postfix http://tech.oeru.org/ en Installing BigBlueButton on an OERu Docker Server http://tech.oeru.org/installing-bigbluebutton-oeru-docker-server <span class="field field--name-title field--type-string field--label-hidden">Installing BigBlueButton on an OERu Docker Server</span> <div class="field field-node--field-blog-tags field-name-field-blog-tags field-type-entity-reference field-label-above"> <h3 class="field__label">Blog tags</h3> <div class="field__items"> <div class="field__item field__item--bigbluebutton"> <span class="field__item-wrapper"><a href="/taxonomy/term/84" hreflang="en">BigBlueButton</a></span> </div> <div class="field__item field__item--ubuntu-linux"> <span class="field__item-wrapper"><a href="/taxonomy/term/12" hreflang="en">ubuntu linux</a></span> </div> <div class="field__item field__item--_004"> <span class="field__item-wrapper"><a href="/taxonomy/term/75" hreflang="en">20.04</a></span> </div> <div class="field__item field__item--docker"> <span class="field__item-wrapper"><a href="/taxonomy/term/16" hreflang="en">docker</a></span> </div> <div class="field__item field__item--docker-compose"> <span class="field__item-wrapper"><a href="/taxonomy/term/49" hreflang="en">docker-compose</a></span> </div> <div class="field__item field__item--postgresql"> <span class="field__item-wrapper"><a href="/taxonomy/term/20" hreflang="en">postgresql</a></span> </div> <div class="field__item field__item--postfix"> <span class="field__item-wrapper"><a href="/taxonomy/term/66" hreflang="en">postfix</a></span> </div> <div class="field__item field__item--nginx"> <span class="field__item-wrapper"><a href="/taxonomy/term/30" hreflang="en">nginx</a></span> </div> <div class="field__item field__item--lets-encrypt"> <span class="field__item-wrapper"><a href="/taxonomy/term/17" hreflang="en">let&#039;s encrypt</a></span> </div> </div> </div> <span class="field field--name-uid field--type-entity-reference field--label-hidden"><a title="View user profile." href="/user/1" lang="" about="/user/1" typeof="schema:Person" property="schema:name" datatype="" class="username">dave</a></span> <span class="field field--name-created field--type-created field--label-hidden">Wed 10/11/2021 - 15:42</span> <div class="field field-node--field-image field-name-field-image field-type-image field-label-hidden has-multiple"> <figure class="field-type-image__figure image-count-1"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-26%20at%2012-02-53%20Create%20Droplets%20-%20DigitalOcean.png?itok=RFCxKkbH" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;Digital Ocean &#039;Droplet&#039; creation screen showing options selected for a BBB server&quot;}" role="button" title="Digital Ocean &#039;Droplet&#039; creation screen showing options selected for a BBB server" data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;Digital Ocean &#039;Droplet&#039; creation screen showing options selected for a BBB server&quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-26%20at%2012-02-53%20Create%20Droplets%20-%20DigitalOcean.png?itok=qpszFHwz" width="106" height="220" alt="Digital Ocean &#039;Droplet&#039; creation screen showing options selected for a BBB server" loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> <figure class="field-type-image__figure image-count-2"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-22%20at%2012-42-19%20bbbtest%20milll%20ws%20-%20DigitalOcean.png?itok=9s5Cj-8F" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;Performance graphs for a Digital Ocean &#039;Droplet&#039; configured to run BBB.&quot;}" role="button" title="Performance graphs for a Digital Ocean &#039;Droplet&#039; configured to run BBB." data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;Performance graphs for a Digital Ocean &#039;Droplet&#039; configured to run BBB.&quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-22%20at%2012-42-19%20bbbtest%20milll%20ws%20-%20DigitalOcean.png?itok=Sy3JvvuB" width="220" height="166" alt="Performance graphs for a Digital Ocean &#039;Droplet&#039; configured to run BBB." loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> <figure class="field-type-image__figure image-count-3"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-22%20at%2012-42-52%20milll%20ws%20-%20Metaname.png?itok=eILrt0_H" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;The Metaname DNS configuration for the milll.ws domain.&quot;}" role="button" title="The Metaname DNS configuration for the milll.ws domain." data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;The Metaname DNS configuration for the milll.ws domain.&quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-22%20at%2012-42-52%20milll%20ws%20-%20Metaname.png?itok=8iNSxMhC" width="220" height="166" alt="The Metaname DNS configuration for the milll.ws domain." loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> <figure class="field-type-image__figure image-count-4"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-23%20at%2014-20-22%20BigBlueButton.png?itok=vRbjT27h" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;The Greenlight front-end (providing user management and &#039;room&#039; configuration) for BigBlueButton.&quot;}" role="button" title="The Greenlight front-end (providing user management and &#039;room&#039; configuration) for BigBlueButton." data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;The Greenlight front-end (providing user management and &#039;room&#039; configuration) for BigBlueButton.&quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-23%20at%2014-20-22%20BigBlueButton.png?itok=4W4E__KP" width="220" height="144" alt="The Greenlight front-end (providing user management and &#039;room&#039; configuration) for BigBlueButton." loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> <figure class="field-type-image__figure image-count-5"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-30%20at%2023-04-07%20The%20OERu%20BigBlueButton%20-%20Home%20Room.png?itok=ofBw87DD" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;Joining a BBB session, you get the option of using a microphone to participate or being a &#039;listen-only&#039; participant.&quot;}" role="button" title="Joining a BBB session, you get the option of using a microphone to participate or being a &#039;listen-only&#039; participant." data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;Joining a BBB session, you get the option of using a microphone to participate or being a &#039;listen-only&#039; participant.&quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-30%20at%2023-04-07%20The%20OERu%20BigBlueButton%20-%20Home%20Room.png?itok=RsOTQSIE" width="220" height="133" alt="Joining a BBB session, you get the option of using a microphone to participate or being a &#039;listen-only&#039; participant." loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> <figure class="field-type-image__figure image-count-6"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-30%20at%2023-04-22%20The%20OERu%20BigBlueButton%20-%20Home%20Room%20-%20echo%20test.png?itok=H8WlXV4f" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;If you select &quot;microphone&quot;, you will next be asked to speak into it and do an &#039;echo test&#039; to calibrate BBB&#039;s echo cancellation algorithms.&quot;}" role="button" title="If you select &quot;microphone&quot;, you will next be asked to speak into it and do an &#039;echo test&#039; to calibrate BBB&#039;s echo cancellation algorithms." data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;If you select &quot;microphone&quot;, you will next be asked to speak into it and do an &#039;echo test&#039; to calibrate BBB&#039;s echo cancellation algorithms.&quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-30%20at%2023-04-22%20The%20OERu%20BigBlueButton%20-%20Home%20Room%20-%20echo%20test.png?itok=KvueJqpL" width="220" height="133" alt="If you select &quot;microphone&quot;, you will next be asked to speak into it and do an &#039;echo test&#039; to calibrate BBB&#039;s echo cancellation algorithms." loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> <figure class="field-type-image__figure image-count-7"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-30%20at%2023-04-49%20The%20OERu%20BigBlueButton%20-%20Home%20Room-webcam.png?itok=pEnZWxzO" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;And you can share your webcam feed, too. &quot;}" role="button" title="And you can share your webcam feed, too. " data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;And you can share your webcam feed, too. &quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-30%20at%2023-04-49%20The%20OERu%20BigBlueButton%20-%20Home%20Room-webcam.png?itok=tXwJ7Cpf" width="220" height="133" alt="And you can share your webcam feed, too. " loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> <figure class="field-type-image__figure image-count-8"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-26%20at%2015-03-34%20The%20OERu%20BigBlueButton%20-%20Home%20Room-withModeratorMenu.png?itok=wkyM4MSu" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;BigBlueButton conversation window in a browser, with the moderator tools open, showing link to breakout rooms and other moderation functions.&quot;}" role="button" title="BigBlueButton conversation window in a browser, with the moderator tools open, showing link to breakout rooms and other moderation functions." data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;BigBlueButton conversation window in a browser, with the moderator tools open, showing link to breakout rooms and other moderation functions.&quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-26%20at%2015-03-34%20The%20OERu%20BigBlueButton%20-%20Home%20Room-withModeratorMenu.png?itok=tsVPmMgZ" width="220" height="143" alt="BigBlueButton conversation window in a browser, with the moderator tools open, showing link to breakout rooms and other moderation functions." loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> <figure class="field-type-image__figure image-count-9"> <div class="field-type-image__item"> <a href="http://tech.oeru.org/sites/default/files/styles/max_1300x1300/public/2021-11/Screenshot%202021-11-26%20at%2015-00-54%20The%20OERu%20BigBlueButton%20-%20Home%20Room.png?itok=55K_wxG1" aria-controls="colorbox" aria-label="{&quot;alt&quot;:&quot;BigBlueButton in effect with 3 participants (all the author from different devices). Note the public chat.&quot;}" role="button" title="BigBlueButton in effect with 3 participants (all the author from different devices). Note the public chat." data-colorbox-gallery="gallery-field_image-GnjYzG6vmqA" class="colorbox" data-cbox-img-attrs="{&quot;alt&quot;:&quot;BigBlueButton in effect with 3 participants (all the author from different devices). Note the public chat.&quot;}"><img src="/sites/default/files/styles/medium/public/2021-11/Screenshot%202021-11-26%20at%2015-00-54%20The%20OERu%20BigBlueButton%20-%20Home%20Room.png?itok=j1O8G0e-" width="220" height="143" alt="BigBlueButton in effect with 3 participants (all the author from different devices). Note the public chat." loading="lazy" typeof="foaf:Image" class="image-style-medium" /> </a> </div> </figure> </div> <div class="clearfix text-formatted field field-node--body field-name-body field-type-text-with-summary field-label-hidden"> <div class="field__items"> <div class="field__item"><p>This tutorial was developed for the <a href="https://samoaksi.ws/">Samoan Knowledge Society Initiative</a>, in which the OER Foundation is very pleased to be involved. (Update 2022-02-10: we have also created a <a href="137.184.84.159">video tutorial</a> based on this written tutorial)</p> <p><a href="https://bigbluebutton.org">BigBlueButton</a> (BBB) is a full-featured video conferencing system designed for large scale remote learning at the university level. In some ways, BBB goes beyond feature parity with widely used proprietary video conferencing systems like Zoom or Microsoft Teams, Webex, or Google Hangouts. It's main differences are that BBB</p> <ul><li>was designed from the gound up for educational use, and</li> <li>is Free and Open Source Software (FOSS) and anyone can install it (as we describe in this tutorial) at no cost other than whatever cost you pay for hosting the application and a bit of your time.</li> </ul><p>You can read all about BigBlueButton and how it works using the <a href="https://docs.bigbluebutton.org">excellent documentation</a> provided by its development community.</p> <p>There are no per-user license fees (or <em>any</em> fees), and your users don't need to install special software, vastly simplifying its adoption: BBB works brilliantly on any desktop computer, laptop, or mobile device (tablet or phone) with a modern web browser that implements the <a href="https://webrtc.org">WebRTC</a> open web standard (which is all modern browsers).</p> <p>The <a href="https://github.com/bigbluebutton/">source code for BBB's internal components, and its many ancillary tools</a> is available for anyone to learn from or improve - that's the fundamental benefit of FOSS. Since the outbreak of COVID19, the team at a small Ottowa, Canada-based company, Blindside Networks, has been working tirelessly with the BBB community to improve the BBB code, which is being used all over the world by millions of people every day.</p> <p>This tutorial walks you through provisioning and building your own BigBlueButton instance on a server running <a href="https://ubuntu.com/download/server">Ubuntu GNU/Linux</a> - version 20.04 is the Long Term Support (LTS) version as of this writing - using <a href="https://www.docker.com/docker-community">Docker</a> containers for the various software services and components, with the containers managed by <a href="https://docs.docker.com/compose/">Docker Compose</a>.</p> <p><em>Table of contents</em></p> <ul class="table-of-contents"><li> <p><a href="#introduction">Introduction</a></p> <ul><li> <p><a href="#references">References</a></p> </li> <li> <p><a href="#copying-and-pasting">Copying and pasting</a></p> </li> </ul></li> <li> <p><a href="#information-you-need-to-know">Information you need to know</a></p> </li> <li> <p><a href="#preferences">Preferences</a></p> </li> <li> <p><a href="#set-up-your-virtual-server">Set up your virtual server</a></p> </li> <li> <p><a href="#configure-your-domain-to-point-at-your-server">Configure your Domain to point at your Server</a></p> <ul><li> <p><a href="#best-practice-access-your-server-as-a-non-root-user">Best Practice: access your server as a non-root user</a></p> </li> </ul></li> <li> <p><a href="#a-few-post-install-updates">A few post-install updates</a></p> <ul><li> <p><a href="#update-the-servers-hosts-file">Update the server's hosts file</a></p> </li> </ul></li> <li> <p><a href="#firewall-configuration">Firewall Configuration</a></p> </li> <li> <p><a href="#install-postfix-so-the-server-can-send-email">Install Postfix so the server can send email</a></p> <ul><li> <p><a href="#email-test">Email test</a></p> </li> </ul></li> <li> <p><a href="#install-nginx-webserver-and-lets-encrypt-tools">Install Nginx webserver and Let's Encrypt tools</a></p> </li> <li> <p><a href="#set-up-coturn-certificates">Set up COTURN certificates</a></p> </li> <li> <p><a href="#set-up-nginx-reverse-proxy-configuration">Set up Nginx Reverse Proxy Configuration</a></p> <ul><li> <p><a href="#extra-security-with-dhparampem">Extra security with dhparam.pem</a></p> </li> </ul></li> <li> <p><a href="#install-docker">Install Docker</a></p> </li> <li> <p><a href="#install-docker-compose">Install Docker-compose</a></p> </li> <li> <p><a href="#git-clone-bbb-docker-repository">Git-Clone BBB Docker repository</a></p> </li> <li> <p><a href="#configure-your-bbb">Configure your BBB</a></p> <ul><li> <p><a href="#fix-minor-configuration-error-that-blocks-jodconverter">Fix minor configuration error that blocks JODConverter</a></p> </li> </ul></li> <li> <p><a href="#build-your-bbb">Build your BBB</a></p> </li> <li> <p><a href="#visit-your-new-bbb">Visit your new BBB</a></p> </li> <li> <p><a href="#create-an-admin-user">Create an admin user:</a></p> </li> <li> <p><a href="#run-your-first-conference">Run your first conference</a></p> </li> <li> <p><a href="#next-steps">Next Steps</a></p> </li> </ul><h2><a id="user-content-introduction" href="#introduction" name="introduction" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Introduction</h2> <h3><a id="user-content-references" href="#references" name="references" class="heading-permalink" aria-hidden="true" title="Permalink"></a>References</h3> <p>For this tutorial, we are using a <a href="https://digitalocean.com">Digital Ocean</a> 'Droplet' as our cloud server. You can use an almost identical process to provision a server from any one of a thousand other commodity GNU/Linux cloud hosting providers.</p> <p>To demonstrate the process of defining a sub domain and its IPv4 and IPv6 addresses (via A and AAAA records respectively) I'm using my preferred local domain registrar <a href="https://metaname.net">Metaname</a> (based here in Christchurch, New Zealand, as am I. I know the developer/owner of the service and I trust him). You can use any domain registrar that gives you the ability to configure your 'DNS zone file'. Some of might have your own DNS server or institutional name servers, in which case you might have to request these changes be made on your behalf.</p> <h3><a id="user-content-copying-and-pasting" href="#copying-and-pasting" name="copying-and-pasting" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Copying and pasting</h3> <p>We will be providing a bunch of command lines that you can copy and paste into a terminal on the computer you're using to access your virtual server. Links like</p> <p><code>this one</code></p> <p>are intended for you to copy and paste into the command line. On Linux, please note that in some cases if "CTRL-V" doesn't work to paste, try using "CTRL+SHIFT+V" (that's because in some terminals, "CTRL+V" had a pre-existing purpose as terminals have been around since long before desktops and 'copy-paste" were invented and the arbitrary CTRL-C, CTRL-X, CTRL-V key combos were chosen by Microsoft without any consideration for prior art). Similarly, if you want to copy <em>from</em> a terminal, you might need to use "CTRL+SHIFT+C". Try it.</p> <p>When we ask you edit a file (using the editor you choose to assign to the EDIT shell variable below), we expect you to complete the recommended changes, and then <em>save the file</em> and exit back to the command line.</p> <p>We'll aim to show you what to change using a 'code' box:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">Like this one <span class="kw2">which</span> is suitable <span class="kw1">for</span> multi-line content <span class="br0">(</span>like what you <span class="kw2">find</span> <span class="kw1">in</span> a <span class="kw2">file</span><span class="br0">)</span></pre></div></div> <h2><a id="user-content-information-you-need-to-know" href="#information-you-need-to-know" name="information-you-need-to-know" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Information you need to know</h2> <p>Info you need to have handy to complete this tutorial:</p> <ul><li>You need to know the IPv4 address of your server. Token: [IPv4] - it'll be in the form of nnn.nnn.nnn.nnn where nnn = 0-254, example value 143.110.228.88</li> <li>If your server has one, you need to know its IPv6 address. Token: [IPv6] - it'll be in the form of hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh where h = 0-9a-f, i.e. a hex value, example 2604:a880:4:1d0::402:b000</li> <li>You need to have a domain name (or a sub domain name) to point at your server's IPv4 and IPv6. Token: [Domain], example domain bbbtest.milll.ws (in this case, bbbtest is the subdomain of the milll.ws domain)</li> <li>The email address your server should send status or admin-related email to. Token [Admin email], example webmaster@[Domain]</li> <li>You'll need a set of authenticating SMTP account settings including - these can be used both on the host and in the BBB installation: <ul><li>[SMTP server] - the domain name or IP address of an existing SMTP server, e.g. about.oerfoundation.org (our one), or smtp.googlemail.com,</li> <li>[SMTP port] - the port number for the service you're using. It'll usually be one of 587 or 465. Older, unauthenticated SMTP servers used to use port 25, but that's now blocked by most ISPs due to its abuse by spammers.</li> <li>[SMTP security] - usually this'll be something like 'SSL' (usually associated with port 465) or 'StartTLS' (usually associated with port 587).</li> <li>[SMTP username] - the username - often an email address - for the authenticating SMTP service, and lastly,</li> <li>[SMTP password] - the password accompanying the username.</li> </ul></li> <li>You'll want an email address that you can check to send test emails to: token [Test email], e.g. <a href="mailto:you@youremailprovider.tld">you@youremailprovider.tld</a>, and finally</li> <li>You'll want a 'from' email address that users of your system will see when they get emails from you. Token: [Outgoing email], e.g. <a href="mailto:notifications@milll.ws">notifications@milll.ws</a>.</li> </ul><h2><a id="user-content-preferences" href="#preferences" name="preferences" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Preferences</h2> <p>You'll need to copy and paste the following lines into any terminal you're using to complete this tutorial, so that that session is aware of your preferred values:</p> <p><code>EDIT=$(which nano)</code></p> <p><code>SITE=bbbtest.milll.ws</code></p> <p>We're going to reference these periodically in the following process, so it's important you set these correctly. To verify them, you can run this in any terminal at any time to verify that the values are still defined and current:</p> <p><code>echo "Our variables = $EDIT and $SITE"</code></p> <h2><a id="user-content-set-up-your-virtual-server" href="#set-up-your-virtual-server" name="set-up-your-virtual-server" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Set up your virtual server</h2> <p>You'll need to log into your cloud service provider's dashboard - in our case, we've used DigitalOcean. That means pointing our browser to <a href="https://digitalocean.com">https://digitalocean.com</a> and either using "Log In" (if we already have an account) or "Sign Up" (if we don't).</p> <p>Once you're logged in, you'll want to go to 'Create' and select 'Droplets' (Digital Ocean calls each of their virtual servers a "Droplet").</p> <p>We've included a screenshot of the Create Droplet page, with the relevant options selected. They are as follows:</p> <ul><li>Choose an image: we choose 'Ubuntu 20.04 LTS'</li> <li>Choose a plan: we choose 'Basic' <ul><li>for CPU options: we choose 'Premium AMD with NVMe SSD'</li> <li>for the size, we choose either the '$24/mo' (choose the '$48/mo' option if you want to be able to support large groups, like 100+ simultaneous participants).</li> </ul></li> <li>Choose a datacenter region: we choose 'San Franciso, zone 3' (which we've determined to be in the 'centre of the internet', i.e. the most central point to give the best website performance to a global audience. You might want to try a different place depending on your location in the globe and your audience).</li> <li>VPC Network - we just leave the default.</li> <li>Select additional options: we check 'IPv6' and 'Monitoring' but <em>not</em> User data.</li> <li>Authentication: if we have added one or more SSH keys to our DigitalOcean profile select 'SSH keys'. If not, you can select 'Password'. It's far more efficient and secure to use SSH whereever possible.</li> <li>We're ony creating 1 Droplet and we Choose a hostname of [Domain]</li> <li>We don't need to add any tags</li> <li>We <em>won't</em> Add backups.</li> </ul><p>Then we can <code>Create Droplet</code>...</p> <p>When the Droplet is finished, we can get the [IPv4] and [IPv6] addresses.</p> <p>We can also either log in via the command line from a local GNU/Linux or UNIX (e.g. MacOS) terminal or via a graphical SSH client (on Microsoft Windows, most people use Putty) via <code>ssh root@[IPv4]</code> or <code>ssh root@[IPv6]</code> (replacing those tokens with their actual IPv4 or IPv6 addresses). If we've set a key, we should get logged in without the need to enter any passwords. If not, we have to enter a password provided by DigitalOcean.</p> <h2><a id="user-content-configure-your-domain-to-point-at-your-server" href="#configure-your-domain-to-point-at-your-server" name="configure-your-domain-to-point-at-your-server" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Configure your Domain to point at your Server</h2> <p>Once you have selected and registered your domain with a domain registrar - we are using Metaname - you can set up (usually through a web interface provided by the registrar)</p> <ul><li>an "A Record" which associates your website's name (your [Domain], e.g. milll.ws, or a subdomain of that domain, e.g. bbb.milll.ws, where 'bbb' is the subdomain part) to the IPv4 address of your server. You should just be able to enter your server's IPv4 address, the domain name (or sub-domain) you want to use for your server.</li> <li>if your registrar offers it it's also important to define an IPv6 record, which is called an "AAAA Record"... you put in the same domain name or subdomain and then your IPv6 address instead of your IPv4 one.</li> </ul><p>I've attached an screenshot of the Metaname interface for configuring these DNS zone records.</p> <p>You might be asked to set a "Time-to-live" (which has to do with the length of time Domain Name Servers are asked to "cache" the association that the A Record specifies) in which case you can put in 3600 seconds or an hour depending on the time units your interface requests... but in most cases that'll be set to a default of an hour automatically.</p> <p>Once your domain A and AAAA records are configured, you should be able to log into your server via <code>ssh root@[Domain]</code>, or, for example, <code>ssh root@bbb.milll.ws</code>. Although it should be instant, depending on your registrar, it might take as long as a few hours (even 24) for your domain name assignments to propogate through the DNS network and be available on your computer.</p> <h3><a id="user-content-best-practice-access-your-server-as-a-non-root-user" href="#best-practice-access-your-server-as-a-non-root-user" name="best-practice-access-your-server-as-a-non-root-user" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Best Practice: access your server as a non-root user</h3> <p>You should be able to test that your A and AAAA Records have been set correctly by logging into your server via SSH using your domain name rather than the IPv4 or IPv6 address you used previously. It should (after you accept the SSH warning that the server's name has a new name) work the same way your original SSH login did. On Linux, you'd SSH via a terminal and enter <code>ssh root@[domain name]</code>. I think you can do similar on MacOS and on Windows, I believe people typically use software called <a href="https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html">Putty</a>...</p> <p>But this will log you into your server as the 'root' user.</p> <p>It's not considered good practice to access your server as root (it's too easy to completely screw it up). Best practice is to create a separate 'non-root' user who has 'sudo' privileges and the ability to log in via SSH. If you are <em>currently logged in as 'root'</em>, you can create a normal user for yourself via (replace [username] with your chosen username):</p> <p><code>U=[username]</code><br /><code>adduser $U</code></p> <p>You will be required to set a password for the user here. Then you can add the new user to several relevant groups that confer the required administrative capabilities.</p> <p><code>adduser $U ssh</code><br /><code>adduser $U admin</code><br /><code>adduser $U sudo</code></p> <p>If you want to change the password for user [username] you can run:</p> <p><code>passwd $U</code></p> <p>then become that user temporarily (note, the root user can 'become' another user without needing to enter a password) and create an SSH key and, in the process, the <code>.ssh</code> directory (directories starting with a '.' are normally 'hidden') for the file into which to put your public SSH key:</p> <p><code>su $U</code><br /><code>ssh-keygen -t rsa -b 2048</code><br /><code>nano ~/.ssh/authorized_keys</code></p> <p>and in that file, copy and paste (without spaces on either end) your <em>current computer's</em> <strong>public</strong> ssh key (<em>never publish</em> your private key anywhere!), save and close the file.</p> <p>From that point, you should be able to SSH to your server via <code>ssh [username]@[domain name]</code> without needing to enter a password.</p> <p>These instructions use 'sudo' in front of commands because I assume you're using a non-root user. The instructions will still work fine even if you're logged in as 'root'.</p> <p>The rest of the tutorial can be run as your 'sudo-capable' non-root user.</p> <h2><a id="user-content-a-few-post-install-updates" href="#a-few-post-install-updates" name="a-few-post-install-updates" class="heading-permalink" aria-hidden="true" title="Permalink"></a>A few post-install updates</h2> <h3><a id="user-content-update-the-servers-hosts-file" href="#update-the-servers-hosts-file" name="update-the-servers-hosts-file" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Update the server's hosts file</h3> <p>This is required due to some quirks of the auto-detection of your domain name used by BigBlueButton - you'll need it later.</p> <p><code>sudo $EDIT /etc/hosts</code></p> <p>and add (or make sure it already has) the following:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">127.0.1.1 <span class="br0">[</span>First part of domain<span class="br0">]</span> 127.0.0.1 localhost <span class="br0">[</span>IPv4<span class="br0">]</span> <span class="br0">[</span>Domain<span class="br0">]</span> <span class="br0">[</span>IPv6<span class="br0">]</span> <span class="br0">[</span>Domain<span class="br0">]</span></pre></div></div> <p>For example - my test system has these details:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">127.0.1.1 bbbtest 127.0.0.1 localhost 143.110.228.88 bbbtest.milll.ws <span class="nu0">2604</span>:a880:<span class="nu0">4</span>:1d0::<span class="nu0">402</span>:b000 bbbtest.milll.ws</pre></div></div> <p>Do an initial post-install update to the latest software versions:</p> <p><code>sudo apt-get update &amp;&amp; sudo apt-get dist-upgrade</code></p> <p>and add a couple useful apps that, for example, track changes to our system configuration for future reference (etckeeper) and allow us to do network troubleshooting (net-tools):</p> <p><code>sudo apt-get install -y etckeeper net-tools</code></p> <p>We also want to enable console logins in the event we have trouble using SSH:</p> <p><code>wget -qO- https://repos-droplet.digitalocean.com/install.sh | sudo bash</code></p> <h2><a id="user-content-firewall-configuration" href="#firewall-configuration" name="firewall-configuration" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Firewall Configuration</h2> <p>We need to configure firewall for admin access via SSH and access to internet for Docker containers</p> <p><code>sudo ufw allow OpenSSH</code></p> <p><code>sudo ufw allow in on docker0</code></p> <p><code>sudo ufw allow from 172.0.0.0/8 to any</code></p> <p>Then we need to adjust the default firewall policy:</p> <p><code>sudo $EDIT /etc/default/ufw</code></p> <p>You'll find this:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0"># Set the default forward policy to ACCEPT, DROP or REJECT. Please note that</span> <span class="co0"># if you change this you will most likely want to adjust your rules</span> <span class="re2">DEFAULT_FORWARD_POLICY</span>=<span class="st0">"DROP"</span></pre></div></div> <p>which you need to change to</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0"># Set the default forward policy to ACCEPT, DROP or REJECT. Please note that</span> <span class="co0"># if you change this you will most likely want to adjust your rules</span> <span class="re2">DEFAULT_FORWARD_POLICY</span>=<span class="st0">"ACCEPT"</span></pre></div></div> <p>Next you need to edit this file</p> <p><code>sudo $EDIT /etc/ufw/sysctl.conf</code></p> <p>And change (near the top of the file):</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0"># Uncomment this to allow this host to route packets between interfaces</span> <span class="co0">#net/ipv4/ip_forward=1</span> <span class="co0">#net/ipv6/conf/default/forwarding=1</span> <span class="co0">#net/ipv6/conf/all/forwarding=1</span></pre></div></div> <p>to</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0"># Uncomment this to allow this host to route packets between interfaces</span> net<span class="sy0">/</span>ipv4<span class="sy0">/</span><span class="re2">ip_forward</span>=<span class="nu0">1</span> net<span class="sy0">/</span>ipv6<span class="sy0">/</span>conf<span class="sy0">/</span>default<span class="sy0">/</span><span class="re2">forwarding</span>=<span class="nu0">1</span> net<span class="sy0">/</span>ipv6<span class="sy0">/</span>conf<span class="sy0">/</span>all<span class="sy0">/</span><span class="re2">forwarding</span>=<span class="nu0">1</span></pre></div></div> <p>(removing the "#" uncomments those lines)</p> <p>Next, you have to restart the server's networking stack to apply the changes you've made:</p> <p><code>sudo systemctl restart systemd-networkd</code></p> <p>Luckily, this is generally instantaneous, so your connection to your server shouldn't be interrupted.</p> <p>Then you either start or (if it's already running for some reason) restart the firewall</p> <p><code>sudo ufw enable</code></p> <p>or</p> <p><code>sudo service ufw restart</code></p> <p>(running both won't do any harm)</p> <p>And we also update the firewall configuration to tell it to automatically start at boot time.</p> <p><code>sudo $EDIT /etc/ufw/ufw.conf</code></p> <p>Change <code>ENABLED=no</code> to <code>ENABLED=yes</code>.</p> <p>Next we need to set up some specialised rules for the "COTURN" functionality of the BigBlueButton system. <a href="https://coturn.github.io/">COTURN</a> is a FOSS application that provides both <a href="https://www.youtube.com/watch?v=4dLJmZOcWFc">TURN and STUN (video)</a> (<a href="https://blog.ivrpowers.com/post/technologies/what-is-stun-turn-server/">alternative non-video reference</a>) functionality which are core to the WebRTC protocol on which modern video conferencing applications are built, and are necessary for your users to connect their audio and video to a session, particularly if they're behind an institutional firewall.</p> <p><em>Note</em>: in some cases, <em>institutions will have implemented a rather over-the-top-paranoid 'default deny' for video conference hosts</em> which will block access to your BBB instance unless you can get them to add your site's domain name to their institutional whitelist. Sadly, there's no easy way around this.</p> <p><code>sudo ufw allow 7443/tcp</code></p> <p><code>sudo ufw allow 16384:32768/udp</code></p> <p><code>sudo ufw allow 3478/udp</code></p> <p><code>sudo ufw allow 5349/tcp</code></p> <p><code>sudo ufw allow from 10.7.7.0/24</code></p> <p>Ok, that's it for the firewall shenanigans.</p> <h2><a id="user-content-install-postfix-so-the-server-can-send-email" href="#install-postfix-so-the-server-can-send-email" name="install-postfix-so-the-server-can-send-email" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Install Postfix so the server can send email</h2> <p>It's generally a good idea to make sure any server you build can send email, and has a sensible default email address to send stuff to: stuff like administrative messages alerting you to failed tasks, or other system problems. We recommend that you designate an email address for whoever's responsible for this server. We've got a more <a href="/node/28">comprehsensive howto</a> for setting this up if you're wanting extra details.</p> <p>We achieve the outgoing mail functionality using the industrial strength Postfix SMTP server (it's widely used by ISPs for large-scale email services) along with a command line SMTP client that allows us to test our solution from the command line:</p> <p><code>sudo apt install postfix bsd-mailx</code></p> <p>During this installation, you'll be asked by the installer to make some decisions to do preliminary configuration of the Postfix installation. Select the default asnwers except as follows:</p> <ul><li>Select "Internet Site with Smarthost",</li> <li>fill in the [Domain] name you've chosen for your server,</li> <li>the domain name or IP address and port (in the form [SMTP server]:[port], examples might be smtp.oeru.org:465, or 10.11.143.22:465) of your "smarthost" who'll be doing the authenticating SMTP for you - note: <strong>our configuration works with port 465</strong>, and</li> <li>the email address to which you want to receive system-related messages, namely [Admin email].</li> </ul><p>Once that's installed, we need to set up our default email address for this server:</p> <p><code>sudo $EDIT /etc/aliases</code></p> <p>This file will containerd</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0"># See man 5 aliases for format</span> postmaster: root</pre></div></div> <p>update it to include an email address to send stuff intended for the system admin (aka 'root'):</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0"># See man 5 aliases for format</span> postmaster: root   root: <span class="br0">[</span>Admin email<span class="br0">]</span></pre></div></div> <p>after writing that, we have to convert that file into a form understood by Postix:</p> <p><code>sudo newaliases</code></p> <p>Next, we need to create a new file with the SMTP 'relay host' aka 'smart host' details:</p> <p><code>sudo $EDIT /etc/postfix/relay_password</code></p> <p>In it you need to put the following:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="br0">[</span>SMTP Server<span class="br0">]</span> <span class="br0">[</span>SMTP username<span class="br0">]</span>:<span class="br0">[</span>SMTP password<span class="br0">]</span></pre></div></div> <p>Here's an example:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">about.oerfoundation.org demosmtp<span class="sy0">@</span>milll.ws:7TLM6qGoqZXHfkDmkh6</pre></div></div> <p>Once you've set that up, we have to again prepare that file for use by Postfix:</p> <p><code>sudo postmap /etc/postfix/relay_password</code></p> <p>Finally, we need to update Postfix's main configuration to tell it to use our authenticating SMTP details:</p> <p><code>sudo $EDIT /etc/postfix/main.cf</code></p> <p>You'll need to make main.cf look like this - specifically commenting out <code>smtp_tls_security_level=may</code> by adding a '#' at the start of the line, and then adding the details below <code># added to configure accessing the relay host via authenticating SMTP</code>. You should also take this opportunity to confirm that your [Domain], [SMTP server] and [SMTP port] are set correctly.</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">smtpd_banner = <span class="re1">$myhostname</span> ESMTP <span class="re1">$mail_name</span> <span class="br0">(</span>Ubuntu<span class="br0">)</span> biff = no   <span class="co0"># appending .domain is the MUA's job.</span> append_dot_mydomain = no   <span class="co0"># Uncomment the next line to generate "delayed mail" warnings</span> <span class="co0">#delay_warning_time = 4h</span>   readme_directory = no   <span class="co0"># See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on</span> <span class="co0"># fresh installs.</span> compatibility_level = <span class="nu0">2</span>   <span class="co0"># TLS parameters</span> <span class="re2">smtpd_tls_cert_file</span>=<span class="sy0">/</span>etc<span class="sy0">/</span>ssl<span class="sy0">/</span>certs<span class="sy0">/</span>ssl-cert-snakeoil.pem <span class="re2">smtpd_tls_key_file</span>=<span class="sy0">/</span>etc<span class="sy0">/</span>ssl<span class="sy0">/</span>private<span class="sy0">/</span>ssl-cert-snakeoil.key <span class="re2">smtpd_tls_security_level</span>=may   <span class="re2">smtp_tls_CApath</span>=<span class="sy0">/</span>etc<span class="sy0">/</span>ssl<span class="sy0">/</span>certs <span class="co0">## Commented out for SmartHost configuration</span> <span class="co0">#smtp_tls_security_level=may</span> smtp_tls_session_cache_database = btree:<span class="co1">${data_directory}</span><span class="sy0">/</span>smtp_scache     smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination myhostname = <span class="br0">[</span>Domain<span class="br0">]</span> alias_maps = hash:<span class="sy0">/</span>etc<span class="sy0">/</span>aliases alias_database = hash:<span class="sy0">/</span>etc<span class="sy0">/</span>aliases myorigin = <span class="sy0">/</span>etc<span class="sy0">/</span>mailname mydestination = <span class="re1">$myhostname</span>, bbbtest.milll.ws, localhost.milll.ws, localhost relayhost = <span class="br0">[</span>SMTP server<span class="br0">]</span>:<span class="nu0">465</span> mynetworks = 127.0.0.0<span class="sy0">/</span><span class="nu0">8</span> <span class="br0">[</span>::ffff:127.0.0.0<span class="br0">]</span><span class="sy0">/</span><span class="nu0">104</span> <span class="br0">[</span>::<span class="nu0">1</span><span class="br0">]</span><span class="sy0">/</span><span class="nu0">128</span> mailbox_size_limit = <span class="nu0">0</span> recipient_delimiter = + inet_interfaces = all inet_protocols = all   <span class="co0"># added to configure accessing the relay host via authenticating SMTP</span> smtp_sasl_auth_enable = <span class="kw2">yes</span> smtp_sasl_password_maps = hash:<span class="sy0">/</span>etc<span class="sy0">/</span>postfix<span class="sy0">/</span>relay_password smtp_sasl_security_options = smtp_tls_security_level = encrypt   <span class="co0"># add this if you're using Ubuntu 20.04, and comment out (with a "#") the</span> <span class="co0"># earlier line smtp_tls_security_level = may to save errors in 'postfix check'</span> <span class="co0"># and uncomment this line (by removing the #)</span> smtp_tls_wrappermode = <span class="kw2">yes</span></pre></div></div> <p>Here's an example of what the final code could look like (don't use these exact values as they won't work for you):</p> <p>First, I commented this out:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co4">#</span><span class="re2">smtp_tls_security_level</span>=may</pre></div></div> <p>Made sure this was my [Domain]</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">myhostname = bbbtest.milll.ws</pre></div></div> <p>Made sure this had my [SMTP server] and [SMTP port] details:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">relayhost = about.oerfoundation.org:<span class="nu0">465</span></pre></div></div> <p>And I added this at the end:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0"># added to configure accessing the relay host via authenticating SMTP</span> smtp_sasl_auth_enable = <span class="kw2">yes</span> smtp_sasl_password_maps = hash:<span class="sy0">/</span>etc<span class="sy0">/</span>postfix<span class="sy0">/</span>relay_password smtp_sasl_security_options = smtp_tls_security_level = encrypt   <span class="co0"># add this if you're using Ubuntu 20.04, and comment out (with a "#") the</span> <span class="co0"># earlier line smtp_tls_security_level = may to save errors in 'postfix check'</span> <span class="co0"># and uncomment this line (by removing the #)</span> smtp_tls_wrappermode = <span class="kw2">yes</span></pre></div></div> <p>After this, the Postfix configuration is done. We can check that we haven't got any typos via</p> <p><code>sudo postfix check</code></p> <p>If not, we can apply our configuration changes:</p> <p><code>sudo postfix reload</code></p> <p>and we can confirm it all worked correctly by checking the log file for Postfix:</p> <p><code>sudo less +G /var/log/mail.log</code></p> <p>Note: you might see a warning like this: <code>postfix/postfix-script: warning: symlink leaves directory: /etc/postfix/./makedefs.out</code> - it's spurious and you don't need to worry about it.</p> <h3><a id="user-content-email-test" href="#email-test" name="email-test" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Email test</h3> <p>Next we can test our outgoing SMTP by sending a test message via the command line - <em>use a test email that you can check!</em>:</p> <p><code>mail [Test email]</code></p> <p>for example:</p> <p><code>mail demo@oerfoundation.org</code></p> <p>After you hit Enter, you'll be shown</p> <p><code>Subject:</code> {Enter an email subject, e.g. "Test email from [Domain]"}</p> <p>After that, hit Enter, and you'll be shown a blank line. On that line:</p> <p>{Enter your email text, e.g. "This is just a test."}</p> <p>Then, to finish your email, type <em>CTRL-D</em> which will show you another line</p> <p><code>CC:</code> {Enter any CC email addresses, e.g. <a href="mailto:mybackupemail@anotherprovider.tld">mybackupemail@anotherprovider.tld</a> }</p> <p>After you hit Enter, your email should be sent if all your configuration options are accepted by your remote host (the SMTP server at the address [SMTP server] with all the other details you entered).</p> <p>You can check if it worked by looking at the Postfix log again:</p> <p><code>sudo less +G /var/log/mail.log</code></p> <p>If it sent the email, you'll see something like (but with different IP addresses, serial numbers, and addresses) - the key bit is the <code>status=sent</code> bit and the <code>250</code> code from the SMTP server:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">08FBD2B501C: <span class="re2">to</span>=<span class="sy0">&lt;</span>demo<span class="sy0">@</span>oerfoundation.org<span class="sy0">&gt;</span>, <span class="re2">relay</span>=dovecot<span class="br0">[</span>172.22.1.250<span class="br0">]</span>:<span class="nu0">24</span>, <span class="re2">delay</span>=<span class="nu0">1.3</span>, <span class="re2">delays</span>=<span class="nu0">1.3</span><span class="sy0">/</span><span class="nu0">0.02</span><span class="sy0">/</span><span class="nu0">0</span><span class="sy0">/</span><span class="nu0">0.04</span>, <span class="re2">dsn</span>=2.0.0, <span class="re2">status</span>=sent <span class="br0">(</span><span class="nu0">250</span> 2.0.0 <span class="sy0">&lt;</span>demo<span class="sy0">@</span>oerfoundation.org<span class="sy0">&gt;</span> MMokCa2TpWEffAAAPgmdMA Saved<span class="br0">)</span></pre></div></div> <p>You can also check for receipt of email and verify receipt (note, if you don't get it quickily, check your email spam folder).</p> <h2><a id="user-content-install-nginx-webserver-and-lets-encrypt-tools" href="#install-nginx-webserver-and-lets-encrypt-tools" name="install-nginx-webserver-and-lets-encrypt-tools" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Install Nginx webserver and Let's Encrypt tools</h2> <p><code>sudo apt install -y nginx-full ca-certificates letsencrypt ssl-cert</code></p> <p>You need to tell your firewall to open the ports that the Nginx webserver will use:</p> <p><code>sudo ufw allow "Nginx Full"</code></p> <p>And then we need to create a special configuration for Let's Encrypt and then an identify verification directory:</p> <p><code>sudo mkdir /etc/nginx/includes</code></p> <p><code>sudo mkdir /var/www/letsencrypt</code></p> <p>To create the specific configuration, we create this file:</p> <p><code>sudo $EDIT /etc/nginx/includes/letsencrypt.conf</code></p> <p>And fill it with this information:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0"># Rule for legitimate ACME Challenge requests</span> location ^~ <span class="sy0">/</span>.well-known<span class="sy0">/</span>acme-challenge<span class="sy0">/</span> <span class="br0">{</span> default_type <span class="st0">"text/plain"</span>; <span class="co0"># this can be any directory, but this name keeps it clear</span> root <span class="sy0">/</span>var<span class="sy0">/</span>www<span class="sy0">/</span>letsencrypt; <span class="br0">}</span>   <span class="co0"># Hide /acme-challenge subdirectory and return 404 on all requests.</span> <span class="co0"># It is somewhat more secure than letting Nginx return 403.</span> <span class="co0"># Ending slash is important!</span> location = <span class="sy0">/</span>.well-known<span class="sy0">/</span>acme-challenge<span class="sy0">/</span> <span class="br0">{</span> <span class="kw3">return</span> <span class="nu0">404</span>; <span class="br0">}</span></pre></div></div> <p>We'll reference this file in our Nginx configuration file for the reverse proxy functionality.</p> <h2><a id="user-content-set-up-coturn-certificates" href="#set-up-coturn-certificates" name="set-up-coturn-certificates" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Set up COTURN certificates</h2> <p>In preparation for creating our Let's Encrypt SSL certificate for our [Domain], we're going to set up a 'hook' which is triggered when our SSL certificate is created, and it copies our current certificate to a place where the COTURN server can find it.</p> <p><code>sudo $EDIT /etc/letsencrypt/renewal-hooks/deploy/coturn.sh</code></p> <p>Copy and past the following into your file (<strong>replacing [Domain] with your domain name</strong>):</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="co0">#!/bin/bash</span>   <span class="re2">DOMAIN</span>=<span class="br0">[</span>Domain<span class="br0">]</span> <span class="re2">DEST</span>=<span class="sy0">/</span>etc<span class="sy0">/</span>coturn-ssl   <span class="co0">#if [[ 1 == 1 ]]; then</span> <span class="kw1">if</span> <span class="br0">[</span><span class="br0">[</span> <span class="re1">$RENEWED_DOMAINS</span> == <span class="sy0">*</span><span class="st0">"<span class="es2">$DOMAIN</span>"</span><span class="sy0">*</span> <span class="br0">]</span><span class="br0">]</span>; <span class="kw1">then</span> <span class="kw2">cp</span> <span class="re5">-L</span> <span class="sy0">/</span>etc<span class="sy0">/</span>letsencrypt<span class="sy0">/</span>live<span class="sy0">/</span><span class="co1">${DOMAIN}</span><span class="sy0">/</span>fullchain.pem <span class="re1">$DEST</span> <span class="kw2">cp</span> <span class="re5">-L</span> <span class="sy0">/</span>etc<span class="sy0">/</span>letsencrypt<span class="sy0">/</span>live<span class="sy0">/</span><span class="co1">${DOMAIN}</span><span class="sy0">/</span>privkey.pem <span class="re1">$DEST</span> <span class="kw3">echo</span> <span class="st0">"updated <span class="es2">$DOMAIN</span> certificates in <span class="es2">$DEST</span>"</span> <span class="kw1">fi</span></pre></div></div> <p>Next, make that script executable:</p> <p><code>sudo chmod a+x /etc/letsencrypt/renewal-hooks/deploy/coturn.sh</code></p> <p>so that it is run automatically anytime the relevant certificate is created or renewed.</p> <p>After that, we have to create a place for the COTURN-specific certificates to go:</p> <p><code>sudo mkdir /etc/coturn-ssl</code></p> <h2><a id="user-content-set-up-nginx-reverse-proxy-configuration" href="#set-up-nginx-reverse-proxy-configuration" name="set-up-nginx-reverse-proxy-configuration" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Set up Nginx Reverse Proxy Configuration</h2> <p>Next we have to set up our Nginx webserver on our virtual server, which will be the Docker container host for our BigBlueButton system. The reverse proxy configuration will allow the virtual server to receive web requests from BBB users and pass them securely through to the right Docker container.</p> <p>Create a suitable configuration file - at the OERF we use the convention of calling our configuration</p> <p><code>sudo $EDIT /etc/nginx/sites-available/$SITE</code></p> <p>In this file, you'll past in the following, replacing [Domain] as appropriate - now might be a good idea to try out search and replace in your text editor!</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">server <span class="br0">{</span> listen <span class="nu0">80</span>; <span class="co0"># if your host doens't support IPv6, comment out the following line</span> listen <span class="br0">[</span>::<span class="br0">]</span>:<span class="nu0">80</span>; server_name <span class="br0">[</span>Domain<span class="br0">]</span>;   access_log <span class="sy0">/</span>var<span class="sy0">/</span>log<span class="sy0">/</span>nginx<span class="sy0">/</span><span class="br0">[</span>Domain<span class="br0">]</span>.access.log; error_log <span class="sy0">/</span>var<span class="sy0">/</span>log<span class="sy0">/</span>nginx<span class="sy0">/</span><span class="br0">[</span>Domain<span class="br0">]</span>.error.log;   include includes<span class="sy0">/</span>letsencrypt.conf;   <span class="co0"># redirect all HTTP traffic to HTTPS.</span> location <span class="sy0">/</span> <span class="br0">{</span> <span class="kw3">return</span> <span class="nu0">302</span> https:<span class="sy0">//</span><span class="re1">$server_name</span><span class="re1">$request_uri</span>; <span class="br0">}</span> <span class="br0">}</span>   server <span class="br0">{</span> listen <span class="nu0">443</span> ssl http2 default_server; <span class="co0"># if your host doens't support IPv6, comment out the following line</span> listen <span class="br0">[</span>::<span class="br0">]</span>:<span class="nu0">443</span> ssl http2 default_server; server_name <span class="br0">[</span>Domain<span class="br0">]</span>;   <span class="co0"># We comment these out *after* we have successfully geneated our Let's Encrypt certificate for [Domain].</span> ssl_certificate <span class="sy0">/</span>etc<span class="sy0">/</span>ssl<span class="sy0">/</span>certs<span class="sy0">/</span>ssl-cert-snakeoil.pem; ssl_certificate_key <span class="sy0">/</span>etc<span class="sy0">/</span>ssl<span class="sy0">/</span>private<span class="sy0">/</span>ssl-cert-snakeoil.key; <span class="co0"># we start with these commented out until after we can generate our Let's Encrypt certificate for [Domain]!</span> <span class="co0">#ssl_certificate /etc/letsencrypt/live/[Domain]/fullchain.pem;</span> <span class="co0">#ssl_certificate_key /etc/letsencrypt/live/[Domain]/privkey.pem;</span> ssl_dhparam <span class="sy0">/</span>etc<span class="sy0">/</span>ssl<span class="sy0">/</span>certs<span class="sy0">/</span>dhparam.pem;   access_log <span class="sy0">/</span>var<span class="sy0">/</span>log<span class="sy0">/</span>nginx<span class="sy0">/</span><span class="br0">[</span>Domain<span class="br0">]</span>.access.log; error_log <span class="sy0">/</span>var<span class="sy0">/</span>log<span class="sy0">/</span>nginx<span class="sy0">/</span><span class="br0">[</span>Domain<span class="br0">]</span>.error.log;   location <span class="sy0">/</span> <span class="br0">{</span> proxy_http_version <span class="nu0">1.1</span>; <span class="co0"># for BBB 2.4, the port used is 48087. For earlier versions of BBB, it's 8080</span> proxy_pass http:<span class="sy0">//</span>127.0.0.1:<span class="nu0">48087</span>; proxy_set_header Host <span class="re1">$host</span>; proxy_set_header X-Real-IP <span class="re1">$remote_addr</span>; proxy_set_header X-Forwarded-For <span class="re1">$proxy_add_x_forwarded_for</span>; proxy_set_header X-Forwarded-Proto <span class="re1">$scheme</span>; proxy_set_header Upgrade <span class="re1">$http_upgrade</span>; <span class="co0">#proxy_set_header Connection $connection_upgrade;</span> proxy_set_header Connection <span class="st0">"Upgrade"</span>; proxy_cache_bypass <span class="re1">$http_upgrade</span>; <span class="br0">}</span> <span class="br0">}</span></pre></div></div> <p><em><strong>Update 2021-12-30</strong></em> With the release of BBB 2.4 a few weeks ago, the Docker configuration now has one 'breaking' change: the port has been changed to 48087! So, if you are installing an older version of BBB, the previous default was port 8080. If you get a 502 error after setting up your containers, check to make sure you haven't been bitten by this little detail!</p> <p>Right - back to the process...</p> <p>After creating it, we have to 'enable' the configuration:</p> <p><code>sudo ln -sf /etc/nginx/sites-available/$SITE /etc/nginx/sites-enabled/</code></p> <p>It's also not a bad idea to disable the Nginx default configuration, as it can sometimes interfere with things:</p> <p><code>sudo rm /etc/nginx/sites-enabled/default</code></p> <h3><a id="user-content-extra-security-with-dhparampem" href="#extra-security-with-dhparampem" name="extra-security-with-dhparampem" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Extra security with dhparam.pem</h3> <p>We're going to create a 'dhparam' certificate for your configuration. These take a long time to generate - between 10-30 minutes, depending not on the speed of your computer, but on the rate at which it creates 'random events' that allow it to create a suitablely complex random prime number.</p> <p><code>sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048</code></p> <p>If your time isn't limited, you can increase the size of your dhparam from 2048 to 4096 - it'll take quite a lot longer to create.</p> <p>Ok - now that we've created our dhparam.pem, referenced in our Nginx configuration for [Domain], we should have everything in place. We can now test Nginx's configuration:</p> <p><code>sudo nginx -t</code></p> <p>If you don't get any errors or warnings, you can activate the new configuration:</p> <p><code>sudo service nginx reload</code></p> <p>You server should now successfully respond to your [Domain], but it'll redirect to HTTPS using the default (self-signed) certificates that are valid as far as Nginx is concerned, but your browser won't let you access the page due to those inappropriate certificates. You can test it by putting <code>http://[Domain]</code> into your browser and seeing if it redirects you to <code>https://[Domain]</code> and a 'bad certificate` (or similar) page.</p> <p>To fix that, we can now generate a Let's Encrypt certificate which <em>will</em> be valid.</p> <p><code>sudo letsencrypt certonly --webroot -w /var/www/letsencrypt -d ${SITE}</code></p> <p>Since this is your first time running the letsencrypt script, you'll be asked for a contact email (so the Let's Encrypt system can warn you if your certificates are going to be expiring soon!) - use your [Admin email] for this. You can also opt in to allowing them to get anonymous statistics from your site.</p> <p>Once you've done that, the Let's Encrypt system will verify that you (the person requesting the certificate) also controls the server that's requesting it (using the details specified in the <code>/etc/nginx/includes/letsencrypt.conf</code> file, along with data that the letsencrypt script writes into a special file in the <code>/var/www/letsencrypt</code> directory) and, all going well, you'll see a "Congratulations!" message telling you that you have new certificates for your [Domain].</p> <p>Now is a good time to check if your renew-hook worked properly - there should now be two files in <code>/etc/coturn-ssl</code>, namely <code>fullchain.pem</code> and <code>privkey.pem</code>. If that's not the case, something might have gone wrong.</p> <p>Then you can re-edit your Nginx confguration file:</p> <p><code>sudo $EDIT /etc/nginx/sites-available/$SITE</code></p> <p>and comment out the default certificates and uncomment the [Domain]-specific certificates, like this (we'll assume you've already got your [Domain] substituted!):</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">  ...   <span class="co0"># We comment these out *after* we have successfully geneated our Let's Encrypt certificate for [Domain].</span> <span class="co0">#ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;</span> <span class="co0">#ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key; </span> <span class="co0"># we start with these commented out until after we can generate our Let's Encrypt certificate for [Domain]!</span> ssl_certificate <span class="sy0">/</span>etc<span class="sy0">/</span>letsencrypt<span class="sy0">/</span>live<span class="sy0">/</span><span class="br0">[</span>Domain<span class="br0">]</span><span class="sy0">/</span>fullchain.pem; ssl_certificate_key <span class="sy0">/</span>etc<span class="sy0">/</span>letsencrypt<span class="sy0">/</span>live<span class="sy0">/</span><span class="br0">[</span>Domain<span class="br0">]</span><span class="sy0">/</span>privkey.pem; ssl_dhparam <span class="sy0">/</span>etc<span class="sy0">/</span>ssl<span class="sy0">/</span>certs<span class="sy0">/</span>dhparam.pem;   ...  </pre></div></div> <p>Once you've got that going, you again check to make sure your Nginx config is valid:</p> <p><code>sudo nginx -t</code></p> <p>and apply your configruation changes:</p> <p><code>sudo service nginx reload</code></p> <p>If you now go to <code>http://[Domain]</code> in your browser, you should be redirected to <code>https://[Domain]</code> and you shouldn't get any <em>certificate</em> errors, although you might get a "502" error because the service that reverse proxy configuration is trying to send you to doesn't yet exist! That's what we're expecting.</p> <p>One more thing - we need to make sure that the <code>coturn.sh</code> renewal hook script has run. We can check to make sure that there are two files, <code>fullchain.pem</code> and <code>privkey.pem</code> in the <code>/etc/coturn-ssl</code> directory. If we start the Docker containers before these files exist, the Docker daemon creates them <em>as directories</em> by default which can lead to all sorts of trickiness. Run</p> <p><code>sudo ls -l /etc/coturn-ssl/</code></p> <p>and make sure you get a result like this:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="re5">-rw-r--r--</span> <span class="nu0">1</span> root root <span class="nu0">5588</span> Dec <span class="nu0">13</span> 08:<span class="nu0">42</span> fullchain.pem <span class="re5">-rw-------</span> <span class="nu0">1</span> root root <span class="nu0">1704</span> Dec <span class="nu0">13</span> 08:<span class="nu0">42</span> privkey.pem</pre></div></div> <h2><a id="user-content-install-docker" href="#install-docker" name="install-docker" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Install Docker</h2> <p>Now we have to set up the Docker container support by first registering a new package source...</p> <p><code>sudo apt-get install -y apt-transport-https curl gnupg lsb-release</code></p> <p><code>sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg</code></p> <p><code>sudo echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list &gt; /dev/null</code></p> <p>updating our list of available packages to include the Docker-related packages...</p> <p><code>sudo apt-get update</code></p> <p>and then install them:</p> <p><code>sudo apt-get install -y docker-ce docker-ce-cli containerd.io</code></p> <p>Which installs a bunch of dependencies as well.</p> <p>To make sure that our non-root user can talk to the Docker server, we need to jump through a couple more hoops:</p> <p><code>sudo addgroup docker</code></p> <p><code>sudo adduser dave docker</code></p> <p>After doing this, the easiest thing is to log out and log back in again to make sure my user can access the new permissions. To confirm that my user has docker group privileges, I can run</p> <p><code>id</code></p> <p>which should give a result like</p> <p><code>uid=1000(dave) gid=1000(dave) groups=1000(dave),4(adm),27(sudo),1001(docker)</code></p> <p>with the latter being the confirmation.</p> <h2><a id="user-content-install-docker-compose" href="#install-docker-compose" name="install-docker-compose" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Install Docker-compose</h2> <p>Now we're almost to the BigBlueButton part - we just need to install the Docker Compose framework:</p> <p><code>sudo apt install python3-pip</code></p> <p><code>sudo pip install -U pip</code></p> <p><code>sudo pip install -U docker-compose</code></p> <p>Once you've done that, you should be able to run <code>docker-compose</code> at your command prompt and it should give you the docker-compose help page. If so, great work! Almost there.</p> <h2><a id="user-content-git-clone-bbb-docker-repository" href="#git-clone-bbb-docker-repository" name="git-clone-bbb-docker-repository" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Git-Clone BBB Docker repository</h2> <p>Now it's time to install the set of Docker containers that make up the BigBlueButton stack of coordinated services.</p> <p>We make a place for the docker configuration and data to live:</p> <p><code>sudo mkdir -p /home/docker/</code></p> <p>go into it</p> <p><code>cd /home/docker</code></p> <p>and then we use the magic of 'git' (if you don't know it, this is one of the single most powerful tools programmers use - everyone would benefit from knowing how 'version control' works - git is by far the most widely used version control aka 'source code control' system in the world. It's open source.) to 'clone' the BigBlueButton developers' Docker definitions code:</p> <p><code>sudo git clone -b main --recurse-submodules https://github.com/bigbluebutton/docker.git bbb-docker</code></p> <p>That command puts all the code into a directory called <code>bbb-docker</code> so let's go there:</p> <p><code>cd bbb-docker</code></p> <p>and in there, we run this command to gram a second layer of code that is referenced by the first layer we already downloaded in the previous step:</p> <p><code>sudo git submodule update --init</code></p> <p>Finally, we run this handy script provided by the BBB developers to set up a working Docker Compose configuration:</p> <p><code>sudo ./scripts/setup</code></p> <p>This will script will ask you some questions about your system. These are the questions <em>and</em> the answers we'll use - note, where I've written [IPv4] and [IPv6] below, you should see the actual IPv4 and IPv6 addresses for your server:</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1">Should greenlight be included? <span class="br0">(</span>y<span class="sy0">/</span>n<span class="br0">)</span>: y Should an automatic HTTPS Proxy be included? <span class="br0">(</span>y<span class="sy0">/</span>n<span class="br0">)</span>: n Should a coturn be included? <span class="br0">(</span>y<span class="sy0">/</span>n<span class="br0">)</span>: y Coturn needs TLS to <span class="kw1">function</span> properly. Since automatic HTTPS Proxy is disabled, you must provide a relative or absolute path to your certificates. Please enter path to cert.pem: <span class="sy0">/</span>etc<span class="sy0">/</span>coturn-ssl<span class="sy0">/</span>fullchain.pem Please enter path to key.pem: <span class="sy0">/</span>etc<span class="sy0">/</span>coturn-ssl<span class="sy0">/</span>privkey.pem Should a Prometheus exporter be included? <span class="br0">(</span>y<span class="sy0">/</span>n<span class="br0">)</span>: y Please enter the domain name: bbbtest.milll.ws Should the recording feature be included? IMPORTANT: this is currently a big privacy issues, because it will record everything <span class="kw2">which</span> happens <span class="kw1">in</span> the conference, even when the button suggests, that it does not. <span class="kw2">make</span> sure that you always get people<span class="st_h">'s consent, before they join a room! https://github.com/bigbluebutton/bigbluebutton/issues/9202 Choice (y/n): y Is [IPv4] your external IPv4 address? (y/n): y Is [IPv6] your external IPv6 address? (y/n): y</span></pre></div></div> <p>Once you finish answering these questions, the script creates a file called <code>.env</code> (the leading '.' means it's a 'hidden' file that won't show up in normal directory listings - you have to know it's there, as it holds important system values and shouldn't be deleted.</p> <h2><a id="user-content-configure-your-bbb" href="#configure-your-bbb" name="configure-your-bbb" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Configure your BBB</h2> <p>But now, we're going to tweak it, because it holds all the important customised values we need to configure our BigBlueButton service.</p> <p><code>sudo $EDIT .env</code></p> <p>When you're editing the file, scroll down through it and adjust the values you find as follows.</p> <p>Uncomment this one</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="re2">ALLOW_MAIL_NOTIFICATIONS</span>=<span class="kw2">true</span></pre></div></div> <p>Set the following</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="re2">SMTP_SERVER</span>=<span class="br0">[</span>SMTP server<span class="br0">]</span> <span class="re2">SMTP_PORT</span>=<span class="br0">[</span>SMTP port<span class="br0">]</span> <span class="re2">SMTP_DOMAIN</span>=<span class="br0">[</span>Domain<span class="br0">]</span> <span class="re2">SMTP_USERNAME</span>=<span class="br0">[</span>SMTP username<span class="br0">]</span> <span class="re2">SMTP_PASSWORD</span>=<span class="br0">[</span>SMTP password<span class="br0">]</span> <span class="re2">SMTP_AUTH</span>=plain <span class="re2">SMTP_STARTTLS_AUTO</span>=<span class="kw2">true</span> <span class="co0">#</span> <span class="re2">SMTP_SENDER</span>=<span class="br0">[</span>Outgoing email<span class="br0">]</span></pre></div></div> <p>and finally set</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"><span class="re2">DEFAULT_REGISTRATION</span>=invite</pre></div></div> <p>This last one makes it possible for you to invite external people to make use of your BigBlueButton instance - they can create a log in and create their own rooms over which they'll have some control. These can be people in your organisation or community for whom you want your BBB to be available as a resource.</p> <h3><a id="user-content-fix-minor-configuration-error-that-blocks-jodconverter" href="#fix-minor-configuration-error-that-blocks-jodconverter" name="fix-minor-configuration-error-that-blocks-jodconverter" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Fix minor configuration error that blocks JODConverter</h3> <p>One of the containers used in the BBB stack is called <a href="https://github.com/bigbluebutton/docker/tree/develop/mod/jodconverter">JODConverter</a> which, in standard Free and Open Source Software tradition, makes use of an <a href="https://github.com/EugenMayer/docker-image-jodconverter">'upstream' development</a> by another developer, <a href="https://github.com/EugenMayer">EugenMayer</a>, which in turn makes use of an <a href="https://hub.docker.com/r/bellsoft/liberica-openjdk-debian">upstream development</a>...</p> <p>The issue is that a recent update (in early December 2021) has broken the process of launching this container. This is a big problem because the JODConverter provides the services of converting uploaded presentations and downloaded documents (like BBB's Public Chat or Shared Notes) in various useful file formats.</p> <p>Turns out the fix is easy. While still in <code>bbb-docker</code>, Just run</p> <p><code>sudo $EDIT mod/jodconverter/Dockerfile</code></p> <p>and add the following line to the very bottom of the file:</p> <p><code>CMD ["--spring.config.additional-location=optional:/etc/app/"]</code></p> <p>Save it, and you're done. I have <a href="https://github.com/bigbluebutton/docker/issues/178">submitted an issue</a> with the fix I've found to the <code>bigbluebutton/docker</code> project.</p> <p>Once that configuration is done, it's finally time to...</p> <h2><a id="user-content-build-your-bbb" href="#build-your-bbb" name="build-your-bbb" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Build your BBB</h2> <p>The first time it's run, this command will trigger the building of a set of no less than 22 separate Docker containers, each running its own crucial service as part of the BigBlueButton stack.</p> <p><code>sudo docker-compose up -d</code></p> <p><em>Note: this process can take a LONG time, like an hour or more</em> depending on your server's internet connection speed.</p> <p>If you want to see how long it takes the first time, run this instead:</p> <p><code>sudo time docker-compose up -d</code></p> <p>which will give you a readout of the time the command takes to complete.</p> <h2><a id="user-content-visit-your-new-bbb" href="#visit-your-new-bbb" name="visit-your-new-bbb" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Visit your new BBB</h2> <p>Once you next see the command prompt ($ or #), it means that your BBB system is starting up. You can see the status of the containers by running</p> <p><code>sudo docker-compose ps</code></p> <p>which should give you something that looks like this, once everything is running (it might take a few minutes!):</p> <div class="geshifilter"><div class="bash geshifilter-bash"><pre class="de1"> Name Command State Ports <span class="re5">-----------------------------------------------------------------------------------------------------------</span> bbb-docker_apps-akka_1 <span class="sy0">/</span>bin<span class="sy0">/</span><span class="kw2">sh</span> <span class="re5">-c</span> dockerize - ... Up bbb-docker_bbb-web_1 <span class="sy0">/</span>entrypoint.sh Up <span class="br0">(</span>healthy<span class="br0">)</span> bbb-docker_coturn_1 docker-entrypoint.sh <span class="re5">--ext</span> ... Up bbb-docker_etherpad_1 <span class="sy0">/</span>entrypoint.sh Up <span class="nu0">9001</span><span class="sy0">/</span>tcp bbb-docker_freeswitch_1 <span class="sy0">/</span>bin<span class="sy0">/</span><span class="kw2">sh</span> <span class="re5">-c</span> <span class="sy0">/</span>entrypoint.sh Up bbb-docker_fsesl-akka_1 <span class="sy0">/</span>bin<span class="sy0">/</span><span class="kw2">sh</span> <span class="re5">-c</span> dockerize - ... Up bbb-docker_greenlight_1 bin<span class="sy0">/</span>start Up 10.7.7.1:<span class="nu0">5000</span>-<span class="sy0">&gt;</span><span class="nu0">80</span><span class="sy0">/</span>tcp bbb-docker_html5-backend-<span class="nu0">1</span>_1 <span class="sy0">/</span>entrypoint.sh Up bbb-docker_html5-backend-<span class="nu0">2</span>_1 <span class="sy0">/</span>entrypoint.sh Up bbb-docker_html5-frontend-<span class="nu0">1</span>_1 <span class="sy0">/</span>entrypoint.sh Up bbb-docker_html5-frontend-<span class="nu0">2</span>_1 <span class="sy0">/</span>entrypoint.sh Up bbb-docker_jodconverter_1 <span class="sy0">/</span>docker-entrypoint.sh <span class="re5">--sp</span> ... Up bbb-docker_kurento_1 <span class="sy0">/</span>entrypoint.sh Up <span class="br0">(</span>healthy<span class="br0">)</span> bbb-docker_mongodb_1 docker-entrypoint.sh mongo ... Up <span class="br0">(</span>healthy<span class="br0">)</span> <span class="nu0">27017</span><span class="sy0">/</span>tcp bbb-docker_nginx_1 <span class="sy0">/</span>docker-entrypoint.sh ngin ... Up bbb-docker_periodic_1 <span class="sy0">/</span>entrypoint.sh Up bbb-docker_postgres_1 docker-entrypoint.sh postgres Up <span class="br0">(</span>healthy<span class="br0">)</span> <span class="nu0">5432</span><span class="sy0">/</span>tcp bbb-docker_prometheus-exporter_1 python server.py Up <span class="nu0">9688</span><span class="sy0">/</span>tcp bbb-docker_recordings_1 <span class="sy0">/</span>bin<span class="sy0">/</span><span class="kw2">sh</span> <span class="re5">-c</span> <span class="sy0">/</span>entrypoint.sh Up bbb-docker_redis_1 docker-entrypoint.sh redis ... Up <span class="br0">(</span>healthy<span class="br0">)</span> <span class="nu0">6379</span><span class="sy0">/</span>tcp bbb-docker_webhooks_1 <span class="sy0">/</span>bin<span class="sy0">/</span><span class="kw2">sh</span> <span class="re5">-c</span> <span class="sy0">/</span>entrypoint.sh Up bbb-docker_webrtc-sfu_1 .<span class="sy0">/</span>docker-entrypoint.sh npm ... Up 127.0.0.1:<span class="nu0">3008</span>-<span class="sy0">&gt;</span><span class="nu0">3008</span><span class="sy0">/</span>tcp</pre></div></div> <p>At that point, you can visit <code>https://[Domain]</code> and instead of a 502 error, you should see the BigBlueButton 'Greenlight' front page.</p> <p>Now the final step...</p> <h2><a id="user-content-create-an-admin-user" href="#create-an-admin-user" name="create-an-admin-user" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Create an admin user:</h2> <p>To create an admin user, you run this:</p> <p><code>sudo docker-compose exec greenlight bundle exec rake admin:create</code></p> <p>It will give you a login email address and a randomly generated password. Use these to log in. In the profile (top right Admin menu dropdown), you can alter the admin user's email to a real email (perhaps [Admin email]?), and change the password if you like.</p> <p>Then you can go back to the Admin menu and select "Organisation" which should put you on the Manage Users page. You then invite yourself to join as a user by sending yourself an email (which, if your SMTP settings are correct, will work). If you don't receive it in a minute or two, check your spam folder.</p> <p>Either log out of Greenlight before clicking the link in the email or open the link (by copying and pasting it) in a different browser where you're not logged in to this Greenlight instance, and create a user account for yourself.</p> <p>Then log back into Greenlight as the Admin user (if you've previously logged out) and refresh the "Manage Users" page. You should find your newly created user. Select 'Edit' from the vertical 3 dotted menu. On the "Update your Account Info" page, set the User Role for your user to 'Admin" and click the "Update" button. You should now be able to log out as Admin, and back in as your own user, but with administrative privileges.</p> <h2><a id="user-content-run-your-first-conference" href="#run-your-first-conference" name="run-your-first-conference" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Run your first conference</h2> <p>Now it's time to try running a video conference. Click on the "Home" link (top right menu) and you should see that you have a default room called "Home Room" with a URL specified in the form [Domain]/b/[first 3 letters of your name]-[3 random hex digits]-[3 more random hex digits]. For me, it might look something like this: https://[Domain]/b/dav-a5b-73z</p> <p>Click "Start" to initiate a conference in that Home Room.</p> <p>In the conference room, you should select 'Microphone' so you can test speaking and listening, and also test your video camera (assming you have access to both on the computing device you're using to access BBB - note, a modern cellphone normally offers all of these.</p> <p><em>We always encourage people participating in video conferences (regardless of the technology) to employ headphones to separate the audio from the conference form their input. It greatly improves the audio quality for all involved!</em>.</p> <p>If you select 'Microphone', there will be a brief delay whil your browser negotiates with the COTURN server in your BBB stack to link your data and audio channels. Once it's done that, it will give you an "echo test" window (see included screen shots). You should speak into your microphone when you see that screen and check whether you can hear yourself. This will confirm that your audio settings are right (or not) and will help the BBB system adjust its echo cancellation algorithms.</p> <p>You can then also clidk the 'camera' icon (bottom middle of the page) to activate your webcam if you have one (or choose one if you have multiple cameras) as well as the video quality.</p> <p>You can also try to 'Start recording' if you want to test your ability to record a session. Note that there is a delay after the end of a session in which you've recorded before the recording is displayed on the 'room' page in Greenlight. It might take minutes or even hourse to generate depending on the power of your server and the length of the session.</p> <p>To see other administrative functionality including moderation and breakout rooms, click on the "gear" icon next to the "Users" heading in the left hand column. You can also experiment with the "Public Chat" and the "Shared Notes". Both can be saved at any time (via the top right 3 dot menu in that section) and will be included in any recordings you make.</p> <p><em>Note</em> the contents of Public Chat and Shared Notes will be wiped at the end of a session unless you explicitly save them or record the session (at least briefly at the end).</p> <p>You can provide that "room address" to anyone and they can join your room (via an modern browser) when you have a session running. Alternatively, you can click on the 3 dotted menu associated with your room below the 'Search for room" form, and change the default properties of your room, including configuring it to let anyone who knows the room's address start a session. You can also create additional rooms (as an Admin user, you can set the limits on many of these properties via Organisation in the top right menu under your user name.</p> <p>Have fun with your new, world class, cost-effective, large-scale BigBlueButton video conferencing application!</p> <h2><a id="user-content-next-steps" href="#next-steps" name="next-steps" class="heading-permalink" aria-hidden="true" title="Permalink"></a>Next Steps</h2> <p>In a future tutorial, we'll provide information on how to troubleshoot BBB issues, how to upgrade it as new versions are made available by developers, and how to ensure that your recordings, user database, and configuration are backed up incrementally, encrypted, in remote storage.</p></div> </div> </div> <section class="field field-node--field-blog-comments field-name-field-blog-comments field-type-comment field-label-above comment-wrapper"> <a name="comments"></a> <h2 class="comment-field__title">Blog comments</h2> <article data-comment-user-id="0" id="comment-826" about="/comment/826" typeof="schema:Comment" class="comment js-comment by-anonymous has-title clearfix"> <div class="comment__container"> <h3 property="schema:name" datatype="" class="comment__title"> <a href="/comment/826#comment-826" class="permalink" rel="bookmark" hreflang="en">It says in the nginx-config…</a> <span class="comment__new marker marker--success hidden" data-comment-timestamp="1641281859"></span> </h3> <div class="comment__meta"> <div class="comment__submitted"> <span class="comment__author"><span rel="schema:author"><span lang="" typeof="schema:Person" property="schema:name" datatype="">LPup (not verified)</span></span> </span> <span class="comment__pubdate">Tue 04/01/2022 - 20:32 <span property="schema:dateCreated" content="2022-01-04T07:32:09+00:00" class="rdf-meta hidden"></span> </span> </div> </div> <div class="comment__content"> <div property="schema:text" class="clearfix text-formatted field field-comment--comment-body field-name-comment-body field-type-text-long field-label-hidden"> <div class="field__items"> <div property="schema:text" class="field__item"><p>It says in the nginx-config to change the port for the proxy and not forget to change it in the .env file. Where do I need to put what into the .env file for using a different port than 8080?</p> </div> </div> </div> <drupal-render-placeholder callback="comment.lazy_builders:renderLinks" arguments="0=826&amp;1=default&amp;2=en&amp;3=" token="ab5iIZGMF89MSnCPgbrcuI7yHqfoKEyjDb9VtJ299fg"></drupal-render-placeholder> </div> </div> </article> <div class="indented"><article data-comment-user-id="1" id="comment-827" about="/comment/827" typeof="schema:Comment" class="comment js-comment by-node-author has-title clearfix"> <div class="comment__container"> <h3 property="schema:name" datatype="" class="comment__title"> <a href="/comment/827#comment-827" class="permalink" rel="bookmark" hreflang="en">Hmm - thanks for pointing…</a> <span class="comment__new marker marker--success hidden" data-comment-timestamp="1641282307"></span> </h3> <div class="comment__meta"> <div class="comment__submitted"> <span class="comment__author"><span rel="schema:author"><a title="View user profile." href="/user/1" lang="" about="/user/1" typeof="schema:Person" property="schema:name" datatype="" class="username">dave</a></span> </span> <span class="comment__pubdate">Tue 04/01/2022 - 20:44 <span property="schema:dateCreated" content="2022-01-04T07:44:02+00:00" class="rdf-meta hidden"></span> </span> </div> </div> <div class="comment__content"> <p class="comment__parent visually-hidden">In reply to <a href="/comment/826#comment-826" class="permalink" rel="bookmark" hreflang="en">It says in the nginx-config…</a> by <span lang="" typeof="schema:Person" property="schema:name" datatype="">LPup (not verified)</span></p> <div property="schema:text" class="clearfix text-formatted field field-comment--comment-body field-name-comment-body field-type-text-long field-label-hidden"> <div class="field__items"> <div property="schema:text" class="field__item"><p>Hmm - thanks for pointing that out. Yes, I think I made an error with that instruction (I've updated the Nginx config). If you implement BBB today via this set of instructions, you'll be installing BBB 2.4 - port 8080 was used in 2.3 and earlier versions. For 2.4, use port 48087. To be honest, I'm not sure of the right way to alter it if you have to due to other services running on the same system. Writing it manually in the docker-compose.yml file will be overwritten the next time you do an update... It might be necessary to change the port specified in the relevant container's Dockerfile under <code>mods</code>...</p></div> </div> </div> <drupal-render-placeholder callback="comment.lazy_builders:renderLinks" arguments="0=827&amp;1=default&amp;2=en&amp;3=" token="IQwvVUQ-NlVwsrO5mMYIbQJJDVotfViSFCA7rOx4_Aw"></drupal-render-placeholder> </div> </div> </article> </div> <div class="comment-form-wrapper"> <h2 class="comment-form__title">Add new comment</h2> <drupal-render-placeholder callback="comment.lazy_builders:renderForm" arguments="0=node&amp;1=46&amp;2=field_blog_comments&amp;3=comment" token="bVuNCPDsukUifzhtwLxvL6UanvQCaG2zyJeoiuzQckE"></drupal-render-placeholder> </div> </section> Wed, 10 Nov 2021 02:42:41 +0000 dave 46 at http://tech.oeru.org Configuring a Linux server to send email via the Postfix SMTP server using an external authenticating SMTP host http://tech.oeru.org/configuring-linux-server-send-email-postfix-smtp-server-using-external-authenticating-smtp-host <span class="field field--name-title field--type-string field--label-hidden">Configuring a Linux server to send email via the Postfix SMTP server using an external authenticating SMTP host</span> <div class="field field-node--field-blog-tags field-name-field-blog-tags field-type-entity-reference field-label-above"> <h3 class="field__label">Blog tags</h3> <div class="field__items"> <div class="field__item field__item--ubuntu-linux"> <span class="field__item-wrapper"><a href="/taxonomy/term/12" hreflang="en">ubuntu linux</a></span> </div> <div class="field__item field__item--postfix"> <span class="field__item-wrapper"><a href="/taxonomy/term/66" hreflang="en">postfix</a></span> </div> <div class="field__item field__item--smtp"> <span class="field__item-wrapper"><a href="/taxonomy/term/67" hreflang="en">smtp</a></span> </div> <div class="field__item field__item--_804"> <span class="field__item-wrapper"><a href="/taxonomy/term/68" hreflang="en">18.04</a></span> </div> <div class="field__item field__item--free--open-source"> <span class="field__item-wrapper"><a href="/taxonomy/term/6" hreflang="en">free &amp; open source</a></span> </div> <div class="field__item field__item--foss"> <span class="field__item-wrapper"><a href="/taxonomy/term/10" hreflang="en">foss</a></span> </div> <div class="field__item field__item--_004"> <span class="field__item-wrapper"><a href="/taxonomy/term/75" hreflang="en">20.04</a></span> </div> <div class="field__item field__item--_204"> <span class="field__item-wrapper"><a href="/taxonomy/term/85" hreflang="en">22.04</a></span> </div> </div> </div> <span class="field field--name-uid field--type-entity-reference field--label-hidden"><a title="View user profile." href="/user/1" lang="" about="/user/1" typeof="schema:Person" property="schema:name" datatype="" class="username">dave</a></span> <span class="field field--name-created field--type-created field--label-hidden">Mon 02/08/2021 - 14:08</span> <div class="clearfix text-formatted field field-node--body field-name-body field-type-text-with-summary field-label-hidden"> <div class="field__items"> <div class="field__item"><p>Just about any and every server needs to be able to send email - whether it's end-user-email, like password recovery services for a website to emails to system administrators reporting on the status of system backups and errors. The problem is that it's <em>non trivial</em> (understatement) to set up a mail server properly.</p> <p>This howto assumes you have a Linux server (these instructions are for Ubuntu 22.04 and 20.04, although it should work on earlier versions of Ubuntu server and Debian Linux with minor changes, and the concepts will be very similar on other Linuxen) with a static IP address, with one or more fully-qualified-domain-names (fdqn) pointing at that address, and you have SSH-based access to it. I've <a href="/setting-your-own-bitwarden-password-keeper-and-sync-server">previously provided tips</a> on how to get to this stage.</p> <h2>Authenticating SMTP</h2> <p>To send email, you need access to a server, somewhere on the Internet, that provides the <a href="https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol">Simple Mail Transfer Protocol</a> (SMTP) service. It's an open standard, and for most of the history of the Internet, email services have been mostly provided by Free and Open Source Software (FOSS) tools - the first SMTP was called "<a href="https://en.wikipedia.org/wiki/Sendmail">Sendmail</a>" and it was fully FOSS, and it's still in use today (although it has mostly been superseded by faster, more secure systems, the best of which are also FOSS).</p> <p>At the OERu, we use the <a href="https://mailcow.github.io/mailcow-dockerized-docs/" title="Dockerised MailCow">Docker-based installation of the amazing, completely FOSS MailCow project</a> to provide our organisational email services. I might cover that set up in a future tutorial here, because MailCow makes an otherwise almost intractable problem - hosting your own email service - much more tractable. Having a MailCow set up means we can offer "full service" email for any number of domains and users and aliases with all the bells and whistles including incoming and outgoing mail with all the virus scanning (we don't really need it because we use Linux desktops, but for other folks it's useful) and dynamic spam filtering services you'd expect from a much larger operation: <a href="https://mailcow.email/">Team MailCow</a> have done an amazing job in pulling together a comprehensive set of FOSS applications to provide all the conceivable requirements of a full-fledged, multi-domain email system, including shared calendaring, contacts, and webmail. A great companion to your organisation's MailCow server would be a <a href="/setting-your-own-bitwarden-password-keeper-and-sync-server">BitWarden password safe</a> server (also FOSS)... just sayin'.</p> <p>So, now, assuming that we have a MailCow server or some other functionally equivalent SMTP service available (apparently you can <a href="https://support.google.com/a/answer/2956491">do this with Gmail</a>, if you're a paying using although because of Google's terms of use, we recommend finding a more trustworthy solution), we have the option of "authenticated SMTP" for outgoing email using credentials we can set up. For example, in MailCow, we can specify a domain we host, like say <strong>oeru.org</strong> (and for which we've defined an MX record and a few other relevant records as guided by MailCow administrative web interface). On top of that, we can specify a mailbox for a dedicated "send stuff from remote relay hosts" email address using that domain, like <strong><a href="mailto:smtp@oeru.org">smtp@oeru.org</a></strong>, with a strong password. With that, we can <em>securely </em>send email using that email address as the username and that password from <em>anywhere we have access to the Internet</em>.</p> <p>The <strong>only tricky part</strong> is that we have to ensure that whatever "reply to" email address we specify from our applications, say <strong><a href="mailto:notifications@tech.oeru.org">notifications@tech.oeru.org</a></strong>, is using a domain we <em>also host on the same server, </em>and that there's an <em>email alias</em> of that email address defined and set as "allow to send from <a href="mailto:smtp@oeru.org">smtp@oeru.org</a>" in the MailCow interface. If we haven't made sure of that, our mail server is likely to reject sending emails with that "mismatching" email address. This is a basic spam deterrence measure, which is for the best, despite sometimes making a email system administrator's life harder.</p> <p>Once we've got that (and it's easy once you've done it once or twice - I'm mostly writing this down now so I don't have to try to re-remember every time I need to set up a new server - and I hope it helps others, too), we can set up any server we control to send secure (and spam-filter-resilient) email. For what it's worth, too, MailCow uses Postfix as its SMTP server component (there're a bunch of other components, too).</p> <h2>Postfix SMTP with SmartHost</h2> <p>The first thing you need to do to create a postfix <a href="https://en.wikipedia.org/wiki/Smart_host">smarthost</a> is to install the postfix application on a new server (this assumes you're logged in with a user who has "sudo" - aka admin - permissions):</p> <p><code>sudo apt update &amp;&amp; sudo apt install postfix bsd-mailx</code></p> <p>During the install, you'll be asked to select a bunch of configuration parameters. Select the defaults except:</p> <ul><li>Select "Internet Site with Smarthost",</li> <li>fill in the domain name for your server,</li> <li>the domain name and port (in the form <code>[smtp server domain]:[port]</code>, e.g. <code>smtp.oeru.org:587</code> ) of your "smarthost" who'll be doing the authenticating SMTP for you, and</li> <li>the email address to which you want to receive system-related messages.</li> </ul><p>After that's done, you can proceed.</p> <h2>Next Steps</h2> <p>For the rest of this tutorial, you'll need to do the following. First, select your text editor. I use vim, but if you're new to the command line, I recommend using nano - it's more straightforward:</p> <p><code>EDIT=`which nano`</code> or <code>EDIT=`which vim`</code></p> <p><code>sudo $EDIT /etc/aliases</code></p> <p>We need to make sure the "root" user points to a real email address. Add a line at the bottom which says (replacing [your email] with <em>your email :) </em>)</p> <p><code>root: [your email]</code></p> <p>After which you'll need to convert the aliases file into a form that postfix can process, simply by running this:</p> <p><code>sudo newaliases</code></p> <p>Then we have to define the authentication credentials required to convince your mail server that you're you!</p> <p><code>sudo $EDIT /etc/postfix/relay_password</code></p> <p>The resulting file only needs one line with three bits of information:</p> <p><code>[smtp server domain] [user name]:[password]</code></p> <p>for example:</p> <p><code>smtp.oeru.org smtp@oeru.org:SomeObscurePassw0rd</code></p> <p>Then save the file and, like the aliases file, run the conversion process (which uses a slightly different mechanism):</p> <p><code>sudo postmap /etc/postfix/relay_password</code></p> <p>Finally, we'll edit the main configuration file for Postfix to tell it about all this stuff:</p> <p><code>sudo $EDIT /etc/postfix/main.cf</code></p> <p>If your SMTP server uses port 25 (the default for <em>unencrypted</em> SMTP) you don't have to change anything, although most people nowadays prefer to use StartTLS or otherwise encrypted transport to at least ensure that your SMTP authentication details (<em>at least</em>) are transferred encrypted. That means using port 587 or 465. If you're using either of those ports, find the "relayhost = [your server name]" line... and add your port number after a colon, like this</p> <p><code>relayhost = [your server name]:[server port] </code></p> <p>or, for example:</p> <p><code>relayhost = smtp.oeru.org:465 </code></p> <p>Next, add the following lines at the bottom of the file:</p> <p><code># added to configure accessing the relay host via authenticating SMTP<br /> smtp_sasl_auth_enable = yes<br /> smtp_sasl_password_maps = hash:/etc/postfix/relay_password<br /> smtp_sasl_security_options = noanonymous</code><br /><code>smtp_tls_security_level = encrypt</code></p> <p><code># if you're using Ubuntu prior to 20.04, uncomment (remove the #) the </code><br /><code># earlier line smtp_tls_security_level = may to save errors in 'postfix check'<br /> # and comment this line (by adding a # at the start)<br /> smtp_tls_wrappermode = yes</code></p> <p>And, finally, comment out the line <code>smtp_tls_security_level = may</code> higher in the file - careful not to confuse it with the very similar <code>smtpd_tls_security_level</code> variable (note the extra '''d''' in `smtpd...`) line.</p> <p>Save the file, and then check that your syntax is correct:</p> <p><code>sudo postfix check</code></p> <p>If it is (running the command returns no errors, and it might not return anything at all - that's a good thing!), then you can run</p> <p><code>sudo postfix reload</code></p> <p>to get postfix to reload its configurations and you can test out your new smarthost-configured SMTP server!</p> <p>If not, the output of the check command will usually give you a helpful insight into what is wrong with your configuration... you'll also find that looking at the mail log is very helpful and offers great insights:</p> <p><code>sudo less +G /var/log/mail.log</code></p> <p>and if you're not able to fix it based on those, you'll find postfix is widely documented and has rich set of easily discoverable resources out there on the web - a search engine is your best resource!</p> <h2>Testing your outgoing email</h2> <p>By default, a command line application called "mail" is installed as part of the bsd-mailx package we installed alongside postfix. You can use it to send test email from the command line on your host to verify you've got things working correctly! The stuff in &lt;&gt; are the keys to hit at the end of the line...</p> <p><code>$ mail you@email.domain&lt;ENTER&gt;</code></p> <p><code>Subject: Testing from your.relay.server.domain&lt;ENTER&gt;<br /> Testing postfix remote host&lt;ENTER&gt;<br /> &lt;CTRL-D&gt;<br /> Cc:&lt;ENTER&gt;</code></p> <p>Typing &lt;CTRL-D&gt; (hold down the Control or Ctrl key on your keyboard and press the "d" key) will finish your message, showing you a "CC:" field, in which you can type in other email addresses if you want to test sending to multiple addresses. When you then hit &lt;ENTER&gt;, it will attempt to send this email. It might take a few minutes to work its way through to the receiving email system (having to run the gauntlet of spam and virus filters on the way).</p> <p>You can also always check the postfix system logs to see what postfix thinks about it using the command above. Hit &lt;SHIFT-F&gt; to have the log update in real time.</p> <h2>Done</h2> <p>Now you've got working outgoing email from your server. That means many higher-level web applications you might install on your infrastructure will work out-of-the-box, because what you've set up, for example, enables the default PHP email service and that used by other stacks.</p> <h2>Sending from Docker Containers</h2> <p>You can configure your server so you can reference it from services you run from Docker containers on your host. You do this by referencing the host, like via an ad hoc SMTP server on your container like <a href="https://marlam.de/msmtp/">msmtp</a>, and you can just reference it as 172.17.0.1, which is the default base IP for Docker hosts from the perspective of Docker containers. You might find it's different on your particular install. In that case, you have to make your Postfix SmartHost accept email for sending from the Docker containers on that server. There're quite a few examples of that among <a href="https://git.oeru.org/explore/projects?utf8=%E2%9C%93&amp;name=docker&amp;sort=latest_activity_desc">my Docker recipes on the OERu's git repository</a>.</p> </div> </div> </div> <section class="field field-node--field-blog-comments field-name-field-blog-comments field-type-comment field-label-above comment-wrapper"> <a name="comments"></a> <div class="comment-form-wrapper"> <h2 class="comment-form__title">Add new comment</h2> <drupal-render-placeholder callback="comment.lazy_builders:renderForm" arguments="0=node&amp;1=28&amp;2=field_blog_comments&amp;3=comment" token="lLRkGAi5P6j9iM99_jKG1YxvJLITyB02GoT7oM-A7oA"></drupal-render-placeholder> </div> </section> Mon, 02 Aug 2021 02:08:28 +0000 dave 28 at http://tech.oeru.org