Add a role for Jitsi in Docker Compose
We need this role to follow the recommended deployment approach from https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/ This role enables us to keep our config and customizations separate from releases of the Compose setup the Jitsi project publishs.
This commit is contained in:
parent
78ee1382d5
commit
dbac5ede16
11 changed files with 462 additions and 0 deletions
40
roles/jitsi/templates/compose.override.yaml.j2
Normal file
40
roles/jitsi/templates/compose.override.yaml.j2
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# {{ ansible_managed }}
|
||||
# Services in addition to the ones of the docker-jitsi-meet release.
|
||||
|
||||
# Docker Compose explicitly disables IPv6 for networks not enabling it, overriding the
|
||||
# daemon's default-network-opts.
|
||||
networks:
|
||||
meet.jitsi:
|
||||
enable_ipv6: true
|
||||
|
||||
services:
|
||||
{% if jitsi__turn %}
|
||||
coturn:
|
||||
image: docker.io/coturn/coturn:4.18.0
|
||||
restart: unless-stopped
|
||||
# Recommended by coturn, as Docker performs badly with large port ranges.
|
||||
network_mode: host
|
||||
# Needs to be able to read the certificate obtained by the web container.
|
||||
user: "1000:1000"
|
||||
command: ["-c", "/etc/coturn/turnserver.conf"]
|
||||
volumes:
|
||||
- {{ jitsi__base_dir }}/coturn/turnserver.conf:/etc/coturn/turnserver.conf:ro
|
||||
- {{ jitsi__config_dir }}/storage/web/acme-certs/{{ jitsi__domain }}:/certs:ro
|
||||
tmpfs:
|
||||
- /var/lib/coturn
|
||||
{% endif %}
|
||||
{% if jitsi__prometheus_exporter %}
|
||||
prometheus-jitsi-meet-exporter:
|
||||
image: docker.io/systemli/prometheus-jitsi-meet-exporter:1.4.2
|
||||
restart: unless-stopped
|
||||
command: ["-videobridge-url", "http://jvb:8080/colibri/stats"]
|
||||
ports:
|
||||
- "9888:9888"
|
||||
depends_on:
|
||||
- jvb
|
||||
networks:
|
||||
meet.jitsi:
|
||||
{% endif %}
|
||||
{% if not (jitsi__turn or jitsi__prometheus_exporter) %}
|
||||
{}
|
||||
{% endif %}
|
||||
46
roles/jitsi/templates/jitsi.env.j2
Normal file
46
roles/jitsi/templates/jitsi.env.j2
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# {{ ansible_managed }}
|
||||
# Only the settings differing from the defaults are set here.
|
||||
# Reference: {{ jitsi__base_dir }}/release/env.example and
|
||||
# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
|
||||
|
||||
# Allow running `docker compose` by hand in {{ jitsi__base_dir }}.
|
||||
COMPOSE_PROJECT_NAME=jitsi
|
||||
COMPOSE_FILE={{ jitsi__compose_files | join(':') }}
|
||||
|
||||
CONFIG={{ jitsi__config_dir }}
|
||||
JITSI_IMAGE_VERSION={{ jitsi__version }}
|
||||
TZ={{ jitsi__timezone }}
|
||||
PUBLIC_URL=https://{{ jitsi__domain }}
|
||||
|
||||
HTTP_PORT=80
|
||||
HTTPS_PORT=443
|
||||
ENABLE_HTTP_REDIRECT=1
|
||||
ENABLE_LETSENCRYPT=1
|
||||
LETSENCRYPT_DOMAIN={{ jitsi__domain }}
|
||||
LETSENCRYPT_EMAIL={{ jitsi__letsencrypt_email }}
|
||||
LETSENCRYPT_ACME_SERVER=letsencrypt
|
||||
{% if jitsi__jvb_advertise_ips | length > 0 %}
|
||||
JVB_ADVERTISE_IPS={{ jitsi__jvb_advertise_ips | join(',') }}
|
||||
{% endif %}
|
||||
{% if jitsi__whiteboard %}
|
||||
|
||||
WHITEBOARD_COLLAB_SERVER_URL_BASE=http://whiteboard.meet.jitsi
|
||||
{% endif %}
|
||||
{% if jitsi__turn %}
|
||||
|
||||
TURN_CREDENTIALS={{ jitsi__turn_secret }}
|
||||
TURN_HOST={{ jitsi__domain }}
|
||||
TURN_PORT=3478
|
||||
TURN_TRANSPORT=udp,tcp
|
||||
TURNS_HOST={{ jitsi__domain }}
|
||||
TURNS_PORT=5349
|
||||
{% endif %}
|
||||
{% if jitsi__env | length > 0 %}
|
||||
|
||||
{% for key, value in jitsi__env.items() %}
|
||||
{{ key }}={{ value }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
JICOFO_AUTH_PASSWORD={{ jitsi__jicofo_auth_password }}
|
||||
JVB_AUTH_PASSWORD={{ jitsi__jvb_auth_password }}
|
||||
34
roles/jitsi/templates/turnserver.conf.j2
Normal file
34
roles/jitsi/templates/turnserver.conf.j2
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# {{ ansible_managed }}
|
||||
listening-port=3478
|
||||
tls-listening-port=5349
|
||||
realm={{ jitsi__domain }}
|
||||
use-auth-secret
|
||||
static-auth-secret={{ jitsi__turn_secret }}
|
||||
cert=/certs/fullchain.pem
|
||||
pkey=/certs/key.pem
|
||||
no-tlsv1
|
||||
no-tlsv1_1
|
||||
no-cli
|
||||
no-multicast-peers
|
||||
no-loopback-peers
|
||||
log-file=stdout
|
||||
# Don't relay to private and otherwise special addresses.
|
||||
denied-peer-ip=0.0.0.0-0.255.255.255
|
||||
denied-peer-ip=10.0.0.0-10.255.255.255
|
||||
denied-peer-ip=100.64.0.0-100.127.255.255
|
||||
denied-peer-ip=127.0.0.0-127.255.255.255
|
||||
denied-peer-ip=169.254.0.0-169.254.255.255
|
||||
denied-peer-ip=172.16.0.0-172.31.255.255
|
||||
denied-peer-ip=192.0.0.0-192.0.0.255
|
||||
denied-peer-ip=192.0.2.0-192.0.2.255
|
||||
denied-peer-ip=192.88.99.0-192.88.99.255
|
||||
denied-peer-ip=192.168.0.0-192.168.255.255
|
||||
denied-peer-ip=198.18.0.0-198.19.255.255
|
||||
denied-peer-ip=198.51.100.0-198.51.100.255
|
||||
denied-peer-ip=203.0.113.0-203.0.113.255
|
||||
denied-peer-ip=240.0.0.0-255.255.255.255
|
||||
denied-peer-ip=::1
|
||||
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
|
||||
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
|
||||
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
Loading…
Reference in a new issue