-
Notifications
You must be signed in to change notification settings - Fork 563
WIP: Support Ubuntu 24 in BBB 4.0 #826
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
antobinary
wants to merge
15
commits into
v4.0.x-release
Choose a base branch
from
v4.0.x-release-ubuntu-24
base: v4.0.x-release
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+52
−66
Draft
Changes from all commits
Commits
Show all changes
15 commits
Select commit
Hold shift + click to select a range
ca5b879
WIP: ubuntu 24.04 support
antobinary 6d9aac4
WIP: ubuntu 24.04 support
antobinary 2d85682
TEMP: drop check for release.gpg on the old server
antobinary 991989a
install yq binary from repo assets
antobinary 3704622
say instead of echo
antobinary 454da09
gpg url
antobinary 0ef6855
switch from mikefarah yq to kislyuk yq (default in ubuntu 24)
antobinary df2b4ac
reorganization
antobinary f7633df
try to follow the old pattern more closely
antobinary 6d0ee25
keep old .asc name
antobinary a3ec0ce
http to https in package repo
antobinary 01c45ec
recover the pattern of independent repos per release
antobinary 1c6f997
relocate pubic key to match old pattern
antobinary 0dbcea2
new yq cannot write to empty file
antobinary b6e7a10
Merge branch 'v4.0.x-release' into v4.0.x-release-ubuntu-24
antobinary File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -26,11 +26,11 @@ | |
| # Install BigBlueButton 4.0.x with a SSL certificate from Let's Encrypt using hostname bbb.example.com | ||
| # and email address [email protected] and apply a basic firewall | ||
| # | ||
| # wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v4.0.x-release/bbb-install.sh | bash -s -- -w -v jammy-400 -s bbb.example.com -e [email protected] | ||
| # wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v4.0.x-release/bbb-install.sh | bash -s -- -w -v noble-400 -s bbb.example.com -e [email protected] | ||
| # | ||
| # Install BigBlueButton with SSL + Greenlight | ||
| # | ||
| # wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v4.0.x-release/bbb-install.sh | bash -s -- -w -v jammy-400 -s bbb.example.com -e [email protected] -g | ||
| # wget -qO- https://raw.githubusercontent.com/bigbluebutton/bbb-install/v4.0.x-release/bbb-install.sh | bash -s -- -w -v noble-400 -s bbb.example.com -e [email protected] -g | ||
| # | ||
|
|
||
| usage() { | ||
|
|
@@ -46,7 +46,7 @@ | |
|
|
||
| OPTIONS (install BigBlueButton): | ||
|
|
||
| -v <version> Install given version of BigBlueButton (e.g. 'jammy-400') (required) | ||
| -v <version> Install given version of BigBlueButton (e.g. 'noble-400') (required) | ||
|
|
||
| -s <hostname> Configure server with <hostname> | ||
| -e <email> Email for Let's Encrypt certbot | ||
|
|
@@ -101,15 +101,15 @@ | |
|
|
||
| Sample options for setup a BigBlueButton 4.0 server | ||
|
|
||
| -v jammy-400 -s bbb.example.com -e [email protected] | ||
| -v noble-400 -s bbb.example.com -e [email protected] | ||
|
|
||
| Sample options for setup a BigBlueButton 4.0 server with Greenlight 3 and optionally Keycloak | ||
|
|
||
| -v jammy-400 -s bbb.example.com -e [email protected] -g [-k] | ||
| -v noble-400 -s bbb.example.com -e [email protected] -g [-k] | ||
|
|
||
| Sample options for setup a BigBlueButton 4.0 server with LTI framework while managing LTI consumer credentials MY_KEY:MY_SECRET | ||
|
|
||
| -v jammy-400 -s bbb.example.com -e [email protected] -t MY_KEY:MY_SECRET | ||
| -v noble-400 -s bbb.example.com -e [email protected] -t MY_KEY:MY_SECRET | ||
|
|
||
| SUPPORT: | ||
| Community: https://bigbluebutton.org/support | ||
|
|
@@ -256,7 +256,7 @@ | |
| # Check if we're installing coturn (need an e-mail address for Let's Encrypt) | ||
| if [ -z "$VERSION" ] && [ -n "$COTURN" ]; then | ||
| if [ -z "$EMAIL" ]; then err "Installing coturn needs an e-mail address for Let's Encrypt"; fi | ||
| check_ubuntu 22.04 | ||
| check_ubuntu 24.04 | ||
|
|
||
| install_coturn | ||
| exit 0 | ||
|
|
@@ -278,56 +278,43 @@ | |
| check_cpus | ||
| check_ipv6 | ||
|
|
||
| need_pkg wget curl gpg-agent dirmngr apparmor-utils | ||
|
|
||
| if [ "$DISTRO" != "noble" ]; then | ||
| err "This version of BigBlueButton requires Ubuntu 24.04" | ||
| exit 0 | ||
| fi | ||
|
|
||
| # need_pkg xmlstarlet | ||
| get_IP "$HOST" | ||
|
|
||
| if [ "$DISTRO" == "jammy" ]; then | ||
| need_pkg ca-certificates | ||
|
|
||
| need_ppa rmescandon-ubuntu-yq-jammy.list ppa:rmescandon/yq CC86BB64 # Edit yaml files with yq | ||
| #need_ppa ppa:rmescandon/yq | ||
| need_pkg yq | ||
| yq --version | ||
|
|
||
| #need_ppa libreoffice-ubuntu-ppa-jammy.list ppa:libreoffice/ppa 1378B444 # Latest version of libreoffice | ||
| need_pkg wget curl gpg-agent dirmngr apparmor-utils ca-certificates yq ruby apt-transport-https haveged openjdk-17-jre dnsutils | ||
| #need_ppa libreoffice-ubuntu-ppa-noble.list ppa:libreoffice/ppa 1378B444 # Latest version of libreoffice | ||
| #need_ppa bigbluebutton-ubuntu-support-noble.list ppa:bigbluebutton/support 2E1B01D0E95B94BC # Needed for libopusenc0 | ||
| #need_ppa martin-uni-mainz-ubuntu-coturn-noble.list ppa:martin-uni-mainz/coturn 4B77C2225D3BBDB3 # Coturn | ||
|
|
||
| need_ppa bigbluebutton-ubuntu-support-jammy.list ppa:bigbluebutton/support 2E1B01D0E95B94BC # Needed for libopusenc0 | ||
| need_ppa martin-uni-mainz-ubuntu-coturn-jammy.list ppa:martin-uni-mainz/coturn 4B77C2225D3BBDB3 # Coturn | ||
|
|
||
| if [ -f /etc/apt/sources.list.d/nodesource.list ] && grep -q 18 /etc/apt/sources.list.d/nodesource.list; then | ||
| # Node 18 might be installed, previously used in BigBlueButton | ||
| # Remove the repository config. This will cause the repository to get | ||
| # re-added using the current nodejs version, and nodejs will be upgraded. | ||
| sudo rm -r /etc/apt/sources.list.d/nodesource.list | ||
| fi | ||
| if [ ! -f /etc/apt/sources.list.d/nodesource.list ]; then | ||
| sudo mkdir -p /etc/apt/keyrings | ||
| if [ -f /etc/apt/keyrings/nodesource.gpg ]; then | ||
| rm /etc/apt/keyrings/nodesource.gpg | ||
| fi | ||
| curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg | ||
| NODE_MAJOR=22 | ||
| echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list | ||
| if [ ! -f /etc/apt/sources.list.d/nodesource.list ]; then | ||
| sudo mkdir -p /etc/apt/keyrings | ||
| if [ -f /etc/apt/keyrings/nodesource.gpg ]; then | ||
| rm /etc/apt/keyrings/nodesource.gpg | ||
| fi | ||
| curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg | ||
| NODE_MAJOR=22 | ||
| echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | sudo tee /etc/apt/sources.list.d/nodesource.list | ||
| fi | ||
|
|
||
| touch /root/.rnd | ||
| install_docker # needed for bbb-libreoffice-docker | ||
| need_pkg ruby | ||
| touch /root/.rnd | ||
| install_docker # needed for bbb-libreoffice-docker | ||
|
|
||
| BBB_WEB_ETC_CONFIG=/etc/bigbluebutton/bbb-web.properties # Override file for local settings | ||
| BBB_WEB_ETC_CONFIG=/etc/bigbluebutton/bbb-web.properties # Override file for local settings | ||
|
|
||
| need_pkg openjdk-17-jre | ||
| update-java-alternatives -s java-1.17.0-openjdk-amd64 | ||
| fi | ||
| update-java-alternatives -s java-1.17.0-openjdk-amd64 | ||
|
|
||
| apt-get update | ||
| apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade | ||
|
|
||
| need_pkg apt-transport-https haveged | ||
| need_pkg bigbluebutton | ||
| need_pkg bbb-html5 | ||
| # need_pkg bbb-html5 | ||
|
|
||
| if [ -f /usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties ]; then | ||
| SERVLET_DIR=/usr/share/bbb-web | ||
|
|
@@ -693,20 +680,18 @@ | |
| } | ||
|
|
||
| check_version() { | ||
| if ! echo "$1" | grep -Eq "jammy-40"; then err "This script can only install BigBlueButton 4.0 and is meant to be run on Ubuntu 22.04 (jammy) server."; fi | ||
| if ! echo "$1" | grep -Eq "noble-4"; then err "This script can only install BigBlueButton 4.0 and is meant to be run on Ubuntu 24.04 (noble) server."; fi | ||
| DISTRO=${1%%-*} | ||
| if ! wget -qS --spider "https://$PACKAGE_REPOSITORY/$1/dists/bigbluebutton-$DISTRO/Release.gpg" > /dev/null 2>&1; then | ||
| err "Unable to locate packages for $1 at $PACKAGE_REPOSITORY." | ||
| fi | ||
| check_root | ||
| need_pkg curl apt-transport-https | ||
| curl -fsSL "https://$PACKAGE_REPOSITORY/repo/bigbluebutton.asc" | sudo tee /etc/apt/keyrings/bigbluebutton.asc | ||
| echo "deb [signed-by=/etc/apt/keyrings/bigbluebutton.asc] https://$PACKAGE_REPOSITORY/$VERSION bigbluebutton-$DISTRO main" > /etc/apt/sources.list.d/bigbluebutton.list | ||
| } | ||
|
|
||
| check_host() { | ||
| if [ -z "$PROVIDED_CERTIFICATE" ] && [ -z "$HOST" ]; then | ||
| need_pkg dnsutils apt-transport-https | ||
| DIG_IP=$(dig +short "$1" | grep '^[.0-9]*$' | tail -n1) | ||
| if [ -z "$DIG_IP" ]; then err "Unable to resolve $1 to an IP address using DNS lookup."; fi | ||
| get_IP "$1" | ||
|
|
@@ -872,9 +857,13 @@ | |
| # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ | ||
| # An alternative list with additional directives can be obtained from | ||
| # https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy | ||
| ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS | ||
| ssl-default-bind-options ssl-min-ver TLSv1.2 | ||
| tune.ssl.default-dh-param 2048 | ||
| ssl-default-bind-curves X25519:prime256v1:secp384r1 | ||
| ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 | ||
| ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 | ||
| ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2 no-tls-tickets | ||
| ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 | ||
| ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 | ||
| ssl-default-server-options ssl-min-ver TLSv1.2 no-tls-tickets | ||
|
|
||
| defaults | ||
| log global | ||
|
|
@@ -1755,21 +1744,18 @@ | |
|
|
||
| # shellcheck disable=SC1091 | ||
| eval "$(source /etc/bigbluebutton/bigbluebutton-release && declare -p BIGBLUEBUTTON_RELEASE)" | ||
| if [[ $BIGBLUEBUTTON_RELEASE == 2.2.* ]] && [[ ${BIGBLUEBUTTON_RELEASE#*.*.} -lt 29 ]]; then | ||
| sed -i "s/proxy_pass .*/proxy_pass https:\/\/$IP:7443;/g" /usr/share/bigbluebutton/nginx/sip.nginx | ||
| else | ||
| # Use nginx as proxy for WSS -> WS (see https://github.com/bigbluebutton/bigbluebutton/issues/9667) | ||
| yq e -i '.public.media.sipjsHackViaWs = true' /etc/bigbluebutton/bbb-html5.yml | ||
| sed -i "s/proxy_pass .*/proxy_pass http:\/\/$IP:5066;/g" /usr/share/bigbluebutton/nginx/sip.nginx | ||
| xmlstarlet edit --inplace --update '//param[@name="ws-binding"]/@value' --value "$IP:5066" /opt/freeswitch/conf/sip_profiles/external.xml | ||
| fi | ||
| # Use nginx as proxy for WSS -> WS (see https://github.com/bigbluebutton/bigbluebutton/issues/9667) | ||
| if [ ! -s /etc/bigbluebutton/bbb-html5.yml ]; then echo '{}' > /etc/bigbluebutton/bbb-html5.yml; fi | ||
| yq -y -i '.public.media.sipjsHackViaWs = true' /etc/bigbluebutton/bbb-html5.yml | ||
| sed -i "s/proxy_pass .*/proxy_pass http:\/\/$IP:5066;/g" /usr/share/bigbluebutton/nginx/sip.nginx | ||
| xmlstarlet edit --inplace --update '//param[@name="ws-binding"]/@value' --value "$IP:5066" /opt/freeswitch/conf/sip_profiles/external.xml | ||
|
|
||
| sed -i 's/^bigbluebutton.web.serverURL=http:/bigbluebutton.web.serverURL=https:/g' "$SERVLET_DIR/WEB-INF/classes/bigbluebutton.properties" | ||
| if [ -f "$BBB_WEB_ETC_CONFIG" ]; then | ||
| sed -i 's/^bigbluebutton.web.serverURL=http:/bigbluebutton.web.serverURL=https:/g' "$BBB_WEB_ETC_CONFIG" | ||
| fi | ||
|
|
||
| yq e -i '.playback_protocol = "https"' /usr/local/bigbluebutton/core/scripts/bigbluebutton.yml | ||
| yq -y -i '.playback_protocol = "https"' /usr/local/bigbluebutton/core/scripts/bigbluebutton.yml | ||
| chmod 644 /usr/local/bigbluebutton/core/scripts/bigbluebutton.yml | ||
|
|
||
| # Update Greenlight (if installed) to use SSL | ||
|
|
@@ -1791,29 +1777,29 @@ | |
| TARGET=/etc/bigbluebutton/bbb-webrtc-sfu/production.yml | ||
| touch $TARGET | ||
|
|
||
| yq e -i ".freeswitch.ip = \"$IP\"" $TARGET | ||
| yq -y -i ".freeswitch.ip = \"$IP\"" $TARGET | ||
|
|
||
| if [[ $BIGBLUEBUTTON_RELEASE == 2.2.* ]] && [[ ${BIGBLUEBUTTON_RELEASE#*.*.} -lt 29 ]]; then | ||
| if [ -n "$INTERNAL_IP" ]; then | ||
| yq e -i ".freeswitch.sip_ip = \"$INTERNAL_IP\"" $TARGET | ||
| yq -y -i ".freeswitch.sip_ip = \"$INTERNAL_IP\"" $TARGET | ||
| else | ||
| yq e -i ".freeswitch.sip_ip = \"$IP\"" $TARGET | ||
| yq -y -i ".freeswitch.sip_ip = \"$IP\"" $TARGET | ||
| fi | ||
| else | ||
| # Use nginx as proxy for WSS -> WS (see https://github.com/bigbluebutton/bigbluebutton/issues/9667) | ||
| yq e -i ".freeswitch.sip_ip = \"$IP\"" $TARGET | ||
| yq -y -i ".freeswitch.sip_ip = \"$IP\"" $TARGET | ||
| fi | ||
| chown bigbluebutton:bigbluebutton $TARGET | ||
| chmod 644 $TARGET | ||
|
|
||
| # Configure mediasoup IPs, reference: https://raw.githubusercontent.com/bigbluebutton/bbb-webrtc-sfu/v2.7.2/docs/mediasoup.md | ||
| # mediasoup IPs: WebRTC | ||
| yq e -i '.mediasoup.webrtc.listenIps[0].ip = "0.0.0.0"' $TARGET | ||
| yq e -i ".mediasoup.webrtc.listenIps[0].announcedIp = \"$IP\"" $TARGET | ||
| yq -y -i '.mediasoup.webrtc.listenIps[0].ip = "0.0.0.0"' $TARGET | ||
| yq -y -i ".mediasoup.webrtc.listenIps[0].announcedIp = \"$IP\"" $TARGET | ||
|
|
||
| # mediasoup IPs: plain RTP (internal comms, FS <-> mediasoup) | ||
| yq e -i '.mediasoup.plainRtp.listenIp.ip = "0.0.0.0"' $TARGET | ||
| yq e -i ".mediasoup.plainRtp.listenIp.announcedIp = \"$IP\"" $TARGET | ||
| yq -y -i '.mediasoup.plainRtp.listenIp.ip = "0.0.0.0"' $TARGET | ||
| yq -y -i ".mediasoup.plainRtp.listenIp.announcedIp = \"$IP\"" $TARGET | ||
|
|
||
| systemctl reload nginx | ||
| } | ||
|
|
@@ -1987,7 +1973,7 @@ | |
|
|
||
| local SSH_HARDENING_FILE="/etc/ssh/sshd_config.d/99-hardened-ciphers.conf" | ||
|
|
||
| # Check if sshd_config includes the .d directory (Ubuntu 22.04 does by default) | ||
| # Check if sshd_config includes the .d directory (Ubuntu 24.04 does by default) | ||
| if ! grep -q "^Include.*/etc/ssh/sshd_config.d/" /etc/ssh/sshd_config; then | ||
| say "Warning: /etc/ssh/sshd_config doesn't include sshd_config.d - adding include directive" | ||
| echo "Include /etc/ssh/sshd_config.d/*.conf" >> /etc/ssh/sshd_config | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check notice
Code scanning / shellcheck
Command appears to be unreachable. Check usage (or ignore if invoked indirectly). Note