Added config files for jitsi installation (does not work yet)

jitsi.yml

@@ -0,0 +1,11 @@
+---
+- name: Set up Jitsi
+  hosts: vps
+  vars_files:
+    - general_vars.yml
+    - jitsi_vars.yml
+  remote_user: "{{ ssh_user }}"
+  become: yes
+  become_user: root
+  roles:
+    - jitsi

jitsi_vars.yml.example

@@ -0,0 +1,27 @@
+---
+jitsi_domain: "jitsi.example.com"
+timezone: "Europe/Berlin"
+log_level: "info"
+docker_host_address: ""
+enable_auth: 0
+auth_type: "internal"
+enable_guests: 0
+enable_recording: 0
+xmpp_domain: "meet.jitsi"
+xmpp_auth_domain: "auth.meet.jitsi"
+xmpp_server: "xmpp.meet.jitsi"
+xmpp_guest_domain: "guest.meet.jitsi"
+xmpp_muc_domain: "muc.meet.jitsi"
+xmpp_internal_muc_domain: "internal-muc.meet.jitsi"
+xmpp_recorder_domain: "recorder.meet.jitsi"
+jicofo_auth_user: "focus"
+jicofo_auth_password: ""
+jicofo_component_secret: ""
+jvb_auth_user: "jvb"
+jvb_auth_password: ""
+jibri_xmpp_user: "jibri"
+jibri_xmpp_password: ""
+jibri_recorder_user: "recorder"
+jibri_recorder_password: ""
+jigasi_xmpp_user: "jigasi"
+jigasi_xmpp_password: ""

roles/jitsi/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: restart jitsi
+  service:
+    name: jitsi
+    state: restarted
+- name: restart prosody
+  service:
+    name: prosody
+    state: restarted

roles/jitsi/meta/main.yml

@@ -0,0 +1,5 @@
+---
+dependencies:
+  - role: docker
+  - role: apache
+  - role: letsencrypt

roles/jitsi/tasks/apache.yml

@@ -0,0 +1,38 @@
+---
+- name: add jitsi http site
+  template:
+    src: etc/apache2/sites-available/ansible_domain.conf.j2
+    dest: /etc/apache2/sites-available/{{ jitsi_domain}}.conf
+    owner: root
+    group: root
+    mode: 0644
+    force: no
+  register: drone_http
+- name: disable default site and enable jitsi site
+  block:
+    - name: disable default site
+      command:
+        cmd: a2dissite 000-default.conf
+        removes: /etc/apache2/sites-enabled/000-default.conf
+    - name: enable jitsi site
+      command:
+        cmd: a2ensite {{ jitsi_domain }}.conf
+        creates: /etc/apache2/sites-enabled/{{ jitsi_domain }}.conf
+- name: run certbot
+  command:
+    cmd: certbot --apache --non-interactive --keep-until-expiring --no-eff-email --email {{ admin_mail }} --redirect --renew-with-new-domains --agree-tos -d {{ jitsi_domain }}
+  when: ansible_domain != 'dev' and drone_http.changed
+- include: ssl-dev.yml
+  when: ansible_domain == 'dev'
+- name: add jitsi https site
+  template:
+    src: etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2
+    dest: /etc/apache2/sites-available/{{ jitsi_domain }}-le-ssl.conf
+    owner: root
+    group: root
+    mode: 0644
+- name: enable jitsi https site
+  command:
+    cmd: a2ensite {{ jitsi_domain }}-le-ssl.conf
+    creates: /etc/apache2/sites-enabled/{{ jitsi_domain }}-le-ssl.conf
+  notify: restart apache

roles/jitsi/tasks/jitsi.yml

@@ -0,0 +1,22 @@
+---
+- name: create jitsi directory
+  file:
+    state: directory
+    path: /etc/jitsi
+- name: create shared secret
+  command:
+    cmd: openssl rand -hex 16
+  register: jitsi_rpc_secret
+  run_once: true
+- set_fact:
+    jitsi_rpc_secret: "{{ jitsi_rpc_secret.stdout }}"
+- name: copy docker compose file for jitsi
+  template:
+    src: etc/jitsi/docker-compose.yml.j2
+    dest: /etc/jitsi/docker-compose.yml
+    owner: root
+    group: root
+    mode: 0644
+- name: start jitsi docker containers
+  docker_compose:
+    project_src: /etc/jitsi

roles/jitsi/tasks/main.yml

@@ -0,0 +1,3 @@
+---
+- include: apache.yml
+- include: jitsi.yml

roles/jitsi/tasks/ssl-dev.yml

@@ -0,0 +1,27 @@
+---
+- name: Ensure python OpenSSL dependencies are installed.
+  pip:
+    name: pyOpenSSL
+    state: present
+
+- name: Ensure directory exists for local self-signed TLS certs.
+  file:
+    path: /etc/letsencrypt/live/{{ jitsi_domain }}
+    state: directory
+
+- name: Generate an OpenSSL private key.
+  openssl_privatekey:
+    path: /etc/letsencrypt/live/{{ jitsi_domain }}/privkey.pem
+
+- name: Generate an OpenSSL CSR.
+  openssl_csr:
+    path: /etc/ssl/private/{{ jitsi_domain }}.csr
+    privatekey_path: /etc/letsencrypt/live/{{ jitsi_domain }}/privkey.pem
+    common_name: "{{ jitsi_domain }}"
+
+- name: Generate a Self Signed OpenSSL certificate.
+  openssl_certificate:
+    path: /etc/letsencrypt/live/{{ jitsi_domain }}/fullchain.pem
+    privatekey_path: /etc/letsencrypt/live/{{ jitsi_domain }}/privkey.pem
+    csr_path: /etc/ssl/private/{{ jitsi_domain }}.csr
+    provider: selfsigned

roles/jitsi/templates/etc/apache2/sites-available/ansible_domain-le-ssl.conf.j2

@@ -0,0 +1,29 @@
+<IfModule mod_ssl.c>
+<VirtualHost *:443>
+  ServerName {{ jitsi_domain }}
+  ServerAdmin {{ admin_mail }}
+  ErrorLog ${APACHE_LOG_DIR}/error.log
+  CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+  SSLCertificateFile /etc/letsencrypt/live/{{ jitsi_domain }}/fullchain.pem
+  SSLCertificateKeyFile /etc/letsencrypt/live/{{ jitsi_domain }}/privkey.pem
+  Include /etc/letsencrypt/options-ssl-apache.conf
+
+  # Encoded slashes need to be allowed
+  AllowEncodedSlashes NoDecode
+
+  # keep the host
+  ProxyPreserveHost On
+  SSLProxyEngine On
+  SSLProxyVerify none
+  SSLProxyCheckPeerCN off
+  SSLProxyCheckPeerName off
+  SSLProxyCheckPeerExpire off
+
+  RequestHeader set X-Forwarded-Proto "https"
+  RequestHeader set X-Forwarded-Host "{{ jitsi_domain }}"
+  ProxyPass / https://127.0.0.1:8003/
+  ProxyPassReverse / https://127.0.0.1:8003/
+
+</VirtualHost>
+</IfModule>

roles/jitsi/templates/etc/apache2/sites-available/ansible_domain.conf.j2

@@ -0,0 +1,6 @@
+<VirtualHost *:80>
+  ServerName {{ jitsi_domain }}
+  ServerAdmin {{ admin_mail }}
+  ErrorLog ${APACHE_LOG_DIR}/error.log
+  CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>

roles/jitsi/templates/etc/jitsi/docker-compose.yml.j2

@@ -0,0 +1,135 @@
+version: '2'
+
+services:
+  # Frontend
+  jitsi:
+    image: jitsi/web
+    ports:
+      - "8002:80"
+      - "8003:443"
+    restart: always
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /etc/jitsi/web:/config
+      - /etc/jitsi/transcripts:/usr/share/jitsi-meet/transcripts
+    environment:
+      - ENABLE_AUTH={{ enable_auth }}
+      - ENABLE_GUESTS={{ enable_guests }}
+      - ENABLE_TRANSCRIPTIONS=0
+      - PUBLIC_URL={{ jitsi_domain }}
+      - TZ={{ timezone }}
+      - ENABLE_RECORDING={{ enable_recording }}
+      - DISABLE_HTTPS=0
+      - JICOFO_AUTH_USER={{ jicofo_auth_user }}
+      - XMPP_DOMAIN={{ xmpp_domain }}
+      - XMPP_AUTH_DOMAIN={{ xmpp_auth_domain }}
+      - XMPP_BOSH_URL_BASE=http://{{ xmpp_domain }}:5280
+      - XMPP_GUEST_DOMAIN={{ xmpp_guest_domain }}
+      - XMPP_MUC_DOMAIN={{ xmpp_muc_domain }}
+      - XMPP_RECORDER_DOMAIN{{ xmpp_recorder_domain }}
+      - JIBRI_BREWERY_MUC=jibribrewery
+      - JIBRI_PENDING_TIMEOUT=90
+      - JIBRI_XMPP_USER={{ jibri_xmpp_user }}
+      - JIBRI_XMPP_PASSWORD={{ jibri_xmpp_password }}
+      - JIBRI_RECORDER_USER=recorder
+      - JIBRI_RECORDER_PASSWORD={{ jibri_recorder_password }}
+    networks:
+      meet.jitsi:
+        aliases:
+          - {{ xmpp_domain }}
+
+  # XMPP server
+  prosody:
+    image: jitsi/prosody
+    expose:
+      - '5222'
+      - '5347'
+      - '5280'
+    restart: always
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /etc/jitsi/prosody:/config
+    environment:
+      - AUTH_TYPE={{ auth_type }}
+      - ENABLE_AUTH={{ enable_auth }}
+      - ENABLE_GUESTS={{ enable_guests }}
+      - XMPP_DOMAIN={{ xmpp_domain }}
+      - XMPP_AUTH_DOMAIN={{ xmpp_auth_domain }}
+      - XMPP_GUEST_DOMAIN={{ xmpp_guest_domain }}
+      - XMPP_MUC_DOMAIN={{ xmpp_muc_domain }}
+      - XMPP_INTERNAL_MUC_DOMAIN={{ xmpp_internal_muc_domain }}
+      - XMPP_RECORDER_DOMAIN={{ xmpp_recorder_domain }}
+      - JICOFO_COMPONENT_SECRET={{ jicofo_component_secret }}
+      - JICOFO_AUTH_USER={{ jicofo_auth_user }}
+      - JICOFO_AUTH_PASSWORD={{ jicofo_auth_password }}
+      - JVB_AUTH_USER={{ jvb_auth_user }}
+      - JVB_AUTH_PASSWORD={{ jvb_auth_password }}
+      - JIGASI_XMPP_USER={{ jigasi_xmpp_user }}
+      - JIGASI_XMPP_PASSWORD={{ jigasi_xmpp_password }}
+      - JIBRI_XMPP_USER={{ jibri_xmpp_user }}
+      - JIBRI_XMPP_PASSWORD={{ jibri_xmpp_password }}
+      - JIBRI_RECORDER_USER={{ jibri_recorder_user }}
+      - JIBRI_RECORDER_PASSWORD={{ jibri_recorder_password }}
+      - LOG_LEVEL={{ log_level }}
+      - TZ={{ timezone }}
+    networks:
+      meet.jitsi:
+        aliases:
+          - {{ xmpp_server }}
+
+  # Focus component
+  jicofo:
+    image: jitsi/jicofo
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /etc/jitsi/jicofo:/config
+    restart: always
+    environment:
+      - ENABLE_AUTH={{ enable_auth }}
+      - XMPP_DOMAIN={{ xmpp_domain }}
+      - XMPP_AUTH_DOMAIN={{ xmpp_auth_domain }}
+      - XMPP_INTERNAL_MUC_DOMAIN={{ xmpp_internal_muc_domain }}
+      - XMPP_SERVER={{ xmpp_server }}
+      - JICOFO_COMPONENT_SECRET={{ jicofo_component_secret }}
+      - JICOFO_AUTH_USER={{ jicofo_auth_user }}
+      - JICOFO_AUTH_PASSWORD={{ jicofo_auth_password }}
+      - JVB_BREWERY_MUC=jvbbrewery
+      - JIGASI_BREWERY_MUC=jigasibrewery
+      - JIBRI_BREWERY_MUC=jibribrewery
+      - JIBRI_PENDING_TIMEOUT=90
+      - TZ={{ timezone }}
+    depends_on:
+      - prosody
+    networks:
+      meet.jitsi:
+
+  # Video bridge
+  jvb:
+    image: jitsi/jvb
+    ports:
+      - '10000:10000/udp'
+      - '4443:4443'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /etc/jitsi/jvb:/config
+    environment:
+      - XMPP_AUTH_DOMAIN={{ xmpp_auth_domain }}
+      - XMPP_INTERNAL_MUC_DOMAIN={{ xmpp_internal_muc_domain }}
+      - XMPP_SERVER={{ xmpp_server }}
+      - JVB_AUTH_USER={{ jvb_auth_user }}
+      - JVB_AUTH_PASSWORD={{ jvb_auth_password }}
+      - JVB_BREWERY_MUC=jvbbrewery
+      - JVB_PORT=10000
+      - JVB_TCP_HARVESTER_DISABLED=true
+      - JVB_TCP_PORT=4443
+      - JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302
+      - TZ={{ timezone }}
+      - DOCKER_HOST_ADDRESS={{ docker_host_address }}
+    depends_on:
+      - prosody
+    networks:
+      meet.jitsi:
+
+# Custom network so all services can communicate using a FQDN
+networks:
+  meet.jitsi: