Initial commit

This commit is contained in:
Jan Beilicke 2020-03-23 00:20:24 +01:00
commit e4b1a63572
14 changed files with 764 additions and 0 deletions

29
.travis.yml Normal file
View file

@ -0,0 +1,29 @@
---
language: python
python: "2.7"
# Use the new container infrastructure
sudo: false
# Install ansible
addons:
apt:
packages:
- python-pip
install:
# Install ansible
- pip install ansible
# Check ansible version
- ansible --version
# Create ansible.cfg with correct roles_path
- printf '[defaults]\nroles_path=../' >ansible.cfg
script:
# Basic role syntax check
- ansible-playbook tests/test.yml -i tests/inventory --syntax-check
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

40
README.md Normal file
View file

@ -0,0 +1,40 @@
Jitsi Meet (Docker-Compose)
===========================
A single-instance [Jitsi Meet](https://jitsi.org/jitsi-meet/) server that can be run behind [Traefik](https://traefik.io).
Requirements
------------
- Ubuntu or Debian server
- [Docker Engine](https://docs.docker.com/install/) + [Docker Compose](https://docs.docker.com/compose/install/)
- Optional: Traefik
Role Variables
--------------
A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
Dependencies
------------
A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
Example Playbook
----------------
Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
- hosts: servers
roles:
- { role: username.rolename, x: 42 }
License
-------
MIT
Author Information
------------------
https://jotbe.io/

2
defaults/main.yml Normal file
View file

@ -0,0 +1,2 @@
---
# defaults file for jitsi

2
handlers/main.yml Normal file
View file

@ -0,0 +1,2 @@
---
# handlers file for jitsi

43
meta/main.yml Normal file
View file

@ -0,0 +1,43 @@
galaxy_info:
author: Jan Beilicke
description: Dockerized Jitsi Meet behind Traefik
#issue_tracker_url: https://git.jotbe.io/jotbe/ansible-role-docker-jitsi/issues
# Choose a valid license ID from https://spdx.org - some suggested licenses:
# - BSD-3-Clause (default)
# - MIT
# - GPL-2.0-or-later
# - GPL-3.0-only
# - Apache-2.0
# - CC-BY-4.0
license: MIT
min_ansible_version: 2.9
# If this a Container Enabled role, provide the minimum Ansible Container version.
# min_ansible_container_version:
#
# Provide a list of supported platforms, and for each platform a list of versions.
# If you don't wish to enumerate all versions for a particular platform, use 'all'.
# To view available platforms and versions (or releases), visit:
# https://galaxy.ansible.com/api/v1/platforms/
#
platforms:
- name: Debian
versions:
- all
- name: Ubuntu
versions:
- all
galaxy_tags:
- docker
- traefik
- chat
- videoconferencing
dependencies: []
# - geerlingguy.pip
# - geerlingguy.docker

79
tasks/main.yml Normal file
View file

@ -0,0 +1,79 @@
---
# tasks file for jitsi
- name: Ensure jitsi config directory exists
file:
path: /home/{{ docker_user }}/jitsi
state: directory
owner: '{{ docker_user }}'
group: '{{ docker_user }}'
tags: config
- name: Provide docker-compose.yml
template:
src: templates/docker-compose.jitsi.yml.j2
dest: /home/{{ docker_user }}/jitsi/docker-compose.yml
owner: "{{ docker_user }}"
group: "{{ docker_user }}"
mode: '0644'
tags: config
- name: Output docker-compose.yml
shell: cat /home/{{ docker_user }}/jitsi/docker-compose.yml
register: output
tags: config
- debug:
var: output
- name: Provide Jitsi env vars
template:
src: templates/env.jitsi.j2
dest: /home/{{ docker_user }}/jitsi/.env
owner: "{{ docker_user }}"
group: "{{ docker_user }}"
mode: '0640'
tags: config
- name: "docker-compose: Teardown existing Jitsi service"
docker_compose:
project_src: "/home/{{ docker_user }}/jitsi/"
state: absent
tags: ['never', 'teardown']
- name: "docker-compose: Bootstrap Jitsi service"
docker_compose:
project_src: "/home/{{ docker_user }}/jitsi/"
register: output
- debug:
var: output
- assert:
that:
- "output.ansible_facts['web']['jitsi_web_1'].state.running"
- name: Get container IP
set_fact:
jitsi_container_ip: "{{ output.ansible_facts['web']['jitsi_web_1']['networks']['jitsi_meet.jitsi'].IPAddress }}"
- name: "Waiting for Jitsi container to become available"
become: false
wait_for:
host: localhost
port: "{{ jitsi_exposed_http_port }}"
- name: "Waiting for Jitsi service (443/TLS) to become available"
become: false
wait_for:
# Use the FQDN here!
host: "{{ jitsi_virtual_host }}"
port: 443
delegate_to: localhost
# - name: "Testing whether the Nextcloud homepage is available#"
# action: uri url=http://{{ ansible_ssh_host }} return_content=yes
# register: gl
# - fail:
# msg: 'Graylog homepage is not available!'
# when: "'Graylog Web Interface' not in gl.content"

View file

@ -0,0 +1,173 @@
version: '3'
services:
# Frontend
web:
image: jitsi/web
ports:
- '${HTTP_PORT}:80'
- '${HTTPS_PORT}:443'
volumes:
- ${CONFIG}/web:/config
- ${CONFIG}/web/letsencrypt:/etc/letsencrypt
- ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts
environment:
- ENABLE_AUTH
- ENABLE_GUESTS
- ENABLE_LETSENCRYPT
- ENABLE_HTTP_REDIRECT
- ENABLE_TRANSCRIPTIONS
- DISABLE_HTTPS
- JICOFO_AUTH_USER
- LETSENCRYPT_DOMAIN
- LETSENCRYPT_EMAIL
- PUBLIC_URL
- XMPP_DOMAIN
- XMPP_AUTH_DOMAIN
- XMPP_BOSH_URL_BASE
- XMPP_GUEST_DOMAIN
- XMPP_MUC_DOMAIN
- XMPP_RECORDER_DOMAIN
- ETHERPAD_URL_BASE
- TZ
- JIBRI_BREWERY_MUC
- JIBRI_PENDING_TIMEOUT
- JIBRI_XMPP_USER
- JIBRI_XMPP_PASSWORD
- JIBRI_RECORDER_USER
- JIBRI_RECORDER_PASSWORD
- ENABLE_RECORDING
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik_traefik"
- "traefik.http.routers.jitsi.rule=Host(`{{ jitsi_virtual_host }}`)"
- "traefik.http.routers.jitsi.entrypoints=websecure"
- "traefik.http.routers.jitsi.tls=true"
- "traefik.http.routers.jitsi.tls.certresolver=defaultresolver"
networks:
traefik:
meet.jitsi:
aliases:
- ${XMPP_DOMAIN}
# XMPP server
prosody:
image: jitsi/prosody
expose:
- '5222'
- '5347'
- '5280'
volumes:
- ${CONFIG}/prosody:/config
environment:
- AUTH_TYPE
- ENABLE_AUTH
- ENABLE_GUESTS
- GLOBAL_MODULES
- GLOBAL_CONFIG
- LDAP_URL
- LDAP_BASE
- LDAP_BINDDN
- LDAP_BINDPW
- LDAP_FILTER
- LDAP_AUTH_METHOD
- LDAP_VERSION
- LDAP_USE_TLS
- LDAP_TLS_CIPHERS
- LDAP_TLS_CHECK_PEER
- LDAP_TLS_CACERT_FILE
- LDAP_TLS_CACERT_DIR
- LDAP_START_TLS
- XMPP_DOMAIN
- XMPP_AUTH_DOMAIN
- XMPP_GUEST_DOMAIN
- XMPP_MUC_DOMAIN
- XMPP_INTERNAL_MUC_DOMAIN
- XMPP_MODULES
- XMPP_MUC_MODULES
- XMPP_INTERNAL_MUC_MODULES
- XMPP_RECORDER_DOMAIN
- JICOFO_COMPONENT_SECRET
- JICOFO_AUTH_USER
- JICOFO_AUTH_PASSWORD
- JVB_AUTH_USER
- JVB_AUTH_PASSWORD
- JIGASI_XMPP_USER
- JIGASI_XMPP_PASSWORD
- JIBRI_XMPP_USER
- JIBRI_XMPP_PASSWORD
- JIBRI_RECORDER_USER
- JIBRI_RECORDER_PASSWORD
- JWT_APP_ID
- JWT_APP_SECRET
- JWT_ACCEPTED_ISSUERS
- JWT_ACCEPTED_AUDIENCES
- JWT_ASAP_KEYSERVER
- JWT_ALLOW_EMPTY
- JWT_AUTH_TYPE
- JWT_TOKEN_AUTH_MODULE
- LOG_LEVEL
- TZ
networks:
meet.jitsi:
aliases:
- ${XMPP_SERVER}
# Focus component
jicofo:
image: jitsi/jicofo
volumes:
- ${CONFIG}/jicofo:/config
environment:
- ENABLE_AUTH
- XMPP_DOMAIN
- XMPP_AUTH_DOMAIN
- XMPP_INTERNAL_MUC_DOMAIN
- XMPP_SERVER
- JICOFO_COMPONENT_SECRET
- JICOFO_AUTH_USER
- JICOFO_AUTH_PASSWORD
- JICOFO_RESERVATION_REST_BASE_URL
- JVB_BREWERY_MUC
- JIGASI_BREWERY_MUC
- JIBRI_BREWERY_MUC
- JIBRI_PENDING_TIMEOUT
- TZ
depends_on:
- prosody
networks:
meet.jitsi:
# Video bridge
jvb:
image: jitsi/jvb
ports:
- '${JVB_PORT}:${JVB_PORT}/udp'
- '${JVB_TCP_PORT}:${JVB_TCP_PORT}'
volumes:
- ${CONFIG}/jvb:/config
environment:
- DOCKER_HOST_ADDRESS
- XMPP_AUTH_DOMAIN
- XMPP_INTERNAL_MUC_DOMAIN
- XMPP_SERVER
- JVB_AUTH_USER
- JVB_AUTH_PASSWORD
- JVB_BREWERY_MUC
- JVB_PORT
- JVB_TCP_HARVESTER_DISABLED
- JVB_TCP_PORT
- JVB_STUN_SERVERS
- JVB_ENABLE_APIS
- TZ
depends_on:
- prosody
networks:
meet.jitsi:
# Custom network so all services can communicate using a FQDN
networks:
meet.jitsi:
traefik:
external:
name: traefik_traefik

302
templates/env.jitsi.j2 Normal file
View file

@ -0,0 +1,302 @@
#
# Basic configuration options
#
# Directory where all configuration will be stored.
CONFIG=~/.jitsi-meet-cfg
# Exposed HTTP port.
HTTP_PORT={{ jitsi_exposed_http_port }}
# Exposed HTTPS port.
HTTPS_PORT={{ jitsi_exposed_https_port }}
# System time zone.
TZ={{ jitsi_timezone }}
# Public URL for the web service.
PUBLIC_URL="{{ jitsi_public_url }}"
VIRTUAL_HOST={{ jitsi_virtual_host }}
# IP address of the Docker host. See the "Running on a LAN environment" section
# in the README.
DOCKER_HOST_ADDRESS={{ jitsi_docker_host_address }}
#
# Let's Encrypt configuration
#
# Enable Let's Encrypt certificate generation.
ENABLE_LETSENCRYPT={{ 1 if jitsi_enable_letsencrypt == True else 0 }}
# Domain for which to generate the certificate.
#LETSENCRYPT_DOMAIN=meet.example.com
# E-Mail for receiving important account notifications (mandatory).
#LETSENCRYPT_EMAIL=alice@atlanta.net
#
# Etherpad integration (for document sharing)
#
# Set etherpad-lite URL (uncomment to enable).
#ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001
#
# Basic Jigasi configuration options (needed for SIP gateway support)
#
# SIP URI for incoming / outgoing calls.
#JIGASI_SIP_URI=test@sip2sip.info
# Password for the specified SIP account as a clear text
#JIGASI_SIP_PASSWORD=passw0rd
# SIP server (use the SIP account domain if in doubt).
#JIGASI_SIP_SERVER=sip2sip.info
# SIP server port
#JIGASI_SIP_PORT=5060
# SIP server transport
#JIGASI_SIP_TRANSPORT=UDP
#
# Authentication configuration (see README for details)
#
# Enable authentication.
#ENABLE_AUTH=1
# Enable guest access.
#ENABLE_GUESTS=1
# Select authentication type: internal, jwt or ldap
#AUTH_TYPE=internal
# JWT auuthentication
#
# Application identifier.
#JWT_APP_ID=my_jitsi_app_id
# Application secret known only to your token.
#JWT_APP_SECRET=my_jitsi_app_secret
# (Optional) Set asap_accepted_issuers as a comma separated list.
#JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client
# (Optional) Set asap_accepted_audiences as a comma separated list.
#JWT_ACCEPTED_AUDIENCES=my_server1,my_server2
# LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page)
#
# LDAP url for connection.
#LDAP_URL=ldaps://ldap.domain.com/
# LDAP base DN. Can be empty
#LDAP_BASE=DC=example,DC=domain,DC=com
# LDAP user DN. Do not specify this parameter for the anonymous bind.
#LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com
# LDAP user password. Do not specify this parameter for the anonymous bind.
#LDAP_BINDPW=LdapUserPassw0rd
# LDAP filter. Tokens example:
# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail.
# %s - %s is replaced by the complete service string.
# %r - %r is replaced by the complete realm string.
#LDAP_FILTER=(sAMAccountName=%u)
# LDAP authentication method
#LDAP_AUTH_METHOD=bind
# LDAP version
#LDAP_VERSION=3
# LDAP TLS using
#LDAP_USE_TLS=1
# List of SSL/TLS ciphers to allow.
#LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC
# Require and verify server certificate
#LDAP_TLS_CHECK_PEER=1
# Path to CA cert file. Used when server sertificate verify is enabled.
#LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt
# Path to CA certs directory. Used when server sertificate verify is enabled.
#LDAP_TLS_CACERT_DIR=/etc/ssl/certs
# Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps://
# LDAP_START_TLS=1
#
# Advanced configuration options (you generally don't need to change these)
#
# Internal XMPP domain.
XMPP_DOMAIN=meet.jitsi
# Internal XMPP server
XMPP_SERVER=xmpp.meet.jitsi
# Internal XMPP server URL
XMPP_BOSH_URL_BASE=http://xmpp.meet.jitsi:5280
# Internal XMPP domain for authenticated services.
XMPP_AUTH_DOMAIN=auth.meet.jitsi
# XMPP domain for the MUC.
XMPP_MUC_DOMAIN=muc.meet.jitsi
# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools.
XMPP_INTERNAL_MUC_DOMAIN=internal-muc.meet.jitsi
# XMPP domain for unauthenticated users.
XMPP_GUEST_DOMAIN=guest.meet.jitsi
# Custom Prosody modules for XMPP_DOMAIN (comma separated)
XMPP_MODULES=
# Custom Prosody modules for MUC component (comma separated)
XMPP_MUC_MODULES=
# Custom Prosody modules for internal MUC component (comma separated)
XMPP_INTERNAL_MUC_MODULES=
# MUC for the JVB pool.
JVB_BREWERY_MUC=jvbbrewery
# XMPP user for JVB client connections.
JVB_AUTH_USER=jvb
# XMPP password for JVB client connections.
JVB_AUTH_PASSWORD=passw0rd
# STUN servers used to discover the server's public IP.
JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302
# Media port for the Jitsi Videobridge
JVB_PORT=10000
# TCP Fallback for Jitsi Videobridge for when UDP isn't available
JVB_TCP_HARVESTER_DISABLED=true
JVB_TCP_PORT=4443
# A comma separated list of APIs to enable when the JVB is started. The default is none.
# See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information
#JVB_ENABLE_APIS=rest,colibri
# XMPP component password for Jicofo.
JICOFO_COMPONENT_SECRET=s3cr37
# XMPP user for Jicofo client connections. NOTE: this option doesn't currently work due to a bug.
JICOFO_AUTH_USER=focus
# XMPP password for Jicofo client connections.
JICOFO_AUTH_PASSWORD=passw0rd
# Base URL of Jicofo's reservation REST API
#JICOFO_RESERVATION_REST_BASE_URL=http://reservation.example.com
# XMPP user for Jigasi MUC client connections.
JIGASI_XMPP_USER=jigasi
# XMPP password for Jigasi MUC client connections.
JIGASI_XMPP_PASSWORD=passw0rd
# MUC name for the Jigasi pool.
JIGASI_BREWERY_MUC=jigasibrewery
# Minimum port for media used by Jigasi.
JIGASI_PORT_MIN=20000
# Maximum port for media used by Jigasi.
JIGASI_PORT_MAX=20050
# Enable SDES srtp
#JIGASI_ENABLE_SDES_SRTP=1
# Keepalive method
#JIGASI_SIP_KEEP_ALIVE_METHOD=OPTIONS
# Health-check extension
#JIGASI_HEALTH_CHECK_SIP_URI=keepalive
# Health-check interval
#JIGASI_HEALTH_CHECK_INTERVAL=300000
#
# Enable Jigasi transcription.
#ENABLE_TRANSCRIPTIONS=1
# Jigasi will recordord an audio when transcriber is on. Default false.
#JIGASI_TRANSCRIBER_RECORD_AUDIO=true
# Jigasi will send transcribed text to the chat when transcriber is on. Default false.
#JIGASI_TRANSCRIBER_SEND_TXT=true
# Jigasi post to the chat an url with transcription file. Default false.
#JIGASI_TRANSCRIBER_ADVERTISE_URL=true
# Credentials for connect to Cloud Google API from Jigasi. Path located inside the container.
# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol
# section "Before you begin" from 1 to 5 paragraph. Copy the key on
# the docker host to ${CONFIG}/jigasi/key.json and to enable this setting:
#GOOGLE_APPLICATION_CREDENTIALS=/config/key.json
# Enable recording
#ENABLE_RECORDING=1
# XMPP domain for the jibri recorder
XMPP_RECORDER_DOMAIN=recorder.meet.jitsi
# XMPP recorder user for Jibri client connections.
JIBRI_RECORDER_USER=recorder
# XMPP recorder password for Jibri client connections.
JIBRI_RECORDER_PASSWORD=passw0rd
# Directory for recordings inside Jibri container.
JIBRI_RECORDING_DIR=/config/recordings
# The finalizing script. Will run after recording is complete.
JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh
# XMPP user for Jibri client connections.
JIBRI_XMPP_USER=jibri
# XMPP password for Jibri client connections.
JIBRI_XMPP_PASSWORD=passw0rd
# MUC name for the Jibri pool.
JIBRI_BREWERY_MUC=jibribrewery
# MUC connection timeout
JIBRI_PENDING_TIMEOUT=90
# When jibri gets a request to start a service for a room, the room
# jid will look like: roomName@optional.prefixes.subdomain.xmpp_domain
# We'll build the url for the call by transforming that into:
# https://xmpp_domain/subdomain/roomName
# So if there are any prefixes in the jid (like jitsi meet, which
# has its participants join a muc at conference.xmpp_domain) then
# list that prefix here so it can be stripped out to generate
# the call url correctly.
JIBRI_STRIP_DOMAIN_JID=muc
# Directory for logs inside Jibri container.
JIBRI_LOGS_DIR=/config/logs
# Disable HTTPS. This can be useful if TLS connections are going to be handled outside of this setup.
#DISABLE_HTTPS=1
# Redirects HTTP traffic to HTTPS. Only works with the standard HTTPS port (443).
#ENABLE_HTTP_REDIRECT=1

10
templates/etherpad.yml Normal file
View file

@ -0,0 +1,10 @@
version: '3'
services:
# Etherpad: real-time collaborative document editing
etherpad:
image: jitsi/etherpad
networks:
meet.jitsi:
aliases:
- etherpad.meet.jitsi

33
templates/jibri.yml Normal file
View file

@ -0,0 +1,33 @@
version: '3'
services:
jibri:
image: jitsi/jibri
volumes:
- ${CONFIG}/jibri:/config
- /dev/shm:/dev/shm
cap_add:
- SYS_ADMIN
- NET_BIND_SERVICE
devices:
- /dev/snd:/dev/snd
environment:
- XMPP_AUTH_DOMAIN
- XMPP_INTERNAL_MUC_DOMAIN
- XMPP_RECORDER_DOMAIN
- XMPP_SERVER
- XMPP_DOMAIN
- JIBRI_XMPP_USER
- JIBRI_XMPP_PASSWORD
- JIBRI_BREWERY_MUC
- JIBRI_RECORDER_USER
- JIBRI_RECORDER_PASSWORD
- JIBRI_RECORDING_DIR
- JIBRI_FINALIZE_RECORDING_SCRIPT_PATH
- JIBRI_STRIP_DOMAIN_JID
- JIBRI_LOGS_DIR
- DISPLAY=:0
- TZ
networks:
meet.jitsi:

42
templates/jigasi.yml Normal file
View file

@ -0,0 +1,42 @@
version: '3'
services:
# SIP gateway (audio)
jigasi:
image: jitsi/jigasi
ports:
- '${JIGASI_PORT_MIN}-${JIGASI_PORT_MAX}:${JIGASI_PORT_MIN}-${JIGASI_PORT_MAX}/udp'
volumes:
- ${CONFIG}/jigasi:/config
- ${CONFIG}/transcripts:/tmp/transcripts
environment:
- ENABLE_AUTH
- XMPP_AUTH_DOMAIN
- XMPP_INTERNAL_MUC_DOMAIN
- XMPP_SERVER
- XMPP_DOMAIN
- PUBLIC_URL
- JIGASI_SIP_URI
- JIGASI_SIP_PASSWORD
- JIGASI_SIP_SERVER
- JIGASI_SIP_PORT
- JIGASI_SIP_TRANSPORT
- JIGASI_XMPP_USER
- JIGASI_XMPP_PASSWORD
- JIGASI_BREWERY_MUC
- JIGASI_PORT_MIN
- JIGASI_PORT_MAX
- JIGASI_HEALTH_CHECK_SIP_URI
- JIGASI_HEALTH_CHECK_INTERVAL
- JIGASI_SIP_KEEP_ALIVE_METHOD
- JIGASI_ENABLE_SDES_SRTP
- ENABLE_TRANSCRIPTIONS
- JIGASI_TRANSCRIBER_ADVERTISE_URL
- JIGASI_TRANSCRIBER_RECORD_AUDIO
- JIGASI_TRANSCRIBER_SEND_TXT
- GOOGLE_APPLICATION_CREDENTIALS
- TZ
depends_on:
- prosody
networks:
meet.jitsi:

2
tests/inventory Normal file
View file

@ -0,0 +1,2 @@
localhost

5
tests/test.yml Normal file
View file

@ -0,0 +1,5 @@
---
- hosts: localhost
remote_user: root
roles:
- jitsi

2
vars/main.yml Normal file
View file

@ -0,0 +1,2 @@
---
# vars file for jitsi