Skip to content

KAZOO Support Channels

This documentation is curated by 2600Hz as part of the KAZOO open source project. Join our community forums here for peer support. Only features in the docs.2600hz.com/supported space are included as part of our 2600Hz Support Services plan.

Quick SSL Setup Guide#

This guide assumes you have configured your DNS properly to point to the server you wish to secure. It will assume you are using Apache to serve MonsterUI and as a reverse proxy for Crossbar (the API server) for SSL termination.

Let's Encrypt Cert Setup#

We'll use Let's Encrypt to generate a free SSL certificate for us. See these instructions for a more detailed guide.

# First, get the script from EFF
sudo wget -O /usr/local/sbin https://dl.eff.org/certbot-auto

# Make it executable
sudo chmod a+x /usr/local/sbin/certbot-auto

Setup Let'sEncrypt and Apache#

To start an interactive session to setup the certificate for your domain (in this case, kazoo.mycompany.com):

certbot-auto --apache -d kazoo.mycompany.com

Certificates will be installed to `/etc/letsencrypt/live`

Auto-renew#

Let's Encrypt certificates are valid for 90 days. Triggering the renewal process is straight-forward:

certbot-auto renew

Setup auto-renewal in the form of a cronjob:

sudo crontab -e

30 2 * * 1 /usr/local/sbin/certbot-auto renew >> /var/log/le-renew.log

Setup Apache as a reverse proxy#

Having Apache (or any HTTP server) proxy the requests for the API server makes sense. You can manage your certificates in fewer places and API servers can come and go since each request is independent of any others (no state shared between requests on a given API server).

We create two VirtualHost entries, one for serving MonsterUI assets and one for proxying to Crossbar.

MonsterUI#

<VirtualHost *:443>
    ServerName kazoo.mycompany.com:443

    DocumentRoot /var/www/html/monster-ui

    SSLEngine on
    SSLCertificateKeyFile "/etc/letsencrypt/live/kazoo.mycompany.com/privkey.pem"
    SSLCertificateFile "/etc/letsencrypt/live/kazoo.mycompany.com/cert.pem"

    <Directory />
        #Options FollowSymLinks
        Options Indexes FollowSymLinks Includes ExecCGI
        AllowOverride All
        Order deny,allow
        Allow from all
    </Directory>
</VirtualHost>

API Reverse Proxy#

Be sure to replace the IPs with the IP Crossbar is using.

<VirtualHost *:8443>
    ServerName kazoo.mycompany.com:8443
    ProxyPreserveHost On

    SSLEngine on
    SSLCertificateKeyFile "/etc/letsencrypt/live/pdx.2600hz.com/privkey.pem"
    SSLCertificateFile "/etc/letsencrypt/live/pdx.2600hz.com/fullchain.pem"

    ProxyPass / http://10.1.10.29:8000/
    ProxyPassReverse / http://10.1.10.29:8000/
</VirtualHost>

Reconfigure MonsterUI and the Apps#

Once you've reloaded Apache, you'll want to update MonsterUI's config.js:

vim /var/www/html/monster-ui/js/config.js
# Update api_url to 'https://kazoo.mycompany.com:8443/v2'

And re-init the apps:

# Re-initialize Monster Apps
sup crossbar_maintenance init_apps \
/var/www/html/monster-ui/apps \
https://kazoo.mycompany.com:8443/v2