Свой сервер видеоконференций Jitsi. Часть 1

#! /bin/bashIPT="iptables"## Внешний интерфейсWAN=ens224WAN_IP=ВАШ_внешний_IP## Внутренний интерфейсLAN1=ens192LAN1_IP=ВАШ_внутренний_IPLAN1_IP_RANGE=192.168.0.0/24LAN2=IP_Jitsi## Очищаем все цепочки перед применением новых правил$IPT -F$IPT -F -t nat$IPT -F -t mangle$IPT -X$IPT -t nat -X$IPT -t mangle -X## Блокируем весь трафик, который не соответствует ни одному из правил$IPT -P INPUT DROP$IPT -P OUTPUT DROP$IPT -P FORWARD DROP## Разрешаем весь трафик в локалхост и локальной сети$IPT -A INPUT -i lo -j ACCEPT$IPT -A INPUT -i $LAN1 -j ACCEPT$IPT -A OUTPUT -o lo -j ACCEPT$IPT -A OUTPUT -o $LAN1 -j ACCEPT## Этот блок разрешает icmp-запросы (пинговать сервер) (опционально)$IPT -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT$IPT -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT$IPT -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT$IPT -A INPUT -p icmp --icmp-type echo-request -j ACCEPT## Открываем доступ в интернет самому серверу$IPT -A OUTPUT -o $WAN -j ACCEPT#$IPT -A INPUT -i $WAN -j ACCEPT## Разрешаем все установленные соединения и дочерние от них$IPT -A INPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT$IPT -A OUTPUT -p all -m state --state ESTABLISHED,RELATED -j ACCEPT$IPT -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT## Защита от наиболее распространенных сетевых атак. (опционально)## Отбрасываем все пакеты без статуса (опционально)$IPT -A INPUT -m state --state INVALID -j DROP$IPT -A FORWARD -m state --state INVALID -j DROP## Блокируем нулевые пакеты (опционально)$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP## Закрываемся от syn-flood атак (опционально)$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP$IPT -A OUTPUT -p tcp ! --syn -m state --state NEW -j DROP## Запрет доступа с определенных IP (опционально)#$IPT -A INPUT -s ipaddres -j REJECT## Разрешаем доступ в интернет из локальной сети$IPT -A FORWARD -i $LAN1 -o $WAN -j ACCEPT## Запрещаем доступ из интернета в локальную сеть (опционально)#$IPT -A FORWARD -i $WAN -o $LAN1 -j REJECT## Чтобы в локальной сети был интернет включаем nat$IPT -t nat -A POSTROUTING -o $WAN -s $LAN1_IP_RANGE -j MASQUERADE##Должен быть включен ip forwarding## Разрешаем ssh (порт 22 - это порт по умолчанию для ssh соединения, если вы его меняли, то обязательно значение 22 надо заменить своим, иначе будет потерян доступ к серверу)$IPT -A INPUT -i $WAN -p tcp --dport 22 -j ACCEPT## Перенаправление трафика на сервер JITSI$IPT -A FORWARD -i $WAN -d $LAN2 -p tcp -m tcp --dport 80 -j ACCEPT$IPT -A FORWARD -i $WAN -d $LAN2 -p tcp -m tcp --dport 443 -j ACCEPT$IPT -A FORWARD -i $WAN -d $LAN2 -p udp -m udp --dport 10000 -j ACCEPT$IPT -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j DNAT --to $LAN2$IPT -t nat -A PREROUTING -i $WAN -p tcp --dport 443 -j DNAT --to $LAN2$IPT -t nat -A PREROUTING -i $WAN -p udp --dport 10000 -j DNAT --to $LAN2$IPT -t nat -A POSTROUTING -j MASQUERADE

# vim /etc/apache2/saites-avalieble/example.org.conf

SSLCertificateChainFile /etc/ssl/example.org/SectigoRSADomainValidationSecureServerCA.crt

SSLProtocol TLSv1 TLSv1.1 TLSv1.2SSLEngine onSSLProxyEngine onSSLCertificateFile /etc/ssl/jitsi.dnsname.com/jitsi.dnsname.com.crtSSLCertificateChainFile /etc/ssl/jitsi.dnsname.com/SectigoRSADomainValidationSecureServerCA.crtSSLCertificateKeyFile /etc/ssl/jitsi.dnsname.com/jitsi.dnsname.com.keySSLCipherSuite "EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA256:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EDH+aRSA+AESGCM:EDH+aRSA+SHA256:EDH+aRSA:EECDH:!aNULL:!eNULL:!MEDIUM:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED"SSLHonorCipherOrder onHeader set Strict-Transport-Security "max-age=31536000"

# vim  /etc/nginx/sites-available/jitsi.dnsname.com.conf

# Mozilla Guideline v5.4, nginx 1.17.7, OpenSSL 1.1.1d, intermediate configuration    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # TLSv1.3;    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;    ssl_prefer_server_ciphers off;    ssl_session_timeout 1d;    ssl_session_cache shared:SSL:10m;  # about 40000 sessions    ssl_session_tickets off;    add_header Strict-Transport-Security "max-age=63072000" always;    ssl_certificate /etc/ssl/jitsi.dnsname.com/fullchain.pem;     ssl_certificate_key /etc/ssl/jitsi.dnsname.com/privkey.pem;     root /usr/share/jitsi-meet;

# cat /etc/ssl/jitsi.dnsname.com/jitsi.dnsname.com.crt /etc/ssl/jitsi.dnsname.com/SectigoRSADomainValidationSecureServerCA.crt >> /etc/ssl/jitsi.dnsname.com/fullchain.pem

DefaultLimitNOFILE=65000DefaultLimitNPROC=65000DefaultTasksMax=65000

# apt-get install -y jibri

# wget -qO - https://download.jitsi.org/jitsi-key.gpg.key | sudo apt-key add -# sh -c "echo 'deb https://download.jitsi.org stable/' > /etc/apt/sources.list.d/jitsi-stable.list"# apt-get update# apt-get install -y jibri

-- internal muc component, meant to enable pools of jibri and jigasi clientsComponent "internal.auth.jitsi.dnsname.com" "muc"    modules_enabled = {        "ping";    }    storage = "memory"    muc_room_cache_size = 1000    VirtualHost "recorder.jitsi.dnsname.com"    modules_enabled = {        "ping";    }    authentication = "internal_plain"

org.jitsi.jicofo.jibri.BREWERY=JibriBrewery@internal.auth.jitsi.dnsname.comorg.jitsi.jicofo.jibri.PENDING_TIMEOUT=90

fileRecordingsEnabled: true, liveStreamingEnabled: true, hiddenDomain: 'recorder.jitsi.dnsname.com',

jibri {  // A unique identifier for this Jibri  // TODO: eventually this will be required with no default  id = ""  // Whether or not Jibri should return to idle state after handling  // (successfully or unsuccessfully) a request.  A value of 'true'  // here means that a Jibri will NOT return back to the IDLE state  // and will need to be restarted in order to be used again.  single-use-mode = false  api {    http {      external-api-port = 2222      internal-api-port = 3333    }    xmpp {      // See example_xmpp_envs.conf for an example of what is expected here      environments = [      {                name = "prod environment"                xmpp-server-hosts = ["jitsi.dnsname.com"]                xmpp-domain = "jitsi.dnsname.com"                control-muc {                    domain = "internal.auth.jitsi.dnsname.com"                    room-name = "JibriBrewery"                    nickname = "jibri-nickname"                }                control-login {                    domain = "auth.jitsi.dnsname.com"                    username = "jibri"                    password = "PAsswDJibRI"                }                call-login {                    domain = "recorder.jitsi.dnsname.com"                    username = "recorder"                    password = "PaSSwdReCORD"                }                strip-from-room-domain = "conference."                usage-timeout = 0                trust-all-xmpp-certs = true            }]    }  }  recording {    recordings-directory = "/srv/recordings"    # TODO: make this an optional param and remove the default    finalize-script = "/path/to/finalize_recording.sh"  }  streaming {    // A list of regex patterns for allowed RTMP URLs.  The RTMP URL used    // when starting a stream must match at least one of the patterns in    // this list.    rtmp-allow-list = [      // By default, all services are allowed      ".*"    ]  }  chrome {    // The flags which will be passed to chromium when launching    flags = [      "--use-fake-ui-for-media-stream",      "--start-maximized",      "--kiosk",      "--enabled",      "--disable-infobars",      "--autoplay-policy=no-user-gesture-required"    ]  }  stats {    enable-stats-d = true  }  webhook {    // A list of subscribers interested in receiving webhook events    subscribers = []  }  jwt-info {    // The path to a .pem file which will be used to sign JWT tokens used in webhook    // requests.  If not set, no JWT will be added to webhook requests.    # signing-key-path = "/path/to/key.pem"    // The kid to use as part of the JWT    # kid = "key-id"    // The issuer of the JWT    # issuer = "issuer"    // The audience of the JWT    # audience = "audience"    // The TTL of each generated JWT.  Can't be less than 10 minutes.    # ttl = 1 hour  }  call-status-checks {    // If all clients have their audio and video muted and if Jibri does not    // detect any data stream (audio or video) comming in, it will stop    // recording after NO_MEDIA_TIMEOUT expires.    no-media-timeout = 30 seconds    // If all clients have their audio and video muted, Jibri consideres this    // as an empty call and stops the recording after ALL_MUTED_TIMEOUT expires.    all-muted-timeout = 10 minutes    // When detecting if a call is empty, Jibri takes into consideration for how    // long the call has been empty already. If it has been empty for more than    // DEFAULT_CALL_EMPTY_TIMEOUT, it will consider it empty and stop the recording.    default-call-empty-timeout = 30 seconds  }}