-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update Dockerfile and include cronjob
including s6 overlay to docker image plus implementing the cronjob to update certs in eturnal turn server. eturnal reloads certificates without interrupting/closing existing sessions.
- Loading branch information
Showing
5 changed files
with
116 additions
and
68 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| #!/command/with-contenv /bin/sh | ||
|
|
||
| # only run the script if TURNS is enabled (and if acme.sh is used in web container) | ||
| if [ ! -z $TURNS_HOST ] || ([ ! -z $TURNS_HOST ] && [ $ENABLE_LETSENCRYPT -eq 1 ]); then | ||
|
|
||
| while true; do | ||
| # sleep a sufficient time to give the web container's acme.sh script a chance to obtain certificates | ||
| sleep 60s | ||
|
|
||
| # mounted certs from web container | ||
| TLS_CERT_FILE=$(find /etc/ -name fullchain.pem) | ||
| TLS_KEY_FILE=$(find /etc/ -name key.pem) | ||
|
|
||
| # check if files have changed | ||
| if [ ! -z $TLS_CERT_FILE ] || [ ! -z $TLS_KEY_FILE ]; then | ||
| current=$(md5sum /opt/eturnal/tls/fullchain.pem | awk '{ print $1 }') | ||
| last_modified=$(md5sum $TLS_CERT_FILE | awk '{ print $1 }') | ||
|
|
||
| # copy certs to eturnal, adjust configuration file | ||
| if [ "$current" != "$last_modified" ]; then | ||
| echo " $(date) [Info] TLS certificates have been renewed, copy certs to eturnal and reload" | ||
|
|
||
| if [ ! -z $TLS_CERT_FILE ]; then | ||
| cp -p $TLS_CERT_FILE /opt/eturnal/tls | ||
| sed -i -e "s|#tls_crt_file:|tls_crt_file:|g" /opt/eturnal/etc/eturnal.yml | ||
| fi | ||
|
|
||
| if [ ! -z $TLS_KEY_FILE ]; then | ||
| cp -p $TLS_KEY_FILE /opt/eturnal/tls | ||
| sed -i -e "s|#tls_key_file:|tls_key_file:|g" /opt/eturnal/etc/eturnal.yml | ||
| fi | ||
|
|
||
| # fix ownership and reload the service (reloading eturnal does not stop/break any active sessions) | ||
| chown 9000:9000 /opt/eturnal/tls/* | ||
| eturnalctl reload | ||
|
|
||
| else | ||
| echo " $(date) [Info] CronJob: TLS certificates have not been renewed, check again in 5 minutes" | ||
| fi | ||
| sleep 240s | ||
| fi | ||
| done | ||
|
|
||
| # don't repeatedly run the cron job, if eturnal does not serve TURNS | ||
| else | ||
| s6-svc -O /var/run/s6/legacy-services/cron | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| #!/command/with-contenv /bin/sh | ||
|
|
||
| # TURN credentials | ||
| if [ ! -z $TURN_CREDENTIALS ] | ||
| then | ||
| export ETURNAL_SECRET=$TURN_CREDENTIALS | ||
| fi | ||
|
|
||
| # TURN relay port range | ||
| if [ ! -z $TURN_RELAY_MIN_PORT ] || [ ! -z $TURN_RELAY_MAX_PORT ] | ||
| then | ||
| if [ ${TURN_RELAY_MIN_PORT-50000} \< ${TURN_RELAY_MAX_PORT-50500} ] | ||
| then | ||
| export ETURNAL_RELAY_MIN_PORT=${TURN_RELAY_MIN_PORT-50000} | ||
| export ETURNAL_RELAY_MAX_PORT=${TURN_RELAY_MAX_PORT-50500} | ||
| else | ||
| echo "" | ||
| echo " $(date) [INFO] Configuration check:" | ||
| echo "" | ||
| echo " $(date) [WARNING] Defined TURN range minimum port -> ${TURN_RELAY_MIN_PORT-50000} is greater or equal than maximum port -> ${TURN_RELAY_MAX_PORT-50500}" | ||
| echo " $(date) [INFO] Starting eturnal with relay port range 50000 - 50500" | ||
| echo "" | ||
| export ETURNAL_RELAY_MIN_PORT=50000 | ||
| export ETURNAL_RELAY_MAX_PORT=50500 | ||
| fi | ||
| else | ||
| export ETURNAL_RELAY_MIN_PORT=50000 | ||
| export ETURNAL_RELAY_MAX_PORT=50500 | ||
| fi | ||
|
|
||
| # discover public IP addresses | ||
| if [ ! -z $DOCKER_HOST_ADDRESS ] | ||
| then | ||
| export ETURNAL_RELAY_IPV4_ADDR=$DOCKER_HOST_ADDRESS | ||
| else | ||
| if [ -z "$JVB_DISABLE_STUN" ] | ||
| then | ||
| export ETURNAL_RELAY_IPV4_ADDR=${ETURNAL_RELAY_IPV4_ADDR-$(stun -4 $STUN_SERVICE)} | ||
| export ETURNAL_RELAY_IPV6_ADDR=${ETURNAL_RELAY_IPV6_ADDR-$(stun -6 $STUN_SERVICE)} | ||
| fi | ||
| fi | ||
|
|
||
| exec eturnalctl foreground |