search

nextcloud / vm

💻☁📦 The Nextcloud VM (virtual machine appliance), Home/SME Server and scripts for RPi (4). Community developed and maintained.
https://download.nextcloudvm.com
GNU General Public License v3.0
1.3k stars 656 forks source link

Talk recording complains about missing secret #2522

Closed enoch85 closed 1 year ago

enoch85 commented 1 year ago

@szaimen Can you please test the current implemantation?

I get this error when enabling recording in Talk.

root@test:~# docker logs talk-recording 
 * Serving Flask app 'nextcloud.talk.recording.Server'
 * Debug mode: off
ERROR:nextcloud.talk.recording.Server:Failed to start recording: https://test.danielhansson.nu/ 5nnvxhew
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/site-packages/nextcloud/talk/recording/Server.py", line 170, in _startRecordingService
    service.start(actorType, actorId)
  File "/usr/local/lib/python3.11/site-packages/nextcloud/talk/recording/Service.py", line 195, in start
    self._participant.joinCall(self.token)
  File "/usr/local/lib/python3.11/site-packages/nextcloud/talk/recording/Participant.py", line 458, in joinCall
    raise Exception(f"No configured signaling secret for {settings['server']}")
Exception: No configured signaling secret for https://talk.danielhansson.nu/

Config in /etc/signaling/server.conf

[http]
listen = 127.0.0.1:8081
[app]
debug = false
[sessions]
hashkey = 448bae565016473382fd0046ea417074
blockkey = b6cc417a2a258fba5621313410eff32e
[clients]
internalsecret = 3JOFfOUGu5nz8V6s1FNF2zzU1
[backend]
allowed = test.danielhansson.nu
allowall = false
secret = YMyFtWI2dlzKjLw@bU2LK**yp
timeout = 10
connectionsperhost = 8
[nats]
url = nats://localhost:4222
[mcu]
type = janus
url = ws://127.0.0.1:8188
[turn]
apikey = yxOWq#WWW1NuZTE*053Bc@MAB
secret = LmXhRQlamg@n9MO7buf5SfNgk
servers = turn:test.danielhansson.nu:3478?transport=tcp,turn:test.danielhansson.nu:3478?transport=udp
szaimen commented 1 year ago

Can you post the output of sudo docker inspect talk-recording here? Does the internalsecret match the configured one in the talk-hpb?

szaimen commented 1 year ago

Does it work if you remove

[turn]
apikey = xy5ZUgq9Ipej0x8eL9XoEssthg
secret = sxzfpmidYeQHrQ1sh8Ip9setB9
servers = turn:test.danielhansson.nu:3478?transport=tcp,turn:test.danielhansson.nu:3478?transport=udp

and restart both, the talk-hpb and talk-recording?

enoch85 commented 1 year ago

Can you post the output of sudo docker inspect talk-recording here? Does the internalsecret match the configured one in the talk-hpb?

[
    {
        "Id": "ed6412d5ba8c5ed82f2deef18e563be50aadc8f085d462dec204b01e8f87c999",
        "Created": "2023-07-20T09:38:58.506705435Z",
        "Path": "/start.sh",
        "Args": [
            "python",
            "-m",
            "nextcloud.talk.recording",
            "--config",
            "/etc/recording.conf"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 22573,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2023-07-20T09:39:08.988950883Z",
            "FinishedAt": "0001-01-01T00:00:00Z",
            "Health": {
                "Status": "healthy",
                "FailingStreak": 0,
                "Log": [
                    {
                        "Start": "2023-07-20T11:41:40.629528533+02:00",
                        "End": "2023-07-20T11:41:40.690084121+02:00",
                        "ExitCode": 0,
                        "Output": ""
                    },
                    {
                        "Start": "2023-07-20T11:42:10.705095349+02:00",
                        "End": "2023-07-20T11:42:10.761921071+02:00",
                        "ExitCode": 0,
                        "Output": ""
                    },
                    {
                        "Start": "2023-07-20T11:42:41.398797391+02:00",
                        "End": "2023-07-20T11:42:41.599447309+02:00",
                        "ExitCode": 0,
                        "Output": ""
                    },
                    {
                        "Start": "2023-07-20T11:43:12.480401563+02:00",
                        "End": "2023-07-20T11:43:12.5498607+02:00",
                        "ExitCode": 0,
                        "Output": ""
                    },
                    {
                        "Start": "2023-07-20T11:43:42.590106422+02:00",
                        "End": "2023-07-20T11:43:42.657546171+02:00",
                        "ExitCode": 0,
                        "Output": ""
                    }
                ]
            }
        },
        "Image": "sha256:c954e538b7441c648ad857766e2119157d7bd88a746be7743521f1541a1f7a0d",
        "ResolvConfPath": "/var/lib/docker/containers/ed6412d5ba8c5ed82f2deef18e563be50aadc8f085d462dec204b01e8f87c999/resolv.conf",
        "HostnamePath": "/var/lib/docker/containers/ed6412d5ba8c5ed82f2deef18e563be50aadc8f085d462dec204b01e8f87c999/hostname",
        "HostsPath": "/var/lib/docker/containers/ed6412d5ba8c5ed82f2deef18e563be50aadc8f085d462dec204b01e8f87c999/hosts",
        "LogPath": "/var/lib/docker/containers/ed6412d5ba8c5ed82f2deef18e563be50aadc8f085d462dec204b01e8f87c999/ed6412d5ba8c5ed82f2deef18e563be50aadc8f085d462dec204b01e8f87c999-json.log",
        "Name": "/talk-recording",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "docker-default",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": null,
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "default",
            "PortBindings": {
                "1234/tcp": [
                    {
                        "HostIp": "127.0.0.1",
                        "HostPort": "1234"
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "always",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "ConsoleSize": [
                55,
                238
            ],
            "CapAdd": null,
            "CapDrop": null,
            "CgroupnsMode": "private",
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "private",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 2147483648,
            "Runtime": "runc",
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": [],
            "BlkioDeviceReadBps": [],
            "BlkioDeviceWriteBps": [],
            "BlkioDeviceReadIOps": [],
            "BlkioDeviceWriteIOps": [],
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DeviceRequests": null,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": null,
            "PidsLimit": null,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ]
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/var/lib/docker/overlay2/34f36f84629747ee201c216c9d603f781e062eeab7a353406fdbfdba3010724f-init/diff:/var/lib/docker/overlay2/359dde50b8093242dd402eddac0802e0bc67ee953a71a23af2d660f226f4a4ed/diff:/var/lib/docker/overlay2/f5d2180c81116b42faa9d4ac8f1407222294707494fdd65ebf25fecdc4c13015/diff:/var/lib/docker/overlay2/651932b3de5e9d6f5275ef4f62a9e330508c8c9b1b3fde70eb921d5d4867dbe9/diff:/var/lib/docker/overlay2/737990f8468fd58c2b7bf59897ed4b5464ba471f77b14b08c796e01543ec8fba/diff:/var/lib/docker/overlay2/1ffc841f5d695a1ed0ca3025dbd6ee1eca46ca7dbf9a86aefd33492e77dc36c1/diff:/var/lib/docker/overlay2/a5024cdf0ec14927746e78b5110e11a96a7a1ebda27f152f7de4e7a0ceafe268/diff:/var/lib/docker/overlay2/ecdf42781e788df66b0f22f7ce212e023f4d031a0b1d158efd6b825db708e800/diff:/var/lib/docker/overlay2/ed5ceb86fe51d926847353966ff749d4d16c47f6dc9627266dd297f36bba8d78/diff",
                "MergedDir": "/var/lib/docker/overlay2/34f36f84629747ee201c216c9d603f781e062eeab7a353406fdbfdba3010724f/merged",
                "UpperDir": "/var/lib/docker/overlay2/34f36f84629747ee201c216c9d603f781e062eeab7a353406fdbfdba3010724f/diff",
                "WorkDir": "/var/lib/docker/overlay2/34f36f84629747ee201c216c9d603f781e062eeab7a353406fdbfdba3010724f/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [],
        "Config": {
            "Hostname": "ed6412d5ba8c",
            "Domainname": "",
            "User": "recording",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "1234/tcp": {}
            },
            "Tty": true,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "NC_DOMAIN=test.danielhansson.nu",
                "TZ=Europe/Stockholm",
                "RECORDING_SECRET=j1LBrKJx9m#g0SgJuWiX8Vax@",
                "INTERNAL_SECRET=3JOFfOUGu5nz8V6s1FNF2zzU1",
                "PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "LANG=C.UTF-8",
                "GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D",
                "PYTHON_VERSION=3.11.4",
                "PYTHON_PIP_VERSION=23.1.2",
                "PYTHON_SETUPTOOLS_VERSION=65.5.1",
                "PYTHON_GET_PIP_URL=https://github.com/pypa/get-pip/raw/0d8570dc44796f4369b652222cf176b3db6ac70e/public/get-pip.py",
                "PYTHON_GET_PIP_SHA256=96461deced5c2a487ddc65207ec5a9cffeca0d34e7af7ea1afc470ff0d746207",
                "RECORDING_VERSION=v17.0.0"
            ],
            "Cmd": [
                "python",
                "-m",
                "nextcloud.talk.recording",
                "--config",
                "/etc/recording.conf"
            ],
            "Healthcheck": {
                "Test": [
                    "CMD-SHELL",
                    "nc -z localhost 1234 || exit 1"
                ]
            },
            "Image": "nextcloud/aio-talk-recording",
            "Volumes": null,
            "WorkingDir": "/tmp",
            "Entrypoint": [
                "/start.sh"
            ],
            "OnBuild": null,
            "Labels": {
                "com.centurylinklabs.watchtower.monitor-only": "true"
            }
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "b8ad1952e437ab1f5a63f9a5a9253010ec89a6036407e73abb13aa06d2ee7dce",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "1234/tcp": [
                    {
                        "HostIp": "127.0.0.1",
                        "HostPort": "1234"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/b8ad1952e437",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "24b98f41ac3d100160417528defbfa7ac501754249605444767057827319c859",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.2",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:02",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "0bd851323b6a21bcb206621e7356535b8ea8caa87d488e5c4f8f6e162f5064d7",
                    "EndpointID": "24b98f41ac3d100160417528defbfa7ac501754249605444767057827319c859",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.2",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:02",
                    "DriverOpts": null
                }
            }
        }
    }
]

internalsecret seems to match.

szaimen commented 1 year ago

"RECORDING_SECRET=j1LBrKJx9m#g0SgJuWiX8Vax@",

maybe the problem are the special characters?

enoch85 commented 1 year ago

OK, so

  1. Change secret to only a-z-A-Z-0-9 and it didn't work
  2. Removed this and rebooted the server
[turn]
apikey = xy5ZUgq9Ipej0x8eL9XoEssthg
secret = sxzfpmidYeQHrQ1sh8Ip9setB9
servers = turn:test.danielhansson.nu:3478?transport=tcp,turn:test.danielhansson.nu:3478?transport=udp

No change. Still same error.

enoch85 commented 1 year ago

OK, now with the latest chnages:

1e8cc1c7c6ac:~$ cat /etc/recording.conf 
[logs]
level = 30

[http]
listen = 0.0.0.0:1234

[backend]
allowall = false
# TODO: remove secret below when https://github.com/nextcloud/spreed/issues/9580 is fixed
secret = @PTXKTDMYXTiafT#dNK1rWt6@Qq
backends = backend-1
skipverify = false
maxmessagesize = 1024
videowidth = 1920
videoheight = 1080
directory = /tmp

[backend-1]
url = https://test.danielhansson.nu
secret = @PTXKTDMYXTiafT#dNK1rWt6@Qq
skipverify = false

[signaling]
signalings = signaling-1

[signaling-1]
url = https://test.danielhansson.nu/standalone-signaling/
internalsecret = h3da1PLvAHiEI@4E2KZEDpDFKoo

[ffmpeg]
# outputaudio = -c:a libopus
# outputvideo = -c:v libvpx -deadline:v realtime -crf 10 -b:v 1M
extensionaudio = .ogg
extensionvideo = .webm
oot@test:~# cat /etc/signaling/server.conf 
[http]
listen = 127.0.0.1:8081

[app]
debug = false

[sessions]
hashkey = 9da3a476be70215713077746017cfe62
blockkey = 2e8c3d23212b1e5c5b6855fe88d39c90

[clients]
internalsecret = h3da1PLvAHiEI@4E2KZEDpDFKoo

[backend]
backends = backend-1
allowall = false
timeout = 10
connectionsperhost = 8

[backend-1]
url = https://test.danielhansson.nu
secret = OsbIzDFlOUVnJ96p4Ykt5hho3LO

[nats]
url = nats://127.0.0.1:4222

[mcu]
type = janus
url = ws://127.0.0.1:8188

[turn]
apikey = cC4rm#23UsqUUn37MpmAFeVftoo
secret = y77AoTvnOJaUCS82JnsGNGeknWv
servers = turn:test.danielhansson.nu:3478?transport=tcp,turn:test.danielhansson.nu:3478?transport=udp
enoch85 commented 1 year ago

@szaimen I know what the issue is!

You are using the same domain for both HPB and NC. In the VM it differs, so could you please make a pull request which changes the name of the variable so that it's possible for me to use another variable here:

url = https://test.danielhansson.nu/standalone-signaling/
enoch85 commented 1 year ago

@szaimen Please try the latest script when you have time. I can send a bounty of €50 for the trouble.

enoch85 commented 1 year ago

OK, so it doesn't seem to work, don't know why?

docker run -t -d -p 127.0.0.1:1234:1234 --restart always --name talk-recording --shm-size=2GB -e NC_DOMAIN=test.danielhansson.nu -e HPB_DOMAIN=hpb.danielhansson.nu -e TZ=Europe/Stockholm -e RECORDING_SECRET=hjmnCSZta0zLWAfigHR0Mnp8hb -e INTERNAL_SECRET=0QHXrQzZl7PXV9gBnLq609TQYw nextcloud/aio-talk-recording

Results in:

fef122572c97:~$ cat /conf/recording.conf 
[logs]
# 30 means Warning
level = 30

[http]
listen = 0.0.0.0:1234

[backend]
allowall = false
# TODO: remove secret below when https://github.com/nextcloud/spreed/issues/9580 is fixed
secret = hjmnCSZta0zLWAfigHR0Mnp8hb
backends = backend-1
skipverify = false
maxmessagesize = 1024
videowidth = 1920
videoheight = 1080
directory = /tmp

[backend-1]
url = https://test.danielhansson.nu
secret = hjmnCSZta0zLWAfigHR0Mnp8hb
skipverify = false

[signaling]
signalings = signaling-1

[signaling-1]
url = https://test.danielhansson.nu/standalone-signaling/
internalsecret = 0QHXrQzZl7PXV9gBnLq609TQYw

[ffmpeg]
# outputaudio = -c:a libopus
# outputvideo = -c:v libvpx -deadline:v realtime -crf 10 -b:v 1M
extensionaudio = .ogg
extensionvideo = .webm

So it doesn't seem like the HPB_DOMAIN is used. Any idea @szaimen

szaimen commented 1 year ago

OK, so it doesn't seem to work, don't know why?

Because the code changes are not released yet. You need to wait for the next version which will likely get released to the beta channel tomorrow and then pushed to the latest channel 1 week after.

enoch85 commented 1 year ago

Waiting for the next release to be published which is planned for this friday.

Thought that "release on friday" some weeks ago meant that it was out there in the open.

szaimen commented 1 year ago

Waiting for the next release to be published which is planned for this friday.

Thought that "release on friday" some weeks ago meant that it was out there in the open.

I see. However that one was for a different PR which was included in that release. However the other fix is not yet.

enoch85 commented 1 year ago

This is now released with v7.0.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel

Just tested, with beta tag, and sorry, but it didn't work as it seems:

           "Env": [
                "INTERNAL_SECRET=lmIIYSV9yYAK14pMtyVwJTlU9ofh",
                "NC_DOMAIN=test.danielhansson.nu",
                "HPB_DOMAIN=hpb.danielhansson.nu",
                "TZ=Europe/Stockholm",
                "RECORDING_SECRET=d0fWi7Zpyb8gsTjNaCzBTcBD6gNr",
                "PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "LANG=C.UTF-8",
                "GPG_KEY=A035C8C19219BA821ECEA86B64E628F8D684696D",
                "PYTHON_VERSION=3.11.4",
                "PYTHON_PIP_VERSION=23.1.2",
                "PYTHON_SETUPTOOLS_VERSION=65.5.1",
                "PYTHON_GET_PIP_URL=https://github.com/pypa/get-pip/raw/0d8570dc44796f4369b652222cf176b3db6ac70e/public/get-pip.py",
                "PYTHON_GET_PIP_SHA256=96461deced5c2a487ddc65207ec5a9cffeca0d34e7af7ea1afc470ff0d746207",
                "RECORDING_VERSION=v17.0.2",
                "ALLOW_ALL=false",
                "HPB_PROTOCOL=https",
                "SKIP_VERIFY=false",
                "HPB_PATH=/standalone-signaling/"
            ],
4631f4bcd4be:~$ cat /conf/recording.conf 
[logs]
# 30 means Warning
level = 30

[http]
listen = 0.0.0.0:1234

[backend]
allowall = false
# TODO: remove secret below when https://github.com/nextcloud/spreed/issues/9580 is fixed
secret = d0fWi7Zpyb8gsTjNaCzBTcBD6gNr
backends = backend-1
skipverify = false
maxmessagesize = 1024
videowidth = 1920
videoheight = 1080
directory = /tmp

[backend-1]
url = https://test.danielhansson.nu
secret = d0fWi7Zpyb8gsTjNaCzBTcBD6gNr
skipverify = false

[signaling]
signalings = signaling-1

[signaling-1]
url = https://test.danielhansson.nu/standalone-signaling/
internalsecret = lmIIYSV9yYAK14pMtyVwJTlU9ofh

[ffmpeg]
# outputaudio = -c:a libopus
# outputvideo = -c:v libvpx -deadline:v realtime -crf 10 -b:v 1M
extensionaudio = .ogg
extensionvideo = .webm
szaimen commented 1 year ago

I just tested with 

docker run -d \
--env NC_DOMAIN=test.example.com \
--env HPB_DOMAIN=hpb.example.com \
--env TZ=UTC \
--env RECORDING_SECRET=abcde \
--env INTERNAL_SECRET=12345 \
--name aio-talk-recording \
nextcloud/aio-talk-recording:beta

And this is what I got:

~ $ cat /conf/recording.conf
[logs]
# 30 means Warning
level = 30

[http]
listen = 0.0.0.0:1234

[backend]
allowall = false
# TODO: remove secret below when https://github.com/nextcloud/spreed/issues/9580 is fixed
secret = abcde
backends = backend-1
skipverify = false
maxmessagesize = 1024
videowidth = 1920
videoheight = 1080
directory = /tmp

[backend-1]
url = https://test.example.com
secret = abcde
skipverify = false

[signaling]
signalings = signaling-1

[signaling-1]
url = https://hpb.example.com/standalone-signaling/
internalsecret = 12345

[ffmpeg]
# outputaudio = -c:a libopus
# outputvideo = -c:v libvpx -deadline:v realtime -crf 10 -b:v 1M
extensionaudio = .ogg
extensionvideo = .webm

So it seems to work

enoch85 commented 1 year ago

Hmm... Thanks for testing, will have to have another look!

enoch85 commented 1 year ago

OK, this now works.

Thanks @szaimen :)

oliveiraigorm commented 3 months ago

I'm facing the same issue File "/usr/local/lib/python3.12/site-packages/nextcloud/talk/recording/Participant.py", line 519, in joinCall raise Exception(f"No configured signaling secret for {settings['server']}") Exception: No configured signaling secret for wss://signaling.metaprovide.org

The config file is properly generated with the internal and recording secrets. I've tested multiple docker images and tags but no luck.

I've even hardcoded the secret into the code and it can't connect to the signaling server. I know the signaling server works because it is currently setup to NC.