heather: remove jitsi stack (web/prosody/jicofo/jvb/coturn)
Fully remove jitsi from arion-compose.nix, caddy.nix, default.nix. Will be reinstalled from scratch.
This commit is contained in:
parent
57f2fe314b
commit
fd605c51ce
3 changed files with 2 additions and 174 deletions
|
|
@ -5,7 +5,7 @@
|
|||
#
|
||||
# Порты проброшены на localhost (127.0.0.1:PORT) — Caddy на хосте терминирует
|
||||
# TLS и роутит по Host (см. caddy.nix). Контейнеры НЕ выставлены наружу
|
||||
# напрямую (кроме jitsi UDP 10000/19132 — см. jitsi ниже, когда добавим).
|
||||
# напрямую (кроме forgejo git ssh на :2222).
|
||||
#
|
||||
# Data: named volumes везде, кроме silverbullet (bind mount на syncthing
|
||||
# sync'аемую папку /srv/syncthing/herbarium — исключение, см. комментарии).
|
||||
|
|
@ -13,7 +13,7 @@
|
|||
# Backup: offen/docker-volume-backup как sidecar, nightly tar.gz всех named
|
||||
# volumes → /var/backups (добавим последним).
|
||||
#
|
||||
# Порядок миграции: forgejo → tuwunel+admin → cinny → jitsi → teable →
|
||||
# Порядок миграции: forgejo → tuwunel+admin → cinny → teable →
|
||||
# silverbullet. Ниже forgejo как первый proof-of-concept, остальные добавим
|
||||
# по мере миграции (секции заготовлены, закомментированы до теста).
|
||||
|
||||
|
|
@ -34,20 +34,7 @@
|
|||
teable-db = {};
|
||||
teable-redis = {};
|
||||
teable-assets = {};
|
||||
# jitsi-стек
|
||||
jitsi-web = {};
|
||||
jitsi-prosody = {};
|
||||
jitsi-jicofo = {};
|
||||
jitsi-jvb = {};
|
||||
jitsi-transcripts = {};
|
||||
};
|
||||
|
||||
# --- Custom network для jitsi с DNS aliases ---
|
||||
# Контейнеры jitsi общаются по FQDN (xmpp.meet.jitsi). Alias задан в
|
||||
# service.networks у prosody. Coturn в host network — вне этой сети.
|
||||
# `networks` — top-level опция arion (как `services`), не в docker-compose.
|
||||
# Имя без точки (docker-compose network name constraint).
|
||||
networks.meet-jitsi.driver = "bridge";
|
||||
services = {
|
||||
# === Forgejo (git.iscg.dev) ===
|
||||
# Первый сервис, proof-of-concept для цепочки arion→docker→Caddy.
|
||||
|
|
@ -95,12 +82,6 @@
|
|||
# tuwunel-admin был systemd на jul11 (knadh/tuwunel-admin). Если контейнер
|
||||
# существует — добавить сюда, иначе оставить как NixOS-сервис или выкинуть.
|
||||
|
||||
# === Jitsi Meet (jitsi.iscg.dev) ===
|
||||
# Стек: web, jicofo, prosody, jvb, coturn. На jul11 был конфликт :3478
|
||||
# (systemd coturn + docker stack-coturn). На heather — только docker coturn
|
||||
# внутри стека, systemd coturn НЕ поднимаем. Добавить отдельнымcompose-файлом
|
||||
# или секцией после forgejo.
|
||||
|
||||
# === Teable (teable.iscg.dev) ===
|
||||
# Стек: app + postgres + redis. Данные перенесены с iscg-dev (2026-07-12):
|
||||
# - postgres восстановлен из pg_dump (18M, consistent, без остановки источника)
|
||||
|
|
@ -149,137 +130,6 @@
|
|||
service.volumes = [ "teable-redis:/data" ];
|
||||
};
|
||||
|
||||
# === Jitsi Meet (jitsi.iscg.dev) ===
|
||||
# Стек: web, prosody, jicofo, jvb, coturn. Перенесено с jul11 (2026-07-12):
|
||||
# - config (web/prosody/jicofo/jvb) → named volumes (включая prosody user mikl)
|
||||
# - образ PIN: stable-11031 (как на jul11, НЕ :latest)
|
||||
# - пароли (jicofo/jvb/jigasi/jibri/turn) НОВЫЕ, в pass iscg.dev/jitsi/
|
||||
# - env-файл /var/lib/jitsi-secrets/jitsi.env на heather (root:docker 0640)
|
||||
# Coturn в host network (нужно для real client IPs). JVB 10000/udp публично.
|
||||
# Caddy терминирует TLS, web внутренне HTTP (DISABLE_HTTPS=1).
|
||||
# Документация: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/
|
||||
# WebSocket routes (/xmpp-websocket, /colibri-ws) — в caddy.nix.
|
||||
jitsi-web = {
|
||||
service.image = "jitsi/web:stable-11031";
|
||||
service.container_name = "jitsi-web";
|
||||
service.restart = "unless-stopped";
|
||||
service.ports = [ "127.0.0.1:8000:80" ];
|
||||
service.volumes = [
|
||||
"jitsi-web:/config"
|
||||
"jitsi-web:/var/spool/cron/crontabs"
|
||||
"jitsi-transcripts:/usr/share/jitsi-meet/transcripts"
|
||||
];
|
||||
service.depends_on = [ "jitsi-jvb" ];
|
||||
service.networks = [ "meet-jitsi" ];
|
||||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||||
service.environment = {
|
||||
PUBLIC_URL = "https://jitsi.iscg.dev";
|
||||
DISABLE_HTTPS = "1";
|
||||
ENABLE_HTTP_REDIRECT = "0";
|
||||
ENABLE_HSTS = "0";
|
||||
ENABLE_LETSENCRYPT = "0";
|
||||
TZ = "Europe/Moscow";
|
||||
HTTP_PORT = "8000";
|
||||
JVB_ADVERTISE_IPS = "51.250.45.111";
|
||||
APP_NAME = "mikl meet";
|
||||
PROVIDER_NAME = "mikl meet";
|
||||
SHOW_JITSI_WATERMARK = "false";
|
||||
SHOW_POWERED_BY = "false";
|
||||
DISABLE_JOIN_LEAVE_NOTIFICATIONS = "true";
|
||||
DISABLE_VIDEO_BACKGROUND = "true";
|
||||
ENABLE_AUTH = "1";
|
||||
AUTH_TYPE = "internal";
|
||||
ENABLE_GUESTS = "1";
|
||||
ENABLE_XMPP_WEBSOCKET = "1";
|
||||
ENABLE_COLIBRI_WEBSOCKET = "1";
|
||||
RESOLUTION = "1080";
|
||||
RESOLUTION_MIN = "360";
|
||||
ENABLE_SIMULCAST = "true";
|
||||
ENABLE_P2P = "true";
|
||||
ENABLE_CODEC_VP8 = "1";
|
||||
ENABLE_CODEC_VP9 = "1";
|
||||
ENABLE_CODEC_H264 = "1";
|
||||
ENABLE_CODEC_AV1 = "0";
|
||||
VIDEOQUALITY_BITRATE_VP8_STANDARD = "1500";
|
||||
VIDEOQUALITY_BITRATE_VP8_HIGH = "2500";
|
||||
VIDEOQUALITY_BITRATE_VP8_LOW = "200";
|
||||
};
|
||||
};
|
||||
|
||||
jitsi-prosody = {
|
||||
service.image = "jitsi/prosody:stable-11031";
|
||||
service.container_name = "jitsi-prosody";
|
||||
service.restart = "unless-stopped";
|
||||
service.expose = [ "5222" "5269" "5347" "5280" ];
|
||||
service.volumes = [
|
||||
"jitsi-prosody:/config"
|
||||
];
|
||||
# network aliases: prosody доступен как xmpp.meet.jitsi для jicofo/jvb/web
|
||||
service.networks.meet-jitsi.aliases = [ "xmpp.meet.jitsi" ];
|
||||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||||
service.environment = {
|
||||
TZ = "Europe/Moscow";
|
||||
ENABLE_AUTH = "1";
|
||||
AUTH_TYPE = "internal";
|
||||
ENABLE_GUESTS = "1";
|
||||
ENABLE_XMPP_WEBSOCKET = "1";
|
||||
ENABLE_IPV6 = "0";
|
||||
PUBLIC_URL = "https://jitsi.iscg.dev";
|
||||
};
|
||||
};
|
||||
|
||||
jitsi-jicofo = {
|
||||
service.image = "jitsi/jicofo:stable-11031";
|
||||
service.container_name = "jitsi-jicofo";
|
||||
service.restart = "unless-stopped";
|
||||
service.ports = [ "127.0.0.1:8888:8888" ];
|
||||
service.volumes = [ "jitsi-jicofo:/config" ];
|
||||
service.depends_on = [ "jitsi-prosody" ];
|
||||
service.networks = [ "meet-jitsi" ];
|
||||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||||
service.environment = {
|
||||
TZ = "Europe/Moscow";
|
||||
ENABLE_AUTH = "1";
|
||||
AUTH_TYPE = "internal";
|
||||
JICOFO_MAX_MEMORY = "1024m";
|
||||
MAX_PARTICIPANTS = "10";
|
||||
};
|
||||
};
|
||||
|
||||
jitsi-jvb = {
|
||||
service.image = "jitsi/jvb:stable-11031";
|
||||
service.container_name = "jitsi-jvb";
|
||||
service.restart = "unless-stopped";
|
||||
service.ports = [
|
||||
"10000:10000/udp" # публично — media traffic
|
||||
"127.0.0.1:8080:8080" # colibri REST (localhost only)
|
||||
];
|
||||
service.volumes = [ "jitsi-jvb:/config" ];
|
||||
service.depends_on = [ "jitsi-prosody" ];
|
||||
service.networks = [ "meet-jitsi" ];
|
||||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||||
service.environment = {
|
||||
TZ = "Europe/Moscow";
|
||||
PUBLIC_URL = "https://jitsi.iscg.dev";
|
||||
JVB_ADVERTISE_IPS = "51.250.45.111";
|
||||
JVB_PORT = "10000";
|
||||
JVB_DISABLE_STUN = "0";
|
||||
VIDEOBRIDGE_MAX_MEMORY = "2048m";
|
||||
DOCKER_HOST_ADDRESS = "51.250.45.111";
|
||||
};
|
||||
};
|
||||
|
||||
jitsi-coturn = {
|
||||
# Coturn в host network: нужно для real client IPs и корректной NAT traversal.
|
||||
# Конфликтов с systemd coturn на heather НЕТ (мы его не поднимаем, в отличие от jul11).
|
||||
service.image = "coturn/coturn:4.7";
|
||||
service.container_name = "jitsi-coturn";
|
||||
service.restart = "unless-stopped";
|
||||
service.network_mode = "host";
|
||||
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
|
||||
service.command = "-v --log-file=stdout --realm=turn.iscg.dev --external-ip=51.250.45.111 --use-auth-secret --static-auth-secret=$${TURN_STATIC_AUTH_SECRET} --min-port=49160 --max-port=49200 --no-tls --no-dtls --fingerprint --no-cli --simple-log";
|
||||
};
|
||||
|
||||
# === Silverbullet (note.iscg.dev) — ИСКЛЮЧЕНИЕ: bind mount ===
|
||||
# Space = /srv/syncthing/herbarium (sync'ается syncthing на устройства).
|
||||
# Единственный сервис без named volume — по твоему решению, чтобы notes
|
||||
|
|
|
|||
|
|
@ -73,26 +73,6 @@ in {
|
|||
encode zstd gzip
|
||||
'';
|
||||
|
||||
# Jitsi Meet (web + WebSocket routes)
|
||||
"jitsi.iscg.dev".extraConfig = ''
|
||||
# WebSocket routes — hop-by-hop, требуют явного upgrade
|
||||
@xmpp path /xmpp-websocket*
|
||||
reverse_proxy @xmpp 127.0.0.1:8000 {
|
||||
header_up Host {host}
|
||||
header_up Upgrade {http.upgrade}
|
||||
header_up Connection {http.connection}
|
||||
}
|
||||
@colibri path /colibri-ws*
|
||||
reverse_proxy @colibri 127.0.0.1:8000 {
|
||||
header_up Host {host}
|
||||
header_up Upgrade {http.upgrade}
|
||||
header_up Connection {http.connection}
|
||||
}
|
||||
# Остальное → web контейнер
|
||||
reverse_proxy 127.0.0.1:8000
|
||||
encode zstd gzip
|
||||
'';
|
||||
|
||||
# Teable
|
||||
"teable.iscg.dev".extraConfig = ''
|
||||
reverse_proxy 127.0.0.1:2345
|
||||
|
|
|
|||
|
|
@ -43,11 +43,9 @@
|
|||
22000 # syncthing sync
|
||||
22067 # strelaysrv (relay)
|
||||
22070 # strelaysrv (status)
|
||||
# jitsi (когда добавим): 3478, 5349, 10000/udp, 49152-65535/udp
|
||||
];
|
||||
firewall.allowedUDPPorts = [
|
||||
22000 # syncthing sync (QUIC)
|
||||
# jitsi: 10000 (jvb), 49152-65535 (RTP)
|
||||
];
|
||||
};
|
||||
# useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.
|
||||
|
|
|
|||
Loading…
Reference in a new issue