Use jitsi role to configure jitsi

The host has been manually cleaned up (removed old packages and config) and this config has been deployed already.

resources/chaosknoten/jitsi/nftables/nftables.conf

@@ -0,0 +1,65 @@
+#!/usr/sbin/nft -f
+
+# Docker manages its own tables (via iptables-nft), so don't use "flush ruleset" here,
+# but only replace our own table. This also means that a reload is fine, but stopping
+# or restarting nftables.service (which flushes the whole ruleset) requires restarting
+# Docker afterwards.
+# Traffic to ports published by Docker containers (web, JVB, exporter) gets DNATed in
+# prerouting and therefore passes the forward hook instead of the input hook.
+
+## Variables
+
+define if_wan = "ens18"
+
+# Prometheus on grafana (IPv4 via the NAT of router)
+define prometheus_v4 = { 212.12.48.123 }
+define prometheus_v6 = { 2a00:14b0:42:102::e }
+
+## Rules
+
+table inet host_filter
+delete table inet host_filter
+
+table inet host_filter {
+    # Runs before Docker's DNAT, so this also applies to ports published by containers.
+    chain prerouting {
+        type filter hook prerouting priority dstnat - 10; policy accept;
+
+        iifname $if_wan tcp dport 9888 ip saddr $prometheus_v4 accept comment "jitsi exporter (container)"
+        iifname $if_wan tcp dport 9888 ip6 saddr $prometheus_v6 accept comment "jitsi exporter (container)"
+        iifname $if_wan tcp dport 9888 drop
+    }
+
+    chain input {
+        type filter hook input priority filter; policy drop;
+
+        iifname "lo" accept
+        ct state invalid drop
+        ct state established,related accept
+
+        # ICMPv6 is needed for neighbour discovery etc.
+        meta l4proto ipv6-icmp accept
+        meta l4proto icmp accept
+
+        # Docker networks
+        iifname { "docker0", "br-*" } accept
+
+        tcp dport 22 accept comment "ssh"
+
+        # Ports published by containers normally get DNATed and never reach the input
+        # hook, but they do when handled by docker-proxy (e.g. for IPv6 without IPv6
+        # enabled on the Docker network).
+        tcp dport { 80, 443 } accept comment "jitsi web (container)"
+        udp dport 10000 accept comment "jitsi jvb (container)"
+
+        # coturn (runs in the host network namespace)
+        udp dport 3478 accept comment "turn"
+        tcp dport 3478 accept comment "turn"
+        tcp dport 5349 accept comment "turns"
+        udp dport 5349 accept comment "turns (dtls)"
+        udp dport 49152-65535 accept comment "turn relay ports"
+
+        tcp dport { 9100, 9888 } ip saddr $prometheus_v4 accept comment "node exporter, jitsi exporter (container)"
+        tcp dport { 9100, 9888 } ip6 saddr $prometheus_v6 accept comment "node exporter, jitsi exporter (container)"
+    }
+}