Steven Foerster
6 years ago
10 changed files with 566 additions and 6 deletions
@ -0,0 +1,177 @@
@@ -0,0 +1,177 @@
|
||||
version: '3' |
||||
|
||||
services: |
||||
# Frontend |
||||
jitsi-web: |
||||
image: jitsi/web |
||||
#ports: |
||||
#- '${HTTP_PORT}:80' |
||||
#- '${HTTPS_PORT}:443' |
||||
labels: |
||||
- "traefik.enable=true" |
||||
- "traefik.port=${HTTP_PORT}" |
||||
volumes: |
||||
- ${CONFIG}/web:/config |
||||
- ${CONFIG}/web/letsencrypt:/etc/letsencrypt |
||||
- ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts |
||||
env_file: |
||||
- ../.envs/.production/.jitsi |
||||
environment: |
||||
- ENABLE_AUTH |
||||
- ENABLE_GUESTS |
||||
- ENABLE_LETSENCRYPT |
||||
- ENABLE_HTTP_REDIRECT |
||||
- ENABLE_TRANSCRIPTIONS |
||||
- DISABLE_HTTPS |
||||
- JICOFO_AUTH_USER |
||||
- LETSENCRYPT_DOMAIN |
||||
- LETSENCRYPT_EMAIL |
||||
- PUBLIC_URL |
||||
- XMPP_DOMAIN |
||||
- XMPP_AUTH_DOMAIN |
||||
- XMPP_BOSH_URL_BASE |
||||
- XMPP_GUEST_DOMAIN |
||||
- XMPP_MUC_DOMAIN |
||||
- XMPP_RECORDER_DOMAIN |
||||
- ETHERPAD_URL_BASE |
||||
- TZ |
||||
- JIBRI_BREWERY_MUC |
||||
- JIBRI_PENDING_TIMEOUT |
||||
- JIBRI_XMPP_USER |
||||
- JIBRI_XMPP_PASSWORD |
||||
- JIBRI_RECORDER_USER |
||||
- JIBRI_RECORDER_PASSWORD |
||||
- ENABLE_RECORDING |
||||
networks: |
||||
default: |
||||
meet.jitsi: |
||||
aliases: |
||||
- ${XMPP_DOMAIN} |
||||
|
||||
# XMPP server |
||||
jitsi-prosody: |
||||
image: jitsi/prosody |
||||
expose: |
||||
- '5222' |
||||
- '5347' |
||||
- '5280' |
||||
volumes: |
||||
- ${CONFIG}/prosody:/config |
||||
env_file: |
||||
- ../.envs/.production/.jitsi |
||||
environment: |
||||
- AUTH_TYPE |
||||
- ENABLE_AUTH |
||||
- ENABLE_GUESTS |
||||
- GLOBAL_MODULES |
||||
- GLOBAL_CONFIG |
||||
- LDAP_URL |
||||
- LDAP_BASE |
||||
- LDAP_BINDDN |
||||
- LDAP_BINDPW |
||||
- LDAP_FILTER |
||||
- LDAP_AUTH_METHOD |
||||
- LDAP_VERSION |
||||
- LDAP_USE_TLS |
||||
- LDAP_TLS_CIPHERS |
||||
- LDAP_TLS_CHECK_PEER |
||||
- LDAP_TLS_CACERT_FILE |
||||
- LDAP_TLS_CACERT_DIR |
||||
- LDAP_START_TLS |
||||
- XMPP_DOMAIN |
||||
- XMPP_AUTH_DOMAIN |
||||
- XMPP_GUEST_DOMAIN |
||||
- XMPP_MUC_DOMAIN |
||||
- XMPP_INTERNAL_MUC_DOMAIN |
||||
- XMPP_MODULES |
||||
- XMPP_MUC_MODULES |
||||
- XMPP_INTERNAL_MUC_MODULES |
||||
- XMPP_RECORDER_DOMAIN |
||||
- JICOFO_COMPONENT_SECRET |
||||
- JICOFO_AUTH_USER |
||||
- JICOFO_AUTH_PASSWORD |
||||
- JVB_AUTH_USER |
||||
- JVB_AUTH_PASSWORD |
||||
- JIGASI_XMPP_USER |
||||
- JIGASI_XMPP_PASSWORD |
||||
- JIBRI_XMPP_USER |
||||
- JIBRI_XMPP_PASSWORD |
||||
- JIBRI_RECORDER_USER |
||||
- JIBRI_RECORDER_PASSWORD |
||||
- JWT_APP_ID |
||||
- JWT_APP_SECRET |
||||
- JWT_ACCEPTED_ISSUERS |
||||
- JWT_ACCEPTED_AUDIENCES |
||||
- JWT_ASAP_KEYSERVER |
||||
- JWT_ALLOW_EMPTY |
||||
- JWT_AUTH_TYPE |
||||
- JWT_TOKEN_AUTH_MODULE |
||||
- LOG_LEVEL |
||||
- TZ |
||||
networks: |
||||
meet.jitsi: |
||||
aliases: |
||||
- ${XMPP_SERVER} |
||||
|
||||
# Focus component |
||||
jitsi-jicofo: |
||||
image: jitsi/jicofo |
||||
volumes: |
||||
- ${CONFIG}/jicofo:/config |
||||
env_file: |
||||
- ../.envs/.production/.jitsi |
||||
environment: |
||||
- ENABLE_AUTH |
||||
- XMPP_DOMAIN |
||||
- XMPP_AUTH_DOMAIN |
||||
- XMPP_INTERNAL_MUC_DOMAIN |
||||
- XMPP_SERVER |
||||
- JICOFO_COMPONENT_SECRET |
||||
- JICOFO_AUTH_USER |
||||
- JICOFO_AUTH_PASSWORD |
||||
- JICOFO_RESERVATION_REST_BASE_URL |
||||
- JVB_BREWERY_MUC |
||||
- JIGASI_BREWERY_MUC |
||||
- JIBRI_BREWERY_MUC |
||||
- JIBRI_PENDING_TIMEOUT |
||||
- TZ |
||||
depends_on: |
||||
- jitsi-prosody |
||||
networks: |
||||
meet.jitsi: |
||||
|
||||
# Video bridge |
||||
jitsi-jvb: |
||||
image: jitsi/jvb |
||||
ports: |
||||
- '${JVB_PORT}:${JVB_PORT}/udp' |
||||
- '${JVB_TCP_PORT}:${JVB_TCP_PORT}' |
||||
volumes: |
||||
- ${CONFIG}/jvb:/config |
||||
env_file: |
||||
- ../.envs/.production/.jitsi |
||||
environment: |
||||
- DOCKER_HOST_ADDRESS |
||||
- XMPP_AUTH_DOMAIN |
||||
- XMPP_INTERNAL_MUC_DOMAIN |
||||
- XMPP_SERVER |
||||
- JVB_AUTH_USER |
||||
- JVB_AUTH_PASSWORD |
||||
- JVB_BREWERY_MUC |
||||
- JVB_PORT |
||||
- JVB_TCP_HARVESTER_DISABLED |
||||
- JVB_TCP_PORT |
||||
- JVB_STUN_SERVERS |
||||
- JVB_ENABLE_APIS |
||||
- TZ |
||||
depends_on: |
||||
- jitsi-prosody |
||||
networks: |
||||
meet.jitsi: |
||||
|
||||
# Custom network so all services can communicate using a FQDN |
||||
networks: |
||||
default: |
||||
external: |
||||
name: mistborn_default |
||||
meet.jitsi: |
||||
@ -0,0 +1,307 @@
@@ -0,0 +1,307 @@
|
||||
# |
||||
# Basic configuration options |
||||
# |
||||
|
||||
# Directory where all configuration will be stored. |
||||
#CONFIG=~/.jitsi-meet-cfg |
||||
CONFIG=../.envs/.production/.jitsi-cfg |
||||
|
||||
# Exposed HTTP port. |
||||
HTTP_PORT=80 |
||||
|
||||
# Exposed HTTPS port. |
||||
HTTPS_PORT=8443 |
||||
|
||||
# System time zone. |
||||
TZ=Europe/Amsterdam |
||||
|
||||
# Public URL for the web service. |
||||
#PUBLIC_URL=https://meet.example.com |
||||
|
||||
# IP address of the Docker host. See the "Running on a LAN environment" section |
||||
# in the README. |
||||
DOCKER_HOST_ADDRESS=10.2.3.1 |
||||
|
||||
|
||||
# |
||||
# Let's Encrypt configuration |
||||
# |
||||
|
||||
# Enable Let's Encrypt certificate generation. |
||||
#ENABLE_LETSENCRYPT=1 |
||||
|
||||
# Domain for which to generate the certificate. |
||||
#LETSENCRYPT_DOMAIN=meet.example.com |
||||
|
||||
# E-Mail for receiving important account notifications (mandatory). |
||||
#LETSENCRYPT_EMAIL=alice@atlanta.net |
||||
|
||||
|
||||
# |
||||
# Etherpad integration (for document sharing) |
||||
# |
||||
|
||||
# Set etherpad-lite URL (uncomment to enable). |
||||
#ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001 |
||||
|
||||
|
||||
# |
||||
# Basic Jigasi configuration options (needed for SIP gateway support) |
||||
# |
||||
|
||||
# SIP URI for incoming / outgoing calls. |
||||
#JIGASI_SIP_URI=test@sip2sip.info |
||||
|
||||
# Password for the specified SIP account as a clear text |
||||
#JIGASI_SIP_PASSWORD=passw0rd |
||||
|
||||
# SIP server (use the SIP account domain if in doubt). |
||||
#JIGASI_SIP_SERVER=sip2sip.info |
||||
|
||||
# SIP server port |
||||
#JIGASI_SIP_PORT=5060 |
||||
|
||||
# SIP server transport |
||||
#JIGASI_SIP_TRANSPORT=UDP |
||||
|
||||
# |
||||
# Authentication configuration (see README for details) |
||||
# |
||||
|
||||
# Enable authentication. |
||||
#ENABLE_AUTH=1 |
||||
|
||||
# Enable guest access. |
||||
#ENABLE_GUESTS=1 |
||||
|
||||
# Select authentication type: internal, jwt or ldap |
||||
#AUTH_TYPE=internal |
||||
|
||||
# JWT authentication |
||||
# |
||||
|
||||
# Application identifier. |
||||
#JWT_APP_ID=my_jitsi_app_id |
||||
|
||||
# Application secret known only to your token. |
||||
#JWT_APP_SECRET=my_jitsi_app_secret |
||||
|
||||
# (Optional) Set asap_accepted_issuers as a comma separated list. |
||||
#JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client |
||||
|
||||
# (Optional) Set asap_accepted_audiences as a comma separated list. |
||||
#JWT_ACCEPTED_AUDIENCES=my_server1,my_server2 |
||||
|
||||
|
||||
# LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page) |
||||
# |
||||
|
||||
# LDAP url for connection. |
||||
#LDAP_URL=ldaps://ldap.domain.com/ |
||||
|
||||
# LDAP base DN. Can be empty |
||||
#LDAP_BASE=DC=example,DC=domain,DC=com |
||||
|
||||
# LDAP user DN. Do not specify this parameter for the anonymous bind. |
||||
#LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com |
||||
|
||||
# LDAP user password. Do not specify this parameter for the anonymous bind. |
||||
#LDAP_BINDPW=LdapUserPassw0rd |
||||
|
||||
# LDAP filter. Tokens example: |
||||
# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail. |
||||
# %s - %s is replaced by the complete service string. |
||||
# %r - %r is replaced by the complete realm string. |
||||
#LDAP_FILTER=(sAMAccountName=%u) |
||||
|
||||
# LDAP authentication method |
||||
#LDAP_AUTH_METHOD=bind |
||||
|
||||
# LDAP version |
||||
#LDAP_VERSION=3 |
||||
|
||||
# LDAP TLS using |
||||
#LDAP_USE_TLS=1 |
||||
|
||||
# List of SSL/TLS ciphers to allow. |
||||
#LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC |
||||
|
||||
# Require and verify server certificate |
||||
#LDAP_TLS_CHECK_PEER=1 |
||||
|
||||
# Path to CA cert file. Used when server sertificate verify is enabled. |
||||
#LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt |
||||
|
||||
# Path to CA certs directory. Used when server sertificate verify is enabled. |
||||
#LDAP_TLS_CACERT_DIR=/etc/ssl/certs |
||||
|
||||
# Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps:// |
||||
# LDAP_START_TLS=1 |
||||
|
||||
|
||||
# |
||||
# Advanced configuration options (you generally don't need to change these) |
||||
# |
||||
|
||||
# Internal XMPP domain. |
||||
XMPP_DOMAIN=meet.jitsi |
||||
|
||||
# Internal XMPP server |
||||
XMPP_SERVER=xmpp.meet.jitsi |
||||
|
||||
# Internal XMPP server URL |
||||
XMPP_BOSH_URL_BASE=http://xmpp.meet.jitsi:5280 |
||||
|
||||
# Internal XMPP domain for authenticated services. |
||||
XMPP_AUTH_DOMAIN=auth.meet.jitsi |
||||
|
||||
# XMPP domain for the MUC. |
||||
XMPP_MUC_DOMAIN=muc.meet.jitsi |
||||
|
||||
# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools. |
||||
XMPP_INTERNAL_MUC_DOMAIN=internal-muc.meet.jitsi |
||||
|
||||
# XMPP domain for unauthenticated users. |
||||
XMPP_GUEST_DOMAIN=guest.meet.jitsi |
||||
|
||||
# Custom Prosody modules for XMPP_DOMAIN (comma separated) |
||||
XMPP_MODULES= |
||||
|
||||
# Custom Prosody modules for MUC component (comma separated) |
||||
XMPP_MUC_MODULES= |
||||
|
||||
# Custom Prosody modules for internal MUC component (comma separated) |
||||
XMPP_INTERNAL_MUC_MODULES= |
||||
|
||||
# MUC for the JVB pool. |
||||
JVB_BREWERY_MUC=jvbbrewery |
||||
|
||||
# XMPP user for JVB client connections. |
||||
JVB_AUTH_USER=jvb |
||||
|
||||
# XMPP password for JVB client connections. |
||||
JVB_AUTH_PASSWORD=passw0rd |
||||
|
||||
# STUN servers used to discover the server's public IP. |
||||
JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302 |
||||
|
||||
# Media port for the Jitsi Videobridge |
||||
JVB_PORT=10000 |
||||
|
||||
# TCP Fallback for Jitsi Videobridge for when UDP isn't available |
||||
JVB_TCP_HARVESTER_DISABLED=true |
||||
JVB_TCP_PORT=4443 |
||||
|
||||
# A comma separated list of APIs to enable when the JVB is started. The default is none. |
||||
# See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information |
||||
#JVB_ENABLE_APIS=rest,colibri |
||||
|
||||
# XMPP component password for Jicofo. |
||||
JICOFO_COMPONENT_SECRET=s3cr37 |
||||
|
||||
# XMPP user for Jicofo client connections. NOTE: this option doesn't currently work due to a bug. |
||||
JICOFO_AUTH_USER=focus |
||||
|
||||
# XMPP password for Jicofo client connections. |
||||
JICOFO_AUTH_PASSWORD=passw0rd |
||||
|
||||
# Base URL of Jicofo's reservation REST API |
||||
#JICOFO_RESERVATION_REST_BASE_URL=http://reservation.example.com |
||||
|
||||
# XMPP user for Jigasi MUC client connections. |
||||
JIGASI_XMPP_USER=jigasi |
||||
|
||||
# XMPP password for Jigasi MUC client connections. |
||||
JIGASI_XMPP_PASSWORD=passw0rd |
||||
|
||||
# MUC name for the Jigasi pool. |
||||
JIGASI_BREWERY_MUC=jigasibrewery |
||||
|
||||
# Minimum port for media used by Jigasi. |
||||
JIGASI_PORT_MIN=20000 |
||||
|
||||
# Maximum port for media used by Jigasi. |
||||
JIGASI_PORT_MAX=20050 |
||||
|
||||
# Enable SDES srtp |
||||
#JIGASI_ENABLE_SDES_SRTP=1 |
||||
|
||||
# Keepalive method |
||||
#JIGASI_SIP_KEEP_ALIVE_METHOD=OPTIONS |
||||
|
||||
# Health-check extension |
||||
#JIGASI_HEALTH_CHECK_SIP_URI=keepalive |
||||
|
||||
# Health-check interval |
||||
#JIGASI_HEALTH_CHECK_INTERVAL=300000 |
||||
# |
||||
# Enable Jigasi transcription. |
||||
#ENABLE_TRANSCRIPTIONS=1 |
||||
|
||||
# Jigasi will recordord an audio when transcriber is on. Default false. |
||||
#JIGASI_TRANSCRIBER_RECORD_AUDIO=true |
||||
|
||||
# Jigasi will send transcribed text to the chat when transcriber is on. Default false. |
||||
#JIGASI_TRANSCRIBER_SEND_TXT=true |
||||
|
||||
# Jigasi post to the chat an url with transcription file. Default false. |
||||
#JIGASI_TRANSCRIBER_ADVERTISE_URL=true |
||||
|
||||
# Credentials for connect to Cloud Google API from Jigasi |
||||
# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol section "Before you begin" from 1 to 5 paragraph. |
||||
# Copy the values from the json to the related env vars |
||||
#GC_PROJECT_ID= |
||||
#GC_PRIVATE_KEY_ID= |
||||
#GC_PRIVATE_KEY= |
||||
#GC_CLIENT_EMAIL= |
||||
#GC_CLIENT_ID= |
||||
#GC_CLIENT_CERT_URL= |
||||
|
||||
# Enable recording |
||||
#ENABLE_RECORDING=1 |
||||
|
||||
# XMPP domain for the jibri recorder |
||||
XMPP_RECORDER_DOMAIN=recorder.meet.jitsi |
||||
|
||||
# XMPP recorder user for Jibri client connections. |
||||
JIBRI_RECORDER_USER=recorder |
||||
|
||||
# XMPP recorder password for Jibri client connections. |
||||
JIBRI_RECORDER_PASSWORD=passw0rd |
||||
|
||||
# Directory for recordings inside Jibri container. |
||||
JIBRI_RECORDING_DIR=/config/recordings |
||||
|
||||
# The finalizing script. Will run after recording is complete. |
||||
JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh |
||||
|
||||
# XMPP user for Jibri client connections. |
||||
JIBRI_XMPP_USER=jibri |
||||
|
||||
# XMPP password for Jibri client connections. |
||||
JIBRI_XMPP_PASSWORD=passw0rd |
||||
|
||||
# MUC name for the Jibri pool. |
||||
JIBRI_BREWERY_MUC=jibribrewery |
||||
|
||||
# MUC connection timeout |
||||
JIBRI_PENDING_TIMEOUT=90 |
||||
|
||||
# When jibri gets a request to start a service for a room, the room |
||||
# jid will look like: roomName@optional.prefixes.subdomain.xmpp_domain |
||||
# We'll build the url for the call by transforming that into: |
||||
# https://xmpp_domain/subdomain/roomName |
||||
# So if there are any prefixes in the jid (like jitsi meet, which |
||||
# has its participants join a muc at conference.xmpp_domain) then |
||||
# list that prefix here so it can be stripped out to generate |
||||
# the call url correctly. |
||||
JIBRI_STRIP_DOMAIN_JID=muc |
||||
|
||||
# Directory for logs inside Jibri container. |
||||
JIBRI_LOGS_DIR=/config/logs |
||||
|
||||
# Disable HTTPS. This can be useful if TLS connections are going to be handled outside of this setup. |
||||
DISABLE_HTTPS=1 |
||||
|
||||
# Redirects HTTP traffic to HTTPS. Only works with the standard HTTPS port (443). |
||||
#ENABLE_HTTP_REDIRECT=1 |
||||
@ -0,0 +1,27 @@
@@ -0,0 +1,27 @@
|
||||
[Unit] |
||||
Description=Mistborn Jitsi Service |
||||
Requires=Mistborn-base.service |
||||
After=Mistborn-base.service |
||||
|
||||
[Service] |
||||
Restart=always |
||||
User=root |
||||
Group=docker |
||||
PermissionsStartOnly=true |
||||
EnvironmentFile=/opt/mistborn/.envs/.production/.jitsi |
||||
|
||||
# Shutdown container (if running) when unit is stopped |
||||
ExecStartPre=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down |
||||
|
||||
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP |
||||
ExecStartPre=/sbin/iptables -I DOCKER-USER -i DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP |
||||
# Start container when unit is started |
||||
ExecStart=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml up --build |
||||
# Stop container when unit is stopped |
||||
ExecStop=/usr/local/bin/docker-compose -f /opt/mistborn/extra/jitsi-meet.yml down |
||||
# Post stop |
||||
ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p udp --dport $JVB_PORT -j MISTBORN_LOG_DROP |
||||
ExecStopPost=-/sbin/iptables -D DOCKER-USER -i DIFACE -p tcp --dport $JVB_TCP_PORT -j MISTBORN_LOG_DROP |
||||
|
||||
[Install] |
||||
WantedBy=multi-user.target |
||||
@ -0,0 +1,21 @@
@@ -0,0 +1,21 @@
|
||||
#!/bin/bash |
||||
|
||||
KEY_FOLDER="./tls/" |
||||
CRT_FILE="cert.crt" |
||||
KEY_FILE="cert.key" |
||||
|
||||
CRT_PATH="$KEY_FOLDER/$CRT_FILE" |
||||
KEY_PATH="$KEY_FOLDER/$KEY_FILE" |
||||
|
||||
# ensure openssl installed |
||||
sudo apt-get install -y openssl |
||||
|
||||
# make folder |
||||
mkdir -p $KEY_FOLDER |
||||
|
||||
# generate crt and key |
||||
openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:4096 -keyout $KEY_PATH -out $CRT_PATH -subj "/C=US/ST=New York/L=New York/O=cyber5k/OU=mistborn/CN=*.mistborn/emailAddress=mistborn@localhost" |
||||
|
||||
# set permissions |
||||
chmod 644 $CRT_PATH |
||||
chmod 600 $KEY_PATH |
||||
Loading…
Reference in new issue