Zen

Traduction

Anglais type: Plain text
It is possible to use certificates validated by a certification authority. However, this requires advanced system administration knowledge. Indeed, due to the multitude of possible use cases, it is impossible to document all situations here. This documentation will therefore only explain the goal to be reached, and give an example which will only be suitable for a "basic" situation (manual installation of Peertube, using letsencrypt). If you are in another situation (Docker installation, certificates signed by another authority, etc...), you will have to adapt this approach by yourself.
0/5970 · 597

Connectez-vous pour enregistrer vos traductions.

Anglais Persan Actions
record name: _xmpp-server._tcp.room.your_instance.tld. (replace «your_instance.tld» by your instance uri)
 
TTL: 3600
 
class: IN
 
SRV: 0
 
priority: 0
 
weight: 5
 
port: 5269 (adapt if your changed the default port)
 
target: your_instance.tld. (replace by your instance uri)
 
record name: _xmpp-server._tcp.external.your_instance.tld. (replace «your_instance.tld» by your instance uri)
 
Be careful to keep the dot after "your_instance.tld".
 
Using the `dig` command to check your records, you should get a result similar to this:
 
$ dig +short _xmpp-server._tcp.room.videos.john-livingston.fr. SRV
0 5 5269 videos.john-livingston.fr.

$ dig +short _xmpp-server._tcp.external.videos.john-livingston.fr. SRV
0 5 5269 videos.john-livingston.fr.
 
If you are **not using the standard `5269` port**, you must also add a SRV record for `_xmpp-server._tcp.your_instance.tld.` (same as above, just without the `room.` prefix). Of course, you can also add this record if you use the standard port. It will also work.
 
Using trusted certificates
 
The self-signed certificates that this plugin uses by default can be rejected by some XMPP servers, for security reasons.
 
It is possible to use certificates validated by a certification authority. However, this requires advanced system administration knowledge. Indeed, due to the multitude of possible use cases, it is impossible to document all situations here. This documentation will therefore only explain the goal to be reached, and give an example which will only be suitable for a "basic" situation (manual installation of Peertube, using letsencrypt). If you are in another situation (Docker installation, certificates signed by another authority, etc...), you will have to adapt this approach by yourself.
 
Basic principle
 
It is up to you to generate valid certificates for domains `your_instance.tld` and `room.your_instance.tld`. You can use any [method supported by Prosody](https://prosody.im/doc/certificates).
 
You must then place these certificates in a folder that will be accessible to the `peertube` user, and specify this folder in the plugin setting "Certificate folder".
 
If you want to use the ProsodyCtl utility to import certificates, this utility is available (once Peertube is started) using the following command (adapting the path to your Peertube data folder, and replacing "xxx" with the arguments you wish to pass to prosodyctl): `sudo -u peertube /var/www/peertube/storage/plugins/data/peertube-plugin-livechat/prosodyAppImage/squashfs-root/AppRun prosodyctl --config /var/www/peertube/storage/plugins/data/peertube-plugin-livechat/prosody/prosody.cfg.lua xxx`
 
The plugin will check once a day to see if any files have been modified in this folder, and reload Prosody if necessary.
 
Method for the simple case
 
We assume here that your Peertube installation is "classic" (no use of Docker), and that the certificates are generated by letsencrypt, using the certbot tool.
 
First of all, we'll have to create a certificate for the subdomain `room.your_instance.tld` : this is the uri of the MUC (XMPP chat rooms) component. Even if the connections are made on `your_instance.tld`, we will need a valid certificate for this subdomain.
 
So start by setting up a DNS entry for `room.your_instance.tld`, which points to your server. You can use a CNAME entry (or an A entry and a AAAA entry).
 
Next, we'll use nginx (already installed for your Peertube) to generate the certbot certificate. We will create a new site. In the file `/etc/nginx/site-available/room.peertube`, add:
 
server {
listen 80;
listen [::]:80;
server_name room.your_instance.tld;

location /.well-known/acme-challenge/ {
default_type "text/plain";
root /var/www/certbot;
}
location / { return 301 https://your_instance.tld; }
}
 
Then enable the site:
 
ln -s /etc/nginx/sites-available/room.peertube /etc/nginx/sites-enabled/
systemc reload nginx
 
Then we prepare the folder in which we will later import the certificates. We assume here that you already have the plugin active. We will create the following folder (if it doesn't already exist), with the user `peertube` to make sure there are no permissions issues:
 
sudo -u peertube mkdir /var/www/peertube/storage/plugins/data/peertube-plugin-livechat/prosody/certs
 

Chargement…

Avatar de l’utilisateur Aucun

Chaîne mise à jour dans le dépôt
It is possible to use certificates validated by a certification authority. However, this requires advanced system administration knowledge. Indeed, due to the multitude of possible use cases, it is impossible to document all situations here. This documentation will therefore only explain the goal to be reached, and give an example which will only be suitable for a "basic" situation (manual installation of Peertube, using letsencrypt). If you are in another situation (Docker installation, certificates signed by another authority, etc...), you will have to adapt this approach by yourself.
 
Il y a un an
Parcourir toutes les modifications de chaînes

Glossaire

Anglais Persan
Aucune chaîne correspondante n’a été trouvée dans le glossaire.

Informations sur la chaîne

Description de la chaîne source
type: Plain text
Emplacement de la chaîne source
support/documentation/content/en/documentation/admin/advanced/xmpp_clients.md
Âge de la chaîne
Il y a un an
Date de dernière mise à jour
Il y a un mois
Âge de la chaîne source
Il y a un an
Fichier de traduction
support/documentation/po/livechat.fa.po, chaîne 240