Ministra TV Platform installation

System Requirements

Approximately for 1000 subscribers

For about 100 channels recording and 100 simultaneous sessions

Choosing of the distribution

The platform works in any *nix system, but we strongly recommend to use the stable 64-bit distribution of Ubuntu 16.04 LTS or Ubuntu 14.04 LTS. The work with other distributions is not guaranteed,  or some of the functions of the middleware may not be available.

Installing the Ministra TV Platform on Ubuntu 14.04

Necessary services & packets

1. apache2

2. apache2-rewrite

3. nginx

4. memcached

5. mysqld >= 5

6. php5 >= 5.3.0

7. php5-mysql

8. php-pear

9. php-soap *

10. php5-intl *

11. php-gettext *

12. php5-memcache *

13. phing (for version >= 4.8.0) **

14. nodejs>= v0.4.8 (for PVR management)

15. upstart (for stalkerd - PVR management)

16. php5-curl *

17. php5-tidy *

18. php5-imagick *

19. php5-geoip *
    

20. php5-sqlite
    

* - beginning from the version 4.8.35 they are automatically installed with phing using.

** - phing installation:

pear channel-discover pear.phing.info
pear install phing/phing

Example of installing all necessary services & packages for Ubuntu 14.04.3 LTS (performed by superuser “root”):

sudo apt-get update && sudo apt-get -y upgrade && sudo apt-get install -y -u apache2 nginx memcached php5-memcache mysql-server php5 php5-mysql php-pear nodejs mcrypt php5-mcrypt npm php5-curl php5-imagick php5-sqlite upstart && sudo pear channel-discover pear.phing.info && sudo pear install -Z phing/phing

Installation order

GRANT ALL PRIVILEGES ON stalker_db.* TO stalker@localhost IDENTIFIED BY '1' WITH GRANT OPTION;

4. Make the necessary changes in the portal config. To change the settings/configuration you need to create a configuration file /var/www/stalker_portal/server/custom.ini and add to it different from config.ini settings items.

[database]
mysql_host = 10.128.1.3
mysql_pass = superpass

6. It is necessary to upgrade the version of NPM to 2.15.11.

sudo npm install -g npm@2.15.11
sudo ln -s /usr/bin/nodejs /usr/bin/node
sudo reboot

If an error Error: CERT_UNTRUSTED occurs during the installation of npm, use the command:

npm config set strict-ssl false

7. Go to /var/www/stalker_portal/deploy/ and run:

sudo phing

Upgrading Ubuntu 14.04 to 16.04 with Ministra TV Platform installed

Backing up current Ministra system

1. Create a directory for the backup files:

sudo mkdir /opt/backup

2. Back up the database:

sudo mysqldump -u stalker -p1 stalker_db | gzip -9 > /opt/backup/database.sql.gz

where

• stalker - value of the mysql_user parameter in the configuration file;
• stalker_db - db_name parameter value in the configuration file;
• 1 - value of the mysql_pass parameter in the configuration file.

sudo cp -r /var/www/stalker_portal/ /opt/backup

Ministra portal update

sudo apt-get update && sudo apt-get upgrade && sudo apt-get dist-upgrade

2. Perform release upgrade.

Make sure you have the update-manager-core package installed:

sudo apt-get install update-manager-core

Remove packages that are no longer required:

sudo apt-get autoremove

Run the command to update:

sudo do-release-upgrade

3. Type y to enable the run of the additional ssh daemon on port 1022. It will be required to access the system in case the update is not completed.

Reading cache
 
Checking package manager
 
Continue running under SSH?
 
This session appears to be running under ssh. It is not recommended
to perform a upgrade over ssh currently because in case of failure it
is harder to recover.
 
If you continue, an additional ssh daemon will be started at port
'1022'.
Do you want to continue?
 
Continue [yN]

4. Next, you’ll be informed that do-release-upgrade is starting a new instance of sshd on port 1022.

Starting additional sshd 
 
To make recovery in case of failure easier, an additional sshd will 
be started on port '1022'. If anything goes wrong with the running 
ssh you can still connect to the additional one. 
If you run a firewall, you may need to temporarily open this port. As 
this is potentially dangerous it's not done automatically. You can 
open the port with e.g.: 
'iptables -I INPUT -p tcp --dport 1022 -j ACCEPT'
 
To continue please press [ENTER]

Click Enter.

5. Type y to confirm that you want to start the upgrade.

Do you want to start the upgrade?
 
 
6 installed packages are no longer supported by Canonical. You can
still get support from the community.
 
9 packages are going to be removed. 104 new packages are going to be
installed. 399 packages are going to be upgraded.
 
You have to download a total of 232 M. This download will take about
46 seconds with your connection.
 
Installing the upgrade can take several hours. Once the download has
finished, the process cannot be canceled.
 
Continue [yN]  Details [d]

6. Select <Yes> to restart automatically the services when necessary.

7. After confirming that the services restart automatically, a few messages will appear stating that some default configuration files have been changed.

Configuration file '/etc/nginx/sites-available/default'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** default (Y/I/N/O/D/Z) [default=N]

8. Select the keep the local version currently installed option to configure unattended-upgrades.

9. On the new system, without any configuration changes, you can answer y to confirm the removal of unnecessary packages. On a system that has been significantly modified, you can answer d and view the list of packages proposed for removal in case you want to reinstall some of them later.

Remove obsolete packages? 
 
74 packages are going to be removed. 
 
 Continue [yN]  Details [d]

10. After the update is complete, you must restart the server. Enter y to continue.

System upgrade is complete.
 
Restart required 
 
To finish the upgrade, a restart is required. 
If you select 'y' the system will be restarted. 
 
Continue [yN]

11. When using SSH, a message displays:

=== Command detached from window (Thu Oct  3 04:35:58 2019) ===
=== Command terminated normally (Thu Oct  3 04:36:08 2019) ===

12. You may need to type any key to exit, since the SSH session was interrupted on the server side. Wait for the system to reboot and log in again.

13. Verify that the system is updated to Ubuntu 16.04. To do this, run the following command:

lsb_release -a

14. Install the required packages.

sudo apt-get install php7.0-mcrypt php7.0-mbstring nginx memcached mysql-server php php-mysql php-pear nodejs libapache2-mod-php php-curl php-imagick php-sqlite3 && sudo pear channel-discover pear.phing.info && sudo pear install -Z phing/phing

15. Set proper MySQL sql_mode.

echo -e "[mysqld]\nsql_mode=\"\"" >> /etc/mysql/conf.d/strict_mode.cnf

16. Restart MySQL service.

sudo service mysql restart

17. Enable PHP short tags.

sed -i 's/^short_open_tag = Off/short_open_tag = On/g' /etc/php/7.0/apache2/php.ini

18. Enable PHP mod_encrypt.

phpenmod mcrypt

19. If necessary, install NPM 2.15.11.

sudo apt-get install npm; sudo npm install -g npm@2.15.11
sudo ln -s /usr/bin/nodejs /usr/bin/node

20. Remove PHP5 directory.

sudo rm -rf /etc/php5/

21. Go to /var/www/stalker_portal/deploy/ and run:

sudo phing 

Installing the Ministra TV Platform on Ubuntu 16.04

Installation order

1. Install system updates:

sudo apt-get update
sudo apt-get upgrade

2. Install and configure apache:

sudo apt install apache2

For details on how to configure Apache, see here.

sudo service apache2 restart

3. Install the remaining packages with one command:

sudo apt-get install php7.0-mcrypt php7.0-mbstring nginx memcached php-memcache mysql-server php php-mysql php-pear nodejs libapache2-mod-php php-curl php-imagick php-sqlite3 && sudo pear channel-discover pear.phing.info && sudo pear install -Z phing/phing-2.16.1

4. Unzip the archive with the version to the root directory of the web server /var/www/. Project files should be available by the URL http://<your_ip_or_domain_name>/stalker_portal/;

5. Create MySQL user with permission to access  stalker_db database only:

GRANT ALL PRIVILEGES ON stalker_db.* TO stalker@localhost IDENTIFIED BY '1' WITH GRANT OPTION;

6. Make the necessary changes in the portal config. To change the settings/configuration you need to create a configuration file /var/www/stalker_portal/server/custom.ini and add to it different from config.ini settings items.

7. Configure MySQL, PHP, Node.js, Nginx ;

8. It is necessary to downgrade the version of NPM to 2.15.11.

sudo apt install npm
sudo npm install -g npm@2.15.11
sudo ln -s /usr/bin/nodejs /usr/bin/node

If the Error: CERT_UNTRUSTED error occurs during the installation of npm, use the command:

npm config set strict-ssl false

9. Go to  /var/www/stalker_portal/deploy/ and run:

sudo phing

Configure MySQL, PHP, Node.js, Apache, Nginx

MySQL

For Ubuntu 14.04

echo "max_allowed_packet = 32M" >> /etc/mysql/my.cnf

For Ubuntu 16.04

echo "sql_mode=\"\"" >> /etc/mysql/mysql.conf.d/mysqld.cnf

Then you need to restart MySQL server:

sudo service mysql restart

PHP

For Ubuntu 14.04

• Enable mod_mcrypt :

php5enmod mcrypt

echo "short_open_tag = On" >> /etc/php5/apache2/php.ini

For Ubuntu 16.04

• Enable mod_mcrypt :

phpenmod mcrypt

echo "short_open_tag = On" >> /etc/php/7.0/apache2/php.ini

Apache

• Enable mod_rewrite :

a2enmod rewrite

• Make sure that the package libapache2-mod-php5filter is not installed on the system. If necessary, remove it.

apt-get purge libapache2-mod-php5filter

• Remove content of /etc/apache2/sites-available/000-default.conf Do not forget to make backup.

cat /dev/null > /etc/apache2/sites-available/000-default.conf

• Add next content to /etc/apache2/sites-available/000-default.conf

<VirtualHost *:88>
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www
        <Directory /var/www/stalker_portal/>
                Options -Indexes -MultiViews
                AllowOverride ALL
                Require all granted
        </Directory>
        <Directory /var/www/player>
                Options -Indexes -MultiViews
                AllowOverride ALL
                #Require all granted
                DirectoryIndex index.php index.html
        </Directory> 
		ErrorLog ${APACHE_LOG_DIR}/error.log
		CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

• Set in /etc/apache2/ports.conf :

Listen 88

• Restart apache :

service apache2 restart

Nginx

• Example of configuration /etc/nginx/sites-available/default :

server { 
	listen 80; 
	server_name localhost; 

root /var/www;
    location ^~ /player {
        root /var/www/player;
        index index.php;
        rewrite ^/player/(.*) /player/$1 break;
        proxy_pass http://127.0.0.1:88/;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Real-IP $remote_addr;
    }

	location / { 
	proxy_pass http://127.0.0.1:88/; 
	proxy_set_header Host $host:$server_port; 
	proxy_set_header X-Real-IP $remote_addr; 
	} 

	location ~* \.(htm|html|jpeg|jpg|gif|png|css|js)$ { 
	root /var/www; 
	expires 30d; 
	} 
}

• Restart nginx

service nginx restart

update administrators set pass=MD5('new password') where login='admin';

Updating

1. Fill the download request form for the Ministra TV Platform on the official website. Please note, that the download link for the further updates will be sent to the email specified in the form. If you don't receipt reply to your request, please contact technical support: support@infomir.eu

2. Rename the folder with the previous version. For example: stalker_portal-old .

3. Download and unzip the file with the new version;

4. Copy custom.ini file from the old version to the new one;

5. Copy /var/www/stalker_portal/screenshots/ folder from the old version to the new one;

6. Copy all files (except the dummy.png file) from stalker_portal/misc/logos/ and stalker_portal/misc/audio_covers

   from the previous version to the corresponding directories of the new version.

   Pay attention! Before upgrading to the new version, you need to install the recommended version of NPM 2.15.11.

7. Enter into /var/www/stalker_portal/deploy/ and run command:

sudo phing

Localization

Ministra TV platform interface uses the following locales: Russian (RU), English (EN), Ukrainian (UK), Polish (PL), Greek (EL), Italian (IT), German (DE), Slovenian (SK), Spanish (ES). In default Ministra deducts the current localization variable from the main software and install the interface localization according to it's variable.

To install Ministra portal localization by default it is necessary:

• to create file custom.ini in directory .../stalker_portal/server/ ;

• to copy in custom.ini the section [Locales] from file ...//stalker_portal/server/config.ini ;

• to edit custom.ini

Containing of custom.ini :

[locales]
default_locale = ru_RU.utf8
allowed_locales[Русский] = ru_RU.utf8
allowed_locales[English] = en_GB.utf8
allowed_locales[Українська] = uk_UA.utf8
allowed_locales[Polski] = pl_PL.utf8
allowed_locales[Ελληνικά] = el_GR.utf8
allowed_locales[Nederlandse] = nl_NL.utf8
allowed_locales[Italiano] = it_IT.utf8
allowed_locales[Deutsch] = de_DE.utf8
allowed_locales[Slovenský] = sk_SK.utf8
allowed_locales[Español] = es_ES.utf8

In this case Ministra portal will be loaded with English interface independently from the software locale.

For correct localization switching in Admin interface next locales should be installed on the server: ru_RU.utf8 , en_GB.utf8 , uk_UA.utf8 , pl_PL.utf8 , pl_PL.utf8 , el_GR.utf8 , nl_NL.utf8 , it_IT.utf8 , de_DE.utf8 , sk_SK.utf8 , es_ES.utf8 .

Configuration of the Storage (separate server)

Necessary services & packets

1. apache2

2. php5 >= 5.3.0

3. php-soap

4. libpython2.7-stdlib (for TV recording)

5. nginx (for "TV Archive", recording or VOD via HTTP)

Installation order

1. Install all necessary services & packages:

Ubuntu 16.04

sudo  apt-get install -y -u apache2 php php-soap python2.7 libapache2-mod-php realpath

Ubuntu 14.04

sudo  apt-get install -y -u apache2 php5 php-soap python2.7 realpath

2. Add the following content to /etc/apache2/sites-available/000-default.conf

<VirtualHost *:88>
	TimeOut 1800
		ServerAdmin webmaster@localhost
		DocumentRoot /var/www
		<Directory /var/www/stalker_portal/>
			Options -Indexes -MultiViews
			AllowOverride ALL
			Require all granted
		</Directory>
		ErrorLog ${APACHE_LOG_DIR}/error.log
		CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

3. Set in /etc/apache2/ports.conf :

Listen 88

4. Make sure the package libapache2-mod-php5filter is not installed on the system.

If necessary, remove it:

apt-get purge libapache2-mod-php5filter

5. Restart apache :

sudo service apache2 restart

6. Install Nginx:

sudo apt-get install -y -u nginx nginx-extras

Configuration example in /etc/nginx/sites-available/default:

server {
    listen       80;
    server_name  example.com;
 
    location / {
        proxy_pass http://127.0.0.1:88/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
 
    location ~* \.(mpg|mpeg|avi|ts|mkv|mp4|mov|m2ts|flv|m4v|srt|sub|ass)$ {
 
        secure_link $arg_st,$arg_e;
        secure_link_md5 "supersecret$uri$remote_addr$arg_e"; # you can change secret "supersecret" in the portal config - nginx_secure_link_secret
 
        if ($secure_link = "") {
            return 403;
        }
 
        if ($secure_link = "0") {
            return 410;
        }
 
        send_timeout 6h;
        root /var/www/;
    }
}

7. Restart Nginx:

sudo service nginx restart

8. Unzip the archive with the version of the portal. Copy the contents of the directory /stalker_portal/storage/ in /var/www/stalker_portal/storage

9. Create directories /media/raid0/storage/ , /media/raid0/karaoke/ , /media/raid0/records/

, /media/raid0/mac/ and set permission 0777 to them.

Create a symbolic link to the STB's home directories in /var/www/media/

Create directory /media/raid0/records/archive/

Create a symbolic link of the folder with the archive to the root of web server.

Create the necessary directories and symbolic links with one command:

sudo mkdir -p -m 0777 /media/raid0/storage /media/raid0/karaoke /media/raid0/records /media/raid0/mac && sudo mkdir /var/www/media && sudo ln -s /media/raid0/mac/ /var/www/media/bb3 && mkdir -m 0777 /media/raid0/records/archive && sudo ln -s /media/raid0/records/archive/ /var/www

10. Edit the file /var/www/stalker_portal/storage/config.php . The following server IP address with a portal is used as an example: 192.168.1.71. Sample file content /var/www/stalker_portal/storage/config.php :

define('VIDEO_STORAGE_DIR', '/media/raid0/storage/'); 
define('KARAOKE_STORAGE_DIR', '/media/raid0/karaoke/');
define('RECORDS_DIR', '/media/raid0/records/'); 
define('NFS_HOME_PATH', '/media/raid0/mac/'); 
//В качестве логина и пароля будут использоваться значения параметров api_auth_login и api_auth_password из файла server/custom.ini, который хранится на сервере с порталом.
define('API_URL', 'http://login:password@192.168.1.71/stalker_portal/api/'); 
define('PORTAL_URL', 'http://192.168.1.71/stalker_portal/'); 
define('STORAGE_NAME', 'bb3');
define('ASTRA_RECORDER', false);
define('DUMPSTREAM_BUFFERING', 1); // set -1 for system default

where:
VIDEO_STORAGE_DIR- the directory for storing the Video club files;
KARAOKE_STORAGE_DIR- the directory for storing the Karaoke files;
RECORDS_DIR- directory with write permissions 0777 . In this directory, create a directory archive , where TV archive files will be created. See TV Archive settings.
NFS_HOME_PATH- STB's home directory;
API_URL- URL to record channels from middleware. Usually it is http://<middleware directory>/api/tv_archive/
PORTAL_URL- portal address. It will be accessed by the storage to verify the access keys to the archive. For example, http://<portal ip or domain name>/stalker_portal/
STORAGE_NAME- the name of the storage specified in the admin interface.

chmod u+x install.sh tvarchive.sh
./install.sh

12. In Admin interface of portal → Storage make next settings:

• Name - <storage name>. For example: bb3 ;
  IP - IP address of storage, for example 192.168.1.100.
  

• Home directory - <STB's home directory>. For example:

/media/raid0/mac/ Read more about adding storage in the administration panel here.

"TV archive" settings

dumprtp 239.1.1.1 1234 > dump239.1.1.1.ts 

1. Make sure that memcached is installed and worked on the server.
2. In Admin interface in the Storage section from the Allow TV recording drop-down list, select the server program that will be used to make the recordings on the storage server.
3. While editing TV channel in Admin interface you can choose “Enable TV archive” option. See more here.

Security

Web

User identification

First of all it is necessary to turn on remoteip module in apache. It allows seeing the real IP address of user while working in nginx and user restricting access in apache configuration file.

Turn on the  remoteip module:

a2enmod remoteip

If you previously enabled the rpaf module, disable it:

a2dismod rpaf

Create the remoteip.conf file on the path /etc/apache2 /conf-available/ and add the following contents to it:

<ifmodule remoteip_module>
  RemoteIPHeader X-Real-IP
  RemoteIPInternalProxy 127.0.0.1 external_server_ip
</ifmodule>

external_server_ip - address of your server.

To activate the settings of the  remoteip module, you need to run the following command:

a2enconf remoteip

In the apache2.conf file, under the path /etc/apache2/ replace the line:

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

to the following content:

LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

Then restart apache:

service apache2 restart

Restricting access in Admin interface

To improve the security of Admin interface it is strongly recommended to use the same IP address for the opening. This can be set in apache configuration file,where portal's host is described. After making changes it is necessary to restart apache.

<Directory /var/www/stalker_portal/server/adm/>
    Order Deny,Allow
    Deny from All
    Allow from 192.168.1.0/24
</Directory>

STB - Authorization

Portal access limitation for new STBs

Beginning from 4.8.63 portal version there is option default_stb_status appeared, which allows closing portal access for all new STBs. To enable this option it is necessary to add in server/custom.ini :

default_stb_status = 0

For old version in MySQL it is necessary to do:

ALTER TABLE `users` MODIFY `status` tinyint DEFAULT 1; 

After this all new STBs will have status OFF in admin interface.

Access control based on the set-top box model

Ministra allows you to differentiate the access to the portal based on set-top box model. The list of all models that are allowed access, is described in parameter allowed_stb_types of the configuration file. For example, you need to add support of WR320 model, all you need is to add in stalker_portal/server/custom.ini the line

allowed_stb_types = MAG200,MAG245,MAG250,MAG254,MAG255,MAG270,MAG275,AuraHD,WR320

For AuraHD set-top box there is a possibility of the strict model check (parameter strict_stb_type_check ), in this case, it is necessary to completely specify the model. For example, access is allowed only to AuraHD International:

strict_stb_type_check = true
allowed_stb_types = AuraHD9

If the model supports recording on the local media, then you can additionally add it to the appropriate list

allowed_stb_types_for_local_recording = MAG245,MAG250,MAG255,MAG270,MAG275,AuraHD,WR320

Access to portal using login&password

Simple authorization

Access to the portal organization for new STBs using login&password. Portal admin creates login&password and provide them to the user. While first loading there will be authorization window which requests login&password. After successful authorization MAC address will be adjust to login. Further portal loading will be without authorization.

For this it is necessary to:

1. In custom.ini add next

auth_url = http://localhost/stalker_portal/server/tools/auth_simple.php

2. In admin interface Users > Add - Add user, it is enough to specify login (unique) and password. MAC address field should be empty.

Authorization with key

Access to portal organization by login&password. Portal admin creates login/password and provides them to the user. While first loading there will be authorization window which request login&password. After successful authorization new key will be generating which is based on login&password. This key is stored on STB, which will validate while next portal loading. If the same login&password will be used for another STB than previous one will be un-authorized automatically.

For this it is necessary to:

1. In custom.ini add next

   auth_url = http://localhost/stalker_portal/server/tools/auth_every_load.php

2. In admin interface users > add -add user,it is enough to specify login(unique) and password. MAC address field should be empty.

API

Billing

If it is necessary to turn on API for working with external billing systems then it is strongly recommended to use authorization. Specify the login and password in server/custom.ini .

[server_api]
; API required for tv archive, pvr and billing
enable_api = true

api_auth_login = login ; login specifying
api_auth_password = password ; password specifying

Storage configuring

On the storages, which are used for recording, it is necessary to specify API_URL parameter with login and password (in storage/config.php ):

define('API_URL', 'http://login:password@localhost/stalker_portal/api/');

Temporary URLs

If the Wowza temporary URLs are using for playing, then it is necessary to specify the login and password for work with API in the configuration of Wowza application. It is not necessary to specify them if nginx and VLC/udpxy are used.

API address setting in configuration file of Wowza:

<Property>
    <Name>stalkerApiServer</Name>
    <Value>http://login:password@192.168.1.1/stalker_portal/api/</Value>
</Property>

TV channel monitoring

In script check_channels.sh API_URL it is necessary to specify authorization URL:

API_URL=http://login:password@localhost/stalker_portal/api/monitoring_links/

Firewall

It is recommended to make access on 88 port (apache) for local access and access from storage, which are working with temporary URLs.