jitsi: complete setup

group_vars/all/vars.yml

@@ -41,6 +41,7 @@ hackmd_dbpass: "{{ vault_hackmd_dbpass }}"
 hackmd_secret: "{{ vault_hackmd_secret }}"
 
 jitsi_domain: jitsi.binary-kitchen.de
+jitsi_admin_email: exxess@binary-kitchen.de
 
 ldap_uri: ldaps://ldap.binary.kitchen
 ldap_host: ldap.binary.kitchen

roles/jitsi/handlers/main.yml

@@ -1,7 +0,0 @@
----
-
-- name: Restart nginx
-  service: name=nginx state=restarted
-
-- name: Run acertmgr
-  command: /usr/bin/acertmgr

roles/jitsi/meta/main.yml

@@ -1,5 +0,0 @@
----
-
-dependencies:
-- { role: acertmgr }
-- { role: nginx, nginx_ssl: True }

roles/jitsi/tasks/main.yml

@@ -1,17 +1,38 @@
 ---
 
-- name: Ensure jitsi certificates are available
+- name: Ensure apt over https is available
-  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ jitsi_domain }}.key -out /etc/nginx/ssl/{{ jitsi_domain }}.crt -days 730 -subj "/CN={{ jitsi_domain }}" creates=/etc/nginx/ssl/{{ jitsi_domain }}.crt
+  apt: name=apt-transport-https
-  notify: Restart nginx
 
-- name: Configure certificate manager
+- name: Add Jitsi repo key
-  template: src=certs.j2 dest=/etc/acertmgr/{{ jitsi_domain }}.conf
+  apt_key:
-  notify: Run acertmgr
+    id: EF8B479E2DC1389C
+    url: https://download.jitsi.org/jitsi-key.gpg.key
 
-- name: Configure vhosts
+- name: Add Jitsi apt repo
-  template: src=vhost.j2 dest=/etc/nginx/sites-available/jitsi
+  apt_repository:
-  notify: Restart nginx
+    repo: deb https://download.jitsi.org stable/
+    filename: jitsi
 
-- name: Enable vhosts
+- name: Provide debconf defaults
-  file: src=/etc/nginx/sites-available/jitsi dest=/etc/nginx/sites-enabled/jitsi state=link
+  debconf:
-  notify: Restart nginx
+    name: "{{ item.name }}"
+    question: "{{ item.question }}"
+    vtype: "{{ item.vtype }}"
+    value: "{{ item.value }}"
+  with_items:
+  - { name: 'jitsi-videobridge2',    question: 'jitsi-videobridge/jvb-hostname', vtype: 'string', value: "{{ jitsi_domain }}" }
+  - { name: 'jitsi-meet-web-config', question: 'jitsi-meet/cert-choice:',        vtype: 'select', value: "Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)" }
+
+- name: Install jitsi meet
+  apt: name=jitsi-meet
+
+- name: Predefine an email address for Let's Encrypt
+  lineinfile:
+    path: /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh
+    regexp: '^read EMAIL$'
+    line: 'EMAIL="{{ jitsi_admin_email }}"'
+
+- name: Setup Let's Encrypt
+  command:
+    cmd: /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh
+    creates: /etc/cron.weekly/letsencrypt-renew

roles/jitsi/templates/certs.j2

@@ -1,14 +0,0 @@
----
-{{ jitsi_domain }}:
-- path: /etc/nginx/ssl/{{ jitsi_domain }}.crt
-  user: root
-  group: root
-  perm: '400'
-  format: crt,ca
-  action: '/usr/sbin/service nginx restart'
-- path: /etc/nginx/ssl/{{ jitsi_domain }}.key
-  user: root
-  group: root
-  perm: '400'
-  format: key
-  action: '/usr/sbin/service nginx restart'

roles/jitsi/templates/vhost.j2

@@ -1,27 +0,0 @@
-server {
-	listen 80;
-	listen [::]:80;
-
-	server_name {{ jitsi_domain }};
-
-	location /.well-known/acme-challenge {
-		default_type "text/plain";
-		alias /var/www/acme-challenge;
-	}
-
-	location / {
-		return 301 https://{{ jitsi_domain }}$request_uri;
-	}
-}
-
-server {
-	listen 443 ssl http2;
-	listen [::]:443 ssl http2;
-
-	server_name {{ jitsi_domain }};
-
-	ssl_certificate_key /etc/nginx/ssl/{{ jitsi_domain }}.key;
-	ssl_certificate /etc/nginx/ssl/{{ jitsi_domain }}.crt;
-
-	root /var/www/jitsi;
-}