{"id":1919,"date":"2020-07-30T17:10:42","date_gmt":"2020-07-30T15:10:42","guid":{"rendered":"https:\/\/markus-blog.de\/?p=1919"},"modified":"2023-04-03T08:43:58","modified_gmt":"2023-04-03T06:43:58","slug":"how-to-install-nextcloud-talk-high-performance-backend-with-stun-turnserver-on-ubuntu","status":"publish","type":"post","link":"https:\/\/markus-blog.de\/index.php\/2020\/07\/30\/how-to-install-nextcloud-talk-high-performance-backend-with-stun-turnserver-on-ubuntu\/","title":{"rendered":"How to Install Nextcloud Talk High Performance Backend with Stun\/Turnserver on Ubuntu"},"content":{"rendered":"

Picture from Alexandra_Koch<\/a> on Pixabay<\/a><\/span><\/em><\/p>\n

Changes 18.11.2020:
\n– Adjust server.conf because typo has changed
\n– Adjust signaling.service and janus.service because they does not start after reboot
\nChanges 22.11.2020:
\n– Adjust janus.jcfg
\n– change repositoty of janus\n<\/p><\/blockquote>\n

Since Nextcloud has released the High Performance Backend as OpenSource under AGPL License<\/a>, i tried my luck to install it on Ubuntu.<\/p>\n

Now I want to share how to do it.<\/p>\n

Requirements:<\/strong><\/p>\n

– a VPS with Ubuntu 18.04 or 20.04 LTS minimal Image installed (you can get one here @netcup<\/a> with 5\u20ac Discount or start at Hetzner Cloud<\/a> with 20\u20ac start credits)
\n– shell access and appropriate rights
\n– One DNS A and possibly AAAA record for our nginx vhost and stun\/turn-server (I use signaling.example.com for all three services in this guide)
\n– Optional – a second DNS A and possibly AAAA record for stun\/turnserver<\/p>\n

Hardware Requirements:<\/strong><\/p>\n

4 CPU
\n8 GB RAM
\n32 GB Disk-Space<\/p>\n

See also: Nextcloud Portal<\/a><\/p>\n

You can also test a smaller server if you don’t have that many users<\/p>\n

Step 1: Install Firewall and other packages<\/strong><\/h3>\n

First of all, you should install a firewall to secure your VPS (if not installed) and allow incoming traffic to port 80\/443 and 22 (ssh) only. For Securing ssh-access you can use fail2ban and passwordless authentication. Many guides for this are out there.<\/p>\n

apt install ufw -y\r\nufw allow http\r\nufw allow https\r\nufw allow ssh\r\nufw allow 5349\/tcp\r\nufw allow 5349\/udp\r\nufw enable<\/pre>\n
Accept with „y“<\/p>\n
Step 2: Install and config stun\/turnserver<\/strong><\/h3>\n
you have to install the package coturn:<\/p>\n
apt install coturn<\/pre>\n
enable daemonizing for your turnserver:<\/p>\n
sed -i '\/TURNSERVER_ENABLED\/c\\TURNSERVER_ENABLED=1' \/etc\/default\/coturn<\/pre>\n
create a random hex key for your nextcloud talk app and signaling server with:<\/p>\n
openssl rand -hex 32<\/pre>\n
and copy it for later use, then edit \/etc\/turnserver.conf:<\/p>\n
mv \/etc\/turnserver.conf \/etc\/turnserver.conf.bak && nano \/etc\/turnserver.conf<\/pre>\n
copy, paste and adjust the following code:<\/p>\n
listening-port=5349\r\nfingerprint\r\nlt-cred-mech\r\nuse-auth-secret\r\nstatic-auth-secret=output_of_openssl rand -hex 32\r\nrealm=signaling.example.com\r\ntotal-quota=100\r\nbps-capacity=0\r\nstale-nonce\r\nno-loopback-peers\r\nno-multicast-peers<\/pre>\n
and last, restart and enable coturn:<\/p>\n
systemctl restart coturn && systemctl enable coturn<\/pre>\n
Step 3: Install and config janus<\/strong><\/h3>\n
You have to add janus Repository of morph027<\/p>\n
Ubuntu 18.04 and 20.04<\/strong>
\nadd repo key:<\/p>\n
curl -sL -o \/etc\/apt\/trusted.gpg.d\/morph027-janus.asc https:\/\/packaging.gitlab.io\/janus\/gpg.key<\/pre>\n
add repo:<\/p>\n
. \/etc\/lsb-release; echo \"deb [arch=amd64] https:\/\/packaging.gitlab.io\/janus\/$DISTRIB_CODENAME $DISTRIB_CODENAME main\" | tee \/etc\/apt\/sources.list.d\/morph027-janus.list\r\napt update<\/pre>\n
apt install janus<\/pre>\n
Now generate a random api key for turnserver:<\/p>\n
openssl rand -base64 16<\/pre>\n
and copy the output for later use.<\/p>\n
Edit \/etc\/janus\/janus.jcfg<\/code><\/p>\n
nano \/etc\/janus\/janus.jcfg<\/pre>\n
go to section nat<\/code> and enter your stunserver<\/code> and port<\/code>, uncomment full_trickle = true<\/code>, turn_server<\/code> with port<\/code> and type<\/code> and the generated api key<\/code>:<\/p>\n
you can copy, paste and adjust the following:<\/p>\n
stun_server = \"127.0.0.1\"\r\nstun_port = 5349\r\nfull_trickle = true\r\nturn_server = \"127.0.0.1\"\r\nturn_port = 5349\r\nturn_type = \"udp\"\r\nturn_rest_api_key = \"openssl rand -base64 16\"\r\n<\/pre>\n
then comment the following lines:<\/p>\n
certificates: {
\n# cert_pem = „\/etc\/ssl\/certs\/ssl-cert-snakeoil.pem“
\n# cert_key = „\/etc\/ssl\/private\/ssl-cert-snakeoil.key“
\n#cert_pwd = „secretpassphrase“
\n}<\/p><\/blockquote>\n
adjust janus.service, so that it will start after coturn.service:<\/p>\n
nano \/lib\/systemd\/system\/janus.service<\/pre>\n
adjust under Unit-Section:<\/p>\n
[Unit]\r\nDescription=Janus WebRTC gateway\r\nAfter=coturn.service\r\nDocumentation=https:\/\/janus.conf.meetecho.com\/docs\/index.html<\/pre>\n
save, enable and restart janus<\/code>:<\/p>\n
systemctl daemon-reload && systemctl restart janus && systemctl enable janus<\/pre>\n
Step 4: Running or Install NATS Server<\/strong><\/h3>\n
If your VPS support docker, then you can use docker to run NATS Server<\/code>:<\/p>\n
Install docker if not installed:<\/p>\n
curl -sSL https:\/\/get.docker.com\/ | CHANNEL=stable sh\r\nsystemctl enable docker.service\r\nsystemctl start docker.service<\/pre>\n
then run NATS Server<\/code>:<\/p>\n
docker run --restart=always --name=NATSSERVER -d -p 4222:4222 -ti --restart=always nats:latest<\/pre>\n
when you want to run NATS Server<\/code> without docker, there is another Repository<\/a> of morph27.<\/p>\n
you have to add its key and its repo:<\/p>\n
curl -sL -o \/etc\/apt\/trusted.gpg.d\/morph027-nats-server.asc https:\/\/packaging.gitlab.io\/nats-server\/gpg.key\r\necho \"deb [arch=amd64] https:\/\/packaging.gitlab.io\/nats-server nats main\" | tee \/etc\/apt\/sources.list.d\/morph027-nats-server.list<\/pre>\n
install NATS Server<\/code>:<\/p>\n
apt update\r\napt install nats-server<\/pre>\n
generate config under \/etc\/nats\/nats.conf<\/p>\n
install -d -o nats -g nats \/etc\/nats\r\nsudo -u nats echo \"listen: 127.0.0.1:4222\" > \/etc\/nats\/nats.conf<\/pre>\n
start and enable NATS-Server:<\/p>\n
systemctl start nats-server && systemctl enable nats-server<\/pre>\n
Step 5: Install nextcloud-spreed-signaling Server<\/strong><\/h3>\n
now we can install the nextcloud-spreed-signaling<\/code> server, first of all, we have to install the packages we need to built:<\/p>\n
apt install git automake golang build-essential python3 -y<\/pre>\n
then we clone the git repository and start the build process:<\/p>\n
cd \/opt\r\ngit clone https:\/\/github.com\/strukturag\/nextcloud-spreed-signaling.git\r\ncd nextcloud-spreed-signaling\/\r\nmake build<\/pre>\n
then copy the binary to \/usr\/bin<\/code><\/p>\n
cp bin\/signaling \/usr\/bin\/<\/pre>\n
now create a dedicated user:<\/p>\n
useradd --system --shell \/usr\/sbin\/nologin --comment \"Standalone signaling server for Nextcloud Talk.\" signaling<\/pre>\n
create the server.conf<\/code> in \/etc\/signaling\/<\/code><\/p>\n
mkdir \/etc\/signaling\/\r\ntouch \/etc\/signaling\/server.conf\r\nchown signaling: \/etc\/signaling\/server.conf\r\nchmod 600 \/etc\/signaling\/server.conf<\/pre>\n
and copy the systemd file:<\/p>\n
cp dist\/init\/systemd\/signaling.service \/etc\/systemd\/system\/signaling.service<\/pre>\n
and adjust, so that signaling.service start after janus.service:<\/p>\n
nano \/etc\/systemd\/system\/signaling.service<\/pre>\n
and change under Unit-Section:<\/p>\n
[Unit]\r\nDescription=Nextcloud Talk signaling server\r\nAfter=janus.service<\/pre>\n
save and then:<\/p>\n
systemctl daemon-reload\r\nsystemctl enable signaling<\/pre>\n
create keys for config:<\/p>\n
Nextcloud Secret Key<\/code><\/p>\n
openssl rand -hex 16<\/pre>\n
Block-Key<\/code><\/p>\n
openssl rand -hex 16<\/pre>\n
Hash-Key<\/code><\/p>\n
openssl rand -hex 16<\/pre>\n
Now we have five keys at all, as example (do not use these keys)<\/p>\n
Turn-Key from Step 2:<\/strong> 2309a206fc4de0f511ce9da52c088171f69193d1f701323d5ab4f733c9853445<\/code>
\napi-key from Step 3:<\/strong> Z6ZkKhjwCFa6RMpFU854Fw==<\/code>
\nNextcloud-Secret-Key:<\/strong> 692cdc99256135bcb7849ca1886e2ed6<\/code>
\nBlock-Key:<\/strong> f702adbf248ab0e752fa76cb46bcba12<\/code>
\nHash-Key:<\/strong> db61d5a8c6bd2b47a3cb0abce3545040<\/code><\/p>\n
open \/etc\/signaling\/server.conf with your editor<\/p>\n
nano \/etc\/signaling\/server.conf<\/pre>\n
then copy, paste and adjust (change keys to yours) the following config<\/p>\n
[http]\r\nlisten = 127.0.0.1:8080\r\n[app]\r\ndebug = false\r\n\r\n[sessions]\r\nhashkey = db61d5a8c6bd2b47a3cb0abce3545040\r\nblockkey = f702adbf248ab0e752fa76cb46bcba12\r\n\r\n[backend]\r\nbackends = backend-1 #here you can add more backends commaseparated backend-1, backend-2, backend-3\r\nallowall = false\r\ntimeout = 10\r\nconnectionsperhost = 8\r\n\r\n[backend-1]\r\nurl = https:\/\/nextcloud.example.com\r\nsecret = 692cdc99256135bcb7849ca1886e2ed6\r\n\r\n#[backend-2]\r\n#url = https:\/\/nextcloud2.example.com\r\n#secret = openssl rand -hex 16\r\n\r\n#[backend-3]\r\n#url = https:\/\/nextcloud3.example.com\r\n#secret = openssl rand -hex 16\r\n\r\n\r\n[nats]\r\nurl = nats:\/\/localhost:4222\r\n\r\n[mcu]\r\ntype = janus\r\nurl = ws:\/\/127.0.0.1:8188\r\n\r\n[turn]\r\napikey = Z6ZkKhjwCFa6RMpFU854Fw==\r\nsecret = 2309a206fc4de0f511ce9da52c088171f69193d1f701323d5ab4f733c9853445\r\nservers = turn:signaling.example.com:5349?transport=udp,turn:signaling.example.com:5349?transport=tcp<\/pre>\n
then start signaling:<\/p>\n
systemctl start signaling<\/pre>\n
and check status of the service:<\/p>\n
systemctl status signaling<\/pre>\n
and if it listens on port 8080:<\/p>\n
netstat -tulpen | grep 8080<\/pre>\n
go to next step.<\/p>\n
Step 6: Install nginx and create vHost for signaling server<\/strong><\/h3>\n
Now we will install nginx as reverse proxy for our high performance backend:<\/p>\n
apt install nginx python3-certbot-nginx -y<\/pre>\n
and create the vHost:<\/p>\n
nano \/etc\/nginx\/sites-available\/signaling<\/pre>\n
copy, paste and adjust:<\/p>\n
server {\r\n    listen :80;\r\n    listen [::]:80;\r\n    server_name signaling.example.com;\r\n    }<\/pre>\n
and activate vhost:<\/p>\n
ln -s \/etc\/nginx\/sites-available\/signaling \/etc\/nginx\/sites-enabled\/signaling<\/pre>\n
then check with:<\/p>\n
nginx -t<\/pre>\n
and reload<\/p>\n
systemctl reload nginx<\/pre>\n
now use certbot to obtain a certificate:<\/p>\n
certbot --authenticator standalone --installer nginx -d signaling.example.com --pre-hook \"service nginx stop\" --post-hook \"service nginx start\"<\/pre>\n
then paste the following config in the vHost-conf:<\/p>\n
mv \/etc\/nginx\/sites-available\/signaling \/tmp\/signaling.bak && nano \/etc\/nginx\/sites-available\/signaling<\/pre>\n
upstream signaling {\r\n    server 127.0.0.1:8080;\r\n}\r\n\r\nserver {\r\n    server_name signaling.example.com;\r\n\r\n    listen :443 ssl http2; # managed by Certbot\r\n    listen [::]:443 ssl http2;\r\n    ssl_certificate \/etc\/letsencrypt\/live\/signaling.example.com\/fullchain.pem; # managed by Certbot\r\n    ssl_certificate_key \/etc\/letsencrypt\/live\/signaling.example.com\/privkey.pem; # managed by Certbot\r\n    include \/etc\/letsencrypt\/options-ssl-nginx.conf; # managed by Certbot\r\n    ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem; # managed by Certbot\r\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\";\r\n\r\nlocation \/standalone-signaling\/ {\r\n        proxy_pass http:\/\/signaling\/;\r\n        proxy_http_version 1.1;\r\n        proxy_set_header Host $host;\r\n        proxy_set_header X-Real-IP $remote_addr;\r\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n    }\r\n\r\n    location \/standalone-signaling\/spreed {\r\n        proxy_pass http:\/\/signaling\/spreed;\r\n        proxy_http_version 1.1;\r\n        proxy_set_header Upgrade $http_upgrade;\r\n        proxy_set_header Connection \"Upgrade\";\r\n        proxy_set_header Host $host;\r\n        proxy_set_header X-Real-IP $remote_addr;\r\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n    }\r\n\r\n}\r\nserver {\r\n    if ($host = signaling.example.com) {\r\n        return 301 https:\/\/$host$request_uri;\r\n    } # managed by Certbot\r\n\r\n\r\n    listen :80;\r\n    listen [::]:80;\r\n    server_name signaling.example.com;\r\n    return 404; # managed by Certbot\r\n\r\n\r\n}<\/pre>\n
and check an reload nginx:<\/p>\n
nginx -t<\/pre>\n
if ok<\/p>\n
systemctl reload nginx<\/pre>\n
Step 7: Configure nextcloud to use stun\/turn and signaling server<\/strong><\/h3>\n
Now we are ready to add turn\/stun- and signaling-server to our Nextcloud<\/p>\n
Go to Settings, Talk and enter the following:<\/p>\n
\"\"<\/p>\n
And then enjoy your High Performance Backend.<\/p>\n
Problems with the tutorial? Then comment below or contact me per Mail or Mastodon.<\/p>\n
If you want a managed nextcloud, then look here<\/a>.<\/p>\n
I will be happy if you would support my work here<\/a>.<\/p>\n
Happy nextclouding and do not forget to share ?<\/p>\n
Sources:
\nMorph27<\/a>
\nStruktur AG<\/a>
\nPicture from Alexandra_Koch<\/a> on Pixabay<\/a><\/p><\/blockquote>\n
This Guide was tested on:
\nnetcup<\/a>
\nHetzner Cloud<\/a><\/p>\n