|
| 1 | +{{ $ENABLE_AUTH := .Env.ENABLE_AUTH | default "0" | toBool -}} |
| 2 | +{{ $ENABLE_GUEST_DOMAIN := and $ENABLE_AUTH (.Env.ENABLE_GUESTS | default "0" | toBool) -}} |
| 3 | +{{ $ENABLE_RATE_LIMITS := .Env.PROSODY_ENABLE_RATE_LIMITS | default "0" | toBool -}} |
| 4 | +{{ $ENABLE_SUBDOMAINS := .Env.ENABLE_SUBDOMAINS | default "true" | toBool -}} |
| 5 | +{{ $ENABLE_XMPP_WEBSOCKET := .Env.ENABLE_XMPP_WEBSOCKET | default "1" | toBool -}} |
| 6 | +{{ $JIBRI_RECORDER_USER := .Env.JIBRI_RECORDER_USER | default "recorder" -}} |
| 7 | +{{ $JIGASI_TRANSCRIBER_USER := .Env.JIGASI_TRANSCRIBER_USER | default "transcriber" -}} |
| 8 | +{{ $LIMIT_MESSAGES_CHECK_TOKEN := .Env.PROSODY_LIMIT_MESSAGES_CHECK_TOKEN | default "0" | toBool -}} |
| 9 | +{{ $RATE_LIMIT_LOGIN_RATE := .Env.PROSODY_RATE_LIMIT_LOGIN_RATE | default "3" -}} |
| 10 | +{{ $RATE_LIMIT_SESSION_RATE := .Env.PROSODY_RATE_LIMIT_SESSION_RATE | default "200" -}} |
| 11 | +{{ $RATE_LIMIT_TIMEOUT := .Env.PROSODY_RATE_LIMIT_TIMEOUT | default "60" -}} |
| 12 | +{{ $RATE_LIMIT_ALLOW_RANGES := .Env.PROSODY_RATE_LIMIT_ALLOW_RANGES | default "10.0.0.0/8" -}} |
| 13 | +{{ $RATE_LIMIT_CACHE_SIZE := .Env.PROSODY_RATE_LIMIT_CACHE_SIZE | default "10000" -}} |
| 14 | +{{ $REGION_NAME := .Env.PROSODY_REGION_NAME | default "default" -}} |
| 15 | +{{ $RELEASE_NUMBER := .Env.RELEASE_NUMBER | default "" -}} |
| 16 | +{{ $SHARD_NAME := .Env.SHARD | default "default" -}} |
| 17 | +{{ $S2S_PORT := .Env.PROSODY_S2S_PORT | default "5269" -}} |
| 18 | +{{ $TRUSTED_PROXIES := .Env.PROSODY_TRUSTED_PROXIES | default "127.0.0.1,::1" -}} |
| 19 | +{{ $TRUSTED_PROXY_LIST := splitList "," $TRUSTED_PROXIES -}} |
| 20 | +{{ $TURN_HOST := .Env.TURN_HOST | default "" -}} |
| 21 | +{{ $TURN_HOSTS := splitList "," $TURN_HOST -}} |
| 22 | +{{ $TURN_PORT := .Env.TURN_PORT | default "443" -}} |
| 23 | +{{ $TURN_TRANSPORT := .Env.TURN_TRANSPORT | default "tcp" -}} |
| 24 | +{{ $TURN_TRANSPORTS := splitList "," $TURN_TRANSPORT -}} |
| 25 | +{{ $TURNS_HOST := .Env.TURNS_HOST | default "" -}} |
| 26 | +{{ $TURNS_HOSTS := splitList "," $TURNS_HOST -}} |
| 27 | +{{ $TURNS_PORT := .Env.TURNS_PORT | default "443" -}} |
| 28 | +{{ $VISITOR_INDEX := .Env.PROSODY_VISITOR_INDEX | default "0" -}} |
| 29 | +{{ $VISITORS_MUC_PREFIX := .Env.PROSODY_VISITORS_MUC_PREFIX | default "muc" -}} |
| 30 | +{{ $VISITORS_MAX_VISITORS_PER_NODE := .Env.VISITORS_MAX_VISITORS_PER_NODE | default "250" }} |
| 31 | +{{ $VISITORS_XMPP_DOMAIN := .Env.VISITORS_XMPP_DOMAIN | default "meet.jitsi" -}} |
| 32 | +{{ $XMPP_AUTH_DOMAIN := .Env.XMPP_AUTH_DOMAIN | default "auth.meet.jitsi" -}} |
| 33 | +{{ $XMPP_DOMAIN := .Env.XMPP_DOMAIN | default "meet.jitsi" -}} |
| 34 | +{{ $XMPP_GUEST_DOMAIN := .Env.XMPP_GUEST_DOMAIN | default "guest.meet.jitsi" -}} |
| 35 | +{{ $XMPP_MUC_DOMAIN := .Env.XMPP_MUC_DOMAIN | default "muc.meet.jitsi" -}} |
| 36 | +{{ $XMPP_MUC_DOMAIN_PREFIX := (split "." $XMPP_MUC_DOMAIN)._0 -}} |
| 37 | +{{ $XMPP_SERVER := .Env.XMPP_SERVER | default "xmpp.meet.jitsi" -}} |
| 38 | +{{ $XMPP_SERVER_S2S_PORT := .Env.XMPP_SERVER_S2S_PORT | default $S2S_PORT -}} |
| 39 | +{{ $XMPP_RECORDER_DOMAIN := .Env.XMPP_RECORDER_DOMAIN | default "recorder.meet.jitsi" -}} |
| 40 | + |
| 41 | +plugin_paths = { "/prosody-plugins/", "/prosody-plugins-custom" } |
| 42 | + |
| 43 | +muc_mapper_domain_base = "v{{ $VISITOR_INDEX }}.{{ $VISITORS_XMPP_DOMAIN }}"; |
| 44 | +muc_mapper_domain_prefix = "{{ $XMPP_MUC_DOMAIN_PREFIX }}"; |
| 45 | + |
| 46 | +http_default_host = "v{{ $VISITOR_INDEX }}.{{ $VISITORS_XMPP_DOMAIN }}" |
| 47 | + |
| 48 | +{{ if .Env.TURN_CREDENTIALS -}} |
| 49 | +external_service_secret = "{{.Env.TURN_CREDENTIALS}}"; |
| 50 | +{{- end }} |
| 51 | + |
| 52 | +{{ if or .Env.TURN_HOST .Env.TURNS_HOST -}} |
| 53 | +external_services = { |
| 54 | + {{ if $TURN_HOST -}} |
| 55 | + {{- range $idx1, $host := $TURN_HOSTS -}} |
| 56 | + {{- range $idx2, $transport := $TURN_TRANSPORTS -}} |
| 57 | + {{- if or $idx1 $idx2 -}},{{- end }} |
| 58 | + { type = "turn", host = "{{ $host }}", port = {{ $TURN_PORT }}, transport = "{{ $transport }}", secret = true, ttl = 86400, algorithm = "turn" } |
| 59 | + {{- end -}} |
| 60 | + {{- end -}} |
| 61 | + {{- end -}} |
| 62 | + |
| 63 | + {{- if $TURNS_HOST -}} |
| 64 | + {{- range $idx, $host := $TURNS_HOSTS -}} |
| 65 | + {{- if or $TURN_HOST $idx -}},{{- end }} |
| 66 | + { type = "turns", host = "{{ $host }}", port = {{ $TURNS_PORT }}, transport = "tcp", secret = true, ttl = 86400, algorithm = "turn" } |
| 67 | + {{- end }} |
| 68 | + {{- end }} |
| 69 | +}; |
| 70 | +{{- end }} |
| 71 | + |
| 72 | +main_domain = '{{ $XMPP_DOMAIN }}'; |
| 73 | + |
| 74 | +-- https://prosody.im/doc/modules/mod_smacks |
| 75 | +smacks_max_unacked_stanzas = 5; |
| 76 | +smacks_hibernation_time = 60; |
| 77 | +-- this is dropped in 0.12 |
| 78 | +smacks_max_hibernated_sessions = 1; |
| 79 | +smacks_max_old_sessions = 1; |
| 80 | + |
| 81 | +unlimited_jids = { "focus@{{ $XMPP_AUTH_DOMAIN }}" } |
| 82 | +limits = { |
| 83 | + c2s = { |
| 84 | + rate = "512kb/s"; |
| 85 | + }; |
| 86 | +} |
| 87 | + |
| 88 | +authentication = 'internal_hashed' |
| 89 | +storage = 'internal' |
| 90 | + |
| 91 | +consider_websocket_secure = true; |
| 92 | +consider_bosh_secure = true; |
| 93 | +bosh_max_inactivity = 60; |
| 94 | + |
| 95 | +trusted_proxies = { |
| 96 | +{{ range $index, $proxy := $TRUSTED_PROXY_LIST }} |
| 97 | + "{{ $proxy }}"; |
| 98 | +{{ end }} |
| 99 | +} |
| 100 | + |
| 101 | +-- this is added to make certs_s2soutinjection work |
| 102 | +s2sout_override = { |
| 103 | + ["{{ $XMPP_MUC_DOMAIN }}"] = "tcp://{{ $XMPP_SERVER }}:{{ $XMPP_SERVER_S2S_PORT }}"; -- needed for visitors to send messages to main room |
| 104 | + ["{{ $XMPP_DOMAIN }}"] = "tcp://{{ $XMPP_SERVER }}:{{ $XMPP_SERVER_S2S_PORT }}"; |
| 105 | + ["visitors.{{ $XMPP_DOMAIN }}"] = "tcp://{{ $XMPP_SERVER }}:{{ $XMPP_SERVER_S2S_PORT }}"; |
| 106 | +{{ if $ENABLE_GUEST_DOMAIN -}} |
| 107 | + ["{{ $XMPP_GUEST_DOMAIN }}"] = "tcp://{{ $XMPP_SERVER }}:{{ $XMPP_SERVER_S2S_PORT }}"; |
| 108 | +{{ end -}} |
| 109 | +} |
| 110 | + |
| 111 | +muc_limit_messages_count = 10; |
| 112 | +muc_limit_messages_check_token = {{ $LIMIT_MESSAGES_CHECK_TOKEN }}; |
| 113 | + |
| 114 | +----------- Virtual hosts ----------- |
| 115 | +VirtualHost 'v{{ $VISITOR_INDEX }}.{{ $VISITORS_XMPP_DOMAIN }}' |
| 116 | + authentication = 'jitsi-anonymous' |
| 117 | + ssl = { |
| 118 | + key = "/config/certs/v{{ $VISITOR_INDEX }}.{{ $VISITORS_XMPP_DOMAIN }}.key"; |
| 119 | + certificate = "/config/certs/v{{ $VISITOR_INDEX }}.{{ $VISITORS_XMPP_DOMAIN }}.crt"; |
| 120 | + } |
| 121 | + modules_enabled = { |
| 122 | + 'bosh'; |
| 123 | + 'ping'; |
| 124 | + "external_services"; |
| 125 | + {{ if $ENABLE_XMPP_WEBSOCKET -}} |
| 126 | + "websocket"; |
| 127 | + "smacks"; -- XEP-0198: Stream Management |
| 128 | + {{ end -}} |
| 129 | + {{ if .Env.XMPP_MODULES }} |
| 130 | + "{{ join "\";\n\"" (splitList "," .Env.XMPP_MODULES) }}"; |
| 131 | + {{ end }} |
| 132 | + } |
| 133 | + main_muc = '{{ $VISITORS_MUC_PREFIX }}.v{{ $VISITOR_INDEX }}.{{ $VISITORS_XMPP_DOMAIN }}'; |
| 134 | + shard_name = "{{ $SHARD_NAME }}" |
| 135 | + region_name = "{{ $REGION_NAME }}" |
| 136 | + release_number = "{{ $RELEASE_NUMBER }}" |
| 137 | + |
| 138 | + |
| 139 | +VirtualHost '{{ $XMPP_AUTH_DOMAIN}}' |
| 140 | + modules_enabled = { |
| 141 | + 'limits_exception'; |
| 142 | + 'ping'; |
| 143 | + } |
| 144 | + authentication = 'internal_hashed' |
| 145 | + |
| 146 | +Component '{{ $VISITORS_MUC_PREFIX }}.v{{ $VISITOR_INDEX }}.{{ $VISITORS_XMPP_DOMAIN }}' 'muc' |
| 147 | + storage = 'memory' |
| 148 | + muc_room_cache_size = 10000 |
| 149 | + restrict_room_creation = true |
| 150 | + modules_enabled = { |
| 151 | + "muc_hide_all"; |
| 152 | + "muc_meeting_id"; |
| 153 | + 'fmuc'; |
| 154 | + 's2s_bidi'; |
| 155 | + 's2s_whitelist'; |
| 156 | + 's2sout_override'; |
| 157 | + 'muc_max_occupants'; |
| 158 | + "muc_limit_messages"; |
| 159 | + {{ if $ENABLE_SUBDOMAINS -}} |
| 160 | + "muc_domain_mapper"; |
| 161 | + {{ end -}} |
| 162 | + {{ if $ENABLE_RATE_LIMITS -}} |
| 163 | + "muc_rate_limit"; |
| 164 | + "rate_limit"; |
| 165 | + {{ end -}} |
| 166 | + {{ if .Env.XMPP_MUC_MODULES -}} |
| 167 | + "{{ join "\";\n\"" (splitList "," .Env.XMPP_MUC_MODULES) }}"; |
| 168 | + {{ end -}} |
| 169 | + } |
| 170 | + muc_room_default_presence_broadcast = { |
| 171 | + visitor = false; |
| 172 | + participant = true; |
| 173 | + moderator = true; |
| 174 | + }; |
| 175 | + muc_room_locking = false |
| 176 | + muc_room_default_public_jids = true |
| 177 | + muc_max_occupants = {{ $VISITORS_MAX_VISITORS_PER_NODE}} |
| 178 | + muc_access_whitelist = { |
| 179 | + "{{ $XMPP_DOMAIN }}"; |
| 180 | + } |
| 181 | + |
| 182 | + {{ if $ENABLE_RATE_LIMITS -}} |
| 183 | + -- Max allowed join/login rate in events per second. |
| 184 | + rate_limit_login_rate = {{ $RATE_LIMIT_LOGIN_RATE }}; |
| 185 | + -- The rate to which sessions from IPs exceeding the join rate will be limited, in bytes per second. |
| 186 | + rate_limit_session_rate = {{ $RATE_LIMIT_SESSION_RATE }}; |
| 187 | + -- The time in seconds, after which the limit for an IP address is lifted. |
| 188 | + rate_limit_timeout = {{ $RATE_LIMIT_TIMEOUT }}; |
| 189 | + -- List of regular expressions for IP addresses that are not limited by this module. |
| 190 | + rate_limit_whitelist = { |
| 191 | + "127.0.0.1"; |
| 192 | + {{ range $index, $cidr := (splitList "," $RATE_LIMIT_ALLOW_RANGES) -}} |
| 193 | + "{{ $cidr }}"; |
| 194 | + {{ end -}} |
| 195 | + }; |
| 196 | + |
| 197 | + rate_limit_whitelist_jids = { |
| 198 | + "{{ $JIBRI_RECORDER_USER }}@{{ $XMPP_RECORDER_DOMAIN }}", |
| 199 | + "{{ $JIGASI_TRANSCRIBER_USER }}@{{ $XMPP_RECORDER_DOMAIN }}" |
| 200 | + } |
| 201 | + {{ end -}} |
| 202 | + |
| 203 | + -- The size of the cache that saves state for IP addresses |
| 204 | + rate_limit_cache_size = {{ $RATE_LIMIT_CACHE_SIZE }}; |
| 205 | + |
| 206 | + muc_rate_joins = 30; |
| 207 | + {{ if .Env.XMPP_MUC_CONFIGURATION -}} |
| 208 | + {{ join "\n" (splitList "," .Env.XMPP_MUC_CONFIGURATION) }} |
| 209 | + {{ end -}} |
0 commit comments