Merge branch 'master' into master

CHANGELOG.md

@@ -1,3 +1,35 @@
+## stable-9457-2
+
+Based on stable release 9457-2.
+
+* fed87fb web: update acme.sh version to 3.0.7
+* 11285cd prosody: Fixed the wrong position of the JWT_SIGN_TYPE setting in the file (#1796)
+* f9ff2a4 misc: working on unstable
+
+## stable-9457-1
+
+Based on stable release 9457-1.
+
+* 09bbfaf misc: working on unstable
+
+## stable-9457
+
+Based on stable release 9457.
+
+* 6f98bbe prosody: add ability to customize TURN TTL value
+* 8fe3139 jvb: fix autoscaler sidecar config (#1785)
+* 48d803c jigasi: fix autoscaler sidecar config for shutdown url (#1784)
+* c951116 jibri: fix autoscaler sidecar config (#1783)
+* cae1e40 feat(jigasi): Adds trusted domains option.
+* e939230 prosody: add ability to customize JWT signature type
+* b0f9eb2 prosody: integrate prosody-plugins-contrib
+* 604ba22 prosody: Switches lua gc back to incremental. (#1777)
+* 68d4b1a jibri: fix xorg modeline for 1280x720 (#1778)
+* 8094a17 web: add ability to change CORS header value
+* 03b6ca2 web: remove no longer needed mime type definition
+* 70ba4cb base: update to Debian Bookworm
+* dc5cbae misc: working on unstable
+
 ## stable-9364-1
 
 Based on stable release 9364-1.

base/Dockerfile

@@ -14,7 +14,7 @@ RUN \
     esac && \
     apt-dpkg-wrap apt-get update && \
     apt-dpkg-wrap apt-get install -y apt-transport-https apt-utils ca-certificates gnupg wget && \
-    wget -qO /usr/bin/tpl https://github.com/jitsi/tpl/releases/download/v1.1.1/tpl-linux-${TPL_ARCH} && \
+    wget -qO /usr/bin/tpl https://github.com/jitsi/tpl/releases/download/v1.2.0/tpl-linux-${TPL_ARCH} && \
     # Workaround S6 bug when /bin is a symlink
     wget -qO /tmp/s6.tar.gz https://github.com/just-containers/s6-overlay/releases/download/v1.22.1.0/s6-overlay-${S6_ARCH}.tar.gz && \
     mkdir /tmp/s6 && \

docker-compose.yml

@@ -25,6 +25,7 @@ services:
             - COLIBRI_WEBSOCKET_JVB_LOOKUP_NAME
             - COLIBRI_WEBSOCKET_REGEX
             - CONFCODE_URL
+            - CORS_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN
             - DEFAULT_LANGUAGE
             - DEPLOYMENTINFO_ENVIRONMENT
             - DEPLOYMENTINFO_ENVIRONMENT_TYPE
@@ -231,6 +232,7 @@ services:
             - JWT_ALLOW_EMPTY
             - JWT_AUTH_TYPE
             - JWT_ENABLE_DOMAIN_VERIFICATION
+            - JWT_SIGN_TYPE
             - JWT_TOKEN_AUTH_MODULE
             - MATRIX_UVS_URL
             - MATRIX_UVS_ISSUER
@@ -360,6 +362,7 @@ services:
             - JIBRI_PENDING_TIMEOUT
             - JIGASI_BREWERY_MUC
             - JIGASI_SIP_URI
+            - JIGASI_TRUSTED_DOMAINS
             - JVB_BREWERY_MUC
             - JVB_XMPP_AUTH_DOMAIN
             - JVB_XMPP_INTERNAL_MUC_DOMAIN
@@ -414,12 +417,14 @@ services:
             - ENABLE_COLIBRI_WEBSOCKET
             - ENABLE_JVB_XMPP_SERVER
             - ENABLE_OCTO
+            - ENABLE_SCTP
             - JVB_ADVERTISE_IPS
             - JVB_ADVERTISE_PRIVATE_CANDIDATES
             - JVB_AUTH_USER
             - JVB_AUTH_PASSWORD
             - JVB_BREWERY_MUC
             - JVB_DISABLE_STUN
+            - JVB_DISABLE_XMPP
             - JVB_INSTANCE_ID
             - JVB_PORT
             - JVB_MUC_NICKNAME
@@ -431,6 +436,7 @@ services:
             - JVB_REQUIRE_VALID_ADDRESS
             - JVB_WS_DOMAIN
             - JVB_WS_SERVER_ID
+            - JVB_WS_TLS
             - JVB_XMPP_AUTH_DOMAIN
             - JVB_XMPP_INTERNAL_MUC_DOMAIN
             - JVB_XMPP_PORT

env.example

@@ -79,18 +79,6 @@ TZ=UTC
 # Set etherpad-lite public URL, including /p/ pad path fragment (uncomment to enable)
 #ETHERPAD_PUBLIC_URL=https://etherpad.my.domain/p/
 
-# Name your etherpad instance!
-ETHERPAD_TITLE="Video Chat"
-
-# The default text of a pad
-ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
-
-# Name of the skin for etherpad
-ETHERPAD_SKIN_NAME=colibris
-
-# Skin variants for etherpad
-ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
-
 
 #
 # Basic Jigasi configuration options (needed for SIP gateway support)

etherpad.yml

@@ -3,13 +3,13 @@ version: '3.5'
 services:
     # Etherpad: real-time collaborative document editing
     etherpad:
-        image: etherpad/etherpad:1.9.6
+        image: etherpad/etherpad:2.0.3
         restart: ${RESTART_POLICY:-unless-stopped}
         environment:
-            - TITLE=${ETHERPAD_TITLE}
-            - DEFAULT_PAD_TEXT=${ETHERPAD_DEFAULT_PAD_TEXT}
-            - SKIN_NAME=${ETHERPAD_SKIN_NAME}
-            - SKIN_VARIANTS=${ETHERPAD_SKIN_VARIANTS}
+            - TITLE=${ETHERPAD_TITLE:-""}
+            - DEFAULT_PAD_TEXT=${ETHERPAD_DEFAULT_PAD_TEXT:-""}
+            - SKIN_NAME=${ETHERPAD_SKIN_NAME:-colibris}
+            - SKIN_VARIANTS=${ETHERPAD_SKIN_VARIANTS:-"super-light-toolbar super-light-editor light-background full-width-editor"}
             - SUPPRESS_ERRORS_IN_PAD_TEXT=true
         networks:
             meet.jitsi:

jibri.yml

@@ -38,6 +38,8 @@ services:
             - JIBRI_USAGE_TIMEOUT
             - JIBRI_XMPP_USER
             - JIBRI_XMPP_PASSWORD
+            - JIBRI_XORG_HORIZ_SYNC
+            - JIBRI_XORG_VERT_REFRESH
             - JIBRI_BREWERY_MUC
             - JIBRI_RECORDER_USER
             - JIBRI_RECORDER_PASSWORD

jibri/Dockerfile

@@ -16,7 +16,20 @@ ARG CHROME_RELEASE=121.0.6167.85
 COPY rootfs/ /
 
 RUN apt-dpkg-wrap apt-get update && \
-    apt-dpkg-wrap apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" jibri libgl1-mesa-dri procps jitsi-upload-integrations jitsi-autoscaler-sidecar jq pulseaudio dbus dbus-x11 rtkit unzip fonts-noto && \
+    apt-dpkg-wrap apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" \
+        jibri \
+        libgl1-mesa-dri \
+        procps \
+        jitsi-upload-integrations \
+        jitsi-autoscaler-sidecar \
+        jq \
+        pulseaudio \
+        dbus \
+        dbus-x11 \
+        rtkit \
+        unzip \
+        fonts-noto \
+        libcap2-bin && \
     /usr/bin/install-chrome.sh && \
     apt-cleanup && \
     adduser jibri rtkit && \

jibri/rootfs/defaults/autoscaler-sidecar.config

@@ -5,10 +5,11 @@ export SHUTDOWN_POLLING_INTERVAL={{ $SHUTDOWN_POLLING_INTERVAL }}
 export STATS_POLLING_INTERVAL={{ $STATS_POLLING_INTERVAL }}
 export PORT={{ .Env.AUTOSCALER_SIDECAR_PORT }}
 export GRACEFUL_SHUTDOWN_SCRIPT="/opt/jitsi/jibri/wait_graceful_shutdown.sh"
-export TERMINATE_SCRIPT="/opt/jitsi/jibri/shutdown.sh"
+export TERMINATE_SCRIPT="/opt/jitsi/shutdown.sh"
 export ENABLE_REPORT_STATS=true
 export POLLING_URL="{{ .Env.AUTOSCALER_URL  }}/sidecar/poll"
 export STATUS_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/status"
+export SHUTDOWN_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/shutdown"
 export STATS_RETRIEVE_URL="http://localhost:{{ $JIBRI_HTTP_API_EXTERNAL_PORT }}/jibri/api/v1.0/health"
 export STATS_REPORT_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/stats"
 export ASAP_SIGNING_KEY_FILE="{{ .Env.AUTOSCALER_SIDECAR_KEY_FILE }}"

jibri/rootfs/defaults/xorg-video-dummy.conf

@@ -1,4 +1,6 @@
 {{ $JIBRI_RECORDING_RESOLUTION := .Env.JIBRI_RECORDING_RESOLUTION | default "1280x720" -}}
+{{ $JIBRI_HORIZ_SYNC := .Env.JIBRI_XORG_HORIZ_SYNC | default "43.0 - 47.0" -}}
+{{ $JIBRI_VERT_REFRESH := .Env.JIBRI_XORG_VERT_REFRESH | default "58.0 - 62.0" -}}
 
 # This xorg configuration file is meant to be used by xpra
 # to start a dummy X11 server.
@@ -24,8 +26,8 @@ EndSection
 
 Section "Monitor"
   Identifier "dummy_monitor"
-  HorizSync   5.0 - 1000.0
-  VertRefresh 5.0 - 200.0
+  HorizSync   {{ $JIBRI_HORIZ_SYNC }}
+  VertRefresh {{ $JIBRI_VERT_REFRESH }}
   #This can be used to get a specific DPI, but only for the default resolution:
   #DisplaySize 508 317
   #NOTE: the highest modes will not work without increasing the VideoRam
@@ -63,6 +65,7 @@ Section "Monitor"
   Modeline "1360x768" 24.49 1360 1392 1480 1512 768 786 789 807
   Modeline "1024x768" 18.71 1024 1056 1120 1152 768 786 789 807
   Modeline "768x1024" 19.50 768 800 872 904 1024 1048 1052 1076
+  Modeline "1280x720@60" 73.78 1280 1312 1592 1624 720 735 742 757
 
 
   #common resolutions for android devices (both orientations):

jibri/rootfs/etc/cont-init.d/10-config

@@ -1,5 +1,11 @@
 #!/usr/bin/with-contenv bash
 
+# Check if the SYS_ADMIN cap is set
+if ! capsh --has-p=cap_sys_admin; then
+    echo "Required capability SYS_ADMIN is missing"
+    exit 1
+fi
+
 # Check if /dev/shm is large enough (2GB at least)
 if ! shm-check; then
     echo "/dev/shm must be at least 2GB in size"

jibri/rootfs/opt/jitsi/shutdown.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/with-contenv bash
+# notify the sidecar of imminent shutdown
+PORT=${AUTOSCALER_SIDECAR_PORT:-6000}
+curl -d '{}' -v 0:$PORT/hook/v1/shutdown
+sleep 10
+
+# signal jibri to shutdown via rest api
+/opt/jitsi/jibri/shutdown.sh
+
+# shutdown everything else
+s6-svscanctl -t /var/run/s6/services

jicofo/rootfs/defaults/jicofo.conf

@@ -7,7 +7,7 @@
 {{ $ENABLE_SCTP := .Env.ENABLE_SCTP | default "0" | toBool -}}
 {{ $ENABLE_RECORDING := .Env.ENABLE_RECORDING | default "0" | toBool -}}
 {{ $ENABLE_OCTO := .Env.ENABLE_OCTO | default "0" | toBool -}}
-{{ $ENABLE_OCTO_SCTP := .Env.ENABLE_OCTO_SCTP | default (.Env.ENABLE_SCTP | default "0") | toBool -}}
+{{ $ENABLE_OCTO_SCTP := .Env.ENABLE_OCTO_SCTP | default $ENABLE_SCTP | toBool -}}
 {{ $ENABLE_AUTO_LOGIN := .Env.ENABLE_AUTO_LOGIN | default "1" | toBool -}}
 {{ $ENABLE_REST := .Env.JICOFO_ENABLE_REST | default "0" | toBool -}}
 {{ $ENABLE_JVB_XMPP_SERVER := .Env.ENABLE_JVB_XMPP_SERVER | default "0" | toBool -}}
@@ -288,8 +288,8 @@ jicofo {
         disable-certificate-verification = true
       }
       {{ end }}
-      
+
       trusted-domains = [ {{ range $index, $element := $TRUSTED_DOMAINS }}{{ if gt $index 0 }},{{ end }}"{{ $element }}"{{ end}} ]
-      
+
     }
 }

jigasi/rootfs/defaults/autoscaler-sidecar.config

@@ -9,6 +9,7 @@ export TERMINATE_SCRIPT="/opt/jitsi/shutdown.sh"
 export ENABLE_REPORT_STATS=true
 export POLLING_URL="{{ .Env.AUTOSCALER_URL  }}/sidecar/poll"
 export STATUS_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/status"
+export SHUTDOWN_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/shutdown"
 export STATS_RETRIEVE_URL="http://localhost:{{ $JIGASI_STATS_PORT }}/about/stats"
 export STATS_REPORT_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/stats"
 export ASAP_SIGNING_KEY_FILE="{{ .Env.AUTOSCALER_SIDECAR_KEY_FILE }}"

jigasi/rootfs/defaults/sip-communicator.properties

@@ -12,6 +12,8 @@
 {{ $SHUTDOWN_REST_ENABLED := .Env.SHUTDOWN_REST_ENABLED | default "false" | toBool -}}
 {{ $DISABLE_SIP := .Env.JIGASI_DISABLE_SIP | default "false" | toBool -}}
 {{/* assign env from context, preserve during range when . is re-assigned */}}
+{{ $TRUSTED_DOMAIN_LIST := .Env.JIGASI_TRUSTED_DOMAINS | default "" -}}
+{{ $TRUSTED_DOMAINS := splitList "," $TRUSTED_DOMAIN_LIST -}}
 {{ $ENV := .Env -}}
 
 net.java.sip.communicator.impl.protocol.SingleCallInProgressPolicy.enabled=false
@@ -180,3 +182,8 @@ org.jitsi.jigasi.DEFAULT_JVB_ROOM_NAME={{ .Env.JIGASI_SIP_DEFAULT_ROOM }}
 {{ end }}
 
 org.jitsi.jigasi.MUC_SERVICE_ADDRESS={{ $XMPP_MUC_DOMAIN }}
+
+# when checking other participants whether they are jibri/jigasi we can also check the the domain they use for connecting
+{{ if $TRUSTED_DOMAIN_LIST }}
+org.jitsi.jigasi.TRUSTED_DOMAINS=[ {{ range $index, $element := $TRUSTED_DOMAINS }}{{ if gt $index 0 }},{{ end }}"{{ $element }}"{{ end}} ]
+{{ end }}

jvb/rootfs/defaults/autoscaler-sidecar.config

@@ -9,6 +9,7 @@ export TERMINATE_SCRIPT="/opt/jitsi/shutdown.sh"
 export ENABLE_REPORT_STATS=true
 export POLLING_URL="{{ .Env.AUTOSCALER_URL  }}/sidecar/poll"
 export STATUS_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/status"
+export SHUTDOWN_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/shutdown"
 export STATS_RETRIEVE_URL="http://localhost:{{ $JVB_COLIBRI_PORT }}/colibri/stats"
 export STATS_REPORT_URL="{{ .Env.AUTOSCALER_URL }}/sidecar/stats"
 export ASAP_SIGNING_KEY_FILE="{{ .Env.AUTOSCALER_SIDECAR_KEY_FILE }}"

jvb/rootfs/defaults/jvb.conf

@@ -1,6 +1,8 @@
 {{ $COLIBRI_REST_ENABLED := .Env.COLIBRI_REST_ENABLED | default "false" | toBool -}}
+{{ $DISABLE_XMPP := .Env.JVB_DISABLE_XMPP | default "0" | toBool -}}
 {{ $ENABLE_COLIBRI_WEBSOCKET := .Env.ENABLE_COLIBRI_WEBSOCKET | default "1" | toBool -}}
 {{ $ENABLE_OCTO := .Env.ENABLE_OCTO | default "0" | toBool -}}
+{{ $ENABLE_SCTP := .Env.ENABLE_SCTP | default "0" | toBool -}}
 {{ $ENABLE_JVB_XMPP_SERVER := .Env.ENABLE_JVB_XMPP_SERVER | default "0" | toBool }}
 {{ $JVB_DISABLE_STUN := .Env.JVB_DISABLE_STUN | default "0" | toBool -}}
 {{ $JVB_STUN_SERVERS := .Env.JVB_STUN_SERVERS | default "meet-jit-si-turnrelay.jitsi.net:443" -}}
@@ -19,7 +21,8 @@
 {{ $PUBLIC_URL_DOMAIN := .Env.PUBLIC_URL | default "https://localhost:8443" | trimPrefix "https://" | trimSuffix "/" -}}
 {{ $SHUTDOWN_REST_ENABLED := .Env.SHUTDOWN_REST_ENABLED | default "false" | toBool -}}
 {{ $WS_DOMAIN := .Env.JVB_WS_DOMAIN | default $PUBLIC_URL_DOMAIN -}}
-{{ $WS_SERVER_ID := .Env.JVB_WS_SERVER_ID | default .Env.JVB_WS_SERVER_ID_FALLBACK -}}
+{{ $WS_SERVER_ID := .Env.JVB_WS_SERVER_ID | default .Env.JVB_WS_SERVER_ID_FALLBACK | default "default" -}}
+{{ $WS_TLS := .Env.JVB_WS_TLS | default "1" | toBool -}}
 {{ $XMPP_AUTH_DOMAIN := .Env.XMPP_AUTH_DOMAIN | default "auth.meet.jitsi" -}}
 {{ $XMPP_INTERNAL_MUC_DOMAIN := .Env.XMPP_INTERNAL_MUC_DOMAIN | default "internal-muc.meet.jitsi" -}}
 {{ $XMPP_PORT := .Env.XMPP_PORT | default "5222" -}}
@@ -36,6 +39,7 @@ videobridge {
         advertise-private-candidates = {{ $JVB_ADVERTISE_PRIVATE_CANDIDATES }}
     }
     apis {
+{{ if not $DISABLE_XMPP -}}
         xmpp-client {
             configs {
 {{ if $ENABLE_JVB_XMPP_SERVER }}
@@ -66,9 +70,10 @@ videobridge {
                     DISABLE_CERTIFICATE_VERIFICATION = true
                 }
 {{ end -}}
-{{ end }}
+{{ end -}}
             }
         }
+{{ end -}}
         rest {
             enabled = {{ $COLIBRI_REST_ENABLED }}
         }
@@ -78,13 +83,16 @@ videobridge {
             enabled = {{ $SHUTDOWN_REST_ENABLED }}
         }
     }
+    sctp {
+      enabled = {{ $ENABLE_SCTP }}
+    }
     stats {
         enabled = true
     }
     websockets {
         enabled = {{ $ENABLE_COLIBRI_WEBSOCKET }}
         domain = "{{ $WS_DOMAIN }}"
-        tls = true
+        tls = {{ $WS_TLS }}
         server-id = "{{ $WS_SERVER_ID }}"
     }
     http-servers {

jvb/rootfs/etc/cont-init.d/10-config

@@ -1,17 +1,24 @@
 #!/usr/bin/with-contenv bash
 
-if [[ -z $JVB_AUTH_PASSWORD ]]; then
-    echo 'FATAL ERROR: JVB auth password must be set'
-    exit 1
-fi
+if [[ -z $JVB_DISABLE_XMPP ]]; then
+    if [[ -z $JVB_AUTH_PASSWORD ]]; then
+        echo 'FATAL ERROR: JVB auth password must be set'
+        exit 1
+    fi
 
-OLD_JVB_AUTH_PASSWORD=passw0rd
-if [[ "$JVB_AUTH_PASSWORD" == "$OLD_JVB_AUTH_PASSWORD" ]]; then
-    echo 'FATAL ERROR: JVB auth password must be changed, check the README'
-    exit 1
-fi
+    OLD_JVB_AUTH_PASSWORD=passw0rd
+    if [[ "$JVB_AUTH_PASSWORD" == "$OLD_JVB_AUTH_PASSWORD" ]]; then
+        echo 'FATAL ERROR: JVB auth password must be changed, check the README'
+        exit 1
+    fi
 
-[ -z "${XMPP_SERVER}" ] && export XMPP_SERVER=xmpp.meet.jitsi
+    [ -z "${XMPP_SERVER}" ] && export XMPP_SERVER=xmpp.meet.jitsi
+
+    # On environments like Swarm the IP address used by the default gateway need not be
+    # the one used for inter-container traffic. Use that one for our fallback ID.
+    XMPP_SERVER_IP=$(dig +short +search ${XMPP_SERVER})
+    export JVB_WS_SERVER_ID_FALLBACK=$(ip route get ${XMPP_SERVER_IP} | grep -oP '(?<=src ).*' | awk '{ print $1 '})
+fi
 
 # Migration from DOCKER_HOST_ADDRESS to JVB_ADVERTISE_IPS
 if [[ -z "${JVB_ADVERTISE_IPS}" ]]; then
@@ -21,11 +28,6 @@ if [[ -z "${JVB_ADVERTISE_IPS}" ]]; then
     fi
 fi
 
-# On environments like Swarm the IP address used by the default gateway need not be
-# the one used for inter-container traffic. Use that one for our fallback ID.
-XMPP_SERVER_IP=$(dig +short +search ${XMPP_SERVER})
-export JVB_WS_SERVER_ID_FALLBACK=$(ip route get ${XMPP_SERVER_IP} | grep -oP '(?<=src ).*' | awk '{ print $1 '})
-
 # Local IP for the ice4j mapping harvester.
 export LOCAL_ADDRESS=$(ip route get 1 | grep -oP '(?<=src ).*' | awk '{ print $1 '})
 
@@ -72,9 +74,3 @@ tpl /defaults/logging.properties > /config/logging.properties
 tpl /defaults/jvb.conf > /config/jvb.conf
 
 chown -R jvb:jitsi /config
-
-# Configuration checks
-if [[ (-z $ENABLE_COLIBRI_WEBSOCKET || $ENABLE_COLIBRI_WEBSOCKET == "0") && $ENABLE_OCTO == "1"  ]]; then
-  echo "ERROR: In order to enable Octo relays (with ENABLE_OCTO=1), you MUST enable Colibri websockets (with ENABLE_COLIBRI_WEBSOCKET=1)";
-  exit 1;
-fi