Webrtc服务器搭建(基于局域网环境)
- 目录
1. 搭建平台
2. 软件安装
3. 搭建房间服务器(Room Server)
4. 搭建信令服务器(Collider Server)
5. 搭建STUNTURN服务器
6. 配置Nginx服务器
7. 运行测试
8. 参考文档
- 搭建平台
操作系统：Ubuntu 16.04 server(64bits)
Google webrtc的服务器Demo：详见 https://github.com/webrtc/apprtc
IP地址：局域网 10.120.10.142
- 软件安装
- 安装JDK：
# add-apt-repository ppa:openjdk-r/ppa
# apt-get update
# apt-get install openjdk-8-jdk
- 安装nodejs相关包：
# apt-get install nodejs
# apt-get install npm
# apt-get install nodejs-legacy
# npm -g install grunt-cli
- 安装Python和Python-webtest：
# apt-get install python
# apt-get install python-webtest
- 搭建房间服务器(Room Server)
- 下载apprtc源码（操作所在目录/root/）
# git clone https://github.com/webrtc/apprtc.git
# cd apprtc
## 安装软件依赖
# npm install
- 修改文件
# vim /root/apprtc/src/app_engine/constants.py
TURN_BASE_URL = 'http://10.120.10.142:80'; #本机内网地址10.120.10.142,此处的端口号与Nginx监听的端口号保持一致
TURN_URL_TEMPLATE = '%s/turn.php?username=%s&key=%s'; #如果turn.php未实现，可使用默认配置
CEOD_KEY = 'inesadt' #此处后面turn配置的用户名保持一致
ICE_SERVER_BASE_URL = 'http://10.120.10.142:80';#此处的端口号与Nginx监听的端口号保持一致
ICE_SERVER_URL_TEMPLATE = '%s/iceconfig.php?key=%s'; #如果iceconfig.php未实现，可用默认配置，但是Android Apk会有问题
WSS_INSTANCE_HOST_KEY = '10.120.10.142:8089' #信令服务器端口号8089
WSS_INSTANCE_NAME_KEY = 'vm_name'
WSS_INSTANCE_ZONE_KEY = 'zone'
WSS_INSTANCES = [{
WSS_INSTANCE_HOST_KEY: '10.120.10.142:8089',
WSS_INSTANCE_NAME_KEY: 'wsserver-std',
WSS_INSTANCE_ZONE_KEY: 'us-central1-a'
}, {
WSS_INSTANCE_HOST_KEY: '10.120.10.142:8089',
WSS_INSTANCE_NAME_KEY: 'wsserver-std-2',
WSS_INSTANCE_ZONE_KEY: 'us-central1-f'
}]
# vim /root/apprtc/src/app_engine/apprtc.py （若使用https,则不需修改此文件）
if wss_tls and wss_tls == 'false':
wss_url = 'ws://' + wss_host_port_pair + '/ws'
wss_post_url = 'http://' + wss_host_port_pair
else:
wss_url = 'ws://' + wss_host_port_pair + '/ws'
wss_post_url = 'http://' + wss_host_port_pair
- 编译（在apprtc目录下进行）
# grunt build
编译完成之后，会生成out目录，房间服务器编译完成。
编译失败请参考文档：https://blog.csdn.net/gladsnow/article/details/77900333
- 安装和配置google app engine
1、下载google app engine
需FQ，下载地址：https://storage.googleapis.com/appengine-sdks/featured/google_appengine_1.9.50.zip，或者通过其他地方下载。
2、配置google app engine 路径
# unzip google_appengine_1.9.50.zip
## 编辑/etc/profile文件，在文件最后添加语句：
export PATH="$PATH:/root/google_appengine/"
# source /etc/profile
- 运行房间服务器（room server)
# cd /root/google_appengine
# ./dev_appserver.py --host=10.120.10.142 /root/apprtc/out/app_engine
## 后台运行
# nohup ./dev_appserver.py --host=192.168.6.54 /root/apprtc/out/app_engine &
- 在浏览器中访问房间服务器
http://10.120.10.142:8080
- 搭建信令服务器(Collider Server)
- 安装go语言编译器
# apt-get install golang-go
- 复制collider源代码
## 此源码在房间服务器源码目录下/root/apprtc/src/collider/
# cd /root
# mkdir -p goWorkspace/src
## 配置编译环境，此配置是暂时有效的
# export GOPATH=/root/goWorkspace/
## 把/root/apprtc/src/collider/目录下的三个目录（collider、collidermain、collidertest）复制到/root/goWorkspace/src/目录下
# cp -rf /root/apprtc/src/collider/* /root/goWorkspace/src
- 修改代码
编辑文件/root/goWorkspace/src/collidermain/main.go，修改房间服务器的地址
var roomSrv = flag.String("room-server", "http://10.120.10.142:8080", "The origin of the room server")
- 编译信令服务器
## 进入目录/root/goWorkspace/src/，此处编译需要FQ。可手动下载需要的文件。在/root/goWorkspace/src/目录下
# mkdir -p golang.org/x
# cd golang.org/x/
# git clone https://github.com/golang/net
## 然后再进行编译即可
# cd /root/goWorkspace/src/
# go get collidermain
# go install collidermain
- 运行信令服务器
# cd /root/goWorkspace/bin/
# ./collidermain -port=8089 -tls=false
## 若想后台运行，则执行
# nohup ./collidermain -port=8089 -tls=false &
- 搭建STUNTURN服务器
- 安装coturn
# apt-get install coturn
- 修改配置
编辑文件/etc/default/coturn，把TURNSERVER_ENABLED=1的注释去掉。
# vim /etc/turnserver.conf ## 把以下内容加入到文件最后
listening-device=eth0 #此处eth0是电脑网卡名称
listening-port=3478 #turn服务器的端口号
relay-device=eth0 #此处eth0是电脑网卡名称
min-port=49152
max-port=65535
Verbose
fingerprint
lt-cred-mech
use-auth-secret
static-auth-secret=inesadt #此处要和房间服务器配置时constants.py文件中的CODE_KEY保持一致。
user=inesadt:0x7e3a2ed35d3cf7f19e2f8b015a186f54
user=inesadt:inesadt
stale-nonce
cert=/usr/local/etc/turn_server_cert.pem
pkey=/usr/local/etc/turn_server_pkey.pem
no-loopback-peers
no-multicast-peers
mobility
no-cli
- 上述文件中 0x7e3a2ed35d3cf7f19e2f8b015a186f54的生成方法：
# turnadmin -k -u inesadt -r north.gov -p inesadt
-k 表示生成一个long-term credential key
-u 表示用户名
-p 表示密码
-r 表示Realm域（这个值的设置可能会有影响）
- coturn的证书生成（即配置文件中cert和pkey)
# sudo openssl req -x509 -newkey rsa:2048 -keyout /usr/local/etc/turn_server_pkey.pem -out /usr/local/etc/turn_server_cert.pem -days 99999 -nodes
- 启动coturn服务器
# service coturn start
- 配置Nginx服务器
- 安装Nginx
# apt-get install nginx
- 安装php和php-fpm
# apt-get install php
# apt-get install php7.0-fpm
- 编辑配置文件/etc/nginx/sites-available/default
upstream roomserver {
server 192.168.6.54:8080;
}
server {
#listen 80 default_server;
#listen [::]:80 default_server;
listen 80;
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/html;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html index.php; #此处添加index.php
server_name _;
# location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
# try_files $uri $uri/ =404;
# }
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
location ~ .php$ {
include snippets/fastcgi-php.conf;
# With php7.0-cgi alone:
# fastcgi_pass 127.0.0.1:9000;
# With php7.0-fpm:
fastcgi_pass unix:/run/php/php7.0-fpm.sock;
}
location / {
proxy_pass http://roomserver$request_uri;
proxy_set_header Host $host;
}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /.ht {
# deny all;
#}
}
- 编写turn.php文件和iceconfig.php文件，并把文件放到目录/var/www/html/目录下
// turn.php文件内容
<?php
$request_username = $_GET["username"];
if(empty($request_username)) {
echo "username == null";
exit;
}
$request_key = $_GET["key"];
$time_to_live = 600;
$timestamp = time() + $time_to_live;//失效时间
$response_username = $timestamp.":".$_GET["username"];
$response_key = $request_key;
if(empty($response_key))
$response_key = "code_key"; //constants.py中CEOD_KEY
$response_password = getSignature($response_username, $response_key);
$jsonObj = new Response();
$jsonObj->username = $response_username;
$jsonObj->password = $response_password;
$jsonObj->ttl = 86400;
//此处需配置自己的服务器
$jsonObj->uris= array("stun:10.120.10.142:3478","turn:10.120.10.142:3478?transport=udp","turn:10.120.10.142:3478?transport=tcp");
echo json_encode($jsonObj);
/**
* 使用HMAC-SHA1算法生成签名值
*
* @param $str 源串
* @param $key 密钥
*
* @return 签名值
*/
function getSignature($str, $key) {
$signature = "";
if (function_exists('hash_hmac')) {
$signature = base64_encode(hash_hmac("sha1", $str, $key, true));
} else {
$blocksize = 64;
$hashfunc = 'sha1';
if (strlen($key) > $blocksize) {
$key = pack('H*', $hashfunc($key));
}
$key = str_pad($key, $blocksize, chr(0x00));
$ipad = str_repeat(chr(0x36), $blocksize);
$opad = str_repeat(chr(0x5c), $blocksize);
$hmac = pack(
'H*', $hashfunc(
($key ^ $opad) . pack(
'H*', $hashfunc(
($key ^ $ipad) . $str
)
)
)
);
$signature = base64_encode($hmac);
}
return $signature;
}
class Response {
public $username = "";
public $password = "";
public $ttl = "";
public $uris = array("");
}
?>
// iceconfig.php文件内容
<?php
$request_username = "inesadt"; //配置成自己的turn服务器用户名
if(empty($request_username)) {
echo "username == null";
exit;
}
$request_key = "0x7e3a2ed35d3cf7f19e2f8b015a186f54"; //配置成自己的turn服务器密码
$time_to_live = 600;
$timestamp = time() + $time_to_live;//失效时间
$response_username = $timestamp.":".$_GET["username"];
$response_key = $request_key;
if(empty($response_key))
$response_key = "CEOD_KEY";//constants.py中CEOD_KEY
$response_password = getSignature($response_username, $response_key);
$arrayObj = array();
$arrayObj[0]['username'] = $response_username;
$arrayObj[0]['credential'] = $response_password;
//配置成自己的stun/turn服务器
$arrayObj[0]['urls'][0] = "stun:10.120.10.142:3478";
$arrayObj[0]['urls'][1] = "turn:10.120.10.142:3478?transport=tcp";
$arrayObj[0]['uris'][0] = "stun:10.120.10.142:3478";
$arrayObj[0]['uris'][1] = "turn:10.120.10.142:3478?transport=tcp";
$jsonObj = new Response();
$jsonObj->lifetimeDuration = "300.000s";
$jsonObj->iceServers = $arrayObj;
echo json_encode($jsonObj);
/**
* 使用HMAC-SHA1算法生成签名值
*
* @param $str 源串
* @param $key 密钥
*
* @return 签名值
*/
function getSignature($str, $key) {
$signature = "";
if (function_exists('hash_hmac')) {
$signature = base64_encode(hash_hmac("sha1", $str, $key, true));
} else {
$blocksize = 64;
hashfunc = 'sha1';
if (strlen($key) > $blocksize) {
$key = pack('H*', $hashfunc($key));
}
$key = str_pad($key, $blocksize, chr(0x00));
$ipad = str_repeat(chr(0x36), $blocksize);
$opad = str_repeat(chr(0x5c), $blocksize);
$hmac = pack(
'H*', $hashfunc(
($key ^ $opad) . pack(
'H*', $hashfunc(
($key ^ $ipad) . $str
)
)
)
);
$signature = base64_encode($hmac);
}
return $signature;
}
class Response {
public $lifetimeDuration = "";
public $iceServers = array("");
}
?>
注：关于turn.php和iceconfig.php文件实现的必要性，如果是http局域网，即使不实现这两个文件，在浏览器之间也可实现视频通信，但是如果使用Google的Android apk作为客户端，则可能会存在问题。经过测试，实现iceconfig.php即可，turn.php文件可不实现。
- 重启Nginx服务器和php7.0-fpm
# service nginx restart
# service php7.0-fpm restart
- 运行测试
- PC浏览器（Android手机浏览器）之间的视频通信测试
访问http://192.168.6.54:8080
1.PC浏览器：Firefox，Android手机浏览器：Firefox
测试OK
- 参考文档
- 基于内网环境WebRTC搭建文档
https://blog.csdn.net/gladsnow/article/details/77900333 - 基于公网环境WebRTC搭建文档
https://blog.csdn.net/gladsnow/article/details/77900578