@ -34,20 +34,16 @@
teable-db = { } ;
teable-redis = { } ;
teable-assets = { } ;
# jitsi-стек (4 сервиса: web/prosody/jicofo/jvb). Coturn Н Е
# официальный compose — добавляется опционально для NAT traversal (пока без него).
# Образы на GHCR (https://github.com/jitsi/docker-jitsi-meet, release stable-11031).
jitsi-web = { } ;
jitsi-prosody = { } ;
jitsi-jicofo = { } ;
jitsi-jvb = { } ;
# jitsi-стек (minimal, per official docker-compose.yml)
jitsi-web-config = { } ;
jitsi-prosody-config = { } ;
jitsi-prosody-data = { } ;
jitsi-jicofo-config = { } ;
jitsi-jvb-config = { } ;
jitsi-transcripts = { } ;
} ;
# --- Custom network для jitsi с
# Контейнеры jitsi общаются по FQDN (xmpp.meet.jitsi). Alias задан в
# service.networks у
# `services`), не в docker-compose. Имя без точки (docker-compose constraint).
# Custom network for jitsi (FQDN-based comms, prosody alias xmpp.meet.jitsi)
networks . meet-jitsi . driver = " b r i d g e " ;
services = {
# === Forgejo (git.iscg.dev) ===
@ -145,28 +141,30 @@
} ;
# === Jitsi Meet (jitsi.iscg.dev) ===
# Установлено с :
# Installed from scratch 2026-07-13 per official docs :
# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
# Репо: https://github.com/jitsi/docker-jitsi-meet (release stable-11031).
# Образы на GHCR: jitsi/* (JITSI_IMAGE_REPO default).
# Минимальный стек: web/prosody/jicofo/jvb. Coturn Н Е
# compose — подключается опционально для NAT traversal (пока без него,
# JVB на :10000/udp + STUN достаточно для большинства клиентов).
# - Data: named volumes (web/prosody/jicofo/jvb + transcripts).
# - Секреты НОВЫЕ (JICOFO_COMPONENT_SECRET, JICOFO_AUTH_PASSWORD,
# JVB_AUTH_PASSWORD) в /var/lib/jitsi-secrets/jitsi.env (root:docker 0640).
# - Caddy терминирует TLS (DISABLE_HTTPS=1), web внутренне HTTP.
# - WebSocket routes (/xmpp-websocket, /colibri-ws) — в caddy.nix.
# - JVB_ADVERTISE_IPS = 51.250.45.111 (публичный IP heather).
# - Authentication: internal (users через prosodyctl в контейнере prosody).
# Документация: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
# Repo: https://github.com/jitsi/docker-jitsi-meet (release stable-11031)
# Minimal stack: web/prosody/jicofo/jvb. No coturn/jigasi/jibri.
# - Images: jitsi/* (docker hub; GHCR ghcr.io/jitsi/* not accessible)
# - read_only + tmpfs per official compose
# - Named volumes (config + prosody data separate)
# - Reverse proxy: DISABLE_HTTPS=1, Caddy terminates TLS
# - JVB_ADVERTISE_IPS=51.250.45.111, :10000/udp public
# - Auth: internal (ENABLE_AUTH=1, AUTH_TYPE=internal). No GUESTS
# (template bug: guest domain lacks websocket module → disconnect).
# - Secrets in /var/lib/jitsi-secrets/jitsi.env (root:docker 0640)
jitsi-web = {
service . image = " j i t s i / w e b : s t a b l e - 1 1 0 3 1 " ;
service . container_name = " j i t s i - w e b " ;
service . restart = " u n l e s s - s t o p p e d " ;
service . read_only = true ;
service . tmpfs = [
" / r u n : s i z e = 1 6 M , m o d e = 1 7 5 0 , e x e c "
" / t m p : s i z e = 1 6 M , m o d e = 1 7 7 7 , n o e x e c "
] ;
service . ports = [ " 1 2 7 . 0 . 0 . 1 : 8 0 0 0 : 8 0 " ] ;
service . volumes = [
" j i t s i - w e b : / c o n f i g "
" j i t s i - w e b -c o n f i g :/ c o n f i g "
" j i t s i - t r a n s c r i p t s : / u s r / s h a r e / j i t s i - m e e t / t r a n s c r i p t s "
] ;
service . depends_on = [ " j i t s i - j v b " ] ;
@ -174,38 +172,18 @@
service . env_file = [ " / v a r / l i b / j i t s i - s e c r e t s / j i t s i . e n v " ] ;
service . environment = {
PUBLIC_URL = " h t t p s : / / j i t s i . i s c g . d e v " ;
# Reverse proxy mode (Caddy терминирует TLS)
TZ = " E u r o p e / M o s c o w " ;
HTTP_PORT = " 8 0 0 0 " ;
DISABLE_HTTPS = " 1 " ;
ENABLE_HTTP_REDIRECT = " 0 " ;
ENABLE_HSTS = " 0 " ;
ENABLE_LETSENCRYPT = " 0 " ;
TZ = " E u r o p e / M o s c o w " ;
HTTP_PORT = " 8 0 0 0 " ;
JVB_ADVERTISE_IPS = " 5 1 . 2 5 0 . 4 5 . 1 1 1 " ;
DOCKER_HOST_ADDRESS = " 5 1 . 2 5 0 . 4 5 . 1 1 1 " ;
# Брендинг
APP_NAME = " m i k l m e e t " ;
PROVIDER_NAME = " m i k l m e e t " ;
SHOW_JITSI_WATERMARK = " f a l s e " ;
SHOW_POWERED_BY = " f a l s e " ;
DISABLE_JOIN_LEAVE_NOTIFICATIONS = " t r u e " ;
DISABLE_VIDEO_BACKGROUND = " t r u e " ;
# Authentication: internal (users через prosodyctl register)
ENABLE_AUTH = " 1 " ;
AUTH_TYPE = " i n t e r n a l " ;
ENABLE_GUESTS = " 1 " ;
# WebSocket для signalling/bridge (reverse proxy friendly)
ENABLE_XMPP_WEBSOCKET = " 1 " ;
ENABLE_COLIBRI_WEBSOCKET = " 1 " ;
# Качество видео
RESOLUTION = " 1 0 8 0 " ;
RESOLUTION_MIN = " 3 6 0 " ;
ENABLE_SIMULCAST = " t r u e " ;
ENABLE_P2P = " t r u e " ;
ENABLE_CODEC_VP8 = " 1 " ;
ENABLE_CODEC_VP9 = " 1 " ;
ENABLE_CODEC_H264 = " 1 " ;
ENABLE_CODEC_AV1 = " 0 " ;
} ;
} ;
@ -213,19 +191,25 @@
service . image = " j i t s i / p r o s o d y : s t a b l e - 1 1 0 3 1 " ;
service . container_name = " j i t s i - p r o s o d y " ;
service . restart = " u n l e s s - s t o p p e d " ;
service . read_only = true ;
service . tmpfs = [
" / r u n : s i z e = 1 6 M , m o d e = 1 7 5 0 , e x e c "
" / t m p : s i z e = 1 6 M , m o d e = 1 7 7 7 , n o e x e c "
] ;
service . expose = [ " 5 2 2 2 " " 5 2 6 9 " " 5 3 4 7 " " 5 2 8 0 " ] ;
service . volumes = [ " j i t s i - p r o s o d y : / c o n f i g " ] ;
# network alias: prosody доступен как xmpp.meet.jitsi для jicofo/jvb/web
service . volumes = [
" j i t s i - p r o s o d y - c o n f i g : / c o n f i g "
" j i t s i - p r o s o d y - d a t a : / v a r / l i b / p r o s o d y "
] ;
service . networks . meet-jitsi . aliases = [ " x m p p . m e e t . j i t s i " ] ;
service . env_file = [ " / v a r / l i b / j i t s i - s e c r e t s / j i t s i . e n v " ] ;
service . environment = {
TZ = " E u r o p e / M o s c o w " ;
PUBLIC_URL = " h t t p s : / / j i t s i . i s c g . d e v " ;
ENABLE_AUTH = " 1 " ;
AUTH_TYPE = " i n t e r n a l " ;
ENABLE_GUESTS = " 1 " ;
ENABLE_XMPP_WEBSOCKET = " 1 " ;
ENABLE_IPV6 = " 0 " ;
PUBLIC_URL = " h t t p s : / / j i t s i . i s c g . d e v " ;
} ;
} ;
@ -233,8 +217,13 @@
service . image = " j i t s i / j i c o f o : s t a b l e - 1 1 0 3 1 " ;
service . container_name = " j i t s i - j i c o f o " ;
service . restart = " u n l e s s - s t o p p e d " ;
service . read_only = true ;
service . tmpfs = [
" / r u n : s i z e = 1 6 M , m o d e = 1 7 5 0 , e x e c "
" / t m p : s i z e = 1 6 M , m o d e = 1 7 7 7 , n o e x e c "
] ;
service . ports = [ " 1 2 7 . 0 . 0 . 1 : 8 8 8 8 : 8 8 8 8 " ] ;
service . volumes = [ " j i t s i - j i c o f o : / c o n f i g " ] ;
service . volumes = [ " j i t s i - j i c o f o -c o n f i g :/ c o n f i g " ] ;
service . depends_on = [ " j i t s i - p r o s o d y " ] ;
service . networks = [ " m e e t - j i t s i " ] ;
service . env_file = [ " / v a r / l i b / j i t s i - s e c r e t s / j i t s i . e n v " ] ;
@ -242,8 +231,6 @@
TZ = " E u r o p e / M o s c o w " ;
ENABLE_AUTH = " 1 " ;
AUTH_TYPE = " i n t e r n a l " ;
JICOFO_MAX_MEMORY = " 1 0 2 4 m " ;
MAX_PARTICIPANTS = " 1 0 " ;
} ;
} ;
@ -251,11 +238,16 @@
service . image = " j i t s i / j v b : s t a b l e - 1 1 0 3 1 " ;
service . container_name = " j i t s i - j v b " ;
service . restart = " u n l e s s - s t o p p e d " ;
service . ports = [
" 1 0 0 0 0 : 1 0 0 0 0 / u d p " # публично — media traffic
" 1 2 7 . 0 . 0 . 1 : 8 0 8 0 : 8 0 8 0 " # colibri REST (localhost only)
service . read_only = true ;
service . tmpfs = [
" / r u n : s i z e = 1 6 M , m o d e = 1 7 5 0 , e x e c "
" / t m p : s i z e = 1 6 M , m o d e = 1 7 7 7 , n o e x e c "
] ;
service . volumes = [ " j i t s i - j v b : / c o n f i g " ] ;
service . ports = [
" 1 0 0 0 0 : 1 0 0 0 0 / u d p "
" 1 2 7 . 0 . 0 . 1 : 8 0 8 0 : 8 0 8 0 "
] ;
service . volumes = [ " j i t s i - j v b - c o n f i g : / c o n f i g " ] ;
service . depends_on = [ " j i t s i - p r o s o d y " ] ;
service . networks = [ " m e e t - j i t s i " ] ;
service . env_file = [ " / v a r / l i b / j i t s i - s e c r e t s / j i t s i . e n v " ] ;
@ -264,8 +256,6 @@
PUBLIC_URL = " h t t p s : / / j i t s i . i s c g . d e v " ;
JVB_ADVERTISE_IPS = " 5 1 . 2 5 0 . 4 5 . 1 1 1 " ;
JVB_PORT = " 1 0 0 0 0 " ;
JVB_DISABLE_STUN = " 0 " ;
VIDEOBRIDGE_MAX_MEMORY = " 2 0 4 8 m " ;
DOCKER_HOST_ADDRESS = " 5 1 . 2 5 0 . 4 5 . 1 1 1 " ;
} ;
} ;
