{ bbb_apt_repo_url }} bigbluebutton-xenial main' tags: - - bbb_repositories + - bbb-repositories - repositories -- name: bigbluebutton is installed +- name: Check BigBlueButton is installed apt: name=bigbluebutton state=present tags: - install_bbb -- name: bbb-demo is installed +- name: Check MongoDB apt key is present + apt_key: + url: "https://www.mongodb.org/static/pgp/server-3.4.asc" + state: present + when: bbb_install_html5 == True + tags: + - mongodb-apt_key + +- name: Check MongoDB repo is enabled + apt_repository: repo="deb [ arch=amd64,arm64 ] http://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/3.4 multiverse" state=present + when: bbb_install_html5 == True + tags: + - mongodb-repositories + - repositories + +- name: Check NodeJS apt key is present + apt_key: + url: "https://deb.nodesource.com/gpgkey/nodesource.gpg.key" + state: present + when: bbb_install_html5 == True + tags: + - nodejs-apt_key + +- name: Check NodeJS repo is enabled + apt_repository: repo="deb https://deb.nodesource.com/node_8.x xenial main" state=present + when: bbb_install_html5 == True + tags: + - nodejs-repositories + - repositories +- name: Install bbb-html5 and dependencies + apt: + name: + - bbb-html5 + - mongodb-org + - curl + - nodejs + state: present + when: bbb_install_html5 == True + tags: + - install_bbb-html5 + +- name: Install notes playback package + apt: name=bbb-playback-notes state=present + when: bbb_install_playback_notes == True + tags: + - install_bbb-playback-notes + +- name: Install podcast playback package + apt: name=bbb-playback-podcast state=present + when: bbb_install_playback_podcast == True + tags: + - install_bbb-playback-podcast + +- name: Install screenshare playback package + apt: name=bbb-playback-screenshare state=present + when: bbb_install_playback_screenshare == True + tags: + - install_bbb-playback-screenshare + +- name: Install bbb-demo package apt: name=bbb-demo state=present + when: bbb_install_demo == True tags: - - install_bbb_demo + - install_bbb-demo -- name: bbb-check is installed +- name: Install bbb-check package apt: name=bbb-check state=present + when: bbb_install_check == True + tags: + - install_bbb-check + +- name: Set BigBlueButton server name + command: bbb-conf --setip "{{ bbb_server_name }}" + tags: + - run_bbb-conf_setip + +- name: Get server local IP address + set_fact: + server_ip: "{{ ansible_default_ipv4.address }}" + tags: + - bbb-get_local_ip + +- name: Get server public IP address + ipify_facts: + register: public_ip + tags: + - bbb-get_public_ip + +- name: Get server public IP address + set_fact: + public_ip: "{{ public_ip.ansible_facts.ipify_public_ip }}" + tags: + - bbb-get_public_ip + + +- name: Verify local IP vs public IP addresses + set_fact: + internal_ip: "{{ server_ip }}" + when: server_ip != public_ip + tags: + - bbb-check_server_ip + +- name: Verify local IP vs public IP addresses + set_fact: + server_ip: "{{ public_ip }}" + when: server_ip != public_ip + tags: + - bbb-check_server_ip + +- name: Update BwMon server IP address + replace: + path: /var/www/bigbluebutton/client/conf/config.xml + regexp: '' + replace: '' + backup: yes + tags: + - bbb_enable_https + +- name: Update http for https on nginx + replace: + path: /etc/bigbluebutton/nginx/sip.nginx + regexp: 'http:' + replace: 'https:' + backup: yes + tags: + - bbb_enable_https + +- name: Update SIP port on nginx + replace: + path: /etc/bigbluebutton/nginx/sip.nginx + regexp: '5066' + replace: '7443' + backup: yes + tags: + - bbb_enable_https + +- name: Update http for https on BigBlueButton webapp + replace: + path: "/usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties" + regexp: 'bigbluebutton.web.serverURL=http:' + replace: 'bigbluebutton.web.serverURL=https:' + backup: yes + tags: + - bbb_enable_https + +- name: Update http for https on red5 + replace: + path: /usr/share/red5/webapps/screenshare/WEB-INF/screenshare.properties + regexp: 'jnlpUrl=http:' + replace: 'jnlpUrl=https:' + backup: yes + tags: + - bbb_enable_https + +- name: Update http for https on red5 + replace: + path: /usr/share/red5/webapps/screenshare/WEB-INF/screenshare.properties + regexp: 'jnlpFile=http:' + replace: 'jnlpFile=https:' + backup: yes + tags: + - bbb_enable_https + +- name: Update http for https on BigBlueButton client config + replace: + path: /var/www/bigbluebutton/client/conf/config.xml + regexp: 'http://' + replace: 'https://' + backup: yes + tags: + - bbb_enable_https + +- name: Update http for https on BigBlueButton client config + replace: + path: /usr/local/bigbluebutton/core/scripts/bigbluebutton.yml + regexp: 'playback_protocol: http$' + replace: 'playback_protocol: https' + backup: yes + tags: + - bbb_enable_https + +- name: Ansible check if /var/lib/tomcat7/webapps/demo/bbb_api_conf.jsp exists + stat: + path: /var/lib/tomcat7/webapps/demo/bbb_api_conf.jsp + register: demo + tags: + - bbb_enable_https + +- name: Update http for https on demo + replace: + path: /var/lib/tomcat7/webapps/demo/bbb_api_conf.jsp + regexp: 'String BigBlueButtonURL = "http:' + replace: 'String BigBlueButtonURL = "https:' + backup: yes + when: demo.stat.exists == True + tags: + - bbb_enable_https diff --git a/templates/bbb-ssl.conf.j2 b/templates/bbb-ssl.conf.j2 new file mode 100644 index 0000000..6bea4c4 --- /dev/null +++ b/templates/bbb-ssl.conf.j2 @@ -0,0 +1,62 @@ +server { + listen 80; + listen [::]:80; + server_name {{ bbb_server_name }}; + listen 443 ssl; + listen [::]:443 ssl; + ssl_certificate /etc/letsencrypt/live/{{ bbb_server_name }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ bbb_server_name }}/privkey.pem; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + ssl_protocols TLSv1 TLSv1.1 TLSv1.2; + ssl_ciphers "ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS:!AES256"; + ssl_prefer_server_ciphers on; + ssl_dhparam /etc/nginx/ssl/dhp-4096.pem; + access_log /var/log/nginx/bigbluebutton.access.log; + # Handle RTMPT (RTMP Tunneling). Forwards requests + # to Red5 on port 5080 + location ~ (/open/|/close/|/idle/|/send/|/fcs/) { + proxy_pass http://127.0.0.1:5080; + proxy_redirect off; + proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + client_max_body_size 10m; + client_body_buffer_size 128k; + proxy_connect_timeout 90; + proxy_send_timeout 90; + proxy_read_timeout 90; + proxy_buffering off; + keepalive_requests 1000000000; + } + # Handle desktop sharing tunneling. Forwards + # requests to Red5 on port 5080. + location /deskshare { + proxy_pass http://127.0.0.1:5080; + proxy_redirect default; + proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; + client_max_body_size 10m; + client_body_buffer_size 128k; + proxy_connect_timeout 90; + proxy_send_timeout 90; + proxy_read_timeout 90; + proxy_buffer_size 4k; + proxy_buffers 4 32k; + proxy_busy_buffers_size 64k; + proxy_temp_file_write_size 64k; + include fastcgi_params; + } + # BigBlueButton landing page. + location / { + root /var/www/bigbluebutton-default; + index index.html index.htm; + expires 1m; + } + # Include specific rules for record and playback + include /etc/bigbluebutton/nginx/*.nginx; + #error_page 404 /404.html; + # Redirect server error pages to the static page /50x.html + # + error_page 500 502 503 504 /50x.html; + location = /50x.html { + root /var/www/nginx-default; + } +} diff --git a/tests/test.sh b/tests/test.sh deleted file mode 100644 index ccdbc1e..0000000 --- a/tests/test.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/usr/bin/env bash - -set -e - -export ANSIBLE_ROLES_PATH='../' -INVENTORY='localhost,' -CONNECTION='local' - -ansible-playbook -i $INVENTORY tests/test.yml --syntax-check -ansible-playbook -i $INVENTORY tests/test.yml --connection=$CONNECTION --sudo -if ansible-playbook -i $INVENTORY tests/test.yml --connection=$CONNECTION --sudo \ - | grep --quiet 'changed=0.*failed=0'; then - echo 'Idempotency: PASS' && exit 0 -else - echo 'Idempotency: FAIL' && exit 1 -fi diff --git a/tests/test.yml b/tests/test.yml deleted file mode 100644 index d7cab4f..0000000 --- a/tests/test.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- hosts: localhost - remote_user: root - roles: - - ansible-bigbluebutton/ \ No newline at end of file