ansible-infra/roles/jitsi

Role jitsi

A role for deploying Jitsi Meet using the official docker-jitsi-meet release.

The given release is downloaded and unpacked unmodified to /opt/jitsi/releases/ and /opt/jitsi/release is pointed to it. The .env file at /opt/jitsi/.env is fully managed by this role; env.example and gen-passwords.sh of the release are not used. The .env also sets COMPOSE_PROJECT_NAME and COMPOSE_FILE, so docker compose can be run by hand in /opt/jitsi. The Jitsi configuration directory (CONFIG) is /opt/jitsi/config, with persistent state in /opt/jitsi/config/storage/. The image version (JITSI_IMAGE_VERSION) always equals the release version, so upgrading means bumping jitsi__version. Releases other than the configured one are removed.

TLS certificates are obtained by the web container itself using Let's Encrypt, so ports 80/tcp and 443/tcp as well as 10000/udp (media) must be reachable.

Optionally, a coturn TURN server and the Prometheus Jitsi Meet exporter are deployed as additional services of the same Compose project, defined in /opt/jitsi/compose.override.yaml. coturn uses the certificate obtained by the web container and is restarted weekly to pick up renewals. It needs 3478/udp+tcp, 5349/tcp and the relay port range 49152-65535/udp to be reachable. The exporter scrapes the JVB statistics and listens on port 9888.

Files can be added to or replaced in the Jitsi Meet web root (/usr/share/jitsi-meet in the web container) using jitsi__web_files, e.g. for branding. They are deployed to /opt/jitsi/web-files/ and bind-mounted into the web container.

Supported Distributions

Should work on Debian-based distributions.

Required Arguments

• jitsi__version: The docker-jitsi-meet release to deploy, e.g. stable-11248.
• jitsi__domain: The domain Jitsi is served on. Used for PUBLIC_URL and the Let's Encrypt certificate.
• jitsi__letsencrypt_email: The e-mail address for the Let's Encrypt account.
• jitsi__jicofo_auth_password: XMPP password for Jicofo. Generate using openssl rand -hex 16.
• jitsi__jvb_auth_password: XMPP password for the JVB. Generate using openssl rand -hex 16.

Optional Arguments

• jitsi__timezone: The time zone for the containers.
  Defaults to Europe/Berlin.
• jitsi__jvb_advertise_ips: List of IP addresses the JVB should advertise for media (JVB_ADVERTISE_IPS).
  Defaults to [ ].
• jitsi__whiteboard: Whether to deploy the Excalidraw whiteboard backend (whiteboard.yml).
  Defaults to false.
• jitsi__turn: Whether to deploy coturn and configure Jitsi to use it.
  Defaults to false.
• jitsi__turn_secret: The shared secret between Prosody and coturn. Required if jitsi__turn is true. Generate using openssl rand -hex 32.
• jitsi__prometheus_exporter: Whether to deploy the Prometheus Jitsi Meet exporter on port 9888.
  Defaults to false.
• jitsi__env: Dictionary of additional variables to put into the .env file. See env.example of the release and the handbook for available variables.
  Defaults to { }.
• jitsi__custom_config_js: Content of custom-config.js, which gets appended to the generated config.js.
  Defaults to "" (no file).
• jitsi__custom_interface_config_js: Content of custom-interface_config.js, which gets appended to the generated interface_config.js.
  Defaults to "" (no file).
• jitsi__web_files: List of files to mount into the Jitsi Meet web root.
  Defaults to [ ].
• jitsi__web_files.*.path: Path relative to the web root, e.g. images/watermark.svg or static/welcomePageAdditionalContent.html.
• jitsi__web_files.*.content: The content of the file.

Links & Resources

• https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/
• https://github.com/jitsi/docker-jitsi-meet
• https://github.com/jitsi/docker-jitsi-meet/releases