Use jitsi role to configure jitsi

The host has been manually cleaned up (removed old packages and config) and this config has been deployed already.

inventories/chaosknoten/host_vars/jitsi.sops.yaml

@@ -1,4 +1,7 @@
 ansible_pull__age_private_key: ENC[AES256_GCM,data:8PCkZx76R5aWPITn5MCZCMckXvaLfVvnDgO70XmF/eeH5xLVOVx+EC3DZjmHxEoW7Kn4LAJTR4mWl/xP+p++elRvTMcHltV+vBQ=,iv:jKq07NLM84MSGU4CCyUS9ODmwiUMhlDONkKJ7P9P2DM=,tag:95yBZlwYdSNeX2O4t/h9kw==,type:str]
+jitsi__jicofo_auth_password: ENC[AES256_GCM,data:a7y36RJUR4OBtVNzgmqlGEsg1hNRGgsuwG2YFJrDlMI=,iv:mnGlKOXtNltNe3wY34BnVCJ9CtLQ7aksr4xXbrTOnJg=,tag:j1N7MUTJG8K0JW/a6YESFg==,type:str]
+jitsi__jvb_auth_password: ENC[AES256_GCM,data:xUFiIXAzY4pEpwgL/5LPBlhkx73RX6VFT3QJlG5QbFo=,iv:/XqENztrrpj1h3lBhEtJJo78lCrxrMWxRszNjSwx+KQ=,tag:+LRYmv9Tvt0muR47QTd6HA==,type:str]
+jitsi__turn_secret: ENC[AES256_GCM,data:UPev9ND9Mf2gGK28huQuuxRyUZvPPCmFL9rU1f0zndSPPBMspSsnlgtMy0+VY/CsGEIEcWsy3eYDPcAW/EKFtA==,iv:ew0MKP5zdQvqfla2y7xkcXLm3qSMlf5sucn8Qu3G3Zs=,tag:dqe239LD+wPVqLQFF+nz2A==,type:str]
 sops:
   age:
     - enc: |
@@ -30,8 +33,8 @@ sops:
         QzBBdJ6TiDwJ1rwwM211smfIbcYhWX6C/EfitI5XoIW8aS4ln1g1Ww==
         -----END AGE ENCRYPTED FILE-----
       recipient: age187zdk64205lx7r83a4m26pfa8hq6khc8sf83k266jasngeq08v3sfqswfg
-  lastmodified: "2026-07-29T20:26:44Z"
-  mac: ENC[AES256_GCM,data:dHiB768SBppBrjNoSpgDvriCgrSNzIkpSYzm9REx4otbnvNjHYPhP9OdsZ6zTcoFoX+41/zE13r4EoAz4F++jdJidv1+7DMFvVUKMuFNzp2VjDfB1ZNzzyM+px7l83L5eNhgNPp26mweOVMEz92NgB916KMY+5e3uUeSR+iIdho=,iv:7k8rugBXULjPSOZukQiufNn9Vs5uWVhcvFKIhD1o7so=,tag:IE+2uhzGS2xJJgFHuc94CA==,type:str]
+  lastmodified: "2026-10-08T07:56:43Z"
+  mac: ENC[AES256_GCM,data:CgD19xHN5nEg9TMQq/c4Xpv1LH0LfcXrkfBMUcbJiIn4FsSzQetLYxueeDXUVOujOb9ZSEin1nR+OZwa/nuwN9mTg37c0XZ6HV0UvNNEIrN/o4doUCQa2jLmbX8etxeNhF7oWJ84OgQIhPLvLwp3Z0A/+kPKbmtz3znQNgKoHQY=,iv:6Dt7z55az2SJovJ7ozG35Q99a08kOrKl/uQCUVcbq8c=,tag:M6p0ZJzoFnWgspnGknq7SQ==,type:str]
   pgp:
     - created_at: "2026-09-24T19:54:13Z"
       enc: |-

inventories/chaosknoten/host_vars/jitsi.yaml

@@ -0,0 +1,13 @@
+nftables__config: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/jitsi/nftables/nftables.conf') }}"
+
+# renovate: datasource=github-releases depName=jitsi/docker-jitsi-meet versioning=regex:^stable-(?<major>\d+)$
+jitsi__version: stable-11248
+jitsi__domain: jitsi.hamburg.ccc.de
+jitsi__letsencrypt_email: le-admin@hamburg.ccc.de
+jitsi__jvb_advertise_ips:
+  - 212.12.51.139
+  - 2a00:14b0:f000:23:51:139:0:1
+jitsi__whiteboard: true
+jitsi__turn: true
+jitsi__prometheus_exporter: true
+# jitsi__jicofo_auth_password, jitsi__jvb_auth_password and jitsi__turn_secret are defined in jitsi.sops.yaml.

inventories/chaosknoten/hosts.yaml

@@ -141,6 +141,7 @@ systemd_networkd_hosts:
     router:
 nftables_hosts:
   hosts:
+    jitsi:
     router:
 docker_compose_hosts:
   hosts:
@@ -258,6 +259,9 @@ wiki_hosts:
 netbox_hosts:
   hosts:
     netbox:
+jitsi_hosts:
+  hosts:
+    jitsi:
 proxmox_vm_template_hosts:
   hosts:
     chaosknoten:

resources/chaosknoten/jitsi/nftables/nftables.conf

@@ -0,0 +1,65 @@
+#!/usr/sbin/nft -f
+
+# Docker manages its own tables (via iptables-nft), so don't use "flush ruleset" here,
+# but only replace our own table. This also means that a reload is fine, but stopping
+# or restarting nftables.service (which flushes the whole ruleset) requires restarting
+# Docker afterwards.
+# Traffic to ports published by Docker containers (web, JVB, exporter) gets DNATed in
+# prerouting and therefore passes the forward hook instead of the input hook.
+
+## Variables
+
+define if_wan = "ens18"
+
+# Prometheus on grafana (IPv4 via the NAT of router)
+define prometheus_v4 = { 212.12.48.123 }
+define prometheus_v6 = { 2a00:14b0:42:102::e }
+
+## Rules
+
+table inet host_filter
+delete table inet host_filter
+
+table inet host_filter {
+    # Runs before Docker's DNAT, so this also applies to ports published by containers.
+    chain prerouting {
+        type filter hook prerouting priority dstnat - 10; policy accept;
+
+        iifname $if_wan tcp dport 9888 ip saddr $prometheus_v4 accept comment "jitsi exporter (container)"
+        iifname $if_wan tcp dport 9888 ip6 saddr $prometheus_v6 accept comment "jitsi exporter (container)"
+        iifname $if_wan tcp dport 9888 drop
+    }
+
+    chain input {
+        type filter hook input priority filter; policy drop;
+
+        iifname "lo" accept
+        ct state invalid drop
+        ct state established,related accept
+
+        # ICMPv6 is needed for neighbour discovery etc.
+        meta l4proto ipv6-icmp accept
+        meta l4proto icmp accept
+
+        # Docker networks
+        iifname { "docker0", "br-*" } accept
+
+        tcp dport 22 accept comment "ssh"
+
+        # Ports published by containers normally get DNATed and never reach the input
+        # hook, but they do when handled by docker-proxy (e.g. for IPv6 without IPv6
+        # enabled on the Docker network).
+        tcp dport { 80, 443 } accept comment "jitsi web (container)"
+        udp dport 10000 accept comment "jitsi jvb (container)"
+
+        # coturn (runs in the host network namespace)
+        udp dport 3478 accept comment "turn"
+        tcp dport 3478 accept comment "turn"
+        tcp dport 5349 accept comment "turns"
+        udp dport 5349 accept comment "turns (dtls)"
+        udp dport 49152-65535 accept comment "turn relay ports"
+
+        tcp dport { 9100, 9888 } ip saddr $prometheus_v4 accept comment "node exporter, jitsi exporter (container)"
+        tcp dport { 9100, 9888 } ip6 saddr $prometheus_v6 accept comment "node exporter, jitsi exporter (container)"
+    }
+}

roles/nftables/tasks/main.yaml

@@ -13,3 +13,10 @@
     group: root
   become: true
   notify: Reload nftables service
+
+- name: ensure nftables service is enabled and started
+  ansible.builtin.systemd_service:
+    name: nftables
+    enabled: true
+    state: started
+  become: true