nixos/jitsi-meet: init #82920

mmilata · 2020-03-19T03:51:50Z

Jitsi Meet video conferencing setup following these instructions (similar to the Debian quick install).

The java apps are not built from source but repackaged prebuilt JARs. I'm at my wit's end wrt building them from source so I'd like to ask someone more knowledgeable in maven to help me with this, potentially in another PR. (Edit: got source build mostly working.)

How to test

If you don't mind switching your system to the snapshot of NixOS Unstable this PR is based on, you can simply pass -I nixpkgs=https://github.com/otevrenamesta/nixpkgs/archive/jitsi-meet.tar.gz to nixos-rebuild or nixops.

If you want to only import the module without the rest of the OS, for example on 19.09 install, you can use the module from NUR:

imports = let
  nur-no-pkgs = import (builtins.fetchTarball "https://github.com/nix-community/NUR/archive/master.tar.gz") {};
in [
  nur-no-pkgs.repos.mmilata.modules.jitsi-meet
];

Example configuration:

services.jitsi-meet = {
  enable = true;
  hostName = "meet.example.org";
  videobridge.openFirewall = true;
};

services.nginx.virtualHosts.${config.services.jitsi-meet.hostName} = {
  enableACME = true;
  forceSSL = true;
};

networking.firewall.allowedTCPPorts = [ 80 443 ];

Motivation for this change

#82805

Things done

veprbl · 2020-03-19T05:39:13Z

@GrahamcOfBorg test jitsi-meet

jluttine · 2020-03-19T09:44:38Z

@mmilata Wow, superamazing! Huge thanks! I'll try to test this today or during the weekend at least. Very excited. 🙂

I suppose it's ok to build them from binary deb packages for now, but it'd be good to have "building from source" as todos for these packages?

mmilata · 2020-03-19T12:04:53Z

@jluttine yeah that would be ideal, I've tried mavenix and mvn2nix and none worked for me, I guess I'd need advice from someone more experienced with Java/Maven. Though there seems to be quite a lot of packages in nixpkgs that just download archive with .jar like this.

Building the webapp through node2nix errors out on some missing webpack plugin, probably has simple solution I missed.

nixos-discourse · 2020-03-19T14:31:09Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nixos-nixpkgs-nix-discord-for-voice-communication/5845/40

nixos/tests/jitsi-meet.nix

nixos-discourse · 2020-03-20T16:04:08Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/package-services-for-schools-covidsupport/6335/7

jluttine · 2020-03-21T07:13:53Z

I tested this on localhost and seems to work! I had a successful two people video conference.

Just one minor issue/question, but it could be related to running it under localhost: I cannot access the front page of Jitsi Meet. Whenever I go to my IP on LAN https://192.168.1.123, it just forwards me automatically to some room like https://192.168.1.123/HappyElephantsDanceRemorsefully. Is this on purpose, a bug or just my localhost setup issue?

This is how I configured:

services.jitsi-meet = {
  enable = true;
  hostname = "192.168.1.123";  # my IP on LAN
  videobridge.openFirewall = true;
};
networking.firewall = {
  enable = true;
  allowedTCPPorts = [ 80 443 ];
};

I was expecting a similar front page as in https://meet.jit.si/ or is that just some custom configuration of their site? I might actually prefer this automatic redirection to a new room, but just wondering how it's expected to behave.

mmilata · 2020-03-21T12:57:34Z

@jluttine it's a feature, you can turn it off with services.jitsi-meet.config.enableWelcomePage = true;

edit: maybe we whould enable the welcome page by default as is in the default config that is currently not included in the package: https://github.com/jitsi/jitsi-meet/blob/master/config.js

jluttine · 2020-03-21T13:02:10Z

@mmilata Ah, nice! Perhaps that would be a good example in the services.jitsi-meet.config option?

nixos/modules/services/networking/jitsi-meet.nix

andir · 2020-03-21T21:19:16Z

nixos/modules/services/networking/jitsi-meet.nix

+        extraConfig = ''
+          authentication = "anonymous"
+          c2s_require_encryption = false
+          admins = { "focus@auth.${cfg.hostname}" }


Is that a predefined local user that must exist? I am not sure why focus@ is there.

Indeed, the jicofo service requires an admin user: https://github.com/jitsi/jicofo#manual-prosody-configuration

nixos/modules/services/networking/jitsi-meet.nix

mmilata · 2020-03-22T17:09:53Z

Thanks for review guys, pushed version that addresses some comments:

store secrets in /var/lib/jitsi-meet
use enableWelcomePage = true in default config, add it to examples
enableFirewall now uses ports from cfg.videobridge.config
mkDefault for nginx and prosody configuration

PTAL

Gonna attempt to build jitsi-meet from source again now.

mmilata · 2020-03-22T22:43:31Z

Force-pushed:

jitsi-meet (the webapp) is now built (copied) from release tarball (which I stumbled into after fighting node2nix for half a day)

nixos-discourse · 2020-03-24T16:31:40Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/package-services-for-schools-covidsupport/6335/1

omgwtflaserguns · 2020-03-27T07:41:34Z

I would really like to use this as soon this is available.

Is there a way to use it as it is now?

Im a software developer myself so at least i could report back problems i encounter, but i have to say i am a real dummy when it gets to nixos.

nixos-discourse · 2020-04-28T00:29:09Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nixcon-2020-status-update/6914/6

mmilata · 2020-04-29T23:14:49Z

Pushed:

moved jitsi-videobridge into its own module services.jitsi-videobridge
- setting services.jitsi-meet.videobridge.enable = true enables this service and configures it to connect to XMPP server on localhost
- this means the configuration options were renamed, e.g. services.jitsi-meet.videobridge.openFirewall -> service.jitsi-videobridge.openFirewall
made the videobridge HOCON config generation slightly saner (IMO)
added options for configuring NAT addresses - service.jitsi-videobridge.nat.publicAddress and service.jitsi-videobridge.nat.localAddress
jicofo now skips certificate validation instead of fiddling with JKS, should be fine since we're connecting to localhost
added check for required environment variables to jitsi-meet-init-secrets
updated to latest stable versions

Feedback appreciated. Hoping to address the other outstanding issues in the near future.

@Zhen-hao Sorry, not in this PR.

flokli · 2020-04-30T11:05:13Z

nixos/modules/services/web-apps/jitsi-meet.nix

+      extraConfig = ''
+        certificates = "${config.services.prosody.dataDir}"
+
+        Component "conference.${cfg.hostName}" "muc"


Can these component names be like in their official documentation?

They are - conference.${cfg.hostName} and focus.${cfg.hostName} are the same.

The linked document describes connecting videobridge as a XMPP component named jitsi-videobridge.${cfg.hostName}, which is deprecated. It is now recommended to connect the videobridge as a XMPP client that joins the internal.${cfg.hostName} MUC component.

See this part of the official DEB package or their docker, repo.

Also regarding deprecation: https://github.com/jitsi/jitsi-videobridge/blob/master/doc/muc.md

So manual-install, updated 20 days ago is documenting a deprecated installation method? Huuuh…

@flokli

WARNING: Manual installation is not recommended. We recommend following the quick-install document. The current document describes the steps that are needed to install a working deployment, but steps are easy to mess up, and the debian packages are more up-to-date, where this document is sometimes not updated to reflect latest changes.

Seems to me like the Debian package should be authoritative, and this PR matches what it does.

Unfortunately the documentation is a bit lacking and needs to be combined with reverse engineering the Debian packages and digging through Jitsi Discourse:(

For example according to https://github.com/jitsi/jitsi-meet/blob/master/doc/scalable-installation.md#jitsi-videobridge2 manual configuration of NAT addresses is no longer needed which I had no idea about.

nixos/modules/services/web-apps/jitsi-meet.nix

mmilata · 2020-05-04T19:01:15Z

Pushed:

Rebased on top of @NinjaTrappeur's nixos/prosody: make module defaults comply with XEP-0423 #86067 which should make Jitsi Meet work a bit better with Prosody instance shared for other use.
Split off JiCoFo to a separate module. Even though 99 % of users will want to run it on the same host as Prosody, this has two advantages:
- Less complexity in jitsi-meet.nix and coupling of the two modules through a defined set of options.
- jitsi-meet.nix now acts purely as an "integration" module that configures other "service" modules. Should make it easier to integrate them in a different way if one desires.
Secrets for the "service" modules are now configured using the passwordFile pattern, i.e. you provide a path to file containing the secret. The "integration" module generates these files for you, unless you want to explicitly set videobridge password for connecting multiple videobridges to one Prosody instance. This change does not require any action if you're upgrading from previous version of this PR.
Self-signed prosody certificate is now generated using openssl instead of prosodyctl cert generate and it is now not needed to regenerate the cert. ACME integration is still on TODO list.
services.jitsi-meet.extraConfig option was added to allow injecting javascript for bridge selection logic (cc @ArdaXi)

According to https://github.com/jitsi/jitsi-meet/blob/master/doc/scalable-installation.md#jitsi-videobridge2 it should be no longer needed to configure IP addresses when running behind NAT - can someone confirm this please?

mmilata · 2020-05-04T19:12:31Z

I was also trying to improve the test and it should in theory be possible to test this end-to-end, i.e. including the javascript that runs in browser by means of the enableOCR test option, v4l2loopback kernel module and xdo tool.

The module must be enabled in node configuration:

boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];

Then it's possible to create mock camera that will output static image with text:

modprobe v4l2loopback
convert -border 250 -font DejaVu-Serif -pointsize 50 -extent 640x480 label:'Hello Client1' /tmp/image.png
ffmpeg -loop 1 -re -i /tmp/image.png -f v4l2 -vcodec rawvideo -pix_fmt yuv420p /dev/video0

This is where I got stuck:

I can't figure out how to import CA certificate into Firefox from the command line (without excessive yak-shaving). This is needed because camera can only be used in secure context i.e. over https.
Chromium doesn't detect the mock camera.

Any ideas?

bjornfor · 2020-05-04T19:41:03Z

I think there is a v4l2loopback option that helps with Chromium. Look in v4l2loopback issue tracker or something. (Sorry, on mobile.)

kolloch · 2020-05-17T09:03:21Z

To whom it may concern: I copied the relevant module/package files from this PR to my nur-packages repo so that you can more easily use this PR without patching your nixpkgs. Like this PR, it depends on prosody changes on nixpkgs-unstable.

There is also a sample config that works with recent updates of this PR.

[The nur-packages repo @mmilata had some problems.]

rnhmjoj · 2020-05-17T20:38:06Z

Regarding adding a certificate in firefox, I think the only way is to do something like

nix run nixpkgs.nssTools -c certutil -A -n "name" -t "TC,," -d sql:$HOME/.pki/nssdb -i name.pem

Though, it would be good if someone could figure how to point firefox at the system store: it's still an open issue.

bachp · 2020-06-14T12:44:40Z

Is somebody still working on this?

mmilata · 2020-06-14T21:54:01Z

@bachp I don't have the motivation to work on this any more, at least not anytime soon. Apologies to everyone. Feel free to reuse expressions from this PR.

IIRC the main thing that is missing is LetsEncrypt support for Prosody<->{jicofo,videobridge} certificates.

Here's OCR-enabled test of video functionality that doesn't work reliably.

JosephLucas · 2020-06-15T06:32:49Z

Thanks for your work @mmilata, using a modified version of @kolloch nur I made jitsi work fine. I wish that this PR will soon be completed and merged.

makefu · 2020-06-15T06:58:55Z

Can we have a MVP (with some documentation to get the thing working) and have new features add as Pull Requests?
It would be fantastic to have jitisi as module in nixpkgs!

ghost · 2020-07-01T11:02:57Z

Thanks to everyone who contributed to this. Some of my friends and I use it since a while for socializing 😄

I have one small improvement request: The nginx config is based off the manual install guide, while the Debian packages contain a completely different nginx config. The Debian config allows for "-" characters in room names, which is required when using the Matrix/Riot integration, because that generates room names with "-" characters. It would be great to change to a nginx config based on the Debian package.

ghost · 2020-07-01T11:06:38Z

nixos/modules/services/web-apps/jitsi-meet.nix

+        locations."/http-bind" = {
+          proxyPass = "http://localhost:5280/http-bind";
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;


This header is set twice on systems where the recommendedProxySettings are enabled. Not sure if it is a problem, but it might be nicer to either not use the proxyPass attribute, or enable recommendedProxySettings instead of setting it in extraConfig.

ghost · 2020-07-01T11:09:52Z

I agree with makefu that feature / improvement requests should not keep this module from being included in nixpkgs. I'm generally interested in continuing this PR up to the point where it can be merged as a minimum viable product, but I'm not interested in maintaining the package and module long-term, so if anyone is up to that task feel free to contact me so we can make it work.

ghost · 2020-07-06T15:25:06Z

FYI: I started a second try with #92468

mmilata mentioned this pull request Mar 19, 2020

Packaging request: Jitsi Meet #82805

Closed

ofborg bot added 6.topic: nixos 8.has: module (update) 8.has: package (new) 11.by: package-maintainer 10.rebuild-darwin: 1-10 10.rebuild-linux: 1-10 labels Mar 19, 2020

mmilata force-pushed the jitsi-meet branch from c7743d3 to 56a1f8b Compare March 19, 2020 14:44

mmilata marked this pull request as ready for review March 19, 2020 14:45

mmilata requested a review from infinisil as a code owner March 19, 2020 14:45

mmilata force-pushed the jitsi-meet branch from 56a1f8b to 3a3bc4e Compare March 19, 2020 20:23

danielfullmer reviewed Mar 19, 2020

View reviewed changes

nixos/tests/jitsi-meet.nix Show resolved Hide resolved

mmilata force-pushed the jitsi-meet branch from 3a3bc4e to 2fadf86 Compare March 19, 2020 21:51

jluttine reviewed Mar 21, 2020

View reviewed changes

nixos/modules/services/networking/jitsi-meet.nix Outdated Show resolved Hide resolved

andir reviewed Mar 21, 2020

View reviewed changes

mmilata force-pushed the jitsi-meet branch from 2fadf86 to 9d515da Compare March 22, 2020 17:04

mmilata force-pushed the jitsi-meet branch 2 times, most recently from 4932002 to 124d159 Compare March 22, 2020 22:40

bachp approved these changes Apr 27, 2020

View reviewed changes

mmilata force-pushed the jitsi-meet branch from 7e2020e to b16c30d Compare April 29, 2020 22:54

flokli reviewed Apr 30, 2020

View reviewed changes

nixos/modules/services/web-apps/jitsi-meet.nix Show resolved Hide resolved

mmilata mentioned this pull request May 3, 2020

nixos/prosody: add MUC extraConfig + fixes #86649

Merged

10 tasks

mmilata force-pushed the jitsi-meet branch from b16c30d to 7e4960a Compare May 4, 2020 18:36

mmilata force-pushed the jitsi-meet branch from 7e4960a to 9657c27 Compare May 11, 2020 23:47

mmilata added 6 commits June 14, 2020 21:25

jitsi-videobridge: init at 2.1-202-g5f9377b9

be50d18

jicofo: init at 1.0-589

9ad5197

jitsi-meet: init at 1.0.4627

be1b52d

nixos/jitsi-videobridge: init

5b364ff

nixos/jicofo: init

96da578

nixos/jitsi-meet: init

8e8a3d7

mmilata force-pushed the jitsi-meet branch from 9657c27 to 8e8a3d7 Compare June 14, 2020 21:37

ghost reviewed Jul 1, 2020

View reviewed changes

mmilata closed this Jul 2, 2020

nixos/jitsi-meet: init #82920

nixos/jitsi-meet: init #82920

Conversation

mmilata commented Mar 19, 2020 • edited

How to test

Motivation for this change

Things done

veprbl commented Mar 19, 2020

jluttine commented Mar 19, 2020

mmilata commented Mar 19, 2020

nixos-discourse commented Mar 19, 2020

nixos-discourse commented Mar 20, 2020

jluttine commented Mar 21, 2020 • edited

mmilata commented Mar 21, 2020 • edited

jluttine commented Mar 21, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mmilata commented Mar 22, 2020

mmilata commented Mar 22, 2020

nixos-discourse commented Mar 24, 2020

omgwtflaserguns commented Mar 27, 2020

nixos-discourse commented Apr 28, 2020

mmilata commented Apr 29, 2020 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mmilata commented May 4, 2020

mmilata commented May 4, 2020

bjornfor commented May 4, 2020

kolloch commented May 17, 2020

rnhmjoj commented May 17, 2020 • edited

bachp commented Jun 14, 2020 • edited

mmilata commented Jun 14, 2020

JosephLucas commented Jun 15, 2020

makefu commented Jun 15, 2020

ghost commented Jul 1, 2020

Choose a reason for hiding this comment

ghost commented Jul 1, 2020

ghost commented Jul 6, 2020

mmilata commented Mar 19, 2020 •

edited

jluttine commented Mar 21, 2020 •

edited

mmilata commented Mar 21, 2020 •

edited

mmilata commented Apr 29, 2020 •

edited

rnhmjoj commented May 17, 2020 •

edited

bachp commented Jun 14, 2020 •

edited