96 lines
2.9 KiB
Bash
Executable File
96 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
|
set -e
|
|
|
|
echo "🔒 CONFIGURACIÓN SSL PARA LIVEKIT CON DOMINIO"
|
|
echo "=============================================="
|
|
|
|
DOMAIN="nextream.sytes.net"
|
|
EMAIL="tu-email@dominio.com" # Cambia por tu email
|
|
|
|
echo "📋 Configuración:"
|
|
echo " • Dominio: $DOMAIN"
|
|
echo " • Email: $EMAIL"
|
|
echo " • Puerto HTTPS: 443"
|
|
echo " • Puerto LiveKit: 7880"
|
|
|
|
# Instalar certbot si no existe
|
|
if ! command -v certbot &> /dev/null; then
|
|
echo "📦 Instalando Certbot..."
|
|
sudo apt update
|
|
sudo apt install -y certbot python3-certbot-nginx
|
|
fi
|
|
|
|
# Generar certificado SSL
|
|
echo "🔐 Generando certificado SSL..."
|
|
sudo certbot certonly --standalone \
|
|
--email $EMAIL \
|
|
--agree-tos \
|
|
--no-eff-email \
|
|
-d $DOMAIN
|
|
|
|
# Crear configuración Nginx para LiveKit
|
|
echo "⚙️ Configurando Nginx para LiveKit..."
|
|
sudo tee /etc/nginx/sites-available/livekit-ssl > /dev/null <<EOF
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name $DOMAIN;
|
|
|
|
# Certificados SSL
|
|
ssl_certificate /etc/letsencrypt/live/$DOMAIN/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/$DOMAIN/privkey.pem;
|
|
|
|
# Configuración SSL moderna
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
|
|
ssl_prefer_server_ciphers off;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_timeout 1d;
|
|
|
|
# Headers de seguridad
|
|
add_header Strict-Transport-Security "max-age=63072000" always;
|
|
add_header X-Frame-Options DENY always;
|
|
add_header X-Content-Type-Options nosniff always;
|
|
|
|
# Proxy hacia LiveKit (HTTP a HTTPS)
|
|
location / {
|
|
proxy_pass http://127.0.0.1:7880;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host \$host;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
proxy_set_header X-Forwarded-Host \$host;
|
|
proxy_set_header X-Forwarded-Port \$server_port;
|
|
|
|
# Timeouts para WebSocket
|
|
proxy_connect_timeout 7d;
|
|
proxy_send_timeout 7d;
|
|
proxy_read_timeout 7d;
|
|
}
|
|
}
|
|
|
|
# Redireccionar HTTP a HTTPS
|
|
server {
|
|
listen 80;
|
|
server_name $DOMAIN;
|
|
return 301 https://\$server_name\$request_uri;
|
|
}
|
|
EOF
|
|
|
|
# Activar sitio
|
|
sudo ln -sf /etc/nginx/sites-available/livekit-ssl /etc/nginx/sites-enabled/
|
|
sudo nginx -t
|
|
sudo systemctl reload nginx
|
|
|
|
echo "✅ SSL configurado correctamente"
|
|
echo ""
|
|
echo "🌐 URLs actualizadas:"
|
|
echo " • HTTP: http://$DOMAIN → redirige a HTTPS"
|
|
echo " • HTTPS: https://$DOMAIN"
|
|
echo " • WSS: wss://$DOMAIN"
|
|
echo ""
|
|
echo "⚠️ IMPORTANTE: Actualiza la configuración de OpenVidu Meet:"
|
|
echo " LIVEKIT_URL=wss://$DOMAIN"
|
|
echo " LIVEKIT_URL_PRIVATE=wss://$DOMAIN" |