many changes for graphql, postgres, freeswitch, etc to enable networking and finishing certain tasks

2026-07-12 16:57:01 -04:00
parent 7d64aebd42
commit ace5578b1c
13 changed files with 144 additions and 52 deletions
@@ -40,6 +40,9 @@ BRF_CONF_VERSION=v1
 BHDN_CONF_VERSION=v1
 BEG_CONF_VERSION=v1
 AA_CONF_VERSION=v1
+PRES_CONF_VERSION=v1
+DEMO_CONF_VERSION=v1
+FREESWITCH_EX_VERSION=v1

 # ====================================
 # ADDITIONS to BigBlueButton
@@ -97,7 +100,7 @@ ENABLE_GREENLIGHT=true
 # CONNECTION
 # ====================================

-EXTERNAL_IPv4=
+EXTERNAL_IPv4=0.0.0.0
 # EXTERNAL_IPv6=2010

 # STUN SERVER
@@ -113,7 +116,7 @@ STUN_PORT=3478
 # due to high traffic caused by bots, by default the SIP port is blocked.
 # but you can allow access by your providers IP or IP ranges (comma seperated)
 # Hint: if you want to allow requests from every IP, you can use 0.0.0.0/0
-SIP_IP_ALLOWLIST=
+SIP_IP_ALLOWLIST=0.0.0.0/0

 # ====================================
 # CUSTOMIZATION
@@ -130,7 +133,7 @@ WELCOME_FOOTER="This server is running <a href='https://docs.bigbluebutton.org/'

 # for a different default presentation, place the pdf file in ./conf/ and
 # adjust the following path
-DEFAULT_PRESENTATION=./mod/nginx/default.pdf
+DEFAULT_PRESENTATION=/etc/nginx/bbb/default.pdf

 # language of sound announcements
 # options:
@@ -1,3 +1,3 @@
 # Set any config versions here
 # Docs: https://docs.coopcloud.tech/maintainers/handbook/#manage-configs
-export APP_ENTRYPOINT_VERSION=v1
+export APP_ENTRYPOINT_VERSION=v1
@@ -43,6 +43,9 @@ services:
  # freeswitch (audio input streaming and telco dial-in support)
  freeswitch:
    image: alangecker/bbb-docker-freeswitch:v1.10.12-v3.0.19
+    deploy:
+      replicas: 1
+      endpoint_mode: dnsrr
    cap_add:
      - IPC_LOCK
      - NET_ADMIN
@@ -86,18 +89,17 @@ services:
    image: alangecker/bbb-docker-nginx:v3.0.19-v5.4.3-1.29
    volumes:
      - bigbluebutton:/var/bigbluebutton
-      - ${DEFAULT_PRESENTATION:-/dev/null}:/www/default.pdf
    tmpfs:
     - /tmp
    configs:
      - source: nginx_conf
        target: /etc/nginx/nginx.conf
        mode: 0555
-      - source: beg_conf
-        target: /etc/nginx/bbb/bbb-exporter.nginx
-        mode: 0555
-      - source: bhdn_conf
-        target: /etc/nginx/bbb/bbb-html5.dev.nginx
+#      - source: beg_conf
+#        target: /etc/nginx/bbb/bbb-exporter.nginx
+#        mode: 0555
+      - source: bhdn_conf # used to be in dev mode
+        target: /etc/nginx/bbb/bbb-html5.nginx
        mode: 0555
      - source: wn_conf
        target: /etc/nginx/bbb/webhooks.nginx
@@ -105,6 +107,12 @@ services:
      - source: wsn_conf
        target: /etc/nginx/bbb/webrtc-sfu.nginx
        mode: 0555
+      - source: pres_conf
+        target: /www/default.pdf
+        mode: 0555
+      - source: demo_conf
+        target: /etc/nginx/bbb/demo.nginx
+        mode: 0555
    networks:
      - proxy
      - internal
@@ -112,7 +120,7 @@ services:
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
-        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=80"
+        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=48087"
        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
@@ -205,7 +213,7 @@ services:
    environment:
      # ESL_PASSWORD is set via entrypoint.webrtc-sfu.sh
      # ip must be 0.0.0.0 (container can't bind to external host IP)
-      MS_WEBRTC_LISTEN_IPS: '[{"ip":"0.0.0.0", "announcedIp":"${EXTERNAL_IPv4}"}]'
+      MS_WEBRTC_LISTEN_IPS: '[{"ip":"${EXTERNAL_IPv4}", "announcedIp":"${EXTERNAL_IPv4}"}]'
    configs:
      - source: entrypoint_webrtcsfu
        target: /usr/local/bin/docker-entrypoint.sh
@@ -222,8 +230,8 @@ services:
       - fsesl_password
    # network_mode: host would be needed for mediasoup UDP to work from outside;
    # keeping on overlay network for now so other services can reach it by name.
-    # security_opt:
-      # - seccomp:unconfined # allow io_uring access for mediasoup
+    #security_opt:
+    #  - seccomp:unconfined # allow io_uring access for mediasoup
    ulimits:
      memlock: -1 # allow io_uring_register_buffers to allocate enough ram
    networks:
@@ -266,7 +274,7 @@ services:
         target: /etc/bigbluebutton/bbb-html5.yml
         mode: 0555 
       - source: aa_conf
-         target: /etc/bigbluebutton/mod/bbb-apps-akka.conf.tmpl
+         target: /etc/bigbluebutton/bbb-apps-akka.conf.tmpl
         mode: 0555
    secrets:
       - shared_secret
@@ -284,6 +292,7 @@ services:
      - bbb-graphql-actions
    secrets:
      - postgres_password
+      - hasura_admin_secret
    environment:
      POSTGRES_USER: postgres
      # POSTGRES_PASSWORD and HASURA_GRAPHQL_ADMIN_SECRET are set via entrypoint
@@ -292,10 +301,12 @@ services:
        target: /usr/local/bin/docker-entrypoint.sh
        mode: 0555
    entrypoint: /usr/local/bin/docker-entrypoint.sh
-    command: ["graphql-engine", "serve"]
-    secrets:
-      - postgres_password
-      - hasura_admin_secret
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8085/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
    networks:
      - internal
  
@@ -375,9 +386,9 @@ services:
      - turn_secret
    environment:
      ENABLE_HTTPS_PROXY: "false"
-    volumes:
-      - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/cert.pem:/tmp/cert.pem:ro"
-      - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/key.pem:/tmp/key.pem:ro"
+    # volumes:
+    #   - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/cert.pem:/tmp/cert.pem:ro"
+    #   - "/var/home/thebastard/.abra/recipes/bigbluebutton/cert/key.pem:/tmp/key.pem:ro"
    # network_mode: host <- mine has this commented out
    network_mode: host
    user: root
@@ -496,7 +507,7 @@ configs:
    file: ./mod/bbb-exporter.nginx
  bhdn_conf:
    name: ${STACK_NAME}_bhdn_conf_${BHDN_CONF_VERSION}
-    file: ./mod/bbb-html5.dev.nginx
+    file: ./mod/nginx/bbb/bbb-html5.nginx
  brf_conf:
    name: ${STACK_NAME}_brf_conf_${BRF_CONF_VERSION}
    file: ./mod/bbb-resync-freeswitch
@@ -512,6 +523,15 @@ configs:
  ws_conf:
    name: ${STACK_NAME}_ws_conf_${WS_CONF_VERSION}
    file: ./mod/webrtc-sfu-config.yaml
+  demo_conf:
+    name: ${STACK_NAME}_demo_conf_${DEMO_CONF_VERSION}
+    file: ./mod/nginx/bbb/demo.nginx
+  pres_conf: # the default presentation for bbb nginx
+    name: ${STACK_NAME}_pres_conf_${PRES_CONF_VERSION}
+    file: ./mod/nginx/default.pdf
+  freeswitch_ex:
+    name: ${STACK_NAME}_freeswitch_ex_${FREESWITCH_EX_VERSION}
+    file: ./mod/freeswitch/conf/sip_profiles/external.xml

 secrets:
  postgres_password:
@@ -42,5 +42,7 @@ TARGET=/usr/share/bigbluebutton/html5-client/private/config/settings.yml
 yq e -i ".public.kurento.wsUrl = \"wss://$DOMAIN/bbb-webrtc-sfu\"" $TARGET
 yq e -i ".public.pads.url = \"https://$DOMAIN/pad\"" $TARGET

+sleep 50
+    
 cd /bbb-apps-akka
 /bbb-apps-akka/bin/bbb-apps-akka
@@ -31,4 +31,79 @@ else
    exit 1
 fi

-exec "$@"
+
+# for psql
+export PGHOST=postgres
+export PGUSER="${POSTGRES_USER}"
+export PGPASSWORD="${POSTGRES_PASSWORD}"
+
+
+# for hasura
+export HASURA_GRAPHQL_DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/hasura_app
+export HASURA_GRAPHQL_METADATA_DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/hasura_app
+export HASURA_GRAPHQL_LOG_LEVEL=warn
+export HASURA_GRAPHQL_ENABLE_CONSOLE=false
+export HASURA_GRAPHQL_LIVE_QUERIES_MULTIPLEXED_REFETCH_INTERVAL=333
+export HASURA_GRAPHQL_LIVE_QUERIES_MULTIPLEXED_BATCH_SIZE=1000
+export HASURA_GRAPHQL_STREAMING_QUERIES_MULTIPLEXED_REFETCH_INTERVAL=150
+export HASURA_GRAPHQL_STREAMING_QUERIES_MULTIPLEXED_BATCH_SIZE=1000
+export HASURA_GRAPHQL_SERVER_PORT=8085
+export HASURA_GRAPHQL_ENABLE_TELEMETRY=false
+export HASURA_GRAPHQL_WEBSOCKET_KEEPALIVE=10
+export HASURA_GRAPHQL_AUTH_HOOK=http://apps-akka:8901/userInfo
+export HASURA_BBB_GRAPHQL_ACTIONS_ADAPTER_URL=http://bbb-graphql-actions:8093
+
+
+export HASURA_GRAPHQL_BBB_DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/bbb_graphql
+
+# echo "Waiting for Postgres..."
+# TIMEOUT=30
+# i=0
+# until (echo > /dev/tcp/$PGHOST/5432) 2>/dev/null; do
+#   i=$((i+1))
+#   if [ $i -ge $TIMEOUT ]; then
+#     echo "Postgres did not start within $TIMEOUT seconds."
+#     exit 1
+#   fi
+#   sleep 1
+# done
+# echo "Postgres is ready!"
+
+cd /app/
+
+# patch database url
+# TODO: this should be possible upstream in BBB via an environment variable
+yq e -i ".[1].configuration.connection_info.database_url = \"$HASURA_GRAPHQL_BBB_DATABASE_URL\"" metadata/databases/databases.yaml
+
+sed -i "s/^admin_secret: .*/admin_secret: $HASURA_GRAPHQL_ADMIN_SECRET/g" /app/config.yaml
+
+echo "SELECT 'CREATE DATABASE hasura_app' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'hasura_app')\gexec" | psql
+
+echo "Restarting database bbb_graphql"
+psql -c "SELECT pg_terminate_backend(pg_stat_activity.pid) FROM pg_stat_activity WHERE datname = 'bbb_graphql'" > /dev/null
+psql -c "drop database if exists bbb_graphql with (force)"
+psql -c "create database bbb_graphql WITH TEMPLATE template0 LC_COLLATE 'C.UTF-8'"
+psql -c "alter database bbb_graphql set timezone to 'UTC'"
+
+echo "Creating tables in bbb_graphql"
+psql -U postgres -d bbb_graphql -q -f bbb_schema.sql --set ON_ERROR_STOP=on
+
+echo "Starting hasura-graphql-engine"
+gosu nobody graphql-engine serve --log-level debug &
+PID=$!
+
+sleep 1
+
+
+#Check if Hasura is ready before applying metadata
+while ! netstat -tuln | grep ":$HASURA_GRAPHQL_SERVER_PORT " > /dev/null; do
+    echo "Waiting for Hasura's port ($HASURA_GRAPHQL_SERVER_PORT) to be ready..."
+    sleep 1
+done
+
+echo "Applying new metadata to Hasura"
+/usr/local/bin/hasura metadata apply --skip-update-check
+
+wait "$PID"
+
+#graphql-engine serve --log-level debug
@@ -53,4 +53,4 @@ sleep 100
 cd /usr/share/bbb-web/
 dockerize \
    -template /etc/bigbluebutton/bbb-web.properties.tmpl:/etc/bigbluebutton/bbb-web.properties \
-    gosu bigbluebutton java -Dgrails.env=prod -Dserver.address=0.0.0.0 -Dserver.port=8090 -Dspring.main.allow-circular-references=true -Xms384m -Xmx384m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/bigbluebutton/diagnostics -cp WEB-INF/lib/*:/:WEB-INF/classes/:. org.springframework.boot.loader.WarLauncher
+    gosu bigbluebutton java -Dgrails.env=prod -Dserver.address=0.0.0.0 -Dserver.port=8090 -Dspring.main.allow-circular-references=true -Xms384m -Xmx384m -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/bigbluebutton/diagnostics -cp WEB-INF/lib/*:/:WEB-INF/classes/:. org.springframework.boot.loader.launch.WarLauncher
@@ -80,6 +80,13 @@ fi


 export SOUNDS_PATH=$SOUNDS_DIR/$(echo "$SOUNDS_LANGUAGE" | sed 's|-|/|g')
+sed -i -e 's/10.7.7.10/0.0.0.0/g' /etc/freeswitch/vars.xml.tmpl
+sed -i -e 's/:5066/0.0.0.0:5066/g' /etc/freeswitch/sip_profiles/external.xml
+sed -i -e 's/:5066/0.0.0.0:5066/g' /etc/freeswitch/sip_profiles/external-ipv6.xml
+sed -i -e 's/:5066/0.0.0.0:5066/g' /etc/freeswitch/sip_profiles/internal.xml
+
+sed -i -e 's/$${local_ip_v4}/auto-nat/g' /etc/freeswitch/sip_profiles/external.xml
+#sed -i -e 's/$${local_ip_v4}/auto-nat/g' /etc/freeswitch/sip_profiles/external-ipv6.xml

 dockerize \
    -template /etc/freeswitch/vars.xml.tmpl:/etc/freeswitch/vars.xml \
@@ -1,9 +1,7 @@
 // include default config from upstream
 include "/bbb-apps-akka/conf/application.conf"

-redis {
-    host="redis"
-}
+redis.host = "redis" 

 services {
  bbbWebAPI="https://DOMAIN/bigbluebutton/api"
@@ -101,8 +101,8 @@
    <param name="tls-verify-in-subjects" value=""/>
    <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 -->
    <param name="tls-version" value="$${sip_tls_version}"/>
-    <param name="ws-binding"  value=":5066"/>
-    <param name="wss-binding"  value=":7443"/>
+    <param name="ws-binding"  value="0.0.0.0:5066"/>
+    <param name="wss-binding"  value="0.0.0.0:7443"/>

    <!-- enable rtcp on every channel also can be done per leg basis with rtcp_audio_interval_msec variable set to passthru to pass it across a call-->
    <param name="rtcp-audio-interval-msec" value="5000"/>
@@ -60,7 +60,7 @@
      affect the sip authentication.  Please review conf/directory/default.xml for more
      information on this topic.
  -->
-  <X-PRE-PROCESS cmd="set" data="local_ip_v4=10.7.7.10"/>
+  <X-PRE-PROCESS cmd="set" data="local_ip_v4=0.0.0.0"/>
  <X-PRE-PROCESS cmd="set" data="external_ip_v4={{ .Env.EXTERNAL_IPv4 }}"/>

  <X-PRE-PROCESS cmd="set" data="domain={{ .Env.DOMAIN }}"/>
@@ -3,24 +3,8 @@
        location = /demo/ {
          return 301 /demo/demo1.jsp;
        }
+        # temporarily since the original used host networking
        location /demo {
-           proxy_pass         http://host.docker.internal:8001;
-           proxy_redirect     default;
-           proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
-
-        # Allow 30M uploaded presentation document.
-           client_max_body_size       30m;
-           client_body_buffer_size    128k;
-
-           proxy_connect_timeout      90;
-           proxy_send_timeout         90;
-           proxy_read_timeout         90;
-
-           proxy_buffer_size          4k;
-           proxy_buffers              4 32k;
-           proxy_busy_buffers_size    64k;
-           proxy_temp_file_write_size 64k;
-
-           include    fastcgi_params;
+         return 404;
        }

@@ -1,9 +1,11 @@
 kurento: []
 redisHost: redis
-clientHost: webrtc-sfu
+
+clientHost: 0.0.0.0 # this changed
+
 recordingAdapter: bbb-webrtc-recorder

-mcs-host: webrtc-sfu
+mcs-host: 0.0.0.0 # this changed
 mcs-address: webrtc-sfu
 freeswitch:
  ip: freeswitch
@@ -29,7 +31,7 @@ mediasoup:
    # Must match the port range published in compose.yml (24577-24676)
    rtcMinPort: 24577
    rtcMaxPort: 24676
-
+    disableLiburing: true
  plainRtp:
    listenIp:
      ip: "0.0.0.0"