ansible-infra/roles/jitsi/tasks/main.yaml

- name: make sure a TURN secret is given, if TURN is enabled
  ansible.builtin.assert:
    that:
      - jitsi__turn_secret is defined
      - jitsi__turn_secret | length > 0
    quiet: true
  when: jitsi__turn

- name: make sure the Jitsi base directories exist
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    mode: "0755"
    owner: root
    group: root
  become: true
  loop:
    - "{{ jitsi__base_dir }}"
    - "{{ jitsi__base_dir }}/releases"

- name: make sure the docker-jitsi-meet release is present
  ansible.builtin.unarchive:
    src: "https://github.com/jitsi/docker-jitsi-meet/archive/refs/tags/{{ jitsi__version }}.tar.gz"
    remote_src: true
    dest: "{{ jitsi__base_dir }}/releases"
    creates: "{{ jitsi__release_dir }}/docker-compose.yml"
    owner: root
    group: root
  become: true

- name: point the `release` symlink to the configured release
  ansible.builtin.file:
    src: "{{ jitsi__release_dir }}"
    dest: "{{ jitsi__base_dir }}/release"
    state: link
    owner: root
    group: root
  become: true

# Configuration read by the containers at startup; managed by Ansible.
- name: make sure the configuration input directories exist
  ansible.builtin.file:
    path: "{{ jitsi__config_dir }}/{{ item }}"
    state: directory
    mode: "0755"
    owner: root
    group: root
  become: true
  loop:
    - ""
    - web
    - prosody
    - prosody/config
    - prosody/prosody-plugins-custom
    - jicofo
    - jvb
    - storage
    - tmp

# State written by the containers, which run as uid/gid 1000.
# The certificate directory is created here, as Docker would otherwise create it owned by
# root for the coturn bind mount, before the web container gets to write the certificate.
- name: make sure the storage and tmp directories exist and are writable by the containers
  ansible.builtin.file:
    path: "{{ jitsi__config_dir }}/{{ item }}"
    state: directory
    mode: "0750"
    owner: "1000"
    group: "1000"
  become: true
  loop:
    - storage/prosody
    - storage/web
    - storage/web/acme-certs
    - "storage/web/acme-certs/{{ jitsi__domain }}"
    - storage/transcripts
    - tmp/web-crontabs
    - tmp/web-load-test

- name: deploy custom web configuration
  ansible.builtin.copy:
    content: "{{ item.content }}"
    dest: "{{ jitsi__config_dir }}/web/{{ item.name }}"
    mode: "0644"
    owner: root
    group: root
  become: true
  when: item.content != ""
  loop:
    - name: custom-config.js
      content: "{{ jitsi__custom_config_js }}"
    - name: custom-interface_config.js
      content: "{{ jitsi__custom_interface_config_js }}"
  loop_control:
    label: "{{ item.name }}"
  notify: restart jitsi web

- name: remove unconfigured custom web configuration
  ansible.builtin.file:
    path: "{{ jitsi__config_dir }}/web/{{ item.name }}"
    state: absent
  become: true
  when: item.content == ""
  loop:
    - name: custom-config.js
      content: "{{ jitsi__custom_config_js }}"
    - name: custom-interface_config.js
      content: "{{ jitsi__custom_interface_config_js }}"
  loop_control:
    label: "{{ item.name }}"
  notify: restart jitsi web

- name: make sure the coturn directory exists
  ansible.builtin.file:
    path: "{{ jitsi__base_dir }}/coturn"
    state: "{{ 'directory' if jitsi__turn else 'absent' }}"
    mode: "0755"
    owner: root
    group: root
  become: true

# Readable by uid 1000, which coturn runs as.
- name: deploy the coturn configuration
  ansible.builtin.template:
    src: turnserver.conf.j2
    dest: "{{ jitsi__base_dir }}/coturn/turnserver.conf"
    mode: "0640"
    owner: root
    group: "1000"
  become: true
  when: jitsi__turn
  notify: restart jitsi coturn

# coturn doesn't notice the certificate renewed by the web container on its own.
- name: ensure the weekly coturn restart cron job is present
  ansible.builtin.cron:
    name: "jitsi coturn restart for certificate renewal"
    special_time: weekly
    job: "cd {{ jitsi__base_dir }} && docker compose restart coturn >/dev/null"
    state: "{{ 'present' if jitsi__turn else 'absent' }}"
  become: true

# Files mounted into the web container, replacing or adding to the files of Jitsi Meet.
- name: make sure the directories for the web files exist
  ansible.builtin.file:
    path: "{{ jitsi__base_dir }}/web-files/{{ item }}"
    state: directory
    mode: "0755"
    owner: root
    group: root
  become: true
  loop: "{{ [''] + (jitsi__web_files | map(attribute='path') | map('dirname') | unique | reject('equalto', '') | list) }}"

- name: deploy the web files
  ansible.builtin.copy:
    content: "{{ item.content }}"
    dest: "{{ jitsi__base_dir }}/web-files/{{ item.path }}"
    mode: "0644"
    owner: root
    group: root
  become: true
  loop: "{{ jitsi__web_files }}"
  loop_control:
    label: "{{ item.path }}"
  # Single file bind mounts keep pointing to the replaced file until the container is restarted.
  notify: restart jitsi web

- name: find web files to remove
  ansible.builtin.find:
    paths: "{{ jitsi__base_dir }}/web-files"
    recurse: true
  register: jitsi__web_files_found

- name: remove web files, which should be removed
  ansible.builtin.file:
    path: "{{ item }}"
    state: absent
  become: true
  loop: "{{ jitsi__web_files_found.files | map(attribute='path') | reject('in', jitsi__web_files_paths) | list }}"
  vars:
    jitsi__web_files_paths: "{{ jitsi__web_files | map(attribute='path') | map('regex_replace', '^', jitsi__base_dir ~ '/web-files/') | list }}"

# Changes to these make `docker compose up` below recreate the affected containers.
- name: deploy the compose override file
  ansible.builtin.template:
    src: compose.override.yaml.j2
    dest: "{{ jitsi__base_dir }}/compose.override.yaml"
    mode: "0644"
    owner: root
    group: root
  become: true

- name: deploy the .env file
  ansible.builtin.template:
    src: jitsi.env.j2
    dest: "{{ jitsi__base_dir }}/.env"
    mode: "0600"
    owner: root
    group: root
  become: true

- name: docker compose up
  community.docker.docker_compose_v2:
    project_src: "{{ jitsi__base_dir }}"
    project_name: jitsi
    files: "{{ jitsi__compose_files }}"
    state: present
    pull: missing
    remove_orphans: true
  become: true

- name: find old releases
  ansible.builtin.find:
    paths: "{{ jitsi__base_dir }}/releases"
    file_type: directory
    excludes: "docker-jitsi-meet-{{ jitsi__version }}"
  register: jitsi__old_releases

- name: remove old releases
  ansible.builtin.file:
    path: "{{ item.path }}"
    state: absent
  become: true
  loop: "{{ jitsi__old_releases.files }}"
  loop_control:
    label: "{{ item.path }}"