Add a role for Jitsi in Docker Compose

We need this role to follow the recommended deployment approach from https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/

This role enables us to keep our config and customizations separate from releases of the Compose setup the Jitsi project publishs.

roles/jitsi/tasks/main.yaml

@@ -0,0 +1,186 @@
+- name: make sure a TURN secret is given, if TURN is enabled
+  ansible.builtin.assert:
+    that:
+      - jitsi__turn_secret is defined
+      - jitsi__turn_secret | length > 0
+    quiet: true
+  when: jitsi__turn
+
+- name: make sure the Jitsi base directories exist
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+    owner: root
+    group: root
+  become: true
+  loop:
+    - "{{ jitsi__base_dir }}"
+    - "{{ jitsi__base_dir }}/releases"
+
+- name: make sure the docker-jitsi-meet release is present
+  ansible.builtin.unarchive:
+    src: "https://github.com/jitsi/docker-jitsi-meet/archive/refs/tags/{{ jitsi__version }}.tar.gz"
+    remote_src: true
+    dest: "{{ jitsi__base_dir }}/releases"
+    creates: "{{ jitsi__release_dir }}/docker-compose.yml"
+    owner: root
+    group: root
+  become: true
+
+- name: point the `release` symlink to the configured release
+  ansible.builtin.file:
+    src: "{{ jitsi__release_dir }}"
+    dest: "{{ jitsi__base_dir }}/release"
+    state: link
+    owner: root
+    group: root
+  become: true
+
+# Configuration read by the containers at startup; managed by Ansible.
+- name: make sure the configuration input directories exist
+  ansible.builtin.file:
+    path: "{{ jitsi__config_dir }}/{{ item }}"
+    state: directory
+    mode: "0755"
+    owner: root
+    group: root
+  become: true
+  loop:
+    - ""
+    - web
+    - prosody
+    - prosody/config
+    - prosody/prosody-plugins-custom
+    - jicofo
+    - jvb
+    - storage
+    - tmp
+
+# State written by the containers, which run as uid/gid 1000.
+# The certificate directory is created here, as Docker would otherwise create it owned by
+# root for the coturn bind mount, before the web container gets to write the certificate.
+- name: make sure the storage and tmp directories exist and are writable by the containers
+  ansible.builtin.file:
+    path: "{{ jitsi__config_dir }}/{{ item }}"
+    state: directory
+    mode: "0750"
+    owner: "1000"
+    group: "1000"
+  become: true
+  loop:
+    - storage/prosody
+    - storage/web
+    - storage/web/acme-certs
+    - "storage/web/acme-certs/{{ jitsi__domain }}"
+    - storage/transcripts
+    - tmp/web-crontabs
+    - tmp/web-load-test
+
+- name: deploy custom web configuration
+  ansible.builtin.copy:
+    content: "{{ item.content }}"
+    dest: "{{ jitsi__config_dir }}/web/{{ item.name }}"
+    mode: "0644"
+    owner: root
+    group: root
+  become: true
+  when: item.content != ""
+  loop:
+    - name: custom-config.js
+      content: "{{ jitsi__custom_config_js }}"
+    - name: custom-interface_config.js
+      content: "{{ jitsi__custom_interface_config_js }}"
+  loop_control:
+    label: "{{ item.name }}"
+  notify: restart jitsi web
+
+- name: remove unconfigured custom web configuration
+  ansible.builtin.file:
+    path: "{{ jitsi__config_dir }}/web/{{ item.name }}"
+    state: absent
+  become: true
+  when: item.content == ""
+  loop:
+    - name: custom-config.js
+      content: "{{ jitsi__custom_config_js }}"
+    - name: custom-interface_config.js
+      content: "{{ jitsi__custom_interface_config_js }}"
+  loop_control:
+    label: "{{ item.name }}"
+  notify: restart jitsi web
+
+- name: make sure the coturn directory exists
+  ansible.builtin.file:
+    path: "{{ jitsi__base_dir }}/coturn"
+    state: "{{ 'directory' if jitsi__turn else 'absent' }}"
+    mode: "0755"
+    owner: root
+    group: root
+  become: true
+
+# Readable by uid 1000, which coturn runs as.
+- name: deploy the coturn configuration
+  ansible.builtin.template:
+    src: turnserver.conf.j2
+    dest: "{{ jitsi__base_dir }}/coturn/turnserver.conf"
+    mode: "0640"
+    owner: root
+    group: "1000"
+  become: true
+  when: jitsi__turn
+  notify: restart jitsi coturn
+
+# coturn doesn't notice the certificate renewed by the web container on its own.
+- name: ensure the weekly coturn restart cron job is present
+  ansible.builtin.cron:
+    name: "jitsi coturn restart for certificate renewal"
+    special_time: weekly
+    job: "cd {{ jitsi__base_dir }} && docker compose restart coturn >/dev/null"
+    state: "{{ 'present' if jitsi__turn else 'absent' }}"
+  become: true
+
+# Changes to these make `docker compose up` below recreate the affected containers.
+- name: deploy the compose override file
+  ansible.builtin.template:
+    src: compose.override.yaml.j2
+    dest: "{{ jitsi__base_dir }}/compose.override.yaml"
+    mode: "0644"
+    owner: root
+    group: root
+  become: true
+
+- name: deploy the .env file
+  ansible.builtin.template:
+    src: jitsi.env.j2
+    dest: "{{ jitsi__base_dir }}/.env"
+    mode: "0600"
+    owner: root
+    group: root
+  become: true
+
+- name: docker compose up
+  community.docker.docker_compose_v2:
+    project_src: "{{ jitsi__base_dir }}"
+    project_name: jitsi
+    files: "{{ jitsi__compose_files }}"
+    state: present
+    pull: missing
+    remove_orphans: true
+  become: true
+
+- name: find old releases
+  ansible.builtin.find:
+    paths: "{{ jitsi__base_dir }}/releases"
+    file_type: directory
+    excludes: "docker-jitsi-meet-{{ jitsi__version }}"
+  register: jitsi__old_releases
+
+- name: remove old releases
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  become: true
+  loop: "{{ jitsi__old_releases.files }}"
+  loop_control:
+    label: "{{ item.path }}"