systemli / ansible-role-jitsi-meet

Ansible role to install & configure Jitsi Meet

Ansible role to install and configure Jitsi Meet

This role installs and configure Jitsi Meet with nginx Webserver and prosody as XMPP Server.

It is maintained with Debian Buster in mind, but should also work with its derivatives like Ubuntu 20.04.

Role Variables

You need to set the jitsi_meet_base_secret variable from which passwords for the various internally used accounts are created.

See defaults/main.yml for further available variables.

Dependencies

• systemli.apt_repositories

Download

Download latest release with ansible-galaxy

ansible-galaxy install systemli.jitsi_meet

Example Playbook

- hosts: jitsimeetservers
  roles:
     - { role: systemli.letsencrypt }
     - { role: systemli.jitsi_meet }
  vars:
    jitsi_meet_server_name: "meet.example.com"
    letsencrypt_cert:
      name: "{{ jitsi_meet_server_name }}"
      domains:
        - "{{ jitsi_meet_server_name }}"
      challenge: dns

Caveats

A change of the jitsi_meet_server_name variable applied on an already deployed instance is going to break the configuration.

Tests

We do integration tests with GitHub Actions and Molecule.

Locally, you can easily test the role with

pip install molecule-vagrant ansible-lint yamllint
molecule test

This requires Vagrant to be installed.

Debugging

For local debugging you can run the following commands:

molecule create
molecule converge

This will spin up an instance which is reachable via https://localhost:8443/.

Remove Jitsi

sudo apt purge jigasi jitsi-meet jitsi-meet-web-config jitsi-meet-prosody jitsi-meet-turnserver jitsi-meet-web jicofo jitsi-videobridge2 nginx* jitsi* prosody lua5.2
sudo apt autoremove --purge
sudo rm -r /etc/jitsi/ /usr/share/jitsi-meet/ /usr/share/jitsi-videobridge/ /etc/prosody/ /var/lib/prosody/ /etc/apt/sources.list.d/download_jitsi_org.sources /etc/apt/sources.list.d/packages.prosody.im.sources /etc/apt/preferences.d/download_jitsi_org.pref /etc/apt/preferences.d/packages.prosody.im.pref

License

GPLv3

Author Information

https://www.systemli.org

ansible-role-jitsi-meet's Issues

prosody fails when jitsi_meet_jicofo_password changes

When the variable jitsi_meet_jicofo_password is changed, the jicofo config is correctly updated, but prosody still uses the old password for focus. This command needs to be re-run:

prosodyctl register focus auth.{{ jitsi_meet_server_name }} {{ jitsi_meet_jicofo_password }}

Doing so will update the focus.dat file.

Scale across multiple videobridges

I forked your role, making it possible to scale across multiple videobridges (with optional octo), while defaulting to a single instance setup.

The branch is a little bit mixed together with other features, but you can get a general impression here:
https://github.com/technischerpunkt/ansible-role-jitsi-meet/tree/seperate-videobridge

I'm currently using this branch to deploy both a single instance setup and a scalable setup. Meaning it is backwards compatible, as long as one did not change the name of the role.

If you are at all interested in changing your role to support multiple bridges, i could do a clean PR. Disclaimer: I never used molecule tests before, so i'd probably need some help on those.

Would love to see this upstreamed!

Package updates override custom web assets

i observed that a custom watermark image was overwritten by a package update. also debsums complains about changed this and a changed interface_config.js and title.html. these are probably caused by a lack of facilitation on the upstream side. but maybe there is an elegant way around one or the other.

Missing GPG package

This is great! Thanks so much!

This mostly works out of the box! The exception is that the GPG package is missing.

TASK [systemli.jitsi_meet : Enable prosody] ******************************************
ok: [64.227.17.188]

TASK [systemli.jitsi_meet : Fetch signing key for Jitsi repository] ******************
fatal: [64.227.17.188]: FAILED! => {"changed": false, "msg": "Failed to find required executable gpg in paths: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}

I'm running Debian 10.3 x64 on a Digitial Ocean Droplet.

apt install gpg manually fixed it

Add APT Pinning for Third Party Repository

We should follow the Debian Guideline for using third party repository and add a standard pinning for the jitsi meet repository. See the explanation here: https://wiki.debian.org/DebianRepository/UseThirdParty

Allow to log everything to syslog

• Java
• Prosody
• nginx

jitsi_meet_turn_secret

kipping: [node03] => {"changed": false, "skip_reason": "Conditional result was False"}

TASK [systemli.jitsi_meet : Set debconf options for jitsi-meet] **************************************************************************************************************
fatal: [node03]: FAILED! => {"msg": "'jitsi_meet_turn_secret' is undefined"}

PLAY RECAP *******************************************************************************************************************************************************************
node03 : ok=30 changed=8 unreachable=0 failed=1 skipped=23 rescued=0 ignored=0

Allow templates to be overridden

Looking into the different ansible roles for installing jitsi-meet, yours seems to be the best kept. But by having fixed templates in your role, some settings can't be changed (like enabling authentication) because the prosody.cfg.j2 file contains:

VirtualHost "{{ jitsi_meet_server_name }}"
	authentication = "anonymous"

Since this role contains many templates (because the jitsi-meet package installes multiple things together - maybe a few too many) it could be more flexible with regard to the template path.

In order to override templates, your role only needs to change the task with the template module:

- name: Copy additional prosody config
  template:
    src: prosody.cfg.j2

- name: Copy additional prosody config
  template:
    src: {{ some_template_path | default() }}prosody.cfg.j2

The some_template_path variable does not even have to exist, so it costs next to nothing, but it allows maximum flexibility downstream. It also saves you from having to keep up with every new release of jitsi-meet options as they come out (but are missing in your template).

I had to look it up myself, but I wrote about this a while back.

Do you think this is something you would incorporate?

Install coturn to remove dependency on Google's STUN servers

https://0xacab.org/mdik/ansible-coturn or something similar could be added as a dependency, or copypasted into this role, as it is not very complex?

Can't handle logs of jvb properly

Currently, there are 24 logs for each hour of one day.
The logs grow quite quickly, so we cant't adjust them to jitsi_meet_logrotate_retained_days

I think we would want

# cat /etc/logrotate.d/jitsi-videobridge
hourly
size 100M
rotate {{ jitsi_meet_logrotate_retained_days|int*7 }}

but it's just to big right now.

Migrate away from ALPN multiplexing

# Multiplexing based on ALPN is DEPRECATED. ALPN does not play well with websockets on some browsers and reverse proxies.
# To migrate away from using it read: https://jitsi.org/multiplexing-to-bridge-ws-howto
# This file will be removed at some point and if deployment is still using it, will break.

https://github.com/jitsi/jitsi-meet/blob/master/doc/debian/jitsi-meet/jitsi-meet.conf

nginx fails when jitsi_meet_server_name was changed

changing jitsi_meet_server_name leads to the situation that there are two website configurations in /etc/nginx/sites-enabled. thus the server_names_hash_bucket_size directive is declared twice and nginx will fail to start.

this could either be fixed by allowing just one site configuration or by factoring that out to an extra configuration file. what would you prefer?

Option to enable XMPP Websockets

Jitsi Meet provide an option to use XMPP Websockets instead of http polling over XMPP BOSH. Would be nice to add the ability to configure it.