127 lines
4.3 KiB
YAML
127 lines
4.3 KiB
YAML
|
---
|
||
|
|
# Étape 15 : visio de classe. Jitsi Meet (docker-jitsi-meet, version figée)
|
||
|
|
# derrière le Nginx de l'hôte ; accès par jeton JWT signé par le portail.
|
||
|
|
- name: créer les dossiers de la visio
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ item }}"
|
||
|
|
state: directory
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0750"
|
||
|
|
loop:
|
||
|
|
- /etc/visio
|
||
|
|
- "{{ visio_dossier }}"
|
||
|
|
|
||
|
|
- name: créer les dossiers des conteneurs (au nom de leur utilisateur)
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ item }}"
|
||
|
|
state: directory
|
||
|
|
owner: "{{ visio_uid_conteneurs }}"
|
||
|
|
group: "{{ visio_uid_conteneurs }}"
|
||
|
|
mode: "0750"
|
||
|
|
loop:
|
||
|
|
- "{{ visio_dossier }}/config"
|
||
|
|
- "{{ visio_dossier }}/config/web"
|
||
|
|
- "{{ visio_dossier }}/config/storage/web"
|
||
|
|
- "{{ visio_dossier }}/config/storage/transcripts"
|
||
|
|
- "{{ visio_dossier }}/config/tmp/web-load-test"
|
||
|
|
- "{{ visio_dossier }}/config/prosody/config"
|
||
|
|
- "{{ visio_dossier }}/config/prosody/prosody-plugins-custom"
|
||
|
|
- "{{ visio_dossier }}/config/storage/prosody"
|
||
|
|
- "{{ visio_dossier }}/config/jicofo"
|
||
|
|
- "{{ visio_dossier }}/config/jvb"
|
||
|
|
|
||
|
|
# Générés une seule fois sur le serveur, jamais dans Git ni affichés.
|
||
|
|
- name: générer les secrets de la visio (première fois seulement)
|
||
|
|
ansible.builtin.copy:
|
||
|
|
dest: /etc/visio/secrets.env
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0600"
|
||
|
|
force: false
|
||
|
|
content: |
|
||
|
|
JICOFO_AUTH_PASSWORD={{ lookup('community.general.random_string', length=40, special=false) }}
|
||
|
|
JVB_AUTH_PASSWORD={{ lookup('community.general.random_string', length=40, special=false) }}
|
||
|
|
JWT_APP_SECRET={{ lookup('community.general.random_string', length=64, special=false) }}
|
||
|
|
no_log: true
|
||
|
|
|
||
|
|
- name: déployer la configuration de la visio
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: visio.env.j2
|
||
|
|
dest: /etc/visio/visio.env
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0640"
|
||
|
|
register: visio_config
|
||
|
|
|
||
|
|
- name: déployer docker-compose.yml de la visio
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: docker-compose.yml.j2
|
||
|
|
dest: "{{ visio_dossier }}/docker-compose.yml"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0640"
|
||
|
|
register: visio_compose
|
||
|
|
|
||
|
|
- name: démarrer Jitsi (web, prosody, jicofo, jvb)
|
||
|
|
community.docker.docker_compose_v2:
|
||
|
|
project_src: "{{ visio_dossier }}"
|
||
|
|
project_name: visio
|
||
|
|
state: present
|
||
|
|
pull: missing
|
||
|
|
recreate: "{{ 'always' if (visio_config.changed or visio_compose.changed) else 'auto' }}"
|
||
|
|
|
||
|
|
- name: attendre que Jitsi web réponde sur 127.0.0.1
|
||
|
|
ansible.builtin.uri:
|
||
|
|
url: "http://127.0.0.1:{{ visio_port_web }}/"
|
||
|
|
status_code: [200]
|
||
|
|
register: visio_web
|
||
|
|
retries: 20
|
||
|
|
delay: 3
|
||
|
|
until: visio_web.status == 200
|
||
|
|
|
||
|
|
- name: vérifier que JVB écoute l'UDP {{ visio_port_media }}
|
||
|
|
ansible.builtin.shell:
|
||
|
|
cmd: "ss -Hulnp 'sport = :{{ visio_port_media }}' | grep -q java"
|
||
|
|
register: visio_jvb
|
||
|
|
retries: 20
|
||
|
|
delay: 3
|
||
|
|
until: visio_jvb.rc == 0
|
||
|
|
changed_when: false
|
||
|
|
|
||
|
|
# Jicofo doit voir un JVB opérationnel : c'est la preuve que les quatre
|
||
|
|
# services se parlent (cassé tant que le pare-feu jetait le trafic entre
|
||
|
|
# conteneurs, voir durcissement_ponts_internes).
|
||
|
|
- name: vérifier que Jicofo voit un JVB opérationnel
|
||
|
|
ansible.builtin.shell:
|
||
|
|
cmd: >-
|
||
|
|
docker compose -p visio -f {{ visio_dossier }}/docker-compose.yml exec -T jicofo
|
||
|
|
curl -s http://127.0.0.1:8888/stats
|
||
|
|
register: visio_stats_jicofo
|
||
|
|
retries: 20
|
||
|
|
delay: 5
|
||
|
|
until: >-
|
||
|
|
visio_stats_jicofo.rc == 0 and
|
||
|
|
(visio_stats_jicofo.stdout | from_json).bridge_selector.operational_bridge_count | int >= 1
|
||
|
|
changed_when: false
|
||
|
|
|
||
|
|
# Le portail signe les jetons avec le même secret (portail/config/visio.php).
|
||
|
|
- name: lire le secret de signature des jetons
|
||
|
|
ansible.builtin.slurp:
|
||
|
|
src: /etc/visio/secrets.env
|
||
|
|
register: visio_secrets_brut
|
||
|
|
no_log: true
|
||
|
|
|
||
|
|
- name: transmettre la configuration de la visio au portail
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
path: /var/www/portail/.env
|
||
|
|
regexp: "^{{ item.cle }}="
|
||
|
|
line: "{{ item.cle }}={{ item.valeur }}"
|
||
|
|
loop:
|
||
|
|
- { cle: "VISIO_DOMAINE", valeur: "{{ visio_domaine }}" }
|
||
|
|
- { cle: "VISIO_JWT_APP_ID", valeur: "{{ visio_jwt_app_id }}" }
|
||
|
|
- { cle: "VISIO_JWT_AUDIENCE", valeur: "{{ visio_jwt_audience }}" }
|
||
|
|
- { cle: "VISIO_JWT_SECRET", valeur: "{{ visio_secrets_brut.content | b64decode | regex_search('JWT_APP_SECRET=(\\S+)', '\\1') | first }}" }
|
||
|
|
no_log: true
|
||
|
|
notify: remettre en cache la configuration du portail
|