From 02cf8a0a8f048653912efdf1a1c8cc1b1b043dd2 Mon Sep 17 00:00:00 2001 From: Kevin Langhans Date: Sat, 12 Sep 2026 14:25:09 +0200 Subject: [PATCH] feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) (#17132) Adds five optional var_jitsi_* settings to the install script. All default to empty, which keeps the previous LAN-only behaviour (container IP, self-signed certificate): - var_jitsi_domain public hostname instead of the container IP - var_jitsi_le_email Let's Encrypt via the packaged debconf option - var_jitsi_public_ip static NAT mapping in jvb.conf (JVB 2.3+) - var_jitsi_admin_user secure domain: only authenticated users create rooms - var_jitsi_admin_pass password for that user (generated when empty) Tested on Proxmox VE 9.2 as unprivileged Debian 13 LXC, both with all variables set (self-signed) and with none set. Co-authored-by: klanghans <13657862+klanghans@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 --- ct/jitsi-meet.sh | 13 +++++- install/jitsi-meet-install.sh | 88 ++++++++++++++++++++++++++++++++++- 2 files changed, 98 insertions(+), 3 deletions(-) diff --git a/ct/jitsi-meet.sh b/ct/jitsi-meet.sh index 18054c9f5..7468c5f13 100644 --- a/ct/jitsi-meet.sh +++ b/ct/jitsi-meet.sh @@ -17,6 +17,14 @@ var_version="${var_version:-13}" var_arm64="${var_arm64:-yes}" var_unprivileged="${var_unprivileged:-1}" +# Optional public setup, read by the install script (all empty = LAN-only install as before). +# Without the export they never reach the container. +export var_jitsi_domain="${var_jitsi_domain:-}" +export var_jitsi_le_email="${var_jitsi_le_email:-}" +export var_jitsi_public_ip="${var_jitsi_public_ip:-}" +export var_jitsi_admin_user="${var_jitsi_admin_user:-}" +export var_jitsi_admin_pass="${var_jitsi_admin_pass:-}" + header_info "$APP" variables color @@ -50,4 +58,7 @@ description msg_ok "Completed Successfully!\n" echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}" echo -e "${INFO}${YW}Access it using the following URL:${CL}" -echo -e "${GATEWAY}${BGN}https://${IP}${CL}" +echo -e "${GATEWAY}${BGN}https://${var_jitsi_domain:-$IP}${CL}" +if [[ -n "${var_jitsi_domain}" ]]; then + echo -e "${INFO}${YW}Forward TCP 80/443 and UDP 10000 to the container. Secure-domain credentials (if enabled) are in ~/jitsi-meet.creds inside the container.${CL}" +fi diff --git a/install/jitsi-meet-install.sh b/install/jitsi-meet-install.sh index 4d24339d6..a9e2c3fcf 100644 --- a/install/jitsi-meet-install.sh +++ b/install/jitsi-meet-install.sh @@ -13,6 +13,29 @@ setting_up_container network_check update_os +# Optional public setup. Leave the hostname empty for a LAN-only install +# (container IP, self-signed certificate) - the previous default behaviour. +if [[ -z "${var_jitsi_domain:-}" ]]; then + read -rp "${TAB3}Public hostname (FQDN, leave empty to use the container IP): " var_jitsi_domain || true +fi +var_jitsi_domain="${var_jitsi_domain:-$LOCAL_IP}" + +if [[ "$var_jitsi_domain" != "$LOCAL_IP" ]]; then + if [[ -z "${var_jitsi_le_email:-}" ]]; then + read -rp "${TAB3}E-mail for Let's Encrypt (leave empty for a self-signed certificate): " var_jitsi_le_email || true + fi + if [[ -z "${var_jitsi_public_ip:-}" ]]; then + read -rp "${TAB3}Public IP behind NAT (leave empty to detect via STUN): " var_jitsi_public_ip || true + fi + if [[ -z "${var_jitsi_admin_user:-}" ]]; then + read -rp "${TAB3}Admin user for secure domain (leave empty to let anyone create rooms): " var_jitsi_admin_user || true + fi + if [[ -n "${var_jitsi_admin_user:-}" && -z "${var_jitsi_admin_pass:-}" ]]; then + read -rsp "${TAB3}Admin password (leave empty to generate): " var_jitsi_admin_pass || true + echo + fi +fi + msg_info "Installing Dependencies" $STD apt install -y nginx msg_ok "Installed Dependencies" @@ -25,11 +48,72 @@ setup_deb822_repo "jitsi" \ "" msg_info "Installing Jitsi Meet" -echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${LOCAL_IP}" | debconf-set-selections -echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections +echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${var_jitsi_domain}" | debconf-set-selections +if [[ -n "${var_jitsi_le_email:-}" ]]; then + # acme.sh (used by the packaged Let's Encrypt helper) refuses to install without cron + $STD apt install -y cron + echo "jitsi-meet-web-config jitsi-meet/cert-choice select Let's Encrypt certificates" | debconf-set-selections + echo "jitsi-meet-web-config jitsi-meet/email string ${var_jitsi_le_email}" | debconf-set-selections +else + echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections +fi +echo "jitsi-meet-web-config jitsi-meet/jaas-choice boolean false" | debconf-set-selections DEBIAN_FRONTEND=noninteractive $STD apt install -y jitsi-meet msg_ok "Installed Jitsi Meet" +if [[ -n "${var_jitsi_public_ip:-}" ]]; then + msg_info "Configuring NAT mapping" + # JVB 2.3+ reads this from jvb.conf; sip-communicator.properties is no longer used + cat <>/etc/jitsi/videobridge/jvb.conf +ice4j { + harvest { + mapping { + static-mappings = [ + { local-address = "${LOCAL_IP}", public-address = "${var_jitsi_public_ip}" } + ] + } + } +} +EOF + systemctl restart jitsi-videobridge2 + msg_ok "Configured NAT mapping" +fi + +if [[ -n "${var_jitsi_admin_user:-}" ]]; then + msg_info "Configuring Secure Domain" + # Only authenticated users may create rooms; guests join via the anonymous domain. + # https://jitsi.github.io/handbook/docs/devops-guide/secure-domain/ + var_jitsi_admin_pass="${var_jitsi_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)}" + sed -i "0,/authentication = \"jitsi-anonymous\"/s//authentication = \"internal_hashed\"/" \ + "/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua" + cat <>"/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua" + +VirtualHost "guest.${var_jitsi_domain}" + authentication = "anonymous" + c2s_require_encryption = false +EOF + cat <>/etc/jitsi/jicofo/jicofo.conf +jicofo { + authentication { + enabled = true + type = XMPP + login-url = "${var_jitsi_domain}" + } +} +EOF + sed -i "s|^\s*// anonymousdomain: 'guest.example.com',| anonymousdomain: 'guest.${var_jitsi_domain}',|" \ + "/etc/jitsi/meet/${var_jitsi_domain}-config.js" + $STD prosodyctl register "${var_jitsi_admin_user}" "${var_jitsi_domain}" "${var_jitsi_admin_pass}" + cat <~/jitsi-meet.creds +Jitsi Meet Secure Domain +Admin User: ${var_jitsi_admin_user} +Admin Password: ${var_jitsi_admin_pass} +Add more users: prosodyctl register ${var_jitsi_domain} +EOF + systemctl restart prosody jicofo jitsi-videobridge2 + msg_ok "Configured Secure Domain" +fi + motd_ssh customize cleanup_lxc