{"id":2040,"date":"2020-11-20T20:21:38","date_gmt":"2020-11-20T19:21:38","guid":{"rendered":"https:\/\/markus-blog.de\/?p=2040"},"modified":"2023-04-03T08:43:57","modified_gmt":"2023-04-03T06:43:57","slug":"how-to-run-nextcloud-talk-high-performance-backend-with-stun-turnserver-on-ubuntu-with-docker-compose","status":"publish","type":"post","link":"https:\/\/markus-blog.de\/index.php\/2020\/11\/20\/how-to-run-nextcloud-talk-high-performance-backend-with-stun-turnserver-on-ubuntu-with-docker-compose\/","title":{"rendered":"How to run Nextcloud Talk High Performance Backend with Stun\/Turnserver on Ubuntu with docker-compose"},"content":{"rendered":"

Since Nextcloud has released the High Performance Backend as OpenSource under AGPL License<\/a>, i tried my luck to install it on Ubuntu without docker, but many people had problems or run other OS as Ubuntu\/Debian and asked „what about docker?“. Ok, without is a little bit tricky, so let us go with docker:<\/p>\n

Requirements:<\/strong><\/p>\n

– a VPS with docker and docker-compose (Tested on Ubuntu 18.04 and 20.04 LTS) (you can get one here @netcup<\/a> with 5\u20ac Discount or start at Hetzner Cloud<\/a> with 20\u20ac start credits)
\n– shell access and appropriate rights
\n– One DNS A and possibly AAAA record for our nginx vhost and stun\/turn-server (I use signaling.example.com for all three services in this guide)
\n– Optional – a second DNS A and possibly AAAA record for stun\/turnserver<\/p>\n

Hardware Requirements:<\/strong><\/p>\n

4 CPU
\n8 GB RAM
\n32 GB Disk-Space<\/p>\n

See also: Nextcloud Portal<\/a><\/p>\n

You can also test a smaller server if you don’t have that many users<\/p>\n

Step 1: Install Firewall and other packages<\/strong><\/h3>\n

First of all, you should install a firewall to secure your VPS (if not installed) and allow incoming traffic to port 80\/443, 22 (ssh) and for coturn on port 3478tcp\/udp only. For Securing ssh-access you can use fail2ban and passwordless authentication. Many guides for this are out there.<\/p>\n

apt install ufw -y\r\nufw allow http\r\nufw allow https\r\nufw allow ssh\r\nufw allow 3478\/tcp\r\nufw allow 3478\/udp\r\nufw enable<\/pre>\n
Accept with „y“<\/p>\n
Step 2: Install git, docker and docker-compose
\n<\/strong><\/h3>\n
Install docker:<\/p>\n
curl -sSL https:\/\/get.docker.com\/ | CHANNEL=stable sh\r\nsystemctl enable docker.service\r\nsystemctl start docker.service<\/pre>\n
and now docker-compose and git with:<\/p>\n
sudo apt install -y docker-compose git<\/pre>\n
Step 3: Clone git-Repository and build Images
\n<\/strong><\/h3>\n
we clone the git-Repository to \/opt<\/p>\n
cd \/opt\/\r\ngit clone https:\/\/github.com\/strukturag\/nextcloud-spreed-signaling.git && cd nextcloud-spreed-signaling<\/pre>\n
create a random hex key (STATIC_SECRET) for your nextcloud talk app and signaling server with:<\/p>\n
openssl rand -hex 32<\/pre>\n
and a hashkey:<\/p>\n
openssl rand -base64 16<\/pre>\n
a blockkey:<\/p>\n
openssl rand -base64 16<\/pre>\n
a Nextcloud SHARED_SECRET for Signaling:<\/p>\n
openssl rand -hex 16<\/pre>\n
an API-KEY:<\/p>\n
openssl rand -base64 16<\/pre>\n
and copy all for later use, then edit docker-compose.yml<\/p>\n
nano docker-compose.yml<\/pre>\n
adjust the following entries REALM and STATIC_SECRET:<\/p>\n
version: '3'\r\n\r\nservices:\r\n  spreedbackend:\r\n    build: .\r\n    volumes:\r\n      - .\/server.conf:\/config\/server.conf\r\n    network_mode: host\r\n    restart: unless-stopped\r\n    depends_on:\r\n      - nats\r\n      - janus\r\n      - coturn\r\n  nats:\r\n    image: nats:2.1\r\n    volumes:\r\n      - .\/gnatsd.conf:\/config\/gnatsd.conf\r\n    command: [\"-c\", \"\/config\/gnatsd.conf\"]\r\n    network_mode: host\r\n    restart: unless-stopped\r\n  janus:\r\n    build: docker\/janus\r\n    command: [\"janus\", \"--full-trickle\"]\r\n    network_mode: host\r\n    restart: unless-stopped\r\n  coturn:\r\n    build: docker\/coturn\r\n    network_mode: host\r\n    environment:\r\n      REALM: signaling.example.com\r\n      STATIC_SECRET: openssl rand -hex 32\r\n    restart: unless-stopped<\/pre>\n
then generate server.conf:<\/p>\n
nano server.conf<\/pre>\n
and copy and paste the following (please adjust your backends and secrets):<\/p>\n
[http]\r\nlisten = 127.0.0.1:8080\r\n[app]\r\ndebug = false\r\n\r\n[sessions]\r\nhashkey = openssl rand -base64 16\r\nblockkey = openssl rand -base64 16\r\n\r\n[backend]\r\nbackends = backend-1 #here you can add more backends commaseparated backend-1, backend-2, backend-3\r\nallowall = false\r\ntimeout = 10\r\nconnectionsperhost = 8\r\n\r\n[backend-1]\r\nurl = https:\/\/nextcloud.example.com\r\nsecret = openssl rand -hex 16\r\n\r\n#[backend-2]\r\n#url = https:\/\/nextcloud2.example.com\r\n#secret = openssl rand -hex 16\r\n\r\n#[backend-3]\r\n#url = https:\/\/nextcloud3.example.com\r\n#secret = openssl rand -hex 16\r\n\r\n\r\n[nats]\r\nurl = nats:\/\/localhost:4222\r\n\r\n[mcu]\r\ntype = janus\r\nurl = ws:\/\/localhost:8188\r\n\r\n[turn]\r\napikey = openssl rand -base64 16\r\nsecret = openssl rand -hex 32\r\nservers = turn:localhost:3478?transport=udp,turn:localhost:3478?transport=tcp<\/pre>\n
save file and change rights to 644:<\/p>\n
chmod 644 server.conf<\/pre>\n
and then build the images:<\/p>\n
docker-compose build<\/pre>\n
you have to wait a little bit before you can continue.<\/p>\n
then bring the complete stack up with:<\/p>\n
docker-compose up -d<\/pre>\n
now you should have at least 4 containers running:<\/p>\n
docker ps<\/pre>\n
\"\"<\/p>\n
then go to next step.<\/p>\n
Step 4: Install nginx and create vHost for signaling server<\/strong><\/h3>\n
Now we will install nginx as reverse proxy for our high performance backend:<\/p>\n
apt install nginx python3-certbot-nginx -y<\/pre>\n
and create the vHost:<\/p>\n
nano \/etc\/nginx\/sites-available\/signaling<\/pre>\n
copy, paste and adjust:<\/p>\n
server {\r\n    listen 80;\r\n    server_name signaling.example.com;\r\n    }<\/pre>\n
and activate vhost:<\/p>\n
ln -s \/etc\/nginx\/sites-available\/signaling \/etc\/nginx\/sites-enabled\/signaling<\/pre>\n
then check with:<\/p>\n
nginx -t<\/pre>\n
and reload<\/p>\n
systemctl reload nginx<\/pre>\n
now use certbot to obtain a certificate:<\/p>\n
certbot --authenticator standalone --installer nginx -d signaling.example.com --pre-hook \"service nginx stop\" --post-hook \"service nginx start\"<\/pre>\n
then paste the following config in the vHost-conf:<\/p>\n
mv \/etc\/nginx\/sites-available\/signaling \/tmp\/signaling.bak && nano \/etc\/nginx\/sites-available\/signaling<\/pre>\n
upstream signaling {\r\n    server 127.0.0.1:8080;\r\n}\r\n\r\nserver {\r\n    server_name signaling.example.com;\r\n\r\n    listen 443 ssl; # managed by Certbot\r\n    ssl_certificate \/etc\/letsencrypt\/live\/signaling.example.com\/fullchain.pem; # managed by Certbot\r\n    ssl_certificate_key \/etc\/letsencrypt\/live\/signaling.example.com\/privkey.pem; # managed by Certbot\r\n    include \/etc\/letsencrypt\/options-ssl-nginx.conf; # managed by Certbot\r\n    ssl_dhparam \/etc\/letsencrypt\/ssl-dhparams.pem; # managed by Certbot\r\n    add_header Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\";\r\n\r\nlocation \/standalone-signaling\/ {\r\n        proxy_pass http:\/\/signaling\/;\r\n        proxy_http_version 1.1;\r\n        proxy_set_header Host $host;\r\n        proxy_set_header X-Real-IP $remote_addr;\r\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n    }\r\n\r\n    location \/standalone-signaling\/spreed {\r\n        proxy_pass http:\/\/signaling\/spreed;\r\n        proxy_http_version 1.1;\r\n        proxy_set_header Upgrade $http_upgrade;\r\n        proxy_set_header Connection \"Upgrade\";\r\n        proxy_set_header Host $host;\r\n        proxy_set_header X-Real-IP $remote_addr;\r\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n    }\r\n\r\n}\r\nserver {\r\n    if ($host = signaling.example.com) {\r\n        return 301 https:\/\/$host$request_uri;\r\n    } # managed by Certbot\r\n\r\n\r\n    listen 80;\r\n    server_name signaling.example.com;\r\n    return 404; # managed by Certbot\r\n\r\n\r\n}<\/pre>\n
and check an reload nginx:<\/p>\n
nginx -t<\/pre>\n
if ok<\/p>\n
systemctl reload nginx<\/pre>\n
Step 5: Configure nextcloud to use stun\/turn and signaling server<\/strong><\/h3>\n
Now we are ready to add turn\/stun- and signaling-server to our Nextcloud<\/p>\n
Go to Settings, Talk and enter the following:<\/p>\n
\"\"
\nAnd then enjoy your High Performance Backend.<\/p>\n
Problems with the tutorial? Then comment below or contact me per Mail or Mastodon.<\/p>\n
I will be happy if you would support my work here<\/a>.<\/p>\n
Happy nextclouding and do not forget to share ?<\/p>\n
If you want to try an easier solution look at this deeztek @ github<\/a><\/p>\n
Sources:
\nPicture from Alexandra_Koch<\/a> on Pixabay<\/a><\/span><\/em>
\nStruktur AG<\/a>
\nTested on netcup<\/a>
\nTested on Hetzner Cloud<\/a><\/p>\n