====== Default configuration for WebRTC companion server ======

Before Ingate unit can be used as webRTC companion server it has to be configured as below:

===== Configuration =====
  * Connect a PC to port E0 of the unit.
  * Set PC to IP adress 192.168.1.5 or let it fetch its IP adress using DHCP from unit.
  * On PC open web browser and surf to http://192.168.1.1
  * Log in as ”root”
  * Using the menubar at the top of the configuration page that appears configure the following:
<WRAP center round important 100%>
After each change make sure to click on ”Apply & Save” at bottom right on page!
</WRAP>
    * SIP > SIP Proxy > Advanced:
      * Uncheck "Reuse port numbers when changing media".
    * SIP > SIP Proxy > Interoperability:
      * Disable:
        * Force Real Username on registrations
      * Enable:
        * Strip BUNDLE related SDP attributes ((This is only to reduce the size of the SDP sent to SIP. If your SIP environment can handle long SDP with BUNDLE, you can skip this setting. There will be probably be other/more compatibility settings with time.))
        * Strip ICE SDP attributes
        * Add ICE candidates
        * Use RTCP Attribute in SDP
    * SIP > SIP Proxy > Media Encryption:
      * Enable “enable media encryption”
      * Enable “Default encryption policy: Allow transcoding”
    * Network > Interfaces > WAN1:
      * Configure appropriate WAN IP adress and port settings.
    * If you are using SIP Trunk: SIP > SIP Trunk > your trunk:
      * Remove video: Yes

Now WebRTC should work. There are however some additional settings you might want to do to improve:

Enable DoS attack protection and Connections limiting for the COWS and websocket server:
  * More Services > Webserver:
    * recommended values are DoS attack protection Max rate: 3, Allowed burst size: 30, Connections Limit: 100

If you have an domain name you use to access your unit from the Internet you might want to configure the
IXNX unit as SIP server for that domain, so that you can register SIP users locally using that domain name.
  * SIP > SIP Server:
    * Enter your domain name into Use as SIP server for Domain(s)

If you are using WebRTC clients that are not based on our WRTC_kit toolkit but still want to use the unit's
TURN server you need to enter the passwords used on More Services > Q-TURN > User-Database

You might also want to adjust settings of the SIP > WebRTC > Client templates.

===== REST authentication =====
Using REST authentication the web server providing the wrtc client webpage can force users to authenticate
themselves (using eg password login) and provide a REST token proving user has been accepted. The web
client can then pass the provided token to the IXNX unit proving it has already been accepted by the web
server – no further authentication is necessary. The IXNX unit's COWS webserver is capable of generating
such tokens if you configure it the following way:

  * More Services > Webserver > Webserver Settings :
    * Enter a REST authentication secret phrase
    * Set REST authentication lifetime (3600 is one hour)
    * Enter at least one entry into the REST login user database:
      * HTTP User ID and Password are the login and password user must use when logging in to COWS server. Communication username is the username she will get in the webrtc client after loggin in. The other fields may be left empty.
  * SIP > WebRTC > Client templates > Template 2 : (please note: Template 2)
    * Authentication mode : REST authentication
    * REST authentication shared secret : exactly the same secret phrase as entered above

Now you can test REST authentication by opening webpage http://192.168.1.2/login.html – when it asks for
login and password enter the ones you specified above.

After successful login you access the same client as usual in this demo – in a real world application you
would of course be granted access to a different web client, or have no access to the webclient at all unless
you have logged in correctly.

===== Use RFC 7118 (SIP Over Websockets) or Ingate’s RTCgate Protocol =====
The WebRTC gateway can communicate using two different protocols: RTCgate and RFC 7118.

RTCgate is a propriatery protocol used by the WRTC_kit toolkit that is used by the applications in the COWS
web server described below. Document WRTC_kit describes the RTCgate protocol, the WRTC_kit toolkit,
and how to create WebRTC clients with it.

The websocket server of IXNX does however also support RFC 7118, SIP over websockets. In addition to
otherwise existing UDP, TCP and TLS protocols, the WebSocket Protocol can also be a transport for the
Session Initiation Protocol (SIP), and interface to the SIP proxy and all SIP functionality of the E-SBC unit.
The RFC 7118 interface has (sparsely) been tested with sipml5’s JavaScript SIP client from Doubango
Telecom: [[http://sipml5.org]].

Both protocols are available at the WS and WSS ports set up at the >SIP>SIP Proxy>Settings>
configuration page and both also use the media proxy between WebRTC and SIP.

===== COWS – COmpanion Web Server =====
COWS is a second web server inside the unit, used solely to provide webpages for ordinary users. The cows
web server is fully separated from the unit's configuration web server to ensure integrity and security - it runs
as a separate process on the unit's CPU.

The demo application at http://webrtc.ingate.com is running on the IXNX second web server (COWS) and
uses the RTCgate protocol, that provides a quick way to integrate and use WebRTC features and functions
(including a multiparty videoconferencing client) with a SIP service. The JavaScript examples and libraries
are fully accessible.

When creating your own WebRTC client you can use the COWS server during development – and even for
small scale deployment, too. Below is a brief description of how to configure and use the COWS:

==== Access from LAN ====
  * At 192.168.1.1 you reach the configuration web server of the unit.
  * At **192.168.1.2** you reach the cows web server.
  * At **192.168.1.1:4336** is an alternate way to reach the cows web server
  * The built-in DNS server of the unit resolves by default **cows.lan** to 192.168.1.2
  * These default values can be altered on configuration pages:
    * More Services > Web server,
    * Network > DHCP and DNS,
    * Network > Hostnames

==== Access from WAN ====
At the **global IP address** of the unit you reach the cows web server.

There is no default way of reaching the configuration web server of the unit from WAN, unless you enable it
using the Network > Firewall > Remote Access page.

==== Web Pages on COWS ====
If you access cows without any page specified in the URL it will open the demo webRTC client page. \\
Example: http://192.168.1.2

If you specify webpage wrtc.html on cows it will open the minimalistic ”call support” popup page. \\
Example: http://192.168.1.2/wrtc.html

===== Files Containing the COWS Web Pages [etc.] =====
The web pages that cows can show are located at /usr/lib/lua/luci/view/wwwu in the unit's file system.

The pages are mapped to /cgi-bin/luci URL prefix by cows. \\
The URL mapping is done in the /usr/lib/lua/luci/controller_u/index.lua control file.

For easier access to the pages shortcut files /www/wwwu/index.html and /www/wwwu/wrtc.html have been
added that open the appropriate page.

Resources that cows can use are located at /www/wwwu in the unit's file system.

==== Accessing the files ====
You can access the above described files either by using SSH or the unit's built-in editor.

=== SSH ===
SSH access is by default disabled. You need to enable it before attempting access. To enable:
  * log in to web GUI http://192.168.1.1 as root
  * select System > Administration
  * if no Dropbear instances exist under SSH Access create one using the Add button
  * select the desired interface to use, or unspecified to enable SSH on all interfaces
  * either enable ”Password authentication” and ”Allow root logins with password”, or enter the SSH keys you intend to use
  * Click ”Apply & Save”
Now you can access the unit using SSH. Using file transfer programs such as WinSCP you can fetch, edit,
and upload files. Remember that you must log in as root to be able to edit all files.
<WRAP center round important 100%>
Make sure the files use LF as row delimiters, not CRLF! Webpages fail to load if CRLF is used!
</WRAP>

=== Built-in editor ===
The web config GUI has its own built-in file editor. To use it:
  * log in to web GUI http://192.168.1.1 as root
  * select System > Develop > ls (the Develop menu is only available for the root user)
Now you can browse the unit's file system. When clicking on a file the Edit page will open with that file's
contents. You can now edit the file and save it using the ”Save” button at the bottom of the page.

== Tips and tricks ==
Instead of browsing the file tree you can select System > Develop > Edit, enter the full file path directly, and click ”Load”.

You can use Ctrl+F to search on the Edit page.

To copy a file: open it on the Edit page, change its filepath above the ”Load” button, and click ”Save”.

To delete a file open System > Develop > CLI and enter ”rm /full/path/to/file”

To be able to access the web configuration GUI from WAN open page Network > Firewall > Remote Access, check ”Enable remote web
access by http” and click ”Apply & Save”. Now you can access the web configuration GUI at the unit's global IP address, port 66
(http://50.11.69.17:66) or more securely, open https access on port 78.