Merge branch '105-jitsi' into 'master'

Resolve "Jitsi Bouncing Error"

Closes #105

See merge request cyber5k/mistborn!55

README.md

@@ -105,6 +105,8 @@ Mistborn protects your data in a variety of ways:
 - The Mistborn firewall blocks unsolicited incoming internet packets
 - Pi-hole running on Mistborn blocks outgoing internet requests to configurable blocked domains (ads, malicious/phishing domains, etc.) 
 
+See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/Mistborn-Network-Security) wiki page to see more network diagrams and the network scan results for Mistborn.
+
 # Coppercloud
 Pihole provides a way to block outgoing DNS requests for given lists of blocked domains. Coppercloud provides a way to block outgoing network calls of all types to given lists of IP addresses (IPv4 only for now). This is especially useful for blocking outgoing telemetry (data and state sharing) to owners of software running on all of your devices.
 
@@ -504,11 +506,12 @@ See the [Mistborn Network Security](https://gitlab.com/cyber5k/mistborn/-/wikis/
 - Outbound UDP on port 53 is blocked. All DNS requests should be handled by the dnscrypt_proxy service and if any client, service, etc. tries to circumvent that it is blocked.
 - Unattended upgrades are set to automatically install operating system security updates.
 
-# Roadmap
+# Roadmap (not necessarily in order)
 Many features and refinements are in the works at various stages including:
 
 - Plugins for Extra Services (enabling third-party development)
 - Plugin repository
+- IPv6 support
 - Integration with RaspAP to enable managing an Access Point for local network connections
 - Internal network scan tool and feedback
 - Anomaly detection in network traffic

extra/jitsi-meet.yml

@@ -4,6 +4,7 @@ services:
     # Frontend
     jitsi-web:
         image: jitsi/web
+        restart: unless-stopped
         #ports:
             #- '${HTTP_PORT}:80'
             #- '${HTTPS_PORT}:443'
@@ -18,59 +19,115 @@ services:
             - "traefik.http.routers.jitsi-https.tls.certresolver=basic"
             - "traefik.http.services.jitsi-service.loadbalancer.server.port=${HTTP_PORT}"
         volumes:
-            - ${CONFIG}/web:/config
-            - ${CONFIG}/web/letsencrypt:/etc/letsencrypt
-            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts
+            - ${CONFIG}/web:/config:Z
+            - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
         env_file:
             - ../.envs/.production/.jitsi
         environment:
-            - ENABLE_AUTH
-            - ENABLE_GUESTS
             - ENABLE_LETSENCRYPT
             - ENABLE_HTTP_REDIRECT
-            - ENABLE_TRANSCRIPTIONS
+            - ENABLE_XMPP_WEBSOCKET
             - DISABLE_HTTPS
-            - JICOFO_AUTH_USER
             - LETSENCRYPT_DOMAIN
             - LETSENCRYPT_EMAIL
+            - LETSENCRYPT_USE_STAGING
             - PUBLIC_URL
-            - XMPP_DOMAIN
+            - TZ
+            - AMPLITUDE_ID
+            - ANALYTICS_SCRIPT_URLS
+            - ANALYTICS_WHITELISTED_EVENTS
+            - BRIDGE_CHANNEL
+            - BRANDING_DATA_URL
+            - CALLSTATS_CUSTOM_SCRIPT_URL
+            - CALLSTATS_ID
+            - CALLSTATS_SECRET
+            - CHROME_EXTENSION_BANNER_JSON
+            - CONFCODE_URL
+            - CONFIG_EXTERNAL_CONNECT
+            - DEPLOYMENTINFO_ENVIRONMENT
+            - DEPLOYMENTINFO_ENVIRONMENT_TYPE
+            - DEPLOYMENTINFO_USERREGION
+            - DIALIN_NUMBERS_URL
+            - DIALOUT_AUTH_URL
+            - DIALOUT_CODES_URL
+            - DROPBOX_APPKEY
+            - DROPBOX_REDIRECT_URI
+            - ENABLE_AUDIO_PROCESSING
+            - ENABLE_AUTH
+            - ENABLE_CALENDAR
+            - ENABLE_FILE_RECORDING_SERVICE
+            - ENABLE_FILE_RECORDING_SERVICE_SHARING
+            - ENABLE_GUESTS
+            - ENABLE_IPV6
+            - ENABLE_LIPSYNC
+            - ENABLE_NO_AUDIO_DETECTION
+            - ENABLE_P2P
+            - ENABLE_PREJOIN_PAGE
+            - ENABLE_RECORDING
+            - ENABLE_REMB
+            - ENABLE_REQUIRE_DISPLAY_NAME
+            - ENABLE_SIMULCAST
+            - ENABLE_STATS_ID
+            - ENABLE_STEREO
+            - ENABLE_SUBDOMAINS
+            - ENABLE_TALK_WHILE_MUTED
+            - ENABLE_TCC
+            - ENABLE_TRANSCRIPTIONS
+            - ETHERPAD_PUBLIC_URL
+            - ETHERPAD_URL_BASE
+            - GOOGLE_ANALYTICS_ID
+            - GOOGLE_API_APP_CLIENT_ID
+            - INVITE_SERVICE_URL
+            - JICOFO_AUTH_USER
+            - MATOMO_ENDPOINT
+            - MATOMO_SITE_ID
+            - MICROSOFT_API_APP_CLIENT_ID
+            - NGINX_RESOLVER
+            - NGINX_WORKER_PROCESSES
+            - NGINX_WORKER_CONNECTIONS
+            - PEOPLE_SEARCH_URL
+            - RESOLUTION
+            - RESOLUTION_MIN
+            - RESOLUTION_WIDTH
+            - RESOLUTION_WIDTH_MIN
+            - START_AUDIO_ONLY
+            - START_AUDIO_MUTED
+            - START_BITRATE
+            - START_VIDEO_MUTED
+            - TESTING_CAP_SCREENSHARE_BITRATE
+            - TESTING_OCTO_PROBABILITY
             - XMPP_AUTH_DOMAIN
             - XMPP_BOSH_URL_BASE
+            - XMPP_DOMAIN
             - XMPP_GUEST_DOMAIN
             - XMPP_MUC_DOMAIN
             - XMPP_RECORDER_DOMAIN
-            - ETHERPAD_URL_BASE
-            - TZ
-            - JIBRI_BREWERY_MUC
-            - JIBRI_PENDING_TIMEOUT
-            - JIBRI_XMPP_USER
-            - JIBRI_XMPP_PASSWORD
-            - JIBRI_RECORDER_USER
-            - JIBRI_RECORDER_PASSWORD
-            - ENABLE_RECORDING
+            - TOKEN_AUTH_URL
         networks:
             default:
             meet.jitsi:
                 aliases:
                     - ${XMPP_DOMAIN}
-        restart: unless-stopped 
 
     # XMPP server
     jitsi-prosody:
-        image: jitsi/prosody
+        image: jitsi/prosody:latest
+        restart: unless-stopped
         expose:
             - '5222'
             - '5347'
             - '5280'
         volumes:
-            - ${CONFIG}/prosody:/config
+            - ${CONFIG}/prosody/config:/config:Z
+            - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
         env_file:
             - ../.envs/.production/.jitsi
         environment:
             - AUTH_TYPE
             - ENABLE_AUTH
             - ENABLE_GUESTS
+            - ENABLE_LOBBY
+            - ENABLE_XMPP_WEBSOCKET
             - GLOBAL_MODULES
             - GLOBAL_CONFIG
             - LDAP_URL
@@ -95,6 +152,7 @@ services:
             - XMPP_MUC_MODULES
             - XMPP_INTERNAL_MUC_MODULES
             - XMPP_RECORDER_DOMAIN
+            - XMPP_CROSS_DOMAIN
             - JICOFO_COMPONENT_SECRET
             - JICOFO_AUTH_USER
             - JICOFO_AUTH_PASSWORD
@@ -115,25 +173,28 @@ services:
             - JWT_AUTH_TYPE
             - JWT_TOKEN_AUTH_MODULE
             - LOG_LEVEL
+            - PUBLIC_URL
             - TZ
         networks:
             meet.jitsi:
                 aliases:
                     - ${XMPP_SERVER}
-        restart: unless-stopped 
 
     # Focus component
     jitsi-jicofo:
-        image: jitsi/jicofo
+        image: jitsi/jicofo:latest
+        restart: unless-stopped
         volumes:
-            - ${CONFIG}/jicofo:/config
+            - ${CONFIG}/jicofo:/config:Z
         env_file:
             - ../.envs/.production/.jitsi
         environment:
+            - AUTH_TYPE
             - ENABLE_AUTH
             - XMPP_DOMAIN
             - XMPP_AUTH_DOMAIN
             - XMPP_INTERNAL_MUC_DOMAIN
+            - XMPP_MUC_DOMAIN
             - XMPP_SERVER
             - JICOFO_COMPONENT_SECRET
             - JICOFO_AUTH_USER
@@ -141,6 +202,7 @@ services:
             - JICOFO_RESERVATION_REST_BASE_URL
             - JVB_BREWERY_MUC
             - JIGASI_BREWERY_MUC
+            - JIGASI_SIP_URI
             - JIBRI_BREWERY_MUC
             - JIBRI_PENDING_TIMEOUT
             - TZ
@@ -148,16 +210,16 @@ services:
             - jitsi-prosody
         networks:
             meet.jitsi:
-        restart: unless-stopped 
 
     # Video bridge
     jitsi-jvb:
-        image: jitsi/jvb
+        image: jitsi/jvb:latest
+        restart: unless-stopped
         ports:
             - '${JVB_PORT}:${JVB_PORT}/udp'
             - '${JVB_TCP_PORT}:${JVB_TCP_PORT}'
         volumes:
-            - ${CONFIG}/jvb:/config
+            - ${CONFIG}/jvb:/config:Z
         env_file:
             - ../.envs/.production/.jitsi
         environment:
@@ -171,14 +233,19 @@ services:
             - JVB_PORT
             - JVB_TCP_HARVESTER_DISABLED
             - JVB_TCP_PORT
+            - JVB_TCP_MAPPED_PORT
             - JVB_STUN_SERVERS
             - JVB_ENABLE_APIS
+            - JVB_WS_DOMAIN
+            - JVB_WS_SERVER_ID
+            - PUBLIC_URL
             - TZ
         depends_on:
             - jitsi-prosody
         networks:
             meet.jitsi:
-        restart: unless-stopped 
+                aliases:
+                    - jvb.meet.jitsi
 
 # Custom network so all services can communicate using a FQDN
 networks:

scripts/conf/jitsi.env

@@ -1,61 +1,116 @@
+# shellcheck disable=SC2034
+
+# Security
+#
+# Set these to strong passwords to avoid intruders from impersonating a service account
+# The service(s) won't start unless these are specified
+# Running ./gen-passwords.sh will update .env with strong passwords
+# You may skip the Jigasi and Jibri passwords if you are not using those
+# DO NOT reuse passwords
+#
+
+# XMPP component password for Jicofo
+JICOFO_COMPONENT_SECRET=
+
+# XMPP password for Jicofo client connections
+JICOFO_AUTH_PASSWORD=
+
+# XMPP password for JVB client connections
+JVB_AUTH_PASSWORD=
+
+# XMPP password for Jigasi MUC client connections
+JIGASI_XMPP_PASSWORD=
+
+# XMPP recorder password for Jibri client connections
+JIBRI_RECORDER_PASSWORD=
+
+# XMPP password for Jibri client connections
+JIBRI_XMPP_PASSWORD=
+
+
 #
 # Basic configuration options
 #
 
-# Directory where all configuration will be stored.
+# Directory where all configuration will be stored
 #CONFIG=~/.jitsi-meet-cfg
 CONFIG=../.envs/.production/.jitsi-cfg
 
-# Exposed HTTP port.
+# Exposed HTTP port
 HTTP_PORT=80
 
-# Exposed HTTPS port.
-HTTPS_PORT=8443
+# Exposed HTTPS port
+HTTPS_PORT=443
 
-# System time zone.
-TZ=Europe/Amsterdam
+# System time zone
+TZ=UTC
 
-# Public URL for the web service.
-#PUBLIC_URL=https://meet.example.com
+# Public URL for the web service (required)
+PUBLIC_URL=https://jitsi.mistborn
 
-# IP address of the Docker host. See the "Running on a LAN environment" section
-# in the README.
+# IP address of the Docker host
+# See the "Running behind NAT or on a LAN environment" section in the Handbook:
+# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-nat-or-on-a-lan-environment
+#DOCKER_HOST_ADDRESS=192.168.1.1
 DOCKER_HOST_ADDRESS=10.2.3.1
 
+# Control whether the lobby feature should be enabled or not
+#ENABLE_LOBBY=1
+
+# Show a prejoin page before entering a conference
+#ENABLE_PREJOIN_PAGE=0
 
 #
 # Let's Encrypt configuration
 #
 
-# Enable Let's Encrypt certificate generation.
+# Enable Let's Encrypt certificate generation
 #ENABLE_LETSENCRYPT=1
 
-# Domain for which to generate the certificate.
+# Domain for which to generate the certificate
 #LETSENCRYPT_DOMAIN=meet.example.com
 
-# E-Mail for receiving important account notifications (mandatory).
+# E-Mail for receiving important account notifications (mandatory)
 #LETSENCRYPT_EMAIL=alice@atlanta.net
 
+# Use the staging server (for avoiding rate limits while testing)
+#LETSENCRYPT_USE_STAGING=1
+
 
 #
 # Etherpad integration (for document sharing)
 #
 
-# Set etherpad-lite URL (uncomment to enable).
+# Set etherpad-lite URL in docker local network (uncomment to enable)
 #ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001
 
+# Set etherpad-lite public URL (uncomment to enable)
+#ETHERPAD_PUBLIC_URL=https://etherpad.my.domain
+
+# Name your etherpad instance!
+ETHERPAD_TITLE="Video Chat"
+
+# The default text of a pad
+ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
+
+# Name of the skin for etherpad
+ETHERPAD_SKIN_NAME="colibris"
+
+# Skin variants for etherpad
+ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
+
 
 #
 # Basic Jigasi configuration options (needed for SIP gateway support)
 #
 
-# SIP URI for incoming / outgoing calls.
+# SIP URI for incoming / outgoing calls
 #JIGASI_SIP_URI=test@sip2sip.info
 
 # Password for the specified SIP account as a clear text
 #JIGASI_SIP_PASSWORD=passw0rd
 
-# SIP server (use the SIP account domain if in doubt).
+# SIP server (use the SIP account domain if in doubt)
 #JIGASI_SIP_SERVER=sip2sip.info
 
 # SIP server port
@@ -65,13 +120,13 @@ DOCKER_HOST_ADDRESS=10.2.3.1
 #JIGASI_SIP_TRANSPORT=UDP
 
 #
-# Authentication configuration (see README for details)
+# Authentication configuration (see handbook for details)
 #
 
-# Enable authentication.
+# Enable authentication
 #ENABLE_AUTH=1
 
-# Enable guest access.
+# Enable guest access
 #ENABLE_GUESTS=1
 
 # Select authentication type: internal, jwt or ldap
@@ -80,38 +135,38 @@ DOCKER_HOST_ADDRESS=10.2.3.1
 # JWT authentication
 #
 
-# Application identifier.
+# Application identifier
 #JWT_APP_ID=my_jitsi_app_id
 
-# Application secret known only to your token.
+# Application secret known only to your token
 #JWT_APP_SECRET=my_jitsi_app_secret
 
-# (Optional) Set asap_accepted_issuers as a comma separated list.
+# (Optional) Set asap_accepted_issuers as a comma separated list
 #JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client
 
-# (Optional) Set asap_accepted_audiences as a comma separated list.
+# (Optional) Set asap_accepted_audiences as a comma separated list
 #JWT_ACCEPTED_AUDIENCES=my_server1,my_server2
 
 
 # LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page)
 #
 
-# LDAP url for connection.
+# LDAP url for connection
 #LDAP_URL=ldaps://ldap.domain.com/
 
 # LDAP base DN. Can be empty
 #LDAP_BASE=DC=example,DC=domain,DC=com
 
-# LDAP user DN. Do not specify this parameter for the anonymous bind.
+# LDAP user DN. Do not specify this parameter for the anonymous bind
 #LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com
 
-# LDAP user password. Do not specify this parameter for the anonymous bind.
+# LDAP user password. Do not specify this parameter for the anonymous bind
 #LDAP_BINDPW=LdapUserPassw0rd
 
 # LDAP filter. Tokens example:
-# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail.
-# %s - %s is replaced by the complete service string.
-# %r - %r is replaced by the complete realm string.
+# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail
+# %s - %s is replaced by the complete service string
+# %r - %r is replaced by the complete realm string
 #LDAP_FILTER=(sAMAccountName=%u)
 
 # LDAP authentication method
@@ -123,16 +178,16 @@ DOCKER_HOST_ADDRESS=10.2.3.1
 # LDAP TLS using
 #LDAP_USE_TLS=1
 
-# List of SSL/TLS ciphers to allow.
+# List of SSL/TLS ciphers to allow
 #LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC
 
 # Require and verify server certificate
 #LDAP_TLS_CHECK_PEER=1
 
-# Path to CA cert file. Used when server sertificate verify is enabled.
+# Path to CA cert file. Used when server certificate verify is enabled
 #LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt
 
-# Path to CA certs directory. Used when server sertificate verify is enabled.
+# Path to CA certs directory. Used when server certificate verify is enabled
 #LDAP_TLS_CACERT_DIR=/etc/ssl/certs
 
 # Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps://
@@ -143,7 +198,7 @@ DOCKER_HOST_ADDRESS=10.2.3.1
 # Advanced configuration options (you generally don't need to change these)
 #
 
-# Internal XMPP domain.
+# Internal XMPP domain
 XMPP_DOMAIN=meet.jitsi
 
 # Internal XMPP server
@@ -152,18 +207,22 @@ XMPP_SERVER=xmpp.meet.jitsi
 # Internal XMPP server URL
 XMPP_BOSH_URL_BASE=http://xmpp.meet.jitsi:5280
 
-# Internal XMPP domain for authenticated services.
+# Internal XMPP domain for authenticated services
 XMPP_AUTH_DOMAIN=auth.meet.jitsi
 
-# XMPP domain for the MUC.
+# XMPP domain for the MUC
 XMPP_MUC_DOMAIN=muc.meet.jitsi
 
-# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools.
+# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools
 XMPP_INTERNAL_MUC_DOMAIN=internal-muc.meet.jitsi
 
-# XMPP domain for unauthenticated users.
+# XMPP domain for unauthenticated users
 XMPP_GUEST_DOMAIN=guest.meet.jitsi
 
+# Comma separated list of domains for cross domain policy or "true" to allow all
+# The PUBLIC_URL is always allowed
+#XMPP_CROSS_DOMAIN=true
+
 # Custom Prosody modules for XMPP_DOMAIN (comma separated)
 XMPP_MODULES=
 
@@ -173,17 +232,14 @@ XMPP_MUC_MODULES=
 # Custom Prosody modules for internal MUC component (comma separated)
 XMPP_INTERNAL_MUC_MODULES=
 
-# MUC for the JVB pool.
+# MUC for the JVB pool
 JVB_BREWERY_MUC=jvbbrewery
 
-# XMPP user for JVB client connections.
+# XMPP user for JVB client connections
 JVB_AUTH_USER=jvb
 
-# XMPP password for JVB client connections.
-JVB_AUTH_PASSWORD=passw0rd
-
-# STUN servers used to discover the server's public IP.
-JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302
+# STUN servers used to discover the server's public IP
+JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443
 
 # Media port for the Jitsi Videobridge
 JVB_PORT=10000
@@ -191,36 +247,32 @@ JVB_PORT=10000
 # TCP Fallback for Jitsi Videobridge for when UDP isn't available
 JVB_TCP_HARVESTER_DISABLED=true
 JVB_TCP_PORT=4443
+JVB_TCP_MAPPED_PORT=4443
 
-# A comma separated list of APIs to enable when the JVB is started. The default is none.
+# A comma separated list of APIs to enable when the JVB is started [default: none]
 # See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information
 #JVB_ENABLE_APIS=rest,colibri
 
-# XMPP component password for Jicofo.
-JICOFO_COMPONENT_SECRET=s3cr37
-
-# XMPP user for Jicofo client connections. NOTE: this option doesn't currently work due to a bug.
+# XMPP user for Jicofo client connections.
+# NOTE: this option doesn't currently work due to a bug
 JICOFO_AUTH_USER=focus
 
-# XMPP password for Jicofo client connections.
-JICOFO_AUTH_PASSWORD=passw0rd
-
 # Base URL of Jicofo's reservation REST API
 #JICOFO_RESERVATION_REST_BASE_URL=http://reservation.example.com
 
-# XMPP user for Jigasi MUC client connections.
-JIGASI_XMPP_USER=jigasi
+# Enable Jicofo's health check REST API (http://<jicofo_base_url>:8888/about/health)
+#JICOFO_ENABLE_HEALTH_CHECKS=true
 
-# XMPP password for Jigasi MUC client connections.
-JIGASI_XMPP_PASSWORD=passw0rd
+# XMPP user for Jigasi MUC client connections
+JIGASI_XMPP_USER=jigasi
 
-# MUC name for the Jigasi pool.
+# MUC name for the Jigasi pool
 JIGASI_BREWERY_MUC=jigasibrewery
 
-# Minimum port for media used by Jigasi.
+# Minimum port for media used by Jigasi
 JIGASI_PORT_MIN=20000
 
-# Maximum port for media used by Jigasi.
+# Maximum port for media used by Jigasi
 JIGASI_PORT_MAX=20050
 
 # Enable SDES srtp
@@ -235,20 +287,21 @@ JIGASI_PORT_MAX=20050
 # Health-check interval
 #JIGASI_HEALTH_CHECK_INTERVAL=300000
 #
-# Enable Jigasi transcription.
+# Enable Jigasi transcription
 #ENABLE_TRANSCRIPTIONS=1
 
-# Jigasi will recordord an audio when transcriber is on. Default false.
+# Jigasi will record audio when transcriber is on [default: false]
 #JIGASI_TRANSCRIBER_RECORD_AUDIO=true
 
-# Jigasi will send transcribed text to the chat when transcriber is on. Default false.
+# Jigasi will send transcribed text to the chat when transcriber is on [default: false]
 #JIGASI_TRANSCRIBER_SEND_TXT=true
 
-# Jigasi post to the chat an url with transcription file. Default false.
+# Jigasi will post an url to the chat with transcription file [default: false]
 #JIGASI_TRANSCRIBER_ADVERTISE_URL=true
 
 # Credentials for connect to Cloud Google API from Jigasi
-# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol section "Before you begin" from 1 to 5 paragraph.
+# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol
+# section "Before you begin" paragraph 1 to 5
 # Copy the values from the json to the related env vars
 #GC_PROJECT_ID=
 #GC_PRIVATE_KEY_ID=
@@ -263,25 +316,19 @@ JIGASI_PORT_MAX=20050
 # XMPP domain for the jibri recorder
 XMPP_RECORDER_DOMAIN=recorder.meet.jitsi
 
-# XMPP recorder user for Jibri client connections.
+# XMPP recorder user for Jibri client connections
 JIBRI_RECORDER_USER=recorder
 
-# XMPP recorder password for Jibri client connections.
-JIBRI_RECORDER_PASSWORD=passw0rd
-
-# Directory for recordings inside Jibri container.
+# Directory for recordings inside Jibri container
 JIBRI_RECORDING_DIR=/config/recordings
 
-# The finalizing script. Will run after recording is complete.
+# The finalizing script. Will run after recording is complete
 JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh
 
-# XMPP user for Jibri client connections.
+# XMPP user for Jibri client connections
 JIBRI_XMPP_USER=jibri
 
-# XMPP password for Jibri client connections.
-JIBRI_XMPP_PASSWORD=passw0rd
-
-# MUC name for the Jibri pool.
+# MUC name for the Jibri pool
 JIBRI_BREWERY_MUC=jibribrewery
 
 # MUC connection timeout
@@ -294,14 +341,26 @@ JIBRI_PENDING_TIMEOUT=90
 # So if there are any prefixes in the jid (like jitsi meet, which
 # has its participants join a muc at conference.xmpp_domain) then
 # list that prefix here so it can be stripped out to generate
-# the call url correctly.
+# the call url correctly
 JIBRI_STRIP_DOMAIN_JID=muc
 
-# Directory for logs inside Jibri container.
+# Directory for logs inside Jibri container
 JIBRI_LOGS_DIR=/config/logs
 
-# Disable HTTPS. This can be useful if TLS connections are going to be handled outside of this setup.
+# Disable HTTPS: handle TLS connections outside of this setup
 DISABLE_HTTPS=1
 
-# Redirects HTTP traffic to HTTPS. Only works with the standard HTTPS port (443).
+# Redirect HTTP traffic to HTTPS
+# Necessary for Let's Encrypt, relies on standard HTTPS port (443)
 #ENABLE_HTTP_REDIRECT=1
+
+# Enable IPv6
+# Provides means to disable IPv6 in environments that don't support it (get with the times, people!)
+#ENABLE_IPV6=1
+
+# Container restart policy
+# Defaults to unless-stopped
+RESTART_POLICY=unless-stopped
+
+# Authenticate using external service or just focus external auth window if there is one already.
+# TOKEN_AUTH_URL=https://auth.meet.example.com/{room}