Jitsi meet(リバースプロキシ構成 + ポート変更)で自分だけのテレビ会議(ビデオ会議)環境を整える

http {
  # ... ごちゃごちゃと他のデフォルト設定の記述
  # ...
  
  # websocket (HTTP/1.1 Upgradeヘッダー)
  map $http_upgrade $connection_upgrade {
      default upgrade;
      '' close;
  }
  
  # ... ごちゃごちゃと他のデフォルト設定の記述
  # ...
}

server {
    listen 80;
    server_name jitsi.example.jp;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name jitsi.example.jp;

      return 502;
    }

    # なんかよくわからんがデカい転送発生しそうなのでヨシ！
    client_max_body_size 2G;

    # 転送ログ
    access_log /var/log/nginx/jitsi.access.log;
    error_log /var/log/nginx/jitsi.err.log;

    # 実際に使用するjitsi側のSSL証明書例
    ssl_certificate /etc/letsencrypt/live/jitsi.example.jp/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/jitsi.example.jp/privkey.pem;

    # その他SSL関連設定(お好みで)
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
    ssl_prefer_server_ciphers on;

    ssl_dhparam /etc/letsencrypt/live/jitsi.example.jp/dhparam.pem;
    add_header Strict-Transport-Security max-age=15768000;

    # ここからが転送の設定
    location / {
        proxy_pass http://192.168.10.20:8443/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forward-Proto http;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
    }
}

sudo vi /etc/jitsi/pubipaddr_auto_replace.sh

ThisFQDN="jitsi.example.jp"

# get the actual IP from the Internet
IPnow=$(host -tA $ThisFQDN | grep address | cut -d " " -f4 )

# get the configured IP of Jitsi
IPbefore=$(grep "NAT_HARVESTER_PUBLIC_ADDRESS" /etc/jitsi/videobridge/sip-communicator.properties |  grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+")

if [ "$IPbefore" == "$IPnow" ]
then
        exit 0
fi

#clear config
sed -i -e "s/HARVESTER_PUBLIC_ADDRESS\=$IPbefore/HARVESTER_PUBLIC_ADDRESS\=$IPnow/g" /etc/jitsi/videobridge/sip-communicator.properties

#restart services
service jicofo restart
#service jigasi restart
service jitsi-videobridge2 restart

chmod 655 /etc/jitsi/pubipaddr_auto_replace.sh

crontab -e

MAILTO=""

#Jitsi動的IP対策 15分間隔で実行
*/15 * * * * /etc/jitsi/pubipaddr_auto_replace.sh

sudo vi /etc/jitsi/videobridge/sip-communicator.properties

org.ice4j.ice.harvest.DISABLE_AWS_HARVESTER=true
#org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES=meet-jit-si-turnrelay.jitsi.net:443
org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS=192.168.1.20
org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS=127.0.0.1
org.jitsi.videobridge.ENABLE_STATISTICS=true
org.jitsi.videobridge.SINGLE_PORT_HARVESTER_PORT=10101
org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.jitsi.example.jp
org.jitsi.videobridge.xmpp.user.shard.USERNAME=*********
org.jitsi.videobridge.xmpp.user.shard.PASSWORD=*********
org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=***************@internal.auth.jitsi.example.jp
org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME=*****************************

bash /etc/jitsi/pubipaddr_auto_replace.sh

sudo vi /etc/nginx/sites-enabled/[ホスト名].conf

server_names_hash_bucket_size 64;

types {
# nginx's default mime.types doesn't include a mapping for wasm
    application/wasm     wasm;
}
upstream prosody {
    zone upstreams 64K;
    server 127.0.0.1:5280;
    keepalive 2;
}
upstream jvb1 {
    zone upstreams 64K;
    server 127.0.0.1:9090;
    keepalive 2;
}

#このへんの記述いらない(フロントエンド側で処理済み)
#server {
#    listen 80;
#    listen [::]:80;
#    server_name jitsi.example.jp;
#
#    location ^~ /.well-known/acme-challenge/ {
#        default_type "text/plain";
#        root         /usr/share/jitsi-meet;
#    }
#    location = /.well-known/acme-challenge/ {
#        return 404;
#    }
#    location / {
#        return 301 https://$host$request_uri;
#    }
#}
#ここらへんまでいらない

server {
    #受付ポート変更 デフォルトは443
    listen 8443;
    listen [::]:8443;
  
    server_name jitsi.example.jp;

#このへんの記述いらない(フロントエンド側で処理済み)
    # Mozilla Guideline v5.4, nginx 1.17.7, OpenSSL 1.1.1d, intermediate configuration
    #ssl_protocols TLSv1.2 TLSv1.3;
    #ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    #ssl_prefer_server_ciphers off;

    #ssl_session_timeout 1d;
    #ssl_session_cache shared:SSL:10m;  # about 40000 sessions
    #ssl_session_tickets off;

    #add_header Strict-Transport-Security "max-age=63072000" always;
    #set $prefix "";

    #ssl_certificate /etc/ssl/jitsi.example.jp.crt;
    #ssl_certificate_key /etc/ssl/jitsi.example.jp.key;
#ここらへんまでいらない

    root /usr/share/jitsi-meet;

    # ssi on with javascript for multidomain variables in config.js
    ssi on;
    ssi_types application/x-javascript application/javascript;

    index index.html index.htm;
    error_page 404 /static/404.html;

    gzip on;
    gzip_types text/plain text/css application/javascript application/json image/x-icon application/octet-stream application/wasm;
    gzip_vary on;
    gzip_proxied no-cache no-store private expired auth;
    gzip_min_length 512;

    location = /config.js {
        alias /etc/jitsi/meet/jitsi.example.jp-config.js;
    }

    location = /external_api.js {
        alias /usr/share/jitsi-meet/libs/external_api.min.js;
    }

    # ensure all static content can always be found first
    location ~ ^/(libs|css|static|images|fonts|lang|sounds|connection_optimization|.well-known)/(.*)$
    {
        add_header 'Access-Control-Allow-Origin' '*';
        alias /usr/share/jitsi-meet/$1/$2;

        # cache all versioned files
        if ($arg_v) {
            expires 1y;
        }
    }

    # BOSH
    location = /http-bind {
        proxy_pass http://prosody/http-bind?prefix=$prefix&$args;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $http_host;
        proxy_set_header Connection "";
    }

    # xmpp websockets
    location = /xmpp-websocket {
        proxy_pass http://prosody/xmpp-websocket?prefix=$prefix&$args;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        tcp_nodelay on;
    }

    # colibri (JVB) websockets for jvb1
    location ~ ^/colibri-ws/default-id/(.*) {
        proxy_pass http://jvb1/colibri-ws/default-id/$1$is_args$args;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        tcp_nodelay on;
    }

    # load test minimal client, uncomment when used
    #location ~ ^/_load-test/([^/?&:'"]+)$ {
    #    rewrite ^/_load-test/(.*)$ /load-test/index.html break;
    #}
    #location ~ ^/_load-test/libs/(.*)$ {
    #    add_header 'Access-Control-Allow-Origin' '*';
    #    alias /usr/share/jitsi-meet/load-test/libs/$1;
    #}

    location ~ ^/([^/?&:'"]+)$ {
        try_files $uri @root_path;
    }

    location @root_path {
        rewrite ^/(.*)$ / break;
    }

    location ~ ^/([^/?&:'"]+)/config.js$
    {
        set $subdomain "$1.";
        set $subdir "$1/";

        alias /etc/jitsi/meet/jitsi.example.jp-config.js;
    }

    # BOSH for subdomains
    location ~ ^/([^/?&:'"]+)/http-bind {
        set $subdomain "$1.";
        set $subdir "$1/";
        set $prefix "$1";

        rewrite ^/(.*)$ /http-bind;
    }

    # websockets for subdomains
    location ~ ^/([^/?&:'"]+)/xmpp-websocket {
        set $subdomain "$1.";
        set $subdir "$1/";
        set $prefix "$1";

        rewrite ^/(.*)$ /xmpp-websocket;
    }

    # Anything that didn't match above, and isn't a real file, assume it's a room name and redirect to /
    location ~ ^/([^/?&:'"]+)/(.*)$ {
        set $subdomain "$1.";
        set $subdir "$1/";
        rewrite ^/([^/?&:'"]+)/(.*)$ /$2;
    }
}

sudo systemctl restart nginx

sudo ufw allow 8443
sudo ufw allow 10101

sudo systemctl restart nginx
sudo systemctl restart prosody
sudo systemctl restart jicofo
sudo systemctl restart jitsi-videobridge2

#自動起動設定
sudo systemctl enable nginx
#自動起動確認
systemctl is-enabled nginx
systemctl is-enabled prosody
systemctl is-enabled jicofo
systemctl is-enabled jitsi-videobridge2

sudo vi /etc/jitsi/jicofo/logging.properties

java.util.logging.ConsoleHandler.level = ALL ← SEVEREに


sudo vi /etc/jitsi/videobridge/logging.properties

java.util.logging.ConsoleHandler.level = ALL ← SEVEREに