From 3e9e6f8b53fa753c54a876ecd8cc8bdfbc33da00 Mon Sep 17 00:00:00 2001 From: meliurwen Date: Fri, 28 May 2021 12:40:21 +0200 Subject: [PATCH] First iteration to sort out and clean the mess of the official docker-compose multi-container stack --- .env.example | 92 +++++++++++++++++++++++++++++++ .gitignore | 1 + docker-compose.yml | 131 ++++++++++++++++++++++++++++++++++++++++++++ gen-passwords.sh | 21 +++++++ jicofo.env.example | 19 +++++++ jvb.env.example | 19 +++++++ prosody.env.example | 116 +++++++++++++++++++++++++++++++++++++++ web.env.example | 102 ++++++++++++++++++++++++++++++++++ 8 files changed, 501 insertions(+) create mode 100644 .env.example create mode 100644 .gitignore create mode 100644 docker-compose.yml create mode 100755 gen-passwords.sh create mode 100644 jicofo.env.example create mode 100644 jvb.env.example create mode 100644 prosody.env.example create mode 100644 web.env.example diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..376d4ac --- /dev/null +++ b/.env.example @@ -0,0 +1,92 @@ +# Global Settings +LOCAL_STACK_DIR=/srv/docker/volumes/jitsi-meet +TZ=Europe/Berlin + +# Jitsi Web Frontend +WEB_IMG= +WEB_TAG= +WEB_CONTAINER_NAME= +WEB_RESTART= + +# Prosody (XMPP Server) +PRS_IMG= +PRS_TAG= +PRS_CONTAINER_NAME= +PRS_RESTART= + +# Jicofo (Focus Component) +JCF_IMG= +JCF_TAG= +JCF_CONTAINER_NAME= +JCF_RESTART= + +# Jvb (Video Bridge) +JVB_IMG= +JVB_TAG= +JVB_CONTAINER_NAME= +JVB_RESTART= +# Media port +JVB_PORT=10000 + +# Public URL for the web service (required) +PUBLIC_URL=https://sub.domain.tld + +# +# Security +# +# - Set these to strong passwords to avoid intruders from impersonating a +# service account. +# - The service(s) won't start unless these are specified. +# - Running ./gen-passwords.sh will update .env with strong passwords. +# - You may skip the Jigasi and Jibri passwords if you are not using those. +# - DO NOT reuse passwords. +# +# Prosody (XMPP Server) and Jicofo (Focus Component) +# +# XMPP component password for Jicofo +JICOFO_COMPONENT_SECRET= +# XMPP password for Jicofo client connections +JICOFO_AUTH_PASSWORD= +# +# Prosody (XMPP Server) and Jvb (Video Bridge) +# +# XMPP password for JVB client connections +JVB_AUTH_PASSWORD= + +# +# Authentication configuration (see handbook for details) +# +# Enable authentication +ENABLE_AUTH=1 +# Enable guest access +ENABLE_GUESTS=1 +# Select authentication type: internal, jwt or ldap +AUTH_TYPE=internal + +# +# Advanced configuration options (you generally don't need to change these) +# +# Internal XMPP domain +XMPP_DOMAIN=meet.jitsi +# Internal XMPP server +XMPP_SERVER=xmpp.meet.jitsi +# Internal XMPP domain for authenticated services +XMPP_AUTH_DOMAIN=auth.meet.jitsi +# XMPP domain for the MUC +XMPP_MUC_DOMAIN=muc.meet.jitsi +# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools +XMPP_INTERNAL_MUC_DOMAIN=internal-muc.meet.jitsi +# XMPP domain for unauthenticated users +XMPP_GUEST_DOMAIN=guest.meet.jitsi + +# MUC for the JVB pool +JVB_BREWERY_MUC=jvbbrewery +# XMPP user for JVB client connections +JVB_AUTH_USER=jvb + +# XMPP user for Jicofo client connections. +# NOTE: this option doesn't currently work due to a bug +JICOFO_AUTH_USER=focus + +# XMPP domain for the jibri recorder +XMPP_RECORDER_DOMAIN=recorder.meet.jitsi diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..03bd412 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +*.env diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..4776867 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,131 @@ +version: "3" + +services: + web: + image: ${WEB_IMG:-jitsi/web}:${WEB_TAG:-latest} + container_name: ${WEB_CONTAINER_NAME:-jitsi-web} + restart: ${WEB_RESTART:-unless-stopped} + expose: + - "80" + - "8443" + networks: + meet.jitsi: + aliases: + - ${XMPP_DOMAIN} + webservices: + volumes: + - ${LOCAL_STACK_DIR}/web:/config:Z + - ${LOCAL_STACK_DIR}/transcripts:/usr/share/jitsi-meet/transcripts:Z + - ${LOCAL_STACK_DIR}/web/custom/images:/usr/share/jitsi-meet/images:ro + - ${LOCAL_STACK_DIR}/web/custom/title.html:/usr/share/jitsi-meet/title.html:ro + env_file: + - web.env + environment: + - TZ + - ENABLE_XMPP_WEBSOCKET + - PUBLIC_URL + - ENABLE_AUTH + - ENABLE_GUESTS + - JICOFO_AUTH_USER + - XMPP_AUTH_DOMAIN + - XMPP_DOMAIN + - XMPP_GUEST_DOMAIN + - XMPP_MUC_DOMAIN + - XMPP_RECORDER_DOMAIN + + prosody: + image: ${PRS_IMG:-jitsi/prosody}:${PRS_TAG:-latest} + container_name: ${PRS_CONTAINER_NAME:-jitsi-prosody} + restart: ${PRS_RESTART:-unless-stopped} + expose: + - "5222" + - "5347" + - "5280" + networks: + meet.jitsi: + aliases: + - ${XMPP_SERVER} + volumes: + - ${LOCAL_STACK_DIR}/prosody/config:/config:Z + - ${LOCAL_STACK_DIR}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z + env_file: + - prosody.env + environment: + - TZ + - JICOFO_COMPONENT_SECRET + - JICOFO_AUTH_PASSWORD + - JVB_AUTH_PASSWORD + - AUTH_TYPE + - ENABLE_AUTH + - ENABLE_GUESTS + - ENABLE_XMPP_WEBSOCKET + - XMPP_DOMAIN + - XMPP_AUTH_DOMAIN + - XMPP_GUEST_DOMAIN + - XMPP_MUC_DOMAIN + - XMPP_INTERNAL_MUC_DOMAIN + - XMPP_RECORDER_DOMAIN + - JICOFO_AUTH_USER + - JVB_AUTH_USER + - PUBLIC_URL + + jicofo: + image: ${JCF_IMG:-jitsi/jicofo}:${JCF_TAG:-latest} + container_name: ${JCF_CONTAINER_NAME:-jitsi-jicofo} + restart: ${JCF_RESTART:-unless-stopped} + networks: + meet.jitsi: + volumes: + - ${LOCAL_STACK_DIR}/jicofo:/config:Z + env_file: + - jicofo.env + environment: + - TZ + - JICOFO_COMPONENT_SECRET + - JICOFO_AUTH_PASSWORD + - AUTH_TYPE + - ENABLE_AUTH + - XMPP_DOMAIN + - XMPP_AUTH_DOMAIN + - XMPP_INTERNAL_MUC_DOMAIN + - XMPP_MUC_DOMAIN + - XMPP_SERVER + - JICOFO_AUTH_USER + - JVB_BREWERY_MUC + depends_on: + - prosody + + jvb: + image: ${JVB_IMG:-jitsi/jvb}:${JVB_TAG:-latest} + container_name: ${JVB_CONTAINER_NAME:-jitsi-jvb} + restart: ${JVB_RESTART:-unless-stopped} + ports: + - "${JVB_PORT}:${JVB_PORT}/udp" + - "${JVB_TCP_PORT}:${JVB_TCP_PORT}" + networks: + meet.jitsi: + aliases: + - jvb.meet.jitsi + volumes: + - ${LOCAL_STACK_DIR}/jvb:/config:Z + env_file: + - jvb.env + environment: + - TZ + - JVB_AUTH_PASSWORD + - XMPP_AUTH_DOMAIN + - XMPP_INTERNAL_MUC_DOMAIN + - XMPP_SERVER + - JVB_AUTH_USER + - JVB_BREWERY_MUC + - JVB_PORT + - PUBLIC_URL + depends_on: + - prosody + +# Custom network so all services can communicate using a FQDN +networks: + meet.jitsi: + webservices: + external: + name: webservices diff --git a/gen-passwords.sh b/gen-passwords.sh new file mode 100755 index 0000000..43d5b95 --- /dev/null +++ b/gen-passwords.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +function generatePassword() { + openssl rand -hex 16 +} + +JICOFO_COMPONENT_SECRET=$(generatePassword) +JICOFO_AUTH_PASSWORD=$(generatePassword) +JVB_AUTH_PASSWORD=$(generatePassword) +JIGASI_XMPP_PASSWORD=$(generatePassword) +JIBRI_RECORDER_PASSWORD=$(generatePassword) +JIBRI_XMPP_PASSWORD=$(generatePassword) + +sed -i.bak \ + -e "s#JICOFO_COMPONENT_SECRET=.*#JICOFO_COMPONENT_SECRET=${JICOFO_COMPONENT_SECRET}#g" \ + -e "s#JICOFO_AUTH_PASSWORD=.*#JICOFO_AUTH_PASSWORD=${JICOFO_AUTH_PASSWORD}#g" \ + -e "s#JVB_AUTH_PASSWORD=.*#JVB_AUTH_PASSWORD=${JVB_AUTH_PASSWORD}#g" \ + -e "s#JIGASI_XMPP_PASSWORD=.*#JIGASI_XMPP_PASSWORD=${JIGASI_XMPP_PASSWORD}#g" \ + -e "s#JIBRI_RECORDER_PASSWORD=.*#JIBRI_RECORDER_PASSWORD=${JIBRI_RECORDER_PASSWORD}#g" \ + -e "s#JIBRI_XMPP_PASSWORD=.*#JIBRI_XMPP_PASSWORD=${JIBRI_XMPP_PASSWORD}#g" \ + "$(dirname "$0")/*.env" diff --git a/jicofo.env.example b/jicofo.env.example new file mode 100644 index 0000000..39065d8 --- /dev/null +++ b/jicofo.env.example @@ -0,0 +1,19 @@ + +# Base URL of Jicofo's reservation REST API +#JICOFO_RESERVATION_REST_BASE_URL=http://reservation.example.com +# MUC name for the Jigasi pool +JIGASI_BREWERY_MUC=jigasibrewery + +# SIP URI for incoming / outgoing calls +#JIGASI_SIP_URI=test@sip2sip.info + +# MUC name for the Jibri pool +JIBRI_BREWERY_MUC=jibribrewery + +# MUC connection timeout +JIBRI_PENDING_TIMEOUT=90 + +# Enable Jicofo's health check REST API (http://:8888/about/health) +#JICOFO_ENABLE_HEALTH_CHECKS=true + +JICOFO_MAX_MEMORY=500m diff --git a/jvb.env.example b/jvb.env.example new file mode 100644 index 0000000..2d17fe8 --- /dev/null +++ b/jvb.env.example @@ -0,0 +1,19 @@ + +# IP address of the Docker host +# See the "Running behind NAT or on a LAN environment" section in the Handbook: +# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-nat-or-on-a-lan-environment +#DOCKER_HOST_ADDRESS=192.168.1.1 +# TCP Fallback for Jitsi Videobridge for when UDP isn't available +JVB_TCP_HARVESTER_DISABLED=true +JVB_TCP_PORT=4443 +JVB_TCP_MAPPED_PORT=4443 +# STUN servers used to discover the server's public IP +JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443 +# A comma separated list of APIs to enable when the JVB is started [default: none] +# See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information +#JVB_ENABLE_APIS=rest,colibri + +JVB_WS_DOMAIN +JVB_WS_SERVER_ID + +VIDEOBRIDGE_MAX_MEMORY=500m diff --git a/prosody.env.example b/prosody.env.example new file mode 100644 index 0000000..1ebf6a1 --- /dev/null +++ b/prosody.env.example @@ -0,0 +1,116 @@ + + +# Control whether the lobby feature should be enabled or not +ENABLE_LOBBY=1 + +GLOBAL_MODULES +GLOBAL_CONFIG +# LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page) +# + +# LDAP url for connection +#LDAP_URL=ldaps://ldap.domain.com/ + +# LDAP base DN. Can be empty +#LDAP_BASE=DC=example,DC=domain,DC=com + +# LDAP user DN. Do not specify this parameter for the anonymous bind +#LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com + +# LDAP user password. Do not specify this parameter for the anonymous bind +#LDAP_BINDPW=LdapUserPassw0rd + +# LDAP filter. Tokens example: +# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail +# %s - %s is replaced by the complete service string +# %r - %r is replaced by the complete realm string +#LDAP_FILTER=(sAMAccountName=%u) + +# LDAP authentication method +#LDAP_AUTH_METHOD=bind + +# LDAP version +#LDAP_VERSION=3 + +# LDAP TLS using +#LDAP_USE_TLS=1 + +# List of SSL/TLS ciphers to allow +#LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC + +# Require and verify server certificate +#LDAP_TLS_CHECK_PEER=1 + +# Path to CA cert file. Used when server certificate verify is enabled +#LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt + +# Path to CA certs directory. Used when server certificate verify is enabled +#LDAP_TLS_CACERT_DIR=/etc/ssl/certs + +# Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps:// +# LDAP_START_TLS=1 + +# Custom Prosody modules for XMPP_DOMAIN (comma separated) +XMPP_MODULES= + +# Custom Prosody modules for MUC component (comma separated) +XMPP_MUC_MODULES= + +# Custom Prosody modules for internal MUC component (comma separated) +XMPP_INTERNAL_MUC_MODULES= + +# XMPP user for Jigasi MUC client connections +JIGASI_XMPP_USER=jigasi + +# XMPP password for Jigasi MUC client connections +JIGASI_XMPP_PASSWORD= + + +# XMPP user for Jibri client connections +JIBRI_XMPP_USER=jibri +# XMPP password for Jibri client connections +JIBRI_XMPP_PASSWORD= +# XMPP recorder user for Jibri client connections +JIBRI_RECORDER_USER=recorder +# XMPP recorder password for Jibri client connections +JIBRI_RECORDER_PASSWORD= + +# Directory for recordings inside Jibri container +JIBRI_RECORDING_DIR=/config/recordings + +# The finalizing script. Will run after recording is complete +JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh + +# When jibri gets a request to start a service for a room, the room +# jid will look like: roomName@optional.prefixes.subdomain.xmpp_domain +# We'll build the url for the call by transforming that into: +# https://xmpp_domain/subdomain/roomName +# So if there are any prefixes in the jid (like jitsi meet, which +# has its participants join a muc at conference.xmpp_domain) then +# list that prefix here so it can be stripped out to generate +# the call url correctly +#JIBRI_STRIP_DOMAIN_JID=muc + +# Directory for logs inside Jibri container +#JIBRI_LOGS_DIR=/config/logs + +# JWT authentication +# + +# Application identifier +#JWT_APP_ID=my_jitsi_app_id + +# Application secret known only to your token +#JWT_APP_SECRET=my_jitsi_app_secret + +# (Optional) Set asap_accepted_issuers as a comma separated list +#JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client + +# (Optional) Set asap_accepted_audiences as a comma separated list +#JWT_ACCEPTED_AUDIENCES=my_server1,my_server2 + +JWT_ASAP_KEYSERVER +JWT_ALLOW_EMPTY +JWT_AUTH_TYPE +JWT_TOKEN_AUTH_MODULE +LOG_LEVEL diff --git a/web.env.example b/web.env.example new file mode 100644 index 0000000..47c7a31 --- /dev/null +++ b/web.env.example @@ -0,0 +1,102 @@ +APP_NAME="Jitsi Meet" + +# Enable Let's Encrypt certificate generation +ENABLE_LETSENCRYPT=0 + +# Redirect HTTP traffic to HTTPS +# Necessary for Let's Encrypt, relies on standard HTTPS port (443) +#ENABLE_HTTP_REDIRECT=1 + +# Disable HTTPS: handle TLS connections outside of this setup +#DISABLE_HTTPS=1 + +# Domain for which to generate the certificate +#LETSENCRYPT_DOMAIN=meet.example.com + +# Use the staging server (for avoiding rate limits while testing) +#LETSENCRYPT_USE_STAGING=1 + +# Reverse-proxy and certbot +VIRTUAL_HOST=sub.domain.tld +VIRTUAL_PORT=80 +LETSENCRYPT_HOST=sub.domain.tld +LETSENCRYPT_EMAIL=account@domain.tld + +# +# Stuff to sort out +# +AMPLITUDE_ID +ANALYTICS_SCRIPT_URLS +ANALYTICS_WHITELISTED_EVENTS +BRIDGE_CHANNEL +BRANDING_DATA_URL +CALLSTATS_CUSTOM_SCRIPT_URL +CALLSTATS_ID +CALLSTATS_SECRET +CHROME_EXTENSION_BANNER_JSON +CONFCODE_URL +CONFIG_EXTERNAL_CONNECT +DEPLOYMENTINFO_ENVIRONMENT +DEPLOYMENTINFO_ENVIRONMENT_TYPE +DEPLOYMENTINFO_USERREGION +DIALIN_NUMBERS_URL +DIALOUT_AUTH_URL +DIALOUT_CODES_URL +DROPBOX_APPKEY +DROPBOX_REDIRECT_URI +ENABLE_AUDIO_PROCESSING +ENABLE_CALENDAR +ENABLE_FILE_RECORDING_SERVICE +ENABLE_FILE_RECORDING_SERVICE_SHARING +ENABLE_IPV6 +ENABLE_LIPSYNC +ENABLE_NO_AUDIO_DETECTION +ENABLE_P2P + +# Show a prejoin page before entering a conference +ENABLE_PREJOIN_PAGE=1 +# Enable recording +ENABLE_RECORDING=0 + +ENABLE_REMB +ENABLE_REQUIRE_DISPLAY_NAME +ENABLE_SIMULCAST +ENABLE_STATS_ID +ENABLE_STEREO +ENABLE_SUBDOMAINS +ENABLE_TALK_WHILE_MUTED +ENABLE_TCC + +# Enable Jigasi transcription +ENABLE_TRANSCRIPTIONS=0 + +# Set etherpad-lite public URL (uncomment to enable) +#ETHERPAD_PUBLIC_URL=https://etherpad.my.domain + +# Set etherpad-lite URL in docker local network (uncomment to enable) +#ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001 +GOOGLE_ANALYTICS_ID +GOOGLE_API_APP_CLIENT_ID +INVITE_SERVICE_URL + +MATOMO_ENDPOINT +MATOMO_SITE_ID +MICROSOFT_API_APP_CLIENT_ID +NGINX_RESOLVER +PEOPLE_SEARCH_URL +RESOLUTION +RESOLUTION_MIN +RESOLUTION_WIDTH +RESOLUTION_WIDTH_MIN +START_AUDIO_ONLY +START_AUDIO_MUTED +START_BITRATE +START_VIDEO_MUTED +TESTING_CAP_SCREENSHARE_BITRATE +TESTING_OCTO_PROBABILITY + +# Internal XMPP server URL +XMPP_BOSH_URL_BASE=http://xmpp.meet.jitsi:5280 + +# Authenticate using external service or just focus external auth window if there is one already. +# TOKEN_AUTH_URL=https://auth.meet.example.com/{room}