Jitsi-meetのソースを表示

[[Category:電話と音声]]
[[en:Jitsi-meet]]
[https://jitsi.org Jitsi] はセキュアなビデオ会議ソリューションを簡単に構築・デプロイすることができるオープンソースプロジェクトのセットです。Jitsi の中心は Jitsi Videobridge と Jitsi Meet で、インターネット上で会議を行うことができます。コミュニティの他のプロジェクトを使うことでオーディオ会議やダイアルイン、録音、サイマルキャストなどの機能を有効化できます。

== インストール ==

{{AUR|jitsi-meet-bin}}, {{AUR|jitsi-videobridge-bin}}, {{AUR|jicofo-bin}} をインストールしてください。

また {{AUR|jitsi-meet-git}}, {{AUR|jitsi-videobridge}}, {{AUR|jicofo-git}} をインストールしてください。

{{Note|{{AUR|jitsi-meet-git}}, {{AUR|jitsi-videobridge}}, {{AUR|jicofo-git}} パッケージの設定パスとサービスは {{AUR|jitsi-meet-bin}}, {{AUR|jitsi-videobridge-bin}}, {{AUR|jicofo-bin}} パッケージで使われているパスとサービスとは異なっています。}}

{{Note|マニュアルインスールガイドは OS に依存しないものになっており、以下のように証明書の信頼だけ変更してください:

 trust anchor /var/lib/prosody/auth.meet.example.com.crt
}}

== 設定 ==

=== git パッケージの設定 ===

If your server name is {{ic|example.com}} then a common choice for your jitsi will be {{ic|meet.example.com}}. You will need to update DNS record for your server with an entry {{ic|meet}}. The remainder assumes that you have done this.

Also you should have SSL/TLS certificates for your {{ic|meet.example.com}} domain, for example see [[certbot]].

The remaining instructions in {{ic|bash}} to make it clear what needs replacing. Pasting the commands into a bash shell with root permissions should give you a working install. 

Replace the domain name with your own:

 export JITSIFQDN=meet.example.com

Specify correct path to generated certificates:

 export JITSIFQDN_CRT=/etc/letsencrypt/live/meet.example.com/fullchain.pem
 export JITSIFQDN_KEY=/etc/letsencrypt/live/meet.example.com/privkey.pem

Passwords are needed. We set up some shell variables to hold them for later use. You can replace {{ic|$(mktemp XXXXXXX)}} with your own passwords if you want, but the random strings generated by {{ic|mktemp}} should be fine.

 export SECRET1=$(mktemp -u XXXXXXXX)
 export SECRET2=$(mktemp -u XXXXXXXX)
 export SECRET3=$(mktemp -u XXXXXXXX)

==== prosody の設定 ====

{{Pkg|prosody}} is a prerequisite and you will need to add a configuration to it for your Jitsi services. If you do not already have a prosody server set up, install {{Pkg|prosody}} and {{Pkg|lua52-sec}} now. The rest of the prosody configuration assumes you have a local install of prosody. 

First make sure there is a subdirectory to hold custom configurations and that prosody loads it:

 mkdir -p /etc/prosody/conf.d
 cat >> /etc/prosody/prosody.cfg.lua <<===
   Include "conf.d/*.cfg.lua"
 ===

Create the prosody config file for your domain:

 cat > /etc/prosody/conf.d/$JITSIFQDN.cfg.lua <<===
 VirtualHost "${JITSIFQDN}"
     authentication = "anonymous"
     ssl = {
         key = "/var/lib/prosody/${JITSIFQDN}.key";
         certificate = "/var/lib/prosody/${JITSIFQDN}.crt";
     }
     modules_enabled = {
         "bosh";
         "pubsub";
     }
     c2s_require_encryption = false
 
 VirtualHost "auth.${JITSIFQDN}"
     ssl = {
         key = "/var/lib/prosody/auth.${JITSIFQDN}.key";
         certificate = "/var/lib/prosody/auth.${JITSIFQDN}.crt";
     }
     authentication = "internal_plain"
     admins = { "focus@auth.${JITSIFQDN}" }
 
 Component "conference.${JITSIFQDN}" "muc"
 
 Component "jitsi-videobridge.${JITSIFQDN}"
     component_secret = "${SECRET1}"
 
 Component "focus.${JITSIFQDN}"
     component_secret = "${SECRET2}"
 ===

Generate the certificates that prosody needs. This is interactive:

 prosodyctl cert generate $JITSIFQDN

 prosodyctl cert generate auth.$JITSIFQDN

Register the focus user:
 
 prosodyctl register focus auth.$JITSIFQDN $SECRET3

Trust the certificate:
 
 trust anchor /var/lib/prosody/auth.$JITSIFQDN.crt

{{ic|prosody}} サービスを[[再起動]]してください。

==== jitsi-videobridge の設定 ====

jitsi-videobridge の設定:

 cat > /etc/jitsi-videobridge/jitsi-videobridge.conf <<===
 flags="--host=localhost --domain=${JITSIFQDN} --port=5347 --secret=${SECRET1}"
 ===

If you want to have logging and sip communicator settings in the same folder you can do the following

 cat >> /etc/jitsi-videobridge/jitsi-videobridge.conf <<===
 VIDEOBRIDGE_DEBUG_OPTIONS="-Djava.util.logging.config.file=/etc/jitsi-videobridge/logging.properties -Dnet.java.sip.communicator.SC_HOME_DIR_NAME=jitsi-videobridge -Dnet.java.sip.communicator.SC_HOME_DIR_LOCATION=/etc 
 ===

 cp /opt/jitsi-videobridge/lib/logging.properties /etc/jitsi-videobridge/logging.properties
 
 cat > /etc/jitsi-videobridge/sip-communicator.properties <<===
 org.jitsi.videobridge.AUTHORIZED_SOURCE_REGEXP=focus@auth.${JITSIFQDN}/.*
 org.jitsi.impl.neomedia.transform.srtp.SRTPCryptoContext.checkReplay=false
 org.jitsi.videobridge.TCP_HARVESTER_PORT=4443
 ===

{{ic|jitsi-videobridge}} サービスを[[起動|起動・有効化]]してください。

==== jicofo の設定 ====

 cat > /etc/jicofo/jicofo.conf <<===
 flags="--host=localhost --domain=${JITSIFQDN} --secret=${SECRET2} --user_domain=auth.${JITSIFQDN} --user_name=focus --user_password=${SECRET3}"
 ===

{{ic|jicofo}} サービスを[[起動|起動・有効化]]してください。

==== jitsi-meet の設定 ====

 cp /opt/jitsi-meet/config.js /opt/jitsi-meet/config.js.orig
 cat > /opt/jitsi-meet/config.js <<===
 var domainroot = "${JITSIFQDN}" 
 var config = { 
        hosts: { 
                domain: domainroot, 
                muc: 'conference.'+domainroot, 
                bridge: 'jitsi-videobridge.'+domainroot,
                focus: 'focus.'+domainroot
        },
        useNicks: false,
        bosh: '//'+domainroot+'/http-bind',
 }
 ===

==== nginx の設定 ====

Here is a minimal nginx configuration supplied that is a simple merge of the recommended HTTPS configuration from https://ssl-config.mozilla.org/#server=nginx&version=1.16.1&config=intermediate&openssl=1.1.1f&guideline=5.4 and the minimal configuration recommended in the Jitsi-meet documentation. While this configuration will work fine, you will want to adapt it to your own server.

 sed -i "/^http.*{/a include /etc/nginx/${JITSIFQDN}.conf;" /etc/nginx/nginx.conf

 #WARNING - The config file text uses bash escapes. If copying for hand editing, each '\$' needs to be replaced with '$'
 #                  and each '${VARIABLE}' needs to be replaced.
 cat > /etc/nginx/${JITSIFQDN}.conf <<===
 # Redirect http to https 
 server { 
     listen 80; 
     listen [::]:80; 
     server_name call.mechadept.nz; 
  
     return 301 https://\$host\$request_uri; 
 } 
  
 # Mozilla intermediate config 
 server { 
     listen 443 ssl http2; 
     listen [::]:443 ssl http2; 
  
     #ssl_certificate /path/to/signed_cert_plus_intermediates; 
     #ssl_certificate_key /path/to/private_key; 
     ssl_session_timeout 1d; 
     ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions 
     ssl_session_tickets off; 
  
     # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam 
 #    ssl_dhparam /path/to/dhparam; 
  
     # intermediate configuration 
     ssl_protocols TLSv1.2 TLSv1.3;
     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
     ssl_prefer_server_ciphers off;
 
     # HSTS (ngx_http_headers_module is required) (63072000 seconds)
     add_header Strict-Transport-Security "max-age=63072000" always;
 #} #Merge mozilla config with jitsi recommended one
 
     ssl_certificate /etc/letsencrypt/live/${JITSIFQDN}/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/${JITSIFQDN}/privkey.pem;
 
     error_page 404 /static/404.html;
 
 # Jitsi recommended settings below
 
 #server {
 #    listen 80;
 
     server_name ${JITSIFQDN};
     # set the root
     root /opt/jitsi-meet;
     index index.html;
 
     location ~ ^/([a-zA-Z0-9=\?]+)\$ {
         rewrite ^/(.*)\$ / break;
         }
 
     location / {
         ssi on;
     }
 
     # BOSH
     location /http-bind {
         proxy_pass      http://localhost:5280/http-bind;
         proxy_set_header X-Forwarded-For \$remote_addr;
         proxy_set_header Host \$http_host;
     }
 
     # xmpp websockets
     location /xmpp-websocket {
         proxy_pass http://localhost:5280/xmpp-websocket;
         proxy_http_version 1.1;
         proxy_set_header Upgrade \$http_upgrade;
         proxy_set_header Connection "upgrade";
         proxy_set_header Host \$host;
         tcp_nodelay on;
     }
 }
 === 

それから {{ic|nginx}} サービスを[[再起動]]してください。

== ヒントとテクニック ==

=== NAT 経由で実行 ===

以下のポートをサーバーに転送する必要があります:

HTTPS:

*TCP/443

Jitsi Videobridge:

*TCP/4443
*UDP/10000

== 参照 ==

*[https://haste.rys.pw/uzisosiram.bash Notes by C0rn3j]
*[https://gitlab.com/C0rn3j/configs/-/tree/master/ansible/serverPlaybooks/roles/meet/files Configurations used in the article]