begin Talk HPB implementation

Reviewed-on: coop-cloud/nextcloud#55

.env.sample

@@ -15,6 +15,7 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
 #MAX_DB_CONNECTIONS=500
 
 ADMIN_USER=admin
+TZ=Etc/UTC
 
 SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
@@ -23,6 +24,7 @@ SECRET_ADMIN_PASSWORD_VERSION=v1
 EXTRA_VOLUME=/dev/null:/tmp/.dummy
 
 PHP_MEMORY_LIMIT=1G
+PHP_UPLOAD_LIMIT=512M
 # fpm-tune, see: https://spot13.com/pmcalculator/
 FPM_MAX_CHILDREN=16
 FPM_START_SERVERS=4
@@ -81,13 +83,17 @@ DEFAULT_QUOTA="10 GB"
 # AUTHENTIK_DOMAIN=authentik.example.com
 # SECRET_AUTHENTIK_SECRET_VERSION=v1
 # SECRET_AUTHENTIK_ID_VERSION=v1
-# OCC_CMDS="app:disable dashboard"
-# OCC_CMDS="$OCC_CMDS|config:app:set sociallogin auto_create_groups --value 1"
-# OCC_CMDS="$OCC_CMDS|config:app:set sociallogin hide_default_login --value 1"
 
 #COMPOSE_FILE="$COMPOSE_FILE:compose.fulltextsearch.yml"
 #SECRET_ELASTICSEARCH_PASSWORD_VERSION=v1
 
+#COMPOSE_FILE="$COMPOSE_FILE:compose.talk.yml"
+#TALK_DOMAIN=talk.example.com
+#SECRET_TALK_INTERNAL_SECRET_VERSION=v1 # length=64 charset=default
+#SECRET_TALK_TURN_SECRET_VERSION=v1 # length=64 charset=default
+#SECRET_TALK_SIGNALING_SECRET_VERSION=v1 # length=64 charset=default
+
+
 # HSTS Options
 # Uncomment this line to enable HSTS: https://docs.nextcloud.com/server/30/admin_manual/installation/harden_server.html
 #HSTS_ENABLED=1

README.md

@@ -64,21 +64,18 @@ AUTHENTIK_ID_NAME=authentik_example_com_nextcloud_id_v1  # the same as in authen
 
 `abra app cmd <app-name> app set_authentik`
 
-### Disable Dashboard
-
-Disable dashboard app since it is so corporate:
-
-`abra app config <app-name>` 
-Configure the following envs:
-```
-OCC_CMDS="app:disable dashboard"
-```
-`abra app cmd <app-name> app post_install_occ`
-
 ## Running `occ`
 
 `abra app cmd <app-name> app run_occ '"user:list --help"'`
 
+Read more about [occ command here](https://docs.nextcloud.com/server/stable/admin_manual/occ_command.html).
+
+### Disable Dashboard
+
+To disable dashboard app (since it is so corporate):
+
+`abra app cmd <app-name> app run_occ '"app:disable dashboard"'`
+
 ## Default user files
 
 - Follow [these docs](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/default_files_configuration.html) to set the default files list for each user in the Files app

abra.sh

@@ -2,9 +2,10 @@
 
 export FPM_TUNE_VERSION=v5
 export NGINX_CONF_VERSION=v8
-export MY_CNF_VERSION=v5
+export MY_CNF_VERSION=v6
 export ENTRYPOINT_VERSION=v3
 export ENTRYPOINT_WHITEBOARD_VERSION=v1
+export ENTRYPOINT_TALK_VERSION=v1
 export CRONTAB_VERSION=v1
 export PG_BACKUP_VERSION=v2
 
@@ -12,13 +13,6 @@ run_occ() {
     su -p www-data -s /bin/sh -c "/var/www/html/occ $@"
 }
 
-post_install_occ() {
-    IFS='|' read -ra CMD <<<"$OCC_CMDS"
-    for cmd in "${CMD[@]}"; do
-        run_occ "$cmd"
-    done
-}
-
 install_apps() {
     install_apps="$@"
     if [ -z "$install_apps" ]; then
@@ -103,6 +97,14 @@ install_whiteboard() {
     set_app_config whiteboard jwt_secret_key "$(cat /run/secrets/whiteboard_jwt)"
 }
 
+install_talk() {
+    install_apps spreed
+    run_occ "talk:signaling:add --verify 'wss://${TALK_DOMAIN}' '$(cat /run/secrets/talk_signaling_secret)'"
+    run_occ "talk:stun:add '${TALK_DOMAIN}:3478'"
+    run_occ "talk:turn:add --secret='$(cat /run/secrets/talk_turn_secret)' turn '${TALK_DOMAIN}:3478' udp,tcp"
+
+}
+
 
 install_fulltextsearch() {
     install_apps fulltextsearch

compose.mariadb.yml

@@ -16,6 +16,7 @@ services:
       - MYSQL_PASSWORD_FILE=/run/secrets/db_password
       - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_password
       - MAX_DB_CONNECTIONS=${MAX_DB_CONNECTIONS:-100}
+      - INNODB_BUFFER_POOL_SIZE=${INNODB_BUFFER_POOL_SIZE:-1G}"
     configs:
       - source: my_tune
         target: /etc/mysql/conf.d/my-tune.cnf

compose.talk.yml

@@ -0,0 +1,64 @@
+version: "3.8"
+
+services:
+  talk:
+    image: "nextcloud/aio-talk:20251031_122139"
+    environment:
+      - NC_DOMAIN=${DOMAIN}
+      - TALK_HOST=${TALK_DOMAIN}
+      - TZ
+      - TALK_PORT=3478
+      - INTERNAL_SECRET_FILE=/run/secrets/talk_internal_secret 
+      - TURN_SECRET_FILE=/run/secrets/talk_turn_secret
+      - SIGNALING_SECRET_FILE=/run/secrets/talk_signaling_secret
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.docker.network=proxy
+        - traefik.http.services.${STACK_NAME}_talk.loadbalancer.server.port=8081
+        - traefik.http.routers.${STACK_NAME}_talk.rule=Host(`${TALK_DOMAIN}`)
+        - traefik.http.routers.${STACK_NAME}_talk.entrypoints=web-secure
+        - traefik.http.routers.${STACK_NAME}_talk.tls.certresolver=${LETS_ENCRYPT_ENV}
+
+    networks:
+      - proxy
+    configs:
+      - source: entrypoint_talk
+        target: /custom-entrypoint.sh
+        mode: 775
+    entrypoint: /custom-entrypoint.sh
+    secrets:
+      - source: talk_internal_secret
+        uid: "1000"
+        gid: "122"
+        mode: 0600
+      - source: talk_turn_secret
+        uid: "1000"
+        gid: "122"
+        mode: 0600
+      - source: talk_signaling_secret
+        uid: "1000"
+        gid: "122"
+        mode: 0600
+
+  app:
+    secrets:
+      - talk_turn_secret
+      - talk_signaling_secret
+
+secrets:
+  talk_internal_secret:
+    external: true
+    name: ${STACK_NAME}_talk_internal_secret_${SECRET_TALK_INTERNAL_SECRET_VERSION}
+  talk_turn_secret:
+    external: true
+    name: ${STACK_NAME}_talk_turn_secret_${SECRET_TALK_TURN_SECRET_VERSION}
+  talk_signaling_secret:
+    external: true
+    name: ${STACK_NAME}_talk_signaling_secret_${SECRET_TALK_SIGNALING_SECRET_VERSION}
+
+configs:
+  entrypoint_talk:
+    name: ${STACK_NAME}_entrypoint_talk_${ENTRYPOINT_TALK_VERSION}
+    file: entrypoint.talk.sh.tmpl
+    template_driver: golang

compose.yml

@@ -35,8 +35,8 @@ services:
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
         - "caddy=${DOMAIN}"
         - "caddy.reverse_proxy={{upstreams 80}}"
         - "caddy.tls.on_demand="
@@ -76,6 +76,7 @@ services:
       - OVERWRITEPROTOCOL=https
       - OVERWRITECLIURL=https://${DOMAIN}
       - PHP_MEMORY_LIMIT=${PHP_MEMORY_LIMIT:-1G}
+      - PHP_UPLOAD_LIMIT=${PHP_UPLOAD_LIMIT:-512M}
       - FPM_MAX_CHILDREN=${FPM_MAX_CHILDREN:-131}
       - FPM_START_SERVERS=${FPM_START_SERVERS:-32}
       - FPM_MIN_SPARE_SERVERS=${FPM_MIN_SPARE_SERVERS:-32}

entrypoint.talk.sh.tmpl

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+set -eu
+
+file_env() {
+  local var="$1"
+  local fileVar="${var}_FILE"
+  local def="${2:-}"
+
+  if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+    echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+    exit 1
+  fi
+
+  local val="$def"
+  if [ "${!var:-}" ]; then
+    val="${!var}"
+  elif [ "${!fileVar:-}" ]; then
+    val="$(< "${!fileVar}")"
+  fi
+
+  export "$var"="$val"
+  unset "$fileVar"
+}
+
+file_env "INTERNAL_SECRET"
+file_env "TURN_SECRET"
+file_env "SIGNALING_SECRET"
+
+/start.sh supervisord -c /supervisord.conf

my-tune.cnf

@@ -4,7 +4,7 @@
 # https://mariadb.com/kb/en/library/performance-schema-overview/
 
 [server]
-innodb_buffer_pool_size        = 1G
+innodb_buffer_pool_size        = {{ env "INNODB_BUFFER_POOL_SIZE" }}
 innodb_flush_log_at_trx_commit = 2
 innodb_log_buffer_size         = 32M
 innodb_max_dirty_pages_pct     = 90