kitsune/restream-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: restream server setup script

Browse Source
This commit is contained in:
kitsune
2022-01-30 00:34:16 +08:00
parent 0cd9b65ad1
commit 00c542b552
3 changed files with 300 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/nginx/README.md
+44 -2
View File
@@ -20,10 +20,29 @@ Feel free to check out the `restream.conf` file and tune it to your liking.
The build script doesn't litter your system with random junk. When you're done
you can just wipe the `./nginx` folder.
## Merging with your existing nginx
## Reverse proxying from existing nginx
If you don't wanna bother merging the config, you can just use your existing
nginx to reverse-proxy to this one.
nginx to reverse-proxy to this one. It'd look something like this:
```
your server
----------------------------------
| |
viewer --|--> main nginx --> this nginx --|--> upstream
| w/ SSL |
----------------------------------
```
You can just do something like this:
```
location / {
proxy_pass http://127.0.0.1:8080/;
}
```
## Merging with your existing nginx
If you want to merge it with an existing nginx config, you can copy these
directives to the `http` block:
@@ -41,3 +60,26 @@ you do the reverse proxy, set `proxy_cache` back to `restream_cache`.
Feel free to tweak the parameters to fit your needs, but generally the values in
`restream.conf` should just work alright for caching live streams.
## Setting this up on a remote server
The convenience script `remote_setup.sh` can be used to ssh into a fresh remote
server, install nginx there, configure the upstream and set up SSL. This should
work on a fresh Ubuntu 20.04 server.
Run the script:
```
./remote_setup.sh \
--domain relay1.stream.example.org \
--upstream-server https://restream.dev:443 \
--acme-email your.email@example.org \
--target-server root@relay1.stream.example.org
```
**Important note**: you _must_ specify the protocol (`https://`) and the port
(`:443`) for the `--upstream-server` flag.
Once the script is done, your server should be accessible from
`https://relay1.stream.example.org` and proxying all requests to
`https://restream.dev`.
scripts/nginx/remote_setup.sh
Executable
+255
View File
@@ -0,0 +1,255 @@
#!/bin/bash
positional_args=()
while [[ $# -gt 0 ]]; do
case $1 in
--domain)
domain="$2"
shift # past argument
shift # past value
;;
--upstream-server)
upstream_server="$2"
shift # past argument
shift # past value
;;
--target-server)
target_server="$2"
shift # past argument
shift # past value
;;
--acme-email)
acme_email="$2"
shift # past argument
shift # past value
;;
--is-in-target)
is_in_target=1
shift # past argument
;;
-*|--*)
echo "Unknown option $1"
exit 1
;;
*)
positional_args+=("$1") # save positional arg
shift # past argument
;;
esac
done
set -- "${positional_args[@]}" # restore positional parameters
# check if self is in target server
if [ -z "$is_in_target" ]; then
# we're still in the user's pc
# make sure we have all the required arguments
if [ -z "$domain" ] \
|| [ -z "$upstream_server" ] \
|| [ -z "$acme_email" ] \
|| [ -z "$target_server" ]; then
echo "Usage: $0 --domain <domain> --upstream-server <https://domain:port> --acme-email <your.email@domain.co> --target-server <user@host>"
exit 1
fi
target_filename=$(mktemp -u)
echo "Copying self to target server..."
scp $0 $target_server:$target_filename
echo "Executing setup script on target server..."
ssh $target_server "$target_filename --domain $domain --upstream-server $upstream_server --upstream-proto $upstream_proto --acme-email $acme_email --is-in-target"
# exit
exit 0
fi
# we're now on the target server
# make sure we're root
if [ "$(id -u)" != "0" ]; then
echo "This script must be run as root"
exit 1
fi
echo "Installing dependencies..."
apt-get update && \
apt-get upgrade -y && \
apt-get install -y nginx socat
echo "Downloading acme.sh..."
wget -O - https://get.acme.sh | sh -s email=$acme_email
echo "Issuing certificate..."
~/.acme.sh/acme.sh --issue -d $domain -w /var/www/html
~/.acme.sh/acme.sh --install-cert -d $domain \
--cert-file /etc/nginx/ssl.crt \
--key-file /etc/nginx/ssl.key \
--fullchain-file /etc/nginx/ssl.pem \
--reloadcmd "systemctl reload nginx"
# create directories
mkdir -p /var/cache/nginx/proxy_cache
# create the nginx config file
echo "Setting up nginx"
cat <<EOF > /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 1048576;
multi_accept on;
use epoll;
}
http {
# Basic settings
sendfile on;
tcp_nopush on;
tcp_nodelay on;
server_tokens off;
keepalive_timeout 300s;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
# SSL settings
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
# Logging Settings
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
# DNS resolver
resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
resolver_timeout 10s;
# Proxy cache
proxy_cache_path
/var/cache/nginx/proxy_cache
levels=1:2
keys_zone=restream_cache:10m
inactive=10m
max_size=20g;
server {
listen 80;
listen [::]:80;
server_name $domain;
return 301 https://\$server_name\$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name $domain;
# SSL settings
ssl_certificate /etc/nginx/ssl.crt;
ssl_certificate_key /etc/nginx/ssl.key;
proxy_redirect off;
proxy_http_version 1.1;
proxy_read_timeout 10s;
proxy_send_timeout 10s;
proxy_connect_timeout 10s;
proxy_cache restream_cache;
proxy_cache_methods GET HEAD;
proxy_cache_key \$uri;
proxy_cache_valid 200 302 5m;
proxy_cache_valid 404 3s;
proxy_cache_lock on;
proxy_cache_lock_age 5s;
proxy_cache_lock_timeout 1h;
proxy_ignore_headers Cache-Control;
proxy_ignore_headers Set-Cookie;
add_header X-Edge-Cache-Status \$upstream_cache_status;
location ~ \.(m3u8|mpd)\$ {
proxy_cache_valid 200 302 1s;
proxy_ssl_server_name on;
proxy_pass $upstream_server;
}
location / {
proxy_ssl_server_name on;
proxy_pass $upstream_server;
}
}
}
EOF
nginx -t
systemctl reload nginx
# sysctl settings
echo "Configuring sysctl"
cat <<EOF > /etc/sysctl.d/999-perf.conf
fs.file-max=1048576
fs.inotify.max_user_instances=1048576
fs.inotify.max_user_watches=1048576
fs.nr_open=1048576
net.core.default_qdisc=fq
net.core.netdev_max_backlog=1048576
net.core.rmem_max=16777216
net.core.somaxconn=65535
net.core.wmem_max=16777216
net.ipv4.ip_local_port_range=1024 65535
net.ipv4.netfilter.ip_conntrack_max=1048576
net.ipv4.tcp_fin_timeout=5
net.ipv4.tcp_max_orphans=1048576
net.ipv4.tcp_max_syn_backlog=20480
net.ipv4.tcp_max_tw_buckets=400000
net.ipv4.tcp_no_metrics_save=1
net.ipv4.tcp_rmem=4096 87380 16777216
net.ipv4.tcp_slow_start_after_idle=0
net.ipv4.tcp_synack_retries=2
net.ipv4.tcp_syn_retries=2
net.ipv4.tcp_tw_reuse=1
net.ipv4.tcp_wmem=4096 65535 16777216
net.nf_conntrack_max=1048576
vm.max_map_count=1048576
vm.min_free_kbytes=65535
vm.overcommit_memory=1
vm.swappiness=0
vm.vfs_cache_pressure=50
EOF
sysctl --system
# limits.conf settings
cat <<EOF > /etc/security/limits.d/999-perf.conf
* soft nofile 1048576
* hard nofile 1048576
root soft nofile 1048576
root hard nofile 1048576
* soft nproc 1048576
* hard nproc 1048576
root soft nproc 1048576
root hard nproc 1048576
* soft memlock unlimited
* hard memlock unlimited
root soft memlock unlimited
root hard memlock unlimited
* soft core 0
* hard core 0
root soft core 0
root hard core 0
EOF
# systemd limits
cat <<EOF > /etc/systemd/system.conf
[Manager]
DefaultLimitNOFILE=1048576
DefaultLimitNPROC=1048576
DefaultLimitMEMLOCK=infinity
EOF
# Done!
reboot
scripts/nginx/restream.conf
+1 -1
View File
@@ -31,7 +31,7 @@ http {
# TODO: Update cache path to your cache directory
proxy_cache_path
# cache directory (e.g. /var/cache/nginx/proxy_cache)
./cache
cache
use_temp_path=off
# the name of the cache, if you change this
# you have to update the proxy_cache directive below