ebbba-org/ansible-role-bigbluebutton

Ansible role for a bigbluebutton installation (following the documentation on https://docs.bigbluebutton.org/administration/install and https://github.com/bigbluebutton/bigbluebutton)

BigBlueButton

Ansible role for a BigBlueButton installation

This role is following the documentation on https://docs.bigbluebutton.org/administration/install

Also check Before you install and Minimum server requirements from the official documentation as they also apply here.

---

• ℹ️ PR #275 removed the option of installing Greenlight. Please checkout another project for Greenlight support
• ℹ️ PR #276 removed the option of installing coturn. Please checkout another project for coturn support

---

Role Variables

⚠️ WATCH OUT FOR REQUIRED VARIABLES! ⚠️

⚠️ IF NOT SET THIS ROLE WILL FAIL! ⚠️

Required	Variable Name	Function	Default value	Comment
⚠️	bbb_hostname	Hostname for this BigBlueButton instance	{{ ansible_fqdn }}
	bbb_version	Install specified BigBlueButton version	focal-250	For installing specified BigBlueButton version e.g. bionic-230-2.3.15
	bbb_state	Install BigBlueButton to state	present	for updating BigBlueButton with this role use latest
	bbb_apt_mirror	apt repo server for BigBlueButton packages	https://ubuntu.bigbluebutton.org	other value would be e.g. https://packages-eu.bigbluebutton.org
	bbb_letsencrypt_enable	Enable letsencrypt/HTTPS	yes
⚠️ when using letsencrypt	bbb_letsencrypt_email	E-mail for use with letsencrypt
	bbb_letsencrypt_api	Set letsencrypt api	https://acme-v02.api.letsencrypt.org/directory	Use this variable to change letsencrypt API URL (example: staging API https://acme-staging-v02.api.letsencrypt.org/directory)
	bbb_letsencrypt_repo	The github repo to use for renewal handling - default acme.sh	https://github.com/acmesh-official/acme.sh.git
	bbb_letsencrypt_dir	The directory to store the acme.sh repo	/opt/acme
	bbb_letsencrypt_version	Which version to clone	master
	bbb_letsencrypt_keep_updated	Keep acme.sh updated	true
	bbb_letsencrypt_install_command	The command to install acme.sh	See defaults/main.yaml
	bbb_letsencrypt_create_command	The command to create certificate	See defaults/main.yaml
	bbb_own_cert	Custom ssl cert file to deploy (instead of letsencrypt)
	bbb_own_key	Custom ssl private key file to deploy
	bbb_nginx_privacy	only log errors not access	yes
	bbb_nginx_listen_https	nginx: use https	yes	This is useful for a reverse proxy configuration where the BBB server is behind a load balancing server like haproxy that does SSL termination
	bbb_nginx_root	Default nginx www path of BigBlueButton	/var/www/bigbluebutton-default	Set the default nginx www path of BigBlueButton
	bbb_ssl_cert	Define the ssl cert location/name	"/etc/letsencrypt/live/{{ bbb_hostname }}/fullchain.pem"
	bbb_ssl_key	Define the ssl key location/name	"/etc/letsencrypt/live/{{ bbb_hostname }}/privkey.pem"
	bbb_default_welcome_message	Welcome Message in the client	Welcome to %%CONFNAME%%! For help on using BigBlueButton see these (short) tutorial videos. To join the audio bridge click the phone button. Use a headset to avoid causing background noise for others.	Needs to be encoded with native2ascii -encoding UTF8!
	bbb_default_welcome_message_footer	Footer of the welcome message	This server is running BigBlueButton.	Encoded as the welcome message
	bbb_default_presentation	Location of default presentation	"${bigbluebutton.web.serverURL}/{{ bbb_custom_presentation_name | default('default.pdf') }}"
	bbb_custom_presentation	Overwrite the default.pdf	None	Location of a custom presentation will be renamed to default.pdf if bbb_custom_presentation_name is not defined - see Ansible search paths for where to place your custom pdf - Example playbooks/files/default.pdf
	bbb_custom_presentation_name	Set a custom presentation name	None	Instead of overwriting the default.pdf setting the name will add for example the customer.pdf
	bbb_use_default_logo	Determines if a default-logo should be used if api-parameter "logo" is not used	false	The (default) logo is displayed at the top left corner.
	bbb_default_logo_url	Set a URL for the default logo	${bigbluebutton.web.serverURL}/images/logo.png
	bbb_custom_logo	Overwrite default logo.png	None	Location of a custom presentation will be renamed to logo.png if bbb_custom_logo_name is not defined - see Ansible search paths for where to place your custom png - Example playbooks/files/logo.png
	bbb_custom_logo_name	Set a custom logo name	None	Instead of overwriting the logo.png setting the name will add for example the custom-logo.png
	bbb_web_logouturl	set logout URL	default	Instead of using bigbluebutton.web.serverURL as default logout page, set another URL or customize logout page e.g. ${bigbluebutton.web.serverURL}/logout.html. API create call with the logoutURL parameter overwrite this setting
	bbb_allow_request_without_session	Enable or disable allow request without session	false	Allow requests without JSESSIONID to be handled
	bbb_turn_enable	enable the use uf TURN in general	yes
	bbb_stun_servers	a list of STUN-Server to use	{{ bbb_hostname }}	an array with key server - take a look in defaults/main.yml
	bbb_ice_servers	a list of RemoteIceCandidate for STUN	[]	in array with key server
	bbb_ignore_running_meetings	install even if meetings are running	no	current meetings will be terminated
	bbb_turn_servers	a list of TURN-Server to use	{}	take a look in defaults/main.yml
	bbb_mongodb_version	version of mongodb to be installed	4.2
	bbb_mongodb_tmpfs_size	tmpfs size for the mongodb	512m
	bbb_disable_recordings	Disable options in gui to have recordings	no	Recordings are running constantly in background which is relevant as privacy relevant user data is stored
	bbb_api_demos_enable	enable installation of the api demos	no
	bbb_client_log_enable	enable installation of the nginx-full and config for client logging according to BBB Customization Docs. See "METEOR" Section below for needed bbb_meteor values.	false
	bbb_mute_on_start	start with muted mic on join	no
	bbb_app_log_level	set bigbluebutton log level	DEBUG
	bbb_freeswitch_log_level	set freeswitch log level	warning
	bbb_etherpad_log_level	set etherpad log level	INFO
	bbb_fsels_akka_log_level	set the loglevel between freeswitch and bbb-apps	ERROR
	bbb_apps_akka_log_level	set the loglevel for bbb-apps-akka	ERROR
	bbb_meteor	overwrite settings in meteor	{}
	bbb_kurento_interfaces	Specify the listening interfaces for kurento	{{ [ansible_default_ipv4.interface, 'lo'] }}
	bbb_nodejs_version	version of nodejs to be installed	18.x
	bbb_system_locale	the system locale to use	en_US.UTF-8
	bbb_secret	define the shared secret for bbb	none	Set this if you want to define the bbb-secret. Otherwise the secret is generated by bbb. Supported characters are [a-zA-Z0-9]
	bbb_freeswitch_ipv6	Enable IPv6 support in FreeSWITCH	true	Disable to fix FreeSWITCH IPv6 error
	bbb_freeswitch_ip_address	Set IP address for FreeSWITCH's wss-binding	{{ ansible_default_ipv4.address }}	Can be used when port 7443 is already in use on {{ ansible_default_ipv4.address }} or in IPv6-only setups.
	bbb_freeswitch_external_ip	Set stun server for sip and rtp on FreeSWITCH	stun:{{ (bbb_stun_servers | first).server }}	WARNING: the value of the default freeswitch installation is stun:stun.freeswitch.org
	bbb_recording_config	overwrite recording settings	{}	See Enable playback of recordings on iOS. It works like bbb_meteor by merging your custom config with the server config.
	bbb_dialplan_quality	Set quality of dailplan for FreeSWITCH	cdquality
	bbb_dialplan_energy_level	Set energy level of dailplan for FreeSWITCH	100	only for selected profile bbb_dialplan_quality
	bbb_dialplan_comfort_noise	Set comfort noise of dailplan for FreeSWITCH	1400	Allowed values: (0-10000
	bbb_webhooks_enable	install bbb-webhooks	no
	bbb_check_for_running_meetings	Check server and stop playbook in case of running meetings. Attention: Currently the check is done only after Docker and NodeJS Roles have already run.	true
	bbb_monitoring_all_in_one_enable	deploy all in one monitoring stack (docker)	no
	bbb_monitoring_all_in_one_version	Deprecated, use bbb_monitoring_exporter_version instead
	bbb_monitoring_all_in_one_directory	Directory for the docker compose files	/root/bbb-monitoring
	bbb_monitoring_all_in_one_port	Internal Port for the monitoring werbservice	3001
	bbb_monitoring_all_in_one_grafana	Enable(true)/Disable(false) the Grafana container	true
	bbb_monitoring_all_in_one_prometheus	Enable(true)/Disable(false) the prometheus container	true
	bbb_monitoring_all_in_one_external	Deprecated, use bbb_monitoring_external instead		Can be reached under /mon/bbb and /mon/node - requires htpasswd and htpasswd_user
	bbb_monitoring_all_in_one_htpasswd_user	Deprecated, use bbb_monitoring_htpasswd_user instead
	bbb_monitoring_all_in_one_htpasswd	Deprecated, use bbb_monitoring_htpasswd instead
	bbb_monitoring_recordings_from_disk	Collect recordings metrics by querying the disk instead of the API. See this for details.	true
	bbb_monitoring_external	Enable exposure to nginx	false	Can be reached under /mon/bbb and /mon/node - requires htpasswd and htpasswd_user. If bbb_monitoring_systemd_enable is enabled, no Node Exporter installation process is included
⚠️ when using external monitoring	bbb_monitoring_htpasswd_user	The user for the htpasswd	Undefined
⚠️ when using external monitoring	bbb_monitoring_htpasswd	The password for the htpasswd	Undefined
	bbb_monitoring_exporter_version	Version of the BigBlueButton Exporter for docker and systemd	latest if docker image is enabled or HEAD if systemd is enabled	If bbb_monitoring_all_in_one_enable is enabled, the Docker images tags can be used. If bbb_monitoring_systemd_enable is enabled, the Git release tags can be used.
	bbb_monitoring_systemd_enable	Deploy monitoring as systemd service (not recommended)	false	Works only when bbb_monitoring_all_in_one_enable is false
	bbb_monitoring_systemd_directory	Installation directory for git repository	"/opt/bigbluebutton-exporter"
	bbb_monitoring_systemd_port	Port of bbb-exporter	9688	default port 9866 is defined by the exporter itself
	bbb_monitoring_systemd_bind_ip	Port of bbb-exporter	0.0.0.0	default bind IP 0.0.0.0 is defined by the exporter itself
	bbb_dialin_enabled	enable phone dial-in, will also remove any previous dial-in configuration if set to false	false
	bbb_dialin_provider_proxy	IP or Domain of your SIP provider, also known as registrar	sip.example.net
	bbb_dialin_provider_username	Username for authentication on the SIP-server	provider-account
	bbb_dialin_provider_password	Password for authentication on the SIP-server	provider-password
	bbb_dialin_provider_extension	Extension of your SIP account	6135551234
	bbb_dialin_default_number	Number to present to users for dial-in. Enable bbb_dialin_overwrite_footer or use %%DIALNUM%% and %%CONFNUM%% in you footer (see bbb_default_welcome_message_footer)	6135551234
	bbb_dialin_mask_caller	Mask caller-number in the BBB web-interface for privacy reasons (01711233121 → xxx-xxx-3121)
	bbb_dialin_default_play_and_get_digits	Phone dialin-pin entry voice dialog	5 7 3 10000 # conference/conf-pin.wav ivr/ivr-that_was_an_invalid_entry.wav pin \\d+ 5000	Usage <min> <max> <tries> <timeout> <terminators> See this for more details
	bbb_dialin_overwrite_footer	Set the default dial-in footer instead of bbb_default_welcome_message_footer	false
	bbb_dialin_footer	The default dial-in notice, if you want to customize it, it is recommended to change bbb_default_welcome_message_footer instead	<br><br>To join this meeting by phone, dial:<br> %%DIALNUM%%<br>Then enter %%CONFNUM%% as the conference PIN number.
	bbb_guestpolicy	How guest can access	ALWAYS_ACCEPT	acceptable options: ALWAYS_ACCEPT, ALWAYS_DENY, ASK_MODERATOR
	bbb_ntp_cron	Disable automatic time synchronisation and instead configure a cronjob	false
	bbb_ntp_cron_day	Day of the month the time-sync job should run	*
	bbb_ntp_cron_hour	Hour when the time-sync job should run	5
	bbb_ntp_cron_minute	Minute when the time-sync job should run	0
	bbb_cron_history	Retention period for presentations, kurento, and freeswitch caches	5
	bbb_cron_unrecorded_days	Retention period of recordings for meetings with no recording markers	14
	bbb_cron_published_days	Retention period of recordings’ raw data	14
	bbb_cron_log_history	Set the retention period of old log files	28
	bbb_html5_node_options	Allow to set extra options for node for the html5-webclient	unset	Could be used for example with bigbluebutton/bigbluebutton#11183 ; --max-old-space-size=4096 --max_semi_space_size=128
⚠️	bbb_freeswitch_socket_password	set password for freeswitch		Can be generated with pwgen -s 16 1
⚠️	bbb_freeswitch_default_password	set the default password for freeswitch		Can be generated with pwgen -s 16 1
	bbb_html5_backend_processes	amount of html5 backend processes	1	min = 1; max = 4
	bbb_html5_frontend_processes	amount of html5 frontend processes	1	min = 1; max = 4; or 0 to let the same process do front- and backend (2.2 behavior)
	bbb_html5_frontend_max_old_space_size	max-old-space-size in frontends	2048
	bbb_container_compat	Compatibility with unprivileged containers	false	Enabling this option allows to deploy BBB into a unprivileged container
	bbb_firewall_ufw	A dict of rules for the ufw	see defaults/main.yml	can also be used to allow/deny more/less
	bbb_ufw_allow_networks_custom	List of additional networks to be allowed by UFW	Not defined
	bbb_ufw_reject_networks_custom	List of additional networks to be rejected by UFW	Not defined
	bbb_ssh_port	Allow and limit the port used for SSH access	22
	bbb_max_file_size_upload	Maximum file size for an uploaded presentation (default 30MB - number must be in byte)	30000000
	bbb_http_session_timeout	Timeout (seconds) to invalidate inactive HTTP sessions.	14400	4 Hours
	bbb_default_max_users	Default maximum number of users a meeting can have	0	Meeting doesn't have a user limit
	bbb_default_meeting_duration	Default duration of the meeting in minutes	0	Meeting doesn't end
	bbb_max_num_pages	Maximum number of pages allowed for an uploaded presentation	200
	bbb_max_conversion_time	Number of minutes the conversion should take	5	If it takes more than this time, cancel the conversion process
	bbb_num_conversion_threads	Number of threads in the pool to do the presentation conversion	5
	bbb_num_file_processor_threads	Number of threads to process file uploads	2
	bbb_office_to_pdf_conversion_timeout	Timeout(secs) to wait for conversion script execution	60
	bbb_office_to_pdf_max_concurrent_conversions	Max concurrent of conversion script execution	4
	bbb_freeswitch_muted_sound	Enable muted sound (you are now muted)	true
	bbb_freeswitch_unmuted_sound	Enable unmuted sound (you are now unmuted)	true
Deprecated	bbb_breakout_rooms_enabled	Enable or disable breakout rooms	true	use bbb_disabled_features instead
	bbb_breakout_rooms_record	Enable or disable recording in breakout rooms	false
	bbb_breakout_rooms_privatechat_enabled	Enable or disable private chat in breakout rooms	true
	bbb_docker_compose_version	Set docker-compose python package version	see defaults/main.yml	Sets the version of the docker-compose python package
	bbb_docker_passwd	Password to Docker Hub login	Not defined (default: disabled)	Set a Docker Hub password. When defined is used to avoid rate limits
	bbb_docker_user	Username to Docker Hub login	Not defined (default: disabled)	Set a Docker Hub user. When defined is used to avoid rate limits
	bbb_etherpad_disable_cursortrace_plugin	Disable or enable cursortrace plugin for etherpad	false	Set to true if you want to avoid displaying names at cursor position in shared notes
	bbb_user_inactivity_inspect_timer	User inactivity audit timer interval in minutes	0	If 0 inactivity inspection is deactivated
	bbb_user_inactivity_threshold	Number of minutes to consider a user inactive	30	A warning message is send to client to check if really inactive
	bbb_webcams_only_for_moderator	Allow webcams streaming reception only to and from moderators	false
	bbb_allow_mods_to_eject_cameras	Allow moderators to eject webcams	false
	bbb_user_activity_sign_response_delay	Number of minutes for user to respond to inactivity warning before being logged out	5
	bbb_meeting_camera_cap	Per meeting camera share limit, if 0, there's no limit	0
	bbb_user_camera_cap	Per user camera share limit, if 0, there's no limit	3
	bbb_pinned_cameras	Maximum number of cameras pinned simultaneously	3
	bbb_end_when_no_moderator		false
	bbb_end_when_delay_in_minutes		1
	bbb_notify_recording_is_on		false
	bbb_allow_reveal_of_bbb_version		false
Deprecated	bbb_learning_dashboard_enabled	Enable true / Disable false the Learning Dashboard	true	use bbb_disabled_features instead
bbb_default_meeting_layout	Default Meeting Layout. Default Meeting Layout. Valid values are CUSTOM_LAYOUT, SMART_LAYOUT, PRESENTATION_FOCUS, VIDEO_FOCUS	SMART_LAYOUT
	bbb_disabled_features	List of features to disable	[]	See https://docs.bigbluebutton.org/development/api#create for options

METEOR

With settings bbb_meteor it is possible to overwrite / change settings of meteor.

The following example is from infra.run

bbb_meteor:
  public:
    note:
      url: "https://{{ inventory_hostname }}/pad"
    app:
      skipCheck: false
      mirrorOwnWebcam: true
      enableMultipleCameras: true
      enableNetworkInformation: true
      breakoutRoomLimit: 16
    chat:
      typingIndicator:
        enabled: false
    media:
      sipjsHackViaWs: true
    kurento:
      wsUrl: "wss://{{ inventory_hostname }}/bbb-webrtc-sfu"
      cameraProfiles:
      - id: low-u30
        name: low-u30
        bitrate: 30
        hidden: true
        constraints:
          frameRate: 3
      - id: low-u25
        name: low-u25
        bitrate: 40
        hidden: true
        constraints:
          frameRate: 3
      - id: low-u20
        name: low-u20
        bitrate: 50
        hidden: true
        constraints:
          frameRate: 5
      - id: low-u15
        name: low-u15
        bitrate: 70
        hidden: true
        constraints:
          frameRate: 8
      - id: low-u12
        name: low-u12
        bitrate: 90
        hidden: true
        constraints:
          frameRate: 10
      - id: low-u8
        name: low-u8
        bitrate: 100
        hidden: true
        constraints:
          frameRate: 10
      - id: low
        name: Low quality
        default: false
        bitrate: 50
      - id: medium
        name: Medium quality
        default: true
        bitrate: 200
      - id: high
        name: High quality
        default: false
        bitrate: 500
      - id: hd
        name: High definition
        default: false
        bitrate: 1200
      cameraQualityThresholds:
        enabled: true
        thresholds:
          - threshold: 8
            profile: low-u8
          - threshold: 12
            profile: low-u12
          - threshold: 15
            profile: low-u15
          - threshold: 20
            profile: low-u20
          - threshold: 25
            profile: low-u25
          - threshold: 30
            profile: low-u30
      cameraTimeouts:
        baseTimeout: 30000
      pagination:
        enabled: true
        pageChangeDebounceTime: 2500
        desktopPageSizes:
          moderator: 16
          viewer: 16
        mobilePageSizes:
          moderator: 8
          viewer: 8

Cluster proxy

This role is capable of configuring BigBlueButton for the (cluster proxy setup)[https://docs.bigbluebutton.org/administration/cluster-proxy/]. To use this feature you need to define both bbb_proxy_host to the url of your cluster proxy and bbb_proxy_name to the name your BBB host should have in the proxy (you can set this e.g. to the subdomain of your BigBlueButton host, as shown in the defaults). This role should then take care of configuring your BigBlueButton host correctly. However, you still need to set up the cluster proxy itself, which this role will not do for you. If you set up a nginx proxy as described in the official docs, you can specify the locations using the variables used in this role in a jinja template like this:

{% for host in groups['bigbluebutton'] %}
{% if hostvars[host].get('bbb_proxy_host') %}
location /{{ hostvars[host].bbb_proxy_name }}/html5client/ {
    proxy_pass https://{{ host }};
}
{% endif %}
{% endfor %}

User Feedback logging

To enable client logging and/or userfeedback, you need to set bbb_client_log_enable to true add the following keys here:

bbb_meteor:
  public:
    app:
      askForFeedbackOnLogout: true
    clientLog:
      external:
        enabled: true
        url: "https://{{ bbb_hostname }}/html5log"

Modification of bbb_webrtc_sfu_multikurento

To add new keys to bbb_webrtc_sfu_multikurento, the defaults are actually stored in bbb_webrtc_sfu_multikurento_default and then assigned to bbb_webrtc_sfu_multikurento.

That way you can add new keys like something like this:

tempvar:
  conference-media-specs:
    OPUS:
      maxaveragebitrate: "64000"


bbb_webrtc_sfu_multikurento: "{{ bbb_webrtc_sfu_multikurento_default | combine(tempvar)  }}"

LXD/LXC compatibility

To run BigBlueButton in unprivileged LXD/LXC containers, you have to set bbb_container_compat to true.

Phone dial-in

Example configuration using sipgate for dial-in. Be sure to check with your provider if this usage is permitted.

bbb_dialin_enabled: true
bbb_dialin_provider_proxy: 'sipgate.de'
bbb_dialin_provider_username: '158d43584d'
bbb_dialin_provider_password: 'xxxx-secret-xxxx'
bbb_dialin_provider_extension: '133713374223'
bbb_dialin_default_number: '0133 713-337-4223'
bbb_dialin_mask_caller: true
bbb_dialin_overwrite_footer: true

Dependencies

• geerlingguy.nodejs
• geerlingguy.docker

Example Playbook

This is an example of how to use this role. Warning: the values of the variables should be changed!

Assuming the following directory structure:

├── ansible
    ├── roles
    │   └── ebbba.bigbluebutton
    ├── playbooks
    │   └── bigbluebutton.yml
    └── inventory
        ├── hosts
        ├── group_vars
        │   └── bigbluebutton
        │       └── bbb.yml
        └── host_vars
            └── your-domain.example.com
                └── vars.yml

You can follow these steps inside your ansible directory to clone the repository and use the example playbook and variable configuration files:

1. Clone the repository in your roles directory. (git clone https://github.com/ebbba-org/ansible-role-bigbluebutton.git roles/ebbba.bigbluebutton)

2. Copy the sample inventory hosts file or append its containt to your already existing hosts file(cp roles/ebbba.bigbluebutton/examples/hosts inventory/hosts).

3. Edit the inventory hosts file (inventory/hosts) to include all the hosts you want in the bigbluebutton group.

4. Create a directory with the name of the group inside group_vars (mkdir inventory/group_vars/bigbluebutton).

5. Copy the group_vars sample configuration file to the directory you created (cp roles/ebbba.bigbluebutton/examples/bbb.yml inventory/group_vars/bigbluebutton/bbb.yml).

6. Edit the group configuration file (inventory/group_vars/bigbluebutton/bbb.yml) to your liking. You should put here all the options that are common among all your bbb servers.

7. Create a directory for each of your servers to hold its configuration (mkdir inventory/host_vars/<your-domain>).

8. Copy the sample configuration file to each of the servers configuration directory (cp roles/ebbba.bigbluebutton/examples/vars.yml inventory/host_vars/<your-domain>/vars.yml).

9. Edit the host configuration file (inventory/host_vars/<your-domain>/vars.yml) to your liking. You should put here all the host specific options. Setting a variable here will override its value set in inventory/group_vars/bigbluebutton/bbb.yml.

10. Copy the sample playbook (cp roles/ebbba.bigbluebutton/examples/playbook/bigbluebutton.yml playbooks).

11. Run the playbook using ansible-playbook -i inventory/hosts playbooks/bigbluebutton.yml.

Event though all the variables are explained above, you may also take a look at roles/ebbba.bigbluebutton/defaults/main.yml and see if there's something you'd like to copy over and override in your vars.yml and bbb.yml configuration files.

License

MIT

ansible-role-bigbluebutton's Issues

turn/stun configuration

Setup a new server with this role, and most things look good, but iOS clients can share videos and get erro 1020.

Apparently that is some issue with the TURN/coturn (bigbluebutton/bigbluebutton#6797)?

Anybody else had this issue too?

feat: variable to use parallel kurento servers

According the bbb documentation it's recommend to use multiple kurento media servers.

It would be nice to have a task which automatically use enableMultipleKurentos set by the var bbb_enableMultipleKurentos.

A simple and working task could be to use apply-config.sh:

- name: Configure three kurento instances
  copy:
    dest: "/etc/bigbluebutton/bbb-conf/apply-config.sh"
    mode: 0777
    content: |
      #!/bin/bash
      source /etc/bigbluebutton/bbb-conf/apply-lib.sh
      enableMultipleKurentos
  notify:
    - restart bigbluebutton
  when: bbb_enableMultipleKurentos

I will implement this if you let me know what do you think about and what the best place would be.

Implement NodeJS conf optimization by basisbit

see bigbluebutton/bigbluebutton#11183

Increase nginx server_names_hash_bucket_size

Hello,

great playbook, worked quite well.
I can maybe contribute a little enhancement.

The default nginx server_names_hash_bucket_size is 32.
This caused the last few jobs of the setup to fail in my usecase.

Do you think it would enhance the playbook to echo "server_names_hash_bucket_size 64;" into /etc/nginx/nginx.conf after installing nginx and before starting and enabling it?

Kind regards,
Ori

[2.3] 404 after installation - LXC Setup

While deploying this role (commit 7900bc1) on a test server I see that BBB is not successfully installed.

This is how I deploy this role:
https://github.com/PrivacyLx/devops/tree/bbb/v2.3/ansible/roles/bigbluebutton

# bbb-conf --check

BigBlueButton Server 2.3.1 (2216)
                    Kernel version: 5.4.22
                      Distribution: Ubuntu 18.04.5 LTS (64-bit)
                            Memory: 8161 MB
                         CPU cores: 4

/etc/bigbluebutton/bbb-web.properties (override for bbb-web)
/usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties (bbb-web)
       bigbluebutton.web.serverURL: https://testing.bbb.privacylx.org
                defaultGuestPolicy: ALWAYS_ACCEPT
                 svgImagesRequired: true

/etc/nginx/sites-available/bigbluebutton (nginx)
                       server_name: testing.bbb.privacylx.org
                              port: 80, [::]:80
                              port: 443 ssl

/opt/freeswitch/etc/freeswitch/vars.xml (FreeSWITCH)
                       local_ip_v4: 37.218.243.62
                   external_rtp_ip: stun:testing.bbb.privacylx.org
                   external_sip_ip: stun:testing.bbb.privacylx.org

/opt/freeswitch/etc/freeswitch/sip_profiles/external.xml (FreeSWITCH)
                        ext-rtp-ip: $${local_ip_v4}
                        ext-sip-ip: $${local_ip_v4}
                        ws-binding: :5066
                       wss-binding: 37.218.243.62:7443

/usr/local/bigbluebutton/core/scripts/bigbluebutton.yml (record and playback)
                     playback_host: testing.bbb.privacylx.org
                 playback_protocol: https
                            ffmpeg: 4.2.4-1ubuntu0.1bbb2~18.04

/etc/bigbluebutton/nginx/sip.nginx (sip.nginx)
                        proxy_pass: 37.218.243.62
                          protocol: https

/usr/local/bigbluebutton/bbb-webrtc-sfu/config/default.yml (Kurento SFU)
                        kurento.ip: 37.218.243.62
                       kurento.url: ws://127.0.0.1:8888/kurento
                    kurento.sip_ip: 37.218.243.62
                    localIpAddress: 37.218.243.62
               recordScreenSharing: true
                     recordWebcams: true
                  codec_video_main: VP8
               codec_video_content: VP8

/usr/share/meteor/bundle/programs/server/assets/app/config/settings.yml (HTML5 client)
                             build: 1720
                        kurentoUrl: wss://testing.bbb.privacylx.org/bbb-webrtc-sfu
                  enableListenOnly: true
                    sipjsHackViaWs: false

/etc/bigbluebutton/turn-stun-servers.xml (STUN Server)
                              stun: testing.bbb.privacylx.org


# Potential problems described below
grep: /opt/freeswitch/var/log/freeswitch/freeswitch.log: No such file or directory


#
# Warning: Failed to verify STUN server at testing.bbb.privacylx.org 3478 with command
#
#    stunclient --mode full --localport 30000 testing.bbb.privacylx.org 3478

# stunclient --mode full --localport 30000 testing.bbb.privacylx.org 3478

Binding test: fail
Behavior test: fail
Filtering test: fail

Default bbb_mongodb_version: 3.4 does not exists for ubuntu bionic

The default value vor bbb_mongodb_version: 3.4 does not exist for ubuntu bionic http://repo.mongodb.org/apt/ubuntu/dists/bionic/mongodb-org/

https://github.com/n0emis/ansible-role-bigbluebutton/blob/514517fb01e9c889973cdf62a192671e9fd62e0f/defaults/main.yml#L40

Resulting in apt cache update failed

The full traceback is:                                                                                                                                                                                                                                        
  File "/tmp/ansible_apt_repository_payload_hv4b1vr_/ansible_apt_repository_payload.zip/ansible/modules/packaging/os/apt_repository.py", line 548, in main                                                                                                    
  File "/usr/lib/python3/dist-packages/apt/cache.py", line 586, in update                                                                                                                                                                                     
    raise FetchFailedException(e)                                                                                                                                                                                                                             
failed: [dev.local] (item=deb [ arch=amd64,arm64 ] http://repo.mongodb.org/apt/ubuntu/ bionic/mongodb-org/3.4 multiverse) => {                                                                                                                                
    "ansible_loop_var": "item",                                                                                                                                                                                                                               
    "changed": false,                                                                                                                                                                                                                                         
    "invocation": {                                                                                                                                                                                                                                           
        "module_args": {                                                                                                                                                                                                                                      
            "codename": null,                                                                                                                                                                                                                                 
            "filename": null,                                                                                                  
            "install_python_apt": true,                                                                                        
            "mode": null,                                                                                                      
            "repo": "deb [ arch=amd64,arm64 ] http://repo.mongodb.org/apt/ubuntu/ bionic/mongodb-org/3.4 multiverse",                                                                                                                                         
            "state": "present",                                                                                                                                                                                                                               
            "update_cache": true,                                                                                              
            "validate_certs": true                        
        }                                                                                                                      
    },                                                                                                                                                                                                                                                        
    "item": "deb [ arch=amd64,arm64 ] http://repo.mongodb.org/apt/ubuntu/ bionic/mongodb-org/3.4 multiverse",
    "msg": "apt cache update failed"
}

https://github.com/n0emis/ansible-role-bigbluebutton/blob/514517fb01e9c889973cdf62a192671e9fd62e0f/tasks/repositories.yml#L32-L38

Also setting the version to 4.2 resulting in the same error.

Or am I completely wrong?

Error while starting greenlight : Unable to load docker-compose

Context :

• Fresh installation of an ubuntu 16.04
• Applied the role with bbb_greenlight_enable: yes

Error

The playbook fail while running the start greenlight task with the following error :

TASK [n0emis.bigbluebutton : start greenlight] *****************************************************************************************************************************************************************************************************************
fatal: [my-server]: FAILED! => {"changed": false, "msg": "Unable to load docker-compose. Try `pip install docker-compose`. Error: Traceback (most recent call last):
  File \"/tmp/ansible_docker_compose_payload_j3I2c2/__main__.py\", line 466, in <module>
    from compose.cli.command import project_from_options
  File \"/usr/local/lib/python2.7/dist-packages/compose/cli/command.py\", line 11, in <module>
    from .. import config
  File \"/usr/local/lib/python2.7/dist-packages/compose/config/__init__.py\", line 6, in <module>
    from .config import ConfigurationError
  File \"/usr/local/lib/python2.7/dist-packages/compose/config/config.py\", line 51, in <module>
    from .validation import match_named_volumes
  File \"/usr/local/lib/python2.7/dist-packages/compose/config/validation.py\", line 12, in <module>
    from jsonschema import Draft4Validator
  File \"/usr/local/lib/python2.7/dist-packages/jsonschema/__init__.py\", line 33, in <module>
    import importlib_metadata as metadata
  File \"/usr/local/lib/python2.7/dist-packages/importlib_metadata/__init__.py\", line 9, in <module>
    import zipp
ImportError: No module named zipp
"}

Fix

I managed to fix this by installing docker-compose version 1.24.0, as done in the official BBB install script.

1. I added the ansible variable docker_compose_version: "1.24.0" to ensure that geerlingguy.docker install the desired version.

2. I patched greenlight.yml to pin the version to use :

- name: install python docker packages
  pip:
    name:
      - docker
      - docker-compose==1.24.0
    state: "{{ bbb_state }}"

AnsibleUndefinedVariable in turn-stun-servers.xml.j2

When I run the Playbook using Ansible 2.9.6 I run into the following error:

TASK [bbb-install : Update /etc/bigbluebutton/turn-stun-servers.xml] **********************************************************************************************************************************************************************************************************
fatal: [xxx.xxx.xxx.xxx]: FAILED! => {"changed": false, "msg": "AnsibleUndefinedVariable: the inline if-expression on line 46 evaluated to false and no else section was defined."}

That would be this line:

        <constructor-arg index="1" value="turn{{ 's' if item.tls | bool }}:{{item.server}}:{{ item.port }}?transport=tcp"/>

Apparently the ternary operator expects an "else" part, otherwise this "undefined" part is not compatible with StrictUndefined.

Nginx refuses connection over 443 after setup

Right after the setup my server refused connections over 443 and I had to restart nginx with sudo systemctl restart nginx. Maybe there's an nginx restart at the end of the ansible script missing?

sendmail not working in greenlight docker?

It looks like the sendmail in the greenlight docker container is not working properly. At least it is not able to send confirmation mails. And a tcpdump on the big blue button server shows no smtp traffic.

I tested it with the site.yml playbook and the configuration from this git repository.

In the docker container, when I run sendmail, I received the following message:

bash-4.4# echo "Subject: sendmail test" | sendmail -v [email protected]
sendmail: can't connect to remote host (127.0.0.1): Connection refused

are there sendmail experts who can help here?

bbb_mute_on_start is negated

https://github.com/n0emis/ansible-role-bigbluebutton/blob/5f1e22498921e10f2c18bfb4a311aede18a2b62f/tasks/config.yml#L59

bbb_mute_on_start: true → not muted
bbb_mute_on_start: false → muted

(may submit a PR later :) )

Introduce releases

Please consider adding tags and create version releases of this role.

use |bool for binary values in this role

warning appears if we use values like ǹo ...
https://docs.ansible.com/ansible/latest/user_guide/playbooks_conditionals.html#the-when-statement

Disabling coturn installation doesn't disable/uninstall coturn

Could be improved I guess.

Add a `check_vars.yml` task

Idea:
Add a check_vars.yml which is run before anything else is done to check all default variables to check if required vars are set to prevent user error of unset required vars which will end the deployment in later steps.

Also checking vars for correct types would be good if lists/dicts are expected etc.

write back new meteor config fails: value must be a string

I have set up a playbook as below, but it fails with the following message:

TASK [n0emis.bigbluebutton : write back new meteor config] *********************
fatal: [<hostname>]: FAILED! => {"msg": "Unexpected templating type error occurred on ({{ meteor  | to_nice_yaml }}): value must be a string"}

my playbook.yml:

- hosts: webservers
  remote_user: <username>
  become: yes
  roles:
     - role: n0emis.bigbluebutton
       bbb_hostname: <hostname>
       bbb_letsencrypt_email: <email>
       bbb_coturn_secret: <coturn secret>
       bbb_greenlight_secret: <greenlight secret>
       bbb_greenlight_db_password: <greenlight db password>
       bbb_greenlight_default_registration: open
       bbb_disable_recordings: yes
       bbb_meteor:
         public:
           app:
             autoJoin: true
             skipCheck: true
       bbb_mute_on_start: yes
       bbb_freeswitch_ipv6: false
       bbb_greenlight_smtp:
         server: <smtp server>
         port: <smtp port>
         domain: <smtp domain>
         username: <smtp username>
         password: <smtp password>
         auth: plain
         starttls_auto: true
         sender: <smtp sender>

Is there something wrong with the playbook? Or is it there an issue with the role? Removing the bbb_meteor part completely still leads to that error...

docker (and nodejs) not needed for installation without greenlight

Expand "create Greenlight users" to allow setting the provider

Hi,

ansible-role-bigbluebutton/tasks/greenlight.yml

Line 50 in a17a013

command: "docker exec greenlight-v2 bundle exec rake user:create[\"{{ item.name }}\",\"{{ item.email }}\",\"{{ item.password }}\",\"{{ item.type }}\"]"

doesn't allow setting the provider field listed in rake --tasks-output:

rake user:create[name,email,password,role,provider]  # Creates a user account

I'd like to create an LDAP user account with "admin" role so I don't need to UPDATE something in Postgres after the role is done...

Cron to auto renew letsencrypt

Like https://github.com/geerlingguy/ansible-role-certbot does

BUG: failed to set locale

TASK [bigbluebutton : Install required packages] **************************************************************************************************************
ok: [bbbtest1]

TASK [bigbluebutton : set version of java to use] *************************************************************************************************************
ok: [bbbtest1]

TASK [bigbluebutton : Ensure localisation files for 'en_US.UTF-8' are available] ******************************************************************************
ok: [bbbtest1]

TASK [bigbluebutton : Get current locale and language configuration] ******************************************************************************************
ok: [bbbtest1]

TASK [bigbluebutton : Parse 'LANG' from current locale and language configuration] ****************************************************************************
fatal: [bbbtest1]: FAILED! => {"msg": "Unexpected templating type error occurred on ({{ locale_status.stdout | regex_search('LANG=([0-9A-Za-z_.-]+)', '\\\\1') | first }}): 'NoneType' object is not iterable"}

reject outbound traffic to private IP address ranges

BigBlueButton by default sends data packages to all the IP addresses which the clients send to the server as local IP addresses list so the server can try to send data to there.
Hetzner seems to be annoyed by unroutable traffic. Thus, we should add a reject rule for outbound data to the following address ranges (source is the turn server default config):

• 0.0.0.0-0.255.255.255
• 10.0.0.0-10.255.255.255
• 100.64.0.0-100.127.255.255
• 127.0.0.0-127.255.255.255
• 169.254.0.0-169.254.255.255
• 127.0.0.0-127.255.255.255
• 172.16.0.0-172.31.255.255
• 192.0.0.0-192.0.0.255
• 192.0.2.0-192.0.2.255
• 192.88.99.0-192.88.99.255
• 192.168.0.0-192.168.255.255
• 198.18.0.0-198.19.255.255
• 198.51.100.0-198.51.100.255
• 203.0.113.0-203.0.113.255
• 240.0.0.0-255.255.255.255

Action reject, so that the service doesn't "wait" for a response.

IPv6 | NGINX: sipjsHackViaWs

ansible-role-bigbluebutton/tasks/bbb-html5.yml

Lines 12 to 18 in 83471e8

	- name: Enable sipjsHackViaWs
	replace:
	path: /etc/bigbluebutton/nginx/sip.nginx
	regexp: 'proxy_pass .*'
	replace: 'proxy_pass http://{{ bbb_freeswitch_ip_address }}:5066;'
	when: ((((bbb_meteor | default({})).public | default({})).media | default({})).sipjsHackViaWs | default({})) | bool
	notify: reload nginx

@danimo thanks

Das müsste man für dual stack auch noch so anpassen, dass nginx proxy_pass auf v6 macht, wenn v6 angefragt wird

firewall ufw (and firewalld)

It would be nice to open firewall rules automatically (the known ports are at this rule).

Here are the ansible-modules:

• ufw
• firewalld

Maybe we should detect, which firewall is running on the server, to use the correct ansible-module.

Greenlight user creation fails on first run of playbook due to DB docker container not ready

I can not reproduce this on every machine, but i am running the role in a playbook for one VM, where the creation of initial greenlight users fails, because the postgreSQL docker container takes to much time to get going.
The role however runs smoothly, since the return message is not checked for a missing database. If you run the playbook a second time, the users are created just fine.

update debian packages?

Hi,
do we like to update the system with the role?
Or just install BigBlueButton.

So we need to change from present to latest in several places like:

https://github.com/n0emis/ansible-role-bigbluebutton/blob/ae0e9b651c19a54fe477f22676282f39921999c5/tasks/main.yml#L19

https://github.com/n0emis/ansible-role-bigbluebutton/blob/ae0e9b651c19a54fe477f22676282f39921999c5/tasks/main.yml#L69

WebRTC seems to advertise internal docker IP addresses

Checking about:webrtc on Firefox shows me internal docker IPs like 172.18.0.1. This is a problem when combined with a turn server that rejects those IPs. It also makes the echo test take longer.

bbb_secret feature breaks breakout feature

Using bbb_secret to set the secret to a given value only set the secret in /usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties.

As https://github.com/bigbluebutton/bigbluebutton/blob/65d7e6c9545120b43de4468dedc9a96316211166/bigbluebutton-config/bin/bbb-conf#L634 shows, there are more places to be patched in order to set the secret.

Otherwise BBB features like breakout rooms stop working.

maxInactivityTimeoutMinutes does not exists

The var maxInactivityTimeoutMinutes does not exists in 2.3

CPUSchedulingPolicy is set in two tasks changing each other

When running two times in a row this should not change something (should be deterministic as much as possible)

Currently CPUSchedulingPolicy is set in two places and changing each other every time so there are changes.

https://github.com/n0emis/ansible-role-bigbluebutton/blob/54f7aa92e1c9a653d69e9e347a55760c3c65a3e9/tasks/main.yml#L33-L44

https://github.com/n0emis/ansible-role-bigbluebutton/blob/54f7aa92e1c9a653d69e9e347a55760c3c65a3e9/tasks/config.yml#L170-L188

As the second one is configurable I would think about removing the first one.
Also interesting to me, without having more knowledge into freeswitch currently: the first one does not notify freeswitch to restart as the second does so one of them is probably wrong.

self sign certificate generation requires package python-openssl

Please add the package python-openssl to the required package list for self signed certificates.

This is needed to prevent the following failure:

TASK [n0emis.bigbluebutton : Generate an OpenSSL Certificate Signing Request] ***************************************************************************************************** fatal: [192.168.122.31]: FAILED! => {"changed": false, "msg": "Can't detect any of the required Python libraries cryptography (>= 1.3) or PyOpenSSL (>= 0.15)"}

Invalid configuration in event_socket.conf.xml

When applying this role multiple time, the file /opt/freeswitch/etc/freeswitch/autoload_configs/event_socket.conf.xml is invalid and contains multiple entries for <param name="listen-ip" ... />

For example :

<configuration name="event_socket.conf" description="Socket Client">
  <settings>
    <param name="nat-map" value="false"/>
<param name="listen-ip" value="::"/>
    <param name="listen-port" value="8021"/>
    <param name="password" value="ClueCon"/>
    <!--<param name="apply-inbound-acl" value="loopback.auto"/>-->
    <!--<param name="stop-on-bind-error" value="true"/>-->
  </settings>
</configuration>
<param name="listen-ip" value="::"/>
<param name="listen-ip" value="::"/>

Error: 'bbb_docker_user' is undefined

Hi, I'm using Ansible 2.10.2 on Ubuntu20 LTS and run into the following error:

TASK [bbb23-node : Log into DockerHub (avoid rate limits)] *************************************************************
fatal: [bbb-23n1.rz.tu-clausthal.de]: FAILED! => {}

MSG:

The conditional check 'bbb_docker_user and bbb_docker_passwd' failed. The error was: error while evaluating conditional (bbb_docker_user and bbb_docker_passwd): 'bbb_docker_user' is undefined

The error appears to be in 'ansible-role-bigbluebutton/tasks/docker.yml': line 17, column 3, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:
- name: Log into DockerHub (avoid rate limits)
  ^ here

It seems the line should be bbb_docker_user is defined and bbb_docker_password is defined...

greenlight .env: SMTP_SENDER gets faulty default value

https://github.com/n0emis/ansible-role-bigbluebutton/blob/master/templates/greenlight/env.j2#L139
might end in: SMTP_SENDER=bbb@{{ bbb_hostname }} leaving jinja code in .env file.

LetsEncrypt Staging Server

Would it be possible to have an option to switch to the LE staging server? This would aid in avoiding the rate limits while testing deployment.

SMTP settings are required to send mail

"Defaults to sendmail" is not really true, since there is no sendmail inside the docker container for it to use. So without SMTP settings it just doesn't work. README should be updated for this.

I also suggest that allow_mail_notifications default to false unless SMTP is set up.

Error starting greenlight

I have an exception running the playbook at the "start greenlight" task, with the following stacktrace.

Running it on Ubuntu 16.04.7 LTS.

TASK [n0emis.bigbluebutton : start greenlight] **************************************************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: SyntaxError: invalid syntax
fatal: [meet.simplicite.io]: FAILED! => {"changed": false, "module_stderr": "Shared connection to meet.simplicite.io closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n  File \"/usr/local/lib/python3.5/dist-packages/jsonschema/__init__.py\", line 31, in <module>\r\n    from importlib import metadata\r\nImportError: cannot import name 'metadata'\r\n\r\nDuring handling of the above exception, another exception occurred:\r\n\r\nTraceback (most recent call last):\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1615199672.382217-12724-29246943133695/AnsiballZ_docker_compose.py\", line 102, in <module>\r\n    _ansiballz_main()\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1615199672.382217-12724-29246943133695/AnsiballZ_docker_compose.py\", line 94, in _ansiballz_main\r\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\r\n  File \"/home/ubuntu/.ansible/tmp/ansible-tmp-1615199672.382217-12724-29246943133695/AnsiballZ_docker_compose.py\", line 40, in invoke_module\r\n    runpy.run_module(mod_name='ansible_collections.community.general.plugins.modules.docker_compose', init_globals=None, run_name='__main__', alter_sys=True)\r\n  File \"/usr/lib/python3.5/runpy.py\", line 196, in run_module\r\n    return _run_module_code(code, init_globals, run_name, mod_spec)\r\n  File \"/usr/lib/python3.5/runpy.py\", line 96, in _run_module_code\r\n    mod_name, mod_spec, pkg_name, script_name)\r\n  File \"/usr/lib/python3.5/runpy.py\", line 85, in _run_code\r\n    exec(code, run_globals)\r\n  File \"/tmp/ansible_docker_compose_payload_b8ccr05t/ansible_docker_compose_payload.zip/ansible_collections/community/general/plugins/modules/docker_compose.py\", line 476, in <module>\r\n  File \"/usr/local/lib/python3.5/dist-packages/compose/cli/command.py\", line 6, in <module>\r\n    from .. import config\r\n  File \"/usr/local/lib/python3.5/dist-packages/compose/config/__init__.py\", line 3, in <module>\r\n    from .config import ConfigurationError\r\n  File \"/usr/local/lib/python3.5/dist-packages/compose/config/config.py\", line 44, in <module>\r\n    from .validation import match_named_volumes\r\n  File \"/usr/local/lib/python3.5/dist-packages/compose/config/validation.py\", line 8, in <module>\r\n    from jsonschema import Draft4Validator\r\n  File \"/usr/local/lib/python3.5/dist-packages/jsonschema/__init__.py\", line 33, in <module>\r\n    import importlib_metadata as metadata\r\n  File \"/usr/local/lib/python3.5/dist-packages/importlib_metadata/__init__.py\", line 92\r\n    dist: Optional['Distribution'] = None\r\n        ^\r\nSyntaxError: invalid syntax\r\n", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

Add LimitNOFILE increase to Role (Libreoffice not running Error)

Ive based my ansible role on this ansible role.

Yesterday i realized that my role just wouldn't work properly with my bigger servers (32 cores / 64 Threads).
I was always getting the Libreoffice not running Error or Tomcat 7 + Libreoffice not running.

After some further investigation and comparison with my other big servers.

I found the Problem.

As a default bbb-web.service runs with a LimitNOFILE of 1024, that's not enough for a server with that many cpu cores.
To circumvent this problem bbb-install.sh creates an override.conf for the service with a LimitNOFILE of 8192 , conditioned on the server having more than 8 CPUS.

Section of bbb-install.sh that does the above:

check_LimitNOFILE() {
  CPU=$(nproc --all)

  if [ "$CPU" -ge 8 ]; then
    if [ -f /lib/systemd/system/bbb-web.service ]; then
      # Let's create an override file to increase the number of LimitNOFILE 
      mkdir -p /etc/systemd/system/bbb-web.service.d/
      cat > /etc/systemd/system/bbb-web.service.d/override.conf << HERE
[Service]
LimitNOFILE=8192
HERE
      systemctl daemon-reload
    fi
  fi
}

Would be awesome if you could add this to the role, so the next guy with a bigger server, wont run into this issue.

Does we need the debug messages?

If we run it on multiple server, it is annouing to see such a big messages

      Monday 11 May 2020  20:49:35 +0000 (0:00:00.352)       0:01:54.455 ************ 
       ok: [localhost] => {
           "locale_status": {
               "changed": false, 
               "cmd": [
                   "localectl", 
                   "status"
               ], 
               "delta": "0:00:00.146804", 
               "end": "2020-05-11 20:49:35.208983", 
               "failed": false, 
               "rc": 0, 
               "start": "2020-05-11 20:49:35.062179", 
               "stderr": "", 
               "stderr_lines": [], 
               "stdout": "   System Locale: LANG=en_US.UTF-8\n       VC Keymap: n/a\n      X11 Layout: us\n       X11 Model: pc105", 
               "stdout_lines": [
                   "   System Locale: LANG=en_US.UTF-8", 
                   "       VC Keymap: n/a", 
                   "      X11 Layout: us", 
                   "       X11 Model: pc105"
               ]
           }
       }

404 from greenlight after running this role

Everything seems to have worked, but going to FQDN/b gives me a 404...

Monitoring installation fails with invalid docker-compose error

Installing from 3955856 with bbb monitoring enabled on a fresh ubuntu 18.04 gives the following error.

TASK [bigbluebutton : start monitoring] *******************************************************************************************************************************************************************************************
fatal: [[email protected]]: FAILED! => {"changed": false, "msg": "Configuration error - The Compose file '/root/bbb-monitoring/docker-compose.yaml' is invalid because:\nvolumes.prometheus_data value Additional properties are not allowed ('grafana_data' was unexpected)"}

This is how the volume section of the generated docker-compose file looks like

volumes:
    prometheus_data:
      grafana_data:

You can see that grafana_data is intended more than it should be. Since I'm very new to Ansible, I couldn't make out the cause for this, but I thought it would be worth reporting anyways.

Thanks for the great role!

bbb_turn_servers doesn't work for me.

I'm a little confused. In the example, it says bbb_turn_secret, but it doesn't exist. In default / main, a list with two items (with and without tls).

I tried everything: with with_items, same as the default / main, passing the parameters through bbb_coturn_ *, but without success.

How do I add my variables to bbb_turn_servers in the role (playbook)? Does anyone have any examples?

Sorry if it is something simple and that I am not seeing.

Allow for customized version of Greenlight?

We're running a customized version of Greenlight - some UI changes, specific localization changes etc.

Do you think this playbook should allow for a custom image via config? If so, do we need to have that image in the public registry or can we have a private one? Also: Should we allow for docker load/save-style?

If you don't think this is used often, I'd need to keep track of a local patch. Doable but not great...

Upgrade of BBB does not work

Setting the {{bbb_state}} to "latest" doesn't do anything.

BBB 2.3: Listen only mode (kurento) not working, ICE 1004

I've set up a fresh BBB 2.3 installation on Ubuntu 18.04 with bbb_freeswitch_ipv6: false and bbb_container_compat: true based on 3955856

I could connect with microphone successfully and talk with other users. But connecting as "listen only" gave a ICE 1004 error.

Running bbb-conf --check on that server gave the following output (I replaced the last two ip address octets with XXX and censored the domain name):

# sudo bbb-conf --check
default

BigBlueButton Server 2.3.0 (2148)
                    Kernel version: 4.15.0
                      Distribution: Ubuntu 18.04.5 LTS (64-bit)
                            Memory: 25165 MB
                         CPU cores: 8

/etc/bigbluebutton/bbb-web.properties (override for bbb-web)
/usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties (bbb-web)
       bigbluebutton.web.serverURL: https://my-domain-bbb3.de
                defaultGuestPolicy: ALWAYS_ACCEPT
                 svgImagesRequired: true

/etc/nginx/sites-available/bigbluebutton (nginx)
                       server_name: my-domain-bbb3.de
                              port: 80, [::]:8080
                              port: 443 ssl

/opt/freeswitch/etc/freeswitch/vars.xml (FreeSWITCH)
                       local_ip_v4: 178.254.XXX.XXX
                   external_rtp_ip: stun:my-domain-bbb3.de
                   external_sip_ip: stun:my-domain-bbb3.de

/opt/freeswitch/etc/freeswitch/sip_profiles/external.xml (FreeSWITCH)
                        ext-rtp-ip: $${local_ip_v4}
                        ext-sip-ip: $${local_ip_v4}
                        ws-binding: :5066
                       wss-binding: 178.254.XXX.XXX:7443

/usr/local/bigbluebutton/core/scripts/bigbluebutton.yml (record and playback)
                     playback_host: my-domain-bbb3.de
                 playback_protocol: https
                            ffmpeg: 4.2.4-1ubuntu0.1bbb2~18.04

/etc/bigbluebutton/nginx/sip.nginx (sip.nginx)
                        proxy_pass: 178.254.XXX.XXX
                          protocol: https

/usr/local/bigbluebutton/bbb-webrtc-sfu/config/default.yml (Kurento SFU)
                        kurento.ip: inet
                       kurento.url: ws://127.0.0.1:8888/kurento
                    kurento.sip_ip: inet
                    localIpAddress: inet
               recordScreenSharing: true
                     recordWebcams: true
                  codec_video_main: VP8
               codec_video_content: VP8

/usr/share/meteor/bundle/programs/server/assets/app/config/settings.yml (HTML5 client)
                             build: 1669
                        kurentoUrl: wss://my-domain-bbb3.de/bbb-webrtc-sfu
                  enableListenOnly: true
                    sipjsHackViaWs: false

/etc/bigbluebutton/turn-stun-servers.xml (STUN Server)
                              stun: my-domain-bbb3.de


# Potential problems described below

# Warning: No firewall detected.  Recommend using setting up a firewall for your server
#
#     https://docs.bigbluebutton.org/2.2/customize.html#setup-a-firewall
#

grep: /opt/freeswitch/var/log/freeswitch/freeswitch.log: No such file or directory

# Warning: The setting of 178.254.XXX.XXX for proxy_pass in
#
#    /etc/bigbluebutton/nginx/sip.nginx
#
# does not match the local IP address (inet).
# (This is OK if you've manually changed the values)

# Warning: The setting of 178.254.XXX.XXX for local_ip_v4 in
#
#    /opt/freeswitch/etc/freeswitch/vars.xml
#
# does not match the local IP address (inet).
# (This is OK if you've manually changed the values)


#
# Kurento will try to connect to inet but FreeSWITCH is listening on 178.254.XXX.XXX for port 5066
#
# To fix, run the commands
#
# sudo yq w -i /usr/local/bigbluebutton/bbb-webrtc-sfu/config/default.yml freeswitch.sip_ip 178.254.XXX.XXX
# sudo chown bigbluebutton:bigbluebutton /usr/local/bigbluebutton/bbb-webrtc-sfu/config/default.yml
#

#
# Warning: Failed to verify STUN server at my-domain-bbb3.de 3478 with command
#
#    stunclient --mode full --localport 30000 my-domain-bbb3.de 3478
#

So, as suggested in that output I ran the following commands:

sudo yq w -i /usr/local/bigbluebutton/bbb-webrtc-sfu/config/default.yml freeswitch.sip_ip 178.254.XXX.XXX
sudo chown bigbluebutton:bigbluebutton /usr/local/bigbluebutton/bbb-webrtc-sfu/config/default.yml

And restarted with bbb-conf --restart. Now the "listen only" mode works again as expected.

Since I'm too unexperienced with Ansible and especially the whole WebRTC business, I'm not sure whether this is an issue with this ansible role. But if it is, it might be a good idea to include this in the role?

set bbb secret manuelle

Add a scheduled backup task

This issue is about adding support for scheduled BBB backups.

The following parts should be included in the backup (I hope I'm not missing anything):

• Greenlight
• PostgreSQL DB
• Recordings (optional)

systemd timer for video cache?

Maybe it will be nice to have a systemd.timer (legacy cronjob) to clean the cache automatically.
https://docs.bigbluebutton.org/2.2/customize.html#delete-recordings-older-than-n-days

Does not deploy turn-stun-servers.xml when external stun/turn is set and bbb_turn_enable is false

When using an external Stun/Turn Server and not install coturn via bbb_turn_enable: false the turn-stun-servers.xml will not be deployed.
This will result in error 1007 in certain networks which need a turn.

My personal hotfix was to simply remove all check in the jinja template for bbb_turn_enable, but this is a bad hotfix imo.

If there is no local coturn and no external stun/turn is defined that don't deploy.

Maybe another extra var like bbb_external_coturn: false as default which then is checked in the jinja template?

Resulting into something like:

 {% if bbb_turn_enable or bbb_external_coturn %} 

Looking forward for your opinion.

https://github.com/n0emis/ansible-role-bigbluebutton/blob/b8cdb5578de4e0c64956033a7b31b1d0b3ca5ebd/templates/bbb/turn-stun-servers.xml.j2#L26

Document the Installation Target(s) in README.md

It would be great if the working installation targets of this Ansible role could be documented in the README.md.

I tried to install it with Ubuntu 20.04 and it failed, I also tried it with Debian 10 which failed as well. It only worked for me w/ Ubuntu 16.04. So I think it could be helpful for others to know on which Linux Distros and Versions this Ansible role is working beforehand.

Unable to activate greenlight email notifications

I did a fresh greenlight installation today and email notifications are not working anymore, even if I set bbb_allow_mail_notifications: true.

The .env file generated by ansible contains :

[...]
ALLOW_MAIL_NOTIFICATIONS=True
[...]

And it is ignored by greenlight that expects a lowercase true value (see here and here).