From 8709321ca3e92d32a3c08e560062e36662df138c Mon Sep 17 00:00:00 2001 From: mikl Date: Sun, 12 Jul 2026 22:42:36 +0300 Subject: [PATCH] heather: install jitsi meet from scratch (web/prosody/jicofo/jvb) Fresh install per https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker - Images on GHCR: ghcr.io/jitsi/*:stable-11031 - Named volumes: jitsi-{web,prosody,jicofo,jvb,transcripts} - Network meet-jitsi (bridge) with prosody alias xmpp.meet.jitsi - Reverse proxy mode (DISABLE_HTTPS=1), Caddy terminates TLS - Internal auth (ENABLE_AUTH=1, AUTH_TYPE=internal) - JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public - Secrets NEW in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640): JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, JVB_AUTH_PASSWORD - Caddy vhost jitsi.iscg.dev with /xmpp-websocket + /colibri-ws upgrade routes - Firewall: 10000/udp (jvb). Coturn not included (optional, add later for NAT) - No jigasi/jibri/transcriber (minimal stack) --- hosts/heather/arion-compose.nix | 141 ++++++++++++++++++++++++++++++++ hosts/heather/caddy.nix | 21 +++++ hosts/heather/default.nix | 3 + 3 files changed, 165 insertions(+) diff --git a/hosts/heather/arion-compose.nix b/hosts/heather/arion-compose.nix index de30c69..9de5f32 100644 --- a/hosts/heather/arion-compose.nix +++ b/hosts/heather/arion-compose.nix @@ -34,7 +34,21 @@ teable-db = {}; teable-redis = {}; teable-assets = {}; + # jitsi-стек (4 сервиса: web/prosody/jicofo/jvb). Coturn НЕ входит в + # официальный compose — добавляется опционально для NAT traversal (пока без него). + # Образы на GHCR (https://github.com/jitsi/docker-jitsi-meet, release stable-11031). + jitsi-web = {}; + jitsi-prosody = {}; + jitsi-jicofo = {}; + jitsi-jvb = {}; + jitsi-transcripts = {}; }; + + # --- Custom network для jitsi с DNS aliases --- + # Контейнеры jitsi общаются по FQDN (xmpp.meet.jitsi). Alias задан в + # service.networks у prosody. `networks` — top-level опция arion (как + # `services`), не в docker-compose. Имя без точки (docker-compose constraint). + networks.meet-jitsi.driver = "bridge"; services = { # === Forgejo (git.iscg.dev) === # Первый сервис, proof-of-concept для цепочки arion→docker→Caddy. @@ -130,6 +144,133 @@ service.volumes = [ "teable-redis:/data" ]; }; + # === Jitsi Meet (jitsi.iscg.dev) === + # Установлено с нуля 2026-07-12 по официальным докам: + # https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker + # Репо: https://github.com/jitsi/docker-jitsi-meet (release stable-11031). + # Образы на GHCR: ghcr.io/jitsi/* (JITSI_IMAGE_REPO default). + # Минимальный стек: web/prosody/jicofo/jvb. Coturn НЕ входит в официальный + # compose — подключается опционально для NAT traversal (пока без него, + # JVB на :10000/udp + STUN достаточно для большинства клиентов). + # - Data: named volumes (web/prosody/jicofo/jvb + transcripts). + # - Секреты НОВЫЕ (JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD, + # JVB_AUTH_PASSWORD) в /var/lib/jitsi-secrets/jitsi.env (root:docker 0640). + # - Caddy терминирует TLS (DISABLE_HTTPS=1), web внутренне HTTP. + # - WebSocket routes (/xmpp-websocket, /colibri-ws) — в caddy.nix. + # - JVB_ADVERTISE_IPS = 51.250.45.111 (публичный IP heather). + # - Authentication: internal (users через prosodyctl в контейнере prosody). + # Документация: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker + jitsi-web = { + service.image = "ghcr.io/jitsi/web:stable-11031"; + service.container_name = "jitsi-web"; + service.restart = "unless-stopped"; + service.ports = [ "127.0.0.1:8000:80" ]; + service.volumes = [ + "jitsi-web:/config" + "jitsi-web:/var/spool/cron/crontabs" + "jitsi-transcripts:/usr/share/jitsi-meet/transcripts" + ]; + service.depends_on = [ "jitsi-jvb" ]; + service.networks = [ "meet-jitsi" ]; + service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ]; + service.environment = { + PUBLIC_URL = "https://jitsi.iscg.dev"; + # Reverse proxy mode (Caddy терминирует TLS) + DISABLE_HTTPS = "1"; + ENABLE_HTTP_REDIRECT = "0"; + ENABLE_HSTS = "0"; + ENABLE_LETSENCRYPT = "0"; + TZ = "Europe/Moscow"; + HTTP_PORT = "8000"; + JVB_ADVERTISE_IPS = "51.250.45.111"; + DOCKER_HOST_ADDRESS = "51.250.45.111"; + # Брендинг + APP_NAME = "mikl meet"; + PROVIDER_NAME = "mikl meet"; + SHOW_JITSI_WATERMARK = "false"; + SHOW_POWERED_BY = "false"; + DISABLE_JOIN_LEAVE_NOTIFICATIONS = "true"; + DISABLE_VIDEO_BACKGROUND = "true"; + # Authentication: internal (users через prosodyctl register) + ENABLE_AUTH = "1"; + AUTH_TYPE = "internal"; + ENABLE_GUESTS = "1"; + # WebSocket для signalling/bridge (reverse proxy friendly) + ENABLE_XMPP_WEBSOCKET = "1"; + ENABLE_COLIBRI_WEBSOCKET = "1"; + # Качество видео + RESOLUTION = "1080"; + RESOLUTION_MIN = "360"; + ENABLE_SIMULCAST = "true"; + ENABLE_P2P = "true"; + ENABLE_CODEC_VP8 = "1"; + ENABLE_CODEC_VP9 = "1"; + ENABLE_CODEC_H264 = "1"; + ENABLE_CODEC_AV1 = "0"; + }; + }; + + jitsi-prosody = { + service.image = "ghcr.io/jitsi/prosody:stable-11031"; + service.container_name = "jitsi-prosody"; + service.restart = "unless-stopped"; + service.expose = [ "5222" "5269" "5347" "5280" ]; + service.volumes = [ "jitsi-prosody:/config" ]; + # network alias: prosody доступен как xmpp.meet.jitsi для jicofo/jvb/web + service.networks.meet-jitsi.aliases = [ "xmpp.meet.jitsi" ]; + service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ]; + service.environment = { + TZ = "Europe/Moscow"; + ENABLE_AUTH = "1"; + AUTH_TYPE = "internal"; + ENABLE_GUESTS = "1"; + ENABLE_XMPP_WEBSOCKET = "1"; + ENABLE_IPV6 = "0"; + PUBLIC_URL = "https://jitsi.iscg.dev"; + }; + }; + + jitsi-jicofo = { + service.image = "ghcr.io/jitsi/jicofo:stable-11031"; + service.container_name = "jitsi-jicofo"; + service.restart = "unless-stopped"; + service.ports = [ "127.0.0.1:8888:8888" ]; + service.volumes = [ "jitsi-jicofo:/config" ]; + service.depends_on = [ "jitsi-prosody" ]; + service.networks = [ "meet-jitsi" ]; + service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ]; + service.environment = { + TZ = "Europe/Moscow"; + ENABLE_AUTH = "1"; + AUTH_TYPE = "internal"; + JICOFO_MAX_MEMORY = "1024m"; + MAX_PARTICIPANTS = "10"; + }; + }; + + jitsi-jvb = { + service.image = "ghcr.io/jitsi/jvb:stable-11031"; + service.container_name = "jitsi-jvb"; + service.restart = "unless-stopped"; + service.ports = [ + "10000:10000/udp" # публично — media traffic + "127.0.0.1:8080:8080" # colibri REST (localhost only) + ]; + service.volumes = [ "jitsi-jvb:/config" ]; + service.depends_on = [ "jitsi-prosody" ]; + service.networks = [ "meet-jitsi" ]; + service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ]; + service.environment = { + TZ = "Europe/Moscow"; + PUBLIC_URL = "https://jitsi.iscg.dev"; + JVB_ADVERTISE_IPS = "51.250.45.111"; + JVB_PORT = "10000"; + JVB_DISABLE_STUN = "0"; + VIDEOBRIDGE_MAX_MEMORY = "2048m"; + DOCKER_HOST_ADDRESS = "51.250.45.111"; + }; + }; + # === Silverbullet (note.iscg.dev) — ИСКЛЮЧЕНИЕ: bind mount === # Space = /srv/syncthing/herbarium (sync'ается syncthing на устройства). # Единственный сервис без named volume — по твоему решению, чтобы notes diff --git a/hosts/heather/caddy.nix b/hosts/heather/caddy.nix index 0ad6ec1..71b2329 100644 --- a/hosts/heather/caddy.nix +++ b/hosts/heather/caddy.nix @@ -73,6 +73,27 @@ in { encode zstd gzip ''; + # Jitsi Meet (web + WebSocket routes) + # Доки: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-a-reverse-proxy + # WebSocket routes (/xmpp-websocket, /colibri-ws) — hop-by-hop, требуют + # явного Upgrade/Connection. Остальное → web контейнер на 127.0.0.1:8000. + "jitsi.iscg.dev".extraConfig = '' + @xmpp path /xmpp-websocket* + reverse_proxy @xmpp 127.0.0.1:8000 { + header_up Host {host} + header_up Upgrade {http.upgrade} + header_up Connection {http.connection} + } + @colibri path /colibri-ws* + reverse_proxy @colibri 127.0.0.1:8000 { + header_up Host {host} + header_up Upgrade {http.upgrade} + header_up Connection {http.connection} + } + reverse_proxy 127.0.0.1:8000 + encode zstd gzip + ''; + # Teable "teable.iscg.dev".extraConfig = '' reverse_proxy 127.0.0.1:2345 diff --git a/hosts/heather/default.nix b/hosts/heather/default.nix index 1f0011b..7e97c12 100644 --- a/hosts/heather/default.nix +++ b/hosts/heather/default.nix @@ -43,9 +43,12 @@ 22000 # syncthing sync 22067 # strelaysrv (relay) 22070 # strelaysrv (status) + # jitsi: 3478/5349 (turn, когда добавим coturn) ]; firewall.allowedUDPPorts = [ 22000 # syncthing sync (QUIC) + 10000 # jitsi jvb (RTP media) + # jitsi: 49152-65535 (RTP range, когда добавим coturn через allowedUDPPortRanges) ]; }; # useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.