diff --git a/openvidu-deployment/pro/singlenode/aws/cf-openvidu-singlenode.yaml b/openvidu-deployment/pro/singlenode/aws/cf-openvidu-singlenode.yaml index af9b8133..aaec2827 100644 --- a/openvidu-deployment/pro/singlenode/aws/cf-openvidu-singlenode.yaml +++ b/openvidu-deployment/pro/singlenode/aws/cf-openvidu-singlenode.yaml @@ -5,17 +5,17 @@ Parameters: CertificateType: Description: | - [selfsigned] Not recommended for production use. If you don't have a FQDN, (DomainName parameter) you can use this option to generate a self-signed certificate. - [owncert] Valid for productions environments. If you have a FQDN, (DomainName parameter) + [selfsigned] Not recommended for production use. Just for testing purposes or development environments. + [owncert] Valid for productions environments. If you don't have a FQDN, sslip.io will be used. and an Elastic IP, you can use this option to use your own certificate. [letsencrypt] Valid for production environments. If you have a FQDN, (DomainName parameter) and an Elastic IP, you can use this option to generate a Let's Encrypt certificate. Type: String AllowedValues: - selfsigned - - owncert - letsencrypt - Default: selfsigned + - owncert + Default: letsencrypt PublicElasticIP: Type: String @@ -37,10 +37,6 @@ Parameters: Description: "If certificate type is 'owncert', this parameter will be used to specify the private certificate" Type: String - LetsEncryptEmail: - Description: "If certificate type is 'letsencrypt', this email will be used for Let's Encrypt notifications" - Type: String - AdditionalInstallFlags: Description: Additional optional flags to pass to the OpenVidu installer (comma-separated, e.g., "--flag1=value, --flag2"). Type: String @@ -223,6 +219,15 @@ Parameters: Metadata: 'AWS::CloudFormation::Interface': ParameterGroups: + - Label: + default: SSH Access configuration + Parameters: + - KeyName + - Label: + default: OpenVidu Single Node PRO configuration + Parameters: + - OpenViduLicense + - RTCEngine - Label: default: Domain and SSL certificate configuration Parameters: @@ -231,17 +236,10 @@ Metadata: - DomainName - OwnPublicCertificate - OwnPrivateCertificate - - LetsEncryptEmail - - Label: - default: OpenVidu Single Node PRO configuration - Parameters: - - OpenViduLicense - - RTCEngine - Label: default: EC2 Instance configuration Parameters: - InstanceType - - KeyName - AmiId - Label: default: S3 bucket for application data and recordings @@ -260,6 +258,7 @@ Metadata: Conditions: PublicElasticIPPresent: !Not [ !Equals [!Ref PublicElasticIP, ""] ] + PublicElasticIPAbsent: !Equals [!Ref PublicElasticIP, ""] CreateRecordingsBucket: !Equals [!Ref S3AppDataBucketName, ""] Resources: @@ -273,29 +272,30 @@ Resources: Description: Secret for OpenVidu to store deployment info and seed secrets SecretString: | { + "OPENVIDU_URL": "none", + "MEET_INITIAL_ADMIN_USER": "none", + "MEET_INITIAL_ADMIN_PASSWORD": "none", + "MEET_INITIAL_API_KEY": "none", + "LIVEKIT_URL": "none", + "LIVEKIT_API_KEY": "none", + "LIVEKIT_API_SECRET": "none", + "DASHBOARD_URL": "none", + "GRAFANA_URL": "none", + "MINIO_URL": "none", "DOMAIN_NAME": "none", "LIVEKIT_TURN_DOMAIN_NAME": "none", - "LETSENCRYPT_EMAIL": "none", "OPENVIDU_PRO_LICENSE": "none", "OPENVIDU_RTC_ENGINE": "none", "REDIS_PASSWORD": "none", "MONGO_ADMIN_USERNAME": "none", "MONGO_ADMIN_PASSWORD": "none", "MONGO_REPLICA_SET_KEY": "none", - "MINIO_URL": "none", "MINIO_ACCESS_KEY": "none", "MINIO_SECRET_KEY": "none", - "DASHBOARD_URL": "none", "DASHBOARD_ADMIN_USERNAME": "none", "DASHBOARD_ADMIN_PASSWORD": "none", - "GRAFANA_URL": "none", "GRAFANA_ADMIN_USERNAME": "none", "GRAFANA_ADMIN_PASSWORD": "none", - "LIVEKIT_API_KEY": "none", - "LIVEKIT_API_SECRET": "none", - "MEET_INITIAL_ADMIN_USER": "none", - "MEET_INITIAL_ADMIN_PASSWORD": "none", - "MEET_INITIAL_API_KEY": "none", "ENABLED_MODULES": "none" } @@ -397,11 +397,11 @@ Resources: unzip \ jq \ wget - wget https://github.com/mikefarah/yq/releases/download/${!YQ_VERSION}/yq_linux_amd64.tar.gz -O - |\ - tar xz && mv yq_linux_amd64 /usr/bin/yq + wget https://github.com/mikefarah/yq/releases/download/${!YQ_VERSION}/yq_linux_$(dpkg --print-architecture).tar.gz -O - |\ + tar xz && mv yq_linux_$(dpkg --print-architecture) /usr/bin/yq # Install aws-cli - curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" + curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" unzip -qq awscliv2.zip ./aws/install rm -rf awscliv2.zip aws @@ -413,7 +413,10 @@ Resources: if [[ "${DomainName}" == '' ]]; then [ ! -d "/usr/share/openvidu" ] && mkdir -p /usr/share/openvidu PublicHostname=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-hostname) - DOMAIN=$PublicHostname + RANDOM_DOMAIN_STRING=$(tr -dc 'a-z' < /dev/urandom | head -c 8) + DOMAIN=openvidu-$RANDOM_DOMAIN_STRING-$(echo "$PublicHostname" | cut -d'.' -f1 | sed 's/^ec2-//').sslip.io + TURN_DOMAIN_NAME_SSLIP_IO="turn-$RANDOM_DOMAIN_STRING-$(echo "$PublicHostname" | cut -d'.' -f1 | sed 's/^ec2-//').sslip.io" + echo $RANDOM_DOMAIN_STRING > /usr/share/openvidu/random-domain-string echo $PublicHostname > /usr/share/openvidu/old-host-name else DOMAIN=${DomainName} @@ -482,8 +485,12 @@ Resources: done fi - # Turn with TLS - if [[ "${TurnDomainName}" != '' ]]; then + if [[ "${!TURN_DOMAIN_NAME_SSLIP_IO}" != '' ]]; then + LIVEKIT_TURN_DOMAIN_NAME=$(/usr/local/bin/store_secret.sh save LIVEKIT_TURN_DOMAIN_NAME "${!TURN_DOMAIN_NAME_SSLIP_IO}") + COMMON_ARGS+=( + "--turn-domain-name=$LIVEKIT_TURN_DOMAIN_NAME" + ) + elif [[ "${TurnDomainName}" != '' ]]; then LIVEKIT_TURN_DOMAIN_NAME=$(/usr/local/bin/store_secret.sh save LIVEKIT_TURN_DOMAIN_NAME "${TurnDomainName}") COMMON_ARGS+=( "--turn-domain-name=$LIVEKIT_TURN_DOMAIN_NAME" @@ -496,10 +503,8 @@ Resources: "--certificate-type=selfsigned" ) elif [[ "${CertificateType}" == "letsencrypt" ]]; then - LETSENCRYPT_EMAIL=$(/usr/local/bin/store_secret.sh save LETSENCRYPT_EMAIL "${LetsEncryptEmail}") CERT_ARGS=( "--certificate-type=letsencrypt" - "--letsencrypt-email=$LETSENCRYPT_EMAIL" ) else # Download owncert files @@ -585,18 +590,23 @@ Resources: if [[ "${DomainName}" == '' ]]; then PublicHostname=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-hostname) - DOMAIN=$PublicHostname + RANDOM_DOMAIN_STRING=$(cat /usr/share/openvidu/random-domain-string) + DOMAIN=openvidu-$RANDOM_DOMAIN_STRING-$(echo "$PublicHostname" | cut -d'.' -f1 | sed 's/^ec2-//').sslip.io else DOMAIN=${DomainName} fi # Generate URLs + OPENVIDU_URL="https://${!DOMAIN}/" + LIVEKIT_URL="wss://${!DOMAIN}/" DASHBOARD_URL="https://${!DOMAIN}/dashboard/" GRAFANA_URL="https://${!DOMAIN}/grafana/" MINIO_URL="https://${!DOMAIN}/minio-console/" # Update shared secret SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DOMAIN_NAME": "'"$DOMAIN"'"}')" + SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"OPENVIDU_URL": "'"$OPENVIDU_URL"'" }')" + SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"LIVEKIT_URL": "'"$LIVEKIT_URL"'" }')" SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DASHBOARD_URL": "'"$DASHBOARD_URL"'" }')" SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"GRAFANA_URL": "'"$GRAFANA_URL"'" }')" SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MINIO_URL": "'"$MINIO_URL"'" }')" @@ -627,9 +637,10 @@ Resources: # Replace DOMAIN_NAME export DOMAIN=$(echo $SHARED_SECRET | jq -r .DOMAIN_NAME) - if [[ $DOMAIN == *"compute.amazonaws.com"* ]] || [[ -z $DOMAIN ]]; then + if [[ $DOMAIN == *"sslip.io"* ]] || [[ -z $DOMAIN ]]; then PublicHostname=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-hostname) - DOMAIN=$PublicHostname + RANDOM_DOMAIN_STRING=$(cat /usr/share/openvidu/random-domain-string) + DOMAIN=openvidu-$RANDOM_DOMAIN_STRING-$(echo "$PublicHostname" | cut -d'.' -f1 | sed 's/^ec2-//').sslip.io fi if [[ -n "$DOMAIN" ]]; then sed -i "s/DOMAIN_NAME=.*/DOMAIN_NAME=$DOMAIN/" "${!CONFIG_DIR}/openvidu.env" @@ -639,15 +650,15 @@ Resources: # Replace LIVEKIT_TURN_DOMAIN_NAME export LIVEKIT_TURN_DOMAIN_NAME=$(echo $SHARED_SECRET | jq -r .LIVEKIT_TURN_DOMAIN_NAME) + if [[ $LIVEKIT_TURN_DOMAIN_NAME == *"sslip.io"* ]] || [[ -z $LIVEKIT_TURN_DOMAIN_NAME ]]; then + PublicHostname=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-hostname) + RANDOM_DOMAIN_STRING=$(cat /usr/share/openvidu/random-domain-string) + LIVEKIT_TURN_DOMAIN_NAME="turn-$RANDOM_DOMAIN_STRING-$(echo "$PublicHostname" | cut -d'.' -f1 | sed 's/^ec2-//').sslip.io" + fi if [[ -n "$LIVEKIT_TURN_DOMAIN_NAME" ]]; then sed -i "s/LIVEKIT_TURN_DOMAIN_NAME=.*/LIVEKIT_TURN_DOMAIN_NAME=$LIVEKIT_TURN_DOMAIN_NAME/" "${!CONFIG_DIR}/openvidu.env" fi - if [[ ${CertificateType} == "letsencrypt" ]]; then - export LETSENCRYPT_EMAIL=$(echo $SHARED_SECRET | jq -r .LETSENCRYPT_EMAIL) - sed -i "s/LETSENCRYPT_EMAIL=.*/LETSENCRYPT_EMAIL=$LETSENCRYPT_EMAIL/" "${!CONFIG_DIR}/openvidu.env" - fi - # Replace rest of the values sed -i "s/REDIS_PASSWORD=.*/REDIS_PASSWORD=$(echo $SHARED_SECRET | jq -r .REDIS_PASSWORD)/" "${!CONFIG_DIR}/openvidu.env" sed -i "s/OPENVIDU_PRO_LICENSE=.*/OPENVIDU_PRO_LICENSE=$(echo $SHARED_SECRET | jq -r .OPENVIDU_PRO_LICENSE)/" "${!CONFIG_DIR}/openvidu.env" @@ -669,10 +680,13 @@ Resources: sed -i "s/ENABLED_MODULES=.*/ENABLED_MODULES=$(echo $SHARED_SECRET | jq -r .ENABLED_MODULES)/" "${!CONFIG_DIR}/openvidu.env" # Update URLs in secret + OPENVIDU_URL="https://${!DOMAIN}/" DASHBOARD_URL="https://${!DOMAIN}/dashboard/" GRAFANA_URL="https://${!DOMAIN}/grafana/" MINIO_URL="https://${!DOMAIN}/minio-console/" SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DOMAIN_NAME": "'"$DOMAIN"'" }')" + SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"OPENVIDU_URL": "'"$OPENVIDU_URL"'" }')" + SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"LIVEKIT_URL": "'"$LIVEKIT_URL"'" }')" SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"DASHBOARD_URL": "'"$DASHBOARD_URL"'" }')" SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"GRAFANA_URL": "'"$GRAFANA_URL"'" }')" SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"MINIO_URL": "'"$MINIO_URL"'" }')" @@ -697,10 +711,6 @@ Resources: INSTALL_DIR="/opt/openvidu" CONFIG_DIR="${!INSTALL_DIR}/config" - if [[ ${CertificateType} == "letsencrypt" ]]; then - SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"LETSENCRYPT_EMAIL": "'"$(/usr/local/bin/get_value_from_config.sh LETSENCRYPT_EMAIL "${!CONFIG_DIR}/openvidu.env")"'"}')" - fi - # Update shared secret SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"REDIS_PASSWORD": "'"$(/usr/local/bin/get_value_from_config.sh REDIS_PASSWORD "${!CONFIG_DIR}/openvidu.env")"'"}')" SHARED_SECRET="$(echo "$SHARED_SECRET" | jq '. + {"OPENVIDU_PRO_LICENSE": "'"$(/usr/local/bin/get_value_from_config.sh OPENVIDU_PRO_LICENSE "${!CONFIG_DIR}/openvidu.env")"'"}')" @@ -857,8 +867,11 @@ Resources: apt-get update && apt-get install -y \ python3-pip \ - ec2-instance-connect - pip3 install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz + ec2-instance-connect \ + pipx + + pipx install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz + export PATH=$PATH:/root/.local/bin cfn-init --region ${AWS::Region} --stack ${AWS::StackId} --resource OpenviduServer @@ -883,7 +896,7 @@ Resources: /usr/local/bin/check_app_ready.sh # sending the finish call - /usr/local/bin/cfn-signal -e $? --stack ${AWS::StackId} --resource WaitCondition --region ${AWS::Region} + cfn-signal -e $? --stack ${AWS::StackId} --resource WaitCondition --region ${AWS::Region} BlockDeviceMappings: - DeviceName: /dev/sda1 @@ -899,6 +912,12 @@ Resources: InstanceId: !Ref OpenviduServer EIP: !Ref PublicElasticIP + NewEIP: + Type: 'AWS::EC2::EIP' + Condition: PublicElasticIPAbsent + Properties: + InstanceId: !Ref OpenviduServer + IMDSv2LaunchTemplate: Type: AWS::EC2::LaunchTemplate Properties: