Can't join to meeting (strict-origin-when-cross-origin)

[NikitaSTets]

Hi All, trying to run it locally by using option 4
use those values

set publicUrl, publicIP, useHostNetwork
My local ipV4 address is 192.168.0.10

but it shows me strict-origin-when-cross-origin
nginx
What could be wrong?

"jicofo and jvb issue"

DNS lookup exception for first-release-prosody.default.svc.cluster.local' exception='java.net.UnknownHostException: first-release-prosody.default.svc.cluster.local')
2024-08-19 21:11:19     at org.jivesoftware.smack.SmackException$EndpointConnectionException.from(SmackException.java:334)
2024-08-19 21:11:19     at org.jivesoftware.smack.tcp.XMPPTCPConnection.connectUsingConfiguration(XMPPTCPConnection.java:664)
2024-08-19 21:11:19     at org.jivesoftware.smack.tcp.XMPPTCPConnection.connectInternal(XMPPTCPConnection.java:849)
2024-08-19 21:11:19     at org.jivesoftware.smack.AbstractXMPPConnection.connect(AbstractXMPPConnection.java:526)
2024-08-19 21:11:19     at org.jitsi.xmpp.mucclient.MucClient.lambda$getConnectAndLoginCallable$9(MucClient.java:635)
2024-08-19 21:11:19     at org.jitsi.retry.RetryStrategy$TaskRunner.run(RetryStrategy.java:167)
2024-08-19 21:11:19     at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
2024-08-19 21:11:19     at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
2024-08-19 21:11:19     at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
2024-08-19 21:11:19     at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
2024-08-19 21:11:19     at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
2024-08-19 21:11:19     at java.base/java.lang.Thread.run(Thread.java:840)

prosody is running and exposed

values.yaml

# Default values for jitsi-meet.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

global:
  # Set your cluster's DNS domain here.
  # "cluster.local" should work for most environments.
  # Set to "" to disable the use of FQDNs (default in older chart versions).
  clusterDomain: cluster.local
  podLabels: {}
  podAnnotations: {}
  releaseSecretsOverride:
    enabled: false
    #Support environment variables from pre-created secrets, such as 1Password operator
    #extraEnvFrom:
    #  - secretRef:
    #      name: '{{ include "prosody.fullname" . }}-overrides'
    #      optional: true

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

enableAuth: false
enableGuests: true
# Where Jitsi Web UI is made available
# such as jitsi.example.com
publicURL: "127.0.0.1:8080"

tz: Europe/Amsterdam

image:
  pullPolicy: IfNotPresent

## WebSocket configuration:
#
#  Both Colibri and XMPP WebSockets are disabled by default,
#  since some LoadBalancer / Reverse Proxy setups can't pass
#  WebSocket connections properly, which might result in breakage
#  for some clients.
#
#  Enable both Colibri and XMPP WebSockets to replicate the current
#  upstream `meet.jit.si` setup. Keep both disabled to replicate
#  older setups which might be more compatible in some cases.
websockets:
  ## Colibri (JVB signalling):
  colibri:
    enabled: false
  ## XMPP (Prosody signalling):
  xmpp:
    enabled: false

web:
  replicaCount: 1
  image:
    repository: jitsi/web

  ## Override the image-provided configuration files:
  #  See https://github.com/jitsi/docker-jitsi-meet/tree/master/web/rootfs
  custom:
    contInit:
      _10_config: ""
    defaults:
      _default: ""
      _ffdhe2048_txt: ""
      _interface_config_js: ""
      _meet_conf: ""
      _nginx_conf: ""
      _settings_config_js: ""
      _ssl_conf: ""
      _system_config_js: ""
    configs:
      _custom_interface_config_js: ""
      _custom_config_js: ""

  extraEnvs: {}
  service:
    type: ClusterIP
    port: 80
    ## If you want to expose the Jitsi Web service directly
    #  (bypassing the Ingress Controller), use this:
    #
    # type: NodePort
    # nodePort: 30580
    # port: 80
    externalIPs: []

  ingress:
    enabled: false
    # ingressClassName: "nginx-ingress-0"
    annotations: {}
      # kubernetes.io/tls-acme: "true"
    hosts:
    - host: jitsi.local
      paths: ['/']
    tls: []
    #  - secretName: jitsi-web-certificate
    #    hosts:
    #      - jitsi.local

  # Useful for ingresses that don't support http-to-https redirect by themself, (namely: GKE),
  httpRedirect: false

  # When tls-termination by the ingress is not wanted, enable this and set web.service.type=Loadbalancer
  httpsEnabled: false

  ## Resolver IP for nginx.
  #
  #  Starting with version `stable-8044`, the web container can
  #  auto-detect the nameserver from /etc/resolv.conf.
  #  Use this option if you want to override the nameserver IP.
  #
  # resolverIP: 10.43.0.10

  livenessProbe:
    httpGet:
      path: /
      port: 80
  readinessProbe:
    httpGet:
      path: /
      port: 80

  podLabels: {}
  podAnnotations: {}
  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   cpu: 100m
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  nodeSelector: {}

  tolerations: []

  affinity: {}

jicofo:
  replicaCount: 1
  image:
    repository: jitsi/jicofo

  ## Override the image-provided configuration files:
  #  See https://github.com/jitsi/docker-jitsi-meet/tree/master/jicofo/rootfs
  custom:
    contInit:
      _10_config: ""
    defaults:
      _jicofo_conf: ""
      _logging_properties: ""

  xmpp:
    password:
    componentSecret:

  livenessProbe:
    tcpSocket:
      port: 8888

  readinessProbe:
    tcpSocket:
      port: 8888

  podLabels: {}
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  extraEnvs: {}

jvb:
  replicaCount: 1
  image:
    repository: jitsi/jvb

  xmpp:
    user: jvb
    password:

  ## Set public IP addresses to be advertised by JVB.
  #  You can specify your nodes' IP addresses,
  #  or IP addresses of proxies/LoadBalancers used for your
  #  Jitsi Meet installation. Or both!
  #
  #  Note that only the first IP address will be used for legacy
  #  `DOCKER_HOST_ADDRESS` environment variable.
  #
  publicIPs:
    - 127.0.0.1
  #   - 5.6.7.8
  ## Alternative option: auto-detect Node's external IP address.
  #  Recommended for OCTO setups (with either NodePort service
  #  or hostPort enabled) where every JVB pod should announce it's
  #  own IP address only.
  useNodeIP: false
  ## Use a STUN server to help some users punch through some
  #  especially nasty NAT setups. Usually makes sense for P2P calls.
  stunServers: 'meet-jit-si-turnrelay.jitsi.net:443'
  ## Try to use the hostPort feature:
  #  (might not be supported by some clouds or CNI engines)
  useHostPort: false
  ## Use host's network namespace:
  #  (not recommended, but might help for some cases)
  useHostNetwork: true
  ## UDP transport port:
  UDPPort: 10000
  ## Use a pre-defined external port for NodePort or LoadBalancer service,
  #  if needed. Will allocate a random port from allowed range if unset.
  #  (Default NodePort range for K8s is 30000-32767)
  # nodePort: 10000
  service:
    enabled:
    type: ClusterIP
    externalTrafficPolicy: Cluster
    externalIPs: []
    ## Annotations to be added to the service (if LoadBalancer is used)
    #  An example below is needed for DigitalOcean managed k8s setups
    #  with a LoadBalancer service, so that DO's external LB can perform
    #  health checks on JVB.
    annotations: {}
      # service.beta.kubernetes.io/do-loadbalancer-healthcheck-port: "8080"
      # service.beta.kubernetes.io/do-loadbalancer-healthcheck-protocol: "tcp"
    ## Add extra ports to the service.
    #  An example below is needed for DigitalOcean managed k8s setups.
    extraPorts: []
      # - name: http-healthcheck
      #   port: 8080
      #   protocol: TCP

  breweryMuc: jvbbrewery

  livenessProbe:
    httpGet:
      path: /about/health
      port: 8080
  readinessProbe:
    httpGet:
      path: /about/health
      port: 8080

  podLabels: {}
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  extraEnvs: {}

  metrics:
    enabled: false
    image:
      repository: docker.io/systemli/prometheus-jitsi-meet-exporter
      tag: 1.2.3
      pullPolicy: IfNotPresent

    resources:
      requests:
        cpu: 10m
        memory: 16Mi
      limits:
        cpu: 20m
        memory: 32Mi

    prometheusAnnotations: false
    serviceMonitor:
      enabled: true
      selector:
        release: prometheus-operator
      interval: 10s
      # honorLabels: false

    grafanaDashboards:
      enabled: false
      labels:
        grafana_dashboard: "1"
      annotations: {}
octo:
  enabled: false


jigasi:
  ## Enabling Jigasi will allow regular SIP clients to join Jitsi meetings
  ## or nearly real-time transcription.
  enabled: false

  ## Use external Jigasi installation.
  ## This setting skips the creation of Jigasi Deployment altogether,
  ## instead creating just the config secret and enabling services.
  ## Defaults to disabled (use bundled Jigasi).
  useExternalJigasi: false

  replicaCount: 1
  image:
    repository: jitsi/jigasi

  breweryMuc: jigasibrewery

  ## jigasi XMPP user credentials:
  xmpp:
    user: jigasi
    password:

  livenessProbe:
    tcpSocket:
      port: 8788
  readinessProbe:
    tcpSocket:
      port: 8788

  podLabels: {}
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  extraEnvs: {}


jibri:
  ## Enabling Jibri will allow users to record
  ## and/or stream their meetings (e.g. to YouTube).
  enabled: false

  ## Use external Jibri installation.
  ## This setting skips the creation of Jibri Deployment altogether,
  ## instead creating just the config secret
  ## and enabling recording/streaming services.
  ## Defaults to disabled (use bundled Jibri).
  useExternalJibri: false

  ## Enable single-use mode for Jibri.
  ## With this setting enabled, every Jibri instance
  ## will become "expired" after being used once (successfully or not)
  ## and cleaned up (restarted) by Kubernetes.
  ##
  ## Note that detecting expired Jibri, restarting and registering it
  ## takes some time, so you'll have to make sure you have enough
  ## instances at your disposal.
  ## You might also want to make LivenessProbe fail faster.
  singleUseMode: false

  ## Enable recording service.
  ## Set this to true/false to enable/disable local recordings.
  ## Defaults to enabled (allow local recordings).
  recording: true

  ## Enable livestreaming service.
  ## Set this to true/false to enable/disable live streams.
  ## Defaults to disabled (livestreaming is forbidden).
  livestreaming: false

  ## Enable multiple Jibri instances.
  ## If enabled (i.e. set to 2 or more), each Jibri instance
  ## will get an ID assigned to it, based on pod name.
  ## Multiple replicas are recommended for single-use mode.
  replicaCount: 1

  ## Enable persistent storage for local recordings.
  ## If disabled, jibri pod will use a transient
  ## emptyDir-backed storage instead.
  persistence:
    enabled: false
    size: 4Gi
    ## Set this to existing PVC name if you have one.
    existingClaim:
    storageClassName:

  shm:
    ## Set to true to enable "/dev/shm" mount.
    ## May be required by built-in Chromium.
    enabled: false
    ## If "true", will use host's shared memory dir,
    ## and if "false" — an emptyDir mount.
    # useHost: false
    # size: 256Mi

  ## Configure the update strategy for Jibri deployment.
  ## This may be useful depending on your persistence settings,
  ## e.g. when you use ReadWriteOnce PVCs.
  ## Default strategy is "RollingUpdate", which keeps
  ## the old instances up until the new ones are ready.
  # strategy:
  #   type: RollingUpdate

  image:
    repository: jitsi/jibri

  podLabels: {}
  podAnnotations: {}
  resources: {}

  breweryMuc: jibribrewery
  timeout: 90

  ## jibri XMPP user credentials:
  xmpp:
    user: jibri
    password:

  ## recorder XMPP user credentials:
  recorder:
    user: recorder
    password:

  livenessProbe:
    initialDelaySeconds: 5
    periodSeconds: 5
    failureThreshold: 2
    exec:
      command:
        - /bin/bash
        - "-c"
        - >-
          curl -sq localhost:2222/jibri/api/v1.0/health
          | jq '"\(.status.health.healthStatus) \(.status.busyStatus)"'
          | grep -qP 'HEALTHY (IDLE|BUSY)'

  readinessProbe:
    initialDelaySeconds: 5
    periodSeconds: 5
    failureThreshold: 2
    exec:
      command:
        - /bin/bash
        - "-c"
        - >-
          curl -sq localhost:2222/jibri/api/v1.0/health
          | jq '"\(.status.health.healthStatus) \(.status.busyStatus)"'
          | grep -qP 'HEALTHY (IDLE|BUSY)'

  extraEnvs: {}

  ## Override the image-provided configuration files:
  #  See https://github.com/jitsi/docker-jitsi-meet/tree/master/jibri/rootfs
  custom:
    contInit:
      _10_config: ""
    defaults:
      _autoscaler_sidecar_config: ""
      _jibri_conf: ""
      _logging_properties: ""
      _xorg_video_dummy_conf: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name:

xmpp:
  domain: meet.jitsi
  authDomain:
  mucDomain:
  internalMucDomain:
  guestDomain:

extraCommonEnvs: {}

prosody:
  enabled: true
  useExternalProsody: false
  server:
  extraEnvFrom:
  - secretRef:
      name: '{{ include "prosody.fullname" . }}-jibri'
  - secretRef:
      name: '{{ include "prosody.fullname" . }}-jicofo'
  - secretRef:
      name: '{{ include "prosody.fullname" . }}-jigasi'
  - secretRef:
      name: '{{ include "prosody.fullname" . }}-jvb'
  - configMapRef:
      name: '{{ include "prosody.fullname" . }}-common'
  image:
    repository: jitsi/prosody
    tag: stable-9646

  # service:
  #   ports:
  # If Prosody c2s in needed on private net outside the cluster
  #     xmppc2snodePort: 30522

  ## Override the image-provided configuration files:
  #  See https://github.com/jitsi/docker-jitsi-meet/tree/master/prosody/rootfs
  custom:
    contInit:
      _10_config: ""
    defaults:
      _prosody_cfg_lua: ""
      _saslauthd_conf: ""
      _jitsi_meet_cfg_lua: ""

  extraVolumes: []
    # - name: prosody-modules
    #   configMap:
    #     name: prosody-modules

  extraVolumeMounts: []
    # - name: prosody-modules
    #   subPath: mod_measure_client_presence.lua
    #   mountPath: /prosody-plugins-custom/mod_measure_client_presence.lua

[NikitaSTets]

For some reason /http-bind use https protocol and it cause this issue

[spijet]

Hello @NikitaSTets!

As for the values you've provided: I'm not sure if using 127.0.0.1 as your announced Public IP is going to do any good in this setup. I'd recommend leaving .Values.jvb.publicIPs unset, so that JVB pod would auto-discover the node's IP address. Are you going to expose this Jitsi Meet installation to the Internet, or is it going to be used in some internal network only?

As for the error log: this error says that your (I assume) JVB pod is unable to resolve the k8s service DNS record for Prosody. This may indicate that this pod either ignores cluster DNS or has some other problems with in-cluster DNS resolution. Please connect to the pod shell (with kubectl -n $namespace exec -it $podname -- /bin/bash or using your favourite k8s GUI) and try to check if the service name resolves correctly. You can use dig for that, it's included in the JVB image.

As for the HTTP(S) error: It seems that you're trying to expose the web service via a NodePort without enabling HTTPS inside the web pod. Both of these things are not recommended. Please use an ingress controller. Also, IIRC, some browsers explicitly disallow any WebRTC communication over plaintext HTTP since ~2017, so you'll need to use HTTPS anyway, even if only with a self-signed certificate.

[NikitaSTets]

Hey @spijet thanks for your reply,

1. We are going to use it in both cases, sometimes internaly sometimes expose to the internet.
2. Looks like it's smth went wront when I start it, after restart jvb pod it resolved it correctly.
3. yes, i just tried to run and see how it works and then going to expose it to run with more than 1 jvb pod to scale it and support a lot of sessions/connection at the same time.

[spijet]

1. In this case it might be preferable to explicitly set the IP address depending on the installation in question (internal-only or external+internal).

2. It could happen in case JVB pod gets scheduled and started before Prosody. Not much we can do here except rely on JVB's automatic reconnection logic and/or failure to start and subsequent pod restart by k8s.

3. From my experience there's not much need in scaling JVB pods unless you specifially need to:

   • Improve connectivity for users in different regions (e.g. some of your users are in western Europe, while others are in Middle East), or
   • When you host a lot of active big meeting rooms at the same time (i.e. you need more network bandwidth that one node can handle).

   JVB rarely uses a lot of CPU, since it just sends audio/video streams back and forth between users without any transcoding or anything like that.

[NikitaSTets]

Hi @spijet
I am trying to run according to your recommendations but with no luck
I've changed Web service port to 443, enabled ingress, installed ingress controller, added secret name to ingress that I have locally and that's it. Added to hosts redirect to 127.0.0.1 for jitsi.local. Because ingress responded to me if just entered localhost in browser.

Looks like ingress doesn't redirect to the web service. Did I miss smth?

# Default values for jitsi-meet.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

global:
  # Set your cluster's DNS domain here.
  # "cluster.local" should work for most environments.
  # Set to "" to disable the use of FQDNs (default in older chart versions).
  clusterDomain: cluster.local
  podLabels: {}
  podAnnotations: {}
  releaseSecretsOverride:
    enabled: false
    #Support environment variables from pre-created secrets, such as 1Password operator
    #extraEnvFrom:
    #  - secretRef:
    #      name: '{{ include "prosody.fullname" . }}-overrides'
    #      optional: true

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

enableAuth: false
enableGuests: true
# Where Jitsi Web UI is made available
# such as jitsi.example.com
publicURL: "jitsi.local"

tz: Europe/Amsterdam

image:
  pullPolicy: IfNotPresent

## WebSocket configuration:
#
#  Both Colibri and XMPP WebSockets are disabled by default,
#  since some LoadBalancer / Reverse Proxy setups can't pass
#  WebSocket connections properly, which might result in breakage
#  for some clients.
#
#  Enable both Colibri and XMPP WebSockets to replicate the current
#  upstream `meet.jit.si` setup. Keep both disabled to replicate
#  older setups which might be more compatible in some cases.
websockets:
  ## Colibri (JVB signalling):
  colibri:
    enabled: false
  ## XMPP (Prosody signalling):
  xmpp:
    enabled: false

web:
  replicaCount: 1
  image:
    repository: jitsi/web

  ## Override the image-provided configuration files:
  #  See https://github.com/jitsi/docker-jitsi-meet/tree/master/web/rootfs
  custom:
    contInit:
      _10_config: ""
    defaults:
      _default: ""
      _ffdhe2048_txt: ""
      _interface_config_js: ""
      _meet_conf: ""
      _nginx_conf: ""
      _settings_config_js: ""
      _ssl_conf: ""
      _system_config_js: ""
    configs:
      _custom_interface_config_js: ""
      _custom_config_js: ""

  extraEnvs: {}
  service:
    type: ClusterIP
    port: 443
    ## If you want to expose the Jitsi Web service directly
    #  (bypassing the Ingress Controller), use this:
    #
    # type: NodePort
    # ports:
    # - name: http
      # protocol: TCP
      # port: 80               # The port on the service (ClusterIP)
      # targetPort: 8080        # The port on the pod
      # nodePort: 30580         # The external NodePort
    # - name: https
      # protocol: TCP
      # port: 443              # The port on the service (ClusterIP)
      # targetPort: 8443       # The port on the pod
      # nodePort: 30443
    externalIPs: []

  ingress:
    enabled: true
    ingressClassName: "nginx"
    annotations:
       kubernetes.io/tls-acme: "true"
    hosts:
    - host: jitsi.local
      paths: [/]
    tls: 
      - secretName: my-release
        hosts:
          - jitsi.local

  # Useful for ingresses that don't support http-to-https redirect by themself, (namely: GKE),
  httpRedirect: false

  # When tls-termination by the ingress is not wanted, enable this and set web.service.type=Loadbalancer
  httpsEnabled: false

  ## Resolver IP for nginx.
  #
  #  Starting with version `stable-8044`, the web container can
  #  auto-detect the nameserver from /etc/resolv.conf.
  #  Use this option if you want to override the nameserver IP.
  #
  # resolverIP: 10.43.0.10

  livenessProbe:
    httpGet:
      path: /
      port: 80
  readinessProbe:
    httpGet:
      path: /
      port: 80

  podLabels: {}
  podAnnotations: {}
  podSecurityContext: {}
    # fsGroup: 2000

  securityContext: {}
    # capabilities:
    #   drop:
    #   - ALL
    # readOnlyRootFilesystem: true
    # runAsNonRoot: true
    # runAsUser: 1000

  resources: {}
    # We usually recommend not to specify default resources and to leave this as a conscious
    # choice for the user. This also increases chances charts run on environments with little
    # resources, such as Minikube. If you do want to specify resources, uncomment the following
    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
    # limits:
    #   cpu: 100m
    #   memory: 128Mi
    # requests:
    #   cpu: 100m
    #   memory: 128Mi

  nodeSelector: {}

  tolerations: []

  affinity: {}

jicofo:
  replicaCount: 1
  image:
    repository: jitsi/jicofo

  ## Override the image-provided configuration files:
  #  See https://github.com/jitsi/docker-jitsi-meet/tree/master/jicofo/rootfs
  custom:
    contInit:
      _10_config: ""
    defaults:
      _jicofo_conf: ""
      _logging_properties: ""

  xmpp:
    password:
    componentSecret:

  livenessProbe:
    tcpSocket:
      port: 8888

  readinessProbe:
    tcpSocket:
      port: 8888

  podLabels: {}
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  extraEnvs: {}

jvb:
  replicaCount: 1
  image:
    repository: jitsi/jvb

  xmpp:
    user: jvb
    password:

  ## Set public IP addresses to be advertised by JVB.
  #  You can specify your nodes' IP addresses,
  #  or IP addresses of proxies/LoadBalancers used for your
  #  Jitsi Meet installation. Or both!
  #
  #  Note that only the first IP address will be used for legacy
  #  `DOCKER_HOST_ADDRESS` environment variable.
  #
  #publicIPs:
  #  - 127.0.0.1
  #   - 5.6.7.8
  ## Alternative option: auto-detect Node's external IP address.
  #  Recommended for OCTO setups (with either NodePort service
  #  or hostPort enabled) where every JVB pod should announce it's
  #  own IP address only.
  useNodeIP: true
  ## Use a STUN server to help some users punch through some
  #  especially nasty NAT setups. Usually makes sense for P2P calls.
  stunServers: 'meet-jit-si-turnrelay.jitsi.net:443'
  ## Try to use the hostPort feature:
  #  (might not be supported by some clouds or CNI engines)
  useHostPort: false
  ## Use host's network namespace:
  #  (not recommended, but might help for some cases)
  useHostNetwork: true
  ## UDP transport port:
  UDPPort: 10000
  ## Use a pre-defined external port for NodePort or LoadBalancer service,
  #  if needed. Will allocate a random port from allowed range if unset.
  #  (Default NodePort range for K8s is 30000-32767)
  # nodePort: 10000
  service:
    enabled:
    type: ClusterIP
    externalTrafficPolicy: Cluster
    externalIPs: []
    ## Annotations to be added to the service (if LoadBalancer is used)
    #  An example below is needed for DigitalOcean managed k8s setups
    #  with a LoadBalancer service, so that DO's external LB can perform
    #  health checks on JVB.
    annotations: {}
      # service.beta.kubernetes.io/do-loadbalancer-healthcheck-port: "8080"
      # service.beta.kubernetes.io/do-loadbalancer-healthcheck-protocol: "tcp"
    ## Add extra ports to the service.
    #  An example below is needed for DigitalOcean managed k8s setups.
    extraPorts: []
      # - name: http-healthcheck
      #   port: 8080
      #   protocol: TCP

  breweryMuc: jvbbrewery

  livenessProbe:
    httpGet:
      path: /about/health
      port: 8080
  readinessProbe:
    httpGet:
      path: /about/health
      port: 8080

  podLabels: {}
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  extraEnvs: {}

  metrics:
    enabled: false
    image:
      repository: docker.io/systemli/prometheus-jitsi-meet-exporter
      tag: 1.2.3
      pullPolicy: IfNotPresent

    resources:
      requests:
        cpu: 10m
        memory: 16Mi
      limits:
        cpu: 20m
        memory: 32Mi

    prometheusAnnotations: false
    serviceMonitor:
      enabled: true
      selector:
        release: prometheus-operator
      interval: 10s
      # honorLabels: false

    grafanaDashboards:
      enabled: false
      labels:
        grafana_dashboard: "1"
      annotations: {}
octo:
  enabled: false


jigasi:
  ## Enabling Jigasi will allow regular SIP clients to join Jitsi meetings
  ## or nearly real-time transcription.
  enabled: false

  ## Use external Jigasi installation.
  ## This setting skips the creation of Jigasi Deployment altogether,
  ## instead creating just the config secret and enabling services.
  ## Defaults to disabled (use bundled Jigasi).
  useExternalJigasi: false

  replicaCount: 1
  image:
    repository: jitsi/jigasi

  breweryMuc: jigasibrewery

  ## jigasi XMPP user credentials:
  xmpp:
    user: jigasi
    password:

  livenessProbe:
    tcpSocket:
      port: 8788
  readinessProbe:
    tcpSocket:
      port: 8788

  podLabels: {}
  podAnnotations: {}
  podSecurityContext: {}
  securityContext: {}
  resources: {}
  nodeSelector: {}
  tolerations: []
  affinity: {}
  extraEnvs: {}


jibri:
  ## Enabling Jibri will allow users to record
  ## and/or stream their meetings (e.g. to YouTube).
  enabled: false

  ## Use external Jibri installation.
  ## This setting skips the creation of Jibri Deployment altogether,
  ## instead creating just the config secret
  ## and enabling recording/streaming services.
  ## Defaults to disabled (use bundled Jibri).
  useExternalJibri: false

  ## Enable single-use mode for Jibri.
  ## With this setting enabled, every Jibri instance
  ## will become "expired" after being used once (successfully or not)
  ## and cleaned up (restarted) by Kubernetes.
  ##
  ## Note that detecting expired Jibri, restarting and registering it
  ## takes some time, so you'll have to make sure you have enough
  ## instances at your disposal.
  ## You might also want to make LivenessProbe fail faster.
  singleUseMode: false

  ## Enable recording service.
  ## Set this to true/false to enable/disable local recordings.
  ## Defaults to enabled (allow local recordings).
  recording: true

  ## Enable livestreaming service.
  ## Set this to true/false to enable/disable live streams.
  ## Defaults to disabled (livestreaming is forbidden).
  livestreaming: false

  ## Enable multiple Jibri instances.
  ## If enabled (i.e. set to 2 or more), each Jibri instance
  ## will get an ID assigned to it, based on pod name.
  ## Multiple replicas are recommended for single-use mode.
  replicaCount: 1

  ## Enable persistent storage for local recordings.
  ## If disabled, jibri pod will use a transient
  ## emptyDir-backed storage instead.
  persistence:
    enabled: false
    size: 4Gi
    ## Set this to existing PVC name if you have one.
    existingClaim:
    storageClassName:

  shm:
    ## Set to true to enable "/dev/shm" mount.
    ## May be required by built-in Chromium.
    enabled: false
    ## If "true", will use host's shared memory dir,
    ## and if "false" — an emptyDir mount.
    # useHost: false
    # size: 256Mi

  ## Configure the update strategy for Jibri deployment.
  ## This may be useful depending on your persistence settings,
  ## e.g. when you use ReadWriteOnce PVCs.
  ## Default strategy is "RollingUpdate", which keeps
  ## the old instances up until the new ones are ready.
  # strategy:
  #   type: RollingUpdate

  image:
    repository: jitsi/jibri

  podLabels: {}
  podAnnotations: {}
  resources: {}

  breweryMuc: jibribrewery
  timeout: 90

  ## jibri XMPP user credentials:
  xmpp:
    user: jibri
    password:

  ## recorder XMPP user credentials:
  recorder:
    user: recorder
    password:

  livenessProbe:
    initialDelaySeconds: 5
    periodSeconds: 5
    failureThreshold: 2
    exec:
      command:
        - /bin/bash
        - "-c"
        - >-
          curl -sq localhost:2222/jibri/api/v1.0/health
          | jq '"\(.status.health.healthStatus) \(.status.busyStatus)"'
          | grep -qP 'HEALTHY (IDLE|BUSY)'

  readinessProbe:
    initialDelaySeconds: 5
    periodSeconds: 5
    failureThreshold: 2
    exec:
      command:
        - /bin/bash
        - "-c"
        - >-
          curl -sq localhost:2222/jibri/api/v1.0/health
          | jq '"\(.status.health.healthStatus) \(.status.busyStatus)"'
          | grep -qP 'HEALTHY (IDLE|BUSY)'

  extraEnvs: {}

  ## Override the image-provided configuration files:
  #  See https://github.com/jitsi/docker-jitsi-meet/tree/master/jibri/rootfs
  custom:
    contInit:
      _10_config: ""
    defaults:
      _autoscaler_sidecar_config: ""
      _jibri_conf: ""
      _logging_properties: ""
      _xorg_video_dummy_conf: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name:

xmpp:
  domain: meet.jitsi
  authDomain:
  mucDomain:
  internalMucDomain:
  guestDomain:

extraCommonEnvs: {}

prosody:
  enabled: true
  useExternalProsody: false
  server:
  extraEnvFrom:
  - secretRef:
      name: '{{ include "prosody.fullname" . }}-jibri'
  - secretRef:
      name: '{{ include "prosody.fullname" . }}-jicofo'
  - secretRef:
      name: '{{ include "prosody.fullname" . }}-jigasi'
  - secretRef:
      name: '{{ include "prosody.fullname" . }}-jvb'
  - configMapRef:
      name: '{{ include "prosody.fullname" . }}-common'
  image:
    repository: jitsi/prosody
    tag: stable-9646

  # service:
  #   ports:
  # If Prosody c2s in needed on private net outside the cluster
  #     xmppc2snodePort: 30522

  ## Override the image-provided configuration files:
  #  See https://github.com/jitsi/docker-jitsi-meet/tree/master/prosody/rootfs
  custom:
    contInit:
      _10_config: ""
    defaults:
      _prosody_cfg_lua: ""
      _saslauthd_conf: ""
      _jitsi_meet_cfg_lua: ""

  extraVolumes: []
    # - name: prosody-modules
    #   configMap:
    #     name: prosody-modules

  extraVolumeMounts: []
    # - name: prosody-modules
    #   subPath: mod_measure_client_presence.lua
    #   mountPath: /prosody-plugins-custom/mod_measure_client_presence.lua