forked from strukturag/nextcloud-spreed-signaling
-
Notifications
You must be signed in to change notification settings - Fork 0
/
server.conf.in
206 lines (164 loc) · 7.1 KB
/
server.conf.in
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
[http]
# IP and port to listen on for HTTP requests.
# Comment line to disable the listener.
#listen = 127.0.0.1:8080
# HTTP socket read timeout in seconds.
#readtimeout = 15
# HTTP socket write timeout in seconds.
#writetimeout = 15
[https]
# IP and port to listen on for HTTPS requests.
# Comment line to disable the listener.
#listen = 127.0.0.1:8443
# HTTPS socket read timeout in seconds.
#readtimeout = 15
# HTTPS socket write timeout in seconds.
#writetimeout = 15
# Certificate / private key to use for the HTTPS server.
certificate = /etc/nginx/ssl/server.crt
key = /etc/nginx/ssl/server.key
[app]
# Set to "true" to install pprof debug handlers.
# See "https://golang.org/pkg/net/http/pprof/" for further information.
debug = false
[sessions]
# Secret value used to generate checksums of sessions. This should be a random
# string of 32 or 64 bytes.
hashkey = the-secret-for-session-checksums
# Optional key for encrypting data in the sessions. Must be either 16, 24 or
# 32 bytes.
# If no key is specified, data will not be encrypted (not recommended).
blockkey = -encryption-key-
[clients]
# Shared secret for connections from internal clients. This must be the same
# value as configured in the respective internal services.
internalsecret = the-shared-secret-for-internal-clients
[backend]
# Comma-separated list of backend ids from which clients are allowed to connect
# from. Each backend will have isolated rooms, i.e. clients connecting to room
# "abc12345" on backend 1 will be in a different room than clients connected to
# a room with the same name on backend 2. Also sessions connected from different
# backends will not be able to communicate with each other.
#backends = backend-id, another-backend
# Allow any hostname as backend endpoint. This is extremely insecure and should
# only be used while running the benchmark client against the server.
allowall = false
# Common shared secret for requests from and to the backend servers if
# "allowall" is enabled. This must be the same value as configured in the
# Nextcloud admin ui.
#secret = the-shared-secret
# Timeout in seconds for requests to the backend.
timeout = 10
# Maximum number of concurrent backend connections per host.
connectionsperhost = 8
# If set to "true", certificate validation of backend endpoints will be skipped.
# This should only be enabled during development, e.g. to work with self-signed
# certificates.
#skipverify = false
# Backend configurations as defined in the "[backend]" section above. The
# section names must match the ids used in "backends" above.
#[backend-id]
# URL of the Nextcloud instance
#url = https://cloud.domain.invalid
# Shared secret for requests from and to the backend servers. This must be the
# same value as configured in the Nextcloud admin ui.
#secret = the-shared-secret
# Limit the number of sessions that are allowed to connect to this backend.
# Omit or set to 0 to not limit the number of sessions.
#sessionlimit = 10
#[another-backend]
# URL of the Nextcloud instance
#url = https://cloud.otherdomain.invalid
# Shared secret for requests from and to the backend servers. This must be the
# same value as configured in the Nextcloud admin ui.
#secret = the-shared-secret
[nats]
# Url of NATS backend to use. This can also be a list of URLs to connect to
# multiple backends. For local development, this can be set to ":loopback:"
# to process NATS messages internally instead of sending them through an
# external NATS backend.
#url = nats://localhost:4222
[mcu]
# The type of the MCU to use. Currently only "janus" and "proxy" are supported.
# Leave empty to disable MCU functionality.
#type =
# For type "janus": the URL to the websocket endpoint of the MCU server.
# For type "proxy": a space-separated list of proxy URLs to connect to.
#url =
# For type "janus": the maximum bitrate per publishing stream (in bits per
# second).
# Defaults to 1 mbit/sec.
#maxstreambitrate = 1048576
# For type "janus": the maximum bitrate per screensharing stream (in bits per
# second).
# Default is 2 mbit/sec.
#maxscreenbitrate = 2097152
# For type "proxy": timeout in seconds for requests to the proxy server.
#proxytimeout = 2
# For type "proxy": type of URL configuration for proxy servers.
# Defaults to "static".
#
# Possible values:
# - static: A space-separated list of proxy URLs is given in the "url" option.
# - etcd: Proxy URLs are retrieved from an etcd cluster (see below).
#urltype = static
# If set to "true", certificate validation of proxy servers will be skipped.
# This should only be enabled during development, e.g. to work with self-signed
# certificates.
#skipverify = false
# For type "proxy": the id of the token to use when connecting to proxy servers.
#token_id = server1
# For type "proxy": the private key for the configured token id to use when
# connecting to proxy servers.
#token_key = privkey.pem
# For url type "etcd": Comma-separated list of static etcd endpoints to
# connect to.
#endpoints = 127.0.0.1:2379,127.0.0.1:22379,127.0.0.1:32379
# For url type "etcd": Options to perform endpoint discovery through DNS SRV.
# Only used if no endpoints are configured manually.
#discoverysrv = example.com
#discoveryservice = foo
# For url type "etcd": Path to private key, client certificate and CA
# certificate if TLS authentication should be used.
#clientkey = /path/to/etcd-client.key
#clientcert = /path/to/etcd-client.crt
#cacert = /path/to/etcd-ca.crt
# For url type "etcd": Key prefix of MCU proxy entries. All keys below will be
# watched and assumed to contain a JSON document. The entry "address" from this
# document will be used as proxy URL, other contents in the document will be
# ignored.
#
# Example:
# "/signaling/proxy/server/one" -> {"address": "https://proxy1.domain.invalid"}
# "/signaling/proxy/server/two" -> {"address": "https://proxy2.domain.invalid"}
#keyprefix = /signaling/proxy/server
[turn]
# API key that the MCU will need to send when requesting TURN credentials.
#apikey = the-api-key-for-the-rest-service
# The shared secret to use for generating TURN credentials. This must be the
# same as on the TURN server.
#secret = 6d1c17a7-c736-4e22-b02c-e2955b7ecc64
# A comma-separated list of TURN servers to use. Leave empty to disable the
# TURN REST API.
#servers = turn:1.2.3.4:9991?transport=udp,turn:1.2.3.4:9991?transport=tcp
[geoip]
# License key to use when downloading the MaxMind GeoIP database. You can
# register an account at "https://www.maxmind.com/en/geolite2/signup" for
# free. See "https://dev.maxmind.com/geoip/geoip2/geolite2/" for further
# information.
# Leave empty to disable GeoIP lookups.
#license =
# Optional URL to download a MaxMind GeoIP database from. Will be generated if
# "license" is provided above. Can be a "file://" url if a local file should
# be used. Please note that the database must provide a country field when
# looking up IP addresses.
#url =
[geoip-overrides]
# Optional overrides for GeoIP lookups. The key is an IP address / range, the
# value the associated country code.
#127.0.0.1 = DE
#192.168.0.0/24 = DE
[stats]
# Comma-separated list of IP addresses that are allowed to access the stats
# endpoint. Leave empty (or commented) to only allow access from "127.0.0.1".
#allowed_ips =