From 67e261beb53bc45968647ddd64df53d480862377 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Erin=E2=80=84Yuki=E2=80=89Schlarb?= Date: Mon, 30 Oct 2023 20:35:39 +0000 Subject: [PATCH 1/6] jitsi-meet: Set internal MUC options set in official Docker image --- nixos/modules/services/web-apps/jitsi-meet.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix index 39aa7379c0ed..6018c0978149 100644 --- a/nixos/modules/services/web-apps/jitsi-meet.nix +++ b/nixos/modules/services/web-apps/jitsi-meet.nix @@ -232,7 +232,7 @@ in extraConfig = '' restrict_room_creation = true storage = "memory" - admins = { "focus@auth.${cfg.hostName}" } + admins = { "focus@auth.${cfg.hostName}", "jvb@auth.${cfg.hostName}" } ''; } { From 61cf88212df30c8758a621086b9dafd06e7a551f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Erin=E2=80=84Yuki=E2=80=89Schlarb?= Date: Fri, 12 Jan 2024 22:35:20 +0100 Subject: [PATCH 2/6] jitsi-videobridge: Set configurable default NAT harvester address to make the service work behind NAT without additional manual configuration --- .../services/networking/jitsi-videobridge.nix | 33 +++++++++++++++---- 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/nixos/modules/services/networking/jitsi-videobridge.nix b/nixos/modules/services/networking/jitsi-videobridge.nix index 8c468e121299..14eb64eae253 100644 --- a/nixos/modules/services/networking/jitsi-videobridge.nix +++ b/nixos/modules/services/networking/jitsi-videobridge.nix @@ -156,7 +156,7 @@ in default = null; example = "192.168.1.42"; description = '' - Local address when running behind NAT. + Local address to assume when running behind NAT. ''; }; @@ -165,7 +165,25 @@ in default = null; example = "1.2.3.4"; description = '' - Public address when running behind NAT. + Public address to assume when running behind NAT. + ''; + }; + + harvesterAddresses = lib.mkOption { + type = listOf str; + default = [ + "stunserver.stunprotocol.org:3478" + "stun.framasoft.org:3478" + "meet-jit-si-turnrelay.jitsi.net:443" + ]; + example = []; + description = '' + Addresses of public STUN services to use to automatically find + the public and local addresses of this Jitsi-Videobridge instance + without the need for manual configuration. + + This option is ignored if {option}`services.jitsi-videobridge.nat.localAddress` + and {option}`services.jitsi-videobridge.nat.publicAddress` are set. ''; }; }; @@ -199,10 +217,13 @@ in config = lib.mkIf cfg.enable { users.groups.jitsi-meet = {}; - services.jitsi-videobridge.extraProperties = lib.optionalAttrs (cfg.nat.localAddress != null) { - "org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS" = cfg.nat.localAddress; - "org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS" = cfg.nat.publicAddress; - }; + services.jitsi-videobridge.extraProperties = + if (cfg.nat.localAddress != null) then { + "org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS" = cfg.nat.localAddress; + "org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS" = cfg.nat.publicAddress; + } else { + "org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES" = lib.concatStringsSep "," cfg.nat.harvesterAddresses; + }; systemd.services.jitsi-videobridge2 = let jvbProps = { From 9e8b3f97ccff9b1523fd033761c89ab2f226b98f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Erin=E2=80=84Yuki=E2=80=89Schlarb?= Date: Fri, 12 Jan 2024 22:44:18 +0100 Subject: [PATCH 3/6] jitsi-meet: Also forward Excalidraw connections when using Caddy as web server --- nixos/modules/services/web-apps/jitsi-meet.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix index 6018c0978149..8d75bd6af6ff 100644 --- a/nixos/modules/services/web-apps/jitsi-meet.nix +++ b/nixos/modules/services/web-apps/jitsi-meet.nix @@ -513,7 +513,11 @@ in cp ${overrideJs "${pkgs.jitsi-meet}/interface_config.js" "interfaceConfig" cfg.interfaceConfig ""} $out/interface_config.js cp ./libs/external_api.min.js $out/external_api.js ''; - in '' + in (optionalString cfg.excalidraw.enable '' + handle /socket.io/ { + reverse_proxy 127.0.0.1:${toString cfg.excalidraw.port} + } + '') + '' handle /http-bind { header Host ${cfg.hostName} reverse_proxy 127.0.0.1:5280 From 7ab8f255b948b668a01039c0b860ff481d4a7409 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Erin=E2=80=84Yuki=E2=80=89Schlarb?= Date: Fri, 12 Jan 2024 23:03:56 +0100 Subject: [PATCH 4/6] jitsi-meet: Restrict jitsi-excalidraw systemd service to the minimum requried --- .../modules/services/web-apps/jitsi-meet.nix | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix index 8d75bd6af6ff..51f721327ef9 100644 --- a/nixos/modules/services/web-apps/jitsi-meet.nix +++ b/nixos/modules/services/web-apps/jitsi-meet.nix @@ -444,7 +444,29 @@ in Type = "simple"; ExecStart = "${pkgs.jitsi-excalidraw}/bin/jitsi-excalidraw-backend"; Restart = "on-failure"; + + DynamicUser = true; Group = "jitsi-meet"; + CapabilityBoundingSet = ""; + NoNewPrivileges = true; + ProtectSystem = "strict"; + ProtectClock = true; + ProtectHome = true; + ProtectProc = true; + ProtectKernelLogs = true; + PrivateTmp = true; + PrivateDevices = true; + PrivateUsers = true; + ProtectHostname = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectControlGroups = true; + RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + LockPersonality = true; + RestrictRealtime = true; + RestrictSUIDSGID = true; + SystemCallFilter = [ "@system-service @pkey" "~@privileged" ]; }; }; From 56581588c3711d36b79f4e23e6f1e24f01746ebc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Erin=E2=80=84Yuki=E2=80=89Schlarb?= Date: Fri, 12 Jan 2024 23:21:47 +0100 Subject: [PATCH 5/6] jitsi-meet: Add option to disable Prosody services not used by Jitsi Meet The default Prosody config assumes that Prosody will be used as a federated XMPP server, while the usecase for Jitsi Meet is much narrower. --- nixos/modules/services/web-apps/jitsi-meet.md | 8 ++++++ .../modules/services/web-apps/jitsi-meet.nix | 25 +++++++++++++++++-- 2 files changed, 31 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-apps/jitsi-meet.md b/nixos/modules/services/web-apps/jitsi-meet.md index 577f82e315be..705cf69274ca 100644 --- a/nixos/modules/services/web-apps/jitsi-meet.md +++ b/nixos/modules/services/web-apps/jitsi-meet.md @@ -19,6 +19,13 @@ A minimal configuration using Let's Encrypt for TLS certificates looks like this } ``` +Jitsi Meet depends on the Prosody XMPP server only for message passing from +the web browser while the default Prosody configuration is intended for use +with standalone XMPP clients and XMPP federation. If you only use Prosody as +a backend for Jitsi Meet it is therefore recommended to also enable +{option}`services.jitsi-meet.prosody.lockdown` option to disable unnecessary +Prosody features such as federation or the file proxy. + ## Configuration {#module-services-jitsi-configuration} Here is the minimal configuration with additional configurations: @@ -27,6 +34,7 @@ Here is the minimal configuration with additional configurations: services.jitsi-meet = { enable = true; hostName = "jitsi.example.com"; + prosody.lockdown = true; config = { enableWelcomePage = false; prejoinPageEnabled = true; diff --git a/nixos/modules/services/web-apps/jitsi-meet.nix b/nixos/modules/services/web-apps/jitsi-meet.nix index 51f721327ef9..f880691b55e9 100644 --- a/nixos/modules/services/web-apps/jitsi-meet.nix +++ b/nixos/modules/services/web-apps/jitsi-meet.nix @@ -175,11 +175,26 @@ in prosody.enable = mkOption { type = bool; default = true; + example = false; description = '' Whether to configure Prosody to relay XMPP messages between Jitsi Meet components. Turn this off if you want to configure it manually. ''; }; + prosody.lockdown = mkOption { + type = bool; + default = false; + example = true; + description = '' + Whether to disable Prosody features not needed by Jitsi Meet. + + The default Prosody configuration assumes that it will be used as a + general-purpose XMPP server rather than as a companion service for + Jitsi Meet. This option reconfigures Prosody to only listen on + localhost without support for TLS termination, XMPP federation or + the file transfer proxy. + ''; + }; excalidraw.enable = mkEnableOption "Excalidraw collaboration backend for Jitsi"; excalidraw.port = mkOption { @@ -211,7 +226,10 @@ in smacks = mkDefault true; tls = mkDefault true; websocket = mkDefault true; + proxy65 = mkIf cfg.prosody.lockdown (mkDefault false); }; + httpInterfaces = mkIf cfg.prosody.lockdown (mkDefault [ "127.0.0.1" ]); + httpsPorts = mkIf cfg.prosody.lockdown (mkDefault []); muc = [ { domain = "conference.${cfg.hostName}"; @@ -300,7 +318,7 @@ in muc_component = "conference.${cfg.hostName}" breakout_rooms_component = "breakout.${cfg.hostName}" '') - (mkBefore '' + (mkBefore ('' muc_mapper_domain_base = "${cfg.hostName}" cross_domain_websocket = true; @@ -310,7 +328,10 @@ in "focus@auth.${cfg.hostName}", "jvb@auth.${cfg.hostName}" } - '') + '' + optionalString cfg.prosody.lockdown '' + c2s_interfaces = { "127.0.0.1" }; + modules_disabled = { "s2s" }; + '')) ]; virtualHosts.${cfg.hostName} = { enabled = true; From 40c1971b82c361506e2404b6d8c42de351d6c1b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Erin=E2=80=84Yuki=E2=80=89Schlarb?= Date: Sat, 13 Jan 2024 16:14:50 +0100 Subject: [PATCH 6/6] jitsi-meet: Only run smoke test on Linux MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The smoke test requires running Jitsi Videobridge and Jicofo, which are Linux-only and don’t work on macos. --- pkgs/servers/web-apps/jitsi-meet/default.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkgs/servers/web-apps/jitsi-meet/default.nix b/pkgs/servers/web-apps/jitsi-meet/default.nix index 32d7249ffc6a..c60ac20cea44 100644 --- a/pkgs/servers/web-apps/jitsi-meet/default.nix +++ b/pkgs/servers/web-apps/jitsi-meet/default.nix @@ -18,7 +18,8 @@ stdenv.mkDerivation rec { runHook postInstall ''; - passthru.tests = { + # Test requires running Jitsi Videobridge and Jicofo which are Linux-only + passthru.tests = lib.optionalAttrs stdenv.isLinux { single-host-smoke-test = nixosTests.jitsi-meet; };