Jitsi-meet

Jitsi はセキュアなビデオ会議ソリューションを簡単に構築・デプロイすることができるオープンソースプロジェクトのセットです。Jitsi の中心は Jitsi Videobridge と Jitsi Meet で、インターネット上で会議を行うことができます。コミュニティの他のプロジェクトを使うことでオーディオ会議やダイアルイン、録音、サイマルキャストなどの機能を有効化できます。

インストール

jitsi-meet-bin^AUR, jitsi-videobridge-bin^AUR, jicofo-bin^AUR をインストールしてください。

また jitsi-meet-git^AUR, jitsi-videobridge^AUR, jicofo-git^AUR をインストールしてください。

ノート: jitsi-meet-git^AUR, jitsi-videobridge^AUR, jicofo-git^AUR パッケージの設定パスとサービスは jitsi-meet-bin^AUR, jitsi-videobridge-bin^AUR, jicofo-bin^AUR パッケージで使われているパスとサービスとは異なっています。

ノート: マニュアルインスールガイドは OS に依存しないものになっており、以下のように証明書の信頼だけ変更してください:

trust anchor /var/lib/prosody/auth.meet.example.com.crt

設定

git パッケージの設定

If your server name is example.com then a common choice for your jitsi will be meet.example.com. You will need to update DNS record for your server with an entry meet. The remainder assumes that you have done this.

Also you should have SSL/TLS certificates for your meet.example.com domain, for example see certbot.

The remaining instructions in bash to make it clear what needs replacing. Pasting the commands into a bash shell with root permissions should give you a working install.

Replace the domain name with your own:

export JITSIFQDN=meet.example.com

Specify correct path to generated certificates:

export JITSIFQDN_CRT=/etc/letsencrypt/live/meet.example.com/fullchain.pem
export JITSIFQDN_KEY=/etc/letsencrypt/live/meet.example.com/privkey.pem

Passwords are needed. We set up some shell variables to hold them for later use. You can replace $(mktemp XXXXXXX) with your own passwords if you want, but the random strings generated by mktemp should be fine.

export SECRET1=$(mktemp -u XXXXXXXX)
export SECRET2=$(mktemp -u XXXXXXXX)
export SECRET3=$(mktemp -u XXXXXXXX)

prosody の設定

prosody is a prerequisite and you will need to add a configuration to it for your Jitsi services. If you do not already have a prosody server set up, install prosody and lua52-sec now. The rest of the prosody configuration assumes you have a local install of prosody.

First make sure there is a subdirectory to hold custom configurations and that prosody loads it:

mkdir -p /etc/prosody/conf.d
cat >> /etc/prosody/prosody.cfg.lua <<===
  Include "conf.d/*.cfg.lua"
===

Create the prosody config file for your domain:

cat > /etc/prosody/conf.d/$JITSIFQDN.cfg.lua <<===
VirtualHost "${JITSIFQDN}"
    authentication = "anonymous"
    ssl = {
        key = "/var/lib/prosody/${JITSIFQDN}.key";
        certificate = "/var/lib/prosody/${JITSIFQDN}.crt";
    }
    modules_enabled = {
        "bosh";
        "pubsub";
    }
    c2s_require_encryption = false

VirtualHost "auth.${JITSIFQDN}"
    ssl = {
        key = "/var/lib/prosody/auth.${JITSIFQDN}.key";
        certificate = "/var/lib/prosody/auth.${JITSIFQDN}.crt";
    }
    authentication = "internal_plain"
    admins = { "focus@auth.${JITSIFQDN}" }

Component "conference.${JITSIFQDN}" "muc"

Component "jitsi-videobridge.${JITSIFQDN}"
    component_secret = "${SECRET1}"

Component "focus.${JITSIFQDN}"
    component_secret = "${SECRET2}"
===

Generate the certificates that prosody needs. This is interactive:

prosodyctl cert generate $JITSIFQDN

prosodyctl cert generate auth.$JITSIFQDN

Register the focus user:

prosodyctl register focus auth.$JITSIFQDN $SECRET3

Trust the certificate:

trust anchor /var/lib/prosody/auth.$JITSIFQDN.crt

prosody サービスを再起動してください。

jitsi-videobridge の設定

jitsi-videobridge の設定:

cat > /etc/jitsi-videobridge/jitsi-videobridge.conf <<===
flags="--host=localhost --domain=${JITSIFQDN} --port=5347 --secret=${SECRET1}"
===

If you want to have logging and sip communicator settings in the same folder you can do the following

cat >> /etc/jitsi-videobridge/jitsi-videobridge.conf <<===
VIDEOBRIDGE_DEBUG_OPTIONS="-Djava.util.logging.config.file=/etc/jitsi-videobridge/logging.properties -Dnet.java.sip.communicator.SC_HOME_DIR_NAME=jitsi-videobridge -Dnet.java.sip.communicator.SC_HOME_DIR_LOCATION=/etc 
===

cp /opt/jitsi-videobridge/lib/logging.properties /etc/jitsi-videobridge/logging.properties

cat > /etc/jitsi-videobridge/sip-communicator.properties <<===
org.jitsi.videobridge.AUTHORIZED_SOURCE_REGEXP=focus@auth.${JITSIFQDN}/.*
org.jitsi.impl.neomedia.transform.srtp.SRTPCryptoContext.checkReplay=false
org.jitsi.videobridge.TCP_HARVESTER_PORT=4443
===

jitsi-videobridge サービスを起動・有効化してください。

jicofo の設定

cat > /etc/jicofo/jicofo.conf <<===
flags="--host=localhost --domain=${JITSIFQDN} --secret=${SECRET2} --user_domain=auth.${JITSIFQDN} --user_name=focus --user_password=${SECRET3}"
===

jicofo サービスを起動・有効化してください。

jitsi-meet の設定

cp /opt/jitsi-meet/config.js /opt/jitsi-meet/config.js.orig
cat > /opt/jitsi-meet/config.js <<===
var domainroot = "${JITSIFQDN}" 
var config = { 
       hosts: { 
               domain: domainroot, 
               muc: 'conference.'+domainroot, 
               bridge: 'jitsi-videobridge.'+domainroot,
               focus: 'focus.'+domainroot
       },
       useNicks: false,
       bosh: '//'+domainroot+'/http-bind',
}
===

nginx の設定

Here is a minimal nginx configuration supplied that is a simple merge of the recommended HTTPS configuration from https://ssl-config.mozilla.org/#server=nginx&version=1.16.1&config=intermediate&openssl=1.1.1f&guideline=5.4 and the minimal configuration recommended in the Jitsi-meet documentation. While this configuration will work fine, you will want to adapt it to your own server.

sed -i "/^http.*{/a include /etc/nginx/${JITSIFQDN}.conf;" /etc/nginx/nginx.conf

#WARNING - The config file text uses bash escapes. If copying for hand editing, each '\$' needs to be replaced with '$'
#                  and each '${VARIABLE}' needs to be replaced.
cat > /etc/nginx/${JITSIFQDN}.conf <<===
# Redirect http to https 
server { 
    listen 80; 
    listen [::]:80; 
    server_name call.mechadept.nz; 
 
    return 301 https://\$host\$request_uri; 
} 
 
# Mozilla intermediate config 
server { 
    listen 443 ssl http2; 
    listen [::]:443 ssl http2; 
 
    #ssl_certificate /path/to/signed_cert_plus_intermediates; 
    #ssl_certificate_key /path/to/private_key; 
    ssl_session_timeout 1d; 
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions 
    ssl_session_tickets off; 
 
    # curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam 
#    ssl_dhparam /path/to/dhparam; 
 
    # intermediate configuration 
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;
#} #Merge mozilla config with jitsi recommended one

    ssl_certificate /etc/letsencrypt/live/${JITSIFQDN}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/${JITSIFQDN}/privkey.pem;

    error_page 404 /static/404.html;

# Jitsi recommended settings below

#server {
#    listen 80;

    server_name ${JITSIFQDN};
    # set the root
    root /opt/jitsi-meet;
    index index.html;

    location ~ ^/([a-zA-Z0-9=\?]+)\$ {
        rewrite ^/(.*)\$ / break;
        }

    location / {
        ssi on;
    }

    # BOSH
    location /http-bind {
        proxy_pass      http://localhost:5280/http-bind;
        proxy_set_header X-Forwarded-For \$remote_addr;
        proxy_set_header Host \$http_host;
    }

    # xmpp websockets
    location /xmpp-websocket {
        proxy_pass http://localhost:5280/xmpp-websocket;
        proxy_http_version 1.1;
        proxy_set_header Upgrade \$http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host \$host;
        tcp_nodelay on;
    }
}
=== 

それから nginx サービスを再起動してください。

ヒントとテクニック

NAT 経由で実行

以下のポートをサーバーに転送する必要があります:

HTTPS:

• TCP/443

Jitsi Videobridge:

• TCP/4443
• UDP/10000

参照

• Notes by C0rn3j
• Configurations used in the article