forked from CCCHH/ansible-infra
Stefan Bethke
ce96105463
Since the Jitsi Docker Compose stack does not properly take IPv6 into consideration, patch the JVB config to add mappings from the private IPv6 address of the Docker network to the public IPv6 address. This should be the source of the reported problems with conferences with 3+ people.
70 lines
4.5 KiB
Markdown
70 lines
4.5 KiB
Markdown
# Role `jitsi`
|
|
|
|
A role for deploying [Jitsi Meet](https://jitsi.org/) using the official [docker-jitsi-meet](https://github.com/jitsi/docker-jitsi-meet) release.
|
|
|
|
The given release is downloaded and unpacked unmodified to `/opt/jitsi/releases/` and `/opt/jitsi/release` is pointed to it.
|
|
The `.env` file at `/opt/jitsi/.env` is fully managed by this role; `env.example` and `gen-passwords.sh` of the release are not used.
|
|
The `.env` also sets `COMPOSE_PROJECT_NAME` and `COMPOSE_FILE`, so `docker compose` can be run by hand in `/opt/jitsi`.
|
|
The Jitsi configuration directory (`CONFIG`) is `/opt/jitsi/config`, with persistent state in `/opt/jitsi/config/storage/`.
|
|
The image version (`JITSI_IMAGE_VERSION`) always equals the release version, so upgrading means bumping `jitsi__version`.
|
|
Releases other than the configured one are removed.
|
|
|
|
TLS certificates are obtained by the web container itself using Let's Encrypt, so ports 80/tcp and 443/tcp as well as 10000/udp (media) must be reachable.
|
|
|
|
Optionally, a [coturn](https://github.com/coturn/coturn) TURN server and the [Prometheus Jitsi Meet exporter](https://github.com/systemli/prometheus-jitsi-meet-exporter) are deployed as additional services of the same Compose project, defined in `/opt/jitsi/compose.override.yaml`.
|
|
coturn uses the certificate obtained by the web container and is restarted weekly to pick up renewals.
|
|
It needs 3478/udp+tcp, 5349/tcp and the relay port range 49152-65535/udp to be reachable.
|
|
The exporter scrapes the JVB statistics and listens on port 9888.
|
|
|
|
Files can be added to or replaced in the Jitsi Meet web root (`/usr/share/jitsi-meet` in the web container) using `jitsi__web_files`, e.g. for branding.
|
|
They are deployed to `/opt/jitsi/web-files/` and bind-mounted into the web container.
|
|
|
|
## Supported Distributions
|
|
|
|
Should work on Debian-based distributions.
|
|
|
|
## Required Arguments
|
|
|
|
- `jitsi__version`: The docker-jitsi-meet release to deploy, e.g. `stable-11248`.
|
|
- `jitsi__domain`: The domain Jitsi is served on. Used for `PUBLIC_URL` and the Let's Encrypt certificate.
|
|
- `jitsi__letsencrypt_email`: The e-mail address for the Let's Encrypt account.
|
|
- `jitsi__jicofo_auth_password`: XMPP password for Jicofo. Generate using `openssl rand -hex 16`.
|
|
- `jitsi__jvb_auth_password`: XMPP password for the JVB. Generate using `openssl rand -hex 16`.
|
|
|
|
## Optional Arguments
|
|
|
|
- `jitsi__timezone`: The time zone for the containers.
|
|
Defaults to `Europe/Berlin`.
|
|
- `jitsi__jvb_advertise_ips`: List of IP addresses the JVB should advertise for media.
|
|
IPv4 addresses are put into `JVB_ADVERTISE_IPS`, which docker-jitsi-meet maps to the IPv4 address of the JVB container.
|
|
IPv6 addresses are mapped to the IPv6 address of the JVB container in `custom-jvb.conf` instead, for which the `meet.jitsi` network gets a fixed IPv6 subnet and the JVB a fixed IPv6 address.
|
|
Defaults to `[ ]`.
|
|
- `jitsi__ipv6_subnet`: The IPv6 subnet of the `meet.jitsi` network, if IPv6 addresses are advertised.
|
|
Defaults to `fd4a:7c1e:93b5:1::/64`.
|
|
- `jitsi__jvb_ipv6_address`: The IPv6 address of the JVB container within `jitsi__ipv6_subnet`.
|
|
Defaults to `fd4a:7c1e:93b5:1::10`.
|
|
- `jitsi__whiteboard`: Whether to deploy the Excalidraw whiteboard backend (`whiteboard.yml`).
|
|
Defaults to `false`.
|
|
- `jitsi__turn`: Whether to deploy coturn and configure Jitsi to use it.
|
|
Defaults to `false`.
|
|
- `jitsi__turn_secret`: The shared secret between Prosody and coturn. Required if `jitsi__turn` is `true`.
|
|
Generate using `openssl rand -hex 32`.
|
|
- `jitsi__prometheus_exporter`: Whether to deploy the Prometheus Jitsi Meet exporter on port 9888.
|
|
Defaults to `false`.
|
|
- `jitsi__env`: Dictionary of additional variables to put into the `.env` file.
|
|
See `env.example` of the release and the handbook for available variables.
|
|
Defaults to `{ }`.
|
|
- `jitsi__custom_config_js`: Content of `custom-config.js`, which gets appended to the generated `config.js`.
|
|
Defaults to `""` (no file).
|
|
- `jitsi__custom_interface_config_js`: Content of `custom-interface_config.js`, which gets appended to the generated `interface_config.js`.
|
|
Defaults to `""` (no file).
|
|
- `jitsi__web_files`: List of files to mount into the Jitsi Meet web root.
|
|
Defaults to `[ ]`.
|
|
- `jitsi__web_files.*.path`: Path relative to the web root, e.g. `images/watermark.svg` or `static/welcomePageAdditionalContent.html`.
|
|
- `jitsi__web_files.*.content`: The content of the file.
|
|
|
|
## Links & Resources
|
|
|
|
- <https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/>
|
|
- <https://github.com/jitsi/docker-jitsi-meet>
|
|
- <https://github.com/jitsi/docker-jitsi-meet/releases>
|