Add a role for Jitsi in Docker Compose

We need this role to follow the recommended deployment approach from https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/

This role enables us to keep our config and customizations separate from releases of the Compose setup the Jitsi project publishs.

roles/jitsi/README.md

@@ -0,0 +1,57 @@
+# Role `jitsi`
+
+A role for deploying [Jitsi Meet](https://jitsi.org/) using the official [docker-jitsi-meet](https://github.com/jitsi/docker-jitsi-meet) release.
+
+The given release is downloaded and unpacked unmodified to `/opt/jitsi/releases/` and `/opt/jitsi/release` is pointed to it.
+The `.env` file at `/opt/jitsi/.env` is fully managed by this role; `env.example` and `gen-passwords.sh` of the release are not used.
+The `.env` also sets `COMPOSE_PROJECT_NAME` and `COMPOSE_FILE`, so `docker compose` can be run by hand in `/opt/jitsi`.
+The Jitsi configuration directory (`CONFIG`) is `/opt/jitsi/config`, with persistent state in `/opt/jitsi/config/storage/`.
+The image version (`JITSI_IMAGE_VERSION`) always equals the release version, so upgrading means bumping `jitsi__version`.
+Releases other than the configured one are removed.
+
+TLS certificates are obtained by the web container itself using Let's Encrypt, so ports 80/tcp and 443/tcp as well as 10000/udp (media) must be reachable.
+
+Optionally, a [coturn](https://github.com/coturn/coturn) TURN server and the [Prometheus Jitsi Meet exporter](https://github.com/systemli/prometheus-jitsi-meet-exporter) are deployed as additional services of the same Compose project, defined in `/opt/jitsi/compose.override.yaml`.
+coturn uses the certificate obtained by the web container and is restarted weekly to pick up renewals.
+It needs 3478/udp+tcp, 5349/tcp and the relay port range 49152-65535/udp to be reachable.
+The exporter scrapes the JVB statistics and listens on port 9888.
+
+## Supported Distributions
+
+Should work on Debian-based distributions.
+
+## Required Arguments
+
+- `jitsi__version`: The docker-jitsi-meet release to deploy, e.g. `stable-11248`.
+- `jitsi__domain`: The domain Jitsi is served on. Used for `PUBLIC_URL` and the Let's Encrypt certificate.
+- `jitsi__letsencrypt_email`: The e-mail address for the Let's Encrypt account.
+- `jitsi__jicofo_auth_password`: XMPP password for Jicofo. Generate using `openssl rand -hex 16`.
+- `jitsi__jvb_auth_password`: XMPP password for the JVB. Generate using `openssl rand -hex 16`.
+
+## Optional Arguments
+
+- `jitsi__timezone`: The time zone for the containers.  
+  Defaults to `Europe/Berlin`.
+- `jitsi__jvb_advertise_ips`: List of IP addresses the JVB should advertise for media (`JVB_ADVERTISE_IPS`).  
+  Defaults to `[ ]`.
+- `jitsi__whiteboard`: Whether to deploy the Excalidraw whiteboard backend (`whiteboard.yml`).  
+  Defaults to `false`.
+- `jitsi__turn`: Whether to deploy coturn and configure Jitsi to use it.  
+  Defaults to `false`.
+- `jitsi__turn_secret`: The shared secret between Prosody and coturn. Required if `jitsi__turn` is `true`.
+  Generate using `openssl rand -hex 32`.
+- `jitsi__prometheus_exporter`: Whether to deploy the Prometheus Jitsi Meet exporter on port 9888.  
+  Defaults to `false`.
+- `jitsi__env`: Dictionary of additional variables to put into the `.env` file.
+  See `env.example` of the release and the handbook for available variables.  
+  Defaults to `{ }`.
+- `jitsi__custom_config_js`: Content of `custom-config.js`, which gets appended to the generated `config.js`.  
+  Defaults to `""` (no file).
+- `jitsi__custom_interface_config_js`: Content of `custom-interface_config.js`, which gets appended to the generated `interface_config.js`.  
+  Defaults to `""` (no file).
+
+## Links & Resources
+
+- <https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/>
+- <https://github.com/jitsi/docker-jitsi-meet>
+- <https://github.com/jitsi/docker-jitsi-meet/releases>