From e33ae979ab81d8d278b676e26ef7c22315692039 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Wed, 17 May 2023 16:04:19 -0400
Subject: [PATCH 01/28] WIP

---
 webapps/jitsimeet/LISEZMOI.md       | 47 ++++++++++++++++++++++++++
 webapps/jitsimeet/README.md         | 47 ++++++++++++++++++++++++++
 webapps/jitsimeet/defaults/main.yml | 10 ++++++
 webapps/jitsimeet/handlers/main.yml |  2 ++
 webapps/jitsimeet/meta/main.yml     | 52 +++++++++++++++++++++++++++++
 webapps/jitsimeet/tasks/main.yml    | 47 ++++++++++++++++++++++++++
 webapps/jitsimeet/tasks/upgrade.yml |  4 +++
 webapps/jitsimeet/tests/inventory   |  2 ++
 webapps/jitsimeet/tests/test.yml    |  5 +++
 webapps/jitsimeet/vars/main.yml     |  2 ++
 10 files changed, 218 insertions(+)
 create mode 100644 webapps/jitsimeet/LISEZMOI.md
 create mode 100644 webapps/jitsimeet/README.md
 create mode 100644 webapps/jitsimeet/defaults/main.yml
 create mode 100644 webapps/jitsimeet/handlers/main.yml
 create mode 100644 webapps/jitsimeet/meta/main.yml
 create mode 100644 webapps/jitsimeet/tasks/main.yml
 create mode 100644 webapps/jitsimeet/tasks/upgrade.yml
 create mode 100644 webapps/jitsimeet/tests/inventory
 create mode 100644 webapps/jitsimeet/tests/test.yml
 create mode 100644 webapps/jitsimeet/vars/main.yml

diff --git a/webapps/jitsimeet/LISEZMOI.md b/webapps/jitsimeet/LISEZMOI.md
new file mode 100644
index 00000000..29594f79
--- /dev/null
+++ b/webapps/jitsimeet/LISEZMOI.md
@@ -0,0 +1,47 @@
+jitsimeet
+=====
+
+Ce rôle installe un serveur jitsimeet. 
+
+Notez qu'hormis le présent fichier LISEZMOI.md, tous les fichiers du rôle jitsimeet sont rédigés en anglais afin de suivre les conventions de la communauté Ansible, favoriser sa réutilisation et son amélioration, etc. Libre à vous cependant de faire appel à ce role dans un playbook rédigé principalement en français ou toute autre langue.
+
+Requis
+------
+
+...
+
+Variables du rôle
+-----------------
+
+Plusieurs des valeurs par défaut dans defaults/main.yml doivent être changées soit directement dans defaults/main.yml ou mieux encore en les supplantant ailleurs, par exemple dans votre playbook (voir l'exemple ci-bas).
+
+Dépendances
+------------
+
+...
+
+Exemple de playbook
+-------------------
+
+```
+- name: "Déployer un serveur jitsimeet"
+  hosts: 
+    - all
+  vars:
+    # Supplanter ici les variables du rôle
+    domains: ['votre-vrai-domaine.org']
+    service: 'mon-jitsimeet'
+
+  roles:
+    - { role: webapps/jitsimeet , tags: "jitsimeet" }
+```
+
+Licence
+-------
+
+GPLv3
+
+Infos sur l'auteur
+------------------
+
+Mathieu Gauthier-Pilote, administrateur de systèmes chez Evolix.
diff --git a/webapps/jitsimeet/README.md b/webapps/jitsimeet/README.md
new file mode 100644
index 00000000..a1f1463a
--- /dev/null
+++ b/webapps/jitsimeet/README.md
@@ -0,0 +1,47 @@
+jitsimeet
+=====
+
+This role installs or upgrades the server for jitsimeet. 
+
+FRENCH: Voir le fichier LISEZMOI.md pour le français.
+
+Requirements
+------------
+
+...
+
+Role Variables
+--------------
+
+Several of the default values in defaults/main.yml must be changed either directly in defaults/main.yml or better even by overwriting them somewhere else, for example in your playbook (see the example below).
+
+Dependencies
+------------
+
+...
+
+Example Playbook
+----------------
+
+```
+- name: "Deploy a jitsimeet server"
+  hosts: 
+    - all
+  vars:
+    # Overwrite the role variables here
+    domains: ['your-real-domain.org']
+    service: 'my-jitsimeet'
+
+  roles:
+    - { role: webapps/jitsimeet , tags: "jitsimeet" }
+```
+
+License
+-------
+
+GPLv3
+
+Author Information
+------------------
+
+Mathieu Gauthier-Pilote, sys. admin. at Evolix.
diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
new file mode 100644
index 00000000..d6813d04
--- /dev/null
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -0,0 +1,10 @@
+---
+# defaults file for main vars
+
+system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'nginx-full', 'lua5.2']"
+
+domains: ['bullseye.domaine-fictif.org']
+
+version: "stable-8319" # 7 March 2023
+version_old: "stable-8252" # used by jitsimeet/tasks/upgrade.yml
+
diff --git a/webapps/jitsimeet/handlers/main.yml b/webapps/jitsimeet/handlers/main.yml
new file mode 100644
index 00000000..214734cf
--- /dev/null
+++ b/webapps/jitsimeet/handlers/main.yml
@@ -0,0 +1,2 @@
+---
+# handlers file
diff --git a/webapps/jitsimeet/meta/main.yml b/webapps/jitsimeet/meta/main.yml
new file mode 100644
index 00000000..b065fb2a
--- /dev/null
+++ b/webapps/jitsimeet/meta/main.yml
@@ -0,0 +1,52 @@
+galaxy_info:
+  author: Mathieu Gauthier-Pilote
+  description: sys. admin.
+  company: Evolix
+
+  # If the issue tracker for your role is not on github, uncomment the
+  # next line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Choose a valid license ID from https://spdx.org - some suggested licenses:
+  # - BSD-3-Clause (default)
+  # - MIT
+  # - GPL-2.0-or-later
+  # - GPL-3.0-only
+  # - Apache-2.0
+  # - CC-BY-4.0
+  license: license GPL-3.0-only
+
+  min_ansible_version: 2.10
+
+  # If this a Container Enabled role, provide the minimum Ansible Container version.
+  # min_ansible_container_version:
+
+  #
+  # Provide a list of supported platforms, and for each platform a list of versions.
+  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
+  # To view available platforms and versions (or releases), visit:
+  # https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - 25
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - 1.0
+  #   - 7
+  #   - 99.99
+
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes
+    # and categorizes the role. Users find roles by searching for tags. Be sure to
+    # remove the '[]' above, if you add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+
+dependencies: []
+  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
+  # if you add dependencies to this list.
diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
new file mode 100644
index 00000000..69815e09
--- /dev/null
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -0,0 +1,47 @@
+---
+# tasks file for jitsimeet install
+
+- name: Set FQDN
+  command: "hostnamectl set-hostname {{ domains | first }}"
+
+- name: Set FQDN in /etc/hosts
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ ansible_default_ipv4.address }} {{ domains | first }}"
+
+# Ouvrir les ports
+
+- name: Add Prosody apt repository key
+  ansible.builtin.get_url:
+    url: https://prosody.im/files/prosody-debian-packages.key
+    dest: /etc/apt/trusted.gpg.d/prosody.gpg
+    mode: '0644'
+    force: true
+
+- name: Add Jitsi Meet apt repository key
+  ansible.builtin.get_url:
+    url: https://download.jitsi.org/jitsi-key.gpg.key
+    dest: /etc/apt/trusted.gpg.d/jitsimeet.asc
+    mode: '0644'
+    force: true
+
+- name: Add Prosody apt repository
+  ansible.builtin.apt_repository:
+    repo: "deb http://packages.prosody.im/debian bullseye main"
+    state: present
+
+- name: Add Jitsi Meet apt repository
+  ansible.builtin.apt_repository:
+    repo: "deb https://download.jitsi.org stable/"
+    state: present
+
+- name: Install system dependencies
+  ansible.builtin.apt:
+    name: "{{ system_dep }}"
+    state: present
+    update_cache: true
+
+- name: Install Jitsi Meet
+  ansible.builtin.apt:
+    name: jitsi-meet
+    state: present
diff --git a/webapps/jitsimeet/tasks/upgrade.yml b/webapps/jitsimeet/tasks/upgrade.yml
new file mode 100644
index 00000000..0b16c683
--- /dev/null
+++ b/webapps/jitsimeet/tasks/upgrade.yml
@@ -0,0 +1,4 @@
+---
+# tasks file for jitsimeet upgrade
+
+
diff --git a/webapps/jitsimeet/tests/inventory b/webapps/jitsimeet/tests/inventory
new file mode 100644
index 00000000..878877b0
--- /dev/null
+++ b/webapps/jitsimeet/tests/inventory
@@ -0,0 +1,2 @@
+localhost
+
diff --git a/webapps/jitsimeet/tests/test.yml b/webapps/jitsimeet/tests/test.yml
new file mode 100644
index 00000000..4e019810
--- /dev/null
+++ b/webapps/jitsimeet/tests/test.yml
@@ -0,0 +1,5 @@
+---
+- hosts: localhost
+  remote_user: root
+  roles:
+    - jitsimeet
diff --git a/webapps/jitsimeet/vars/main.yml b/webapps/jitsimeet/vars/main.yml
new file mode 100644
index 00000000..2053e362
--- /dev/null
+++ b/webapps/jitsimeet/vars/main.yml
@@ -0,0 +1,2 @@
+---
+# vars file 
-- 
2.39.2


From 3b584d19511073c03e2274c9e2bead0c2ebe3f56 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 18 May 2023 15:51:49 -0400
Subject: [PATCH 02/28] debconf, templates, etc

---
 webapps/jitsimeet/defaults/main.yml           |    7 +-
 webapps/jitsimeet/tasks/main.yml              |   53 +
 .../templates/jicofo/logging.properties.j2    |   38 +
 webapps/jitsimeet/templates/meet/config.js.j2 | 1597 +++++++++++++++++
 .../templates/prosody/prosody.cfg.lua.j2      |  254 +++
 .../templates/prosody/virtualhost.cfg.lua.j2  |  160 ++
 .../templates/videobridge/jvb.conf.j2         |   12 +
 .../videobridge/logging.properties.j2         |   34 +
 .../sip-communicator.properties.j2            |   10 +
 9 files changed, 2164 insertions(+), 1 deletion(-)
 create mode 100644 webapps/jitsimeet/templates/jicofo/logging.properties.j2
 create mode 100644 webapps/jitsimeet/templates/meet/config.js.j2
 create mode 100644 webapps/jitsimeet/templates/prosody/prosody.cfg.lua.j2
 create mode 100644 webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
 create mode 100644 webapps/jitsimeet/templates/videobridge/jvb.conf.j2
 create mode 100644 webapps/jitsimeet/templates/videobridge/logging.properties.j2
 create mode 100644 webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2

diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index d6813d04..b519ebcb 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -1,10 +1,15 @@
 ---
 # defaults file for main vars
 
-system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'nginx-full', 'lua5.2']"
+system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2']"
 
 domains: ['bullseye.domaine-fictif.org']
 
+jitsi_meet_cert_choice: "Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)"
+jitsi_meet_ssl_cert_path: "/etc/ssl/certs/ssl-cert-snakeoil.pem"
+jitsi_meet_ssl_key_path: "/etc/ssl/private/ssl-cert-snakeoil.key"
+jitsi_meet_turn_secret: "QZItKTo4iJ2vqrMWoZgN"
+
 version: "stable-8319" # 7 March 2023
 version_old: "stable-8252" # used by jitsimeet/tasks/upgrade.yml
 
diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 69815e09..1f4e383d 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -41,7 +41,60 @@
     state: present
     update_cache: true
 
+- name: Set debconf options for jitsi-meet
+  ansible.builtin.debconf:
+    name: "{{ item.name }}"
+    question: "{{ item.question }}"
+    value: "{{ item.value }}"
+    vtype: "{{ item.vtype }}"
+  loop:
+    - name: jitsi-videobridge2
+      question: jitsi-videobridge/jvb-hostname
+      value: "{{ domains | first }}"
+      vtype: string
+    - name: jitsi-meet-web-config
+      question: jitsi-meet/cert-choice
+      value: "{{ jitsi_meet_cert_choice }}"
+      vtype: string
+    - name: jitsi-meet-web-config
+      question: jitsi-meet/cert-path-crt
+      value: "{{ jitsi_meet_ssl_cert_path }}"
+      vtype: string
+    - name: jitsi-meet-web-config
+      question: jitsi-meet/cert-path-key
+      value: "{{ jitsi_meet_ssl_key_path }}"
+      vtype: string
+    - name: jitsi-meet-prosody
+      question: jitsi-meet-prosody/turn-secret
+      value: "{{ jitsi_meet_turn_secret }}"
+      vtype: string
+
 - name: Install Jitsi Meet
   ansible.builtin.apt:
     name: jitsi-meet
     state: present
+    install_recommends: no
+
+- name: Template config files
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "{{ item.owner }}"
+    group: "{{ item.group }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - { src: 'videobridge/jvb.conf.j2', dest: "/etc/jitsi/videobridge/jvb.conf", owner: "jvb", group: "jitsi", mode: "0640" }
+    - { src: 'videobridge/logging.properties.j2', dest: "/etc/jitsi/videobridge/jlogging.properties", owner: "jvb", group: "jitsi", mode: "0640" }
+    - { src: 'videobridge/sip-communicator.properties.j2', dest: "/etc/jitsi/videobridge/sip-communicator.properties", owner: "jvb", group: "jitsi", mode: "0640" }
+    - { src: 'jicofo/logging.properties.j2', dest: "/etc/jitsi/jicofo/logging.properties", owner: "jicofo", group: "jitsi", mode: "0640" }
+    - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
+    - { src: 'prosody/prosody.cfg.lua.j2', dest: "/etc/prosody/prosody.cfg.lua", owner: "root", group: "prosody", mode: "0640" }
+    - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
+
+#- name: Install Jitsi Meet
+#  ansible.builtin.apt:
+#    name: 
+#       - nginx-full
+#       - python3-certbot-nginx
+#    state: present
+#    install_recommends: no
diff --git a/webapps/jitsimeet/templates/jicofo/logging.properties.j2 b/webapps/jitsimeet/templates/jicofo/logging.properties.j2
new file mode 100644
index 00000000..7181e262
--- /dev/null
+++ b/webapps/jitsimeet/templates/jicofo/logging.properties.j2
@@ -0,0 +1,38 @@
+
+handlers= java.util.logging.ConsoleHandler
+
+# Handlers with XMPP debug enabled:
+#handlers= java.util.logging.ConsoleHandler, org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler
+
+# Handlers with syslog enabled:
+#handlers= java.util.logging.ConsoleHandler, com.agafua.syslog.SyslogHandler
+#handlers= java.util.logging.ConsoleHandler, io.sentry.jul.SentryHandler
+
+java.util.logging.ConsoleHandler.level = ALL
+java.util.logging.ConsoleHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
+java.util.logging.ConsoleHandler.filter = org.jitsi.impl.protocol.xmpp.log.ExcludeXmppPackets
+
+org.jitsi.utils.logging2.JitsiLogFormatter.programname=Jicofo
+.level=INFO
+
+# To enable XMPP packets logging add XmppPacketsFileHandler to the handlers property
+org.jitsi.impl.protocol.xmpp.log.PacketDebugger.level=ALL
+org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler.pattern=/var/log/jitsi/jicofo-xmpp.log
+org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler.append=true
+org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler.limit=200000000
+org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler.count=3
+
+# Syslog (uncomment handler to use)
+com.agafua.syslog.SyslogHandler.transport = udp
+com.agafua.syslog.SyslogHandler.facility = local0
+com.agafua.syslog.SyslogHandler.port = 514
+com.agafua.syslog.SyslogHandler.hostname = localhost
+com.agafua.syslog.SyslogHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
+com.agafua.syslog.SyslogHandler.escapeNewlines = false
+com.agafua.syslog.SyslogHandler.filter = org.jitsi.impl.protocol.xmpp.log.ExcludeXmppPackets
+
+# Sentry (uncomment handler to use)
+io.sentry.jul.SentryHandler.level=WARNING
+
+# uncomment to see how Jicofo talks to the JVB
+#org.jitsi.impl.protocol.xmpp.colibri.level=ALL
diff --git a/webapps/jitsimeet/templates/meet/config.js.j2 b/webapps/jitsimeet/templates/meet/config.js.j2
new file mode 100644
index 00000000..1f4473e3
--- /dev/null
+++ b/webapps/jitsimeet/templates/meet/config.js.j2
@@ -0,0 +1,1597 @@
+/* eslint-disable comma-dangle, no-unused-vars, no-var, prefer-template, vars-on-top */
+
+/*
+ * NOTE: If you add a new option please remember to document it here:
+ * https://jitsi.github.io/handbook/docs/dev-guide/dev-guide-configuration
+ */
+
+var subdir = '<!--# echo var="subdir" default="" -->';
+var subdomain = '<!--# echo var="subdomain" default="" -->';
+
+if (subdomain) {
+    subdomain = subdomain.substr(0, subdomain.length - 1).split('.')
+        .join('_')
+        .toLowerCase() + '.';
+}
+
+// In case of no ssi provided by the webserver, use empty strings
+if (subdir.startsWith('<!--')) {
+    subdir = '';
+}
+if (subdomain.startsWith('<!--')) {
+    subdomain = '';
+}
+
+var enableJaaS = false;
+
+var config = {
+    // Connection
+    //
+
+    hosts: {
+        // XMPP domain.
+        domain: 'bullseye.domaine-fictif.org',
+
+        // When using authentication, domain for guest users.
+        // anonymousdomain: 'guest.example.com',
+
+        // Domain for authenticated users. Defaults to <domain>.
+        // authdomain: 'bullseye.domaine-fictif.org',
+
+        // Focus component domain. Defaults to focus.<domain>.
+        // focus: 'focus.bullseye.domaine-fictif.org',
+
+        // XMPP MUC domain. FIXME: use XEP-0030 to discover it.
+        muc: 'conference.' + subdomain + 'bullseye.domaine-fictif.org',
+    },
+
+    // BOSH URL. FIXME: use XEP-0156 to discover it.
+    bosh: 'https://bullseye.domaine-fictif.org/' + subdir + 'http-bind',
+
+    // Websocket URL (XMPP)
+    // websocket: 'wss://bullseye.domaine-fictif.org/' + subdir + 'xmpp-websocket',
+
+    // The real JID of focus participant - can be overridden here
+    // Do not change username - FIXME: Make focus username configurable
+    // https://github.com/jitsi/jitsi-meet/issues/7376
+    // focusUserJid: 'focus@auth.bullseye.domaine-fictif.org',
+
+    // Options related to the bridge (colibri) data channel
+    bridgeChannel: {
+        // If the backend advertises multiple colibri websockets, this options allows
+        // to filter some of them out based on the domain name. We use the first URL
+        // which does not match ignoreDomain, falling back to the first one that matches
+        // ignoreDomain. Has no effect if undefined.
+        // ignoreDomain: 'example.com',
+
+        // Prefer SCTP (WebRTC data channels over the media path) over a colibri websocket.
+        // If SCTP is available in the backend it will be used instead of a WS. Defaults to
+        // false (SCTP is used only if available and no WS are available).
+        // preferSctp: false
+    },
+
+    // Testing / experimental features.
+    //
+
+    testing: {
+        // Disables the End to End Encryption feature. Useful for debugging
+        // issues related to insertable streams.
+        // disableE2EE: false,
+
+        // Enables XMPP WebSocket (as opposed to BOSH) for the given amount of users.
+        // mobileXmppWsThreshold: 10, // enable XMPP WebSockets on mobile for 10% of the users
+
+        // P2P test mode disables automatic switching to P2P when there are 2
+        // participants in the conference.
+        // p2pTestMode: false,
+
+        // Enables the test specific features consumed by jitsi-meet-torture
+        // testMode: false,
+
+        // Disables the auto-play behavior of *all* newly created video element.
+        // This is useful when the client runs on a host with limited resources.
+        // noAutoPlayVideo: false,
+
+        // Enable callstats only for a percentage of users.
+        // This takes a value between 0 and 100 which determines the probability for
+        // the callstats to be enabled.
+        // callStatsThreshold: 5, // enable callstats for 5% of the users.
+    },
+
+    // Disables moderator indicators.
+    // disableModeratorIndicator: false,
+
+    // Disables the reactions feature.
+    // disableReactions: true,
+
+    // Disables the reactions moderation feature.
+    // disableReactionsModeration: false,
+
+    // Disables polls feature.
+    // disablePolls: false,
+
+    // Disables self-view tile. (hides it from tile view and from filmstrip)
+    // disableSelfView: false,
+
+    // Disables self-view settings in UI
+    // disableSelfViewSettings: false,
+
+    // screenshotCapture : {
+    //      Enables the screensharing capture feature.
+    //      enabled: false,
+    //
+    //      The mode for the screenshot capture feature.
+    //      Can be either 'recording' - screensharing screenshots are taken
+    //      only when the recording is also on,
+    //      or 'always' - screensharing screenshots are always taken.
+    //      mode: 'recording',
+    // }
+
+    // Disables ICE/UDP by filtering out local and remote UDP candidates in
+    // signalling.
+    // webrtcIceUdpDisable: false,
+
+    // Disables ICE/TCP by filtering out local and remote TCP candidates in
+    // signalling.
+    // webrtcIceTcpDisable: false,
+
+
+    // Media
+    //
+
+    // Audio
+
+    // Disable measuring of audio levels.
+    // disableAudioLevels: false,
+
+    // audioLevelsInterval: 200,
+
+    // Enabling this will run the lib-jitsi-meet no audio detection module which
+    // will notify the user if the current selected microphone has no audio
+    // input and will suggest another valid device if one is present.
+    enableNoAudioDetection: true,
+
+    // Enabling this will show a "Save Logs" link in the GSM popover that can be
+    // used to collect debug information (XMPP IQs, SDP offer/answer cycles)
+    // about the call.
+    // enableSaveLogs: false,
+
+    // Enabling this will hide the "Show More" link in the GSM popover that can be
+    // used to display more statistics about the connection (IP, Port, protocol, etc).
+    // disableShowMoreStats: true,
+
+    // Enabling this will run the lib-jitsi-meet noise detection module which will
+    // notify the user if there is noise, other than voice, coming from the current
+    // selected microphone. The purpose it to let the user know that the input could
+    // be potentially unpleasant for other meeting participants.
+    enableNoisyMicDetection: true,
+
+    // Start the conference in audio only mode (no video is being received nor
+    // sent).
+    // startAudioOnly: false,
+
+    // Every participant after the Nth will start audio muted.
+    // startAudioMuted: 10,
+
+    // Start calls with audio muted. Unlike the option above, this one is only
+    // applied locally. FIXME: having these 2 options is confusing.
+    // startWithAudioMuted: false,
+
+    // Enabling it (with #params) will disable local audio output of remote
+    // participants and to enable it back a reload is needed.
+    // startSilent: false,
+
+    // Enables support for opus-red (redundancy for Opus).
+    // enableOpusRed: false,
+
+    // Specify audio quality stereo and opusMaxAverageBitrate values in order to enable HD audio.
+    // Beware, by doing so, you are disabling echo cancellation, noise suppression and AGC.
+    // Specify enableOpusDtx to enable support for opus-dtx where
+    // audio packets won’t be transmitted while participant is silent or muted.
+    // audioQuality: {
+    //     stereo: false,
+    //     opusMaxAverageBitrate: null, // Value to fit the 6000 to 510000 range.
+    //     enableOpusDtx: false,
+    // },
+
+    // Noise suppression configuration. By default rnnoise is used. Optionally Krisp
+    // can be used by enabling it below, but the Krisp JS SDK files must be supplied in your
+    // installation. Specifically, these files are needed:
+    //   - https://meet.example.com/libs/krisp/krisp.mjs
+    //   - https://meet.example.com/libs/krisp/models/model_8.kw
+    //   - https://meet.example.com/libs/krisp/models/model_16.kw
+    //   - https://meet.example.com/libs/krisp/models/model_32.kw
+    // NOTE: Krisp JS SDK v1.0.9 was tested.
+    // noiseSuppression: {
+    //     krisp: {
+    //         enabled: false,
+    //         logProcessStats: false,
+    //         debugLogs: false,
+    //     },
+    // },
+
+    // Video
+
+    // Sets the preferred resolution (height) for local video. Defaults to 720.
+    // resolution: 720,
+
+    // Specifies whether the raised hand will hide when someone becomes a dominant speaker or not
+    // disableRemoveRaisedHandOnFocus: false,
+
+    // speakerStats: {
+    //     // Specifies whether the speaker stats is enable or not.
+    //     disabled: false,
+
+    //     // Specifies whether there will be a search field in speaker stats or not.
+    //     disableSearch: false,
+
+    //     // Specifies whether participants in speaker stats should be ordered or not, and with what priority.
+    //     // 'role', <- Moderators on top.
+    //     // 'name', <- Alphabetically by name.
+    //     // 'hasLeft', <- The ones that have left in the bottom.
+    //     order: [
+    //         'role',
+    //         'name',
+    //         'hasLeft',
+    //     ],
+    // },
+
+    // DEPRECATED. Please use speakerStats.disableSearch instead.
+    // Specifies whether there will be a search field in speaker stats or not
+    // disableSpeakerStatsSearch: false,
+
+    // DEPRECATED. Please use speakerStats.order .
+    // Specifies whether participants in speaker stats should be ordered or not, and with what priority
+    // speakerStatsOrder: [
+    //  'role', <- Moderators on top
+    //  'name', <- Alphabetically by name
+    //  'hasLeft', <- The ones that have left in the bottom
+    // ], <- the order of the array elements determines priority
+
+    // How many participants while in the tile view mode, before the receiving video quality is reduced from HD to SD.
+    // Use -1 to disable.
+    // maxFullResolutionParticipants: 2,
+
+    // w3c spec-compliant video constraints to use for video capture. Currently
+    // used by browsers that return true from lib-jitsi-meet's
+    // util#browser#usesNewGumFlow. The constraints are independent from
+    // this config's resolution value. Defaults to requesting an ideal
+    // resolution of 720p.
+    // constraints: {
+    //     video: {
+    //         height: {
+    //             ideal: 720,
+    //             max: 720,
+    //             min: 240,
+    //         },
+    //     },
+    // },
+
+    // Enable / disable simulcast support.
+    // disableSimulcast: false,
+
+    // Every participant after the Nth will start video muted.
+    // startVideoMuted: 10,
+
+    // Start calls with video muted. Unlike the option above, this one is only
+    // applied locally. FIXME: having these 2 options is confusing.
+    // startWithVideoMuted: false,
+
+    // Desktop sharing
+
+    // Optional desktop sharing frame rate options. Default value: min:5, max:5.
+    // desktopSharingFrameRate: {
+    //     min: 5,
+    //     max: 5,
+    // },
+
+    // This option has been deprecated since it is no longer supported as per the w3c spec.
+    // https://w3c.github.io/mediacapture-screen-share/#dom-mediadevices-getdisplaymedia. If the user has not
+    // interacted with the webpage before the getDisplayMedia call, the promise will be rejected by the browser. This
+    // has already been implemented in Firefox and Safari and will be implemented in Chrome soon.
+    // https://bugs.chromium.org/p/chromium/issues/detail?id=1198918
+    // startScreenSharing: false,
+
+    // Recording
+
+    // DEPRECATED. Use recordingService.enabled instead.
+    // fileRecordingsEnabled: false,
+
+    // Enable the dropbox integration.
+    // dropbox: {
+    //     appKey: '<APP_KEY>', // Specify your app key here.
+    //     // A URL to redirect the user to, after authenticating
+    //     // by default uses:
+    //     // 'https://bullseye.domaine-fictif.org/static/oauth.html'
+    //     redirectURI:
+    //          'https://bullseye.domaine-fictif.org/subfolder/static/oauth.html',
+    // },
+
+    // recordingService: {
+    //     // When integrations like dropbox are enabled only that will be shown,
+    //     // by enabling fileRecordingsServiceEnabled, we show both the integrations
+    //     // and the generic recording service (its configuration and storage type
+    //     // depends on jibri configuration)
+    //     enabled: false,
+
+    //     // Whether to show the possibility to share file recording with other people
+    //     // (e.g. meeting participants), based on the actual implementation
+    //     // on the backend.
+    //     sharingEnabled: false,
+
+    //     // Hide the warning that says we only store the recording for 24 hours.
+    //     hideStorageWarning: false,
+    // },
+
+    // DEPRECATED. Use recordingService.enabled instead.
+    // fileRecordingsServiceEnabled: false,
+
+    // DEPRECATED. Use recordingService.sharingEnabled instead.
+    // fileRecordingsServiceSharingEnabled: false,
+
+    // Local recording configuration.
+    // localRecording: {
+    //     // Whether to disable local recording or not.
+    //     disable: false,
+
+    //     // Whether to notify all participants when a participant is recording locally.
+    //     notifyAllParticipants: false,
+
+    //     // Whether to disable the self recording feature (only local participant streams).
+    //     disableSelfRecording: false,
+    // },
+
+    // Customize the Live Streaming dialog. Can be modified for a non-YouTube provider.
+    // liveStreaming: {
+    //    // Whether to enable live streaming or not.
+    //    enabled: false,
+    //    // Terms link
+    //    termsLink: 'https://www.youtube.com/t/terms',
+    //    // Data privacy link
+    //    dataPrivacyLink: 'https://policies.google.com/privacy',
+    //    // RegExp string that validates the stream key input field
+    //    validatorRegExpString: '^(?:[a-zA-Z0-9]{4}(?:-(?!$)|$)){4}',
+    //    // Documentation reference for the live streaming feature.
+    //    helpLink: 'https://jitsi.org/live'
+    // },
+
+    // DEPRECATED. Use liveStreaming.enabled instead.
+    // liveStreamingEnabled: false,
+
+    // DEPRECATED. Use transcription.enabled instead.
+    // transcribingEnabled: false,
+
+    // DEPRECATED. Use transcription.useAppLanguage instead.
+    // transcribeWithAppLanguage: true,
+
+    // DEPRECATED. Use transcription.preferredLanguage instead.
+    // preferredTranscribeLanguage: 'en-US',
+
+    // DEPRECATED. Use transcription.autoCaptionOnRecord instead.
+    // autoCaptionOnRecord: false,
+
+    // Transcription options.
+    // transcription: {
+    //     // Whether the feature should be enabled or not.
+    //     enabled: false,
+
+    //     // Translation languages.
+    //     // Available languages can be found in
+    //     // ./src/react/features/transcribing/translation-languages.json.
+    //     translationLanguages: ['en', 'es', 'fr', 'ro'],
+
+    //     // Important languages to show on the top of the language list.
+    //     translationLanguagesHead: ['en'],
+
+    //     // If true transcriber will use the application language.
+    //     // The application language is either explicitly set by participants in their settings or automatically
+    //     // detected based on the environment, e.g. if the app is opened in a chrome instance which
+    //     // is using french as its default language then transcriptions for that participant will be in french.
+    //     // Defaults to true.
+    //     useAppLanguage: true,
+
+    //     // Transcriber language. This settings will only work if "useAppLanguage"
+    //     // is explicitly set to false.
+    //     // Available languages can be found in
+    //     // ./src/react/features/transcribing/transcriber-langs.json.
+    //     preferredLanguage: 'en-US',
+
+    //     // Disable start transcription for all participants.
+    //     disableStartForAll: false,
+
+    //     // Enables automatic turning on captions when recording is started
+    //     autoCaptionOnRecord: false,
+    // },
+
+    // Misc
+
+    // Default value for the channel "last N" attribute. -1 for unlimited.
+    channelLastN: -1,
+
+    // Connection indicators
+    // connectionIndicators: {
+    //     autoHide: true,
+    //     autoHideTimeout: 5000,
+    //     disabled: false,
+    //     disableDetails: false,
+    //     inactiveDisabled: false
+    // },
+
+    // Provides a way for the lastN value to be controlled through the UI.
+    // When startLastN is present, conference starts with a last-n value of startLastN and channelLastN
+    // value will be used when the quality level is selected using "Manage Video Quality" slider.
+    // startLastN: 1,
+
+    // Specify the settings for video quality optimizations on the client.
+    // videoQuality: {
+    //    // Provides a way to prevent a video codec from being negotiated on the JVB connection. The codec specified
+    //    // here will be removed from the list of codecs present in the SDP answer generated by the client. If the
+    //    // same codec is specified for both the disabled and preferred option, the disable settings will prevail.
+    //    // Note that 'VP8' cannot be disabled since it's a mandatory codec, the setting will be ignored in this case.
+    //    disabledCodec: 'H264',
+    //
+    //    // Provides a way to set a preferred video codec for the JVB connection. If 'H264' is specified here,
+    //    // simulcast will be automatically disabled since JVB doesn't support H264 simulcast yet. This will only
+    //    // rearrange the the preference order of the codecs in the SDP answer generated by the browser only if the
+    //    // preferred codec specified here is present. Please ensure that the JVB offers the specified codec for this
+    //    // to take effect.
+    //    preferredCodec: 'VP8',
+    //
+    //    // Provides a way to enforce the preferred codec for the conference even when the conference has endpoints
+    //    // that do not support the preferred codec. For example, older versions of Safari do not support VP9 yet.
+    //    // This will result in Safari not being able to decode video from endpoints sending VP9 video.
+    //    // When set to false, the conference falls back to VP8 whenever there is an endpoint that doesn't support the
+    //    // preferred codec and goes back to the preferred codec when that endpoint leaves.
+    //    enforcePreferredCodec: false,
+    //
+    //    // Provides a way to configure the maximum bitrates that will be enforced on the simulcast streams for
+    //    // video tracks. The keys in the object represent the type of the stream (LD, SD or HD) and the values
+    //    // are the max.bitrates to be set on that particular type of stream. The actual send may vary based on
+    //    // the available bandwidth calculated by the browser, but it will be capped by the values specified here.
+    //    // This is currently not implemented on app based clients on mobile.
+    //    maxBitratesVideo: {
+    //          H264: {
+    //              low: 200000,
+    //              standard: 500000,
+    //              high: 1500000,
+    //          },
+    //          VP8 : {
+    //              low: 200000,
+    //              standard: 500000,
+    //              high: 1500000,
+    //          },
+    //          VP9: {
+    //              low: 100000,
+    //              standard: 300000,
+    //              high: 1200000,
+    //          },
+    //    },
+    //
+    //    // The options can be used to override default thresholds of video thumbnail heights corresponding to
+    //    // the video quality levels used in the application. At the time of this writing the allowed levels are:
+    //    //     'low' - for the low quality level (180p at the time of this writing)
+    //    //     'standard' - for the medium quality level (360p)
+    //    //     'high' - for the high quality level (720p)
+    //    // The keys should be positive numbers which represent the minimal thumbnail height for the quality level.
+    //    //
+    //    // With the default config value below the application will use 'low' quality until the thumbnails are
+    //    // at least 360 pixels tall. If the thumbnail height reaches 720 pixels then the application will switch to
+    //    // the high quality.
+    //    minHeightForQualityLvl: {
+    //        360: 'standard',
+    //        720: 'high',
+    //    },
+    //
+    // },
+
+    // Notification timeouts
+    // notificationTimeouts: {
+    //     short: 2500,
+    //     medium: 5000,
+    //     long: 10000,
+    // },
+
+    // // Options for the recording limit notification.
+    // recordingLimit: {
+    //
+    //    // The recording limit in minutes. Note: This number appears in the notification text
+    //    // but doesn't enforce the actual recording time limit. This should be configured in
+    //    // jibri!
+    //    limit: 60,
+    //
+    //    // The name of the app with unlimited recordings.
+    //    appName: 'Unlimited recordings APP',
+    //
+    //    // The URL of the app with unlimited recordings.
+    //    appURL: 'https://unlimited.recordings.app.com/',
+    // },
+
+    // Disables or enables RTX (RFC 4588) (defaults to false).
+    // disableRtx: false,
+
+    // Moves all Jitsi Meet 'beforeunload' logic (cleanup, leaving, disconnecting, etc) to the 'unload' event.
+    // disableBeforeUnloadHandlers: true,
+
+    // Disables or enables TCC support in this client (default: enabled).
+    // enableTcc: true,
+
+    // Disables or enables REMB support in this client (default: enabled).
+    // enableRemb: true,
+
+    // Enables ICE restart logic in LJM and displays the page reload overlay on
+    // ICE failure. Current disabled by default because it's causing issues with
+    // signaling when Octo is enabled. Also when we do an "ICE restart"(which is
+    // not a real ICE restart), the client maintains the TCC sequence number
+    // counter, but the bridge resets it. The bridge sends media packets with
+    // TCC sequence numbers starting from 0.
+    // enableIceRestart: false,
+
+    // Enables forced reload of the client when the call is migrated as a result of
+    // the bridge going down.
+    // enableForcedReload: true,
+
+    // Use TURN/UDP servers for the jitsi-videobridge connection (by default
+    // we filter out TURN/UDP because it is usually not needed since the
+    // bridge itself is reachable via UDP)
+    // useTurnUdp: false
+
+    // Enable support for encoded transform in supported browsers. This allows
+    // E2EE to work in Safari if the corresponding flag is enabled in the browser.
+    // Experimental.
+    // enableEncodedTransformSupport: false,
+
+    // UI
+    //
+
+    // Disables responsive tiles.
+    // disableResponsiveTiles: false,
+
+    // DEPRECATED. Please use `securityUi?.hideLobbyButton` instead.
+    // Hides lobby button.
+    // hideLobbyButton: false,
+
+    // DEPRECATED. Please use `lobby?.autoKnock` instead.
+    // If Lobby is enabled starts knocking automatically.
+    // autoKnockLobby: false,
+
+    // DEPRECATED. Please use `lobby?.enableChat` instead.
+    // Enable lobby chat.
+    // enableLobbyChat: true,
+
+    // DEPRECATED! Use `breakoutRooms.hideAddRoomButton` instead.
+    // Hides add breakout room button
+    // hideAddRoomButton: false,
+
+    // Require users to always specify a display name.
+    // requireDisplayName: true,
+
+    // Enables webhid functionality for Audio.
+    // enableWebHIDFeature: false,
+
+    // DEPRECATED! Use 'welcomePage.disabled' instead.
+    // Whether to use a welcome page or not. In case it's false a random room
+    // will be joined when no room is specified.
+    // enableWelcomePage: true,
+
+    // Configs for welcome page.
+    // welcomePage: {
+    //     // Whether to disable welcome page. In case it's disabled a random room
+    //     // will be joined when no room is specified.
+    //     disabled: false,
+    //     // If set,landing page will redirect to this URL.
+    //     customUrl: ''
+    // },
+
+    // Configs for the lobby screen.
+    // lobby {
+    //     // If Lobby is enabled, it starts knocking automatically. Replaces `autoKnockLobby`.
+    //     autoKnock: false,
+    //     // Enables the lobby chat. Replaces `enableLobbyChat`.
+    //     enableChat: true,
+    // },
+
+    // Configs for the security related UI elements.
+    // securityUi: {
+    //     // Hides the lobby button. Replaces `hideLobbyButton`.
+    //     hideLobbyButton: false,
+    //     // Hides the possibility to set and enter a lobby password.
+    //     disableLobbyPassword: false,
+    // },
+
+    // Disable app shortcuts that are registered upon joining a conference
+    // disableShortcuts: false,
+
+    // Disable initial browser getUserMedia requests.
+    // This is useful for scenarios where users might want to start a conference for screensharing only
+    // disableInitialGUM: false,
+
+    // Enabling the close page will ignore the welcome page redirection when
+    // a call is hangup.
+    // enableClosePage: false,
+
+    // Disable hiding of remote thumbnails when in a 1-on-1 conference call.
+    // Setting this to null, will also disable showing the remote videos
+    // when the toolbar is shown on mouse movements
+    // disable1On1Mode: null | false | true,
+
+    // Default local name to be displayed
+    // defaultLocalDisplayName: 'me',
+
+    // Default remote name to be displayed
+    // defaultRemoteDisplayName: 'Fellow Jitster',
+
+    // Hides the display name from the participant thumbnail
+    // hideDisplayName: false,
+
+    // Hides the dominant speaker name badge that hovers above the toolbox
+    // hideDominantSpeakerBadge: false,
+
+    // Default language for the user interface. Cannot be overwritten.
+    // defaultLanguage: 'en',
+
+    // Disables profile and the edit of all fields from the profile settings (display name and email)
+    // disableProfile: false,
+
+    // Hides the email section under profile settings.
+    // hideEmailInSettings: false,
+
+    // When enabled the password used for locking a room is restricted to up to the number of digits specified
+    // default: roomPasswordNumberOfDigits: false,
+    // roomPasswordNumberOfDigits: 10,
+
+    // Message to show the users. Example: 'The service will be down for
+    // maintenance at 01:00 AM GMT,
+    // noticeMessage: '',
+
+    // Enables calendar integration, depends on googleApiApplicationClientID
+    // and microsoftApiApplicationClientID
+    // enableCalendarIntegration: false,
+
+    // Configs for prejoin page.
+    // prejoinConfig: {
+    //     // When 'true', it shows an intermediate page before joining, where the user can configure their devices.
+    //     // This replaces `prejoinPageEnabled`.
+    //     enabled: true,
+    //     // Hides the participant name editing field in the prejoin screen.
+    //     // If requireDisplayName is also set as true, a name should still be provided through
+    //     // either the jwt or the userInfo from the iframe api init object in order for this to have an effect.
+    //     hideDisplayName: false,
+    //     // List of buttons to hide from the extra join options dropdown.
+    //     hideExtraJoinButtons: ['no-audio', 'by-phone'],
+    // },
+
+    // When 'true', the user cannot edit the display name.
+    // (Mainly useful when used in conjunction with the JWT so the JWT name becomes read only.)
+    // readOnlyName: false,
+
+    // If etherpad integration is enabled, setting this to true will
+    // automatically open the etherpad when a participant joins.  This
+    // does not affect the mobile app since opening an etherpad
+    // obscures the conference controls -- it's better to let users
+    // choose to open the pad on their own in that case.
+    // openSharedDocumentOnJoin: false,
+
+    // If true, shows the unsafe room name warning label when a room name is
+    // deemed unsafe (due to the simplicity in the name) and a password is not
+    // set or the lobby is not enabled.
+    // enableInsecureRoomNameWarning: false,
+
+    // Whether to automatically copy invitation URL after creating a room.
+    // Document should be focused for this option to work
+    // enableAutomaticUrlCopy: false,
+
+    // Array with avatar URL prefixes that need to use CORS.
+    // corsAvatarURLs: [ 'https://www.gravatar.com/avatar/' ],
+
+    // Base URL for a Gravatar-compatible service. Defaults to Gravatar.
+    // DEPRECATED! Use `gravatar.baseUrl` instead.
+    // gravatarBaseURL: 'https://www.gravatar.com/avatar/',
+
+    // Setup for Gravatar-compatible services.
+    // gravatar: {
+    //     // Defaults to Gravatar.
+    //     baseUrl: 'https://www.gravatar.com/avatar/',
+    //     // True if Gravatar should be disabled.
+    //     disabled: false,
+    // },
+
+    // App name to be displayed in the invitation email subject, as an alternative to
+    // interfaceConfig.APP_NAME.
+    // inviteAppName: null,
+
+    // Moved from interfaceConfig(TOOLBAR_BUTTONS).
+    // The name of the toolbar buttons to display in the toolbar, including the
+    // "More actions" menu. If present, the button will display. Exceptions are
+    // "livestreaming" and "recording" which also require being a moderator and
+    // some other values in config.js to be enabled. Also, the "profile" button will
+    // not display for users with a JWT.
+    // Notes:
+    // - it's impossible to choose which buttons go in the "More actions" menu
+    // - it's impossible to control the placement of buttons
+    // - 'desktop' controls the "Share your screen" button
+    // - if `toolbarButtons` is undefined, we fallback to enabling all buttons on the UI
+    // toolbarButtons: [
+    //    'camera',
+    //    'chat',
+    //    'closedcaptions',
+    //    'desktop',
+    //    'download',
+    //    'embedmeeting',
+    //    'etherpad',
+    //    'feedback',
+    //    'filmstrip',
+    //    'fullscreen',
+    //    'hangup',
+    //    'help',
+    //    'highlight',
+    //    'invite',
+    //    'linktosalesforce',
+    //    'livestreaming',
+    //    'microphone',
+    //    'noisesuppression',
+    //    'participants-pane',
+    //    'profile',
+    //    'raisehand',
+    //    'recording',
+    //    'security',
+    //    'select-background',
+    //    'settings',
+    //    'shareaudio',
+    //    'sharedvideo',
+    //    'shortcuts',
+    //    'stats',
+    //    'tileview',
+    //    'toggle-camera',
+    //    'videoquality',
+    //    'whiteboard',
+    // ],
+
+    // Holds values related to toolbar visibility control.
+    // toolbarConfig: {
+    //     // Moved from interfaceConfig.INITIAL_TOOLBAR_TIMEOUT
+    //     // The initial number of milliseconds for the toolbar buttons to be visible on screen.
+    //     initialTimeout: 20000,
+    //     // Moved from interfaceConfig.TOOLBAR_TIMEOUT
+    //     // Number of milliseconds for the toolbar buttons to be visible on screen.
+    //     timeout: 4000,
+    //     // Moved from interfaceConfig.TOOLBAR_ALWAYS_VISIBLE
+    //     // Whether toolbar should be always visible or should hide after x milliseconds.
+    //     alwaysVisible: false,
+    //     // Indicates whether the toolbar should still autohide when chat is open
+    //     autoHideWhileChatIsOpen: false,
+    // },
+
+    // Toolbar buttons which have their click/tap event exposed through the API on
+    // `toolbarButtonClicked`. Passing a string for the button key will
+    // prevent execution of the click/tap routine; passing an object with `key` and
+    // `preventExecution` flag on false will not prevent execution of the click/tap
+    // routine. Below array with mixed mode for passing the buttons.
+    // buttonsWithNotifyClick: [
+    //     'camera',
+    //     {
+    //         key: 'chat',
+    //         preventExecution: false
+    //     },
+    //     {
+    //         key: 'closedcaptions',
+    //         preventExecution: true
+    //     },
+    //     'desktop',
+    //     'download',
+    //     'embedmeeting',
+    //     'end-meeting',
+    //     'etherpad',
+    //     'feedback',
+    //     'filmstrip',
+    //     'fullscreen',
+    //     'hangup',
+    //     'hangup-menu',
+    //     'help',
+    //     {
+    //         key: 'invite',
+    //         preventExecution: false
+    //     },
+    //     'livestreaming',
+    //     'microphone',
+    //     'mute-everyone',
+    //     'mute-video-everyone',
+    //     'noisesuppression',
+    //     'participants-pane',
+    //     'profile',
+    //     {
+    //         key: 'raisehand',
+    //         preventExecution: true
+    //     },
+    //     'recording',
+    //     'security',
+    //     'select-background',
+    //     'settings',
+    //     'shareaudio',
+    //     'sharedvideo',
+    //     'shortcuts',
+    //     'stats',
+    //     'tileview',
+    //     'toggle-camera',
+    //     'videoquality',
+    //     // The add passcode button from the security dialog.
+    //     {
+    //         key: 'add-passcode',
+    //         preventExecution: false
+    //     },
+    //     'whiteboard',
+    // ],
+
+    // List of pre meeting screens buttons to hide. The values must be one or more of the 5 allowed buttons:
+    // 'microphone', 'camera', 'select-background', 'invite', 'settings'
+    // hiddenPremeetingButtons: [],
+
+    // An array with custom option buttons for the participant context menu
+    // type:  Array<{ icon: string; id: string; text: string; }>
+    // customParticipantMenuButtons: [],
+
+    // An array with custom option buttons for the toolbar
+    // type:  Array<{ icon: string; id: string; text: string; }>
+    // customToolbarButtons: [],
+
+    // Stats
+    //
+
+    // Whether to enable stats collection or not in the TraceablePeerConnection.
+    // This can be useful for debugging purposes (post-processing/analysis of
+    // the webrtc stats) as it is done in the jitsi-meet-torture bandwidth
+    // estimation tests.
+    // gatherStats: false,
+
+    // The interval at which PeerConnection.getStats() is called. Defaults to 10000
+    // pcStatsInterval: 10000,
+
+    // To enable sending statistics to callstats.io you must provide the
+    // Application ID and Secret.
+    // callStatsID: '',
+    // callStatsSecret: '',
+    // callStatsApplicationLogsDisabled: false,
+
+    // The callstats initialize config params as described in the API:
+    // https://docs.callstats.io/docs/javascript#callstatsinitialize-with-app-secret
+    // callStatsConfigParams: {
+    //     disableBeforeUnloadHandler: true, // disables callstats.js's window.onbeforeunload parameter.
+    //     applicationVersion: "app_version", // Application version specified by the developer.
+    //     disablePrecalltest: true, // disables the pre-call test, it is enabled by default.
+    //     siteID: "siteID", // The name/ID of the site/campus from where the call/pre-call test is made.
+    //     additionalIDs: { // additionalIDs object, contains application related IDs.
+    //         customerID: "Customer Identifier. Example, walmart.",
+    //         tenantID: "Tenant Identifier. Example, monster.",
+    //         productName: "Product Name. Example, Jitsi.",
+    //         meetingsName: "Meeting Name. Example, Jitsi loves callstats.",
+    //         serverName: "Server/MiddleBox Name. Example, jvb-prod-us-east-mlkncws12.",
+    //         pbxID: "PBX Identifier. Example, walmart.",
+    //         pbxExtensionID: "PBX Extension Identifier. Example, 5625.",
+    //         fqExtensionID: "Fully qualified Extension Identifier. Example, +71 (US) +5625.",
+    //         sessionID: "Session Identifier. Example, session-12-34",
+    //     },
+    //     collectLegacyStats: true, //enables the collection of legacy stats in chrome browser
+    //     collectIP: true, //enables the collection localIP address
+    // },
+
+    // Enables sending participants' display names to callstats
+    // enableDisplayNameInStats: false,
+
+    // Enables sending participants' emails (if available) to callstats and other analytics
+    // enableEmailInStats: false,
+
+    // faceLandmarks: {
+    //     // Enables sharing your face coordinates. Used for centering faces within a video.
+    //     enableFaceCentering: false,
+
+    //     // Enables detecting face expressions and sharing data with other participants
+    //     enableFaceExpressionsDetection: false,
+
+    //     // Enables displaying face expressions in speaker stats
+    //     enableDisplayFaceExpressions: false,
+
+    //     // Enable rtc stats for face landmarks
+    //     enableRTCStats: false,
+
+    //     // Minimum required face movement percentage threshold for sending new face centering coordinates data.
+    //     faceCenteringThreshold: 10,
+
+    //     // Milliseconds for processing a new image capture in order to detect face coordinates if they exist.
+    //     captureInterval: 1000,
+    // },
+
+    // Controls the percentage of automatic feedback shown to participants when callstats is enabled.
+    // The default value is 100%. If set to 0, no automatic feedback will be requested
+    // feedbackPercentage: 100,
+
+    // Privacy
+    //
+
+    // If third party requests are disabled, no other server will be contacted.
+    // This means avatars will be locally generated and callstats integration
+    // will not function.
+    // disableThirdPartyRequests: false,
+
+
+    // Peer-To-Peer mode: used (if enabled) when there are just 2 participants.
+    //
+
+    p2p: {
+        // Enables peer to peer mode. When enabled the system will try to
+        // establish a direct connection when there are exactly 2 participants
+        // in the room. If that succeeds the conference will stop sending data
+        // through the JVB and use the peer to peer connection instead. When a
+        // 3rd participant joins the conference will be moved back to the JVB
+        // connection.
+        enabled: true,
+
+        // Sets the ICE transport policy for the p2p connection. At the time
+        // of this writing the list of possible values are 'all' and 'relay',
+        // but that is subject to change in the future. The enum is defined in
+        // the WebRTC standard:
+        // https://www.w3.org/TR/webrtc/#rtcicetransportpolicy-enum.
+        // If not set, the effective value is 'all'.
+        // iceTransportPolicy: 'all',
+
+        // Provides a way to set the video codec preference on the p2p connection. Acceptable
+        // codec values are 'VP8', 'VP9' and 'H264'.
+        // preferredCodec: 'H264',
+
+        // Provides a way to prevent a video codec from being negotiated on the p2p connection.
+        // disabledCodec: '',
+
+        // How long we're going to wait, before going back to P2P after the 3rd
+        // participant has left the conference (to filter out page reload).
+        // backToP2PDelay: 5,
+
+        // The STUN servers that will be used in the peer to peer connections
+        stunServers: [
+
+            // { urls: 'stun:bullseye.domaine-fictif.org:3478' },
+            { urls: 'stun:meet-jit-si-turnrelay.jitsi.net:443' },
+        ],
+    },
+
+    analytics: {
+        // True if the analytics should be disabled
+        // disabled: false,
+
+        // The Google Analytics Tracking ID:
+        // googleAnalyticsTrackingId: 'your-tracking-id-UA-123456-1',
+
+        // Matomo configuration:
+        // matomoEndpoint: 'https://your-matomo-endpoint/',
+        // matomoSiteID: '42',
+
+        // The Amplitude APP Key:
+        // amplitudeAPPKey: '<APP_KEY>',
+
+        // Obfuscates room name sent to analytics (amplitude, rtcstats)
+        // Default value is false.
+        // obfuscateRoomName: false,
+
+        // Configuration for the rtcstats server:
+        // By enabling rtcstats server every time a conference is joined the rtcstats
+        // module connects to the provided rtcstatsEndpoint and sends statistics regarding
+        // PeerConnection states along with getStats metrics polled at the specified
+        // interval.
+        // rtcstatsEnabled: false,
+        // rtcstatsStoreLogs: false,
+
+        // In order to enable rtcstats one needs to provide a endpoint url.
+        // rtcstatsEndpoint: wss://rtcstats-server-pilot.jitsi.net/,
+
+        // The interval at which rtcstats will poll getStats, defaults to 10000ms.
+        // If the value is set to 0 getStats won't be polled and the rtcstats client
+        // will only send data related to RTCPeerConnection events.
+        // rtcstatsPollInterval: 10000,
+
+        // This determines if rtcstats sends the SDP to the rtcstats server or replaces
+        // all SDPs with an empty string instead.
+        // rtcstatsSendSdp: false,
+
+        // Array of script URLs to load as lib-jitsi-meet "analytics handlers".
+        // scriptURLs: [
+        //      "libs/analytics-ga.min.js", // google-analytics
+        //      "https://example.com/my-custom-analytics.js",
+        // ],
+    },
+
+    // Logs that should go be passed through the 'log' event if a handler is defined for it
+    // apiLogLevels: ['warn', 'log', 'error', 'info', 'debug'],
+
+    // Information about the jitsi-meet instance we are connecting to, including
+    // the user region as seen by the server.
+    // deploymentInfo: {
+    //     shard: "shard1",
+    //     region: "europe",
+    //     userRegion: "asia",
+    // },
+
+    // Array<string> of disabled sounds.
+    // Possible values:
+    // - 'ASKED_TO_UNMUTE_SOUND'
+    // - 'E2EE_OFF_SOUND'
+    // - 'E2EE_ON_SOUND'
+    // - 'INCOMING_MSG_SOUND'
+    // - 'KNOCKING_PARTICIPANT_SOUND'
+    // - 'LIVE_STREAMING_OFF_SOUND'
+    // - 'LIVE_STREAMING_ON_SOUND'
+    // - 'NO_AUDIO_SIGNAL_SOUND'
+    // - 'NOISY_AUDIO_INPUT_SOUND'
+    // - 'OUTGOING_CALL_EXPIRED_SOUND'
+    // - 'OUTGOING_CALL_REJECTED_SOUND'
+    // - 'OUTGOING_CALL_RINGING_SOUND'
+    // - 'OUTGOING_CALL_START_SOUND'
+    // - 'PARTICIPANT_JOINED_SOUND'
+    // - 'PARTICIPANT_LEFT_SOUND'
+    // - 'RAISE_HAND_SOUND'
+    // - 'REACTION_SOUND'
+    // - 'RECORDING_OFF_SOUND'
+    // - 'RECORDING_ON_SOUND'
+    // - 'TALK_WHILE_MUTED_SOUND'
+    // disabledSounds: [],
+
+    // DEPRECATED! Use `disabledSounds` instead.
+    // Decides whether the start/stop recording audio notifications should play on record.
+    // disableRecordAudioNotification: false,
+
+    // DEPRECATED! Use `disabledSounds` instead.
+    // Disables the sounds that play when other participants join or leave the
+    // conference (if set to true, these sounds will not be played).
+    // disableJoinLeaveSounds: false,
+
+    // DEPRECATED! Use `disabledSounds` instead.
+    // Disables the sounds that play when a chat message is received.
+    // disableIncomingMessageSound: false,
+
+    // Information for the chrome extension banner
+    // chromeExtensionBanner: {
+    //     // The chrome extension to be installed address
+    //     url: 'https://chrome.google.com/webstore/detail/jitsi-meetings/kglhbbefdnlheedjiejgomgmfplipfeb',
+    //     edgeUrl: 'https://microsoftedge.microsoft.com/addons/detail/jitsi-meetings/eeecajlpbgjppibfledfihobcabccihn',
+
+    //     // Extensions info which allows checking if they are installed or not
+    //     chromeExtensionsInfo: [
+    //         {
+    //             id: 'kglhbbefdnlheedjiejgomgmfplipfeb',
+    //             path: 'jitsi-logo-48x48.png',
+    //         },
+    //         // Edge extension info
+    //         {
+    //             id: 'eeecajlpbgjppibfledfihobcabccihn',
+    //             path: 'jitsi-logo-48x48.png',
+    //         },
+    //     ]
+    // },
+
+    // e2ee: {
+    //   labels,
+    //   externallyManagedKey: false,
+    // },
+
+    // Options related to end-to-end (participant to participant) ping.
+    // e2eping: {
+    //   // Whether ene-to-end pings should be enabled.
+    //   enabled: false,
+    //
+    //   // The number of responses to wait for.
+    //   numRequests: 5,
+    //
+    //   // The max conference size in which e2e pings will be sent.
+    //   maxConferenceSize: 200,
+    //
+    //   // The maximum number of e2e ping messages per second for the whole conference to aim for.
+    //   // This is used to control the pacing of messages in order to reduce the load on the backend.
+    //   maxMessagesPerSecond: 250,
+    // },
+
+    // If set, will attempt to use the provided video input device label when
+    // triggering a screenshare, instead of proceeding through the normal flow
+    // for obtaining a desktop stream.
+    // NOTE: This option is experimental and is currently intended for internal
+    // use only.
+    // _desktopSharingSourceDevice: 'sample-id-or-label',
+
+    // DEPRECATED! Use deeplinking.disabled instead.
+    // If true, any checks to handoff to another application will be prevented
+    // and instead the app will continue to display in the current browser.
+    // disableDeepLinking: false,
+
+    // The deeplinking config.
+    // For information about the properties of
+    // deeplinking.[ios/android].dynamicLink check:
+    // https://firebase.google.com/docs/dynamic-links/create-manually
+    // deeplinking: {
+    //
+    //     // The desktop deeplinking config.
+    //     desktop: {
+    //         appName: 'Jitsi Meet'
+    //     },
+    //     // If true, any checks to handoff to another application will be prevented
+    //     // and instead the app will continue to display in the current browser.
+    //     disabled: false,
+
+    //     // whether to hide the logo on the deep linking pages.
+    //     hideLogo: false,
+
+    //     // The ios deeplinking config.
+    //     ios: {
+    //         appName: 'Jitsi Meet',
+    //         // Specify mobile app scheme for opening the app from the mobile browser.
+    //         appScheme: 'org.jitsi.meet',
+    //         // Custom URL for downloading ios mobile app.
+    //         downloadLink: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
+    //         dynamicLink: {
+    //             apn: 'org.jitsi.meet',
+    //             appCode: 'w2atb',
+    //             customDomain: undefined,
+    //             ibi: 'com.atlassian.JitsiMeet.ios',
+    //             isi: '1165103905'
+    //         }
+    //     },
+
+    //     // The android deeplinking config.
+    //     android: {
+    //         appName: 'Jitsi Meet',
+    //         // Specify mobile app scheme for opening the app from the mobile browser.
+    //         appScheme: 'org.jitsi.meet',
+    //         // Custom URL for downloading android mobile app.
+    //         downloadLink: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
+    //         // Android app package name.
+    //         appPackage: 'org.jitsi.meet',
+    //         fDroidUrl: 'https://f-droid.org/en/packages/org.jitsi.meet/',
+    //         dynamicLink: {
+    //             apn: 'org.jitsi.meet',
+    //             appCode: 'w2atb',
+    //             customDomain: undefined,
+    //             ibi: 'com.atlassian.JitsiMeet.ios',
+    //             isi: '1165103905'
+    //         }
+    //     }
+    // },
+
+    // // The terms, privacy and help centre URL's.
+    // legalUrls: {
+    //     helpCentre: 'https://web-cdn.jitsi.net/faq/meet-faq.html',
+    //     privacy: 'https://jitsi.org/meet/privacy',
+    //     terms: 'https://jitsi.org/meet/terms'
+    // },
+
+    // A property to disable the right click context menu for localVideo
+    // the menu has option to flip the locally seen video for local presentations
+    // disableLocalVideoFlip: false,
+
+    // A property used to unset the default flip state of the local video.
+    // When it is set to 'true', the local(self) video will not be mirrored anymore.
+    // doNotFlipLocalVideo: false,
+
+    // Mainly privacy related settings
+
+    // Disables all invite functions from the app (share, invite, dial out...etc)
+    // disableInviteFunctions: true,
+
+    // Disables storing the room name to the recents list. When in an iframe this is ignored and
+    // the room is never stored in the recents list.
+    // doNotStoreRoom: true,
+
+    // Deployment specific URLs.
+    // deploymentUrls: {
+    //    // If specified a 'Help' button will be displayed in the overflow menu with a link to the specified URL for
+    //    // user documentation.
+    //    userDocumentationURL: 'https://docs.example.com/video-meetings.html',
+    //    // If specified a 'Download our apps' button will be displayed in the overflow menu with a link
+    //    // to the specified URL for an app download page.
+    //    downloadAppsUrl: 'https://docs.example.com/our-apps.html',
+    // },
+
+    // Options related to the remote participant menu.
+    // remoteVideoMenu: {
+    //     // Whether the remote video context menu to be rendered or not.
+    //     disabled: true,
+    //     // If set to true the 'Kick out' button will be disabled.
+    //     disableKick: true,
+    //     // If set to true the 'Grant moderator' button will be disabled.
+    //     disableGrantModerator: true,
+    //     // If set to true the 'Send private message' button will be disabled.
+    //     disablePrivateChat: true,
+    // },
+
+    // Endpoint that enables support for salesforce integration with in-meeting resource linking
+    // This is required for:
+    // listing the most recent records - salesforceUrl/records/recents
+    // searching records - salesforceUrl/records?text=${text}
+    // retrieving record details - salesforceUrl/records/${id}?type=${type}
+    // and linking the meeting - salesforceUrl/sessions/${sessionId}/records/${id}
+    //
+    // salesforceUrl: 'https://api.example.com/',
+
+    // If set to true all muting operations of remote participants will be disabled.
+    // disableRemoteMute: true,
+
+    // Enables support for lip-sync for this client (if the browser supports it).
+    // enableLipSync: false,
+
+    /**
+     External API url used to receive branding specific information.
+     If there is no url set or there are missing fields, the defaults are applied.
+     The config file should be in JSON.
+     None of the fields are mandatory and the response must have the shape:
+    {
+        // The domain url to apply (will replace the domain in the sharing conference link/embed section)
+        inviteDomain: 'example-company.org,
+        // The hex value for the colour used as background
+        backgroundColor: '#fff',
+        // The url for the image used as background
+        backgroundImageUrl: 'https://example.com/background-img.png',
+        // The anchor url used when clicking the logo image
+        logoClickUrl: 'https://example-company.org',
+        // The url used for the image used as logo
+        logoImageUrl: 'https://example.com/logo-img.png',
+        // Overwrite for pool of background images for avatars
+        avatarBackgrounds: ['url(https://example.com/avatar-background-1.png)', '#FFF'],
+        // The lobby/prejoin screen background
+        premeetingBackground: 'url(https://example.com/premeeting-background.png)',
+        // A list of images that can be used as video backgrounds.
+        // When this field is present, the default images will be replaced with those provided.
+        virtualBackgrounds: ['https://example.com/img.jpg'],
+        // Object containing a theme's properties. It also supports partial overwrites of the main theme.
+        // For a list of all possible theme tokens and their current defaults, please check:
+        // https://github.com/jitsi/jitsi-meet/tree/master/resources/custom-theme/custom-theme.json
+        // For a short explanations on each of the tokens, please check:
+        // https://github.com/jitsi/jitsi-meet/blob/master/react/features/base/ui/Tokens.ts
+        // IMPORTANT!: This is work in progress so many of the various tokens are not yet applied in code
+        // or they are partially applied.
+        customTheme: {
+            palette: {
+                ui01: "orange !important",
+                ui02: "maroon",
+                surface02: 'darkgreen',
+                ui03: "violet",
+                ui04: "magenta",
+                ui05: "blueviolet",
+                action01: 'green',
+                action01Hover: 'lightgreen',
+                disabled01: 'beige',
+                success02: 'cadetblue',
+                action02Hover: 'aliceblue',
+            },
+            typography: {
+                labelRegular: {
+                    fontSize: 25,
+                    lineHeight: 30,
+                    fontWeight: 500,
+                }
+            }
+        }
+    }
+    */
+    // dynamicBrandingUrl: '',
+
+    // Options related to the participants pane.
+    // participantsPane: {
+    //     // Hides the moderator settings tab.
+    //     hideModeratorSettingsTab: false,
+    //     // Hides the more actions button.
+    //     hideMoreActionsButton: false,
+    //     // Hides the mute all button.
+    //     hideMuteAllButton: false,
+    // },
+
+    // Options related to the breakout rooms feature.
+    // breakoutRooms: {
+    //     // Hides the add breakout room button. This replaces `hideAddRoomButton`.
+    //     hideAddRoomButton: false,
+    //     // Hides the auto assign participants button.
+    //     hideAutoAssignButton: false,
+    //     // Hides the join breakout room button.
+    //     hideJoinRoomButton: false,
+    // },
+
+    // When true the user cannot add more images to be used as virtual background.
+    // Only the default ones from will be available.
+    // disableAddingBackgroundImages: false,
+
+    // Disables using screensharing as virtual background.
+    // disableScreensharingVirtualBackground: false,
+
+    // Sets the background transparency level. '0' is fully transparent, '1' is opaque.
+    // backgroundAlpha: 1,
+
+    // The URL of the moderated rooms microservice, if available. If it
+    // is present, a link to the service will be rendered on the welcome page,
+    // otherwise the app doesn't render it.
+    // moderatedRoomServiceUrl: 'https://moderated.bullseye.domaine-fictif.org',
+
+    // If true, tile view will not be enabled automatically when the participants count threshold is reached.
+    // disableTileView: true,
+
+    // If true, the tiles will be displayed contained within the available space rather than enlarged to cover it,
+    // with a 16:9 aspect ratio (old behaviour).
+    // disableTileEnlargement: true,
+
+    // Controls the visibility and behavior of the top header conference info labels.
+    // If a label's id is not in any of the 2 arrays, it will not be visible at all on the header.
+    // conferenceInfo: {
+    //     // those labels will not be hidden in tandem with the toolbox.
+    //     alwaysVisible: ['recording', 'raised-hands-count'],
+    //     // those labels will be auto-hidden in tandem with the toolbox buttons.
+    //     autoHide: [
+    //         'subject',
+    //         'conference-timer',
+    //         'participants-count',
+    //         'e2ee',
+    //         'transcribing',
+    //         'video-quality',
+    //         'insecure-room',
+    //         'highlight-moment',
+    //         'top-panel-toggle',
+    //     ]
+    // },
+
+    // Hides the conference subject
+    // hideConferenceSubject: false,
+
+    // Hides the conference timer.
+    // hideConferenceTimer: false,
+
+    // Hides the recording label
+    // hideRecordingLabel: false,
+
+    // Hides the participants stats
+    // hideParticipantsStats: true,
+
+    // Sets the conference subject
+    // subject: 'Conference Subject',
+
+    // Sets the conference local subject
+    // localSubject: 'Conference Local Subject',
+
+    // This property is related to the use case when jitsi-meet is used via the IFrame API. When the property is true
+    // jitsi-meet will use the local storage of the host page instead of its own. This option is useful if the browser
+    // is not persisting the local storage inside the iframe.
+    // useHostPageLocalStorage: true,
+
+    // Etherpad ("shared document") integration.
+    //
+    // If set, add a "Open shared document" link to the bottom right menu that
+    // will open an etherpad document.
+    // etherpad_base: 'https://your-etherpad-installati.on/p/',
+
+    // To enable information about dial-in access to meetings you need to provide
+    // dialInNumbersUrl and dialInConfCodeUrl.
+    // dialInNumbersUrl returns a json array of numbers that can be used for dial-in.
+    // {"countryCode":"US","tollFree":false,"formattedNumber":"+1 123-456-7890"}
+    // dialInConfCodeUrl is the conference mapper converting a meeting id to a PIN used for dial-in
+    // or the other way around (more info in resources/cloud-api.swagger)
+
+    // List of undocumented settings used in jitsi-meet
+    /**
+     _immediateReloadThreshold
+     debug
+     debugAudioLevels
+     deploymentInfo
+     dialOutAuthUrl
+     dialOutCodesUrl
+     dialOutRegionUrl
+     disableRemoteControl
+     displayJids
+     e2eeLabels
+     firefox_fake_device
+     googleApiApplicationClientID
+     iAmRecorder
+     iAmSipGateway
+     microsoftApiApplicationClientID
+     peopleSearchQueryTypes
+     peopleSearchUrl
+     requireDisplayName
+     tokenAuthUrl
+     */
+
+    /**
+     * This property can be used to alter the generated meeting invite links (in combination with a branding domain
+     * which is retrieved internally by jitsi meet) (e.g. https://meet.jit.si/someMeeting
+     * can become https://brandedDomain/roomAlias)
+     */
+    // brandingRoomAlias: null,
+
+    // List of undocumented settings used in lib-jitsi-meet
+    /**
+     _peerConnStatusOutOfLastNTimeout
+     _peerConnStatusRtcMuteTimeout
+     avgRtpStatsN
+     callStatsConfIDNamespace
+     callStatsCustomScriptUrl
+     desktopSharingSources
+     disableAEC
+     disableAGC
+     disableAP
+     disableHPF
+     disableLocalStats
+     disableNS
+     enableTalkWhileMuted
+     forceJVB121Ratio
+     forceTurnRelay
+     hiddenDomain
+     hiddenFromRecorderFeatureEnabled
+     ignoreStartMuted
+     websocketKeepAlive
+     websocketKeepAliveUrl
+     */
+
+    /**
+     * Default interval (milliseconds) for triggering mouseMoved iframe API event
+     */
+    mouseMoveCallbackInterval: 1000,
+
+    /**
+        Use this array to configure which notifications will be shown to the user
+        The items correspond to the title or description key of that notification
+        Some of these notifications also depend on some other internal logic to be displayed or not,
+        so adding them here will not ensure they will always be displayed
+
+        A falsy value for this prop will result in having all notifications enabled (e.g null, undefined, false)
+    */
+    // notifications: [
+    //     'connection.CONNFAIL', // shown when the connection fails,
+    //     'dialog.cameraNotSendingData', // shown when there's no feed from user's camera
+    //     'dialog.kickTitle', // shown when user has been kicked
+    //     'dialog.liveStreaming', // livestreaming notifications (pending, on, off, limits)
+    //     'dialog.lockTitle', // shown when setting conference password fails
+    //     'dialog.maxUsersLimitReached', // shown when maximmum users limit has been reached
+    //     'dialog.micNotSendingData', // shown when user's mic is not sending any audio
+    //     'dialog.passwordNotSupportedTitle', // shown when setting conference password fails due to password format
+    //     'dialog.recording', // recording notifications (pending, on, off, limits)
+    //     'dialog.remoteControlTitle', // remote control notifications (allowed, denied, start, stop, error)
+    //     'dialog.reservationError',
+    //     'dialog.serviceUnavailable', // shown when server is not reachable
+    //     'dialog.sessTerminated', // shown when there is a failed conference session
+    //     'dialog.sessionRestarted', // show when a client reload is initiated because of bridge migration
+    //     'dialog.tokenAuthFailed', // show when an invalid jwt is used
+    //     'dialog.transcribing', // transcribing notifications (pending, off)
+    //     'dialOut.statusMessage', // shown when dial out status is updated.
+    //     'liveStreaming.busy', // shown when livestreaming service is busy
+    //     'liveStreaming.failedToStart', // shown when livestreaming fails to start
+    //     'liveStreaming.unavailableTitle', // shown when livestreaming service is not reachable
+    //     'lobby.joinRejectedMessage', // shown when while in a lobby, user's request to join is rejected
+    //     'lobby.notificationTitle', // shown when lobby is toggled and when join requests are allowed / denied
+    //     'notify.chatMessages', // shown when receiving chat messages while the chat window is closed
+    //     'notify.disconnected', // shown when a participant has left
+    //     'notify.connectedOneMember', // show when a participant joined
+    //     'notify.connectedTwoMembers', // show when two participants joined simultaneously
+    //     'notify.connectedThreePlusMembers', // show when more than 2 participants joined simultaneously
+    //     'notify.leftOneMember', // show when a participant left
+    //     'notify.leftTwoMembers', // show when two participants left simultaneously
+    //     'notify.leftThreePlusMembers', // show when more than 2 participants left simultaneously
+    //     'notify.grantedTo', // shown when moderator rights were granted to a participant
+    //     'notify.hostAskedUnmute', // shown to participant when host asks them to unmute
+    //     'notify.invitedOneMember', // shown when 1 participant has been invited
+    //     'notify.invitedThreePlusMembers', // shown when 3+ participants have been invited
+    //     'notify.invitedTwoMembers', // shown when 2 participants have been invited
+    //     'notify.kickParticipant', // shown when a participant is kicked
+    //     'notify.linkToSalesforce', // shown when joining a meeting with salesforce integration
+    //     'notify.moderationStartedTitle', // shown when AV moderation is activated
+    //     'notify.moderationStoppedTitle', // shown when AV moderation is deactivated
+    //     'notify.moderationInEffectTitle', // shown when user attempts to unmute audio during AV moderation
+    //     'notify.moderationInEffectVideoTitle', // shown when user attempts to enable video during AV moderation
+    //     'notify.moderationInEffectCSTitle', // shown when user attempts to share content during AV moderation
+    //     'notify.mutedRemotelyTitle', // shown when user is muted by a remote party
+    //     'notify.mutedTitle', // shown when user has been muted upon joining,
+    //     'notify.newDeviceAudioTitle', // prompts the user to use a newly detected audio device
+    //     'notify.newDeviceCameraTitle', // prompts the user to use a newly detected camera
+    //     'notify.participantWantsToJoin', // shown when lobby is enabled and participant requests to join meeting
+    //     'notify.passwordRemovedRemotely', // shown when a password has been removed remotely
+    //     'notify.passwordSetRemotely', // shown when a password has been set remotely
+    //     'notify.raisedHand', // shown when a partcipant used raise hand,
+    //     'notify.startSilentTitle', // shown when user joined with no audio
+    //     'notify.unmute', // shown to moderator when user raises hand during AV moderation
+    //     'notify.videoMutedRemotelyTitle', // shown when user's video is muted by a remote party,
+    //     'prejoin.errorDialOut',
+    //     'prejoin.errorDialOutDisconnected',
+    //     'prejoin.errorDialOutFailed',
+    //     'prejoin.errorDialOutStatus',
+    //     'prejoin.errorStatusCode',
+    //     'prejoin.errorValidation',
+    //     'recording.busy', // shown when recording service is busy
+    //     'recording.failedToStart', // shown when recording fails to start
+    //     'recording.unavailableTitle', // shown when recording service is not reachable
+    //     'toolbar.noAudioSignalTitle', // shown when a broken mic is detected
+    //     'toolbar.noisyAudioInputTitle', // shown when noise is detected for the current microphone
+    //     'toolbar.talkWhileMutedPopup', // shown when user tries to speak while muted
+    //     'transcribing.failedToStart', // shown when transcribing fails to start
+    // ],
+
+    // List of notifications to be disabled. Works in tandem with the above setting.
+    // disabledNotifications: [],
+
+    // Prevent the filmstrip from autohiding when screen width is under a certain threshold
+    // disableFilmstripAutohiding: false,
+
+    // filmstrip: {
+    //     // Disables user resizable filmstrip. Also, allows configuration of the filmstrip
+    //     // (width, tiles aspect ratios) through the interfaceConfig options.
+    //     disableResizable: false,
+
+    //     // Disables the stage filmstrip
+    //     // (displaying multiple participants on stage besides the vertical filmstrip)
+    //     disableStageFilmstrip: false,
+
+    //     // Default number of participants that can be displayed on stage.
+    //     // The user can change this in settings. Number must be between 1 and 6.
+    //     stageFilmstripParticipants: 1,
+
+    //     // Disables the top panel (only shown when a user is sharing their screen).
+    //     disableTopPanel: false,
+
+    //     // The minimum number of participants that must be in the call for
+    //     // the top panel layout to be used.
+    //     minParticipantCountForTopPanel: 50,
+    // },
+
+    // Tile view related config options.
+    // tileView: {
+    //     // The optimal number of tiles that are going to be shown in tile view. Depending on the screen size it may
+    //     // not be possible to show the exact number of participants specified here.
+    //     numberOfVisibleTiles: 25,
+    // },
+
+    // Specifies whether the chat emoticons are disabled or not
+    // disableChatSmileys: false,
+
+    // Settings for the GIPHY integration.
+    // giphy: {
+    //     // Whether the feature is enabled or not.
+    //     enabled: false,
+    //     // SDK API Key from Giphy.
+    //     sdkKey: '',
+    //     // Display mode can be one of:
+    //     // - tile: show the GIF on the tile of the participant that sent it.
+    //     // - chat: show the GIF as a message in chat
+    //     // - all: all of the above. This is the default option
+    //     displayMode: 'all',
+    //     // How long the GIF should be displayed on the tile (in milliseconds).
+    //     tileTime: 5000,
+    //     // Limit results by rating: g, pg, pg-13, r. Default value: g.
+    //     rating: 'pg',
+    //     // The proxy server url for giphy requests in the web app.
+    //     proxyUrl: 'https://giphy-proxy.example.com',
+    // },
+
+    // Logging
+    // logging: {
+    //      // Default log level for the app and lib-jitsi-meet.
+    //      defaultLogLevel: 'trace',
+    //      // Option to disable LogCollector (which stores the logs on CallStats).
+    //      //disableLogCollector: true,
+    //      // Individual loggers are customizable.
+    //      loggers: {
+    //      // The following are too verbose in their logging with the default level.
+    //      'modules/RTC/TraceablePeerConnection.js': 'info',
+    //      'modules/statistics/CallStats.js': 'info',
+    //      'modules/xmpp/strophe.util.js': 'log',
+    // },
+
+    // Application logo url
+    // defaultLogoUrl: 'images/watermark.svg',
+
+    // Settings for the Excalidraw whiteboard integration.
+    // whiteboard: {
+    //     // Whether the feature is enabled or not.
+    //     enabled: true,
+    //     // The server used to support whiteboard collaboration.
+    //     // https://github.com/jitsi/excalidraw-backend
+    //     collabServerBaseUrl: 'https://excalidraw-backend.example.com',
+    // },
+};
+
+// Temporary backwards compatibility with old mobile clients.
+config.flags = config.flags || {};
+config.flags.sourceNameSignaling = true;
+config.flags.sendMultipleVideoStreams = true;
+config.flags.receiveMultipleVideoStreams = true;
+
+// Set the default values for JaaS customers
+if (enableJaaS) {
+    config.dialInNumbersUrl = 'https://conference-mapper.jitsi.net/v1/access/dids';
+    config.dialInConfCodeUrl = 'https://conference-mapper.jitsi.net/v1/access';
+    config.roomPasswordNumberOfDigits = 10; // skip re-adding it (do not remove comment)
+}
diff --git a/webapps/jitsimeet/templates/prosody/prosody.cfg.lua.j2 b/webapps/jitsimeet/templates/prosody/prosody.cfg.lua.j2
new file mode 100644
index 00000000..cb8b8034
--- /dev/null
+++ b/webapps/jitsimeet/templates/prosody/prosody.cfg.lua.j2
@@ -0,0 +1,254 @@
+-- Prosody XMPP Server Configuration
+--
+-- Information on configuring Prosody can be found on our
+-- website at https://prosody.im/doc/configure
+--
+-- Tip: You can check that the syntax of this file is correct
+-- when you have finished by running this command:
+--     prosodyctl check config
+-- If there are any errors, it will let you know what and where
+-- they are, otherwise it will keep quiet.
+--
+-- Good luck, and happy Jabbering!
+
+
+---------- Server-wide settings ----------
+-- Settings in this section apply to the whole server and are the default settings
+-- for any virtual hosts
+
+-- This is a (by default, empty) list of accounts that are admins
+-- for the server. Note that you must create the accounts separately
+-- (see https://prosody.im/doc/creating_accounts for info)
+-- Example: admins = { "user1@example.com", "user2@example.net" }
+admins = { }
+
+-- This option allows you to specify additional locations where Prosody
+-- will search first for modules. For additional modules you can install, see
+-- the community module repository at https://modules.prosody.im/
+--plugin_paths = {}
+
+-- This is the list of modules Prosody will load on startup.
+-- Documentation for bundled modules can be found at: https://prosody.im/doc/modules
+modules_enabled = {
+
+	-- Generally required
+		"disco"; -- Service discovery
+		"roster"; -- Allow users to have a roster. Recommended ;)
+		"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
+		"tls"; -- Add support for secure TLS on c2s/s2s connections
+
+	-- Not essential, but recommended
+		"blocklist"; -- Allow users to block communications with other users
+		"bookmarks"; -- Synchronise the list of open rooms between clients
+		"carbons"; -- Keep multiple online clients in sync
+		"dialback"; -- Support for verifying remote servers using DNS
+		"limits"; -- Enable bandwidth limiting for XMPP connections
+		"pep"; -- Allow users to store public and private data in their account
+		"private"; -- Legacy account storage mechanism (XEP-0049)
+		"smacks"; -- Stream management and resumption (XEP-0198)
+		"vcard4"; -- User profiles (stored in PEP)
+		"vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
+
+	-- Nice to have
+		"csi_simple"; -- Simple but effective traffic optimizations for mobile devices
+		"invites"; -- Create and manage invites
+		"invites_adhoc"; -- Allow admins/users to create invitations via their client
+		"invites_register"; -- Allows invited users to create accounts
+		"ping"; -- Replies to XMPP pings with pongs
+		"register"; -- Allow users to register on this server using a client and change passwords
+		"time"; -- Let others know the time here on this server
+		"uptime"; -- Report how long server has been running
+		"version"; -- Replies to server version requests
+		--"mam"; -- Store recent messages to allow multi-device synchronization
+		--"turn_external"; -- Provide external STUN/TURN service for e.g. audio/video calls
+
+	-- Admin interfaces
+		"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
+		"admin_shell"; -- Allow secure administration via 'prosodyctl shell'
+
+	-- HTTP modules
+		--"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
+		--"http_openmetrics"; -- for exposing metrics to stats collectors
+		--"websocket"; -- XMPP over WebSockets
+
+	-- Other specific functionality
+		--"announce"; -- Send announcement to all online users
+		--"groups"; -- Shared roster support
+		--"legacyauth"; -- Legacy authentication. Only used by some old clients and bots.
+		--"mimicking"; -- Prevent address spoofing
+		--"motd"; -- Send a message to users when they log in
+		--"proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
+		--"s2s_bidi"; -- Bi-directional server-to-server (XEP-0288)
+		--"server_contact_info"; -- Publish contact information for this service
+		--"tombstones"; -- Prevent registration of deleted accounts
+		--"watchregistrations"; -- Alert admins of registrations
+		--"welcome"; -- Welcome users who register accounts
+}
+
+-- These modules are auto-loaded, but should you want
+-- to disable them then uncomment them here:
+modules_disabled = {
+	-- "offline"; -- Store offline messages
+	-- "c2s"; -- Handle client connections
+	-- "s2s"; -- Handle server-to-server connections
+	-- "posix"; -- POSIX functionality, sends server to background, etc.
+}
+
+
+-- Server-to-server authentication
+-- Require valid certificates for server-to-server connections?
+-- If false, other methods such as dialback (DNS) may be used instead.
+
+s2s_secure_auth = true
+
+-- Some servers have invalid or self-signed certificates. You can list
+-- remote domains here that will not be required to authenticate using
+-- certificates. They will be authenticated using other methods instead,
+-- even when s2s_secure_auth is enabled.
+
+--s2s_insecure_domains = { "insecure.example" }
+
+-- Even if you disable s2s_secure_auth, you can still require valid
+-- certificates for some domains by specifying a list here.
+
+--s2s_secure_domains = { "jabber.org" }
+
+
+-- Rate limits
+-- Enable rate limits for incoming client and server connections. These help
+-- protect from excessive resource consumption and denial-of-service attacks.
+
+limits = {
+	c2s = {
+		rate = "10kb/s";
+	};
+	s2sin = {
+		rate = "30kb/s";
+	};
+}
+
+-- Required for init scripts and prosodyctl
+pidfile = "/var/run/prosody/prosody.pid"
+
+-- Authentication
+-- Select the authentication backend to use. The 'internal' providers
+-- use Prosody's configured data storage to store the authentication data.
+-- For more information see https://prosody.im/doc/authentication
+
+authentication = "internal_hashed"
+
+-- Many authentication providers, including the default one, allow you to
+-- create user accounts via Prosody's admin interfaces. For details, see the
+-- documentation at https://prosody.im/doc/creating_accounts
+
+
+-- Storage
+-- Select the storage backend to use. By default Prosody uses flat files
+-- in its configured data directory, but it also supports more backends
+-- through modules. An "sql" backend is included by default, but requires
+-- additional dependencies. See https://prosody.im/doc/storage for more info.
+
+--storage = "sql" -- Default is "internal"
+
+-- For the "sql" backend, you can uncomment *one* of the below to configure:
+--sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
+--sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+--sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
+
+
+-- Archiving configuration
+-- If mod_mam is enabled, Prosody will store a copy of every message. This
+-- is used to synchronize conversations between multiple clients, even if
+-- they are offline. This setting controls how long Prosody will keep
+-- messages in the archive before removing them.
+
+archive_expires_after = "1w" -- Remove archived messages after 1 week
+
+-- You can also configure messages to be stored in-memory only. For more
+-- archiving options, see https://prosody.im/doc/modules/mod_mam
+
+
+-- Audio/video call relay (STUN/TURN)
+-- To ensure clients connected to the server can establish connections for
+-- low-latency media streaming (such as audio and video calls), it is
+-- recommended to run a STUN/TURN server for clients to use. If you do this,
+-- specify the details here so clients can discover it.
+-- Find more information at https://prosody.im/doc/turn
+
+-- Specify the address of the TURN service (you may use the same domain as XMPP)
+--turn_external_host = "turn.example.com"
+
+-- This secret must be set to the same value in both Prosody and the TURN server
+--turn_external_secret = "your-secret-turn-access-token"
+
+
+-- Logging configuration
+-- For advanced logging see https://prosody.im/doc/logging
+log = {
+	info = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for verbose logging
+	error = "/var/log/prosody/prosody.err";
+	-- "*syslog"; -- Uncomment this for logging to syslog
+	-- "*console"; -- Log to the console, useful for debugging when running in the foreground
+}
+
+
+-- Uncomment to enable statistics
+-- For more info see https://prosody.im/doc/statistics
+-- statistics = "internal"
+
+
+-- Certificates
+-- Every virtual host and component needs a certificate so that clients and
+-- servers can securely verify its identity. Prosody will automatically load
+-- certificates/keys from the directory specified here.
+-- For more information, including how to use 'prosodyctl' to auto-import certificates
+-- (from e.g. Let's Encrypt) see https://prosody.im/doc/certificates
+
+-- Location of directory to find certificates in (relative to main config file):
+certificates = "certs"
+
+----------- Virtual hosts -----------
+-- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
+-- Settings under each VirtualHost entry apply *only* to that host.
+
+VirtualHost "localhost"
+-- Prosody requires at least one enabled VirtualHost to function. You can
+-- safely remove or disable 'localhost' once you have added another.
+
+
+--VirtualHost "example.com"
+
+------ Components ------
+-- You can specify components to add hosts that provide special services,
+-- like multi-user conferences, and transports.
+-- For more information on components, see https://prosody.im/doc/components
+
+---Set up a MUC (multi-user chat) room server on conference.example.com:
+--Component "conference.example.com" "muc"
+--- Store MUC messages in an archive and allow users to access it
+--modules_enabled = { "muc_mam" }
+
+---Set up a file sharing component
+--Component "share.example.com" "http_file_share"
+
+---Set up an external component (default component port is 5347)
+--
+-- External components allow adding various services, such as gateways/
+-- bridges to non-XMPP networks and services. For more info
+-- see: https://prosody.im/doc/components#adding_an_external_component
+--
+--Component "gateway.example.com"
+--	component_secret = "password"
+
+
+---------- End of the Prosody Configuration file ----------
+-- You usually **DO NOT** want to add settings here at the end, as they would
+-- only apply to the last defined VirtualHost or Component.
+--
+-- Settings for the global section should go higher up, before the first
+-- VirtualHost or Component line, while settings intended for specific hosts
+-- should go under the corresponding VirtualHost or Component line.
+--
+-- For more information see https://prosody.im/doc/configure
+
+Include "conf.d/*.cfg.lua"
diff --git a/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2 b/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
new file mode 100644
index 00000000..7d40e05c
--- /dev/null
+++ b/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
@@ -0,0 +1,160 @@
+plugin_paths = { "/usr/share/jitsi-meet/prosody-plugins/" }
+
+-- domain mapper options, must at least have domain base set to use the mapper
+muc_mapper_domain_base = "{{ domains | first }}";
+
+external_service_secret = "{{ jitsi_meet_turn_secret }}";
+external_services = {
+     { type = "stun", host = "{{ domains | first }}", port = 3478 },
+     { type = "turn", host = "{{ domains | first }}", port = 3478, transport = "udp", secret = true, ttl = 86400, algorithm = "turn" },
+     { type = "turns", host = "{{ domains | first }}", port = 5349, transport = "tcp", secret = true, ttl = 86400, algorithm = "turn" }
+};
+
+cross_domain_bosh = false;
+consider_bosh_secure = true;
+-- https_ports = { }; -- Remove this line to prevent listening on port 5284
+
+-- by default prosody 0.12 sends cors headers, if you want to disable it uncomment the following (the config is available on 0.12.1)
+--http_cors_override = {
+--    bosh = {
+--        enabled = false;
+--    };
+--    websocket = {
+--        enabled = false;
+--    };
+--}
+
+-- https://ssl-config.mozilla.org/#server=haproxy&version=2.1&config=intermediate&openssl=1.1.0g&guideline=5.4
+ssl = {
+    protocol = "tlsv1_2+";
+    ciphers = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
+}
+
+unlimited_jids = {
+    "focus@auth.{{ domains | first }}",
+    "jvb@auth.{{ domains | first }}"
+}
+
+VirtualHost "{{ domains | first }}"
+    authentication = "jitsi-anonymous" -- do not delete me
+    -- Properties below are modified by jitsi-meet-tokens package config
+    -- and authentication above is switched to "token"
+    --app_id="example_app_id"
+    --app_secret="example_app_secret"
+    -- Assign this host a certificate for TLS, otherwise it would use the one
+    -- set in the global section (if any).
+    -- Note that old-style SSL on port 5223 only supports one certificate, and will always
+    -- use the global one.
+    ssl = {
+        key = "/etc/prosody/certs/{{ domains | first }}.key";
+        certificate = "/etc/prosody/certs/{{ domains | first }}.crt";
+    }
+    av_moderation_component = "avmoderation.{{ domains | first }}"
+    speakerstats_component = "speakerstats.{{ domains | first }}"
+    conference_duration_component = "conferenceduration.{{ domains | first }}"
+    end_conference_component = "endconference.{{ domains | first }}"
+    -- we need bosh
+    modules_enabled = {
+        "bosh";
+        "pubsub";
+        "ping"; -- Enable mod_ping
+        "speakerstats";
+        "external_services";
+        "conference_duration";
+        "end_conference";
+        "muc_lobby_rooms";
+        "muc_breakout_rooms";
+        "av_moderation";
+        "room_metadata";
+    }
+    c2s_require_encryption = false
+    lobby_muc = "lobby.{{ domains | first }}"
+    breakout_rooms_muc = "breakout.{{ domains | first }}"
+    room_metadata_component = "metadata.{{ domains | first }}"
+    main_muc = "conference.{{ domains | first }}"
+    -- muc_lobby_whitelist = { "recorder.{{ domains | first }}" } -- Here we can whitelist jibri to enter lobby enabled rooms
+
+Component "conference.{{ domains | first }}" "muc"
+    restrict_room_creation = true
+    storage = "memory"
+    modules_enabled = {
+        "muc_hide_all";
+        "muc_meeting_id";
+        "muc_domain_mapper";
+        "polls";
+        --"token_verification";
+        "muc_rate_limit";
+        "muc_password_whitelist";
+    }
+    admins = { "focus@auth.{{ domains | first }}" }
+    muc_password_whitelist = {
+        "focus@auth.{{ domains | first }}"
+    }
+    muc_room_locking = false
+    muc_room_default_public_jids = true
+
+Component "breakout.{{ domains | first }}" "muc"
+    restrict_room_creation = true
+    storage = "memory"
+    modules_enabled = {
+        "muc_hide_all";
+        "muc_meeting_id";
+        "muc_domain_mapper";
+        "muc_rate_limit";
+        "polls";
+    }
+    admins = { "focus@auth.{{ domains | first }}" }
+    muc_room_locking = false
+    muc_room_default_public_jids = true
+
+-- internal muc component
+Component "internal.auth.{{ domains | first }}" "muc"
+    storage = "memory"
+    modules_enabled = {
+        "muc_hide_all";
+        "ping";
+    }
+    admins = { "focus@auth.{{ domains | first }}", "jvb@auth.{{ domains | first }}" }
+    muc_room_locking = false
+    muc_room_default_public_jids = true
+
+VirtualHost "auth.{{ domains | first }}"
+    ssl = {
+        key = "/etc/prosody/certs/auth.{{ domains | first }}.key";
+        certificate = "/etc/prosody/certs/auth.{{ domains | first }}.crt";
+    }
+    modules_enabled = {
+        "limits_exception";
+    }
+    authentication = "internal_hashed"
+
+-- Proxy to jicofo's user JID, so that it doesn't have to register as a component.
+Component "focus.{{ domains | first }}" "client_proxy"
+    target_address = "focus@auth.{{ domains | first }}"
+
+Component "speakerstats.{{ domains | first }}" "speakerstats_component"
+    muc_component = "conference.{{ domains | first }}"
+
+Component "conferenceduration.{{ domains | first }}" "conference_duration_component"
+    muc_component = "conference.{{ domains | first }}"
+
+Component "endconference.{{ domains | first }}" "end_conference"
+    muc_component = "conference.{{ domains | first }}"
+
+Component "avmoderation.{{ domains | first }}" "av_moderation_component"
+    muc_component = "conference.{{ domains | first }}"
+
+Component "lobby.{{ domains | first }}" "muc"
+    storage = "memory"
+    restrict_room_creation = true
+    muc_room_locking = false
+    muc_room_default_public_jids = true
+    modules_enabled = {
+        "muc_hide_all";
+        "muc_rate_limit";
+        "polls";
+    }
+
+Component "metadata.{{ domains | first }}" "room_metadata_component"
+    muc_component = "conference.{{ domains | first }}"
+    breakout_rooms_component = "breakout.{{ domains | first }}"
diff --git a/webapps/jitsimeet/templates/videobridge/jvb.conf.j2 b/webapps/jitsimeet/templates/videobridge/jvb.conf.j2
new file mode 100644
index 00000000..483f765a
--- /dev/null
+++ b/webapps/jitsimeet/templates/videobridge/jvb.conf.j2
@@ -0,0 +1,12 @@
+videobridge {
+    http-servers {
+        public {
+            port = 9090
+        }
+    }
+    websockets {
+        enabled = true
+        domain = "{{ domains | first }}:443"
+        tls = true
+    }
+}
diff --git a/webapps/jitsimeet/templates/videobridge/logging.properties.j2 b/webapps/jitsimeet/templates/videobridge/logging.properties.j2
new file mode 100644
index 00000000..3c364a43
--- /dev/null
+++ b/webapps/jitsimeet/templates/videobridge/logging.properties.j2
@@ -0,0 +1,34 @@
+handlers= java.util.logging.ConsoleHandler
+#handlers= java.util.logging.ConsoleHandler, com.agafua.syslog.SyslogHandler
+#handlers= java.util.logging.ConsoleHandler, io.sentry.jul.SentryHandler
+
+java.util.logging.ConsoleHandler.level = ALL
+java.util.logging.ConsoleHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
+
+org.jitsi.utils.logging2.JitsiLogFormatter.programname=JVB
+.level=INFO
+
+# Syslog (uncomment handler to use)
+com.agafua.syslog.SyslogHandler.transport = udp
+com.agafua.syslog.SyslogHandler.facility = local0
+com.agafua.syslog.SyslogHandler.port = 514
+com.agafua.syslog.SyslogHandler.hostname = localhost
+com.agafua.syslog.SyslogHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
+com.agafua.syslog.SyslogHandler.escapeNewlines = false
+
+# Sentry (uncomment handler to use)
+io.sentry.jul.SentryHandler.level=WARNING
+
+# time series logging
+java.util.logging.SimpleFormatter.format= %5$s%n
+java.util.logging.FileHandler.level = ALL
+java.util.logging.FileHandler.formatter = java.util.logging.SimpleFormatter
+java.util.logging.FileHandler.pattern = /tmp/jvb-series.log
+java.util.logging.FileHandler.limit = 200000000
+java.util.logging.FileHandler.count = 1
+java.util.logging.FileHandler.append = false
+
+timeseries.level=OFF
+timeseries.useParentHandlers = false
+# time series logging is disabled by default. Uncomment the line below to enable it.
+#timeseries.handlers = java.util.logging.FileHandler
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
new file mode 100644
index 00000000..351fb097
--- /dev/null
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -0,0 +1,10 @@
+org.ice4j.ice.harvest.DISABLE_AWS_HARVESTER=true
+org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES=meet-jit-si-turnrelay.jitsi.net:443
+org.jitsi.videobridge.ENABLE_STATISTICS=true
+org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
+org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
+org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.bullseye.domaine-fictif.org
+org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
+org.jitsi.videobridge.xmpp.user.shard.PASSWORD=wqS4pQxK
+org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.bullseye.domaine-fictif.org
+org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME=1899aaf3-3991-4770-9c8c-113906dc0a2e
-- 
2.39.2


From 2074e6c937696bce3de13ec73f496ca84c41af83 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Fri, 19 May 2023 16:23:36 -0400
Subject: [PATCH 03/28] variable domain

---
 webapps/jitsimeet/defaults/main.yml           |  2 +-
 webapps/jitsimeet/templates/meet/config.js.j2 | 22 +++++++++----------
 .../sip-communicator.properties.j2            |  4 ++--
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index b519ebcb..6d736cfa 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -1,7 +1,7 @@
 ---
 # defaults file for main vars
 
-system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2']"
+system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2', 'lua-unbound']"
 
 domains: ['bullseye.domaine-fictif.org']
 
diff --git a/webapps/jitsimeet/templates/meet/config.js.j2 b/webapps/jitsimeet/templates/meet/config.js.j2
index 1f4473e3..6e06124f 100644
--- a/webapps/jitsimeet/templates/meet/config.js.j2
+++ b/webapps/jitsimeet/templates/meet/config.js.j2
@@ -30,31 +30,31 @@ var config = {
 
     hosts: {
         // XMPP domain.
-        domain: 'bullseye.domaine-fictif.org',
+        domain: '{{ domains | first }}',
 
         // When using authentication, domain for guest users.
         // anonymousdomain: 'guest.example.com',
 
         // Domain for authenticated users. Defaults to <domain>.
-        // authdomain: 'bullseye.domaine-fictif.org',
+        // authdomain: '{{ domains | first }}',
 
         // Focus component domain. Defaults to focus.<domain>.
-        // focus: 'focus.bullseye.domaine-fictif.org',
+        // focus: 'focus.{{ domains | first }}',
 
         // XMPP MUC domain. FIXME: use XEP-0030 to discover it.
-        muc: 'conference.' + subdomain + 'bullseye.domaine-fictif.org',
+        muc: 'conference.' + subdomain + '{{ domains | first }}',
     },
 
     // BOSH URL. FIXME: use XEP-0156 to discover it.
-    bosh: 'https://bullseye.domaine-fictif.org/' + subdir + 'http-bind',
+    bosh: 'https://{{ domains | first }}/' + subdir + 'http-bind',
 
     // Websocket URL (XMPP)
-    // websocket: 'wss://bullseye.domaine-fictif.org/' + subdir + 'xmpp-websocket',
+    // websocket: 'wss://{{ domains | first }}/' + subdir + 'xmpp-websocket',
 
     // The real JID of focus participant - can be overridden here
     // Do not change username - FIXME: Make focus username configurable
     // https://github.com/jitsi/jitsi-meet/issues/7376
-    // focusUserJid: 'focus@auth.bullseye.domaine-fictif.org',
+    // focusUserJid: 'focus@auth.{{ domains | first }}',
 
     // Options related to the bridge (colibri) data channel
     bridgeChannel: {
@@ -302,9 +302,9 @@ var config = {
     //     appKey: '<APP_KEY>', // Specify your app key here.
     //     // A URL to redirect the user to, after authenticating
     //     // by default uses:
-    //     // 'https://bullseye.domaine-fictif.org/static/oauth.html'
+    //     // 'https://{{ domains | first }}/static/oauth.html'
     //     redirectURI:
-    //          'https://bullseye.domaine-fictif.org/subfolder/static/oauth.html',
+    //          'https://{{ domains | first }}/subfolder/static/oauth.html',
     // },
 
     // recordingService: {
@@ -946,7 +946,7 @@ var config = {
         // The STUN servers that will be used in the peer to peer connections
         stunServers: [
 
-            // { urls: 'stun:bullseye.domaine-fictif.org:3478' },
+            // { urls: 'stun:{{ domains | first }}:3478' },
             { urls: 'stun:meet-jit-si-turnrelay.jitsi.net:443' },
         ],
     },
@@ -1300,7 +1300,7 @@ var config = {
     // The URL of the moderated rooms microservice, if available. If it
     // is present, a link to the service will be rendered on the welcome page,
     // otherwise the app doesn't render it.
-    // moderatedRoomServiceUrl: 'https://moderated.bullseye.domaine-fictif.org',
+    // moderatedRoomServiceUrl: 'https://moderated.{{ domains | first }}',
 
     // If true, tile view will not be enabled automatically when the participants count threshold is reached.
     // disableTileView: true,
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
index 351fb097..c906e5bd 100644
--- a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -3,8 +3,8 @@ org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES=meet-jit-si-turnrelay.jit
 org.jitsi.videobridge.ENABLE_STATISTICS=true
 org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
 org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
-org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.bullseye.domaine-fictif.org
+org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.{{ domains | first }}
 org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
 org.jitsi.videobridge.xmpp.user.shard.PASSWORD=wqS4pQxK
-org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.bullseye.domaine-fictif.org
+org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.{{ domains | first }}
 org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME=1899aaf3-3991-4770-9c8c-113906dc0a2e
-- 
2.39.2


From 4240aa7c01be26571033e1c56ebe3b27f46686aa Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Fri, 19 May 2023 17:47:21 -0400
Subject: [PATCH 04/28] New variables for secrets and muc nickname

---
 webapps/jitsimeet/defaults/main.yml                       | 8 +++-----
 webapps/jitsimeet/tasks/main.yml                          | 6 ++++++
 .../templates/videobridge/sip-communicator.properties.j2  | 4 ++--
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index 6d736cfa..1544a8ba 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -8,8 +8,6 @@ domains: ['bullseye.domaine-fictif.org']
 jitsi_meet_cert_choice: "Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)"
 jitsi_meet_ssl_cert_path: "/etc/ssl/certs/ssl-cert-snakeoil.pem"
 jitsi_meet_ssl_key_path: "/etc/ssl/private/ssl-cert-snakeoil.key"
-jitsi_meet_turn_secret: "QZItKTo4iJ2vqrMWoZgN"
-
-version: "stable-8319" # 7 March 2023
-version_old: "stable-8252" # used by jitsimeet/tasks/upgrade.yml
-
+jitsi_meet_turn_secret: "YOU_ABSOLUTELY_MUST_CHANGE_ME"
+jitsi_meet_jvb_secret: "NOT_CHANGING_ME_IS_SUPER_UNCOOL"
+jitsi_meet_jvb_muc_nick: "1899aaf3-3991-4770-9c8c-113906dc0a2e"
diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 1f4e383d..c6bcdb04 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -91,6 +91,12 @@
     - { src: 'prosody/prosody.cfg.lua.j2', dest: "/etc/prosody/prosody.cfg.lua", owner: "root", group: "prosody", mode: "0640" }
     - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
 
+- name: Unregister default jvb account in prosody
+  ansible.builtin.command: prosodyctl unregister jvb@auth.{{ domains | first }}
+
+- name: Register jvb account in prosody (with proper secret)
+  ansible.builtin.command: prosodyctl register jvb auth.{{ domains | first }} {{ jitsi_meet_jvb_secret }}
+
 #- name: Install Jitsi Meet
 #  ansible.builtin.apt:
 #    name: 
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
index c906e5bd..c788ba02 100644
--- a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -5,6 +5,6 @@ org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
 org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
 org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.{{ domains | first }}
 org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
-org.jitsi.videobridge.xmpp.user.shard.PASSWORD=wqS4pQxK
+org.jitsi.videobridge.xmpp.user.shard.PASSWORD={{ jitsi_meet_jvb_secret }}
 org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.{{ domains | first }}
-org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME=1899aaf3-3991-4770-9c8c-113906dc0a2e
+org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME={{ jitsi_meet_muc_nick }}
-- 
2.39.2


From 536a6a6b41ab5758a2d71458c2b1091b9722be30 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Fri, 2 Jun 2023 09:46:59 -0400
Subject: [PATCH 05/28] Basic install; self-signed cert; no websocket in
 prosody; public stun server used; sctp disabled

---
 webapps/jitsimeet/tasks/main.yml              |  37 ++-
 .../templates/jicofo/logging.properties.j2    |  38 ---
 .../templates/prosody/prosody.cfg.lua.j2      | 254 ------------------
 .../videobridge/logging.properties.j2         |  34 ---
 .../sip-communicator.properties.j2            |   2 +-
 5 files changed, 27 insertions(+), 338 deletions(-)
 delete mode 100644 webapps/jitsimeet/templates/jicofo/logging.properties.j2
 delete mode 100644 webapps/jitsimeet/templates/prosody/prosody.cfg.lua.j2
 delete mode 100644 webapps/jitsimeet/templates/videobridge/logging.properties.j2

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index c6bcdb04..8a5508e1 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -4,13 +4,6 @@
 - name: Set FQDN
   command: "hostnamectl set-hostname {{ domains | first }}"
 
-- name: Set FQDN in /etc/hosts
-  ansible.builtin.lineinfile:
-    path: /etc/hosts
-    line: "{{ ansible_default_ipv4.address }} {{ domains | first }}"
-
-# Ouvrir les ports
-
 - name: Add Prosody apt repository key
   ansible.builtin.get_url:
     url: https://prosody.im/files/prosody-debian-packages.key
@@ -84,19 +77,41 @@
     mode: "{{ item.mode }}"
   loop:
     - { src: 'videobridge/jvb.conf.j2', dest: "/etc/jitsi/videobridge/jvb.conf", owner: "jvb", group: "jitsi", mode: "0640" }
-    - { src: 'videobridge/logging.properties.j2', dest: "/etc/jitsi/videobridge/jlogging.properties", owner: "jvb", group: "jitsi", mode: "0640" }
     - { src: 'videobridge/sip-communicator.properties.j2', dest: "/etc/jitsi/videobridge/sip-communicator.properties", owner: "jvb", group: "jitsi", mode: "0640" }
-    - { src: 'jicofo/logging.properties.j2', dest: "/etc/jitsi/jicofo/logging.properties", owner: "jicofo", group: "jitsi", mode: "0640" }
     - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
-    - { src: 'prosody/prosody.cfg.lua.j2', dest: "/etc/prosody/prosody.cfg.lua", owner: "root", group: "prosody", mode: "0640" }
     - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
 
+- name: Add bloc to jicofo.conf to disable sctp
+  ansible.builtin.blockinfile:
+    path: /etc/jitsi/jicofo/jicofo.conf
+    marker: "# {mark} ANSIBLE MANAGED BLOCK"
+    insertafter: 'jicofo {'
+    block: |
+        sctp: {
+          enabled: false
+        }
+
 - name: Unregister default jvb account in prosody
-  ansible.builtin.command: prosodyctl unregister jvb@auth.{{ domains | first }}
+  ansible.builtin.command: prosodyctl unregister jvb auth.{{ domains | first }}
 
 - name: Register jvb account in prosody (with proper secret)
   ansible.builtin.command: prosodyctl register jvb auth.{{ domains | first }} {{ jitsi_meet_jvb_secret }}
 
+- name: Restart prosody
+  ansible.builtin.service:
+    name: prosody
+    state: restarted
+
+- name: Restart jvb
+  ansible.builtin.service:
+    name: jitsi-videobridge2
+    state: restarted
+
+- name: Restart jicofo
+  ansible.builtin.service:
+    name: jicofo
+    state: restarted
+
 #- name: Install Jitsi Meet
 #  ansible.builtin.apt:
 #    name: 
diff --git a/webapps/jitsimeet/templates/jicofo/logging.properties.j2 b/webapps/jitsimeet/templates/jicofo/logging.properties.j2
deleted file mode 100644
index 7181e262..00000000
--- a/webapps/jitsimeet/templates/jicofo/logging.properties.j2
+++ /dev/null
@@ -1,38 +0,0 @@
-
-handlers= java.util.logging.ConsoleHandler
-
-# Handlers with XMPP debug enabled:
-#handlers= java.util.logging.ConsoleHandler, org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler
-
-# Handlers with syslog enabled:
-#handlers= java.util.logging.ConsoleHandler, com.agafua.syslog.SyslogHandler
-#handlers= java.util.logging.ConsoleHandler, io.sentry.jul.SentryHandler
-
-java.util.logging.ConsoleHandler.level = ALL
-java.util.logging.ConsoleHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
-java.util.logging.ConsoleHandler.filter = org.jitsi.impl.protocol.xmpp.log.ExcludeXmppPackets
-
-org.jitsi.utils.logging2.JitsiLogFormatter.programname=Jicofo
-.level=INFO
-
-# To enable XMPP packets logging add XmppPacketsFileHandler to the handlers property
-org.jitsi.impl.protocol.xmpp.log.PacketDebugger.level=ALL
-org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler.pattern=/var/log/jitsi/jicofo-xmpp.log
-org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler.append=true
-org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler.limit=200000000
-org.jitsi.impl.protocol.xmpp.log.XmppPacketsFileHandler.count=3
-
-# Syslog (uncomment handler to use)
-com.agafua.syslog.SyslogHandler.transport = udp
-com.agafua.syslog.SyslogHandler.facility = local0
-com.agafua.syslog.SyslogHandler.port = 514
-com.agafua.syslog.SyslogHandler.hostname = localhost
-com.agafua.syslog.SyslogHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
-com.agafua.syslog.SyslogHandler.escapeNewlines = false
-com.agafua.syslog.SyslogHandler.filter = org.jitsi.impl.protocol.xmpp.log.ExcludeXmppPackets
-
-# Sentry (uncomment handler to use)
-io.sentry.jul.SentryHandler.level=WARNING
-
-# uncomment to see how Jicofo talks to the JVB
-#org.jitsi.impl.protocol.xmpp.colibri.level=ALL
diff --git a/webapps/jitsimeet/templates/prosody/prosody.cfg.lua.j2 b/webapps/jitsimeet/templates/prosody/prosody.cfg.lua.j2
deleted file mode 100644
index cb8b8034..00000000
--- a/webapps/jitsimeet/templates/prosody/prosody.cfg.lua.j2
+++ /dev/null
@@ -1,254 +0,0 @@
--- Prosody XMPP Server Configuration
---
--- Information on configuring Prosody can be found on our
--- website at https://prosody.im/doc/configure
---
--- Tip: You can check that the syntax of this file is correct
--- when you have finished by running this command:
---     prosodyctl check config
--- If there are any errors, it will let you know what and where
--- they are, otherwise it will keep quiet.
---
--- Good luck, and happy Jabbering!
-
-
----------- Server-wide settings ----------
--- Settings in this section apply to the whole server and are the default settings
--- for any virtual hosts
-
--- This is a (by default, empty) list of accounts that are admins
--- for the server. Note that you must create the accounts separately
--- (see https://prosody.im/doc/creating_accounts for info)
--- Example: admins = { "user1@example.com", "user2@example.net" }
-admins = { }
-
--- This option allows you to specify additional locations where Prosody
--- will search first for modules. For additional modules you can install, see
--- the community module repository at https://modules.prosody.im/
---plugin_paths = {}
-
--- This is the list of modules Prosody will load on startup.
--- Documentation for bundled modules can be found at: https://prosody.im/doc/modules
-modules_enabled = {
-
-	-- Generally required
-		"disco"; -- Service discovery
-		"roster"; -- Allow users to have a roster. Recommended ;)
-		"saslauth"; -- Authentication for clients and servers. Recommended if you want to log in.
-		"tls"; -- Add support for secure TLS on c2s/s2s connections
-
-	-- Not essential, but recommended
-		"blocklist"; -- Allow users to block communications with other users
-		"bookmarks"; -- Synchronise the list of open rooms between clients
-		"carbons"; -- Keep multiple online clients in sync
-		"dialback"; -- Support for verifying remote servers using DNS
-		"limits"; -- Enable bandwidth limiting for XMPP connections
-		"pep"; -- Allow users to store public and private data in their account
-		"private"; -- Legacy account storage mechanism (XEP-0049)
-		"smacks"; -- Stream management and resumption (XEP-0198)
-		"vcard4"; -- User profiles (stored in PEP)
-		"vcard_legacy"; -- Conversion between legacy vCard and PEP Avatar, vcard
-
-	-- Nice to have
-		"csi_simple"; -- Simple but effective traffic optimizations for mobile devices
-		"invites"; -- Create and manage invites
-		"invites_adhoc"; -- Allow admins/users to create invitations via their client
-		"invites_register"; -- Allows invited users to create accounts
-		"ping"; -- Replies to XMPP pings with pongs
-		"register"; -- Allow users to register on this server using a client and change passwords
-		"time"; -- Let others know the time here on this server
-		"uptime"; -- Report how long server has been running
-		"version"; -- Replies to server version requests
-		--"mam"; -- Store recent messages to allow multi-device synchronization
-		--"turn_external"; -- Provide external STUN/TURN service for e.g. audio/video calls
-
-	-- Admin interfaces
-		"admin_adhoc"; -- Allows administration via an XMPP client that supports ad-hoc commands
-		"admin_shell"; -- Allow secure administration via 'prosodyctl shell'
-
-	-- HTTP modules
-		--"bosh"; -- Enable BOSH clients, aka "Jabber over HTTP"
-		--"http_openmetrics"; -- for exposing metrics to stats collectors
-		--"websocket"; -- XMPP over WebSockets
-
-	-- Other specific functionality
-		--"announce"; -- Send announcement to all online users
-		--"groups"; -- Shared roster support
-		--"legacyauth"; -- Legacy authentication. Only used by some old clients and bots.
-		--"mimicking"; -- Prevent address spoofing
-		--"motd"; -- Send a message to users when they log in
-		--"proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
-		--"s2s_bidi"; -- Bi-directional server-to-server (XEP-0288)
-		--"server_contact_info"; -- Publish contact information for this service
-		--"tombstones"; -- Prevent registration of deleted accounts
-		--"watchregistrations"; -- Alert admins of registrations
-		--"welcome"; -- Welcome users who register accounts
-}
-
--- These modules are auto-loaded, but should you want
--- to disable them then uncomment them here:
-modules_disabled = {
-	-- "offline"; -- Store offline messages
-	-- "c2s"; -- Handle client connections
-	-- "s2s"; -- Handle server-to-server connections
-	-- "posix"; -- POSIX functionality, sends server to background, etc.
-}
-
-
--- Server-to-server authentication
--- Require valid certificates for server-to-server connections?
--- If false, other methods such as dialback (DNS) may be used instead.
-
-s2s_secure_auth = true
-
--- Some servers have invalid or self-signed certificates. You can list
--- remote domains here that will not be required to authenticate using
--- certificates. They will be authenticated using other methods instead,
--- even when s2s_secure_auth is enabled.
-
---s2s_insecure_domains = { "insecure.example" }
-
--- Even if you disable s2s_secure_auth, you can still require valid
--- certificates for some domains by specifying a list here.
-
---s2s_secure_domains = { "jabber.org" }
-
-
--- Rate limits
--- Enable rate limits for incoming client and server connections. These help
--- protect from excessive resource consumption and denial-of-service attacks.
-
-limits = {
-	c2s = {
-		rate = "10kb/s";
-	};
-	s2sin = {
-		rate = "30kb/s";
-	};
-}
-
--- Required for init scripts and prosodyctl
-pidfile = "/var/run/prosody/prosody.pid"
-
--- Authentication
--- Select the authentication backend to use. The 'internal' providers
--- use Prosody's configured data storage to store the authentication data.
--- For more information see https://prosody.im/doc/authentication
-
-authentication = "internal_hashed"
-
--- Many authentication providers, including the default one, allow you to
--- create user accounts via Prosody's admin interfaces. For details, see the
--- documentation at https://prosody.im/doc/creating_accounts
-
-
--- Storage
--- Select the storage backend to use. By default Prosody uses flat files
--- in its configured data directory, but it also supports more backends
--- through modules. An "sql" backend is included by default, but requires
--- additional dependencies. See https://prosody.im/doc/storage for more info.
-
---storage = "sql" -- Default is "internal"
-
--- For the "sql" backend, you can uncomment *one* of the below to configure:
---sql = { driver = "SQLite3", database = "prosody.sqlite" } -- Default. 'database' is the filename.
---sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
---sql = { driver = "PostgreSQL", database = "prosody", username = "prosody", password = "secret", host = "localhost" }
-
-
--- Archiving configuration
--- If mod_mam is enabled, Prosody will store a copy of every message. This
--- is used to synchronize conversations between multiple clients, even if
--- they are offline. This setting controls how long Prosody will keep
--- messages in the archive before removing them.
-
-archive_expires_after = "1w" -- Remove archived messages after 1 week
-
--- You can also configure messages to be stored in-memory only. For more
--- archiving options, see https://prosody.im/doc/modules/mod_mam
-
-
--- Audio/video call relay (STUN/TURN)
--- To ensure clients connected to the server can establish connections for
--- low-latency media streaming (such as audio and video calls), it is
--- recommended to run a STUN/TURN server for clients to use. If you do this,
--- specify the details here so clients can discover it.
--- Find more information at https://prosody.im/doc/turn
-
--- Specify the address of the TURN service (you may use the same domain as XMPP)
---turn_external_host = "turn.example.com"
-
--- This secret must be set to the same value in both Prosody and the TURN server
---turn_external_secret = "your-secret-turn-access-token"
-
-
--- Logging configuration
--- For advanced logging see https://prosody.im/doc/logging
-log = {
-	info = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for verbose logging
-	error = "/var/log/prosody/prosody.err";
-	-- "*syslog"; -- Uncomment this for logging to syslog
-	-- "*console"; -- Log to the console, useful for debugging when running in the foreground
-}
-
-
--- Uncomment to enable statistics
--- For more info see https://prosody.im/doc/statistics
--- statistics = "internal"
-
-
--- Certificates
--- Every virtual host and component needs a certificate so that clients and
--- servers can securely verify its identity. Prosody will automatically load
--- certificates/keys from the directory specified here.
--- For more information, including how to use 'prosodyctl' to auto-import certificates
--- (from e.g. Let's Encrypt) see https://prosody.im/doc/certificates
-
--- Location of directory to find certificates in (relative to main config file):
-certificates = "certs"
-
------------ Virtual hosts -----------
--- You need to add a VirtualHost entry for each domain you wish Prosody to serve.
--- Settings under each VirtualHost entry apply *only* to that host.
-
-VirtualHost "localhost"
--- Prosody requires at least one enabled VirtualHost to function. You can
--- safely remove or disable 'localhost' once you have added another.
-
-
---VirtualHost "example.com"
-
------- Components ------
--- You can specify components to add hosts that provide special services,
--- like multi-user conferences, and transports.
--- For more information on components, see https://prosody.im/doc/components
-
----Set up a MUC (multi-user chat) room server on conference.example.com:
---Component "conference.example.com" "muc"
---- Store MUC messages in an archive and allow users to access it
---modules_enabled = { "muc_mam" }
-
----Set up a file sharing component
---Component "share.example.com" "http_file_share"
-
----Set up an external component (default component port is 5347)
---
--- External components allow adding various services, such as gateways/
--- bridges to non-XMPP networks and services. For more info
--- see: https://prosody.im/doc/components#adding_an_external_component
---
---Component "gateway.example.com"
---	component_secret = "password"
-
-
----------- End of the Prosody Configuration file ----------
--- You usually **DO NOT** want to add settings here at the end, as they would
--- only apply to the last defined VirtualHost or Component.
---
--- Settings for the global section should go higher up, before the first
--- VirtualHost or Component line, while settings intended for specific hosts
--- should go under the corresponding VirtualHost or Component line.
---
--- For more information see https://prosody.im/doc/configure
-
-Include "conf.d/*.cfg.lua"
diff --git a/webapps/jitsimeet/templates/videobridge/logging.properties.j2 b/webapps/jitsimeet/templates/videobridge/logging.properties.j2
deleted file mode 100644
index 3c364a43..00000000
--- a/webapps/jitsimeet/templates/videobridge/logging.properties.j2
+++ /dev/null
@@ -1,34 +0,0 @@
-handlers= java.util.logging.ConsoleHandler
-#handlers= java.util.logging.ConsoleHandler, com.agafua.syslog.SyslogHandler
-#handlers= java.util.logging.ConsoleHandler, io.sentry.jul.SentryHandler
-
-java.util.logging.ConsoleHandler.level = ALL
-java.util.logging.ConsoleHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
-
-org.jitsi.utils.logging2.JitsiLogFormatter.programname=JVB
-.level=INFO
-
-# Syslog (uncomment handler to use)
-com.agafua.syslog.SyslogHandler.transport = udp
-com.agafua.syslog.SyslogHandler.facility = local0
-com.agafua.syslog.SyslogHandler.port = 514
-com.agafua.syslog.SyslogHandler.hostname = localhost
-com.agafua.syslog.SyslogHandler.formatter = org.jitsi.utils.logging2.JitsiLogFormatter
-com.agafua.syslog.SyslogHandler.escapeNewlines = false
-
-# Sentry (uncomment handler to use)
-io.sentry.jul.SentryHandler.level=WARNING
-
-# time series logging
-java.util.logging.SimpleFormatter.format= %5$s%n
-java.util.logging.FileHandler.level = ALL
-java.util.logging.FileHandler.formatter = java.util.logging.SimpleFormatter
-java.util.logging.FileHandler.pattern = /tmp/jvb-series.log
-java.util.logging.FileHandler.limit = 200000000
-java.util.logging.FileHandler.count = 1
-java.util.logging.FileHandler.append = false
-
-timeseries.level=OFF
-timeseries.useParentHandlers = false
-# time series logging is disabled by default. Uncomment the line below to enable it.
-#timeseries.handlers = java.util.logging.FileHandler
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
index c788ba02..617622e8 100644
--- a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -7,4 +7,4 @@ org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.{{ domains | first }}
 org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
 org.jitsi.videobridge.xmpp.user.shard.PASSWORD={{ jitsi_meet_jvb_secret }}
 org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.{{ domains | first }}
-org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME={{ jitsi_meet_muc_nick }}
+org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME={{ jitsi_meet_jvb_muc_nick }}
-- 
2.39.2


From 45e80ef42de446fa9f5d9357593374ad05353d16 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 10 Aug 2023 13:40:27 -0400
Subject: [PATCH 06/28] Installs a Let's Encrypt cert

---
 webapps/jitsimeet/defaults/main.yml       |   3 +-
 webapps/jitsimeet/tasks/main.yml          |  65 +++++-
 webapps/jitsimeet/templates/vhost.conf.j2 | 230 ++++++++++++++++++++++
 3 files changed, 290 insertions(+), 8 deletions(-)
 create mode 100644 webapps/jitsimeet/templates/vhost.conf.j2

diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index 1544a8ba..2a9a39a2 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -1,9 +1,10 @@
 ---
 # defaults file for main vars
 
-system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2', 'lua-unbound']"
+system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2', 'lua-unbound', 'certbot', 'python3-certbot-nginx']"
 
 domains: ['bullseye.domaine-fictif.org']
+certbot_admin_email: 'support@evolix.fr'
 
 jitsi_meet_cert_choice: "Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)"
 jitsi_meet_ssl_cert_path: "/etc/ssl/certs/ssl-cert-snakeoil.pem"
diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 8a5508e1..c3c72dc4 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -112,10 +112,61 @@
     name: jicofo
     state: restarted
 
-#- name: Install Jitsi Meet
-#  ansible.builtin.apt:
-#    name: 
-#       - nginx-full
-#       - python3-certbot-nginx
-#    state: present
-#    install_recommends: no
+- name: Check if SSL certificate is present and register result
+  stat:
+    path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
+  register: ssl
+
+- name: Generate certificate only if required (first time)
+  block:
+  - name: Template vhost without SSL for successfull LE challengce
+    template: 
+      src: "vhost.conf.j2"
+      dest: "/etc/nginx/sites-available/{{ domains |first }}.conf"
+  - name: Enable temporary nginx vhost for peertube
+    file:
+      src: "/etc/nginx/sites-available/{{ domains |first }}.conf"
+      dest: "/etc/nginx/sites-enabled/{{ domains |first }}.conf"
+      state: link
+  - name: Reload nginx conf
+    service:
+      name: nginx
+      state: reloaded
+  - name: Make sure /var/lib/letsencrypt exists and has correct permissions
+    file: 
+      path: /var/lib/letsencrypt
+      state: directory
+      mode: '0755'
+  - name: Generate certificate with certbot
+    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
+  when: ssl.stat.exists != true
+
+- name: (Re)check if SSL certificate is present and register result
+  stat:
+    path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
+  register: ssl
+
+- name: (Re)template conf file for nginx vhost with SSL
+  template:
+    src: "vhost.conf.j2"
+    dest: "/etc/nginx/sites-available/{{ domains |first }}.conf"
+
+- name: Enable nginx vhost for peertube
+  file:
+    src: "/etc/nginx/sites-available/{{ domains |first }}.conf"
+    dest: "/etc/nginx/sites-enabled/{{ domains |first }}.conf"
+    state: link
+
+- name: Reload nginx conf
+  service:
+    name: nginx
+    state: reloaded
+
+- name: Adjust permissions of files/folders for nginx
+  file:
+    path: "~/"
+    state: directory
+    mode: 'o=rX'
+    recurse: true
+  become_user: "{{ service }}"
+
diff --git a/webapps/jitsimeet/templates/vhost.conf.j2 b/webapps/jitsimeet/templates/vhost.conf.j2
new file mode 100644
index 00000000..1335c943
--- /dev/null
+++ b/webapps/jitsimeet/templates/vhost.conf.j2
@@ -0,0 +1,230 @@
+{% if ssl.stat.exists %}
+server_names_hash_bucket_size 64;
+
+types {
+# nginx's default mime.types doesn't include a mapping for wasm or wav.
+    application/wasm     wasm;
+    audio/wav            wav;
+}
+upstream prosody {
+    zone upstreams 64K;
+    server 127.0.0.1:5280;
+    keepalive 2;
+}
+upstream jvb1 {
+    zone upstreams 64K;
+    server 127.0.0.1:9090;
+    keepalive 2;
+}
+map $arg_vnode $prosody_node {
+    default prosody;
+    v1 v1;
+    v2 v2;
+    v3 v3;
+    v4 v4;
+    v5 v5;
+    v6 v6;
+    v7 v7;
+    v8 v8;
+}
+
+{% endif %}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name {{ domains | first }};
+
+  # For certbot
+  location ~ /.well-known/acme-challenge {
+    alias /var/lib/letsencrypt/;
+    try_files $uri =404;
+    allow all;
+  }
+  {% if ssl.stat.exists %}
+  location / { return 301 https://$host$request_uri; }
+  {% endif %}
+}
+
+{% if ssl.stat.exists %}
+server {
+  listen 443 ssl http2;
+  listen [::]:443 ssl http2;
+  server_name {{ domains | first }};
+  
+  access_log /var/log/nginx/{{ service }}.access.log; # reduce I/0 with buffer=10m flush=5m
+  error_log  /var/log/nginx/{{ service }}.error.log;
+
+  # For certbot
+  location ~ /.well-known/acme-challenge {
+    alias /var/lib/letsencrypt/;
+    try_files $uri =404;
+    allow all;
+  }
+
+  # Mozilla Guideline v5.4, nginx 1.17.7, OpenSSL 1.1.1d, intermediate configuration
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+  ssl_prefer_server_ciphers off;
+
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:SSL:10m;  # about 40000 sessions
+  ssl_session_tickets off;
+
+  add_header Strict-Transport-Security "max-age=63072000" always;
+  set $prefix "";
+  set $custom_index "";
+  set $config_js_location /etc/jitsi/meet/atlantide-3.evolix.eu-config.js;
+
+  ##
+  # Certificates
+  # you need a certificate to run in production. see https://letsencrypt.org/
+  ##
+  ssl_certificate     /etc/letsencrypt/live/{{ domains | first }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/{{ domains | first }}/privkey.pem;
+
+  root /usr/share/jitsi-meet;
+
+  # ssi on with javascript for multidomain variables in config.js
+  ssi on;
+  ssi_types application/x-javascript application/javascript;
+
+  index index.html index.htm;
+  error_page 404 /static/404.html;
+
+  gzip on;
+  gzip_types text/plain text/css application/javascript application/json image/x-icon application/octet-stream application/wasm;
+  gzip_vary on;
+  gzip_proxied no-cache no-store private expired auth;
+  gzip_min_length 512;
+
+  include /etc/jitsi/meet/jaas/*.conf;
+
+  location = /config.js {
+      alias $config_js_location;
+  }
+
+  location = /external_api.js {
+      alias /usr/share/jitsi-meet/libs/external_api.min.js;
+  }
+
+  location = /_api/room-info {
+      proxy_pass http://prosody/room-info?prefix=$prefix&$args;
+      proxy_http_version 1.1;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header Host $http_host;
+  }
+
+  location ~ ^/_api/public/(.*)$ {
+      autoindex off;
+      alias /etc/jitsi/meet/public/$1;
+  }
+
+  # ensure all static content can always be found first
+  location ~ ^/(libs|css|static|images|fonts|lang|sounds|.well-known)/(.*)$
+  {
+      add_header 'Access-Control-Allow-Origin' '*';
+      alias /usr/share/jitsi-meet/$1/$2;
+
+      # cache all versioned files
+      if ($arg_v) {
+          expires 1y;
+      }
+  }
+
+  # BOSH
+  location = /http-bind {
+      proxy_pass http://$prosody_node/http-bind?prefix=$prefix&$args;
+      proxy_http_version 1.1;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header Host $http_host;
+      proxy_set_header Connection "";
+  }
+
+  # xmpp websockets
+  location = /xmpp-websocket {
+      proxy_pass http://$prosody_node/xmpp-websocket?prefix=$prefix&$args;
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+      proxy_set_header Host $http_host;
+      tcp_nodelay on;
+  }
+
+  # colibri (JVB) websockets for jvb1
+  location ~ ^/colibri-ws/default-id/(.*) {
+      proxy_pass http://jvb1/colibri-ws/default-id/$1$is_args$args;
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+      tcp_nodelay on;
+  }
+
+  # load test minimal client, uncomment when used
+  #location ~ ^/_load-test/([^/?&:'"]+)$ {
+  #    rewrite ^/_load-test/(.*)$ /load-test/index.html break;
+  #}
+  #location ~ ^/_load-test/libs/(.*)$ {
+  #    add_header 'Access-Control-Allow-Origin' '*';
+  #    alias /usr/share/jitsi-meet/load-test/libs/$1;
+  #}
+
+  location ~ ^/([^/?&:'"]+)$ {
+      set $roomname "$1";
+      try_files $uri @root_path;
+  }
+
+  location @root_path {
+      rewrite ^/(.*)$ /$custom_index break;
+  }
+
+  location ~ ^/([^/?&:'"]+)/config.js$
+  {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+
+      alias $config_js_location;
+  }
+
+  # Matches /(TENANT)/pwa-worker.js or /(TENANT)/manifest.json to rewrite to / and look for file
+  location ~ ^/([^/?&:'"]+)/(pwa-worker.js|manifest.json)$ {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      rewrite ^/([^/?&:'"]+)/(pwa-worker.js|manifest.json)$ /$2;
+  }
+
+  # BOSH for subdomains
+  location ~ ^/([^/?&:'"]+)/http-bind {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      set $prefix "$1";
+
+      rewrite ^/(.*)$ /http-bind;
+  }
+
+  # websockets for subdomains
+  location ~ ^/([^/?&:'"]+)/xmpp-websocket {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      set $prefix "$1";
+
+      rewrite ^/(.*)$ /xmpp-websocket;
+  }
+
+  location ~ ^/([^/?&:'"]+)/_api/room-info {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      set $prefix "$1";
+
+      rewrite ^/(.*)$ /_api/room-info;
+  }
+
+  # Anything that didn't match above, and isn't a real file, assume it's a room name and redirect to /
+  location ~ ^/([^/?&:'"]+)/(.*)$ {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      rewrite ^/([^/?&:'"]+)/(.*)$ /$2;
+  }
+}
+
+{% endif %}
-- 
2.39.2


From bb6cd5f8ccd3c0e7c2a9ba9bb603877a1eb17aec Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 10 Aug 2023 13:46:23 -0400
Subject: [PATCH 07/28] Replace hardcoded value with variable

---
 webapps/jitsimeet/templates/vhost.conf.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webapps/jitsimeet/templates/vhost.conf.j2 b/webapps/jitsimeet/templates/vhost.conf.j2
index 1335c943..87a5712b 100644
--- a/webapps/jitsimeet/templates/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/vhost.conf.j2
@@ -74,7 +74,7 @@ server {
   add_header Strict-Transport-Security "max-age=63072000" always;
   set $prefix "";
   set $custom_index "";
-  set $config_js_location /etc/jitsi/meet/atlantide-3.evolix.eu-config.js;
+  set $config_js_location /etc/jitsi/meet/{{ domains | first }}-config.js;
 
   ##
   # Certificates
-- 
2.39.2


From 68f3f48c3b747488df246854e567e862f7371fb4 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 10 Aug 2023 14:52:24 -0400
Subject: [PATCH 08/28] Not needed

---
 webapps/jitsimeet/tasks/main.yml | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index c3c72dc4..f2fc0924 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -151,7 +151,7 @@
     src: "vhost.conf.j2"
     dest: "/etc/nginx/sites-available/{{ domains |first }}.conf"
 
-- name: Enable nginx vhost for peertube
+- name: Enable nginx vhost
   file:
     src: "/etc/nginx/sites-available/{{ domains |first }}.conf"
     dest: "/etc/nginx/sites-enabled/{{ domains |first }}.conf"
@@ -162,11 +162,3 @@
     name: nginx
     state: reloaded
 
-- name: Adjust permissions of files/folders for nginx
-  file:
-    path: "~/"
-    state: directory
-    mode: 'o=rX'
-    recurse: true
-  become_user: "{{ service }}"
-
-- 
2.39.2


From 5fa66a8d5e815886837a1f4b64e4ca5a878a36d8 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 10 Aug 2023 14:53:37 -0400
Subject: [PATCH 09/28] Enabling websockets

---
 webapps/jitsimeet/templates/meet/config.js.j2              | 2 +-
 webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2 | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/webapps/jitsimeet/templates/meet/config.js.j2 b/webapps/jitsimeet/templates/meet/config.js.j2
index 6e06124f..ee762f64 100644
--- a/webapps/jitsimeet/templates/meet/config.js.j2
+++ b/webapps/jitsimeet/templates/meet/config.js.j2
@@ -49,7 +49,7 @@ var config = {
     bosh: 'https://{{ domains | first }}/' + subdir + 'http-bind',
 
     // Websocket URL (XMPP)
-    // websocket: 'wss://{{ domains | first }}/' + subdir + 'xmpp-websocket',
+    websocket: 'wss://{{ domains | first }}/' + subdir + 'xmpp-websocket',
 
     // The real JID of focus participant - can be overridden here
     // Do not change username - FIXME: Make focus username configurable
diff --git a/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2 b/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
index 7d40e05c..506f4a14 100644
--- a/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
+++ b/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
@@ -12,6 +12,8 @@ external_services = {
 
 cross_domain_bosh = false;
 consider_bosh_secure = true;
+cross_domain_websocket = true;
+consider_websocket_secure = true;
 -- https_ports = { }; -- Remove this line to prevent listening on port 5284
 
 -- by default prosody 0.12 sends cors headers, if you want to disable it uncomment the following (the config is available on 0.12.1)
@@ -56,6 +58,8 @@ VirtualHost "{{ domains | first }}"
     -- we need bosh
     modules_enabled = {
         "bosh";
+        "websocket";
+        "smacks"; -- XEP-0198: Stream Management
         "pubsub";
         "ping"; -- Enable mod_ping
         "speakerstats";
-- 
2.39.2


From 0f425f05f58f7e80ac9b1f5c9433006d33cd355d Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 10 Aug 2023 16:05:59 -0400
Subject: [PATCH 10/28] Fix bug with jvb/websocket/colibri

---
 webapps/jitsimeet/templates/vhost.conf.j2 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/webapps/jitsimeet/templates/vhost.conf.j2 b/webapps/jitsimeet/templates/vhost.conf.j2
index 87a5712b..919d0788 100644
--- a/webapps/jitsimeet/templates/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/vhost.conf.j2
@@ -152,8 +152,8 @@ server {
   }
 
   # colibri (JVB) websockets for jvb1
-  location ~ ^/colibri-ws/default-id/(.*) {
-      proxy_pass http://jvb1/colibri-ws/default-id/$1$is_args$args;
+  location ~ ^/colibri-ws/([a-zA-Z0-9-\._]+)/(.*) {
+      proxy_pass http://jvb1/colibri-ws/default-id/$2$is_args$args;
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
-- 
2.39.2


From 03e231af19308346507ed83db310bfd78512ca00 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Fri, 18 Aug 2023 10:06:18 -0400
Subject: [PATCH 11/28] coturn

---
 webapps/jitsimeet/tasks/main.yml              | 23 ++++++++--
 .../certbot/coturn-certbot-deploy.sh.j2       | 30 ++++++++++++
 .../templates/coturn/turnserver.conf.j2       | 46 +++++++++++++++++++
 webapps/jitsimeet/templates/meet/config.js.j2 |  4 +-
 .../templates/{ => nginx}/vhost.conf.j2       |  0
 .../sip-communicator.properties.j2            |  2 +-
 6 files changed, 98 insertions(+), 7 deletions(-)
 create mode 100644 webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
 create mode 100644 webapps/jitsimeet/templates/coturn/turnserver.conf.j2
 rename webapps/jitsimeet/templates/{ => nginx}/vhost.conf.j2 (100%)

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index f2fc0924..529d640c 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -66,7 +66,20 @@
   ansible.builtin.apt:
     name: jitsi-meet
     state: present
-    install_recommends: no
+    install_recommends: yes
+
+- name: Add certs dir for coturn/letsencrypt if needed
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: '700'
+    owner: 'turnserver'
+    group: 'turnserver'
+  loop: 
+    - /etc/coturn
+    - /etc/coturn/certs
+    - /etc/letsencrypt/renewal-hooks
+    - /etc/letsencrypt/renewal-hooks/deploy
 
 - name: Template config files
   template:
@@ -80,6 +93,8 @@
     - { src: 'videobridge/sip-communicator.properties.j2', dest: "/etc/jitsi/videobridge/sip-communicator.properties", owner: "jvb", group: "jitsi", mode: "0640" }
     - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
     - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
+    - { src: 'coturn/turnserver.conf.j2', dest: "/etc/turnserver.conf", owner: "root", group: "turnserver", mode: "0640" }
+    - { src: 'certbot/coturn-certbot-deploy.sh.j2', dest: "/etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh", owner: "root", group: "turnserver", mode: "0700" }
 
 - name: Add bloc to jicofo.conf to disable sctp
   ansible.builtin.blockinfile:
@@ -121,9 +136,9 @@
   block:
   - name: Template vhost without SSL for successfull LE challengce
     template: 
-      src: "vhost.conf.j2"
+      src: "nginx/vhost.conf.j2"
       dest: "/etc/nginx/sites-available/{{ domains |first }}.conf"
-  - name: Enable temporary nginx vhost for peertube
+  - name: Enable temporary nginx vhost
     file:
       src: "/etc/nginx/sites-available/{{ domains |first }}.conf"
       dest: "/etc/nginx/sites-enabled/{{ domains |first }}.conf"
@@ -148,7 +163,7 @@
 
 - name: (Re)template conf file for nginx vhost with SSL
   template:
-    src: "vhost.conf.j2"
+    src: "nginx/vhost.conf.j2"
     dest: "/etc/nginx/sites-available/{{ domains |first }}.conf"
 
 - name: Enable nginx vhost
diff --git a/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2 b/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
new file mode 100644
index 00000000..de032ab5
--- /dev/null
+++ b/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
@@ -0,0 +1,30 @@
+#!/bin/sh
+
+# https://serverfault.com/questions/849683/how-to-setup-coturn-with-letsencrypt
+
+set -e
+
+for domain in $RENEWED_DOMAINS; do
+        case $domain in
+        {{ domains | first }})
+                daemon_cert_root=/etc/coturn/certs
+
+                # Make sure the certificate and private key files are
+                # never world readable, even just for an instant while
+                # we're copying them into daemon_cert_root.
+                umask 077
+
+                cp "$RENEWED_LINEAGE/fullchain.pem" "$daemon_cert_root/$domain.crt"
+                cp "$RENEWED_LINEAGE/privkey.pem" "$daemon_cert_root/$domain.key"
+
+                # Apply the proper file ownership and permissions for
+                # the daemon to read its certificate and key.
+                chown turnserver "$daemon_cert_root/$domain.crt" \
+                        "$daemon_cert_root/$domain.key"
+                chmod 400 "$daemon_cert_root/$domain.crt" \
+                        "$daemon_cert_root/$domain.key"
+
+                service coturn restart >/dev/null
+                ;;
+        esac
+done
diff --git a/webapps/jitsimeet/templates/coturn/turnserver.conf.j2 b/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
new file mode 100644
index 00000000..1bf95f1d
--- /dev/null
+++ b/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
@@ -0,0 +1,46 @@
+# jitsi-meet coturn config. Do not modify this line
+use-auth-secret
+keep-address-family
+static-auth-secret={{ jitsi_meet_turn_secret }}
+realm={{ domains | first }}
+cert=/etc/letsencrypt/live/{{ domains | first }}/fullchain.pem
+pkey=/etc/letsencrypt/live/{{ domains | first }}/privkey.pem
+no-multicast-peers
+no-cli
+no-loopback-peers
+no-tcp-relay
+no-tcp
+listening-port=3478
+tls-listening-port=5349
+no-tlsv1
+no-tlsv1_1
+# https://ssl-config.mozilla.org/#server=haproxy&version=2.1&config=intermediate&openssl=1.1.0g&guideline=5.4
+cipher-list=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+# without it there are errors when running on Ubuntu 20.04
+dh2066
+# jitsi-meet coturn relay disable config. Do not modify this line
+denied-peer-ip=0.0.0.0-0.255.255.255
+denied-peer-ip=10.0.0.0-10.255.255.255
+denied-peer-ip=100.64.0.0-100.127.255.255
+denied-peer-ip=127.0.0.0-127.255.255.255
+denied-peer-ip=169.254.0.0-169.254.255.255
+denied-peer-ip=127.0.0.0-127.255.255.255
+denied-peer-ip=172.16.0.0-172.31.255.255
+denied-peer-ip=192.0.0.0-192.0.0.255
+denied-peer-ip=192.0.2.0-192.0.2.255
+denied-peer-ip=192.88.99.0-192.88.99.255
+denied-peer-ip=192.168.0.0-192.168.255.255
+denied-peer-ip=198.18.0.0-198.19.255.255
+denied-peer-ip=198.51.100.0-198.51.100.255
+denied-peer-ip=203.0.113.0-203.0.113.255
+denied-peer-ip=240.0.0.0-255.255.255.255
+denied-peer-ip=::1
+denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+syslog
+
diff --git a/webapps/jitsimeet/templates/meet/config.js.j2 b/webapps/jitsimeet/templates/meet/config.js.j2
index ee762f64..6fa9886a 100644
--- a/webapps/jitsimeet/templates/meet/config.js.j2
+++ b/webapps/jitsimeet/templates/meet/config.js.j2
@@ -946,8 +946,8 @@ var config = {
         // The STUN servers that will be used in the peer to peer connections
         stunServers: [
 
-            // { urls: 'stun:{{ domains | first }}:3478' },
-            { urls: 'stun:meet-jit-si-turnrelay.jitsi.net:443' },
+             { urls: 'stun:{{ domains | first }}:3478' },
+            //{ urls: 'stun:meet-jit-si-turnrelay.jitsi.net:443' },
         ],
     },
 
diff --git a/webapps/jitsimeet/templates/vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
similarity index 100%
rename from webapps/jitsimeet/templates/vhost.conf.j2
rename to webapps/jitsimeet/templates/nginx/vhost.conf.j2
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
index 617622e8..f8fca054 100644
--- a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -1,5 +1,5 @@
 org.ice4j.ice.harvest.DISABLE_AWS_HARVESTER=true
-org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES=meet-jit-si-turnrelay.jitsi.net:443
+org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES={{ domains | first }}:3478
 org.jitsi.videobridge.ENABLE_STATISTICS=true
 org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
 org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
-- 
2.39.2


From 3ab377ffa845b4e069f506b8bc910b69d4267c41 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Wed, 23 Aug 2023 15:44:22 -0400
Subject: [PATCH 12/28] certbot --deploy-hook

---
 webapps/jitsimeet/tasks/main.yml                      | 2 +-
 webapps/jitsimeet/templates/coturn/turnserver.conf.j2 | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 529d640c..878ca4eb 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -153,7 +153,7 @@
       state: directory
       mode: '0755'
   - name: Generate certificate with certbot
-    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
+    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
   when: ssl.stat.exists != true
 
 - name: (Re)check if SSL certificate is present and register result
diff --git a/webapps/jitsimeet/templates/coturn/turnserver.conf.j2 b/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
index 1bf95f1d..ac9f0c1d 100644
--- a/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
+++ b/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
@@ -3,11 +3,11 @@ use-auth-secret
 keep-address-family
 static-auth-secret={{ jitsi_meet_turn_secret }}
 realm={{ domains | first }}
-cert=/etc/letsencrypt/live/{{ domains | first }}/fullchain.pem
-pkey=/etc/letsencrypt/live/{{ domains | first }}/privkey.pem
+cert=/etc/coturn/certs/{{ domains | first }}.crt
+pkey=/etc/coturn/certs/{{ domains | first }}.key
 no-multicast-peers
 no-cli
-no-loopback-peers
+#no-loopback-peers
 no-tcp-relay
 no-tcp
 listening-port=3478
@@ -17,7 +17,7 @@ no-tlsv1_1
 # https://ssl-config.mozilla.org/#server=haproxy&version=2.1&config=intermediate&openssl=1.1.0g&guideline=5.4
 cipher-list=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
 # without it there are errors when running on Ubuntu 20.04
-dh2066
+#dh2066
 # jitsi-meet coturn relay disable config. Do not modify this line
 denied-peer-ip=0.0.0.0-0.255.255.255
 denied-peer-ip=10.0.0.0-10.255.255.255
-- 
2.39.2


From 193e266f1917670188e7c89b44d873b5f278a47f Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Wed, 23 Aug 2023 16:00:31 -0400
Subject: [PATCH 13/28] More generic

---
 webapps/jitsimeet/defaults/main.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index 2a9a39a2..d5fc790f 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -3,8 +3,8 @@
 
 system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2', 'lua-unbound', 'certbot', 'python3-certbot-nginx']"
 
-domains: ['bullseye.domaine-fictif.org']
-certbot_admin_email: 'support@evolix.fr'
+domains: ['jitsi.example.net']
+certbot_admin_email: 'security@example.net'
 
 jitsi_meet_cert_choice: "Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)"
 jitsi_meet_ssl_cert_path: "/etc/ssl/certs/ssl-cert-snakeoil.pem"
-- 
2.39.2


From ee659b531dd0ab43c040c0c2b14efeb2ae24357a Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 24 Aug 2023 15:04:10 -0400
Subject: [PATCH 14/28] Simple manual upgrade with .deb packages

---
 webapps/jitsimeet/tasks/upgrade.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/webapps/jitsimeet/tasks/upgrade.yml b/webapps/jitsimeet/tasks/upgrade.yml
index 0b16c683..c1befe48 100644
--- a/webapps/jitsimeet/tasks/upgrade.yml
+++ b/webapps/jitsimeet/tasks/upgrade.yml
@@ -1,4 +1,11 @@
 ---
 # tasks file for jitsimeet upgrade
-
-
+#
+# 1. Check what may have changed in release notes and changelogs:
+# https://github.com/jitsi/jitsi-meet-release-notes
+# https://github.com/jitsi/jitsi-meet/releases
+# 
+# 2. Upgrade Debian packages with these commands (as root):
+# apt update
+# apt list --upgradeable
+# apt install jitsi-meet
-- 
2.39.2


From 44cbc0a74cb100df4094295ef600a8be1ad19219 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Fri, 29 Sep 2023 10:35:20 -0400
Subject: [PATCH 15/28] pied perso + proxy stream

---
 webapps/jitsimeet/defaults/main.yml           |   1 +
 webapps/jitsimeet/tasks/main.yml              |  48 ++-
 .../certbot/coturn-certbot-deploy.sh.j2       |   2 +-
 .../templates/coturn/turnserver.conf.j2       |   6 +-
 webapps/jitsimeet/templates/meet/config.js.j2 |   9 +-
 .../templates/meet/interface_config.js.j2     | 273 ++++++++++++++++++
 .../meet/welcomePageAdditionalContent.html.j2 |  22 ++
 .../templates/nginx/multiplex.conf.j2         |  27 ++
 .../jitsimeet/templates/nginx/vhost.conf.j2   |  11 +-
 .../templates/prosody/virtualhost.cfg.lua.j2  |   6 +-
 .../sip-communicator.properties.j2            |   5 +-
 11 files changed, 383 insertions(+), 27 deletions(-)
 create mode 100644 webapps/jitsimeet/templates/meet/interface_config.js.j2
 create mode 100644 webapps/jitsimeet/templates/meet/welcomePageAdditionalContent.html.j2
 create mode 100644 webapps/jitsimeet/templates/nginx/multiplex.conf.j2

diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index d5fc790f..dad86af6 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -4,6 +4,7 @@
 system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2', 'lua-unbound', 'certbot', 'python3-certbot-nginx']"
 
 domains: ['jitsi.example.net']
+turn_domains: ['turn.jitsi.example.net']
 certbot_admin_email: 'security@example.net'
 
 jitsi_meet_cert_choice: "Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)"
diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 878ca4eb..4f26f55d 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -68,18 +68,23 @@
     state: present
     install_recommends: yes
 
+- name: Install stream module for nginx
+  ansible.builtin.apt:
+    name: libnginx-mod-stream
+    state: present
+
 - name: Add certs dir for coturn/letsencrypt if needed
   file:
-    path: "{{ item }}"
+    path: "{{ item.path }}"
     state: directory
-    mode: '700'
-    owner: 'turnserver'
-    group: 'turnserver'
+    mode: "{{ item.mode }}"
+    owner: "{{ item.owner }}"
+    group: "{{ item.group }}"
   loop: 
-    - /etc/coturn
-    - /etc/coturn/certs
-    - /etc/letsencrypt/renewal-hooks
-    - /etc/letsencrypt/renewal-hooks/deploy
+    - { path: '/etc/coturn', owner: "turnserver", group: "turnserver", mode: "0700" }
+    - { path: '/etc/coturn/certs', owner: "turnserver", group: "turnserver", mode: "0700" }
+    - { path: '/etc/letsencrypt/renewal-hooks', owner: "root", group: "root", mode: "0700" }
+    - { path: '/etc/letsencrypt/renewal-hooks/deploy', owner: "root", group: "root", mode: "0700" }
 
 - name: Template config files
   template:
@@ -92,9 +97,11 @@
     - { src: 'videobridge/jvb.conf.j2', dest: "/etc/jitsi/videobridge/jvb.conf", owner: "jvb", group: "jitsi", mode: "0640" }
     - { src: 'videobridge/sip-communicator.properties.j2', dest: "/etc/jitsi/videobridge/sip-communicator.properties", owner: "jvb", group: "jitsi", mode: "0640" }
     - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
+    - { src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
+    - { src: 'meet/welcomePageAdditionalContent.html.j2', dest: "/usr/share/jitsi-meet/static/welcomePageAdditionalContent.html", owner: "root", group: "root", mode: "0644" }
     - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
     - { src: 'coturn/turnserver.conf.j2', dest: "/etc/turnserver.conf", owner: "root", group: "turnserver", mode: "0640" }
-    - { src: 'certbot/coturn-certbot-deploy.sh.j2', dest: "/etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh", owner: "root", group: "turnserver", mode: "0700" }
+    - { src: 'certbot/coturn-certbot-deploy.sh.j2', dest: "/etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh", owner: "root", group: "root", mode: "0700" }
 
 - name: Add bloc to jicofo.conf to disable sctp
   ansible.builtin.blockinfile:
@@ -153,7 +160,7 @@
       state: directory
       mode: '0755'
   - name: Generate certificate with certbot
-    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
+    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
   when: ssl.stat.exists != true
 
 - name: (Re)check if SSL certificate is present and register result
@@ -163,8 +170,17 @@
 
 - name: (Re)template conf file for nginx vhost with SSL
   template:
-    src: "nginx/vhost.conf.j2"
-    dest: "/etc/nginx/sites-available/{{ domains |first }}.conf"
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  loop:
+    - { src: 'nginx/vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ domains |first }}.conf" }
+    - { src: 'nginx/multiplex.conf.j2', dest: '/etc/nginx/modules-available/multiplex.conf' }
+
+- name: Enable multiplex module conf
+  file:
+    src: '/etc/nginx/modules-available/multiplex.conf'
+    dest: '/etc/nginx/modules-enabled/multiplex.conf'
+    state: link
 
 - name: Enable nginx vhost
   file:
@@ -177,3 +193,11 @@
     name: nginx
     state: reloaded
 
+- name: Check if SSL certificate for coturn is present and register result
+  stat:
+    path: "/etc/coturn/certs/{{ turn_domains |first }}.crt"
+  register: ssl_coturn
+
+- name: Generate certificate for coturn with certbot
+  shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh --agree-tos --email {{ certbot_admin_email }} -d {{ turn_domains |first }}
+  when: ssl_coturn.stat.exists != true 
diff --git a/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2 b/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
index de032ab5..9e34af55 100644
--- a/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
+++ b/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
@@ -6,7 +6,7 @@ set -e
 
 for domain in $RENEWED_DOMAINS; do
         case $domain in
-        {{ domains | first }})
+        {{ turn_domains | first }})
                 daemon_cert_root=/etc/coturn/certs
 
                 # Make sure the certificate and private key files are
diff --git a/webapps/jitsimeet/templates/coturn/turnserver.conf.j2 b/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
index ac9f0c1d..67ee20a3 100644
--- a/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
+++ b/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
@@ -2,9 +2,9 @@
 use-auth-secret
 keep-address-family
 static-auth-secret={{ jitsi_meet_turn_secret }}
-realm={{ domains | first }}
-cert=/etc/coturn/certs/{{ domains | first }}.crt
-pkey=/etc/coturn/certs/{{ domains | first }}.key
+realm={{ turn_domains | first }}
+cert=/etc/coturn/certs/{{ turn_domains | first }}.crt
+pkey=/etc/coturn/certs/{{ turn_domains | first }}.key
 no-multicast-peers
 no-cli
 #no-loopback-peers
diff --git a/webapps/jitsimeet/templates/meet/config.js.j2 b/webapps/jitsimeet/templates/meet/config.js.j2
index 6fa9886a..5000be95 100644
--- a/webapps/jitsimeet/templates/meet/config.js.j2
+++ b/webapps/jitsimeet/templates/meet/config.js.j2
@@ -574,13 +574,14 @@ var config = {
     // enableWelcomePage: true,
 
     // Configs for welcome page.
-    // welcomePage: {
+    welcomePage: {
     //     // Whether to disable welcome page. In case it's disabled a random room
     //     // will be joined when no room is specified.
-    //     disabled: false,
+         disabled: false,
+         additionalContent: true
     //     // If set,landing page will redirect to this URL.
     //     customUrl: ''
-    // },
+    },
 
     // Configs for the lobby screen.
     // lobby {
@@ -946,7 +947,7 @@ var config = {
         // The STUN servers that will be used in the peer to peer connections
         stunServers: [
 
-             { urls: 'stun:{{ domains | first }}:3478' },
+             { urls: 'stun:{{ turn_domains | first }}:3478' },
             //{ urls: 'stun:meet-jit-si-turnrelay.jitsi.net:443' },
         ],
     },
diff --git a/webapps/jitsimeet/templates/meet/interface_config.js.j2 b/webapps/jitsimeet/templates/meet/interface_config.js.j2
new file mode 100644
index 00000000..0b8d546e
--- /dev/null
+++ b/webapps/jitsimeet/templates/meet/interface_config.js.j2
@@ -0,0 +1,273 @@
+/* eslint-disable no-unused-vars, no-var, max-len */
+/* eslint sort-keys: ["error", "asc", {"caseSensitive": false}] */
+
+/**
+ * !!!IMPORTANT!!!
+ *
+ * This file is considered deprecated. All options will eventually be moved to
+ * config.js, and no new options should be added here.
+ */
+
+var interfaceConfig = {
+    APP_NAME: 'Jitsi Meet',
+    AUDIO_LEVEL_PRIMARY_COLOR: 'rgba(255,255,255,0.4)',
+    AUDIO_LEVEL_SECONDARY_COLOR: 'rgba(255,255,255,0.2)',
+
+    /**
+     * A UX mode where the last screen share participant is automatically
+     * pinned. Valid values are the string "remote-only" so remote participants
+     * get pinned but not local, otherwise any truthy value for all participants,
+     * and any falsy value to disable the feature.
+     *
+     * Note: this mode is experimental and subject to breakage.
+     */
+    AUTO_PIN_LATEST_SCREEN_SHARE: 'remote-only',
+    BRAND_WATERMARK_LINK: '',
+
+    CLOSE_PAGE_GUEST_HINT: false, // A html text to be shown to guests on the close page, false disables it
+
+    DEFAULT_BACKGROUND: '#040404',
+    DEFAULT_WELCOME_PAGE_LOGO_URL: 'images/watermark.svg',
+
+    DISABLE_DOMINANT_SPEAKER_INDICATOR: false,
+
+    /**
+     * If true, notifications regarding joining/leaving are no longer displayed.
+     */
+    DISABLE_JOIN_LEAVE_NOTIFICATIONS: false,
+
+    /**
+     * If true, presence status: busy, calling, connected etc. is not displayed.
+     */
+    DISABLE_PRESENCE_STATUS: false,
+
+    /**
+     * Whether the ringing sound in the call/ring overlay is disabled. If
+     * {@code undefined}, defaults to {@code false}.
+     *
+     * @type {boolean}
+     */
+    DISABLE_RINGING: false,
+
+    /**
+     * Whether the speech to text transcription subtitles panel is disabled.
+     * If {@code undefined}, defaults to {@code false}.
+     *
+     * @type {boolean}
+     */
+    DISABLE_TRANSCRIPTION_SUBTITLES: false,
+
+    /**
+     * Whether or not the blurred video background for large video should be
+     * displayed on browsers that can support it.
+     */
+    DISABLE_VIDEO_BACKGROUND: false,
+
+    DISPLAY_WELCOME_FOOTER: {{ welcome_footer }},
+    DISPLAY_WELCOME_PAGE_ADDITIONAL_CARD: false,
+    DISPLAY_WELCOME_PAGE_CONTENT: true,
+    DISPLAY_WELCOME_PAGE_TOOLBAR_ADDITIONAL_CONTENT: false,
+
+    ENABLE_DIAL_OUT: true,
+
+    // DEPRECATED. Animation no longer supported.
+    // ENABLE_FEEDBACK_ANIMATION: false,
+
+    FILM_STRIP_MAX_HEIGHT: 120,
+
+    GENERATE_ROOMNAMES_ON_WELCOME_PAGE: true,
+
+    /**
+     * Hide the invite prompt in the header when alone in the meeting.
+     */
+    HIDE_INVITE_MORE_HEADER: false,
+
+    JITSI_WATERMARK_LINK: 'https://jitsi.org',
+
+    LANG_DETECTION: true, // Allow i18n to detect the system language
+    LOCAL_THUMBNAIL_RATIO: 16 / 9, // 16:9
+
+    /**
+     * Maximum coefficient of the ratio of the large video to the visible area
+     * after the large video is scaled to fit the window.
+     *
+     * @type {number}
+     */
+    MAXIMUM_ZOOMING_COEFFICIENT: 1.3,
+
+    /**
+     * Whether the mobile app Jitsi Meet is to be promoted to participants
+     * attempting to join a conference in a mobile Web browser. If
+     * {@code undefined}, defaults to {@code true}.
+     *
+     * @type {boolean}
+     */
+    MOBILE_APP_PROMO: true,
+
+    // Names of browsers which should show a warning stating the current browser
+    // has a suboptimal experience. Browsers which are not listed as optimal or
+    // unsupported are considered suboptimal. Valid values are:
+    // chrome, chromium, edge, electron, firefox, nwjs, opera, safari
+    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'firefox', 'nwjs', 'electron', 'safari' ],
+
+    POLICY_LOGO: null,
+    PROVIDER_NAME: 'Jitsi',
+
+    /**
+     * If true, will display recent list
+     *
+     * @type {boolean}
+     */
+    RECENT_LIST_ENABLED: true,
+    REMOTE_THUMBNAIL_RATIO: 1, // 1:1
+
+    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'sounds', 'more' ],
+
+    /**
+     * Specify which sharing features should be displayed. If the value is not set
+     * all sharing features will be shown. You can set [] to disable all.
+     */
+    // SHARING_FEATURES: ['email', 'url', 'dial-in', 'embed'],
+
+    SHOW_BRAND_WATERMARK: false,
+
+    /**
+     * Decides whether the chrome extension banner should be rendered on the landing page and during the meeting.
+     * If this is set to false, the banner will not be rendered at all. If set to true, the check for extension(s)
+     * being already installed is done before rendering.
+     */
+    SHOW_CHROME_EXTENSION_BANNER: false,
+
+    SHOW_JITSI_WATERMARK: true,
+    SHOW_POWERED_BY: false,
+    SHOW_PROMOTIONAL_CLOSE_PAGE: false,
+
+    /*
+     * If indicated some of the error dialogs may point to the support URL for
+     * help.
+     */
+    SUPPORT_URL: 'https://community.jitsi.org/',
+
+    // Browsers, in addition to those which do not fully support WebRTC, that
+    // are not supported and should show the unsupported browser page.
+    UNSUPPORTED_BROWSERS: [],
+
+    /**
+     * Whether to show thumbnails in filmstrip as a column instead of as a row.
+     */
+    VERTICAL_FILMSTRIP: true,
+
+    // Determines how the video would fit the screen. 'both' would fit the whole
+    // screen, 'height' would fit the original video height to the height of the
+    // screen, 'width' would fit the original video width to the width of the
+    // screen respecting ratio, 'nocrop' would make the video as large as
+    // possible and preserve aspect ratio without cropping.
+    VIDEO_LAYOUT_FIT: 'both',
+
+    /**
+     * If true, hides the video quality label indicating the resolution status
+     * of the current large video.
+     *
+     * @type {boolean}
+     */
+    VIDEO_QUALITY_LABEL_DISABLED: false,
+
+    /**
+     * How many columns the tile view can expand to. The respected range is
+     * between 1 and 5.
+     */
+    // TILE_VIEW_MAX_COLUMNS: 5,
+
+    // List of undocumented settings
+    /**
+     INDICATOR_FONT_SIZES
+     PHONE_NUMBER_REGEX
+    */
+
+    // -----------------DEPRECATED CONFIGS BELOW THIS LINE-----------------------------
+
+    /**
+     * Specify URL for downloading ios mobile app.
+     */
+    // MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
+
+    /**
+     * Specify custom URL for downloading android mobile app.
+     */
+    // MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
+
+    /**
+     * Specify mobile app scheme for opening the app from the mobile browser.
+     */
+    // APP_SCHEME: 'org.jitsi.meet',
+
+    // NATIVE_APP_NAME: 'Jitsi Meet',
+
+    /**
+     * Specify Firebase dynamic link properties for the mobile apps.
+     */
+    // MOBILE_DYNAMIC_LINK: {
+    //    APN: 'org.jitsi.meet',
+    //    APP_CODE: 'w2atb',
+    //    CUSTOM_DOMAIN: undefined,
+    //    IBI: 'com.atlassian.JitsiMeet.ios',
+    //    ISI: '1165103905'
+    // },
+
+    /**
+     * Hide the logo on the deep linking pages.
+     */
+    // HIDE_DEEP_LINKING_LOGO: false,
+
+    /**
+     * Specify the Android app package name.
+     */
+    // ANDROID_APP_PACKAGE: 'org.jitsi.meet',
+
+    /**
+     * Specify custom URL for downloading f droid app.
+     */
+    // MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',
+
+    // Connection indicators (
+    // CONNECTION_INDICATOR_AUTO_HIDE_ENABLED,
+    // CONNECTION_INDICATOR_AUTO_HIDE_TIMEOUT,
+    // CONNECTION_INDICATOR_DISABLED) got moved to config.js.
+
+    // Please use disableModeratorIndicator from config.js
+    // DISABLE_FOCUS_INDICATOR: false,
+
+    // Please use defaultLocalDisplayName from config.js
+    // DEFAULT_LOCAL_DISPLAY_NAME: 'me',
+
+    // Please use defaultLogoUrl from config.js
+    // DEFAULT_LOGO_URL: 'images/watermark.svg',
+
+    // Please use defaultRemoteDisplayName from config.js
+    // DEFAULT_REMOTE_DISPLAY_NAME: 'Fellow Jitster',
+
+    // Moved to config.js as `toolbarConfig.initialTimeout`.
+    // INITIAL_TOOLBAR_TIMEOUT: 20000,
+
+    // Please use `liveStreaming.helpLink` from config.js
+    // Documentation reference for the live streaming feature.
+    // LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live',
+
+    // Moved to config.js as `toolbarConfig.alwaysVisible`.
+    // TOOLBAR_ALWAYS_VISIBLE: false,
+
+    // This config was moved to config.js as `toolbarButtons`.
+    // TOOLBAR_BUTTONS: [],
+
+    // Moved to config.js as `toolbarConfig.timeout`.
+    // TOOLBAR_TIMEOUT: 4000,
+
+    // Allow all above example options to include a trailing comma and
+    // prevent fear when commenting out the last value.
+    // eslint-disable-next-line sort-keys
+    makeJsonParserHappy: 'even if last key had a trailing comma'
+
+    // No configuration value should follow this line.
+};
+
+/* eslint-enable no-unused-vars, no-var, max-len */
diff --git a/webapps/jitsimeet/templates/meet/welcomePageAdditionalContent.html.j2 b/webapps/jitsimeet/templates/meet/welcomePageAdditionalContent.html.j2
new file mode 100644
index 00000000..f91eb691
--- /dev/null
+++ b/webapps/jitsimeet/templates/meet/welcomePageAdditionalContent.html.j2
@@ -0,0 +1,22 @@
+<template id = "welcome-page-additional-content-template">
+    <div class="welcome-page-content">
+        <div class="welcome-footer">
+            <div class="welcome-footer-centered">
+                <div class="welcome-footer-padded">
+                    <div class="welcome-footer-row-block welcome-footer--row-1">
+                        <div class="welcome-footer-row-1-text">Jitsi on mobile – download our apps and start a meeting from anywhere </div>
+                        <a class="welcome-badge" href="https://apps.apple.com/us/app/jitsi-meet/id1165103905"><img src="./images/app-store-badge.png"></a>
+                        <a class="welcome-badge" href="https://play.google.com/store/apps/details?id=org.jitsi.meet&amp;hl=en&amp;gl=US"><img src="./images/google-play-badge.png"></a>
+                        <a class="welcomebadge" href="https://f-droid.org/en/packages/org.jitsi.meet/"><img src="./images/f-droid-badge.png"></a>
+                    </div>
+        
+                    <div class="welcome-footer-row-block welcome-footer--row-2">
+                        <div style="padding-top:0.7em; padding-bottom:0.7em;">
+                            <a href="https://evolix.com" rel="noopener" target="_blank">Hébergé par Evolix</a> | Nous proposons une utilisation gratuite sous réserve d'accepter nos <a href="https://evolix.com/cgu.html" rel="noopener" target="_blank">CGU</a>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </div>
+</template>
diff --git a/webapps/jitsimeet/templates/nginx/multiplex.conf.j2 b/webapps/jitsimeet/templates/nginx/multiplex.conf.j2
new file mode 100644
index 00000000..8a279fb9
--- /dev/null
+++ b/webapps/jitsimeet/templates/nginx/multiplex.conf.j2
@@ -0,0 +1,27 @@
+stream {
+    map $ssl_preread_server_name $name {
+        {{ domains | first }} web_backend;
+        {{ turn_domains | first }} turn_backend;
+    }
+
+    upstream web_backend {
+        server 127.0.0.1:8088;
+    }
+
+    upstream turn_backend {
+        server {{ ansible_default_ipv4.address }}:5349;
+    }
+
+    server {
+        listen 443;
+        listen [::]:443;
+
+        # since 1.11.5
+        ssl_preread on;
+
+        proxy_pass $name;
+
+        # Increase buffer to serve video
+        proxy_buffer_size 10m;
+    }
+}
diff --git a/webapps/jitsimeet/templates/nginx/vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
index 919d0788..47156004 100644
--- a/webapps/jitsimeet/templates/nginx/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
@@ -33,7 +33,7 @@ map $arg_vnode $prosody_node {
 server {
   listen 80;
   listen [::]:80;
-  server_name {{ domains | first }};
+  server_name {{ domains | first }} {{ turn_domains | first }};
 
   # For certbot
   location ~ /.well-known/acme-challenge {
@@ -48,8 +48,8 @@ server {
 
 {% if ssl.stat.exists %}
 server {
-  listen 443 ssl http2;
-  listen [::]:443 ssl http2;
+  listen 8088 ssl http2;
+  listen [::]:8088 ssl http2;
   server_name {{ domains | first }};
   
   access_log /var/log/nginx/{{ service }}.access.log; # reduce I/0 with buffer=10m flush=5m
@@ -75,6 +75,7 @@ server {
   set $prefix "";
   set $custom_index "";
   set $config_js_location /etc/jitsi/meet/{{ domains | first }}-config.js;
+  set $interface_config_js_location /etc/jitsi/meet/{{ domains | first }}-interface_config.js;
 
   ##
   # Certificates
@@ -103,6 +104,10 @@ server {
   location = /config.js {
       alias $config_js_location;
   }
+  
+  location = /interface_config.js {
+      alias $interface_config_js_location;
+  }
 
   location = /external_api.js {
       alias /usr/share/jitsi-meet/libs/external_api.min.js;
diff --git a/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2 b/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
index 506f4a14..cef3eaae 100644
--- a/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
+++ b/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
@@ -5,9 +5,9 @@ muc_mapper_domain_base = "{{ domains | first }}";
 
 external_service_secret = "{{ jitsi_meet_turn_secret }}";
 external_services = {
-     { type = "stun", host = "{{ domains | first }}", port = 3478 },
-     { type = "turn", host = "{{ domains | first }}", port = 3478, transport = "udp", secret = true, ttl = 86400, algorithm = "turn" },
-     { type = "turns", host = "{{ domains | first }}", port = 5349, transport = "tcp", secret = true, ttl = 86400, algorithm = "turn" }
+     { type = "stun", host = "{{ turn_domains | first }}", port = 3478 },
+     { type = "turn", host = "{{ turn_domains | first }}", port = 3478, transport = "udp", secret = true, ttl = 86400, algorithm = "turn" },
+     { type = "turns", host = "{{ turn_domains | first }}", port = 443, transport = "tcp", secret = true, ttl = 86400, algorithm = "turn" }
 };
 
 cross_domain_bosh = false;
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
index f8fca054..2b1dde4e 100644
--- a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -1,5 +1,5 @@
 org.ice4j.ice.harvest.DISABLE_AWS_HARVESTER=true
-org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES={{ domains | first }}:3478
+org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES={{ turn_domains | first }}:3478
 org.jitsi.videobridge.ENABLE_STATISTICS=true
 org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
 org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
@@ -8,3 +8,6 @@ org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
 org.jitsi.videobridge.xmpp.user.shard.PASSWORD={{ jitsi_meet_jvb_secret }}
 org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.{{ domains | first }}
 org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME={{ jitsi_meet_jvb_muc_nick }}
+org.jitsi.videobridge.rest.jetty.ResourceHandler.alias./static/welcomePageAdditionalContent.html=/usr/share/jitsi-meet/static/welcomePageAdditionalContent.html
+# Switches off the BWE mechanism.
+#org.jitsi.videobridge.TRUST_BWE=false
-- 
2.39.2


From ff90deff43a608f46537fc688757aff640828906 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Wed, 4 Oct 2023 14:56:28 -0400
Subject: [PATCH 16/28] To preserve custom changes to
 welcomePageAdditionalContent.html

---
 webapps/jitsimeet/tasks/main.yml                             | 2 +-
 webapps/jitsimeet/templates/nginx/vhost.conf.j2              | 5 +++++
 .../templates/videobridge/sip-communicator.properties.j2     | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 4f26f55d..2ea23891 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -98,7 +98,7 @@
     - { src: 'videobridge/sip-communicator.properties.j2', dest: "/etc/jitsi/videobridge/sip-communicator.properties", owner: "jvb", group: "jitsi", mode: "0640" }
     - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
     - { src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
-    - { src: 'meet/welcomePageAdditionalContent.html.j2', dest: "/usr/share/jitsi-meet/static/welcomePageAdditionalContent.html", owner: "root", group: "root", mode: "0644" }
+    - { src: 'meet/welcomePageAdditionalContent.html.j2', dest: "/etc/jitsi/meet/welcomePageAdditionalContent.html", owner: "root", group: "root", mode: "0644" }
     - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
     - { src: 'coturn/turnserver.conf.j2', dest: "/etc/turnserver.conf", owner: "root", group: "turnserver", mode: "0640" }
     - { src: 'certbot/coturn-certbot-deploy.sh.j2', dest: "/etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh", owner: "root", group: "root", mode: "0700" }
diff --git a/webapps/jitsimeet/templates/nginx/vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
index 47156004..1b2e6093 100644
--- a/webapps/jitsimeet/templates/nginx/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
@@ -76,6 +76,7 @@ server {
   set $custom_index "";
   set $config_js_location /etc/jitsi/meet/{{ domains | first }}-config.js;
   set $interface_config_js_location /etc/jitsi/meet/{{ domains | first }}-interface_config.js;
+  set $welcome_page_additional_content_location /etc/jitsi/meet/welcomePageAdditionalContent.html;
 
   ##
   # Certificates
@@ -112,6 +113,10 @@ server {
   location = /external_api.js {
       alias /usr/share/jitsi-meet/libs/external_api.min.js;
   }
+  
+  location = /static/welcomePageAdditionalContent.html {
+      alias $welcome_page_additional_content_location;
+  }
 
   location = /_api/room-info {
       proxy_pass http://prosody/room-info?prefix=$prefix&$args;
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
index 2b1dde4e..4b52cafd 100644
--- a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -8,6 +8,6 @@ org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
 org.jitsi.videobridge.xmpp.user.shard.PASSWORD={{ jitsi_meet_jvb_secret }}
 org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.{{ domains | first }}
 org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME={{ jitsi_meet_jvb_muc_nick }}
-org.jitsi.videobridge.rest.jetty.ResourceHandler.alias./static/welcomePageAdditionalContent.html=/usr/share/jitsi-meet/static/welcomePageAdditionalContent.html
+#org.jitsi.videobridge.rest.jetty.ResourceHandler.alias./static/welcomePageAdditionalContent.html=/usr/share/jitsi-meet/static/welcomePageAdditionalContent.html
 # Switches off the BWE mechanism.
 #org.jitsi.videobridge.TRUST_BWE=false
-- 
2.39.2


From a6a12f42fd4d17175061e342d9696b0d4f215354 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 14 Dec 2023 13:27:50 -0500
Subject: [PATCH 17/28] Remove hardcoded value

---
 webapps/jitsimeet/tasks/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 2ea23891..d8bb49fd 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -20,7 +20,7 @@
 
 - name: Add Prosody apt repository
   ansible.builtin.apt_repository:
-    repo: "deb http://packages.prosody.im/debian bullseye main"
+    repo: "deb http://packages.prosody.im/debian {{ ansible_distribution_release }} main"
     state: present
 
 - name: Add Jitsi Meet apt repository
-- 
2.39.2


From dbfade9f453754ee1d4a6bf43f440775ef0c9e1c Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Wed, 10 Jan 2024 13:22:34 -0500
Subject: [PATCH 18/28] To allow for other domains

---
 webapps/jitsimeet/tasks/main.yml          |  6 ++
 webapps/jitsimeet/tasks/other_domains.yml | 71 +++++++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 webapps/jitsimeet/tasks/other_domains.yml

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index d8bb49fd..f674f73b 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -201,3 +201,9 @@
 - name: Generate certificate for coturn with certbot
   shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh --agree-tos --email {{ certbot_admin_email }} -d {{ turn_domains |first }}
   when: ssl_coturn.stat.exists != true 
+
+- name: Setup other domains if any
+  include_tasks: other_domains.yml
+  loop: "{{ domains[1:] }}"
+  loop_control:
+    loop_var: domain
diff --git a/webapps/jitsimeet/tasks/other_domains.yml b/webapps/jitsimeet/tasks/other_domains.yml
new file mode 100644
index 00000000..b5eda9bc
--- /dev/null
+++ b/webapps/jitsimeet/tasks/other_domains.yml
@@ -0,0 +1,71 @@
+---
+# tasks file for other domains if any
+
+- name: Template config files
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+    owner: "{{ item.owner }}"
+    group: "{{ item.group }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domain }}-config.js", owner: "root", group: "root", mode: "0644" }
+
+- name: Check if SSL certificate is present and register result
+  stat:
+    path: "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
+  register: ssl
+
+- name: Generate certificate only if required (first time)
+  block:
+  - name: Template vhost without SSL for successfull LE challengce
+    template: 
+      src: "nginx/vhost.conf.j2"
+      dest: "/etc/nginx/sites-available/{{ domain }}.conf"
+  - name: Enable temporary nginx vhost
+    file:
+      src: "/etc/nginx/sites-available/{{ domain }}.conf"
+      dest: "/etc/nginx/sites-enabled/{{ domain }}.conf"
+      state: link
+  - name: Reload nginx conf
+    service:
+      name: nginx
+      state: reloaded
+  - name: Make sure /var/lib/letsencrypt exists and has correct permissions
+    file: 
+      path: /var/lib/letsencrypt
+      state: directory
+      mode: '0755'
+  - name: Generate certificate with certbot
+    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domain }}
+  when: ssl.stat.exists != true
+
+- name: (Re)check if SSL certificate is present and register result
+  stat:
+    path: "/etc/letsencrypt/live/{{ domain |first }}/fullchain.pem"
+  register: ssl
+
+- name: (Re)template conf file for nginx vhost with SSL
+  template:
+    src: "{{ item.src }}"
+    dest: "{{ item.dest }}"
+  loop:
+    - { src: 'nginx/vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ domain }}.conf" }
+    - { src: 'nginx/multiplex.conf.j2', dest: '/etc/nginx/modules-available/multiplex.conf' }
+
+- name: Enable multiplex module conf
+  file:
+    src: '/etc/nginx/modules-available/multiplex.conf'
+    dest: '/etc/nginx/modules-enabled/multiplex.conf'
+    state: link
+
+- name: Enable nginx vhost
+  file:
+    src: "/etc/nginx/sites-available/{{ domain }}.conf"
+    dest: "/etc/nginx/sites-enabled/{{ domain }}.conf"
+    state: link
+
+- name: Reload nginx conf
+  service:
+    name: nginx
+    state: reloaded
-- 
2.39.2


From bd77f6d75ea858c59f08d204bc04e3b7b8836991 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 18 Jan 2024 15:43:59 -0500
Subject: [PATCH 19/28] Deploy with additional domains

---
 webapps/jitsimeet/tasks/other_domains.yml     |  18 +-
 .../templates/nginx/other.vhost.conf.j2       | 223 ++++++++++++++++++
 2 files changed, 232 insertions(+), 9 deletions(-)
 create mode 100644 webapps/jitsimeet/templates/nginx/other.vhost.conf.j2

diff --git a/webapps/jitsimeet/tasks/other_domains.yml b/webapps/jitsimeet/tasks/other_domains.yml
index b5eda9bc..b2dfcf69 100644
--- a/webapps/jitsimeet/tasks/other_domains.yml
+++ b/webapps/jitsimeet/tasks/other_domains.yml
@@ -10,6 +10,7 @@
     mode: "{{ item.mode }}"
   loop:
     - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domain }}-config.js", owner: "root", group: "root", mode: "0644" }
+    - { src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ domain }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
 
 - name: Check if SSL certificate is present and register result
   stat:
@@ -20,7 +21,7 @@
   block:
   - name: Template vhost without SSL for successfull LE challengce
     template: 
-      src: "nginx/vhost.conf.j2"
+      src: "nginx/other.vhost.conf.j2"
       dest: "/etc/nginx/sites-available/{{ domain }}.conf"
   - name: Enable temporary nginx vhost
     file:
@@ -42,7 +43,7 @@
 
 - name: (Re)check if SSL certificate is present and register result
   stat:
-    path: "/etc/letsencrypt/live/{{ domain |first }}/fullchain.pem"
+    path: "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
   register: ssl
 
 - name: (Re)template conf file for nginx vhost with SSL
@@ -50,14 +51,13 @@
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
   loop:
-    - { src: 'nginx/vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ domain }}.conf" }
-    - { src: 'nginx/multiplex.conf.j2', dest: '/etc/nginx/modules-available/multiplex.conf' }
+    - { src: 'nginx/other.vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ domain }}.conf" }
 
-- name: Enable multiplex module conf
-  file:
-    src: '/etc/nginx/modules-available/multiplex.conf'
-    dest: '/etc/nginx/modules-enabled/multiplex.conf'
-    state: link
+- name: Insert block in multiplex.conf
+  lineinfile:
+    path: /etc/nginx/modules-enabled/multiplex.conf
+    insertafter: "web_backend;"
+    line: "{{ domain }} web_backend;"
 
 - name: Enable nginx vhost
   file:
diff --git a/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
new file mode 100644
index 00000000..a897b8ab
--- /dev/null
+++ b/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
@@ -0,0 +1,223 @@
+{% if ssl.stat.exists %}
+map $arg_vnode $prosody_node {
+    default prosody;
+    v1 v1;
+    v2 v2;
+    v3 v3;
+    v4 v4;
+    v5 v5;
+    v6 v6;
+    v7 v7;
+    v8 v8;
+}
+
+{% endif %}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name {{ domain }};
+
+  # For certbot
+  location ~ /.well-known/acme-challenge {
+    alias /var/lib/letsencrypt/;
+    try_files $uri =404;
+    allow all;
+  }
+  {% if ssl.stat.exists %}
+  location / { return 301 https://$host$request_uri; }
+  {% endif %}
+}
+
+{% if ssl.stat.exists %}
+server {
+  listen 8088 ssl http2;
+  listen [::]:8088 ssl http2;
+  server_name {{ domain }};
+  
+  access_log /var/log/nginx/{{ service }}.access.log; # reduce I/0 with buffer=10m flush=5m
+  error_log  /var/log/nginx/{{ service }}.error.log;
+
+  # For certbot
+  location ~ /.well-known/acme-challenge {
+    alias /var/lib/letsencrypt/;
+    try_files $uri =404;
+    allow all;
+  }
+
+  # Mozilla Guideline v5.4, nginx 1.17.7, OpenSSL 1.1.1d, intermediate configuration
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+  ssl_prefer_server_ciphers off;
+
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:SSL:10m;  # about 40000 sessions
+  ssl_session_tickets off;
+
+  add_header Strict-Transport-Security "max-age=63072000" always;
+  set $prefix "";
+  set $custom_index "";
+  set $config_js_location /etc/jitsi/meet/{{ domain }}-config.js;
+  set $interface_config_js_location /etc/jitsi/meet/{{ domain }}-interface_config.js;
+  set $welcome_page_additional_content_location /etc/jitsi/meet/welcomePageAdditionalContent.html;
+
+  ##
+  # Certificates
+  # you need a certificate to run in production. see https://letsencrypt.org/
+  ##
+  ssl_certificate     /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
+
+  root /usr/share/jitsi-meet;
+
+  # ssi on with javascript for multidomain variables in config.js
+  ssi on;
+  ssi_types application/x-javascript application/javascript;
+
+  index index.html index.htm;
+  error_page 404 /static/404.html;
+
+  gzip on;
+  gzip_types text/plain text/css application/javascript application/json image/x-icon application/octet-stream application/wasm;
+  gzip_vary on;
+  gzip_proxied no-cache no-store private expired auth;
+  gzip_min_length 512;
+
+  include /etc/jitsi/meet/jaas/*.conf;
+
+  location = /config.js {
+      alias $config_js_location;
+  }
+  
+  location = /interface_config.js {
+      alias $interface_config_js_location;
+  }
+
+  location = /external_api.js {
+      alias /usr/share/jitsi-meet/libs/external_api.min.js;
+  }
+  
+  location = /static/welcomePageAdditionalContent.html {
+      alias $welcome_page_additional_content_location;
+  }
+
+  location = /_api/room-info {
+      proxy_pass http://prosody/room-info?prefix=$prefix&$args;
+      proxy_http_version 1.1;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header Host $http_host;
+  }
+
+  location ~ ^/_api/public/(.*)$ {
+      autoindex off;
+      alias /etc/jitsi/meet/public/$1;
+  }
+
+  # ensure all static content can always be found first
+  location ~ ^/(libs|css|static|images|fonts|lang|sounds|.well-known)/(.*)$
+  {
+      add_header 'Access-Control-Allow-Origin' '*';
+      alias /usr/share/jitsi-meet/$1/$2;
+
+      # cache all versioned files
+      if ($arg_v) {
+          expires 1y;
+      }
+  }
+
+  # BOSH
+  location = /http-bind {
+      proxy_pass http://$prosody_node/http-bind?prefix=$prefix&$args;
+      proxy_http_version 1.1;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header Host $http_host;
+      proxy_set_header Connection "";
+  }
+
+  # xmpp websockets
+  location = /xmpp-websocket {
+      proxy_pass http://$prosody_node/xmpp-websocket?prefix=$prefix&$args;
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+      proxy_set_header Host $http_host;
+      tcp_nodelay on;
+  }
+
+  # colibri (JVB) websockets for jvb1
+  location ~ ^/colibri-ws/([a-zA-Z0-9-\._]+)/(.*) {
+      proxy_pass http://jvb1/colibri-ws/default-id/$2$is_args$args;
+      proxy_http_version 1.1;
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+      tcp_nodelay on;
+  }
+
+  # load test minimal client, uncomment when used
+  #location ~ ^/_load-test/([^/?&:'"]+)$ {
+  #    rewrite ^/_load-test/(.*)$ /load-test/index.html break;
+  #}
+  #location ~ ^/_load-test/libs/(.*)$ {
+  #    add_header 'Access-Control-Allow-Origin' '*';
+  #    alias /usr/share/jitsi-meet/load-test/libs/$1;
+  #}
+
+  location ~ ^/([^/?&:'"]+)$ {
+      set $roomname "$1";
+      try_files $uri @root_path;
+  }
+
+  location @root_path {
+      rewrite ^/(.*)$ /$custom_index break;
+  }
+
+  location ~ ^/([^/?&:'"]+)/config.js$
+  {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+
+      alias $config_js_location;
+  }
+
+  # Matches /(TENANT)/pwa-worker.js or /(TENANT)/manifest.json to rewrite to / and look for file
+  location ~ ^/([^/?&:'"]+)/(pwa-worker.js|manifest.json)$ {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      rewrite ^/([^/?&:'"]+)/(pwa-worker.js|manifest.json)$ /$2;
+  }
+
+  # BOSH for subdomains
+  location ~ ^/([^/?&:'"]+)/http-bind {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      set $prefix "$1";
+
+      rewrite ^/(.*)$ /http-bind;
+  }
+
+  # websockets for subdomains
+  location ~ ^/([^/?&:'"]+)/xmpp-websocket {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      set $prefix "$1";
+
+      rewrite ^/(.*)$ /xmpp-websocket;
+  }
+
+  location ~ ^/([^/?&:'"]+)/_api/room-info {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      set $prefix "$1";
+
+      rewrite ^/(.*)$ /_api/room-info;
+  }
+
+  # Anything that didn't match above, and isn't a real file, assume it's a room name and redirect to /
+  location ~ ^/([^/?&:'"]+)/(.*)$ {
+      set $subdomain "$1.";
+      set $subdir "$1/";
+      rewrite ^/([^/?&:'"]+)/(.*)$ /$2;
+  }
+}
+
+{% endif %}
-- 
2.39.2


From 7b5417c79aafeee40e6ed71af6deb1794d9d8366 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 25 Jan 2024 14:23:27 -0500
Subject: [PATCH 20/28] CORS for xmpp-websocket in multidomain setup

---
 webapps/jitsimeet/templates/nginx/other.vhost.conf.j2 | 7 ++++---
 webapps/jitsimeet/templates/nginx/vhost.conf.j2       | 1 +
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
index a897b8ab..472f8de0 100644
--- a/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
@@ -105,7 +105,7 @@ server {
       proxy_pass http://prosody/room-info?prefix=$prefix&$args;
       proxy_http_version 1.1;
       proxy_set_header X-Forwarded-For $remote_addr;
-      proxy_set_header Host $http_host;
+      proxy_set_header Host {{ domains | first }};
   }
 
   location ~ ^/_api/public/(.*)$ {
@@ -130,17 +130,18 @@ server {
       proxy_pass http://$prosody_node/http-bind?prefix=$prefix&$args;
       proxy_http_version 1.1;
       proxy_set_header X-Forwarded-For $remote_addr;
-      proxy_set_header Host $http_host;
+      proxy_set_header Host {{ domains | first }};
       proxy_set_header Connection "";
   }
 
   # xmpp websockets
   location = /xmpp-websocket {
+      add_header 'Access-Control-Allow-Origin' '*';
       proxy_pass http://$prosody_node/xmpp-websocket?prefix=$prefix&$args;
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
-      proxy_set_header Host $http_host;
+      proxy_set_header Host {{ domains | first }};
       tcp_nodelay on;
   }
 
diff --git a/webapps/jitsimeet/templates/nginx/vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
index 1b2e6093..af8e79a1 100644
--- a/webapps/jitsimeet/templates/nginx/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
@@ -153,6 +153,7 @@ server {
 
   # xmpp websockets
   location = /xmpp-websocket {
+      add_header 'Access-Control-Allow-Origin' '*';
       proxy_pass http://$prosody_node/xmpp-websocket?prefix=$prefix&$args;
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
-- 
2.39.2


From ef7f31ac92e72d04b3539e287200405a52083146 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 8 Feb 2024 15:17:43 -0500
Subject: [PATCH 21/28] 3rd-party repo management for Deb 12

---
 webapps/jitsimeet/tasks/main.yml | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index f674f73b..d5f2e635 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -11,21 +11,17 @@
     mode: '0644'
     force: true
 
-- name: Add Jitsi Meet apt repository key
-  ansible.builtin.get_url:
-    url: https://download.jitsi.org/jitsi-key.gpg.key
-    dest: /etc/apt/trusted.gpg.d/jitsimeet.asc
-    mode: '0644'
-    force: true
+- name: Add Jitsi Meet apt repository key + dearmor hack
+  shell: curl -sL https://download.jitsi.org/jitsi-key.gpg.key | sh -c 'gpg --dearmor > /etc/apt/trusted.gpg.d/jitsimeet.gpg'
 
 - name: Add Prosody apt repository
   ansible.builtin.apt_repository:
-    repo: "deb http://packages.prosody.im/debian {{ ansible_distribution_release }} main"
+    repo: "deb [signed-by=/etc/apt/trusted.gpg.d/prosody.gpg] https://packages.prosody.im/debian {{ ansible_distribution_release }} main"
     state: present
 
 - name: Add Jitsi Meet apt repository
   ansible.builtin.apt_repository:
-    repo: "deb https://download.jitsi.org stable/"
+    repo: "deb [signed-by=/etc/apt/trusted.gpg.d/jitsimeet.gpg] https://download.jitsi.org stable/"
     state: present
 
 - name: Install system dependencies
-- 
2.39.2


From 788d4d202b68894d709ef847575a6b713ea9548f Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 22 Feb 2024 15:56:52 -0500
Subject: [PATCH 22/28] To enable colibri stats and allow external
 visualisation

---
 .../jitsimeet/templates/nginx/vhost.conf.j2   | 29 +++++++++++++++++++
 .../templates/videobridge/jvb.conf.j2         |  8 +++++
 .../sip-communicator.properties.j2            |  2 +-
 3 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/webapps/jitsimeet/templates/nginx/vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
index af8e79a1..b070d5bd 100644
--- a/webapps/jitsimeet/templates/nginx/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
@@ -238,4 +238,33 @@ server {
   }
 }
 
+## Pour communiquer les stats colibri à un serveur externe Grafana 
+server {
+    listen 8443      ssl http2;
+    listen [::]:8443 ssl http2;
+
+    server_name {{ domains | first }};
+
+    # Mozilla Guideline v5.4, nginx 1.17.7, OpenSSL 1.1.1d, intermediate configuration
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers off;
+
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:10m;  # about 40000 sessions
+    ssl_session_tickets off;
+
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    ssl_certificate     /etc/letsencrypt/live/{{ domains | first }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ domains | first }}/privkey.pem;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
 {% endif %}
diff --git a/webapps/jitsimeet/templates/videobridge/jvb.conf.j2 b/webapps/jitsimeet/templates/videobridge/jvb.conf.j2
index 483f765a..4a64ec9a 100644
--- a/webapps/jitsimeet/templates/videobridge/jvb.conf.j2
+++ b/webapps/jitsimeet/templates/videobridge/jvb.conf.j2
@@ -3,10 +3,18 @@ videobridge {
         public {
             port = 9090
         }
+        private {
+            port = 8080
+        }
     }
     websockets {
         enabled = true
         domain = "{{ domains | first }}:443"
         tls = true
     }
+    apis {
+        rest {
+            enabled = true
+        }
+    }
 }
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
index 4b52cafd..f8fe663e 100644
--- a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -1,7 +1,7 @@
 org.ice4j.ice.harvest.DISABLE_AWS_HARVESTER=true
 org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES={{ turn_domains | first }}:3478
 org.jitsi.videobridge.ENABLE_STATISTICS=true
-org.jitsi.videobridge.STATISTICS_TRANSPORT=muc
+org.jitsi.videobridge.STATISTICS_TRANSPORT=muc,colibri
 org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
 org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.{{ domains | first }}
 org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
-- 
2.39.2


From f333daf01119d7faf56d3db57fcfbce14ea948d0 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 22 Feb 2024 16:01:13 -0500
Subject: [PATCH 23/28] Make it a variable

---
 webapps/jitsimeet/defaults/main.yml             | 1 +
 webapps/jitsimeet/templates/nginx/vhost.conf.j2 | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index dad86af6..22ed5a87 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -13,3 +13,4 @@ jitsi_meet_ssl_key_path: "/etc/ssl/private/ssl-cert-snakeoil.key"
 jitsi_meet_turn_secret: "YOU_ABSOLUTELY_MUST_CHANGE_ME"
 jitsi_meet_jvb_secret: "NOT_CHANGING_ME_IS_SUPER_UNCOOL"
 jitsi_meet_jvb_muc_nick: "1899aaf3-3991-4770-9c8c-113906dc0a2e"
+colibri_ext_port: '8443'
diff --git a/webapps/jitsimeet/templates/nginx/vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
index b070d5bd..386dd10d 100644
--- a/webapps/jitsimeet/templates/nginx/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
@@ -240,8 +240,8 @@ server {
 
 ## Pour communiquer les stats colibri à un serveur externe Grafana 
 server {
-    listen 8443      ssl http2;
-    listen [::]:8443 ssl http2;
+    listen {{ colibri_ext_port }}      ssl http2;
+    listen [::]:{{ colibri_ext_port }} ssl http2;
 
     server_name {{ domains | first }};
 
-- 
2.39.2


From c2dd03b88f42e17e9c657e92719b6b00e17c1a22 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Wed, 27 Mar 2024 16:55:24 -0400
Subject: [PATCH 24/28] jitsimeet_ prefix for vars + ansible.builtin. prefix
 for modules

---
 webapps/jitsimeet/LISEZMOI.md                 |  2 +-
 webapps/jitsimeet/README.md                   |  2 +-
 webapps/jitsimeet/defaults/main.yml           | 22 ++---
 webapps/jitsimeet/tasks/main.yml              | 83 +++++++++---------
 webapps/jitsimeet/tasks/other_domains.yml     | 24 +++---
 .../certbot/coturn-certbot-deploy.sh.j2       |  2 +-
 .../templates/coturn/turnserver.conf.j2       |  8 +-
 webapps/jitsimeet/templates/meet/config.js.j2 | 22 ++---
 .../templates/meet/interface_config.js.j2     |  2 +-
 .../templates/nginx/multiplex.conf.j2         |  4 +-
 .../templates/nginx/other.vhost.conf.j2       |  6 +-
 .../jitsimeet/templates/nginx/vhost.conf.j2   | 22 ++---
 .../templates/prosody/virtualhost.cfg.lua.j2  | 86 +++++++++----------
 .../templates/videobridge/jvb.conf.j2         |  2 +-
 .../sip-communicator.properties.j2            | 10 +--
 15 files changed, 151 insertions(+), 146 deletions(-)

diff --git a/webapps/jitsimeet/LISEZMOI.md b/webapps/jitsimeet/LISEZMOI.md
index 29594f79..113a88e7 100644
--- a/webapps/jitsimeet/LISEZMOI.md
+++ b/webapps/jitsimeet/LISEZMOI.md
@@ -29,7 +29,7 @@ Exemple de playbook
     - all
   vars:
     # Supplanter ici les variables du rôle
-    domains: ['votre-vrai-domaine.org']
+    jitsimeet_domains: ['votre-vrai-domaine.org']
     service: 'mon-jitsimeet'
 
   roles:
diff --git a/webapps/jitsimeet/README.md b/webapps/jitsimeet/README.md
index a1f1463a..b3e48031 100644
--- a/webapps/jitsimeet/README.md
+++ b/webapps/jitsimeet/README.md
@@ -29,7 +29,7 @@ Example Playbook
     - all
   vars:
     # Overwrite the role variables here
-    domains: ['your-real-domain.org']
+    jitsimeet_domains: ['your-real-domain.org']
     service: 'my-jitsimeet'
 
   roles:
diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index 22ed5a87..985298b4 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -1,16 +1,16 @@
 ---
 # defaults file for main vars
 
-system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2', 'lua-unbound', 'certbot', 'python3-certbot-nginx']"
+jitsimeet_system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2', 'lua-unbound', 'certbot', 'python3-certbot-nginx']"
 
-domains: ['jitsi.example.net']
-turn_domains: ['turn.jitsi.example.net']
-certbot_admin_email: 'security@example.net'
+jitsimeet_domains: ['jitsi.example.net']
+jitsimeet_turn_domains: ['turn.jitsi.example.net']
+jitsimeet_certbot_admin_email: 'security@example.net'
 
-jitsi_meet_cert_choice: "Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)"
-jitsi_meet_ssl_cert_path: "/etc/ssl/certs/ssl-cert-snakeoil.pem"
-jitsi_meet_ssl_key_path: "/etc/ssl/private/ssl-cert-snakeoil.key"
-jitsi_meet_turn_secret: "YOU_ABSOLUTELY_MUST_CHANGE_ME"
-jitsi_meet_jvb_secret: "NOT_CHANGING_ME_IS_SUPER_UNCOOL"
-jitsi_meet_jvb_muc_nick: "1899aaf3-3991-4770-9c8c-113906dc0a2e"
-colibri_ext_port: '8443'
+jitsimeet_cert_choice: "Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)"
+jitsimeet_ssl_cert_path: "/etc/ssl/certs/ssl-cert-snakeoil.pem"
+jitsimeet_ssl_key_path: "/etc/ssl/private/ssl-cert-snakeoil.key"
+jitsimeet_turn_secret: "YOU_ABSOLUTELY_MUST_CHANGE_ME"
+jitsimeet_jvb_secret: "NOT_CHANGING_ME_IS_SUPER_UNCOOL"
+jitsimeet_jvb_muc_nick: "1899aaf3-3991-4770-9c8c-113906dc0a2e"
+jitsimeet_colibri_ext_port: '8443'
diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index d5f2e635..50f1f223 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -1,8 +1,8 @@
 ---
 # tasks file for jitsimeet install
 
-- name: Set FQDN
-  command: "hostnamectl set-hostname {{ domains | first }}"
+#- name: Set FQDN
+#  ansible.builtin.command: "hostnamectl set-hostname {{ jitsimeet_domains | first }}"
 
 - name: Add Prosody apt repository key
   ansible.builtin.get_url:
@@ -12,7 +12,12 @@
     force: true
 
 - name: Add Jitsi Meet apt repository key + dearmor hack
-  shell: curl -sL https://download.jitsi.org/jitsi-key.gpg.key | sh -c 'gpg --dearmor > /etc/apt/trusted.gpg.d/jitsimeet.gpg'
+  ansible.builtin.shell: curl -sL https://download.jitsi.org/jitsi-key.gpg.key | sh -c 'gpg --dearmor > /etc/apt/trusted.gpg.d/jitsimeet.gpg'
+
+- name: Adjust permissions of gpg key
+  ansible.builtin.file:
+    path: /etc/apt/trusted.gpg.d/jitsimeet.gpg
+    mode: '0644'
 
 - name: Add Prosody apt repository
   ansible.builtin.apt_repository:
@@ -26,7 +31,7 @@
 
 - name: Install system dependencies
   ansible.builtin.apt:
-    name: "{{ system_dep }}"
+    name: "{{ jitsimeet_system_dep }}"
     state: present
     update_cache: true
 
@@ -39,23 +44,23 @@
   loop:
     - name: jitsi-videobridge2
       question: jitsi-videobridge/jvb-hostname
-      value: "{{ domains | first }}"
+      value: "{{ jitsimeet_domains | first }}"
       vtype: string
     - name: jitsi-meet-web-config
       question: jitsi-meet/cert-choice
-      value: "{{ jitsi_meet_cert_choice }}"
+      value: "{{ jitsimeet_cert_choice }}"
       vtype: string
     - name: jitsi-meet-web-config
       question: jitsi-meet/cert-path-crt
-      value: "{{ jitsi_meet_ssl_cert_path }}"
+      value: "{{ jitsimeet_ssl_cert_path }}"
       vtype: string
     - name: jitsi-meet-web-config
       question: jitsi-meet/cert-path-key
-      value: "{{ jitsi_meet_ssl_key_path }}"
+      value: "{{ jitsimeet_ssl_key_path }}"
       vtype: string
     - name: jitsi-meet-prosody
       question: jitsi-meet-prosody/turn-secret
-      value: "{{ jitsi_meet_turn_secret }}"
+      value: "{{ jitsimeet_turn_secret }}"
       vtype: string
 
 - name: Install Jitsi Meet
@@ -70,7 +75,7 @@
     state: present
 
 - name: Add certs dir for coturn/letsencrypt if needed
-  file:
+  ansible.builtin.file:
     path: "{{ item.path }}"
     state: directory
     mode: "{{ item.mode }}"
@@ -83,7 +88,7 @@
     - { path: '/etc/letsencrypt/renewal-hooks/deploy', owner: "root", group: "root", mode: "0700" }
 
 - name: Template config files
-  template:
+  ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
     owner: "{{ item.owner }}"
@@ -92,10 +97,10 @@
   loop:
     - { src: 'videobridge/jvb.conf.j2', dest: "/etc/jitsi/videobridge/jvb.conf", owner: "jvb", group: "jitsi", mode: "0640" }
     - { src: 'videobridge/sip-communicator.properties.j2', dest: "/etc/jitsi/videobridge/sip-communicator.properties", owner: "jvb", group: "jitsi", mode: "0640" }
-    - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
-    - { src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ domains | first }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
+    - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ jitsimeet_domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
+    - { src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ jitsimeet_domains | first }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
     - { src: 'meet/welcomePageAdditionalContent.html.j2', dest: "/etc/jitsi/meet/welcomePageAdditionalContent.html", owner: "root", group: "root", mode: "0644" }
-    - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
+    - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ jitsimeet_domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
     - { src: 'coturn/turnserver.conf.j2', dest: "/etc/turnserver.conf", owner: "root", group: "turnserver", mode: "0640" }
     - { src: 'certbot/coturn-certbot-deploy.sh.j2', dest: "/etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh", owner: "root", group: "root", mode: "0700" }
 
@@ -110,10 +115,10 @@
         }
 
 - name: Unregister default jvb account in prosody
-  ansible.builtin.command: prosodyctl unregister jvb auth.{{ domains | first }}
+  ansible.builtin.command: prosodyctl unregister jvb auth.{{ jitsimeet_domains | first }}
 
 - name: Register jvb account in prosody (with proper secret)
-  ansible.builtin.command: prosodyctl register jvb auth.{{ domains | first }} {{ jitsi_meet_jvb_secret }}
+  ansible.builtin.command: prosodyctl register jvb auth.{{ jitsimeet_domains | first }} {{ jitsimeet_jvb_secret }}
 
 - name: Restart prosody
   ansible.builtin.service:
@@ -131,75 +136,75 @@
     state: restarted
 
 - name: Check if SSL certificate is present and register result
-  stat:
-    path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
+  ansible.builtin.stat:
+    path: "/etc/letsencrypt/live/{{ jitsimeet_domains |first }}/fullchain.pem"
   register: ssl
 
 - name: Generate certificate only if required (first time)
   block:
   - name: Template vhost without SSL for successfull LE challengce
-    template: 
+    ansible.builtin.template: 
       src: "nginx/vhost.conf.j2"
-      dest: "/etc/nginx/sites-available/{{ domains |first }}.conf"
+      dest: "/etc/nginx/sites-available/{{ jitsimeet_domains |first }}.conf"
   - name: Enable temporary nginx vhost
-    file:
-      src: "/etc/nginx/sites-available/{{ domains |first }}.conf"
-      dest: "/etc/nginx/sites-enabled/{{ domains |first }}.conf"
+    ansible.builtin.file:
+      src: "/etc/nginx/sites-available/{{ jitsimeet_domains |first }}.conf"
+      dest: "/etc/nginx/sites-enabled/{{ jitsimeet_domains |first }}.conf"
       state: link
   - name: Reload nginx conf
-    service:
+    ansible.builtin.service:
       name: nginx
       state: reloaded
   - name: Make sure /var/lib/letsencrypt exists and has correct permissions
-    file: 
+    ansible.builtin.file: 
       path: /var/lib/letsencrypt
       state: directory
       mode: '0755'
   - name: Generate certificate with certbot
-    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domains |first }}
+    ansible.builtin.shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ jitsimeet_domains |first }}
   when: ssl.stat.exists != true
 
 - name: (Re)check if SSL certificate is present and register result
-  stat:
-    path: "/etc/letsencrypt/live/{{ domains |first }}/fullchain.pem"
+  ansible.builtin.stat:
+    path: "/etc/letsencrypt/live/{{ jitsimeet_domains |first }}/fullchain.pem"
   register: ssl
 
 - name: (Re)template conf file for nginx vhost with SSL
-  template:
+  ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
   loop:
-    - { src: 'nginx/vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ domains |first }}.conf" }
+    - { src: 'nginx/vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ jitsimeet_domains |first }}.conf" }
     - { src: 'nginx/multiplex.conf.j2', dest: '/etc/nginx/modules-available/multiplex.conf' }
 
 - name: Enable multiplex module conf
-  file:
+  ansible.builtin.file:
     src: '/etc/nginx/modules-available/multiplex.conf'
     dest: '/etc/nginx/modules-enabled/multiplex.conf'
     state: link
 
 - name: Enable nginx vhost
-  file:
-    src: "/etc/nginx/sites-available/{{ domains |first }}.conf"
-    dest: "/etc/nginx/sites-enabled/{{ domains |first }}.conf"
+  ansible.builtin.file:
+    src: "/etc/nginx/sites-available/{{ jitsimeet_domains |first }}.conf"
+    dest: "/etc/nginx/sites-enabled/{{ jitsimeet_domains |first }}.conf"
     state: link
 
 - name: Reload nginx conf
-  service:
+  ansible.builtin.service:
     name: nginx
     state: reloaded
 
 - name: Check if SSL certificate for coturn is present and register result
-  stat:
-    path: "/etc/coturn/certs/{{ turn_domains |first }}.crt"
+  ansible.builtin.stat:
+    path: "/etc/coturn/certs/{{ jitsimeet_turn_domains |first }}.crt"
   register: ssl_coturn
 
 - name: Generate certificate for coturn with certbot
-  shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh --agree-tos --email {{ certbot_admin_email }} -d {{ turn_domains |first }}
+  ansible.builtin.shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ jitsimeet_turn_domains |first }}
   when: ssl_coturn.stat.exists != true 
 
 - name: Setup other domains if any
   include_tasks: other_domains.yml
-  loop: "{{ domains[1:] }}"
+  loop: "{{ jitsimeet_domains[1:] }}"
   loop_control:
     loop_var: domain
diff --git a/webapps/jitsimeet/tasks/other_domains.yml b/webapps/jitsimeet/tasks/other_domains.yml
index b2dfcf69..04175831 100644
--- a/webapps/jitsimeet/tasks/other_domains.yml
+++ b/webapps/jitsimeet/tasks/other_domains.yml
@@ -2,7 +2,7 @@
 # tasks file for other domains if any
 
 - name: Template config files
-  template:
+  ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
     owner: "{{ item.owner }}"
@@ -13,59 +13,59 @@
     - { src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ domain }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
 
 - name: Check if SSL certificate is present and register result
-  stat:
+  ansible.builtin.stat:
     path: "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
   register: ssl
 
 - name: Generate certificate only if required (first time)
   block:
   - name: Template vhost without SSL for successfull LE challengce
-    template: 
+    ansible.builtin.template: 
       src: "nginx/other.vhost.conf.j2"
       dest: "/etc/nginx/sites-available/{{ domain }}.conf"
   - name: Enable temporary nginx vhost
-    file:
+    ansible.builtin.file:
       src: "/etc/nginx/sites-available/{{ domain }}.conf"
       dest: "/etc/nginx/sites-enabled/{{ domain }}.conf"
       state: link
   - name: Reload nginx conf
-    service:
+    ansible.builtin.service:
       name: nginx
       state: reloaded
   - name: Make sure /var/lib/letsencrypt exists and has correct permissions
-    file: 
+    ansible.builtin.file: 
       path: /var/lib/letsencrypt
       state: directory
       mode: '0755'
   - name: Generate certificate with certbot
-    shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ certbot_admin_email }} -d {{ domain }}
+    ansible.builtin.shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ domain }}
   when: ssl.stat.exists != true
 
 - name: (Re)check if SSL certificate is present and register result
-  stat:
+  ansible.builtin.stat:
     path: "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
   register: ssl
 
 - name: (Re)template conf file for nginx vhost with SSL
-  template:
+  ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
   loop:
     - { src: 'nginx/other.vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ domain }}.conf" }
 
 - name: Insert block in multiplex.conf
-  lineinfile:
+  ansible.builtin.lineinfile:
     path: /etc/nginx/modules-enabled/multiplex.conf
     insertafter: "web_backend;"
     line: "{{ domain }} web_backend;"
 
 - name: Enable nginx vhost
-  file:
+  ansible.builtin.file:
     src: "/etc/nginx/sites-available/{{ domain }}.conf"
     dest: "/etc/nginx/sites-enabled/{{ domain }}.conf"
     state: link
 
 - name: Reload nginx conf
-  service:
+  ansible.builtin.service:
     name: nginx
     state: reloaded
diff --git a/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2 b/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
index 9e34af55..1985490f 100644
--- a/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
+++ b/webapps/jitsimeet/templates/certbot/coturn-certbot-deploy.sh.j2
@@ -6,7 +6,7 @@ set -e
 
 for domain in $RENEWED_DOMAINS; do
         case $domain in
-        {{ turn_domains | first }})
+        {{ jitsimeet_turn_domains | first }})
                 daemon_cert_root=/etc/coturn/certs
 
                 # Make sure the certificate and private key files are
diff --git a/webapps/jitsimeet/templates/coturn/turnserver.conf.j2 b/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
index 67ee20a3..574635aa 100644
--- a/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
+++ b/webapps/jitsimeet/templates/coturn/turnserver.conf.j2
@@ -1,10 +1,10 @@
 # jitsi-meet coturn config. Do not modify this line
 use-auth-secret
 keep-address-family
-static-auth-secret={{ jitsi_meet_turn_secret }}
-realm={{ turn_domains | first }}
-cert=/etc/coturn/certs/{{ turn_domains | first }}.crt
-pkey=/etc/coturn/certs/{{ turn_domains | first }}.key
+static-auth-secret={{ jitsimeet_turn_secret }}
+realm={{ jitsimeet_turn_domains | first }}
+cert=/etc/coturn/certs/{{ jitsimeet_turn_domains | first }}.crt
+pkey=/etc/coturn/certs/{{ jitsimeet_turn_domains | first }}.key
 no-multicast-peers
 no-cli
 #no-loopback-peers
diff --git a/webapps/jitsimeet/templates/meet/config.js.j2 b/webapps/jitsimeet/templates/meet/config.js.j2
index 5000be95..9e50c6bd 100644
--- a/webapps/jitsimeet/templates/meet/config.js.j2
+++ b/webapps/jitsimeet/templates/meet/config.js.j2
@@ -30,31 +30,31 @@ var config = {
 
     hosts: {
         // XMPP domain.
-        domain: '{{ domains | first }}',
+        domain: '{{ jitsimeet_domains | first }}',
 
         // When using authentication, domain for guest users.
         // anonymousdomain: 'guest.example.com',
 
         // Domain for authenticated users. Defaults to <domain>.
-        // authdomain: '{{ domains | first }}',
+        // authdomain: '{{ jitsimeet_domains | first }}',
 
         // Focus component domain. Defaults to focus.<domain>.
-        // focus: 'focus.{{ domains | first }}',
+        // focus: 'focus.{{ jitsimeet_domains | first }}',
 
         // XMPP MUC domain. FIXME: use XEP-0030 to discover it.
-        muc: 'conference.' + subdomain + '{{ domains | first }}',
+        muc: 'conference.' + subdomain + '{{ jitsimeet_domains | first }}',
     },
 
     // BOSH URL. FIXME: use XEP-0156 to discover it.
-    bosh: 'https://{{ domains | first }}/' + subdir + 'http-bind',
+    bosh: 'https://{{ jitsimeet_domains | first }}/' + subdir + 'http-bind',
 
     // Websocket URL (XMPP)
-    websocket: 'wss://{{ domains | first }}/' + subdir + 'xmpp-websocket',
+    websocket: 'wss://{{ jitsimeet_domains | first }}/' + subdir + 'xmpp-websocket',
 
     // The real JID of focus participant - can be overridden here
     // Do not change username - FIXME: Make focus username configurable
     // https://github.com/jitsi/jitsi-meet/issues/7376
-    // focusUserJid: 'focus@auth.{{ domains | first }}',
+    // focusUserJid: 'focus@auth.{{ jitsimeet_domains | first }}',
 
     // Options related to the bridge (colibri) data channel
     bridgeChannel: {
@@ -302,9 +302,9 @@ var config = {
     //     appKey: '<APP_KEY>', // Specify your app key here.
     //     // A URL to redirect the user to, after authenticating
     //     // by default uses:
-    //     // 'https://{{ domains | first }}/static/oauth.html'
+    //     // 'https://{{ jitsimeet_domains | first }}/static/oauth.html'
     //     redirectURI:
-    //          'https://{{ domains | first }}/subfolder/static/oauth.html',
+    //          'https://{{ jitsimeet_domains | first }}/subfolder/static/oauth.html',
     // },
 
     // recordingService: {
@@ -947,7 +947,7 @@ var config = {
         // The STUN servers that will be used in the peer to peer connections
         stunServers: [
 
-             { urls: 'stun:{{ turn_domains | first }}:3478' },
+             { urls: 'stun:{{ jitsimeet_turn_domains | first }}:3478' },
             //{ urls: 'stun:meet-jit-si-turnrelay.jitsi.net:443' },
         ],
     },
@@ -1301,7 +1301,7 @@ var config = {
     // The URL of the moderated rooms microservice, if available. If it
     // is present, a link to the service will be rendered on the welcome page,
     // otherwise the app doesn't render it.
-    // moderatedRoomServiceUrl: 'https://moderated.{{ domains | first }}',
+    // moderatedRoomServiceUrl: 'https://moderated.{{ jitsimeet_domains | first }}',
 
     // If true, tile view will not be enabled automatically when the participants count threshold is reached.
     // disableTileView: true,
diff --git a/webapps/jitsimeet/templates/meet/interface_config.js.j2 b/webapps/jitsimeet/templates/meet/interface_config.js.j2
index 0b8d546e..142661ed 100644
--- a/webapps/jitsimeet/templates/meet/interface_config.js.j2
+++ b/webapps/jitsimeet/templates/meet/interface_config.js.j2
@@ -63,7 +63,7 @@ var interfaceConfig = {
      */
     DISABLE_VIDEO_BACKGROUND: false,
 
-    DISPLAY_WELCOME_FOOTER: {{ welcome_footer }},
+    DISPLAY_WELCOME_FOOTER: {{ jitsimeet_welcome_footer }},
     DISPLAY_WELCOME_PAGE_ADDITIONAL_CARD: false,
     DISPLAY_WELCOME_PAGE_CONTENT: true,
     DISPLAY_WELCOME_PAGE_TOOLBAR_ADDITIONAL_CONTENT: false,
diff --git a/webapps/jitsimeet/templates/nginx/multiplex.conf.j2 b/webapps/jitsimeet/templates/nginx/multiplex.conf.j2
index 8a279fb9..3358fc41 100644
--- a/webapps/jitsimeet/templates/nginx/multiplex.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/multiplex.conf.j2
@@ -1,7 +1,7 @@
 stream {
     map $ssl_preread_server_name $name {
-        {{ domains | first }} web_backend;
-        {{ turn_domains | first }} turn_backend;
+        {{ jitsimeet_domains | first }} web_backend;
+        {{ jitsimeet_turn_domains | first }} turn_backend;
     }
 
     upstream web_backend {
diff --git a/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
index 472f8de0..5e0b4858 100644
--- a/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
@@ -105,7 +105,7 @@ server {
       proxy_pass http://prosody/room-info?prefix=$prefix&$args;
       proxy_http_version 1.1;
       proxy_set_header X-Forwarded-For $remote_addr;
-      proxy_set_header Host {{ domains | first }};
+      proxy_set_header Host {{ jitsimeet_domains | first }};
   }
 
   location ~ ^/_api/public/(.*)$ {
@@ -130,7 +130,7 @@ server {
       proxy_pass http://$prosody_node/http-bind?prefix=$prefix&$args;
       proxy_http_version 1.1;
       proxy_set_header X-Forwarded-For $remote_addr;
-      proxy_set_header Host {{ domains | first }};
+      proxy_set_header Host {{ jitsimeet_domains | first }};
       proxy_set_header Connection "";
   }
 
@@ -141,7 +141,7 @@ server {
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";
-      proxy_set_header Host {{ domains | first }};
+      proxy_set_header Host {{ jitsimeet_domains | first }};
       tcp_nodelay on;
   }
 
diff --git a/webapps/jitsimeet/templates/nginx/vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
index 386dd10d..aa1db962 100644
--- a/webapps/jitsimeet/templates/nginx/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
@@ -33,7 +33,7 @@ map $arg_vnode $prosody_node {
 server {
   listen 80;
   listen [::]:80;
-  server_name {{ domains | first }} {{ turn_domains | first }};
+  server_name {{ jitsimeet_domains | first }} {{ jitsimeet_turn_domains | first }};
 
   # For certbot
   location ~ /.well-known/acme-challenge {
@@ -50,7 +50,7 @@ server {
 server {
   listen 8088 ssl http2;
   listen [::]:8088 ssl http2;
-  server_name {{ domains | first }};
+  server_name {{ jitsimeet_domains | first }};
   
   access_log /var/log/nginx/{{ service }}.access.log; # reduce I/0 with buffer=10m flush=5m
   error_log  /var/log/nginx/{{ service }}.error.log;
@@ -74,16 +74,16 @@ server {
   add_header Strict-Transport-Security "max-age=63072000" always;
   set $prefix "";
   set $custom_index "";
-  set $config_js_location /etc/jitsi/meet/{{ domains | first }}-config.js;
-  set $interface_config_js_location /etc/jitsi/meet/{{ domains | first }}-interface_config.js;
+  set $config_js_location /etc/jitsi/meet/{{ jitsimeet_domains | first }}-config.js;
+  set $interface_config_js_location /etc/jitsi/meet/{{ jitsimeet_domains | first }}-interface_config.js;
   set $welcome_page_additional_content_location /etc/jitsi/meet/welcomePageAdditionalContent.html;
 
   ##
   # Certificates
   # you need a certificate to run in production. see https://letsencrypt.org/
   ##
-  ssl_certificate     /etc/letsencrypt/live/{{ domains | first }}/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/{{ domains | first }}/privkey.pem;
+  ssl_certificate     /etc/letsencrypt/live/{{ jitsimeet_domains | first }}/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/{{ jitsimeet_domains | first }}/privkey.pem;
 
   root /usr/share/jitsi-meet;
 
@@ -240,10 +240,10 @@ server {
 
 ## Pour communiquer les stats colibri à un serveur externe Grafana 
 server {
-    listen {{ colibri_ext_port }}      ssl http2;
-    listen [::]:{{ colibri_ext_port }} ssl http2;
+    listen {{ jitsimeet_colibri_ext_port }}      ssl http2;
+    listen [::]:{{ jitsimeet_colibri_ext_port }} ssl http2;
 
-    server_name {{ domains | first }};
+    server_name {{ jitsimeet_domains | first }};
 
     # Mozilla Guideline v5.4, nginx 1.17.7, OpenSSL 1.1.1d, intermediate configuration
     ssl_protocols TLSv1.2 TLSv1.3;
@@ -256,8 +256,8 @@ server {
 
     add_header Strict-Transport-Security "max-age=63072000" always;
 
-    ssl_certificate     /etc/letsencrypt/live/{{ domains | first }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ domains | first }}/privkey.pem;
+    ssl_certificate     /etc/letsencrypt/live/{{ jitsimeet_domains | first }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ jitsimeet_domains | first }}/privkey.pem;
 
     location / {
         proxy_pass http://127.0.0.1:8080;
diff --git a/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2 b/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
index cef3eaae..bba56bd0 100644
--- a/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
+++ b/webapps/jitsimeet/templates/prosody/virtualhost.cfg.lua.j2
@@ -1,13 +1,13 @@
 plugin_paths = { "/usr/share/jitsi-meet/prosody-plugins/" }
 
 -- domain mapper options, must at least have domain base set to use the mapper
-muc_mapper_domain_base = "{{ domains | first }}";
+muc_mapper_domain_base = "{{ jitsimeet_domains | first }}";
 
-external_service_secret = "{{ jitsi_meet_turn_secret }}";
+external_service_secret = "{{ jitsimeet_turn_secret }}";
 external_services = {
-     { type = "stun", host = "{{ turn_domains | first }}", port = 3478 },
-     { type = "turn", host = "{{ turn_domains | first }}", port = 3478, transport = "udp", secret = true, ttl = 86400, algorithm = "turn" },
-     { type = "turns", host = "{{ turn_domains | first }}", port = 443, transport = "tcp", secret = true, ttl = 86400, algorithm = "turn" }
+     { type = "stun", host = "{{ jitsimeet_turn_domains | first }}", port = 3478 },
+     { type = "turn", host = "{{ jitsimeet_turn_domains | first }}", port = 3478, transport = "udp", secret = true, ttl = 86400, algorithm = "turn" },
+     { type = "turns", host = "{{ jitsimeet_turn_domains | first }}", port = 443, transport = "tcp", secret = true, ttl = 86400, algorithm = "turn" }
 };
 
 cross_domain_bosh = false;
@@ -33,11 +33,11 @@ ssl = {
 }
 
 unlimited_jids = {
-    "focus@auth.{{ domains | first }}",
-    "jvb@auth.{{ domains | first }}"
+    "focus@auth.{{ jitsimeet_domains | first }}",
+    "jvb@auth.{{ jitsimeet_domains | first }}"
 }
 
-VirtualHost "{{ domains | first }}"
+VirtualHost "{{ jitsimeet_domains | first }}"
     authentication = "jitsi-anonymous" -- do not delete me
     -- Properties below are modified by jitsi-meet-tokens package config
     -- and authentication above is switched to "token"
@@ -48,13 +48,13 @@ VirtualHost "{{ domains | first }}"
     -- Note that old-style SSL on port 5223 only supports one certificate, and will always
     -- use the global one.
     ssl = {
-        key = "/etc/prosody/certs/{{ domains | first }}.key";
-        certificate = "/etc/prosody/certs/{{ domains | first }}.crt";
+        key = "/etc/prosody/certs/{{ jitsimeet_domains | first }}.key";
+        certificate = "/etc/prosody/certs/{{ jitsimeet_domains | first }}.crt";
     }
-    av_moderation_component = "avmoderation.{{ domains | first }}"
-    speakerstats_component = "speakerstats.{{ domains | first }}"
-    conference_duration_component = "conferenceduration.{{ domains | first }}"
-    end_conference_component = "endconference.{{ domains | first }}"
+    av_moderation_component = "avmoderation.{{ jitsimeet_domains | first }}"
+    speakerstats_component = "speakerstats.{{ jitsimeet_domains | first }}"
+    conference_duration_component = "conferenceduration.{{ jitsimeet_domains | first }}"
+    end_conference_component = "endconference.{{ jitsimeet_domains | first }}"
     -- we need bosh
     modules_enabled = {
         "bosh";
@@ -72,13 +72,13 @@ VirtualHost "{{ domains | first }}"
         "room_metadata";
     }
     c2s_require_encryption = false
-    lobby_muc = "lobby.{{ domains | first }}"
-    breakout_rooms_muc = "breakout.{{ domains | first }}"
-    room_metadata_component = "metadata.{{ domains | first }}"
-    main_muc = "conference.{{ domains | first }}"
-    -- muc_lobby_whitelist = { "recorder.{{ domains | first }}" } -- Here we can whitelist jibri to enter lobby enabled rooms
+    lobby_muc = "lobby.{{ jitsimeet_domains | first }}"
+    breakout_rooms_muc = "breakout.{{ jitsimeet_domains | first }}"
+    room_metadata_component = "metadata.{{ jitsimeet_domains | first }}"
+    main_muc = "conference.{{ jitsimeet_domains | first }}"
+    -- muc_lobby_whitelist = { "recorder.{{ jitsimeet_domains | first }}" } -- Here we can whitelist jibri to enter lobby enabled rooms
 
-Component "conference.{{ domains | first }}" "muc"
+Component "conference.{{ jitsimeet_domains | first }}" "muc"
     restrict_room_creation = true
     storage = "memory"
     modules_enabled = {
@@ -90,14 +90,14 @@ Component "conference.{{ domains | first }}" "muc"
         "muc_rate_limit";
         "muc_password_whitelist";
     }
-    admins = { "focus@auth.{{ domains | first }}" }
+    admins = { "focus@auth.{{ jitsimeet_domains | first }}" }
     muc_password_whitelist = {
-        "focus@auth.{{ domains | first }}"
+        "focus@auth.{{ jitsimeet_domains | first }}"
     }
     muc_room_locking = false
     muc_room_default_public_jids = true
 
-Component "breakout.{{ domains | first }}" "muc"
+Component "breakout.{{ jitsimeet_domains | first }}" "muc"
     restrict_room_creation = true
     storage = "memory"
     modules_enabled = {
@@ -107,25 +107,25 @@ Component "breakout.{{ domains | first }}" "muc"
         "muc_rate_limit";
         "polls";
     }
-    admins = { "focus@auth.{{ domains | first }}" }
+    admins = { "focus@auth.{{ jitsimeet_domains | first }}" }
     muc_room_locking = false
     muc_room_default_public_jids = true
 
 -- internal muc component
-Component "internal.auth.{{ domains | first }}" "muc"
+Component "internal.auth.{{ jitsimeet_domains | first }}" "muc"
     storage = "memory"
     modules_enabled = {
         "muc_hide_all";
         "ping";
     }
-    admins = { "focus@auth.{{ domains | first }}", "jvb@auth.{{ domains | first }}" }
+    admins = { "focus@auth.{{ jitsimeet_domains | first }}", "jvb@auth.{{ jitsimeet_domains | first }}" }
     muc_room_locking = false
     muc_room_default_public_jids = true
 
-VirtualHost "auth.{{ domains | first }}"
+VirtualHost "auth.{{ jitsimeet_domains | first }}"
     ssl = {
-        key = "/etc/prosody/certs/auth.{{ domains | first }}.key";
-        certificate = "/etc/prosody/certs/auth.{{ domains | first }}.crt";
+        key = "/etc/prosody/certs/auth.{{ jitsimeet_domains | first }}.key";
+        certificate = "/etc/prosody/certs/auth.{{ jitsimeet_domains | first }}.crt";
     }
     modules_enabled = {
         "limits_exception";
@@ -133,22 +133,22 @@ VirtualHost "auth.{{ domains | first }}"
     authentication = "internal_hashed"
 
 -- Proxy to jicofo's user JID, so that it doesn't have to register as a component.
-Component "focus.{{ domains | first }}" "client_proxy"
-    target_address = "focus@auth.{{ domains | first }}"
+Component "focus.{{ jitsimeet_domains | first }}" "client_proxy"
+    target_address = "focus@auth.{{ jitsimeet_domains | first }}"
 
-Component "speakerstats.{{ domains | first }}" "speakerstats_component"
-    muc_component = "conference.{{ domains | first }}"
+Component "speakerstats.{{ jitsimeet_domains | first }}" "speakerstats_component"
+    muc_component = "conference.{{ jitsimeet_domains | first }}"
 
-Component "conferenceduration.{{ domains | first }}" "conference_duration_component"
-    muc_component = "conference.{{ domains | first }}"
+Component "conferenceduration.{{ jitsimeet_domains | first }}" "conference_duration_component"
+    muc_component = "conference.{{ jitsimeet_domains | first }}"
 
-Component "endconference.{{ domains | first }}" "end_conference"
-    muc_component = "conference.{{ domains | first }}"
+Component "endconference.{{ jitsimeet_domains | first }}" "end_conference"
+    muc_component = "conference.{{ jitsimeet_domains | first }}"
 
-Component "avmoderation.{{ domains | first }}" "av_moderation_component"
-    muc_component = "conference.{{ domains | first }}"
+Component "avmoderation.{{ jitsimeet_domains | first }}" "av_moderation_component"
+    muc_component = "conference.{{ jitsimeet_domains | first }}"
 
-Component "lobby.{{ domains | first }}" "muc"
+Component "lobby.{{ jitsimeet_domains | first }}" "muc"
     storage = "memory"
     restrict_room_creation = true
     muc_room_locking = false
@@ -159,6 +159,6 @@ Component "lobby.{{ domains | first }}" "muc"
         "polls";
     }
 
-Component "metadata.{{ domains | first }}" "room_metadata_component"
-    muc_component = "conference.{{ domains | first }}"
-    breakout_rooms_component = "breakout.{{ domains | first }}"
+Component "metadata.{{ jitsimeet_domains | first }}" "room_metadata_component"
+    muc_component = "conference.{{ jitsimeet_domains | first }}"
+    breakout_rooms_component = "breakout.{{ jitsimeet_domains | first }}"
diff --git a/webapps/jitsimeet/templates/videobridge/jvb.conf.j2 b/webapps/jitsimeet/templates/videobridge/jvb.conf.j2
index 4a64ec9a..67da6060 100644
--- a/webapps/jitsimeet/templates/videobridge/jvb.conf.j2
+++ b/webapps/jitsimeet/templates/videobridge/jvb.conf.j2
@@ -9,7 +9,7 @@ videobridge {
     }
     websockets {
         enabled = true
-        domain = "{{ domains | first }}:443"
+        domain = "{{ jitsimeet_domains | first }}:443"
         tls = true
     }
     apis {
diff --git a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2 b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
index f8fe663e..ac06ccc6 100644
--- a/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
+++ b/webapps/jitsimeet/templates/videobridge/sip-communicator.properties.j2
@@ -1,13 +1,13 @@
 org.ice4j.ice.harvest.DISABLE_AWS_HARVESTER=true
-org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES={{ turn_domains | first }}:3478
+org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES={{ jitsimeet_turn_domains | first }}:3478
 org.jitsi.videobridge.ENABLE_STATISTICS=true
 org.jitsi.videobridge.STATISTICS_TRANSPORT=muc,colibri
 org.jitsi.videobridge.xmpp.user.shard.HOSTNAME=localhost
-org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.{{ domains | first }}
+org.jitsi.videobridge.xmpp.user.shard.DOMAIN=auth.{{ jitsimeet_domains | first }}
 org.jitsi.videobridge.xmpp.user.shard.USERNAME=jvb
-org.jitsi.videobridge.xmpp.user.shard.PASSWORD={{ jitsi_meet_jvb_secret }}
-org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.{{ domains | first }}
-org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME={{ jitsi_meet_jvb_muc_nick }}
+org.jitsi.videobridge.xmpp.user.shard.PASSWORD={{ jitsimeet_jvb_secret }}
+org.jitsi.videobridge.xmpp.user.shard.MUC_JIDS=JvbBrewery@internal.auth.{{ jitsimeet_domains | first }}
+org.jitsi.videobridge.xmpp.user.shard.MUC_NICKNAME={{ jitsimeet_jvb_muc_nick }}
 #org.jitsi.videobridge.rest.jetty.ResourceHandler.alias./static/welcomePageAdditionalContent.html=/usr/share/jitsi-meet/static/welcomePageAdditionalContent.html
 # Switches off the BWE mechanism.
 #org.jitsi.videobridge.TRUST_BWE=false
-- 
2.39.2


From 7ac72846122815b951bcb3d0a5966e0bdacc73cf Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 28 Mar 2024 16:08:08 -0400
Subject: [PATCH 25/28] new apt_sources.yml ; systemd + command instead of
 service + shell

---
 webapps/jitsimeet/defaults/main.yml           |   1 +
 webapps/jitsimeet/files/jitsimeet.gpg         | Bin 0 -> 2241 bytes
 webapps/jitsimeet/files/prosody.gpg           | Bin 0 -> 1686 bytes
 webapps/jitsimeet/tasks/apt_sources.yml       |  55 ++++++++++++++++++
 webapps/jitsimeet/tasks/main.yml              |  48 +++++----------
 webapps/jitsimeet/tasks/other_domains.yml     |   7 ++-
 .../templates/apt/jitsimeet.sources.j2        |   8 +++
 .../templates/apt/prosody.sources.j2          |   8 +++
 8 files changed, 89 insertions(+), 38 deletions(-)
 create mode 100644 webapps/jitsimeet/files/jitsimeet.gpg
 create mode 100644 webapps/jitsimeet/files/prosody.gpg
 create mode 100644 webapps/jitsimeet/tasks/apt_sources.yml
 create mode 100644 webapps/jitsimeet/templates/apt/jitsimeet.sources.j2
 create mode 100644 webapps/jitsimeet/templates/apt/prosody.sources.j2

diff --git a/webapps/jitsimeet/defaults/main.yml b/webapps/jitsimeet/defaults/main.yml
index 985298b4..35b02989 100644
--- a/webapps/jitsimeet/defaults/main.yml
+++ b/webapps/jitsimeet/defaults/main.yml
@@ -1,5 +1,6 @@
 ---
 # defaults file for main vars
+apt_keyring_dir: "{{ ansible_distribution_major_version is version('12', '<') | ternary('/etc/apt/trusted.gpg.d', '/etc/apt/keyrings') }}"
 
 jitsimeet_system_dep: "['gnupg2', 'curl', 'apt-transport-https', 'default-jdk', 'lua5.2', 'lua-unbound', 'certbot', 'python3-certbot-nginx']"
 
diff --git a/webapps/jitsimeet/files/jitsimeet.gpg b/webapps/jitsimeet/files/jitsimeet.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..2ee72812e32e7c5c38878f333351c5f759a53b28
GIT binary patch
literal 2241
zcmV;y2tN0j0u2OUcx*`l5CGqNaSOAgL1aN7neB_{rSdzK(}a#uI8cmd?ibc(Qz-nR
zhT|8zQV@Bf(1k*T!>tWueMidi_0+xhEr%kST#F2D&Fat0jcZE)kFb&k`iX`%m<r6@
zI*(5^U}Z-Mmz1ro`*u^r4Xe|3s>xdyxMtoB`7^&O<RWI3R2VyNe6K#TZi~+KG{O8W
z%4{<Sq7fG%)nx#JfVS_y<<*e1{>?{pSss_npzGi3lVW8XE_I$#Wyf{!Zs*c_`ZQit
zm**}n!;FWz_9`Req<fIUhVT%YT=3SQv#e984=alzY`?;nB-UZ)Q;=DVkc7<tJ9(8!
zx7~hZxVwSWZ+c;QNu#S`@#6I5OFV)`c##W*NQGFDYXr+fA}MzdISAh3B=dgRmJU;i
zCuRh%^dRQAp=!iro&G)$9@76Shqu5{Ka&9d;U$av5G)Cl51pI6MAv3b_L6?X>PrL#
z612u!D~2Q-&Co$cL{bbRdA9(Rg6QLg$-vd%qsbf;3UM*`p;33DkO_}<_~wSX^Ujk3
zJOHrqwMUU!rl?j&HLR<^r{22y5Tbwc7yS~S${@o@wVEip-rv{(CO`TROxNxE1%!G!
zYj;M8F@6r{(~=v74aFAb-)JAK5gLvn)B{HeTk9U<KmuiY;@_bf@OjFeivnqOTWirw
z%hcY`=`u)~P-6fQ0RREC6-sGzb7>$vWMy_hYH4(HX)bSaXFiDnP6QJH2mm-1Aq4-{
zS`DJUz3X$-OpCPA(iZXkcm@RmV0dgv0viJb3ke7Z0tOWd2?z@U1Qr4V0RkQY0vCV)
z3JDOj($W_3{dfl79uNS}nk`rNCnI|CQS)mCqe_!dNGEphZCW9a%`L?3A+^AX5vnW_
zleP9IQ!B-;WFSc;(5Ee>gd>DPR#(K|0W+SEsA$I4r)B5;tI;o{(!nHXpIia$^}VPM
zIXmNi+{)Fv);U4Sw&PLm?Ntj}5SDH^%;RKf$HToCzoGOEL@q=*Nt%ZT&ows!3RfrP
z=u29BfR4C20yAAxp}!_o$l9BqL-MKW=taCj&@=EF#K7>zAb)$KqW}n=)on`sB+a%@
z(-lA8I%c>(i^D@KtB9SPO&<DiDSbFa+sr;N0eBKA7oz+t_)#I~EbZK(t5WI$QH@xb
zx{{={8Xb$p)`V=Gk`)o>7X^>(M;uPPxi}ueZ6RKxCwh`x0gtl~2_zY8Pf71QFR|mS
zFFO!ezh$7ARBN8R`@WiW3(S#V2AXeOB~q`Cx%Mkdj1XS-(<ld}q~>8qO)4i)EsMOh
zOk4NFSY?Dr;QqanQO&3nMje!c>3&FpJ>avE#McL?u(?V3^$EI?!GbUH6Qg?;Wgy!*
z0tV}NThLTlkY6TRd5>^v51Afhn)>@gG0K_xCTQexE{E5uwcp=2;SQI%kt|;=wCqN4
z!pDx6C1uPO9`sLNW8i}4S)rqDa6LI?trH^xr_r7y`({|H0fhfD!rdcnx5v%Q!F^;-
z)2aCH@JmR!0u2OUcx*`l5CGPgv;mzYacx>#+X`gX3D}k6vFGZZt5i@jG{oeRm!FHy
zJ7d;Uz}0&8FV%P#B?cR#d<Enj$@zO^0cq$(lKl`9XzbqpvaupyD;?G}FOMq`13?N7
zr4GyQJeD1B!EQ8Jy?gDif&!HKjWeV;mC<4&YQM<krE)p6JM2JCCQ%O!DD&CtEKRmq
z<Qi+ks!>S~0*;fZO0#gFFyS@v&k@Qbk;f)JQ9Q-jm!Db;<(U60ql73LiBcU@b15MZ
zPhkAVA?Rg#0(*t7&>mTg@#aU(lpFKaj_}<z=Wc`#@xMrU3=PSY)@Z{lwtq98-w`T$
z(*tLY81A*nC@nEf-w>3I(rSm@$ms(!*Y>v^ijxa_c0(D7V#H7vrORA)60Z`hUHQCi
zyj0MYD-uZuy$<!zIrjagpSnsnqlG){S{1N_{MI1i*WiF+UtQ`Cmo5B^Y%d68+kdO~
zI%MyRa7LL|;8fh+jb`}TXjybo0qGnm-avwRK!uM^?K}S8Q;|od|AZzSvs>rIvB`mI
z^S@0-$H|;JKmP5YoVLU_+JqJ}p-^M{+@&m2jGG&tn3CO+6kyfg-(@EP=2XZgs;-j2
zR16Im9A>8k8`UK->~KKw?WG;DDk*R3okRw1bZ^oR=t@Z<m;l<&Oel=k6?O?L7u|D_
zOLHS8zBK5DJGTH40RRDs0yYE~0SEvf79j-x)>;jszP;;n)J%)C($W_3{dfii0$_M-
zNdg-T0162Zw9?WR@%?xP6C@A-um>U}XckCvq-sUCf19^<OF{mQ58?D?Bb>{P!;}yd
z&$HV$Rk&<B$Tmn5Xk=RX!VJOHxs_wRe!!uyN&{AS<@UD?aWY&tkzD-0mz{2;^&HmL
za=w~9&4_2w?BX?7r;RgyI`~RJ*_rB9H|y7rmAj8qSG&@&`PqY}>zC_wsNBgccPyP;
zaR4km<l~Btfv)GOGrJKMj=`{=`{W<DQT%eowojKoLsm!=s1lLm?XiC9A2l+U401jJ
zVuqOjm(a=le60P6KrhEOwlr)7v}zM}$LGZLS9*x~D?DU|iM5fxpxgYS<kcTP@ooWN
zt76|>#9dz?(g!q6+$wGo);cM|j?&iosn@csW>ix~)x@<5`vr?-gGSiLKX;gDM`v7j
zCp^9&DD>W5QQzEgg9+y780Cd}DYk5U4$Zva^s0W8W-^QViCd3)pXMpR6@yfG6_qY^
zW5`nP5O@`i^-F`8;crs$b@VAjB8I9V+)g-pj6P?>gw_oLqQmpq#A2Wbgn3iVt*r=v
zJ)#e?%D6>c>oR*qymMG3q@(K&fGM<=to-dBNJ1vW6|_|WJLV(scMSFij!x~M^!fTY
z9D$7xKCek(Bav<e@1bF|f6dbrhs9T{hJt2>)H4@g^Ks}yl}%{OGKI}<$pe!O$92VB
PS3Wgnb-&h9S$aFxvL`t_

literal 0
HcmV?d00001

diff --git a/webapps/jitsimeet/files/prosody.gpg b/webapps/jitsimeet/files/prosody.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..117d429b10a36e6b3c965953622226f42e1a004b
GIT binary patch
literal 1686
zcmV;H25I@30ipy-7dkN!1OWER36gdytVU|nsY;w0g{DnUbPl+rX@>Xyyf88prJ;2F
zsM~{R=Sgq!&3_1DNwS6Cl1G7sc=-|?z%uXS18SPY2i2AiQZ3{EQ@O)p)$&oi*QNF~
z(Wi^&#sa%c>%hHd7f25WsM%gd<ts-Z*9t%Inr}}mQar1yDsVgYdB*^t^nVLJ!C0Qo
zk#ci8f1o<YlSdI-1OUHLU?^dc=P&>2r))V&9O6^)G!x-3Dd`q1X_3TT9{0Zc<Iw;5
zFC0F!rb(#@m88~-Upq@k)we0|5%`?=NU%wvBlx*;c~Mdno~G#>B^lfq!x`c3PMLAG
zwicT?#NUF9lFqA%dK3bcKay%ZOj@Dwq{OFDe`ViOcDRspNP+|YHb@yv+zfPaxVE+t
z(h?OF>7bjl)O{ah=8^3SvkFu(H}O$D`)|v6p~l&WdIoewNDFpK*-I|ygt@vFINOe5
z5GJ23MffaUE@NKE9zONoBZp_i{kLMk7+bxg6FU$}1IbdnCJi4(e(bCezo)Yu1U+QI
zR**V!BdR#6e|NpGv@%d~Z*y;Cc_2wmAVg(iX<=?4P+?<hVP|D?AUtGcc4cgDaAk6H
zKyY$zb8lpME@^E(h+qU05dr`p1p-PJIxzwp0|pBT2nPcK1Qh}Z0|XWV0|5da0Rk6*
z0162ZbCcKRblKar)WiUt8!G33xDQ!Bvq-c~4mF2T!)yU<0HC&mox@;F*YY#fB~Vip
z;q0DF?R>ce4FpOTI{*+60Kwl*BWq@<Edxh(e7_oEqeqqhPln**n_x`itAd`Q96Y;<
zhE{;i;IqM}D;_la`X}eE_+5@QtvD}NjtuY^ro7|DPM{VGeqU?5k}(m<u|r%LRUJb^
zK!ps3s#P8vB`jbh*3!w*smNCe`z{_Ix3U?lZ_BI(`AHpYN@;kjt@+wKD$5%UX8!d@
z>_?4P<KZfV*i<^*icmodN{I3t{_i{LZCk`GI4b0IZs8*XLZv)#5sYQMbZ7rdF*4v*
z9JsuVJxGy6eSjzC{KAJGewF8JqMshmvoA>YC<;KmD56_K4c@EQiFJ8t>iZ2_n_isj
zOSM3F5_-!x>OnOYZHQ)rV+x<5V#R_z%Zxn`(V>uc3a7+lItNes7jvT`kToGW*DX!X
z=+Fu0?DLRXT&l>KOUWf%;#f-)0xYzxK6&~(gL-(tm}x?oDGdoQbbYmm+;R6mrJYZA
z?fN!kR_sSvHu9nYm18Ax-RpMrdC2&pc>CT3ZEM|G(GCM)!_-EPZbdCOQg`(F57Hp<
z(Oq6B8p|4^23}y)0f^TJFKiH;_6m~l&mGdjEXaXN`G$xKAhxWqT{&PKJPy*slTiWe
zKa)y8RvY2B-oAsDH00(Q<5-Y{)H1j^{05T+eJ8$V4K4b4IVTc+A;#T}NHefpKkm?{
zgetnm7#3~!UjPFI5C4A)c|a_4?#Fovu2_p%y*R*m2Yb{&qR?;RAn%-TW(B;0gfPV`
zC6pQ%np)l;Bh*X0y1@kdbrddsmY0?(h$=`1kutK}XPT+@Zx)KQH$}8QH-vS6d7zNG
z;>tJLrpKjhrP_x|qkh*G?T{LX2NR71vu?4c!O3MT*N_y%R?A|fxpe$DJlZH6V$r<2
zYTla8&|RYhvZA^=O-W(DL#w|5yhxvVjfsP$+f7?26e3_h@d=R-WCzJfV7?OdG=7ll
zOx(UO3fZ0@2A0qf;Y^_=%97m>EC;6b*_vRj<Ed>h3EmMC>9!^#1y4coKRNOdk&`Bl
zS7+lq(TvIc9wK9N`EOX4oSEF&)YFO-D4@^DZa8*cNpO<igvW+1A03c$NT<UTmCl;3
z{i5O1V@PtnSuB(LW8MzV&w3jbfZK1*mzV`*KKmwFF;4Sv#Y<`-1E!*u_R)ni4iG*v
z<VSgFv0Q$<;t4#DwU{Q<>RvV`>pGt~4`MSgd1_@bzeQ<zF4a`PRI9&3r4v1|57ct5
zQXuut0Z@~2Y)aSGhIH^%RzcaIeg1u1(@Vd$&pdVt3U-8|?veqGPk2ZsY~xWUrxEGY
zl_0?Ym&(NmhYRjJ|LHCQjLMQvfc-L{&U%2|mu6<75|xP8OBdtzIu^QiFjK@x^VX<e
za_-JnF`9@;1Q-zl00{*GN*6l-0vikf3JDN%lh@{S+1s_IO#q<ZW$jg+MD(H$4wor1
gxK;a%DYu;fo-~-WI0G7mn@1Q%4AQq!tR6hoi&+5)^Z)<=

literal 0
HcmV?d00001

diff --git a/webapps/jitsimeet/tasks/apt_sources.yml b/webapps/jitsimeet/tasks/apt_sources.yml
new file mode 100644
index 00000000..3638b595
--- /dev/null
+++ b/webapps/jitsimeet/tasks/apt_sources.yml
@@ -0,0 +1,55 @@
+---
+
+- name: "Ensure {{ apt_keyring_dir }} directory exists"
+  file:
+    path: "{{ apt_keyring_dir }}"
+    state: directory
+    mode: "755"
+    owner: root
+    group: root
+
+- name: Prosody GPG key is installed
+  ansible.builtin.copy:
+    src: prosody.gpg
+    dest: "{{ apt_keyring_dir }}/prosody.gpg"
+    force: true
+    mode: "0644"
+    owner: root
+    group: root
+
+- name: Jitsi Meet GPG key is installed
+  ansible.builtin.copy:
+    src: jitsimeet.gpg
+    dest: "{{ apt_keyring_dir }}/jitsimeet.gpg"
+    force: true
+    mode: "0644"
+    owner: root
+    group: root
+
+- name: Add Prosody repository (Debian <12)
+  ansible.builtin.apt_repository:
+    repo: "deb [signed-by={{ apt_keyring_dir }}/prosody.gpg] https://packages.prosody.im/debian {{ ansible_distribution_release }} main"
+    filename: prosody
+    state: present
+    update_cache: yes
+  when: ansible_distribution_major_version is version('12', '<')
+
+- name: Add Prosody repository (Debian >=12)
+  ansible.builtin.template:
+    src: apt/prosody.sources.j2
+    dest: /etc/apt/sources.list.d/prosody.sources
+  when: ansible_distribution_major_version is version('12', '>=')
+
+- name: Add Jitsi Meet repository (Debian <12)
+  ansible.builtin.apt_repository:
+    repo: "deb [signed-by={{ apt_keyring_dir }}/jitsimeet.gpg] https://download.jitsi.org stable/"
+    filename: jitsimeet
+    state: present
+    update_cache: yes
+  when: ansible_distribution_major_version is version('12', '<')
+
+- name: Add Jitsi Meet repository (Debian >=12)
+  ansible.builtin.template:
+    src: apt/jitsimeet.sources.j2
+    dest: /etc/apt/sources.list.d/jitsimeet.sources
+  when: ansible_distribution_major_version is version('12', '>=')
diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 50f1f223..59522017 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -1,33 +1,8 @@
 ---
 # tasks file for jitsimeet install
 
-#- name: Set FQDN
-#  ansible.builtin.command: "hostnamectl set-hostname {{ jitsimeet_domains | first }}"
-
-- name: Add Prosody apt repository key
-  ansible.builtin.get_url:
-    url: https://prosody.im/files/prosody-debian-packages.key
-    dest: /etc/apt/trusted.gpg.d/prosody.gpg
-    mode: '0644'
-    force: true
-
-- name: Add Jitsi Meet apt repository key + dearmor hack
-  ansible.builtin.shell: curl -sL https://download.jitsi.org/jitsi-key.gpg.key | sh -c 'gpg --dearmor > /etc/apt/trusted.gpg.d/jitsimeet.gpg'
-
-- name: Adjust permissions of gpg key
-  ansible.builtin.file:
-    path: /etc/apt/trusted.gpg.d/jitsimeet.gpg
-    mode: '0644'
-
-- name: Add Prosody apt repository
-  ansible.builtin.apt_repository:
-    repo: "deb [signed-by=/etc/apt/trusted.gpg.d/prosody.gpg] https://packages.prosody.im/debian {{ ansible_distribution_release }} main"
-    state: present
-
-- name: Add Jitsi Meet apt repository
-  ansible.builtin.apt_repository:
-    repo: "deb [signed-by=/etc/apt/trusted.gpg.d/jitsimeet.gpg] https://download.jitsi.org stable/"
-    state: present
+- name: APT sources
+  ansible.builtin.include_tasks: apt_sources.yml
 
 - name: Install system dependencies
   ansible.builtin.apt:
@@ -115,23 +90,25 @@
         }
 
 - name: Unregister default jvb account in prosody
-  ansible.builtin.command: prosodyctl unregister jvb auth.{{ jitsimeet_domains | first }}
+  ansible.builtin.command: 
+    cmd: prosodyctl unregister jvb auth.{{ jitsimeet_domains | first }}
 
 - name: Register jvb account in prosody (with proper secret)
-  ansible.builtin.command: prosodyctl register jvb auth.{{ jitsimeet_domains | first }} {{ jitsimeet_jvb_secret }}
+  ansible.builtin.command: 
+    cmd: prosodyctl register jvb auth.{{ jitsimeet_domains | first }} {{ jitsimeet_jvb_secret }}
 
 - name: Restart prosody
-  ansible.builtin.service:
+  ansible.builtin.systemd:
     name: prosody
     state: restarted
 
 - name: Restart jvb
-  ansible.builtin.service:
+  ansible.builtin.systemd:
     name: jitsi-videobridge2
     state: restarted
 
 - name: Restart jicofo
-  ansible.builtin.service:
+  ansible.builtin.systemd:
     name: jicofo
     state: restarted
 
@@ -152,7 +129,7 @@
       dest: "/etc/nginx/sites-enabled/{{ jitsimeet_domains |first }}.conf"
       state: link
   - name: Reload nginx conf
-    ansible.builtin.service:
+    ansible.builtin.systemd:
       name: nginx
       state: reloaded
   - name: Make sure /var/lib/letsencrypt exists and has correct permissions
@@ -161,7 +138,8 @@
       state: directory
       mode: '0755'
   - name: Generate certificate with certbot
-    ansible.builtin.shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ jitsimeet_domains |first }}
+    ansible.builtin.command: 
+      cmd: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ jitsimeet_domains |first }}
   when: ssl.stat.exists != true
 
 - name: (Re)check if SSL certificate is present and register result
@@ -190,7 +168,7 @@
     state: link
 
 - name: Reload nginx conf
-  ansible.builtin.service:
+  ansible.builtin.systemd:
     name: nginx
     state: reloaded
 
diff --git a/webapps/jitsimeet/tasks/other_domains.yml b/webapps/jitsimeet/tasks/other_domains.yml
index 04175831..2982c8c6 100644
--- a/webapps/jitsimeet/tasks/other_domains.yml
+++ b/webapps/jitsimeet/tasks/other_domains.yml
@@ -29,7 +29,7 @@
       dest: "/etc/nginx/sites-enabled/{{ domain }}.conf"
       state: link
   - name: Reload nginx conf
-    ansible.builtin.service:
+    ansible.builtin.systemd:
       name: nginx
       state: reloaded
   - name: Make sure /var/lib/letsencrypt exists and has correct permissions
@@ -38,7 +38,8 @@
       state: directory
       mode: '0755'
   - name: Generate certificate with certbot
-    ansible.builtin.shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ domain }}
+    ansible.builtin.command: 
+      cmd: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ domain }}
   when: ssl.stat.exists != true
 
 - name: (Re)check if SSL certificate is present and register result
@@ -66,6 +67,6 @@
     state: link
 
 - name: Reload nginx conf
-  ansible.builtin.service:
+  ansible.builtin.systemd:
     name: nginx
     state: reloaded
diff --git a/webapps/jitsimeet/templates/apt/jitsimeet.sources.j2 b/webapps/jitsimeet/templates/apt/jitsimeet.sources.j2
new file mode 100644
index 00000000..9acd6c0d
--- /dev/null
+++ b/webapps/jitsimeet/templates/apt/jitsimeet.sources.j2
@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+
+Types: deb
+URIs: https://download.jitsi.org
+Suites: stable/
+#Components: main
+Signed-by: {{ apt_keyring_dir }}/jitsimeet.gpg
+Enabled: yes
diff --git a/webapps/jitsimeet/templates/apt/prosody.sources.j2 b/webapps/jitsimeet/templates/apt/prosody.sources.j2
new file mode 100644
index 00000000..15e84be4
--- /dev/null
+++ b/webapps/jitsimeet/templates/apt/prosody.sources.j2
@@ -0,0 +1,8 @@
+# {{ ansible_managed }}
+
+Types: deb
+URIs: https://packages.prosody.im/debian
+Suites: bookworm
+Components: main
+Signed-by: {{ apt_keyring_dir }}/prosody.gpg
+Enabled: yes
-- 
2.39.2


From fc520c531d5a19fff202714667d6e0e02042f360 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Wed, 3 Apr 2024 14:30:09 -0400
Subject: [PATCH 26/28] 1 more command instead of shell + more jitsimeet_
 prefix

---
 webapps/jitsimeet/tasks/main.yml                    | 13 +++++++------
 webapps/jitsimeet/tasks/other_domains.yml           |  6 +++---
 .../jitsimeet/templates/nginx/other.vhost.conf.j2   |  6 +++---
 webapps/jitsimeet/templates/nginx/vhost.conf.j2     |  6 +++---
 4 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 59522017..648ce507 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -115,7 +115,7 @@
 - name: Check if SSL certificate is present and register result
   ansible.builtin.stat:
     path: "/etc/letsencrypt/live/{{ jitsimeet_domains |first }}/fullchain.pem"
-  register: ssl
+  register: jitsimeet_ssl
 
 - name: Generate certificate only if required (first time)
   block:
@@ -140,12 +140,12 @@
   - name: Generate certificate with certbot
     ansible.builtin.command: 
       cmd: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ jitsimeet_domains |first }}
-  when: ssl.stat.exists != true
+  when: jitsimeet_ssl.stat.exists != true
 
 - name: (Re)check if SSL certificate is present and register result
   ansible.builtin.stat:
     path: "/etc/letsencrypt/live/{{ jitsimeet_domains |first }}/fullchain.pem"
-  register: ssl
+  register: jitsimeet_ssl
 
 - name: (Re)template conf file for nginx vhost with SSL
   ansible.builtin.template:
@@ -175,11 +175,12 @@
 - name: Check if SSL certificate for coturn is present and register result
   ansible.builtin.stat:
     path: "/etc/coturn/certs/{{ jitsimeet_turn_domains |first }}.crt"
-  register: ssl_coturn
+  register: jitsimeet_ssl_coturn
 
 - name: Generate certificate for coturn with certbot
-  ansible.builtin.shell: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ jitsimeet_turn_domains |first }}
-  when: ssl_coturn.stat.exists != true 
+  ansible.builtin.command: 
+    cmd: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ jitsimeet_turn_domains |first }}
+  when: jitsimeet_ssl_coturn.stat.exists != true 
 
 - name: Setup other domains if any
   include_tasks: other_domains.yml
diff --git a/webapps/jitsimeet/tasks/other_domains.yml b/webapps/jitsimeet/tasks/other_domains.yml
index 2982c8c6..c9be3b83 100644
--- a/webapps/jitsimeet/tasks/other_domains.yml
+++ b/webapps/jitsimeet/tasks/other_domains.yml
@@ -15,7 +15,7 @@
 - name: Check if SSL certificate is present and register result
   ansible.builtin.stat:
     path: "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
-  register: ssl
+  register: jitsimeet_ssl
 
 - name: Generate certificate only if required (first time)
   block:
@@ -40,12 +40,12 @@
   - name: Generate certificate with certbot
     ansible.builtin.command: 
       cmd: certbot certonly --webroot --webroot-path /var/lib/letsencrypt --non-interactive --agree-tos --email {{ jitsimeet_certbot_admin_email }} -d {{ domain }}
-  when: ssl.stat.exists != true
+  when: jitsimeet_ssl.stat.exists != true
 
 - name: (Re)check if SSL certificate is present and register result
   ansible.builtin.stat:
     path: "/etc/letsencrypt/live/{{ domain }}/fullchain.pem"
-  register: ssl
+  register: jitsimeet_ssl
 
 - name: (Re)template conf file for nginx vhost with SSL
   ansible.builtin.template:
diff --git a/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
index 5e0b4858..a197d812 100644
--- a/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/other.vhost.conf.j2
@@ -1,4 +1,4 @@
-{% if ssl.stat.exists %}
+{% if jitsimeet_ssl.stat.exists %}
 map $arg_vnode $prosody_node {
     default prosody;
     v1 v1;
@@ -24,12 +24,12 @@ server {
     try_files $uri =404;
     allow all;
   }
-  {% if ssl.stat.exists %}
+  {% if jitsimeet_ssl.stat.exists %}
   location / { return 301 https://$host$request_uri; }
   {% endif %}
 }
 
-{% if ssl.stat.exists %}
+{% if jitsimeet_ssl.stat.exists %}
 server {
   listen 8088 ssl http2;
   listen [::]:8088 ssl http2;
diff --git a/webapps/jitsimeet/templates/nginx/vhost.conf.j2 b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
index aa1db962..251644e9 100644
--- a/webapps/jitsimeet/templates/nginx/vhost.conf.j2
+++ b/webapps/jitsimeet/templates/nginx/vhost.conf.j2
@@ -1,4 +1,4 @@
-{% if ssl.stat.exists %}
+{% if jitsimeet_ssl.stat.exists %}
 server_names_hash_bucket_size 64;
 
 types {
@@ -41,12 +41,12 @@ server {
     try_files $uri =404;
     allow all;
   }
-  {% if ssl.stat.exists %}
+  {% if jitsimeet_ssl.stat.exists %}
   location / { return 301 https://$host$request_uri; }
   {% endif %}
 }
 
-{% if ssl.stat.exists %}
+{% if jitsimeet_ssl.stat.exists %}
 server {
   listen 8088 ssl http2;
   listen [::]:8088 ssl http2;
-- 
2.39.2


From a71339f00f433ba2aa21ff45ef02a90e94fb90d1 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Wed, 3 Apr 2024 16:03:52 -0400
Subject: [PATCH 27/28] Adding handlers

---
 webapps/jitsimeet/handlers/main.yml       | 36 ++++++++++++++
 webapps/jitsimeet/tasks/main.yml          | 59 +++++++++++------------
 webapps/jitsimeet/tasks/other_domains.yml | 17 +++----
 3 files changed, 73 insertions(+), 39 deletions(-)

diff --git a/webapps/jitsimeet/handlers/main.yml b/webapps/jitsimeet/handlers/main.yml
index 214734cf..5f477271 100644
--- a/webapps/jitsimeet/handlers/main.yml
+++ b/webapps/jitsimeet/handlers/main.yml
@@ -1,2 +1,38 @@
 ---
 # handlers file
+
+- name: reload nginx
+  ansible.builtin.systemd:
+    name: nginx
+    state: reloaded
+
+- name: restart nginx
+  ansible.builtin.systemd:
+    name: nginx
+    state: restarted
+
+- name: restart jvb
+  ansible.builtin.systemd:
+    name: jitsi-videobridge2
+    state: restarted
+
+- name: restart prosody
+  ansible.builtin.systemd:
+    name: prosody
+    state: restarted
+
+- name: restart jicofo
+  ansible.builtin.systemd:
+    name: jicofo
+    state: restarted
+
+- name: restart coturn
+  ansible.builtin.systemd:
+    name: coturn
+    state: restarted
+
+- name: restart jitsimeet_all
+  loop: "{{ jitsimeet_all.results | selectattr('changed', 'equalto', true) | map(attribute='item') | map(attribute='name') | list }}"
+  systemd:
+    name: '{{ item }}'
+    state: restarted
diff --git a/webapps/jitsimeet/tasks/main.yml b/webapps/jitsimeet/tasks/main.yml
index 648ce507..ca29ed2c 100644
--- a/webapps/jitsimeet/tasks/main.yml
+++ b/webapps/jitsimeet/tasks/main.yml
@@ -70,14 +70,17 @@
     group: "{{ item.group }}"
     mode: "{{ item.mode }}"
   loop:
-    - { src: 'videobridge/jvb.conf.j2', dest: "/etc/jitsi/videobridge/jvb.conf", owner: "jvb", group: "jitsi", mode: "0640" }
-    - { src: 'videobridge/sip-communicator.properties.j2', dest: "/etc/jitsi/videobridge/sip-communicator.properties", owner: "jvb", group: "jitsi", mode: "0640" }
-    - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ jitsimeet_domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
-    - { src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ jitsimeet_domains | first }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
-    - { src: 'meet/welcomePageAdditionalContent.html.j2', dest: "/etc/jitsi/meet/welcomePageAdditionalContent.html", owner: "root", group: "root", mode: "0644" }
-    - { src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ jitsimeet_domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
-    - { src: 'coturn/turnserver.conf.j2', dest: "/etc/turnserver.conf", owner: "root", group: "turnserver", mode: "0640" }
-    - { src: 'certbot/coturn-certbot-deploy.sh.j2', dest: "/etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh", owner: "root", group: "root", mode: "0700" }
+    - { name: jitsi-videobridge2, src: 'videobridge/jvb.conf.j2', dest: "/etc/jitsi/videobridge/jvb.conf", owner: "jvb", group: "jitsi", mode: "0640" }
+    - { name: jitsi-videobridge2, src: 'videobridge/sip-communicator.properties.j2', dest: "/etc/jitsi/videobridge/sip-communicator.properties", owner: "jvb", group: "jitsi", mode: "0640" }
+    - { name: nginx, src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ jitsimeet_domains | first }}-config.js", owner: "root", group: "root", mode: "0644" }
+    - { name: nginx, src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ jitsimeet_domains | first }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
+    - { name: nginx, src: 'meet/welcomePageAdditionalContent.html.j2', dest: "/etc/jitsi/meet/welcomePageAdditionalContent.html", owner: "root", group: "root", mode: "0644" }
+    - { name: prosody, src: 'prosody/virtualhost.cfg.lua.j2', dest: "/etc/prosody/conf.avail/{{ jitsimeet_domains | first }}.cfg.lua", owner: "root", group: "root", mode: "0644" }
+    - { name: coturn, src: 'coturn/turnserver.conf.j2', dest: "/etc/turnserver.conf", owner: "root", group: "turnserver", mode: "0640" }
+    - { name: nginx, src: 'certbot/coturn-certbot-deploy.sh.j2', dest: "/etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh", owner: "root", group: "root", mode: "0700" }
+  register: jitsimeet_all
+  notify: 
+    - restart jitsimeet_all
 
 - name: Add bloc to jicofo.conf to disable sctp
   ansible.builtin.blockinfile:
@@ -88,29 +91,24 @@
         sctp: {
           enabled: false
         }
+  notify: restart jicofo
 
 - name: Unregister default jvb account in prosody
   ansible.builtin.command: 
     cmd: prosodyctl unregister jvb auth.{{ jitsimeet_domains | first }}
+  notify: 
+    - restart prosody
+    - restart jicofo
 
 - name: Register jvb account in prosody (with proper secret)
   ansible.builtin.command: 
     cmd: prosodyctl register jvb auth.{{ jitsimeet_domains | first }} {{ jitsimeet_jvb_secret }}
+  notify: 
+    - restart prosody
+    - restart jicofo
 
-- name: Restart prosody
-  ansible.builtin.systemd:
-    name: prosody
-    state: restarted
-
-- name: Restart jvb
-  ansible.builtin.systemd:
-    name: jitsi-videobridge2
-    state: restarted
-
-- name: Restart jicofo
-  ansible.builtin.systemd:
-    name: jicofo
-    state: restarted
+- name: Flush handlers
+  ansible.builtin.meta: flush_handlers
 
 - name: Check if SSL certificate is present and register result
   ansible.builtin.stat:
@@ -123,15 +121,15 @@
     ansible.builtin.template: 
       src: "nginx/vhost.conf.j2"
       dest: "/etc/nginx/sites-available/{{ jitsimeet_domains |first }}.conf"
+    notify: reload nginx
   - name: Enable temporary nginx vhost
     ansible.builtin.file:
       src: "/etc/nginx/sites-available/{{ jitsimeet_domains |first }}.conf"
       dest: "/etc/nginx/sites-enabled/{{ jitsimeet_domains |first }}.conf"
       state: link
-  - name: Reload nginx conf
-    ansible.builtin.systemd:
-      name: nginx
-      state: reloaded
+    notify: reload nginx
+  - name: Flush handlers
+    ansible.builtin.meta: flush_handlers
   - name: Make sure /var/lib/letsencrypt exists and has correct permissions
     ansible.builtin.file: 
       path: /var/lib/letsencrypt
@@ -154,23 +152,24 @@
   loop:
     - { src: 'nginx/vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ jitsimeet_domains |first }}.conf" }
     - { src: 'nginx/multiplex.conf.j2', dest: '/etc/nginx/modules-available/multiplex.conf' }
+  notify: reload nginx
 
 - name: Enable multiplex module conf
   ansible.builtin.file:
     src: '/etc/nginx/modules-available/multiplex.conf'
     dest: '/etc/nginx/modules-enabled/multiplex.conf'
     state: link
+  notify: restart nginx
 
 - name: Enable nginx vhost
   ansible.builtin.file:
     src: "/etc/nginx/sites-available/{{ jitsimeet_domains |first }}.conf"
     dest: "/etc/nginx/sites-enabled/{{ jitsimeet_domains |first }}.conf"
     state: link
+  notify: reload nginx
 
-- name: Reload nginx conf
-  ansible.builtin.systemd:
-    name: nginx
-    state: reloaded
+- name: Flush handlers
+  ansible.builtin.meta: flush_handlers
 
 - name: Check if SSL certificate for coturn is present and register result
   ansible.builtin.stat:
diff --git a/webapps/jitsimeet/tasks/other_domains.yml b/webapps/jitsimeet/tasks/other_domains.yml
index c9be3b83..bc0f07fa 100644
--- a/webapps/jitsimeet/tasks/other_domains.yml
+++ b/webapps/jitsimeet/tasks/other_domains.yml
@@ -11,6 +11,7 @@
   loop:
     - { src: 'meet/config.js.j2', dest: "/etc/jitsi/meet/{{ domain }}-config.js", owner: "root", group: "root", mode: "0644" }
     - { src: 'meet/interface_config.js.j2', dest: "/etc/jitsi/meet/{{ domain }}-interface_config.js", owner: "root", group: "root", mode: "0644" }
+  notify: reload nginx
 
 - name: Check if SSL certificate is present and register result
   ansible.builtin.stat:
@@ -23,15 +24,15 @@
     ansible.builtin.template: 
       src: "nginx/other.vhost.conf.j2"
       dest: "/etc/nginx/sites-available/{{ domain }}.conf"
+    notify: reload nginx
   - name: Enable temporary nginx vhost
     ansible.builtin.file:
       src: "/etc/nginx/sites-available/{{ domain }}.conf"
       dest: "/etc/nginx/sites-enabled/{{ domain }}.conf"
       state: link
-  - name: Reload nginx conf
-    ansible.builtin.systemd:
-      name: nginx
-      state: reloaded
+      notify: reload nginx
+  - name: Flush handlers
+    ansible.builtin.meta: flush_handlers
   - name: Make sure /var/lib/letsencrypt exists and has correct permissions
     ansible.builtin.file: 
       path: /var/lib/letsencrypt
@@ -53,20 +54,18 @@
     dest: "{{ item.dest }}"
   loop:
     - { src: 'nginx/other.vhost.conf.j2', dest: "/etc/nginx/sites-available/{{ domain }}.conf" }
+  notify: reload nginx
 
 - name: Insert block in multiplex.conf
   ansible.builtin.lineinfile:
     path: /etc/nginx/modules-enabled/multiplex.conf
     insertafter: "web_backend;"
     line: "{{ domain }} web_backend;"
+  notify: reload nginx
 
 - name: Enable nginx vhost
   ansible.builtin.file:
     src: "/etc/nginx/sites-available/{{ domain }}.conf"
     dest: "/etc/nginx/sites-enabled/{{ domain }}.conf"
     state: link
-
-- name: Reload nginx conf
-  ansible.builtin.systemd:
-    name: nginx
-    state: reloaded
+  notify: reload nginx
-- 
2.39.2


From b47f2f17cd13bbf650e2be2d617aacb1d0807733 Mon Sep 17 00:00:00 2001
From: Mathieu Gauthier-Pilote <mgauthier+git@evolix.ca>
Date: Thu, 11 Apr 2024 14:44:49 -0400
Subject: [PATCH 28/28] Fix wrong indentation

---
 webapps/jitsimeet/tasks/other_domains.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webapps/jitsimeet/tasks/other_domains.yml b/webapps/jitsimeet/tasks/other_domains.yml
index bc0f07fa..59a73cd4 100644
--- a/webapps/jitsimeet/tasks/other_domains.yml
+++ b/webapps/jitsimeet/tasks/other_domains.yml
@@ -30,7 +30,7 @@
       src: "/etc/nginx/sites-available/{{ domain }}.conf"
       dest: "/etc/nginx/sites-enabled/{{ domain }}.conf"
       state: link
-      notify: reload nginx
+    notify: reload nginx
   - name: Flush handlers
     ansible.builtin.meta: flush_handlers
   - name: Make sure /var/lib/letsencrypt exists and has correct permissions
-- 
2.39.2