严格按照戴维营的https方法，搭建一边apprtc服务器

zangcf · 发表于 2016-8-6 16:15:45

网址：
http://www.jianshu.com/p/5431a7066f47

zangcf · 发表于 2016-8-6 16:31:52

在Ubuntu Linux 版本服务器上创建新用户apprtc,设置密码,并安装必要的软件包:
useradd -m apprtc
passwd apprtc
apt-get install openjdk-7-jdk
apt-get install python-webtest

mkdir apprtc_root
cd apprtc_root
git clone https://github.com/webrtc/apprtc.git

zangcf · 发表于 2016-8-6 17:29:47

本帖最后由 zangcf 于 2016-8-8 05:41 编辑

安装NodeJS和grunt
=========================
apt-get install nodejs
npm install -g npm

apt-get install nodejs-legacy

npm -g install grunt-cli

zangcf · 发表于 2016-8-8 05:44:21

本帖最后由 zangcf 于 2016-8-8 06:17 编辑

执行下面命令:

npm install然后再执行下面命令编译出apprtc这个GAE app.
$ grunt build编译完成后,输出将放在~/apprtc_root/out目录下的app_engine目录
当然到这一步还没完,还需要配置constant.py服务器参数,
ICE_SERVER_BASE_URL = 'https://api.diveinedu.com'ICE_SERVER_URL_TEMPLATE = '%s/apprtc/iceconfig.php?key=%s'ICE_SERVER_API_KEY = os.environ.get('ICE_SERVER_API_KEY')然后把下面命令放到一个脚本文件$HOME/start_apprtc.sh中:
export PATH=$PATH:$HOME/google_appengineexport APPRTC_APP=$HOME/apprtc_root/out/app_engine/export HOST="--host=0.0.0.0"export ICE_SERVER_API_KEY="AIzaSyAJdh2HkajseEIltlZ3SIXO02Tze9sO3NY"dev_appserver.py $HOST $APPRTC_APP以后都只需要执行该脚本文件就可以启动会话房间服务:
$ $HOME/start_apprtc.sh打开浏览器,访问服务器<a href="http://apprtc.diveinedu.com:8080" target="_blank">http://apprtc.diveinedu.com:8080</a> ,就可以打开了.
===================
上面的配置有两个问题，第一，没有dev_appserver.py的环境
第二，ICE_SERVER_API_KEY需要后面确定

复制代码

准备包：google_appengine_1.9.35.zip解压缩，然后加入执行环境

export PATH=$PATH:$HOME/google_appengine
echo "export PATH=$PATH:$HOME/google_appengine" >> $HOME/.profile

复制代码

如果使用上面的脚本，上面准备环境步奏可以不要，因为sh脚本已经做了这个工作

zangcf · 发表于 2016-8-8 06:16:32

本帖最后由 zangcf 于 2016-8-8 06:54 编辑

配置Nginx反向代理服务器,提供默认HTTPS的访问, 新建Nginx虚拟主机配置文件,反向代理到8080端口

安装nginx的方法：

apt-get install nginx

复制代码

配置/etc/nginx/site-available/apprtc.91xuepai.com

#/etc/nginx/sites-enabled/apprtc.diveinedu.com
upstream roomserver {
server localhost:8080;
}
}
server {
listen 80 ;
server_name apprtc.91xuepai.com;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ;
ssl on;
ssl_certificate /etc/nginx/apprtc.91xuepai.com.crt;
ssl_certificate_key /etc/nginx/apprtc.91xuepai.com.key;
server_name apprtc.diveinedu.com;
access_log /var/log/nginx/apprtc.91xuepai.com.log;
location / {
proxy_pass http://roomserver$request_uri;
proxy_set_header Host $host;
}
}

复制代码

注意，要把这个站点配置文件link到site-enable

root@iZ949sqo4m3Z:/etc/nginx/sites-available# ln -s ../sites-available/apprtc.91xuepai.com ./apprtc.91xuepai.com

复制代码

最后，准备key和crt文件
使用simplewebrtc的信令服务器来准备这两个文件：

root@iZ949sqo4m3Z:~# cd singalserver/
root@iZ949sqo4m3Z:~/singalserver# ls
signalmaster-master signalmaster-master.zip test
root@iZ949sqo4m3Z:~/singalserver# cd signalmaster-master/
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master# ls
config LICENSE package.json README.md server.js test.js
Dockerfile node_modules Procfile scripts sockets.js
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master# cd config/
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config# ls
development.json production.json
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config# cd ..
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master# ls
config LICENSE package.json README.md server.js test.js
Dockerfile node_modules Procfile scripts sockets.js
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master# cd ..
root@iZ949sqo4m3Z:~/singalserver# ls
signalmaster-master signalmaster-master.zip test
root@iZ949sqo4m3Z:~/singalserver# cd test/
root@iZ949sqo4m3Z:~/singalserver/test# ls
config LICENSE package.json README.md server.js test.js
Dockerfile node_modules Procfile scripts sockets.js
root@iZ949sqo4m3Z:~/singalserver/test# cd..
cd..: command not found
root@iZ949sqo4m3Z:~/singalserver/test# ls
config LICENSE package.json README.md server.js test.js
Dockerfile node_modules Procfile scripts sockets.js
root@iZ949sqo4m3Z:~/singalserver/test# ls
config LICENSE package.json README.md server.js test.js
Dockerfile node_modules Procfile scripts sockets.js
root@iZ949sqo4m3Z:~/singalserver/test# cd ..
root@iZ949sqo4m3Z:~/singalserver# ls
signalmaster-master signalmaster-master.zip test
root@iZ949sqo4m3Z:~/singalserver# cd signalmaster-master/
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master# ./scripts/generate-ssl-certs.sh
Generating self-signed certificates...
Generating RSA private key, 1024 bit long modulus
...........++++++
......++++++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:GD
Locality Name (eg, city) []:SZ
Organization Name (eg, company) [Internet Widgits Pty Ltd]:91xuepai
Organizational Unit Name (eg, section) []:91xuepai
Common Name (e.g. server FQDN or YOUR name) []:91xuepai
Email Address []:710833814@qq.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:123456
Signature ok
subject=/C=CN/ST=GD/L=SZ/O=91xuepai/OU=91xuepai/CN=91xuepai/emailAddress=710833814@qq.com
Getting Private key
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master# ls
config LICENSE package.json README.md server.js test.js
Dockerfile node_modules Procfile scripts sockets.js
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master# cd config/
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config# ls
development.json production.json sslcerts
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config# cd sslcerts/
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config/sslcerts# ls
cert.pem key.pem
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config/sslcerts# cp key.pem

复制代码

然后copy到指定目录：

root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config/sslcerts# cp key.pem /etc/nginx/apprtc.91xuepai.com.key
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config/sslcerts# cp cert.pem /etc/nginx/apprtc.91xuepai.com.crt
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config/sslcerts#

复制代码

最后，重启nginx

root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config/sslcerts# service nginx reload
* Reloading nginx configuration nginx
...done.
root@iZ949sqo4m3Z:~/singalserver/signalmaster-master/config/sslcerts#

复制代码

zangcf · 发表于 2016-8-8 07:40:07

本帖最后由 zangcf 于 2016-8-8 08:09 编辑

这个配置比较复杂，主要牵扯到云端服务器能否翻墙的问题：
========================================================
1，首先找一个本地的ubuntu桌面系统，保证可以使用翻墙工具
2，下载go程序:进入网站下载 http://www.golangtc.com/download
go1.6.2.linux-amd64.tar.gz
3，安装go环境
解压缩

<font color="#333333">tar xzvf </font><font color="#333333">go1.6.2.linux-amd64.tar.gz</font>

复制代码

将生成一个go的目录，使用su的权限

<div class="blockcode"><blockquote>root@iZ949sqo4m3Z:~# mv go /usr/local/
root@iZ949sqo4m3Z:~# vi .profile
# ~/.profile: executed by Bourne-compatible login shells.
if [ "$BASH" ]; then
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi
fi
export GOROOT="/usr/local/go"
export GOPATH="$HOME/collider_root"
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/ga
mes:/usr/local/games:/root/google_appengine:/root/google_appengine::$GOROOT/bin
mesg n
~
~
~
~
~
~
~
~
~
".profile" 13L, 367C written
root@iZ949sqo4m3Z:~# source .profile
root@iZ949sqo4m3Z:~# mkdir collider_root
root@iZ949sqo4m3Z:~# cd collider_root/
root@iZ949sqo4m3Z:~/collider_root# mkdir src
root@iZ949sqo4m3Z:~/collider_root# cd src/
root@iZ949sqo4m3Z:~/collider_root/src# echo $GOPATH
/root/collider_root
root@iZ949sqo4m3Z:~/collider_root/src# cp $HOME/apprtc_root/src/collider/collider ./
cp: omitting directory ?root/apprtc_root/src/collider/collider?
root@iZ949sqo4m3Z:~/collider_root/src# cp -r $HOME/apprtc_root/src/collider/collider ./
root@iZ949sqo4m3Z:~/collider_root/src# cp -r $HOME/apprtc_root/src/collider/collidermain ./
root@iZ949sqo4m3Z:~/collider_root/src# $HOME/apprtc_root/src/collider/collidertest
-bash: /root/apprtc_root/src/collider/collidertest: Is a directory
root@iZ949sqo4m3Z:~/collider_root/src# vi $GOPATH/src/collidermain/main.go
// Copyright (c) 2014 The WebRTC project authors. All Rights Reserved.
// Use of this source code is governed by a BSD-style license
// that can be found in the LICENSE file in the root of the source
// tree.
package main
import (
"collider"
"flag"
"log"
)
var tls = flag.Bool("tls", true, "whether TLS is used")
var port = flag.Int("port", 443, "The TCP port that the server listens on")
var roomSrv = flag.String("room-server", "https://120.76.203.222", "The origin of the room server")
func main() {
flag.Parse()
log.Printf("Starting collider: tls = %t, port = %d, room-server=%s", *tls, *port, *roomSrv)
"collidermain/main.go" 25L, 678C written
root@iZ949sqo4m3Z:~/collider_root/src# vi $GOPATH/src/collider/collider.go
// Copyright (c) 2014 The WebRTC project authors. All Rights Reserved.
// Use of this source code is governed by a BSD-style license
// that can be found in the LICENSE file in the root of the source
// tree.
// Package collider implements a signaling server based on WebSocket.
package collider
import (
"crypto/tls"
"golang.org/x/net/websocket"
"encoding/json"
"errors"
"io"
"io/ioutil"
"log"
"net/http"
"strconv"
"strings"
"time"
)
const registerTimeoutSec = 10
/ListenAndServeTLS
tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
},
PreferServerCipherSuites: true,
}
server := &http.Server{ Addr: pstr, Handler: nil, TLSConfig: config }
e = server.ListenAndServeTLS("/etc/nginx/apprtc.91xuepai.com.crt
", "/etc/nginx/apprtc.91xuepai.com.key")
} else {
e = http.ListenAndServe(pstr, nil)
}
if e != nil {
log.Fatal("Run: " + e.Error())
}
}
// httpStatusHandler is a HTTP handler that handles GET requests to get the
"collider/collider.go" 215L, 6275C written
root@iZ949sqo4m3Z:~/collider_root/src#

复制代码

10，然后重复上面：

go get collidermain
go install collidermain

复制代码

11，运行信令服务器：

$GOPATH/bin/collidermain -port=8089 -tls=true

复制代码

如何测试信令服务器是否可以工作呢？

zangcf · 发表于 2016-8-8 08:23:59

1，准备编译环境和安装相应库

apt-get install build-essential
apt-get install -y libssl-dev libevent-dev libpq-dev mysql-client libmysqlclient-dev libhiredis-dev

复制代码

2，下载程序，编译安装：
准备文件，turnserver-3.2.3.95.tar.gz解压缩

./configure
make
sudo make install

复制代码

3, 配置

zangcf · 发表于 2016-8-9 18:26:28

本帖最后由 zangcf 于 2016-8-9 19:12 编辑

对于turnserver，我决定还是按照戴维营的思路去搭建
第一步，删除原来的turnserver

root@iZ949sqo4m3Z:~/turnserver-3.2.3.95# make uninstall
pkill turnserver || echo OK
OK
rm -rf /usr/local/share/doc/turnserver
rm -rf /usr/local/share/turnserver
rm -rf /usr/local/bin/turnserver
rm -rf /usr/local/bin/turnadmin
rm -rf /usr/local/bin/turnutils_peer
rm -rf /usr/local/bin/turnutils_uclient
rm -rf /usr/local/bin/turnutils_stunclient
rm -rf /usr/local/man/man1/turnserver.1
rm -rf /usr/local/man/man1/turnadmin.1
rm -rf /usr/local/man/man1/turnutils.1
rm -rf /usr/local/man/man1/turnutils_uclient.1
rm -rf /usr/local/man/man1/turnutils_stunclient.1
rm -rf /usr/local/man/man1/turnutils_peer.1
rm -rf /usr/local/man/man1/rfc5766-turn-server.1
rm -rf /usr/local/lib/libturnclient.a
rm -rf /usr/local/share/examples/turnserver/
rm -rf /usr/local/etc/turnserver.conf.default
rm -rf /usr/local/etc/turnuserdb.conf.default

复制代码

下载安装包

tar xzvf turnserver-4.4.1.2-debian-wheezy-ubuntu-mint-x86-64bits.tar.gz

复制代码

使用dpkg安装

dpkg -i coturn_4.4.1.2-1_amd64.deb

复制代码

修改coturn的配置文件：

root@iZ949sqo4m3Z:/etc/default# vi coturn

复制代码

root@iZ949sqo4m3Z:/etc/default# vi coturn
#
# Uncomment it if you want to have the turnserver running as
# an automatic system service daemon
#
TURNSERVER_ENABLED=1

复制代码

生成user的密码：

root@iZ949sqo4m3Z:~# turnadmin -k -u 91xuepai -p 91xuepai
0x35a8061d1c85cd9f367d6dae569710ba
root@iZ949sqo4m3Z:~#

复制代码

修改配置文件/etc/turnserver.conf

zangcf · 发表于 2016-8-9 19:23:39

再次修改apprtc的constants.py文件

This module contains the constants used in AppRTC Python modules.
"""
import os
ROOM_MEMCACHE_EXPIRATION_SEC = 60 * 60 * 24
MEMCACHE_RETRY_LIMIT = 100
LOOPBACK_CLIENT_ID = 'LOOPBACK_CLIENT_ID'
# TODO: Remove once clients support ICE_SERVER.
TURN_BASE_URL = 'https://120.76.203.222'
TURN_URL_TEMPLATE = '%s/turn.php?username=%s&key=%s'
CEOD_KEY = '91xuepai'
ICE_SERVER_BASE_URL = 'https://120.76.203.222'
ICE_SERVER_URL_TEMPLATE = '%s/apprtc/iceconfig.php?key=%s'
#ICE_SERVER_URL_TEMPLATE = '%s/turn.php?username=%s&key=%s'
ICE_SERVER_API_KEY = os.environ.get('ICE_SERVER_API_KEY')

复制代码

turn的配置和ICE的配置关系是什么样子？是都配置呢？还是二选一的配置呢？

zangcf · 发表于 2016-8-9 19:46:36

下面启动服务器：
第一，nginx启动
按照我的判断nginx应该是自动启动的，可以查看80端口的占用情况可知。

root@iZ949sqo4m3Z:~/apprtc_root/src/app_engine# netstat -apn | grep 80
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 906/nginx
tcp 0 0 120.76.203.222:51209 140.205.140.205:80 ESTABLISHED 1039/AliYunDun
tcp6 0 0 :::80 :::* LISTEN 906/nginx
unix 2 [ ACC ] STREAM LISTENING 8680 1039/AliYunDun /tmp/Aegis-<Guid(5A2C30A2-A87D-490A-9281-6765EDAD7CBA)>
root@iZ949sqo4m3Z:~/apprtc_root/src/app_engine#

复制代码

确实如此

第二步，启动隧道服务器

service coturn start;

复制代码

第三步，启动信令服务器
因为上面修改过信令服务器，所以需要重新安装：

root@iZ949sqo4m3Z:~/apprtc_root/src/app_engine# go get collidermain
root@iZ949sqo4m3Z:~/apprtc_root/src/app_engine# go install collidermain

复制代码

然后再运行：

root@iZ949sqo4m3Z:~/apprtc_root/src/app_engine# $GOPATH/bin/collidermain -port=8089 -tls=true
2016/08/09 19:33:22 Starting collider: tls = true, port = 8089, room-server=https://120.76.203.222
2016/08/09 19:33:22 Run: http2: TLSConfig.CipherSuites index 4 contains an HTTP/2-approved cipher suite (0xc030), but it comes after unapproved cipher suites. With this configuration, clients that don't support previous, approved cipher suites may be given an unapproved one and reject the connection.

复制代码

第四步，运行房间服务器
这个配置还是有问题，看样子，我还得再次重来一遍

		自动登录	找回密码
密码			立即注册

严格按照戴维营的https方法，搭建一边apprtc服务器

环境准备和代码下载

安装NodeJS和grunt

3. 安装apprtc代码中的grunt依赖:

配置Nginx反向代理服务器

准备信令服务器

准备隧道服务器

对于turnserver，我决定还是按照戴维营的思路去搭建

RE: 严格按照戴维营的https方法，搭建一边apprtc服务器