mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2025-02-22 06:54:07 +01:00
Update docs/configuring-playbook-jitsi.md: remove the instructions for other optional configurations in favor of the role's document
- The section about enabling Gravater service is not removed as it is specific to configuring Jitsi on a Matrix server. Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
This commit is contained in:
Suguru Hirahara
parent
b14a0f7854
commit
31971011dc
@ -70,102 +70,6 @@ If you would like to control who is allowed to start meetings on your instance,
|
||||
|
||||
See [this section](https://github.com/mother-of-all-self-hosting/ansible-role-jitsi/blob/main/docs/configuring-jitsi.md#configure-jitsi-authentication-and-guests-mode-optional) on the role's document for details about how to configure the authentication and guests mode. The recommended authentication method is `internal` as it also works in federated rooms. If you want to enable authentication with Matrix OpenID making use of [Matrix User Verification Service (UVS)](https://github.com/spantaleev/matrix-docker-ansible-deploy/blob/master/docs/configuring-playbook-user-verification-service.md), see [here](https://github.com/mother-of-all-self-hosting/ansible-role-jitsi/blob/main/docs/configuring-jitsi.md#authenticate-using-matrix-openid-auth-type-matrix) for details about how to set it up.
|
||||
|
||||
### Configure Jitsi authentication and guests mode (optional)
|
||||
|
||||
By default the Jitsi instance does not require for anyone to log in, and is open to use without an account. To control who is allowed to start meetings on your Jitsi instance, you'd need to enable Jitsi's authentication and optionally guests mode.
|
||||
|
||||
Authentication type must be one of them: `internal` (default), `jwt`, `matrix` or `ldap`. Currently, only `internal`, `matrix` and `ldap` mechanisms are supported by the [Jitsi role](https://github.com/mother-of-all-self-hosting/ansible-role-jitsi).
|
||||
|
||||
With authentication enabled, all meetings have to be started by a registered user. After the meeting is started by that user, then guests are free to join. If the registered user is not yet present, the guests are put on hold in individual waiting rooms.
|
||||
|
||||
**Note**: authentication is not tested by the playbook's self-checks. We therefore recommend that you would make sure by yourself that authentication is configured properly. To test it, start a meeting at `jitsi.example.com` on your browser.
|
||||
|
||||
#### Authenticate using Jitsi accounts: Auth-Type `internal` (recommended)
|
||||
|
||||
The default authentication mechanism is `internal` auth, which requires a Jitsi account to have been configured. This is a recommended method, as it also works in federated rooms.
|
||||
|
||||
To enable authentication with a Jitsi account, add the following configuration to your `vars.yml` file. Make sure to replace `USERNAME_…` and `PASSWORD_…` with your own values.
|
||||
|
||||
```yaml
|
||||
jitsi_enable_auth: true
|
||||
jitsi_enable_guests: true
|
||||
jitsi_prosody_auth_internal_accounts:
|
||||
- username: "USERNAME_FOR_THE_FIRST_USER_HERE"
|
||||
password: "PASSWORD_FOR_THE_FIRST_USER_HERE"
|
||||
- username: "USERNAME_FOR_THE_SECOND_USER_HERE"
|
||||
password: "PASSWORD_FOR_THE_SECOND_USER_HERE"
|
||||
```
|
||||
|
||||
**Note**: as Jitsi account removal function is not integrated into the playbook, these accounts will not be able to be removed from the Prosody server automatically, even if they are removed from your `vars.yml` file subsequently.
|
||||
|
||||
#### Authenticate using Matrix OpenID: Auth-Type `matrix`
|
||||
|
||||
> [!WARNING]
|
||||
> This breaks the Jitsi instance on federated rooms probably and does not allow sharing conference links with guests.
|
||||
|
||||
This authentication method requires [Matrix User Verification Service](https://github.com/matrix-org/matrix-user-verification-service), which can be installed using this [playbook](configuring-playbook-user-verification-service.md). It verifies against Matrix openID, and requires a user-verification-service to run.
|
||||
|
||||
To enable authentication with Matrix OpenID, add the following configuration to your `vars.yml` file:
|
||||
|
||||
```yaml
|
||||
jitsi_enable_auth: true
|
||||
jitsi_auth_type: matrix
|
||||
matrix_user_verification_service_enabled: true
|
||||
```
|
||||
|
||||
For more information see also [https://github.com/matrix-org/prosody-mod-auth-matrix-user-verification](https://github.com/matrix-org/prosody-mod-auth-matrix-user-verification).
|
||||
|
||||
#### Authenticate using LDAP: Auth-Type `ldap`
|
||||
|
||||
To enable authentication with LDAP, add the following configuration to your `vars.yml` file (adapt to your needs):
|
||||
|
||||
```yaml
|
||||
jitsi_enable_auth: true
|
||||
jitsi_auth_type: ldap
|
||||
jitsi_ldap_url: "ldap://ldap.example.com"
|
||||
jitsi_ldap_base: "OU=People,DC=example.com"
|
||||
#jitsi_ldap_binddn: ""
|
||||
#jitsi_ldap_bindpw: ""
|
||||
jitsi_ldap_filter: "uid=%u"
|
||||
jitsi_ldap_auth_method: "bind"
|
||||
jitsi_ldap_version: "3"
|
||||
jitsi_ldap_use_tls: true
|
||||
jitsi_ldap_tls_ciphers: ""
|
||||
jitsi_ldap_tls_check_peer: true
|
||||
jitsi_ldap_tls_cacert_file: "/etc/ssl/certs/ca-certificates.crt"
|
||||
jitsi_ldap_tls_cacert_dir: "/etc/ssl/certs"
|
||||
jitsi_ldap_start_tls: false
|
||||
```
|
||||
|
||||
For more information refer to the [docker-jitsi-meet](https://github.com/jitsi/docker-jitsi-meet#authentication-using-ldap) and the [saslauthd `LDAP_SASLAUTHD`](https://github.com/winlibs/cyrus-sasl/blob/master/saslauthd/LDAP_SASLAUTHD) documentation.
|
||||
|
||||
### Configure `JVB_ADVERTISE_IPS` for running behind NAT or on a LAN environment (optional)
|
||||
|
||||
When running Jitsi in a LAN environment, or on the public Internet via NAT, the `JVB_ADVERTISE_IPS` enviornment variable should be set.
|
||||
|
||||
This variable allows to control which IP addresses the JVB will advertise for WebRTC media traffic. It is necessary to set it regardless of the use of a reverse proxy, since it's the IP address that will receive the media (audio / video) and not HTTP traffic, hence it's oblivious to the reverse proxy.
|
||||
|
||||
If your users are coming in over the Internet (and not over LAN), this will likely be your public IP address. If this is not set up correctly, calls will crash when more than two users join a meeting.
|
||||
|
||||
To set the variable, add the following configuration to your `vars.yml` file. Make sure to replace `LOCAL_IP_ADDRESS_OF_THE_HOST_HERE` with a proper value.
|
||||
|
||||
```yaml
|
||||
jitsi_jvb_container_extra_arguments:
|
||||
- '--env "JVB_ADVERTISE_IPS=LOCAL_IP_ADDRESS_OF_THE_HOST_HERE"'
|
||||
```
|
||||
|
||||
Check [the official documentation](https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/#running-behind-nat-or-on-a-lan-environment) for more details about it.
|
||||
|
||||
### Set a maximum number of participants on a Jitsi conference (optional)
|
||||
|
||||
You can set a maximum number of participants allowed to join a Jitsi conference. By default the number is not specified.
|
||||
|
||||
To set it, add the following configuration to your `vars.yml` file (adapt to your needs):
|
||||
|
||||
```yaml
|
||||
jitsi_prosody_max_participants: 4 # example value
|
||||
```
|
||||
|
||||
### Enable Gravatar (optional)
|
||||
|
||||
In the default Jisti Meet configuration, `gravatar.com` is enabled as an avatar service.
|
||||
@ -181,67 +85,6 @@ jitsi_disable_gravatar: false
|
||||
> [!WARNING]
|
||||
> This will result in third party request leaking data to the Gravatar Service (`gravatar.com`, unless configured otherwise). Besides metadata, the Matrix user_id and possibly the room ID (via `referrer` header) will be also sent to the third party.
|
||||
|
||||
### Fine tune Jitsi (optional)
|
||||
|
||||
If you'd like to have Jitsi save up resources, add the following configuration to your `vars.yml` file (adapt to your needs):
|
||||
|
||||
```yaml
|
||||
jitsi_web_config_resolution_width_ideal_and_max: 480
|
||||
jitsi_web_config_resolution_height_ideal_and_max: 240
|
||||
jitsi_web_custom_config_extension: |
|
||||
config.enableLayerSuspension = true;
|
||||
|
||||
config.disableAudioLevels = true;
|
||||
|
||||
config.channelLastN = 4;
|
||||
```
|
||||
|
||||
These configurations:
|
||||
|
||||
- **limit the maximum video resolution**, to save up resources on both server and clients
|
||||
- **suspend unused video layers** until they are requested again, to save up resources on both server and clients. Read more on this feature [here](https://jitsi.org/blog/new-off-stage-layer-suppression-feature/).
|
||||
- **disable audio levels** to avoid excessive refresh of the client-side page and decrease the CPU consumption involved
|
||||
- **limit the number of video feeds forwarded to each client**, to save up resources on both server and clients. As clients’ bandwidth and CPU may not bear the load, use this setting to avoid lag and crashes. This feature is available by default on other webconference applications such as Office 365 Teams (the number is limited to 4). Read how it works [here](https://github.com/jitsi/jitsi-videobridge/blob/5ff195985edf46c9399dcf263cb07167f0a2c724/doc/allocation.md).
|
||||
|
||||
### Extending the configuration
|
||||
|
||||
There are some additional things you may wish to configure about the component.
|
||||
|
||||
Take a look at:
|
||||
|
||||
- [Jitsi role](https://github.com/mother-of-all-self-hosting/ansible-role-jitsi)'s [`defaults/main.yml`](https://github.com/mother-of-all-self-hosting/ansible-role-jitsi/blob/main/defaults/main.yml) for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using these variables:
|
||||
- `jitsi_web_custom_interface_config_extension`: custom configuration to be appended to `interface_config.js`, passed to Jitsi Web
|
||||
- `jitsi_web_custom_config_extension`: custom configuration to be injected into `custom-config.js`, passed to Jitsi Web
|
||||
- `jitsi_jvb_custom_config_extension`: custom configuration to be injected into `custom-sip-communicator.properties`, passed to Jitsi JVB
|
||||
|
||||
### Example configurations
|
||||
|
||||
Here is an example set of configurations for running a Jitsi instance with:
|
||||
|
||||
- authentication using a Jitsi account (username: `US3RNAME`, password: `passw0rd`)
|
||||
- guests: allowed
|
||||
- maximum participants: 6 people
|
||||
- fine tuning with the configurations presented above
|
||||
- other miscellaneous options (see the official Jitsi documentation [here](https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-configuration) and [here](https://jitsi.github.io/handbook/docs/user-guide/user-guide-advanced))
|
||||
|
||||
```yaml
|
||||
jitsi_enabled: true
|
||||
jitsi_enable_auth: true
|
||||
jitsi_enable_guests: true
|
||||
jitsi_prosody_auth_internal_accounts:
|
||||
- username: "US3RNAME"
|
||||
password: "passw0rd"
|
||||
jitsi_prosody_max_participants: 6
|
||||
jitsi_web_config_resolution_width_ideal_and_max: 480
|
||||
jitsi_web_config_resolution_height_ideal_and_max: 240
|
||||
jitsi_web_custom_config_extension: |
|
||||
config.enableLayerSuspension = true;
|
||||
config.disableAudioLevels = true;
|
||||
config.channelLastN = 4;
|
||||
config.requireDisplayName = true; // force users to set a display name
|
||||
config.startAudioOnly = true; // start the conference in audio only mode (no video is being received nor sent)
|
||||
```
|
||||
|
||||
## Installing
|
||||
|
||||
After configuring the playbook and potentially [adjusting your DNS records](#adjusting-dns-records), run the playbook with [playbook tags](playbook-tags.md) as below:
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user