From 61e71b3ee4a66f6f008705404b087e071e25f41d Mon Sep 17 00:00:00 2001
From: mikl <mikl@iscg.dev>
Date: Mon, 13 Jul 2026 01:37:20 +0300
Subject: [PATCH] heather: enable jitsi guest access (lobby) + patch prosody
 guest websocket
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- ENABLE_GUESTS=1 in web/prosody/jicofo: unauthenticated users join via
  guest.meet.jitsi domain, wait in lobby until moderator (mikl) admits
- Patched prosody template mounted at /defaults/conf.d/jitsi-meet.cfg.lua:
  adds 'websocket' module to guest VirtualHost (upstream bug — guest domain
  only had 'smacks', no 'websocket' → wss disconnect loop)
- Template at /var/lib/jitsi-secrets/jitsi-meet.cfg.lua.template (root:root 0644)
- Fixes: mobile/anonymous users couldn't join, got disconnect loop
---
 hosts/heather/arion-compose.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hosts/heather/arion-compose.nix b/hosts/heather/arion-compose.nix
index f9b8acb..bbced41 100644
--- a/hosts/heather/arion-compose.nix
+++ b/hosts/heather/arion-compose.nix
@@ -183,6 +183,9 @@
         TURN_HOST = "51.250.45.111";
         TURN_PORT = "3478";
         TURN_TRANSPORT = "udp";
+        # Guest access: unauthenticated users join via guest domain, wait in
+        # lobby until a moderator (mikl) authenticates and admits them.
+        ENABLE_GUESTS = "1";
       };
     };
 
@@ -194,6 +197,10 @@
       service.volumes = [
         "jitsi-prosody-config:/config"
         "jitsi-prosody-data:/var/lib/prosody"
+        # Patched prosody template: guest VirtualHost gets "websocket" module
+        # (upstream bug — guest domain lacks it → wss disconnect loop).
+        # Patched file at /var/lib/jitsi-secrets/jitsi-meet.cfg.lua.template
+        "/var/lib/jitsi-secrets/jitsi-meet.cfg.lua.template:/defaults/conf.d/jitsi-meet.cfg.lua:ro"
       ];
       service.networks.meet-jitsi.aliases = [ "xmpp.meet.jitsi" ];
       service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
@@ -204,6 +211,7 @@
         AUTH_TYPE = "internal";
         ENABLE_XMPP_WEBSOCKET = "1";
         ENABLE_IPV6 = "0";
+        ENABLE_GUESTS = "1";
       };
     };
 
@@ -220,6 +228,7 @@
         TZ = "Europe/Moscow";
         ENABLE_AUTH = "1";
         AUTH_TYPE = "internal";
+        ENABLE_GUESTS = "1";
       };
     };