98 lines
2.4 KiB
Nix
98 lines
2.4 KiB
Nix
{
|
|
inputs,
|
|
flake,
|
|
self,
|
|
}:
|
|
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
...
|
|
}: let
|
|
cfg = config.hectic.services.jitsi;
|
|
in {
|
|
options = {
|
|
hectic.services.jitsi = {
|
|
enable = lib.mkEnableOption "Jitsi Meet video conferencing with Prosody XMPP backend";
|
|
hostName = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = ''
|
|
FQDN for the Jitsi Meet instance (e.g. "meet.example.org").
|
|
Prosody VirtualHosts, nginx, and ACME certs are derived from this.
|
|
'';
|
|
};
|
|
secureDomain = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Require authentication to create rooms. Guests can still join
|
|
existing rooms anonymously.
|
|
'';
|
|
};
|
|
lockdown = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = ''
|
|
Restrict Prosody to localhost only (no S2S federation, c2s
|
|
only on 127.0.0.1). Set to false when running alongside a
|
|
general-purpose XMPP server (hectic.services.xmpp).
|
|
'';
|
|
};
|
|
videobridgePasswordFile = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.path;
|
|
default = null;
|
|
description = ''
|
|
Path to a file containing the Jitsi Videobridge XMPP password.
|
|
If null, a random password is auto-generated.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
services.jitsi-meet = {
|
|
enable = true;
|
|
hostName = cfg.hostName;
|
|
|
|
prosody = {
|
|
enable = true;
|
|
lockdown = cfg.lockdown;
|
|
};
|
|
|
|
nginx.enable = true;
|
|
videobridge = {
|
|
enable = true;
|
|
} // lib.optionalAttrs (cfg.videobridgePasswordFile != null) {
|
|
passwordFile = cfg.videobridgePasswordFile;
|
|
};
|
|
jicofo.enable = true;
|
|
|
|
secureDomain = lib.mkIf cfg.secureDomain {
|
|
enable = true;
|
|
};
|
|
};
|
|
|
|
services.jitsi-videobridge.openFirewall = true;
|
|
|
|
services.nginx.virtualHosts.${cfg.hostName} = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
};
|
|
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults = {
|
|
email = lib.mkDefault "hectic.yukkop.it@gmail.com";
|
|
enableDebugLogs = lib.mkDefault true;
|
|
};
|
|
};
|
|
|
|
networking.firewall = {
|
|
allowedTCPPorts = [
|
|
80 443 # HTTP/HTTPS (nginx + ACME)
|
|
5222 # XMPP c2s (if not locked down)
|
|
];
|
|
};
|
|
};
|
|
}
|