add support for custom port

* add etherpad integration

* remove default ETHERPAD_URL_BASE

* upgrade etherpad to 1.8.18

.github/workflows/pr.yaml

@@ -0,0 +1,155 @@
+name: Lint and Test Charts
+
+on: pull_request
+
+jobs:
+  e2e-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Print the GitHub context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
+
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Remove built-in kubectl
+        run: |
+          sudo rm $(which kubectl)
+      
+      - name: Install
+        run: |
+          sudo \
+            DEPLOY_GIT_REPO=${{github.event.pull_request.head.repo.clone_url}} \
+            DEPLOY_GIT_VERSION=${{github.head_ref}} \
+            TLS_CERT=test/localhost.crt \
+            TLS_KEY=test/localhost.key \
+            ./deploy_jitsi.sh localhost
+
+      - name: Wait for pods
+        run: |
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/name=prosody --for condition=Ready --timeout=90s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=web --for condition=Ready --timeout=90s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=jicofo --for condition=Ready --timeout=180s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=etherpad --for condition=Ready --timeout=180s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=jvb --for condition=Ready --timeout=300s
+
+      - name: Check
+        run: |
+          curl -vIL --cacert test/rootca.crt https://localhost
+          curl \
+            --include \
+            --no-buffer \
+            --header "Connection: Upgrade" \
+            --header "Upgrade: websocket" \
+            --header "Host: localhost:443" \
+            --header "Origin: https://localhost:443" \
+            --cacert test/rootca.crt \
+            https://localhost/xmpp-websocket?room=test |
+          grep 'It works! Now point your WebSocket client to this URL to connect to Prosody.'
+
+      - name: Tear down
+        run: sudo /usr/local/bin/k3s-uninstall.sh
+
+  e2e-test-custom-port:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Print the GitHub context
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
+
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Remove built-in kubectl
+        run: |
+          sudo rm $(which kubectl)
+      
+      - name: Install with custom port
+        run: |
+          sudo \
+            DEPLOY_GIT_REPO=${{github.event.pull_request.head.repo.clone_url}} \
+            DEPLOY_GIT_VERSION=${{github.head_ref}} \
+            PORT=7443 \
+            TLS_CERT=test/localhost.crt \
+            TLS_KEY=test/localhost.key \
+            ./deploy_jitsi.sh localhost
+      
+      - name: Wait for pods
+        run: |
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/name=prosody --for condition=Ready --timeout=90s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=web --for condition=Ready --timeout=90s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=jicofo --for condition=Ready --timeout=180s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=etherpad --for condition=Ready --timeout=180s
+          sudo kubectl -n prod wait pods -l app.kubernetes.io/component=jvb --for condition=Ready --timeout=300s
+
+      - name: Check
+        run: |
+          curl -vIL --cacert test/rootca.crt https://localhost:7443
+          curl \
+            --include \
+            --no-buffer \
+            --header "Connection: Upgrade" \
+            --header "Upgrade: websocket" \
+            --header "Host: localhost:7443" \
+            --header "Origin: https://localhost:7443" \
+            --cacert test/rootca.crt \
+            https://localhost:7443/xmpp-websocket?room=test |
+          grep 'It works! Now point your WebSocket client to this URL to connect to Prosody.'
+          curl http://localhost 2>&1 | grep "Connection refused"
+          curl https://localhost 2>&1 | grep "Connection refused"
+
+      - name: Tear down
+        run: sudo /usr/local/bin/k3s-uninstall.sh
+
+  lint-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v1
+        with:
+          version: v3.9.0
+
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.2.1
+        with:
+          version: v3.5.1
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --config ct.yaml)
+          if [[ -n "$changed" ]]; then
+            echo "::set-output name=changed::true"
+          fi
+
+      - name: Run chart-testing (lint)
+        run: ct lint --config ct.yaml --lint-conf lintconf.yaml --validate-maintainers=false
+
+      - name: Create k3s cluster
+        uses: debianmaster/actions-k3s@master
+        with:
+          version: 'v1.24.1-k3s1'
+        if: steps.list-changed.outputs.changed == 'true'
+
+      - name: Wait for traefik
+        run: |
+          kubectl -n kube-system wait --for=condition=complete job/helm-install-traefik-crd
+          kubectl -n kube-system wait --for=condition=complete job/helm-install-traefik
+          kubectl -n kube-system wait --for=condition=available deploy/traefik
+        if: steps.list-changed.outputs.changed == 'true'
+
+      - name: Run chart-testing (install)
+        run: ct install --config ct.yaml --chart-dirs . --charts jitsi
+        if: steps.list-changed.outputs.changed == 'true'

INSTALL.md

@@ -0,0 +1,75 @@
+# Installation
+
+The deployment script is largely based on the helm chart [jitsi-helm](https://github.com/jitsi-contrib/jitsi-helm/). The dependencies include [k3s](https://k3s.io/), [traefik](https://traefik.io/) and [argocd](https://argoproj.github.io/). It also uses [Let's Encrypt](https://letsencrypt.org/) for signing TLS certificates. 
+
+## Prerequisites
+
+  * A GNU/Linux host with Debian/Ubuntu installed and root privileges
+  * The host has a public IPv4 address <PUBLIC_IP>
+  * Allow these traffic through firewall: 80/TCP, 443/TCP, 5222/TCP (necessary only for external jvb), 30000/UDP (30001/UDP for test)
+  * An email inbox address <ACME_EMAIL> for receiving ACME notification mails
+  * A domain name <PROD_HOSTNAME> that has a DNS A record pointing to <PUBLIC_IP>
+  * (optional) Another domain name <TEST_HOSTNAME> (for test deployment purposes) that has a DNS A record pointing to <PUBLIC_IP>
+  * (optional) Yet another domain name <CD_HOSTNAME> (for accessing the ArgoCD web UI) that has a DNS A record pointing to <PUBLIC_IP>
+
+## Install/Upgrade
+
+The initial installation needs to be run from command line. But afterwards, ArgoCD web UI can be used instead to fulfill the subsequent (re)install/upgrade/uninstall needs. **All the shell commands need to be run with root user.** There are two installation modes, prod and test. By default, prod is installed. It can be switched to test by setting environment variable `TEST_INSTALL`.
+
+### Install/Upgrade from command line
+
+Run the following shell command by providing the 2 mandatory arguments: fully-qualified domain name for accessing jitsi web, and an email address for receiving Let's Enrypt's ACME mails. 
+
+```bash
+curl -sL https://raw.githubusercontent.com/shanghailug/jitsi-deploy/main/deploy_jitsi.sh | 
+  bash -s - <PROD_HOSTNAME> <ACME_EMAIL>
+```
+
+Before committing to a prod installation, the whole setup can be tested by using a test hostname, only requesting certificates from staging instance of Let's Encrypt, and installing into `test` k8s namespace. This can be done by setting `TEST_INSTALL` and `STAGING_CERT` environment variable and giving test hostname as command argument, like this: 
+
+```bash
+curl -sL https://raw.githubusercontent.com/shanghailug/jitsi-deploy/main/deploy_jitsi.sh | 
+  TEST_INSTALL=1 STAGING_CERT=1 bash -s - <TEST_HOSTNAME> <ACME_EMAIL>
+```
+
+The installed applications can then be updated/upgraded by rerunning exactly the same command, when the git repo is updated or it's desirable to enable ArgoCD web after initial installation is done. The already installed components will usually be kept as-is if their versions match, or be upgraded otherwise. If k3s needs to be upgraded, however, it's probably a better idea to [tear down](#tear-down) the whole setup before-hand. 
+
+### Install/Upgrade from ArgoCD web UI
+
+If the initial installation enabled ArgoCD web UI's ingress by providing the environment variable `ARGOCD_FQDN`, then the ArgoCD web server can be accessed via `https://${ARGOCD_FQDN}/`. 
+Please refer to [ArgoCD docs](https://argo-cd.readthedocs.io/en/stable/getting_started/#6-create-an-application-from-a-git-repository) for more details about how to create/update applications using helm charts from a git repo. The login's name is `admin` and the login's password can be retrieved after initial installation, by running the following command on the host: 
+
+```bash
+kubectl -n argocd get secret/argocd-initial-admin-secret -o jsonpath='{ .data.password }' | base64 -d
+```
+
+## Settings
+
+The following list of environment variables can be used to customize or alter the installation. 
+
+Environment Variable | Description | Default Value | Default behaviour
+--- | --- | --- | ---
+`ARGOCD_VERSION` | argocd release to install | "v2.4.2" | 
+`DEPLOY_GIT_REPO` | the git repo url for retrieving artifacts | `https://github.com/shanghailug/jitsi-deploy.git` |
+`DEPLOY_GIT_VERSION` | the revision of artifacts to checkout and use from the repo | "" | use the default branch when git repo is cloned locally
+`EXCLUDE_JVB` | Exclude built-in jvb component (so that an external one can be registered for use) | "" | include jvb
+`K3S_VERSION` | k3s release to install | "v1.24.1+k3s1" | 
+`TEST_INSTALL` | when set to non-empty, install an app called `jitsitest` into `test` k8s namespace | "" | install an app called `jitsi` into `prod` k8s namespace
+
+
+## Uninstall
+
+### Uninstall the applications
+
+The applications can be uninstalled either from ArgoCD web UI or by running something like the following commands: 
+
+```bash
+argocd app delete jitsi
+argocd app delete jitsitest
+```
+
+### Tear down
+
+```bash
+/usr/local/bin/k3s-uninstall.sh
+```

README.md

@@ -1,3 +1,13 @@
 # prototype
 
 ![jitsi setup prototype](images/prototype.png)
+
+# metrics
+
+## resource usage of jitsi videobridge for online meetup at 2022-04-22 night
+
+![jitsi videobridge network and memory usage](images/shlug_jitsi_2022_04_22_jvb_mem_and_network.png)
+
+![jitsi videobridge cpu usage](images/shlug_jitsi_2022_04_22_jvb_cpu.png)
+
+peak client number is about 20~30, with screenshare(but not sure everyone view the screenshare).

argocd/cmd-params-cm.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-cmd-params-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  server.insecure: "true"
+  server.rootpath: "/argocd"

argocd/ingressroute-server.yaml.sh

@@ -0,0 +1,44 @@
+if [ -n "${FQDN}" ]; then
+  HOST_RULE="Host(\`${FQDN}\`)"
+else
+  HOST_RULE="Host(\`${PUBLIC_IP}\`)"
+fi
+
+if [ ${PUBLIC_PORT} -eq 443 ]; then
+  ENTRYPOINT=websecure
+else
+  ENTRYPOINT=jitsi-meet
+fi
+
+cat <<EOF
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  entryPoints:
+    - ${ENTRYPOINT}
+  routes:
+    - kind: Rule
+      match: ${HOST_RULE} && PathPrefix(\`/argocd\`)
+      services:
+        - name: argocd-server
+          port: 80
+    - kind: Rule
+      match: ${HOST_RULE} && PathPrefix(\`/argocd\`) && Headers(\`Content-Type\`, \`application/grpc\`)
+      services:
+        - name: argocd-server
+          port: 80
+          scheme: h2c
+EOF
+if [ -n "${CERT_RESOLVER}" ]; then
+  cat <<EOF
+  tls:
+    certResolver: ${CERT_RESOLVER}
+EOF
+else
+  cat <<EOF
+  tls: {}
+EOF
+fi

bootstrap.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-
-# k3s and set current context as k3s , k3s use trafik as ingress controller by default.
-(which k3s &> /dev/null && test -f /etc/rancher/k3s/k3s.yaml)  || \
-    curl -sfL https://get.k3s.io | sh -s - --write-kubeconfig-mode 644 --disable traefik
-
-export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
-kubectl get namespace jitsi &> /dev/null || \
-    sudo -E kubectl create namespace jitsi
-
-sudo -E kubectl config set-context  --current --namespace=jitsi
-
-# helm
-which helm &> /dev/null || \
-    curl -sfL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3  | bash -s -
-
-# jitsi
-sudo -E helm repo add jitsi https://jitsi-contrib.github.io/jitsi-helm/
-sudo -E helm install shlug-jitsi jitsi/jitsi-meet -f values.yml -n jitsi
-
-# traefik set global argument for acme challenge needs.
-#  globalArguments:
-#  - "--global.checknewversion"
-#  - "--global.sendanonymoususage"
-#  - "--providers.kubernetescrd"
-#  - "--certificatesresolvers.myresolver.acme.tlschallenge"
-#  - "--certificatesresolvers.myresolver.acme.email=foo@you.com"
-#  - "--certificatesresolvers.myresolver.acme.storage=acme.json"
-#  Please note that this is the staging Let's Encrypt server.
-#  Once you get things working, you should remove that whole line altogether.
-#  - "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-
-helm repo add traefik https://helm.traefik.io/traefik
-sudo -E helm upgrade traefik traefik/traefik  --install -n kube-system --reuse-values -f traefik-values.yml

ct.yaml

@@ -0,0 +1,8 @@
+# See https://github.com/helm/chart-testing#configuration
+remote: origin
+target-branch: main
+chart-dirs:
+  - .
+chart-repos:
+  - jitsi=https://jitsi-contrib.github.io/jitsi-helm
+helm-extra-args: --timeout 600s

deploy_jitsi.sh

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+
+function err {
+    echo -e $1 1>&2
+    exit 1
+}
+
+# check usage
+if [ $# -ne 1 ] && [ $# -ne 2 ]; then
+  err "usage: $0 <fully-qualified-host-name> [<acme_email_address>]"
+fi
+
+# check sudo
+if [ $EUID -ne 0 ]; then
+  err "sudo?"
+fi
+
+# host OS packages
+apt update && apt -y install grep bind9-dnsutils iproute2 curl wget git
+
+# parameters
+export FQDN=$1
+export ACME_EMAIL=$2
+
+if [ -n "${TLS_CERT}" ] && [ -n "${TLS_KEY}" ]; then
+  CERT_RESOLVER=""
+else
+  if [ -z "${ACME_EMAIL}" ]; then
+    err "<acme_email_address> is required if no TLS cert is provided in TLS_CERT and TLS_KEY envvars"
+  fi
+  if [ -n "${STAGING_CERT}" ]; then
+    CERT_RESOLVER="le-staging"
+  else
+    CERT_RESOLVER="le-prod"
+  fi
+fi
+export CERT_RESOLVER
+
+if [[ "${FQDN}" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  export PUBLIC_IP=${FQDN}
+  export FQDN=""
+  if [ -z "${TLS_CERT}" ] || [ -z "${TLS_KEY}" ]; then
+    err "both of 'TLS_CERT' and 'TLS_KEY' envvars should be specified when deploying without domain name"
+  fi
+else
+  export PUBLIC_IP=$(nslookup ${FQDN} | grep -A1 Name: | grep Address: | cut -d' ' -f2 | grep -v ':' | head -1)
+fi
+
+if [ -z "${PUBLIC_IP}" ]; then
+  err "can't resolve hostname: ${1}"
+else
+  echo "resolved hostname '${1}' to ip address ${PUBLIC_IP}"
+fi
+
+if [ ${FQDN} != "localhost" ] && ! (curl -s https://ipinfo.io/ip | grep -q ${PUBLIC_IP}); then
+  err "the host doesn't have such public ip: ${PUBLIC_IP}, but these: \n$(curl -s https://ipinfo.io/ip)"
+fi
+
+if [ -z "${PORT}" ]; then
+  export PUBLIC_PORT=443
+  export PUBLIC_URL="https://${FQDN:-${PUBLIC_IP}}"
+else
+  export PUBLIC_PORT=${PORT}
+  export PUBLIC_URL="https://${FQDN:-${PUBLIC_IP}}:${PUBLIC_PORT}"
+fi
+
+if [ -n "${TEST_INSTALL}" ]; then
+  export HELM_NAME=jitsitest
+  export NAMESPACE=test
+  export JVB_PORT=30001
+else
+  export HELM_NAME=jitsi
+  export NAMESPACE=prod
+  export JVB_PORT=30000
+fi
+
+# versions
+K3S_VERSION=${K3S_VERSION:-"v1.24.1+k3s1"}
+HELM_VERSION=${HELM_VERSION:-"v3.9.0"}
+ARGOCD_VERSION=${ARGOCD_VERSION:-"v2.4.2"}
+HELM_ARCHIVE="helm-${HELM_VERSION}-linux-amd64.tar.gz"
+DEPLOY_GIT_REPO=${DEPLOY_GIT_REPO:-"https://github.com/shanghailug/jitsi-deploy.git"}
+
+# workspace
+WS_DIR=${HOME}/deploy/$(date +"%Y%m%d_%H%M%S")
+SRC_DIR=${WS_DIR}/jitsi-deploy
+mkdir -p ${WS_DIR}
+
+function get_helm {
+  if ! which helm || ! ( helm version | grep -q ${HELM_VERSION} ); then
+    cd ${WS_DIR}/
+    wget -nv https://get.helm.sh/${HELM_ARCHIVE}
+    tar -zxvf ${HELM_ARCHIVE}
+    mv $(find -type f -name helm) /usr/local/bin/
+  fi
+}
+
+function get_src {
+  cd ${WS_DIR}/
+  git clone ${DEPLOY_GIT_REPO}
+  cd $SRC_DIR/
+  if [ -n "${DEPLOY_GIT_VERSION}" ]; then
+    git checkout ${DEPLOY_GIT_VERSION}
+  fi
+}
+
+function do_k3s {
+  INSTALL_K3S=
+  # nuke
+  if [ -n "${NUKE_K3S}" ] && [ -f /usr/local/bin/k3s-uninstall.sh ]; then
+    /usr/local/bin/k3s-uninstall.sh
+    INSTALL_K3S=1
+  elif ! which k3s; then
+    INSTALL_K3S=1
+  fi
+
+  # install k3s
+  if [ -n "${INSTALL_K3S}" ]; then
+    curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=${K3S_VERSION} INSTALL_K3S_EXEC="--tls-san ${PUBLIC_IP}" sh -
+  fi
+
+  echo -n "waiting for k3s server node to become ready ."
+  while ! (kubectl get node | grep -q -w Ready); do
+    echo -n "."
+    sleep 1
+  done
+  echo "ready."
+  export KUBECONFIG=/etc/rancher/k3s/k3s.yaml
+  kubectl get node -o wide
+}
+
+function get_argocd {
+  if ! which argocd || ! (argocd -n argocd version --client | grep ^argocd: | grep -q ${ARGOCD_VERSION}); then
+    cd ${WS_DIR}/
+    wget -nv https://github.com/argoproj/argo-cd/releases/download/${ARGOCD_VERSION}/argocd-linux-amd64
+    chmod a+x argocd-linux-amd64
+    mv argocd-linux-amd64 /usr/local/bin/argocd
+  fi
+}
+
+function do_traefik {
+  cd ${SRC_DIR}/
+  ./traefik-config.yaml.sh | kubectl apply -f -
+
+  echo -n "waiting for helm-install-traefik to become ready ."
+  while [ $(kubectl -n kube-system get job | grep helm-install-traefik | grep -c '1/1') -ne 2 ]; do
+    echo -n "."
+    sleep 1
+  done
+  echo "ready."
+  kubectl -n kube-system get job -o wide
+
+  if [ -n "${TLS_CERT}" ] && [ -n "${TLS_KEY}" ]; then
+    if kubectl -n default get secret | grep -q tls-secret; then
+      kubectl -n default delete secret tls-secret
+    fi
+    kubectl -n default create secret tls tls-secret --cert ${TLS_CERT} --key ${TLS_KEY}
+    kubectl apply -f tlsstore.yaml
+  fi
+}
+
+function do_argocd {
+  cd ${SRC_DIR}/
+
+  kubectl create ns argocd --dry-run=client -o yaml | kubectl apply -f -
+  kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml
+  kubectl apply -f argocd/cmd-params-cm.yaml
+  kubectl -n argocd rollout restart deploy/argocd-server
+  argocd/ingressroute-server.yaml.sh | kubectl apply -f -
+  # ARGOCD_PASSWD=$(kubectl -n argocd get secret/argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d)
+
+  echo -n "waiting for argocd to become ready ."
+  while [ $(kubectl -n argocd get pods | grep -c '1/1') -ne 7 ]; do
+    echo -n "."
+    sleep 1
+  done
+  echo "ready."
+  kubectl -n argocd get all
+}
+
+function do_chart {
+  cd ${SRC_DIR}/jitsi
+
+  if [ -n "${EXCLUDE_JVB}" ]; then
+    EXCLUDE_JVB_VALUES_FILE="-f values-jvb-off.yaml"
+  fi
+
+  helm -n ${NAMESPACE} upgrade -i --create-namespace ${HELM_NAME} . \
+    -f values.yaml \
+    $EXCLUDE_JVB_VALUES_FILE \
+    --set certResolver=${CERT_RESOLVER} \
+    --set fqdn="${FQDN}" \
+    --set port=${PUBLIC_PORT} \
+    --set jitsi-meet.publicURL="${PUBLIC_URL}" \
+    --set jitsi-meet.jvb.publicIP=${PUBLIC_IP} \
+    --set jitsi-meet.jvb.UDPPort=${JVB_PORT}
+}
+
+function do_app {
+  cd ${WS_DIR}/
+
+  if [ -n "${DEPLOY_GIT_VERSION}" ]; then
+    SET_GIT_REVISION="--revision ${DEPLOY_GIT_VERSION}"
+  fi
+
+  if [ -n "${EXCLUDE_JVB}" ]; then
+    EXCLUDE_JVB_VALUES_FILE="--values values-jvb-off.yaml"
+  fi
+
+  argocd login --core
+  ORIG_NAMESPACE=$(kubectl config view --minify -o jsonpath='{..namespace}')
+  kubectl config set-context --current --namespace=argocd
+
+  kubectl create ns ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -
+  argocd app create ${HELM_NAME} \
+    --upsert \
+    --repo ${DEPLOY_GIT_REPO} \
+    --path jitsi \
+    ${SET_GIT_REVISION} \
+    --dest-server https://kubernetes.default.svc \
+    --dest-namespace ${NAMESPACE} \
+    --values values.yaml \
+    ${EXCLUDE_JVB_VALUES_FILE} \
+    --helm-set certResolver=${CERT_RESOLVER} \
+    --helm-set fqdn="${FQDN}" \
+    --helm-set port=${PUBLIC_PORT} \
+    --helm-set jitsi-meet.publicURL="${PUBLIC_URL}" \
+    --helm-set jitsi-meet.jvb.publicIP=${PUBLIC_IP} \
+    --helm-set jitsi-meet.jvb.UDPPort=${JVB_PORT}
+
+  sleep 5 # there is a race if sync happens too quickly, so that it becomes a partial sync
+  argocd app sync ${HELM_NAME}
+  kubectl config set-context --current --namespace=${ORIG_NAMESPACE}
+}
+
+# installation starts from here
+(
+  get_helm
+
+  get_src
+
+  do_k3s
+
+  get_argocd # 'argocd version' depends on k3s setup
+
+  do_traefik
+
+  do_argocd
+
+  do_app
+
+# installation ends here
+) 2>&1 | tee ${WS_DIR}/deploy.log

jitsi/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: jitsi-meet
+  repository: ""
+  version: 1.2.2+etherpad.1
+digest: sha256:8ef0f113e499152fd5b0a2861d93713bdd3e9e4ea0e57b7be2992a7947e748ff
+generated: "2022-05-22T10:40:05.978749+08:00"

jitsi/Chart.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v2
+name: jitsi-deploy
+version: 0.1.6
+dependencies:
+  - name: jitsi-meet
+    version: "1.2.2+etherpad.1"

jitsi/charts/jitsi-meet/.helmignore

@@ -0,0 +1,25 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# GitHub Pages
+docs/

jitsi/charts/jitsi-meet/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: prosody
+  repository: ""
+  version: '*'
+digest: sha256:fa9f3f9cfe91aefb81520e7b941b3412241dba7e1631a69138f0fe328c3795ff
+generated: "2020-07-15T11:12:58.968506151+02:00"

jitsi/charts/jitsi-meet/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: stable-7287
+dependencies:
+- condition: prosody.enabled
+  name: prosody
+  version: 1.2.2
+description: A Helm chart for Kubernetes
+name: jitsi-meet
+type: application
+version: "1.2.2+etherpad.1"

jitsi/charts/jitsi-meet/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 jitsi-contrib
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

jitsi/charts/jitsi-meet/README.md

@@ -0,0 +1,157 @@
+# Helm Chart for Jitsi Meet
+
+[jitsi-meet](https://jitsi.org/jitsi-meet/) Secure, Simple and Scalable Video Conferences that you use as a standalone app or embed in your web application.
+
+## TL;DR;
+
+```bash
+helm repo add jitsi https://jitsi-contrib.github.io/jitsi-helm/
+helm install myjitsi jitsi/jitsi-meet
+```
+
+## Introduction
+
+This chart bootstraps a jitsi-meet deployment, like the official [one](https://meet.jit.si).
+
+## Different topology
+
+To be able to do video conferencing with other people, the jvb component should be reachable by all participants (eg: a public IP).
+Thus the default behaviour of advertised the internal IP of jvb, is not really suitable in many cases.
+Kubernetes offers multiple possibilities to work around the problem. Not all options are available depending on the Kubernetes cluster setup.
+The chart tries to make all options available without enforcing one.
+
+### Option 1: service of type `LoadBalancer`
+
+This requires a cloud setup that enables a Loadbalancer attachement.
+This could be enabled via values:
+
+```yaml
+jvb:
+  service:
+    type: LoadBalancer
+
+  # Depending on the cloud, publicIP cannot be know in advance, so deploy first, without the next option.
+  # Next: redeploy with the following option set to the public IP you retrieved from the API.
+  publicIP: 1.2.3.4
+```
+
+In this case you're not allowed to change the `jvb.replicaCount` to more than `1`, UDP packets will be routed to random `jvb`, which would not allow for a working video setup.
+
+### Option 2: NodePort and node with Public IP or external loadbalancer
+
+```yaml
+jvb:
+  service:
+    type: NodePort
+  # It may be required to change the default port to a value allowed by Kubernetes (30000-32768)
+  UDPPort: 30000
+
+  # Use public IP of one of your node, or the public IP of a loadbalancer in front of the nodes
+  publicIP: 1.2.3.4
+```
+
+In this case you're not allowed to change the `jvb.replicaCount` to more than `1`, UDP packets will be routed to random `jvb`, which would not allow for a working video setup.
+
+### Option 3: hostPort and node with Public IP
+
+Assuming that the node knows the PublicIP it holds, you can enable this setup:
+
+```yaml
+jvb:
+  useHostPort: true
+  # This option requires kubernetes >= 1.17
+  useNodeIP: true
+```
+
+In this case you can have more the one `jvb` but you're putting you cluster at risk by having it directly exposed on the Internet.
+
+### Option 4: Use ingress TCP/UDP forward capabilities
+
+In case of an ingress capable of doing tcp/udp forwarding (like nginx-ingress), it can be setup to forward the video streams.
+
+```yaml
+# Don't forget to configure the ingress properly (separate configuration)
+jvb:
+  # 1.2.3.4 being one of the IP of the ingress controller
+  publicIP: 1.2.3.4
+
+```
+
+Again in this case, only one jvb will work in this case.
+
+### Option 5: Bring your own setup
+
+There are multiple other possibilities combining the available parameters, depending of your cluster/network setup.
+
+
+
+## Configuration
+
+The following table lists the configurable parameters of the jisti-meet chart and their default values.
+
+Parameter | Description | Default
+--- | --- | ---
+`imagePullSecrets` | List of names of secrets resources containing private registry credentials | `[]`
+`enableAuth` | Enable authentication | `false`
+`enableGuests` | Enable guest access | `true`
+`jibri.enabled` | Enable Jibri service | `false`
+`jibri.persistence.enabled` | Enable persistent storage for Jibri recordings | `false`
+`jibri.persistence.size` | Jibri persistent storage size | `4Gi`
+`jibri.persistence.existingClaim` | Use pre-created PVC for Jibri | `(unset)`
+`jibri.persistence.storageClassName` | StorageClass to use with Jibri | `(unset)`
+`jibri.shm.enabled` | Allocate shared memory to Jibri pod | `false`
+`jibri.shm.useHost` | Pass `/dev/shm` from host to Jibri | `false`
+`jibri.shm.size` | Jibri shared memory size | `256Mi`
+`jibri.replicaCount` | Number of replica of the jibri pods | `1`
+`jibri.image.repository` | Name of the image to use for the jibri pods | `jitsi/jibri`
+`jibri.extraEnvs` | Map containing additional environment variables for jibri | '{}'
+`jibri.livenessProbe` | Map that holds the liveness probe, you can add parameters such as timeout or retries following the Kubernetes spec | A livenessProbe map
+`jibri.readinessProbe` | Map that holds the liveness probe, you can add parameters such as timeout or retries following the Kubernetes spec | A readinessProbe map
+`jibri.breweryMuc` | Name of the XMPP MUC used by jibri | `jibribrewery`
+`jibri.xmpp.user` | Name of the XMPP user used by jibri to authenticate | `jibri`
+`jibri.xmpp.password` | Password used by jibri to authenticate on the XMPP service | 10 random chars
+`jibri.recorder.user` | Name of the XMPP user used by jibri to record | `recorder`
+`jibri.recorder.password` | Password used by jibri to record on the XMPP service | 10 random chars
+`jicofo.replicaCount` | Number of replica of the jicofo pods | `1`
+`jicofo.image.repository` | Name of the image to use for the jicofo pods | `jitsi/jicofo`
+`jicofo.extraEnvs` | Map containing additional environment variables for jicofo | '{}'
+`jicofo.livenessProbe` | Map that holds the liveness probe, you can add parameters such as timeout or retries following the Kubernetes spec | A livenessProbe map
+`jicofo.readinessProbe` | Map that holds the liveness probe, you can add parameters such as timeout or retries following the Kubernetes spec | A readinessProbe map
+`jicofo.xmpp.user` | Name of the XMPP user used by jicofo to authenticate | `focus`
+`jicofo.xmpp.password` | Password used by jicofo to authenticate on the XMPP service | 10 random chars
+`jicofo.xmpp.componentSecret` | Values of the secret used by jicofo for the xmpp-component | 10 random chars
+`jvb.service.enabled` | Boolean to enable os disable the jvb service creation | `false` if `jvb.useHostPort` is `true` otherwise `true`
+`jvb.service.type` | Type of the jvb service | `ClusterIP`
+`jvb.UDPPort` | UDP port used by jvb, also affects port of service, and hostPort | `10000`
+`jvb.extraEnvs` | Map containing additional environment variables to jvb | '{}'
+`jvb.xmpp.user` | Name of the XMPP user used by jvb to authenticate | `jvb`
+`jvb.xmpp.password` | Password used by jvb to authenticate on the XMPP service | 10 random chars
+`jvb.livenessProbe` | Map that holds the liveness probe, you can add parameters such as timeout or retries following the Kubernetes spec | A livenessProbe map
+`jvb.readinessProbe` | Map that holds the liveness probe, you can add parameters such as timeout or retries following the Kubernetes spec | A readinessProbe map
+`jvb.websockets.enabled` | Enable WebSocket support for JVB/Colibri | `false`
+`jvb.websockets.serverID` | Set JVB/Colibri WS Server ID | `podIP` (see `values.yaml`)
+`jvb.metrics.enabled` | Boolean that control the metrics exporter for jvb. If true the `ServiceMonitor` will also created | `false`
+`jvb.metrics.prometheusAnnotations` | Boolean that controls the generation of prometheus annotations, to expose metrics for HPA | `false`
+`jvb.metrics.image.repository` | Default image repository for metrics exporter | `docker.io/systemli/prometheus-jitsi-meet-exporter`
+`jvb.metrics.image.tag` | Default tag for metrics exporter | `1.1.5`
+`jvb.metrics.image.pullPolicy` | ImagePullPolicy for metrics exporter | `IfNotPresent`
+`jvb.metrics.serviceMonitor.enabled` | `ServiceMonitor` for Prometheus | `true`
+`jvb.metrics.serviceMonitor.selector` | Selector for `ServiceMonitor` | `{ release: prometheus-operator }`
+`jvb.metrics.serviceMonitor.interval` | Interval for `ServiceMonitor` | `10s`
+`jvb.metrics.serviceMonitor.honorLabels` | Make `ServiceMonitor` honor labels | `false`
+`jvb.metrics.resources` | Resources for the metrics container | `{ requests: { cpu: 10m, memory: 16Mi }, limits: { cpu: 20m, memory: 32Mi } }`
+`octo.enabled` | Boolean to enable or disable the OCTO mode, for a single region | `false`
+`web.httpsEnabled` | Boolean that enabled tls-termination on the web pods. Useful if you expose the UI via a `Loadbalancer` IP instead of an ingress | `false`
+`web.httpRedirect` | Boolean that enabled http-to-https redirection. Useful for ingress that don't support this feature (ex: GKE ingress) | `false`
+`web.resolverIP` | DNS service IP for Web container to use | (unset)
+`web.extraEnvs` | Map containing additional environment variable to web pods | '{}'
+`web.livenessProbe` | Map that holds the liveness probe, you can add parameters such as timeout or retries following the Kubernetes spec | A livenessProbe map
+`web.readinessProbe` | Map that holds the liveness probe, you can add parameters such as timeout or retries following the Kubernetes spec | A readinessProbe map
+`tz` | System Time Zone | `Europe/Amsterdam`
+
+## Package
+
+```bash
+helm package . -d docs
+helm repo index docs --url https://jitsi-contrib.github.io/jitsi-helm/
+```

jitsi/charts/jitsi-meet/charts/prosody/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

jitsi/charts/jitsi-meet/charts/prosody/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+appVersion: 0.11.13
+description: A Helm chart for Kubernetes
+name: prosody
+type: application
+version: 1.2.2

jitsi/charts/jitsi-meet/charts/prosody/templates/NOTES.txt

@@ -0,0 +1,21 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "prosody.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "prosody.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "prosody.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "prosody.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:80
+{{- end }}

jitsi/charts/jitsi-meet/charts/prosody/templates/_helpers.tpl

@@ -0,0 +1,63 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "prosody.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "prosody.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "prosody.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "prosody.labels" -}}
+helm.sh/chart: {{ include "prosody.chart" . }}
+{{ include "prosody.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "prosody.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "prosody.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "prosody.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "prosody.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

jitsi/charts/jitsi-meet/charts/prosody/templates/envs-configmap.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "prosody.fullname" . }}
+  labels:
+    {{- include "prosody.labels" . | nindent 4 }}
+data:
+  {{- range $key, $value := .Values.env }}
+  {{- if not (kindIs "invalid" $value) }}
+  {{ $key }}: {{ tpl $value $ | quote }}
+  {{- end }}
+  {{- end }}

jitsi/charts/jitsi-meet/charts/prosody/templates/envs-secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "prosody.fullname" . }}
+  labels:
+    {{- include "prosody.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- range $key, $value := .Values.secretEnvs }}
+  {{- if not (kindIs "invalid" $value) }}
+  {{ $key }}: {{ tpl $value $ | b64enc }}
+  {{- end }}
+  {{- end }}

jitsi/charts/jitsi-meet/charts/prosody/templates/ingress.yaml

@@ -0,0 +1,56 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "prosody.fullname" . -}}
+{{- $svcPort := index .Values.service.ports "bosh-insecure" -}}
+{{- $kubeVersion := .Capabilities.KubeVersion.GitVersion -}}
+{{- if semverCompare ">=1.19-0" $kubeVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" $kubeVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "prosody.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+  rules:
+  {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+        {{- range .paths }}
+          - path: {{ . }}
+            pathType: Prefix
+            backend:
+            {{ if semverCompare ">=1.19-0" $kubeVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  {{ if kindIs "float64" $svcPort }}
+                  number: {{ $svcPort }}
+                  {{ else }}
+                  name: {{ $svcPort }}
+                  {{ end }}
+            {{ else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+            {{ end }}
+        {{- end }}
+  {{- end }}
+{{- end }}

jitsi/charts/jitsi-meet/charts/prosody/templates/service.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "prosody.fullname" . }}
+  labels:
+    {{- include "prosody.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ index .Values.service.ports "bosh-insecure" }}
+      protocol: TCP
+      name: tcp-bosh-insecure
+    - port: {{ index .Values.service.ports "bosh-secure" }}
+      protocol: TCP
+      name: tcp-bosh-secure
+    - port: {{ index .Values.service.ports "xmpp-component" }}
+      protocol: TCP
+      name: tcp-xmpp-component
+    - port: {{ index .Values.service.ports "xmpp-c2s" }}
+      protocol: TCP
+      name: tcp-xmpp-c2
+    - port: {{ index .Values.service.ports "xmpp-s2s" }}
+      protocol: TCP
+      name: tcp-xmpp-s2
+  selector:
+    {{- include "prosody.selectorLabels" . | nindent 4 }}

jitsi/charts/jitsi-meet/charts/prosody/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "prosody.serviceAccountName" . }}
+  labels:
+    {{- include "prosody.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end -}}

jitsi/charts/jitsi-meet/charts/prosody/templates/statefulset.yaml

@@ -0,0 +1,130 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "prosody.fullname" . }}
+  labels:
+    {{- include "prosody.labels" . | nindent 4 }}
+  {{- with .Values.annotations }}
+  annotations:
+    {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  serviceName: "prosody"
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "prosody.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "prosody.selectorLabels" . | nindent 8 }}
+      {{- range $label, $value := mergeOverwrite .Values.global.podLabels .Values.podLabels }}
+        {{ $label }}: {{ $value }}
+      {{- end }}
+      {{- with mergeOverwrite .Values.global.podAnnotations .Values.podAnnotations }}
+      annotations:
+      {{- range $annotation, $value := . }}
+        {{ $annotation }}: {{ $value }}
+      {{- end }}
+      {{- end }}
+    spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      serviceAccountName: {{ include "prosody.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ tpl (default .Chart.AppVersion .Values.image.tag ) . }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          envFrom:
+          - configMapRef:
+              name: {{ include "prosody.fullname" . }}
+          - secretRef:
+              name: {{ include "prosody.fullname" . }}
+          {{- range .Values.extraEnvFrom }}
+          - {{ tpl (toYaml . ) $ | indent 12 | trim }}
+          {{- end }}
+          {{- if .Values.extraEnvs }}
+          env:
+          {{- range .Values.extraEnvs }}
+          - {{ tpl (toYaml . ) $ | indent 12 | trim }}
+          {{- end }}
+          {{- end }}
+          ports:
+            - name: xmpp-c2s
+              containerPort: {{ index .Values.service.ports "xmpp-c2s" }}
+              protocol: TCP
+            - name: xmpp-s2s
+              containerPort: {{ index .Values.service.ports "xmpp-s2s" }}
+              protocol: TCP
+            - name: xmpp-component
+              containerPort: {{ index .Values.service.ports "xmpp-component" }}
+              protocol: TCP
+            - name: bosh-insecure
+              containerPort: {{ index .Values.service.ports "bosh-insecure" }}
+              protocol: TCP
+            - name: bosh-secure
+              containerPort: {{ index .Values.service.ports "bosh-secure" }}
+              protocol: TCP
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+          - name: prosody-data
+            mountPath: {{ .Values.dataDir }}
+          {{- with .Values.extraVolumeMounts }}
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+      volumes:
+      - name: prosody-data
+        {{- if .Values.persistence.enabled }}
+        persistentVolumeClaim:
+          claimName: prosody-data
+        {{- else }}
+        emptyDir: {}
+        {{- end }}
+      {{- with .Values.extraVolumes }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- if or .Values.persistence.enabled .Values.extraVolumeClaimTemplates }}
+  volumeClaimTemplates:
+  - metadata:
+      name: prosody-data
+    spec:
+      accessModes:
+        - ReadWriteOnce
+      volumeMode: Filesystem
+      resources:
+        requests:
+          storage: {{ .Values.persistence.size }}
+      {{- with .Values.persistence.storageClassName }}
+      storageClassName: {{ . | quote }}
+      {{- end }}
+  {{- with .Values.extraVolumeClaimTemplates }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+  {{- end }}

jitsi/charts/jitsi-meet/charts/prosody/templates/tests/test-connection.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "prosody.fullname" . }}-test-connection"
+  labels:
+    {{- include "prosody.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test-success
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "prosody.fullname" . }}:{{ index .Values.service.ports "bosh-insecure" }}/http-bind']
+  restartPolicy: Never

jitsi/charts/jitsi-meet/charts/prosody/values.yaml

@@ -0,0 +1,94 @@
+# Default values for prosody.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+image:
+  repository: nginx
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+domain:
+
+dataDir: /config/data
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+
+podLabels: {}
+podAnnotations: {}
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  ports:
+    bosh-insecure: 5280
+    bosh-secure: 5281
+    xmpp-c2s: 5222
+    xmpp-s2s: 5269
+    xmpp-component: 5347
+
+ingress:
+  enabled: false
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  hosts:
+    - host: chart-example.local
+      paths: []
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - chart-example.local
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+livenessProbe:
+  httpGet:
+    path: /http-bind
+    port: bosh-insecure
+readinessProbe:
+  httpGet:
+    path: /http-bind
+    port: bosh-insecure
+
+persistence:
+  enabled: true
+  size: 3G
+  storageClassName:
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+extraEnvs: []
+extraEnvFrom: []
+secretEnvs: {}

jitsi/charts/jitsi-meet/templates/NOTES.txt

@@ -0,0 +1,21 @@
+1. Get the application URL by running these commands:
+{{- if .Values.web.ingress.enabled }}
+{{- range $host := .Values.web.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.web.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.web.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "jitsi-meet.web.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.web.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "jitsi-meet.web.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "jitsi-meet.web.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.web.service.port }}
+{{- else if contains "ClusterIP" .Values.web.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "jitsi-meet.name" . }},app.kubernetes.io/component=web,app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:80
+{{- end }}

jitsi/charts/jitsi-meet/templates/_helpers.tpl

@@ -0,0 +1,104 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "jitsi-meet.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "jitsi-meet.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "jitsi-meet.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "jitsi-meet.labels" -}}
+helm.sh/chart: {{ include "jitsi-meet.chart" . }}
+{{ include "jitsi-meet.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "jitsi-meet.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "jitsi-meet.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "jitsi-meet.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "jitsi-meet.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+  https://github.com/helm/helm/issues/4535
+*/}}
+{{- define "call-nested" }}
+{{- $dot := index . 0 }}
+{{- $subchart := index . 1 }}
+{{- $template := index . 2 }}
+{{- include $template (dict "Chart" (dict "Name" $subchart) "Values" (index $dot.Values $subchart) "Release" $dot.Release "Capabilities" $dot.Capabilities) }}
+{{- end }}
+
+{{- define "jitsi-meet.xmpp.domain" -}}
+{{- if  .Values.xmpp.domain -}}
+  {{ .Values.xmpp.domain }}
+{{- else -}}
+  {{ .Release.Namespace }}.svc
+{{- end -}}
+{{- end -}}
+
+{{- define "jitsi-meet.xmpp.server" -}}
+{{- if .Values.prosody.server -}}
+  {{ .Values.prosody.server }}
+{{- else -}}
+  {{ include "call-nested" (list . "prosody" "prosody.fullname") }}.{{ .Release.Namespace }}.svc
+{{- end -}}
+{{- end -}}
+
+
+{{- define "jitsi-meet.publicURL" -}}
+{{- if .Values.publicURL }}
+{{- .Values.publicURL -}}
+{{- else -}}
+{{- if .Values.web.ingress.tls -}}https://{{- else -}}http://{{- end -}}
+{{- if .Values.web.ingress.tls -}}
+{{- (.Values.web.ingress.tls|first).hosts|first -}}
+{{- else if .Values.web.ingress.hosts -}}
+{{- (.Values.web.ingress.hosts|first).host -}}
+{{ required "You need to define a publicURL or some value for ingress" .Values.publicURL }}
+{{- end -}}
+{{- end -}}
+{{- end -}}

jitsi/charts/jitsi-meet/templates/common-configmap.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-common
+  labels:
+    {{- include "jitsi-meet.labels" . | nindent 4 }}
+data:
+  ENABLE_AUTH: {{ ternary "1" "0" .Values.enableAuth | quote }}
+  ENABLE_GUESTS: {{ ternary "1" "0" .Values.enableGuests | quote }}
+  PUBLIC_URL: {{ include "jitsi-meet.publicURL" . }}
+  XMPP_DOMAIN: {{ include "jitsi-meet.xmpp.domain" . }}
+  XMPP_MUC_DOMAIN: {{ .Values.xmpp.mucDomain | default (printf "muc.%s" (include "jitsi-meet.xmpp.domain" .)) }}
+  XMPP_AUTH_DOMAIN: {{ .Values.xmpp.authDomain | default (printf "auth.%s" (include "jitsi-meet.xmpp.domain" .)) }}
+  XMPP_GUEST_DOMAIN: {{ .Values.xmpp.guestDomain | default (printf "guest.%s" (include "jitsi-meet.xmpp.domain" .)) }}
+  XMPP_RECORDER_DOMAIN: {{ .Values.xmpp.recorderDomain | default (printf "recorder.%s" (include "jitsi-meet.xmpp.domain" .)) }}
+  XMPP_INTERNAL_MUC_DOMAIN: {{ .Values.xmpp.internalMucDomain | default (printf "internal-muc.%s" (include "jitsi-meet.xmpp.domain" .)) }}
+  {{- if .Values.jibri.enabled }}
+  ENABLE_RECORDING: "true"
+  {{- end }}
+  TZ: '{{ .Values.tz }}'
+  {{- range $key, $value := .Values.extraCommonEnvs }}
+  {{- if not (kindIs "invalid" $value) }}
+  {{ $key }}: {{ tpl $value $ | quote }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.octo.enabled }}
+  ENABLE_OCTO: "1"
+  TESTING_OCTO_PROBABILITY: "1"
+  DEPLOYMENTINFO_REGION: "all"
+  DEPLOYMENTINFO_USERREGION: "all"
+  {{- end }}

jitsi/charts/jitsi-meet/templates/etherpad/_helper.tpl

@@ -0,0 +1,13 @@
+{{- define "jitsi-meet.etherpad.fullname" -}}
+{{ include "jitsi-meet.fullname" . }}-etherpad
+{{- end -}}
+
+{{- define "jitsi-meet.etherpad.labels" -}}
+{{ include "jitsi-meet.labels" . }}
+app.kubernetes.io/component: etherpad
+{{- end -}}
+
+{{- define "jitsi-meet.etherpad.selectorLabels" -}}
+{{ include "jitsi-meet.selectorLabels" . }}
+app.kubernetes.io/component: etherpad
+{{- end -}}

jitsi/charts/jitsi-meet/templates/etherpad/deployment.yaml

@@ -0,0 +1,48 @@
+{{- if .Values.etherpad.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "jitsi-meet.etherpad.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.etherpad.labels" . | nindent 4 }}
+  {{- with .Values.etherpad.annotations }}
+  annotations:
+    {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.etherpad.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "jitsi-meet.etherpad.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "jitsi-meet.etherpad.selectorLabels" . | nindent 8 }}
+    spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      serviceAccountName: {{ include "jitsi-meet.serviceAccountName" . }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.etherpad.securityContext | nindent 12 }}
+          image: "{{ .Values.etherpad.image.repository }}:{{ .Values.etherpad.image.tag }}"
+          imagePullPolicy: {{ pluck "pullPolicy" .Values.etherpad.image .Values.image | first }}
+          ports:
+          - name: http
+            containerPort: 9001
+            protocol: TCP
+          {{- with .Values.etherpad.livenessProbe }}
+          livenessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.etherpad.readinessProbe }}
+          readinessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+
+          resources:
+            {{- toYaml .Values.etherpad.resources | nindent 12 }}
+{{- end }}

jitsi/charts/jitsi-meet/templates/etherpad/service.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.etherpad.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "jitsi-meet.etherpad.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.etherpad.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 9001
+    targetPort: 9001
+    protocol: TCP
+  selector:
+    {{- include "jitsi-meet.etherpad.selectorLabels" . | nindent 4 }}
+{{- end }}

jitsi/charts/jitsi-meet/templates/ingress.yaml

@@ -0,0 +1,59 @@
+{{- if .Values.web.ingress.enabled -}}
+{{- $fullName := include "jitsi-meet.web.fullname" . -}}
+{{- $svcPort := .Values.web.service.port -}}
+{{- $kubeVersion := .Capabilities.KubeVersion.GitVersion -}}
+{{- if semverCompare ">=1.19-0" $kubeVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" $kubeVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "jitsi-meet.web.labels" . | nindent 4 }}
+  {{- with .Values.web.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+{{- if and .Values.web.ingress.ingressClassName (semverCompare ">=1.19-0" $kubeVersion) }}
+  ingressClassName: {{ .Values.web.ingress.ingressClassName }}
+{{- end }}
+{{- if .Values.web.ingress.tls }}
+  tls:
+  {{- range .Values.web.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+  rules:
+  {{- range .Values.web.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+        {{- range .paths }}
+          - path: {{ . }}
+            pathType: Prefix
+            backend:
+            {{ if semverCompare ">=1.19-0" $kubeVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  {{ if kindIs "float64" $svcPort }}
+                  number: {{ $svcPort }}
+                  {{ else }}
+                  name: {{ $svcPort }}
+                  {{ end }}
+            {{ else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+            {{ end }}
+        {{- end }}
+  {{- end }}
+{{- end }}

jitsi/charts/jitsi-meet/templates/jibri/_helper.tpl

@@ -0,0 +1,18 @@
+
+{{- define "jitsi-meet.jibri.fullname" -}}
+{{ include "jitsi-meet.fullname" . }}-jibri
+{{- end -}}
+
+{{- define "jitsi-meet.jibri.labels" -}}
+{{ include "jitsi-meet.labels" . }}
+app.kubernetes.io/component: jibri
+{{- end -}}
+
+{{- define "jitsi-meet.jibri.selectorLabels" -}}
+{{ include "jitsi-meet.selectorLabels" . }}
+app.kubernetes.io/component: jibri
+{{- end -}}
+
+{{- define "jitsi-meet.jibri.secret" -}}
+{{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jibri
+{{- end -}}

jitsi/charts/jitsi-meet/templates/jibri/configmap.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.jibri.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "jitsi-meet.jibri.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jibri.labels" . | nindent 4 }}
+data:
+  XMPP_SERVER: '{{ include "jitsi-meet.xmpp.server" . }}'
+  JIBRI_BREWERY_MUC: '{{ .Values.jibri.breweryMuc }}'
+  JIBRI_RECORDING_DIR: '{{ .Values.jibri.recordingDir | default "/data/recordings" }}'
+  JIBRI_FINALIZE_RECORDING_SCRIPT_PATH: "/config/finalize.sh"
+  JIBRI_STRIP_DOMAIN_JID: muc
+  JIBRI_LOGS_DIR: "/data/logs"
+  DISPLAY: ":0"
+  {{- range $key, $value := .Values.jibri.extraEnvs }}
+  {{- if not (kindIs "invalid" $value) }}
+  {{ $key }}: {{ tpl $value $ | quote }}
+  {{- end }}
+  {{- end }}
+{{- end }}

jitsi/charts/jitsi-meet/templates/jibri/deployment.yaml

@@ -0,0 +1,93 @@
+{{- if .Values.jibri.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "jitsi-meet.jibri.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jibri.labels" . | nindent 4 }}
+  {{- with .Values.jibri.annotations }}
+  annotations:
+    {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.jibri.replicaCount | default 1 }}
+  selector:
+    matchLabels:
+      {{- include "jitsi-meet.jibri.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "jitsi-meet.jibri.selectorLabels" . | nindent 8 }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/jibri/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/jibri/xmpp-secret.yaml") . | sha256sum }}
+    spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      serviceAccountName: {{ include "jitsi-meet.serviceAccountName" . }}
+      containers:
+      - name: {{ .Chart.Name }}
+        securityContext:
+          privileged: true
+        image: "{{ .Values.jibri.image.repository }}:{{ default .Chart.AppVersion .Values.jibri.image.tag }}"
+        imagePullPolicy: {{ pluck "pullPolicy" .Values.jibri.image .Values.image | first }}
+        ports:
+        - name: http-internal
+          containerPort: 3333
+        - name: http-api
+          containerPort: 2222
+        {{- with default .Values.jibri.livenessProbe .Values.jibri.livenessProbeOverride }}
+        livenessProbe:
+        {{- toYaml . | nindent 10 }}
+        {{- end }}
+        {{- with default .Values.jibri.readinessProbe .Values.jibri.readinessProbeOverride }}
+        readinessProbe:
+        {{- toYaml . | nindent 10 }}
+        {{- end }}
+
+        envFrom:
+        - secretRef:
+            name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jibri
+        - configMapRef:
+            name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-common
+        - configMapRef:
+            name: {{ include "jitsi-meet.jibri.fullname" . }}
+
+        resources:
+          {{- toYaml .Values.jibri.resources | nindent 12 }}
+
+        volumeMounts:
+        - name: jibri-data
+          mountPath: /data
+        - name: dev-snd
+          mountPath: /dev/snd
+        {{- if .Values.jibri.shm.enabled }}
+        - name: dev-shm
+          mountPath: /dev/shm
+        {{- end }}
+
+      volumes:
+      - name: jibri-data
+        {{- if .Values.jibri.persistence.enabled }}
+        persistentVolumeClaim:
+          claimName: {{ .Values.jibri.persistence.existingClaim | default (include "jitsi-meet.jibri.fullname" .) }}
+        {{- else }}
+        emptyDir: {}
+        {{- end }}
+      - name: dev-snd
+        hostPath:
+          path: /dev/snd
+      {{- if .Values.jibri.shm.enabled }}
+      - name: dev-shm
+      {{-   if .Values.jibri.shm.useHost }}
+        hostPath:
+          path: /dev/shm
+      {{-   else }}
+        emptyDir:
+          medium: Memory
+          sizeLimit: {{ .Values.jibri.shm.size | default "256Mi" | quote }}
+      {{-   end }}
+      {{- end }}
+{{- end }}

jitsi/charts/jitsi-meet/templates/jibri/persistentvolumeclaim.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.jibri.enabled .Values.jibri.persistence.enabled (not .Values.jibri.persistence.existingClaim)}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "jitsi-meet.jibri.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jibri.labels" . | nindent 4 }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.jibri.persistence.size | quote }}
+  {{- with .Values.jibri.persistence.storageClassName }}
+  storageClassName: {{ . | quote }}
+  {{- end }}
+{{- end -}}

jitsi/charts/jitsi-meet/templates/jibri/service.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.jibri.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "jitsi-meet.jibri.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jibri.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: http-internal
+    port: 3333
+    targetPort: 3333
+    protocol: TCP
+  - name: http-api
+    port: 2222
+    targetPort: 2222
+    protocol: TCP
+  selector:
+    {{- include "jitsi-meet.jibri.selectorLabels" . | nindent 4 }}
+{{- end }}

jitsi/charts/jitsi-meet/templates/jibri/xmpp-secret.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.jibri.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jibri
+  labels:
+    {{- include "jitsi-meet.jibri.labels" . | nindent 4 }}
+type: Opaque
+data:
+  JIBRI_XMPP_USER: '{{ .Values.jibri.xmpp.user | b64enc }}'
+  JIBRI_XMPP_PASSWORD: '{{ default (randAlphaNum 10) .Values.jibri.xmpp.password | b64enc }}'
+  JIBRI_RECORDER_USER: '{{ .Values.jibri.recorder.user | b64enc }}'
+  JIBRI_RECORDER_PASSWORD: '{{ default (randAlphaNum 10) .Values.jibri.recorder.password | b64enc }}'
+{{- end }}

jitsi/charts/jitsi-meet/templates/jicofo/_helper.tpl

@@ -0,0 +1,18 @@
+
+{{- define "jitsi-meet.jicofo.fullname" -}}
+{{ include "jitsi-meet.fullname" . }}-jicofo
+{{- end -}}
+
+{{- define "jitsi-meet.jicofo.labels" -}}
+{{ include "jitsi-meet.labels" . }}
+app.kubernetes.io/component: jicofo
+{{- end -}}
+
+{{- define "jitsi-meet.jicofo.selectorLabels" -}}
+{{ include "jitsi-meet.selectorLabels" . }}
+app.kubernetes.io/component: jicofo
+{{- end -}}
+
+{{- define "jitsi-meet.jicofo.secret" -}}
+{{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jicofo
+{{- end -}}

jitsi/charts/jitsi-meet/templates/jicofo/configmap.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "jitsi-meet.jicofo.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jicofo.labels" . | nindent 4 }}
+data:
+  JVB_BREWERY_MUC: '{{ .Values.jvb.breweryMuc }}'
+  XMPP_SERVER: '{{ include "jitsi-meet.xmpp.server" . }}'
+  {{- if .Values.jibri.enabled }}
+  JIBRI_BREWERY_MUC: '{{ .Values.jibri.breweryMuc }}'
+  JIBRI_PENDING_TIMEOUT: '{{ .Values.jibri.timeout }}'
+  {{- end }}
+  {{- range $key, $value := .Values.jicofo.extraEnvs }}
+  {{- if not (kindIs "invalid" $value) }}
+  {{ $key }}: {{ tpl $value $ | quote }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.octo.enabled }}
+  ENABLE_OCTO: "1"
+  OCTO_BRIDGE_SELECTION_STRATEGY: "SplitBridgeSelectionStrategy"
+  {{- end }}

jitsi/charts/jitsi-meet/templates/jicofo/deployment.yaml

@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "jitsi-meet.jicofo.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jicofo.labels" . | nindent 4 }}
+  {{- with .Values.jicofo.annotations }}
+  annotations:
+    {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.jicofo.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "jitsi-meet.jicofo.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "jitsi-meet.jicofo.selectorLabels" . | nindent 8 }}
+      {{- range $label, $value := mergeOverwrite .Values.global.podLabels .Values.jicofo.podLabels }}
+        {{ $label }}: {{ $value }}
+      {{- end }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/jicofo/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/jicofo/xmpp-secret.yaml") . | sha256sum }}
+      {{- range $annotation, $value := mergeOverwrite .Values.global.podAnnotations .Values.jicofo.podAnnotations }}
+        {{ $annotation }}: {{ $value|quote }}
+      {{- end }}
+    spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      serviceAccountName: {{ include "jitsi-meet.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.jicofo.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.jicofo.securityContext | nindent 12 }}
+          image: "{{ .Values.jicofo.image.repository }}:{{ default .Chart.AppVersion .Values.jicofo.image.tag }}"
+          imagePullPolicy: {{ pluck "pullPolicy" .Values.jicofo.image .Values.image | first }}
+          envFrom:
+          - secretRef:
+              name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jicofo
+          - configMapRef:
+              name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-common
+          - configMapRef:
+              name: {{ include "jitsi-meet.jicofo.fullname" . }}
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          {{- with .Values.jicofo.livenessProbe }}
+          livenessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.jicofo.readinessProbe }}
+          readinessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.jicofo.resources | nindent 12 }}
+
+      {{- with .Values.jicofo.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.jicofo.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.jicofo.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}

jitsi/charts/jitsi-meet/templates/jicofo/xmpp-secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jicofo
+  labels:
+    {{- include "jitsi-meet.jicofo.labels" . | nindent 4 }}
+type: Opaque
+data:
+  JICOFO_AUTH_USER: '{{ .Values.jicofo.xmpp.user | b64enc }}'
+  JICOFO_AUTH_PASSWORD: '{{ default (randAlphaNum 10) .Values.jicofo.xmpp.password | b64enc }}'
+  JICOFO_COMPONENT_SECRET: '{{ default (randAlphaNum 10) .Values.jicofo.xmpp.componentSecret | b64enc }}'

jitsi/charts/jitsi-meet/templates/jvb/_helper.tpl

@@ -0,0 +1,18 @@
+
+{{- define "jitsi-meet.jvb.fullname" -}}
+{{ include "jitsi-meet.fullname" . }}-jvb
+{{- end -}}
+
+{{- define "jitsi-meet.jvb.labels" -}}
+{{ include "jitsi-meet.labels" . }}
+app.kubernetes.io/component: jvb
+{{- end -}}
+
+{{- define "jitsi-meet.jvb.selectorLabels" -}}
+{{ include "jitsi-meet.selectorLabels" . }}
+app.kubernetes.io/component: jvb
+{{- end -}}
+
+{{- define "jitsi-meet.jvb.secret" -}}
+{{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jvb
+{{- end -}}

jitsi/charts/jitsi-meet/templates/jvb/configmap.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "jitsi-meet.jvb.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jvb.labels" . | nindent 4 }}
+data:
+  JVB_BREWERY_MUC: '{{ .Values.jvb.breweryMuc }}'
+  JVB_PORT: '{{ .Values.jvb.UDPPort }}'
+  JVB_STUN_SERVERS: '{{.Values.jvb.stunServers }}'
+  JVB_TCP_HARVESTER_DISABLED: '1'
+  XMPP_SERVER: '{{ include "jitsi-meet.xmpp.server" . }}'
+  {{- range $key, $value := .Values.jvb.extraEnvs }}
+  {{- if not (kindIs "invalid" $value) }}
+  {{ $key }}: {{ tpl $value $ | quote }}
+  {{- end }}
+  {{- end }}
+  COLIBRI_REST_ENABLED: 'true'
+  {{- if .Values.jvb.websockets.enabled }}
+  ENABLE_COLIBRI_WEBSOCKET: 'true'
+  {{- else }}
+  ENABLE_COLIBRI_WEBSOCKET: 'false'
+  {{- end }}
+  {{- if .Values.octo.enabled }}
+  ENABLE_OCTO: "1"
+  JVB_OCTO_BIND_PORT: "4096"
+  JVB_OCTO_REGION: "all"
+  {{- end }}

jitsi/charts/jitsi-meet/templates/jvb/deployment.yaml

@@ -0,0 +1,166 @@
+{{- $serverID := default "podIP" .Values.jvb.websockets.serverID }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "jitsi-meet.jvb.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jvb.labels" . | nindent 4 }}
+  {{- with .Values.jvb.annotations }}
+  annotations:
+    {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.jvb.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "jitsi-meet.jvb.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "jitsi-meet.jvb.selectorLabels" . | nindent 8 }}
+      {{- range $label, $value := mergeOverwrite .Values.global.podLabels .Values.jvb.podLabels }}
+        {{ $label }}: {{ $value }}
+      {{- end }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/jvb/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/jvb/xmpp-secret.yaml") . | sha256sum }}
+        {{- if and .Values.jvb.metrics.enabled  .Values.jvb.metrics.prometheusAnnotations  }}
+        prometheus.io/port: "9888"
+        prometheus.io/scrape: "true"
+        {{- end }}
+      {{- range $annotation, $value := mergeOverwrite .Values.global.podAnnotations .Values.jvb.podAnnotations }}
+        {{ $annotation }}: {{ $value|quote }}
+      {{- end }}
+    spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      serviceAccountName: {{ include "jitsi-meet.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.jvb.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.jvb.securityContext | nindent 12 }}
+          image: "{{ .Values.jvb.image.repository }}:{{ default .Chart.AppVersion .Values.jvb.image.tag }}"
+          imagePullPolicy: {{ pluck "pullPolicy" .Values.jvb.image .Values.image | first }}
+          envFrom:
+          - secretRef:
+              name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jvb
+          - configMapRef:
+              name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-common
+          - configMapRef:
+              name: {{ include "jitsi-meet.jvb.fullname" . }}
+          env:
+          {{- if or .Values.jvb.useNodeIP .Values.jvb.publicIP }}
+          - name: DOCKER_HOST_ADDRESS
+            {{- if .Values.jvb.publicIP }}
+            value: {{ .Values.jvb.publicIP }}
+            {{- else }}
+            valueFrom:
+              fieldRef:
+                fieldPath: status.hostIP
+            {{- end }}
+          {{- end }}
+          {{- if .Values.jvb.websockets.enabled }}
+          - name: JVB_WS_SERVER_ID
+            {{- if eq $serverID "service" }}
+            value: {{ include "jitsi-meet.jvb.fullname" . }}.{{ .Release.Namespace }}.svc
+            {{- else if eq $serverID "podIP" }}
+            valueFrom:
+              fieldRef:
+                fieldPath: status.podIP
+            {{- else }}
+            value: {{ $serverID | quote }}
+            {{- end }}
+          {{- end }}
+          {{- if  .Values.octo.enabled }}
+          - name: JVB_OCTO_BIND_ADDRESS
+            valueFrom:
+              fieldRef:
+                fieldPath: status.hostIP
+          - name: JVB_OCTO_PUBLIC_ADDRESS
+            valueFrom:
+              fieldRef:
+                fieldPath: status.podIP
+          {{- end }}
+          ports:
+            - name: rtp-udp
+              containerPort: {{ .Values.jvb.UDPPort }}
+              {{- if .Values.jvb.useHostPort }}
+              hostPort: {{ .Values.jvb.UDPPort }}
+              {{- end }}
+              protocol: UDP
+          {{- if .Values.jvb.websockets.enabled }}
+            - name: colibri-ws-tcp
+              containerPort: 9090
+              protocol: TCP
+          {{- end }}
+          {{- with .Values.jvb.livenessProbe }}
+          livenessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.jvb.readinessProbe }}
+          readinessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.jvb.resources | nindent 12 }}
+          {{- with .Values.jvb.extraVolumeMounts }}
+          volumeMounts:
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+
+        {{- if .Values.jvb.metrics.enabled }}
+        - name: metrics
+          image: {{ .Values.jvb.metrics.image.repository }}:{{ .Values.jvb.metrics.image.tag }}
+          imagePullPolicy: {{ .Values.jvb.metrics.image.pullPolicy }}
+          securityContext:
+            runAsUser: 10001
+          command:
+            - /prometheus-jitsi-meet-exporter
+            - -videobridge-url
+            - http://localhost:8080/colibri/stats
+          ports:
+            - containerPort: 9888
+              name: tcp-metrics
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 9888
+            initialDelaySeconds: 3
+            periodSeconds: 5
+          resources:
+        {{- toYaml .Values.jvb.metrics.resources | nindent 12 }}
+      {{- end }}
+
+      {{- with .Values.jvb.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- if or .Values.jvb.useHostPort .Values.jvb.affinity }}
+      affinity:
+      {{- if .Values.jvb.affinity }}
+        {{- toYaml .Values.jvb.affinity | nindent 8 }}
+      {{- else }}
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: app.kubernetes.io/component
+                operator: In
+                values:
+                - jvb
+            topologyKey: "kubernetes.io/hostname"
+      {{- end }}
+    {{- end }}
+    {{- with .Values.jvb.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.jvb.extraVolumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}

jitsi/charts/jitsi-meet/templates/jvb/metrics-prometheus.yaml

@@ -0,0 +1,27 @@
+{{- if and (.Values.jvb.metrics.enabled) (.Values.jvb.metrics.serviceMonitor.enabled) }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "jitsi-meet.jvb.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.jvb.labels" . | nindent 4 }}
+    {{- range $key, $value := .Values.jvb.metrics.serviceMonitor.selector }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+spec:
+  endpoints:
+    - port: tcp-metrics
+      path: /metrics
+      {{- if .Values.jvb.metrics.serviceMonitor.honorLabels }}
+      honorLabels: {{ .Values.jvb.metrics.serviceMonitor.honorLabels }}
+      {{- end }}
+      {{- if .Values.jvb.metrics.serviceMonitor.interval }}
+      interval: {{ .Values.jvb.metrics.serviceMonitor.interval }}
+      {{- end }}
+  selector:
+    matchLabels:
+  {{- include "jitsi-meet.jvb.labels" . | nindent 6 }}
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  {{- end -}}

jitsi/charts/jitsi-meet/templates/jvb/metrics-service.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.jvb.metrics.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "jitsi-meet.jvb.fullname" . }}-metrics
+  labels:
+  {{- include "jitsi-meet.jvb.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 9888
+      protocol: TCP
+      name: tcp-metrics
+  selector:
+  {{- include "jitsi-meet.jvb.selectorLabels" . | nindent 4 }}
+  {{- end }}

jitsi/charts/jitsi-meet/templates/jvb/service.yaml

@@ -0,0 +1,35 @@
+{{- if or (and (kindIs "invalid" .Values.jvb.service.enabled) (not .Values.jvb.useHostPort)) .Values.jvb.service.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "jitsi-meet.jvb.fullname" . }}
+  annotations:
+  {{- range $key, $value := .Values.jvb.service.annotations }}
+    {{ $key }}: {{ $value | quote }}
+  {{- end }}
+  labels:
+    {{- include "jitsi-meet.jvb.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.jvb.service.type }}
+  {{- with .Values.jvb.service.LoadbalancerIP }}
+  loadBalancerIP: {{ . }}
+  {{- end }}
+  ports:
+    - port: {{ default 10000 .Values.jvb.UDPPort }}
+      {{- if or (eq .Values.jvb.service.type "NodePort") (eq .Values.jvb.service.type "LoadBalancer") }}
+      nodePort: {{ .Values.jvb.UDPPort }}
+      {{- end }}
+      protocol: UDP
+      name: rtp-udp
+    {{- if .Values.jvb.websockets.enabled }}
+    - port: 9090
+      protocol: TCP
+      name: colibri-ws-tcp
+    {{- end }}
+  {{- with .Values.jvb.service.externalIPs }}
+  externalIPs:
+  {{ toYaml . | indent 2 | trim }}
+  {{- end }}
+  selector:
+    {{- include "jitsi-meet.jvb.selectorLabels" . | nindent 4 }}
+{{- end }}

jitsi/charts/jitsi-meet/templates/jvb/xmpp-secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-jvb
+  labels:
+    {{- include "jitsi-meet.jvb.labels" . | nindent 4 }}
+type: Opaque
+data:
+  JVB_AUTH_USER: '{{ .Values.jvb.xmpp.user | b64enc }}'
+  JVB_AUTH_PASSWORD: '{{ default (randAlphaNum 10) .Values.jvb.xmpp.password | b64enc }}'

jitsi/charts/jitsi-meet/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "jitsi-meet.serviceAccountName" . }}
+  labels:
+    {{- include "jitsi-meet.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end -}}

jitsi/charts/jitsi-meet/templates/tests/test-connection.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "jitsi-meet.web.fullname" . }}-test-connection"
+  labels:
+    {{- include "jitsi-meet.web.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test-success
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "jitsi-meet.web.fullname" . }}:{{ .Values.web.service.port }}']
+  restartPolicy: Never

jitsi/charts/jitsi-meet/templates/web/_helper.tpl

@@ -0,0 +1,15 @@
+
+{{- define "jitsi-meet.web.fullname" -}}
+{{ include "jitsi-meet.fullname" . }}-web
+{{- end -}}
+
+{{- define "jitsi-meet.web.labels" -}}
+{{ include "jitsi-meet.labels" . }}
+app.kubernetes.io/component: web
+{{- end -}}
+
+{{- define "jitsi-meet.web.selectorLabels" -}}
+{{ include "jitsi-meet.selectorLabels" . }}
+app.kubernetes.io/component: web
+{{- end -}}
+

jitsi/charts/jitsi-meet/templates/web/configmap.yaml

@@ -0,0 +1,27 @@
+{{- $serverID := default "podIP" .Values.jvb.websockets.serverID }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "jitsi-meet.web.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.web.labels" . | nindent 4 }}
+data:
+  DISABLE_HTTPS: {{ ternary "0" "1" .Values.web.httpsEnabled | quote }}
+  ENABLE_HTTP_REDIRECT: {{ ternary "1" "0" .Values.web.httpRedirect | quote }}
+  JICOFO_AUTH_USER: '{{ .Values.jicofo.xmpp.user }}'
+  XMPP_BOSH_URL_BASE: 'http://{{ include "jitsi-meet.xmpp.server" . }}:{{ index .Values.prosody.service.ports "bosh-insecure" }}'
+  {{- if and .Values.jvb.websockets.enabled (eq $serverID "service") }}
+  NGINX_RESOLVER: {{ required "(web.resolverIP) Please set an IP address of your KubeDNS service!" .Values.web.resolverIP }}
+  {{- end }}
+  {{- if .Values.jibri.enabled }}
+  ENABLE_RECORDING: "true"
+  ENABLE_FILE_RECORDING_SERVICE_SHARING: "true"
+  {{- end }}
+  {{- if .Values.etherpad.enabled}}
+  ETHERPAD_URL_BASE: 'http://{{ include "jitsi-meet.etherpad.fullname" . }}.{{ .Release.Namespace }}.svc:9001'  
+  {{- end }}
+  {{- range $key, $value := .Values.web.extraEnvs }}
+  {{- if not (kindIs "invalid" $value) }}
+  {{ $key }}: {{ tpl $value $ | quote }}
+  {{- end }}
+  {{- end }}

jitsi/charts/jitsi-meet/templates/web/deployment.yaml

@@ -0,0 +1,84 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "jitsi-meet.web.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.web.labels" . | nindent 4 }}
+  {{- with .Values.web.annotations }}
+  annotations:
+    {{ toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.web.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "jitsi-meet.web.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "jitsi-meet.web.selectorLabels" . | nindent 8 }}
+      {{- range $label, $value := mergeOverwrite .Values.global.podLabels .Values.web.podLabels }}
+        {{ $label }}: {{ $value }}
+      {{- end }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/web/configmap.yaml") . | sha256sum }}
+      {{- range $annotation, $value := mergeOverwrite .Values.global.podAnnotations .Values.web.podAnnotations }}
+        {{ $annotation }}: {{ $value|quote }}
+      {{- end }}
+    spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      serviceAccountName: {{ include "jitsi-meet.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.web.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.web.securityContext | nindent 12 }}
+          image: "{{ .Values.web.image.repository }}:{{ default .Chart.AppVersion .Values.web.image.tag }}"
+          imagePullPolicy: {{ pluck "pullPolicy" .Values.web.image .Values.image | first }}
+          envFrom:
+          - configMapRef:
+              name: {{ include "jitsi-meet.web.fullname" . }}
+          - configMapRef:
+              name: {{ include "call-nested" (list . "prosody" "prosody.fullname") }}-common
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+            - name: https
+              containerPort: 443
+              protocol: TCP
+          {{- with .Values.web.livenessProbe }}
+          livenessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.web.readinessProbe }}
+          readinessProbe:
+          {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.web.resources | nindent 12 }}
+          {{- with .Values.web.extraVolumeMounts }}
+          volumeMounts:
+          {{- toYaml . | nindent 10 }}
+          {{- end }}
+
+      {{- with .Values.web.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.web.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.web.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.web.extraVolumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}

jitsi/charts/jitsi-meet/templates/web/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "jitsi-meet.web.fullname" . }}
+  labels:
+    {{- include "jitsi-meet.web.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.web.service.type }}
+  ports:
+    - port: {{ .Values.web.service.port }}
+      protocol: TCP
+      name: http
+  {{- with .Values.web.service.externalIPs }}
+  externalIPs:
+  {{ toYaml . | indent 2 | trim }}
+  {{- end }}
+  selector:
+    {{- include "jitsi-meet.web.selectorLabels" . | nindent 4 }}

jitsi/charts/jitsi-meet/values.yaml

@@ -0,0 +1,307 @@
+# Default values for jitsi-meet.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+global:
+  podLabels: {}
+  podAnnotations: {}
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+enableAuth: false
+enableGuests: true
+publicURL: ""
+
+tz: Europe/Amsterdam
+
+image:
+  pullPolicy: IfNotPresent
+
+web:
+  replicaCount: 1
+  image:
+    repository: jitsi/web
+
+  extraEnvs: {}
+  service:
+    type: ClusterIP
+    port: 80
+    externalIPs: []
+
+  ingress:
+    enabled: false
+    # ingressClassName: "nginx-ingress-0"
+    annotations: {}
+      # kubernetes.io/ingress.class: nginx
+      # kubernetes.io/tls-acme: "true"
+    hosts:
+    - host: jitsi.local
+      paths: ['/']
+    tls: []
+    #  - secretName: jitsi-web-certificate
+    #    hosts:
+    #      - jitsi.local
+
+  # Useful for ingresses that don't support http-to-https redirect by themself, (namely: GKE),
+  httpRedirect: false
+
+  # When tls-termination by the ingress is not wanted, enable this and set web.service.type=Loadbalancer
+  httpsEnabled: false
+
+  ## Resolver IP for nginx.
+  ## Set this to ClusterIP of your `kube-dns` service
+  ## when using websockets and discovering JVB's address
+  ## via k8s services.
+  # resolverIP: 10.43.0.10
+
+  livenessProbe:
+    httpGet:
+      path: /
+      port: 80
+  readinessProbe:
+    httpGet:
+      path: /
+      port: 80
+
+  podLabels: {}
+  podAnnotations: {}
+  podSecurityContext: {}
+    # fsGroup: 2000
+
+  securityContext: {}
+    # capabilities:
+    #   drop:
+    #   - ALL
+    # readOnlyRootFilesystem: true
+    # runAsNonRoot: true
+    # runAsUser: 1000
+
+  resources: {}
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    # limits:
+    #   cpu: 100m
+    #   memory: 128Mi
+    # requests:
+    #   cpu: 100m
+    #   memory: 128Mi
+
+  nodeSelector: {}
+
+  tolerations: []
+
+  affinity: {}
+
+jicofo:
+  replicaCount: 1
+  image:
+    repository: jitsi/jicofo
+
+  xmpp:
+    user: focus
+    password:
+    componentSecret:
+
+  livenessProbe:
+    tcpSocket:
+      port: 8888
+  readinessProbe:
+    tcpSocket:
+      port: 8888
+
+  podLabels: {}
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  extraEnvs: {}
+
+jvb:
+  replicaCount: 1
+  image:
+    repository: jitsi/jvb
+
+  xmpp:
+    user: jvb
+    password:
+
+  stunServers: 'meet-jit-si-turnrelay.jitsi.net:443'
+  useHostPort: false
+  UDPPort: 10000
+  service:
+    enabled:
+    type: ClusterIP
+    externalIPs: []
+    ## Annotations to be added to the service (if LoadBalancer is used)
+    ##
+    annotations: {}
+
+  breweryMuc: jvbbrewery
+
+  livenessProbe:
+    httpGet:
+      path: /about/health
+      port: 8080
+  readinessProbe:
+    httpGet:
+      path: /about/health
+      port: 8080
+
+  podLabels: {}
+  podAnnotations: {}
+  podSecurityContext: {}
+  securityContext: {}
+  resources: {}
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  extraEnvs: {}
+
+  websockets:
+    ## Set to 'true' to enable Colibri WebSocket support in JVB:
+    enabled: false
+    ## Uncomment this to set JVB server ID manually,
+    ## Or use one of pre-defined values:
+    ## * "podIP" will fetch JVB pod's IP address from K8s metadata;
+    ## * "service" will use JVB service name generated by Helm.
+    ##
+    ## Don't forget to set `web.resolverIP` to your cluster's
+    ## DNS service IP when setting this to "service"!
+    ##
+    ## (default is "podIP")
+    # serverID: podIP
+
+  metrics:
+    enabled: false
+    prometheusAnnotations: false
+    image:
+      repository: docker.io/systemli/prometheus-jitsi-meet-exporter
+      tag: 1.1.9
+      pullPolicy: IfNotPresent
+    serviceMonitor:
+      enabled: true
+      selector:
+        release: prometheus-operator
+      interval: 10s
+      # honorLabels: false
+    resources:
+      requests:
+        cpu: 10m
+        memory: 16Mi
+      limits:
+        cpu: 20m
+        memory: 32Mi
+  
+octo:
+  enabled: false
+
+
+jibri:
+  ## Enabling Jibri will allow users to record
+  ## and/or stream their meetings (e.g. to YouTube).
+  enabled: false
+
+  ## Enable persistent storage for local recordings.
+  ## If disabled, jibri pod will use a transient
+  ## emptyDir-backed storage instead.
+  persistence:
+    enabled: false
+    size: 4Gi
+    ## Set this to existing PVC name if you have one.
+    existingClaim:
+    storageClassName:
+
+  shm:
+    ## Set to true to enable "/dev/shm" mount.
+    ## May be required by built-in Chromium.
+    enabled: false
+    ## If "true", will use host's shared memory dir,
+    ## and if "false" — an emptyDir mount.
+    # useHost: false
+    # size: 256Mi
+
+  image:
+    repository: jitsi/jibri
+
+  breweryMuc: jibribrewery
+  timeout: 90
+
+  ## jibri XMPP user credentials:
+  xmpp:
+    user: jibri
+    password:
+
+  ## recorder XMPP user credentials:
+  recorder:
+    user: recorder
+    password:
+
+  livenessProbe:
+    exec:
+      command: ["pgrep", "java"]
+
+  readinessProbe:
+    exec:
+      command: ["pgrep", "java"]
+
+  extraEnvs: {}
+
+etherpad:
+  enabled: false
+  replicaCount: 1
+
+  image:
+    repository: etherpad/etherpad
+    tag: 1.8.18
+
+  livenessProbe:
+    httpGet:
+      path: /
+      port: 9001
+  readinessProbe:
+    httpGet:
+      path: /
+      port: 9001
+
+  resources: {}
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+
+xmpp:
+  domain: meet.jitsi
+  authDomain:
+  mucDomain:
+  internalMucDomain:
+  guestDomain:
+
+extraCommonEnvs: {}
+
+prosody:
+  enabled: true
+  server:
+  extraEnvFrom:
+  - secretRef:
+      name: '{{ include "prosody.fullname" . }}-jicofo'
+  - secretRef:
+      name: '{{ include "prosody.fullname" . }}-jvb'
+  - configMapRef:
+      name: '{{ include "prosody.fullname" . }}-common'
+  ## Uncomment this if you want to use jibri:
+  # - secretRef:
+  #     name: '{{ include "prosody.fullname" . }}-jibri'
+  image:
+    repository: jitsi/prosody
+    tag: 'stable-7287'

jitsi/ci/dummy-values.yaml

@@ -0,0 +1,3 @@
+---
+jitsi-meet:
+  publicURL: "http://localhost"

jitsi/templates/etherpad-schedule/cluster-role-binding.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.etherpad.scheduled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Name }}-etherpad-scale-role-binding
+subjects:
+  - namespace: {{ .Release.Namespace }}
+    kind: ServiceAccount
+    name: {{ .Release.Name }}-etherpad-startstop-account
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ .Release.Name }}-etherpad-scale-role
+{{- end }}

jitsi/templates/etherpad-schedule/cluster-role.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.etherpad.scheduled }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Name }}-etherpad-scale-role
+rules:
+  - apiGroups:
+      - apps
+    resources:
+      - deployments
+    verbs: [ "get" ]
+  - apiGroups:
+      - apps
+    resources:
+      - deployments/scale
+    verbs: [ "patch" ]
+{{- end }}

jitsi/templates/etherpad-schedule/cronjob.yaml

@@ -0,0 +1,54 @@
+{{- if .Values.etherpad.scheduled }}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .Release.Name }}-start-etherpad
+spec:
+  schedule: {{ .Values.etherpad.schedules.start }}
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure
+          containers:
+          - name: kubectl
+            image: bitnami/kubectl:1.23
+            imagePullPolicy: IfNotPresent
+            args:
+              - -n
+              - {{ .Release.Namespace }}
+              - scale
+              - deployment
+              - {{ .Release.Name }}-jitsi-meet-etherpad
+              - --replicas=1
+          serviceAccountName: {{ .Release.Name }}-etherpad-startstop-account
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ .Release.Name }}-stop-etherpad
+spec:
+  schedule: {{ .Values.etherpad.schedules.stop }}
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure
+          containers:
+          - name: kubectl
+            image: bitnami/kubectl:1.23
+            imagePullPolicy: IfNotPresent
+            args:
+              - -n
+              - {{ .Release.Namespace }}
+              - scale
+              - deployment
+              - {{ .Release.Name }}-jitsi-meet-etherpad
+              - --replicas=0
+          serviceAccountName: {{ .Release.Name }}-etherpad-startstop-account
+{{- end }}

jitsi/templates/etherpad-schedule/serviceacount.yaml

@@ -0,0 +1,7 @@
+{{- if .Values.etherpad.scheduled }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-etherpad-startstop-account
+{{- end }}

jitsi/templates/ingressroute-web.yaml

@@ -0,0 +1,44 @@
+{{- $hostname := default (index .Values "jitsi-meet" "jvb" "publicIP") .Values.fqdn }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: jitsi-websecure
+spec:
+  entryPoints:
+    {{- if eq (int .Values.port) 443 }}
+    - websecure
+    {{- else }}
+    - jitsi-meet
+    {{- end }}
+  routes:
+    - kind: Rule
+      match: Host(`{{ $hostname }}`) && PathPrefix(`/`)
+      services:
+        - name: {{ .Release.Name }}-jitsi-meet-web
+          port: 80
+  {{- if .Values.certResolver }}
+  tls:
+    certResolver: {{ .Values.certResolver }}
+  {{- else }}
+  tls: {}
+  {{- end }}
+
+{{- if eq (int .Values.port) 443 }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: jitsi-web
+spec:
+  entryPoints:
+    - web
+  routes:
+    - kind: Rule
+      match: Host(`{{ $hostname }}`) && PathPrefix(`/`)
+      middlewares:
+        - name: jitsi-web-redirectscheme
+      services:
+        - name: {{ .Release.Name }}-jitsi-meet-web
+          port: 80
+{{- end }}

jitsi/templates/ingressroutetcp-prosody.yaml

@@ -0,0 +1,12 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: {{ .Release.Name }}-ingressroutetcp-prosody
+spec:
+  entryPoints:
+  - xmpp-{{ .Release.Namespace }}
+  routes:
+  - match: HostSNI(`*`)
+    services:
+    - name: {{ .Release.Name }}-prosody
+      port: 5222

jitsi/templates/middleware-redirect.yaml

@@ -0,0 +1,7 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: jitsi-web-redirectscheme
+spec:
+  redirectScheme:
+    scheme: https

jitsi/values-jvb-off.yaml

@@ -0,0 +1,5 @@
+jitsi-meet:
+  jvb:
+    replicaCount: 0
+    service:
+      enabled: false

jitsi/values.yaml

@@ -0,0 +1,50 @@
+---
+certResolver: le-staging
+
+fqdn: ""
+
+port: 443
+
+etherpad:
+  scheduled: false
+  schedules:
+    start: ""
+    stop: ""
+
+jitsi-meet:
+  publicURL: ""
+
+  tz: Asia/Shanghai
+
+  web:
+    ingress:
+      enabled: false
+
+  jicofo:
+    livenessProbe:
+      failureThreshold: 30
+      periodSeconds: 10
+    readinessProbe:
+      failureThreshold: 30
+      periodSeconds: 10
+
+  jvb:
+    service:
+      type: NodePort
+    UDPPort: 30000
+
+    livenessProbe:
+      failureThreshold: 30
+      periodSeconds: 10
+    readinessProbe:
+      failureThreshold: 30
+      periodSeconds: 10
+
+    websockets:
+      enabled: true
+
+    publicIP: ""
+
+  etherpad:
+    enabled: true
+    replicaCount: 1

lintconf.yaml

@@ -0,0 +1,7 @@
+extends: default
+
+rules:
+  empty-lines:
+    max: 3
+    max-start: 1
+    max-end: 1

test/domains.ext

@@ -0,0 +1,6 @@
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost

test/localhost.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDbDCCAlSgAwIBAgIUcc7tSYM5y/4KVnGR8OWlEcau374wDQYJKoZIhvcNAQEL
+BQAwJDELMAkGA1UEBhMCQ04xFTATBgNVBAMMDFRlc3QtUm9vdC1DQTAeFw0yMjA1
+MjkxMDE2NTRaFw0zMjA1MjgxMDE2NTRaMGkxCzAJBgNVBAYTAkNOMREwDwYDVQQI
+DAhTaGFuZ2hhaTERMA8GA1UEBwwIU2hhbmdoYWkxGjAYBgNVBAoMEVRlc3QtQ2Vy
+dGlmaWNhdGVzMRgwFgYDVQQDDA9sb2NhbGhvc3QubG9jYWwwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDENvP4g4VFHetaQh+VgadakrwWQZl2zv0pK4a8
+MIbJZjFWm1BSNBMt6gyEXTAbxNtHRmEMX09u4CJs3uPlHP4l/qGjvMCnBwX4FWK9
+zHc7/nfhfUY/IugYp+yPDW9zUeZvNPgVg2SGbJVVoaQacVDyRGULGz4KYkjmiEtL
+HHBbSGnjOPccuxFDOLddq5GXyo2K5eL99m/HRZS3WG6tHdJgujVEjLTFLRsOmoTI
+hheWbL0wKSKEyRr358wLYklfmFopKJf96RKzTYAcG4S48HEnE8utICS7vdpQkFvg
+PGfWhmm6tF4p32EBY9RHIhIruQl5a3R64GgkVh/XB3BQwoQ5AgMBAAGjUTBPMB8G
+A1UdIwQYMBaAFMLiGgOohW2V366tFw8by/ljyocUMAkGA1UdEwQCMAAwCwYDVR0P
+BAQDAgTwMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAQEA
+4oZZZaNCFt80IISTVnJqARox62r/xq4cjYk8fGa5UdjetA3uKPJ7mAfAMGalaCjy
+4OcWcFhCYuJMZofWHFBmo51M0Po0F/sWGpnqzS4v0Bd8dSGw8LgX2H2Iz+Kbv8IB
+p3G5dNWaTxqu8Wx2K4Uu5dbmrQ6fwW+/o/ES/x5VYuKukPCSGVL1UA/k8T1NtnCy
+mcEHFL83A3ZQRxpctUpQVYveF5CQCCVarxfSCw+z5rU6JUfKdJ7UshYjYqcTCUtc
+dH5eZB28vr8vPp/qKvZ6lfa4BzO/O56CfcQhMHeVFlLin0vLdcQSjdEQXiWPkx9Y
+taQng1IMk10ELix76aHTog==
+-----END CERTIFICATE-----

test/localhost.csr

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICrjCCAZYCAQAwaTELMAkGA1UEBhMCQ04xETAPBgNVBAgMCFNoYW5naGFpMREw
+DwYDVQQHDAhTaGFuZ2hhaTEaMBgGA1UECgwRVGVzdC1DZXJ0aWZpY2F0ZXMxGDAW
+BgNVBAMMD2xvY2FsaG9zdC5sb2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAMQ28/iDhUUd61pCH5WBp1qSvBZBmXbO/SkrhrwwhslmMVabUFI0Ey3q
+DIRdMBvE20dGYQxfT27gImze4+Uc/iX+oaO8wKcHBfgVYr3Mdzv+d+F9Rj8i6Bin
+7I8Nb3NR5m80+BWDZIZslVWhpBpxUPJEZQsbPgpiSOaIS0sccFtIaeM49xy7EUM4
+t12rkZfKjYrl4v32b8dFlLdYbq0d0mC6NUSMtMUtGw6ahMiGF5ZsvTApIoTJGvfn
+zAtiSV+YWikol/3pErNNgBwbhLjwcScTy60gJLu92lCQW+A8Z9aGabq0XinfYQFj
+1EciEiu5CXlrdHrgaCRWH9cHcFDChDkCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IB
+AQC7WRAd2iYn0F9h/ebQ4FZ4hhguzMDya79xe9rKCbGkYqYoYwY2Msg9E1Rikr19
+KI5Spm3vFVe51BKTdysxfYckBQ1h5yfO/rjh7Id7bAoJlNb9zjOFAt3YvtIgLA5W
+GDKZ/36jIY9SNDWVmWU4gC1Zqvowtd1kT91CqH9Kbs4VhiORwj2+2Q7xQZDZwrW1
+oLLelVVF2VjZ6pWqCamoO8i9tkIfNtpvZCYdnG8J54tPIap18G2AgC/3Val5MWfp
+jXGBDNy+l6EldOmEhzm6NYN+aOP2prhrMD9QKZiO5uWJq6IdBCtnVf0vOj484Osk
+twKkfxAAUpPLhiDx2znRvAGt
+-----END CERTIFICATE REQUEST-----

test/localhost.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDENvP4g4VFHeta
+Qh+VgadakrwWQZl2zv0pK4a8MIbJZjFWm1BSNBMt6gyEXTAbxNtHRmEMX09u4CJs
+3uPlHP4l/qGjvMCnBwX4FWK9zHc7/nfhfUY/IugYp+yPDW9zUeZvNPgVg2SGbJVV
+oaQacVDyRGULGz4KYkjmiEtLHHBbSGnjOPccuxFDOLddq5GXyo2K5eL99m/HRZS3
+WG6tHdJgujVEjLTFLRsOmoTIhheWbL0wKSKEyRr358wLYklfmFopKJf96RKzTYAc
+G4S48HEnE8utICS7vdpQkFvgPGfWhmm6tF4p32EBY9RHIhIruQl5a3R64GgkVh/X
+B3BQwoQ5AgMBAAECggEBAKnClbAUMjCLYz1y6hqS0zUUsPBcjybwjK2a//Y/0c3b
+waIZvBNzBIj77xpx+ZZ86e6voHVw3Kuj9YTWDrwCKoy60iR0wQWBmRN7hTOK/DoG
+vrdziFxFmiMC3jMiP6O5XzIl1OHgDRAUT9uHfxB1q7//lqBWUIXxZPs3PlVc5ITE
+DR7kScGq/E+14qlQ07NXSXZ94nRAVII2oa/NpafE112IL54mHbtApme/Shg2KEeM
+IE8c0hhIxbTCbpkfBAbEaSRMIT76ACsyCGNm7uMwXl1wCIpAlKuoEB5GyJjhuFgU
++R7UEdVZDSeOn0SCNB+T8QMzHHlLzXP/17i+SXJFAVECgYEA5EoXjfIQYrba+yYV
+TJ9IwumBsXT2IXUqYfrLaUTnl29xwfa79EjfUGmJGoLstTlLboXGI6aj5d1dyrfZ
+RuRNO/y2MMf7TmP/xiZJFYYvIqPnYgeAN1FlikjpgzLstNpZegrG1hP6kjsUJgZV
+sBqitOdhv4JnPPuv+BFJmpkDWzUCgYEA3Agp9GEwoVyTLlpq1f0qnAYlAxbzc/x2
+Vi5eynaJEJGBdaL8ZekGlqUPdNR6FtN9vwk/uWH+sf4k6QGp3TGmE2ARtHE3rN86
+o6VFIBeJvmI9a6MCkc1heXGSb19qA/vEi8zaojmX/R4St3Qz+ZDKjKZIP7rkp/4S
+dK+RmxyYIXUCgYB5/pYjxq228tyGxc0wCxbJAhvKhyRYsNIbVfiJosbYCDgUXRQH
+8UFVKXCY+EoidiG3SEmgF5cSaX+Lqz+zQKF9YwjBfLzxIUM30pHPrMtXiZtGqZd8
++ER454nSEM6pvt19+HBVSovmxSd5Qn1cBH/aiKOVwcwFrMJWoHZi5U4D2QKBgChv
+p6Ytpk5BQRsnqrKg0A/UYUDsGtmZ7/VumCUFG7NbyjrgNRpVdMyCkRCba8R+IYHW
+JUvgYno7hnT7xUfNNAQjh51toRm3/ILOgKGhMcM3MqpxTquU3vD+mja1hjotLrWy
+dAuUIgZ2XGIyjMq0fUTT2js8EYF+A85F5bBn1N1xAoGBAJ7gwV6knxm3ks25C+Jx
+8Le8hzvhM2Vm6O5+fQh8m09m5RfBpfxDgObGZITD61JckfVyShP6OmotLX5Kw3kP
+jTkep0CuICpKYDy34c+8bzNCPtm8obwaR4UwHGLT7ukt1YBnL9Tz2bizKRYA9dCM
+mPgSq9VdqPkbNdoptdlPjhzL
+-----END PRIVATE KEY-----

test/rootca.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDKTCCAhGgAwIBAgIUQf/FpPggQl+eoZw7T+HIF4x6yqUwDQYJKoZIhvcNAQEL
+BQAwJDELMAkGA1UEBhMCQ04xFTATBgNVBAMMDFRlc3QtUm9vdC1DQTAeFw0yMjA1
+MjkxMDE2MDZaFw0zMjA1MjkxMDE2MDZaMCQxCzAJBgNVBAYTAkNOMRUwEwYDVQQD
+DAxUZXN0LVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD1
+hppTIv/OLBhZMmzx34SJp3vme9vtTWgd5s5yFua2dUonM6880zac2uLSwU5eJaNr
+EFVsHG+1axEMrZG+EE6BQwgL3O6uOxwm6NhWN5IFEI8INTRZvXgkfX2nMcz/4mPe
+rPV4wfC/M37HWLLWhwhbIdr455DzdJ4dj16oeVksMyq0ogZVnOJNmPA6RgmCxp1C
++etvgGsqM30POgnRxrCNMcl9m9/zw5n1qYJ1NVHJUSxzaEZydeTWxEpQTj5myS9P
+59VHn36Qpb9Pmvd1RuO/MbxLCTpL9azA1dvnuMkK39gYwRw5Y8UWlBgDCI2yfiDW
+ayC/EkyuNCLYYDkySRQPAgMBAAGjUzBRMB0GA1UdDgQWBBTC4hoDqIVtld+urRcP
+G8v5Y8qHFDAfBgNVHSMEGDAWgBTC4hoDqIVtld+urRcPG8v5Y8qHFDAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQADjLM6wUKR2Ucd+QY6TjkwdXEV
+0cMKhdXLeibo27XBgWnj+HZaKCNxfgP6tmLh6EBfyLsSf83zgcS8SEiep9NPw67F
+98qHkU9vJWQfrcH9kCSfCRmGrEwMW56IE8rplbQpOBx/n9YLPGRwqN5RRUnG3rhl
+ukAZKm54Vt3pMNuQAPyirXQhaQ5G9jlss73nov/UOi7J2TTklPaJnmccldbFzwVU
+EqUneOPhW5/eu25wMI7TL4VaOKCY97vOHAdORAeHnP2Z1UrqmTWBqxc6gsCUmdMI
+DoCzO9p/u4UKiaen++u4qrgC8IBwfisuKS0exhL3hKXjUscllevzCwYlCVd7
+-----END CERTIFICATE-----

test/rootca.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQD1hppTIv/OLBhZ
+Mmzx34SJp3vme9vtTWgd5s5yFua2dUonM6880zac2uLSwU5eJaNrEFVsHG+1axEM
+rZG+EE6BQwgL3O6uOxwm6NhWN5IFEI8INTRZvXgkfX2nMcz/4mPerPV4wfC/M37H
+WLLWhwhbIdr455DzdJ4dj16oeVksMyq0ogZVnOJNmPA6RgmCxp1C+etvgGsqM30P
+OgnRxrCNMcl9m9/zw5n1qYJ1NVHJUSxzaEZydeTWxEpQTj5myS9P59VHn36Qpb9P
+mvd1RuO/MbxLCTpL9azA1dvnuMkK39gYwRw5Y8UWlBgDCI2yfiDWayC/EkyuNCLY
+YDkySRQPAgMBAAECggEBAKBJ1LxL0BaoQOkSe39Yfe1kEwZAfC6q5zsGMGbZPpuF
+bPi0zEV4WmICoCwZGPFrvwkpa6sd0Wvtzv6o3cnoWWgX+8vK22ORoWphfsKimsiF
+q+se2ONxR1sDNiIN6BhxkuOPpN3GN0aL9strw608EJ92Nb9jZgUacBM6QwDX3/hy
+05ppA93N7uZMXSH3M3bfeNzWNaKCI/QhMRkUAQoqDYyufFWBSiftSRP+ymfrYqcp
+stL/VR1qVOete2j+3q/M9X1B4JrrYP1Q+Mqs8R7kBIkSgi77shZnsyAuQ8R00/0x
+Z2kodB5MJBvIDE2sR5u+mom3SFvj5wrQKEfiV/OSPrkCgYEA/1InDpb8s3MYa4tg
+BZixz/rymIjNZI0CgoZ66zShhnLveiYOdDCJZfqwG1oPAeW1GH7DcP7vjBk9h2CO
+65Jh0vSLGodbVf5SCXbnGrlwlq7BV2/5swlY7vfjpM2GLk1Q58BIlrolctldVA7b
++aFcihpq82Zv+Dqx+s1AycQPQGsCgYEA9i3H4f1z4jd4eVlBinZ4ZCm9fFyjur+y
+XlFbiX0JpHuVuwBgX7kC05wmZsvxTTkj7mZNwCnwLeAK2Dj9EXaFL7IJH8tFExGt
+kw+jSI/K3TvcP9JLsnKkcFYiXTA5mjUzPttBwns9LpWfsJ+C7eCwM5r6tr38Rdjw
+G17PF1HHk+0CgYEAylRxDRfL0+1OmdMOWgECT/3fB8/JbHhuV794YzIHGsO0UUkd
+RSg9ieoaauJ4aBl/5JR4DvCIJq7N2p1DRR1wljsijPhdAg2TN1rZk40G0vJT1xWu
+fBnZNy6MYMpaHhE5Hx56p6+GA7iLRBSub+lWqz56KL6x1rW02zqSsBHFwFcCgYBi
+YN02FKFQz7YXWHH2sW1fKccNgb/0i1Lumjiocw19a93kQzxARKE6i3ZVMj8WCzWu
+ubdsidXvn072JaAMcH69FrrKt+K8wh3JXUB1aPE7BAb6gkG56FKKigFlmDYMyCHY
+hqp62+ERUr3kSXp7MYV4ugBjMv0ztIQPjA3aVdYZ6QKBgQDlDqbFEHpxXO4/bycR
+kflfv2TDmxxb11cn6NnuRZjEY2EhYXBRN/OXRYjpUEiBqte9EsyPQCwVPh78BpIb
+C9md4GsZNJpuvHXhFQxwAyorGOoXvfTehROcIKz7B/9ec2ksQG18E60q1+xNAXF+
+wnXl7pICKzczQFGd/EzJwvFARQ==
+-----END PRIVATE KEY-----

test/rootca.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDKTCCAhGgAwIBAgIUQf/FpPggQl+eoZw7T+HIF4x6yqUwDQYJKoZIhvcNAQEL
+BQAwJDELMAkGA1UEBhMCQ04xFTATBgNVBAMMDFRlc3QtUm9vdC1DQTAeFw0yMjA1
+MjkxMDE2MDZaFw0zMjA1MjkxMDE2MDZaMCQxCzAJBgNVBAYTAkNOMRUwEwYDVQQD
+DAxUZXN0LVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD1
+hppTIv/OLBhZMmzx34SJp3vme9vtTWgd5s5yFua2dUonM6880zac2uLSwU5eJaNr
+EFVsHG+1axEMrZG+EE6BQwgL3O6uOxwm6NhWN5IFEI8INTRZvXgkfX2nMcz/4mPe
+rPV4wfC/M37HWLLWhwhbIdr455DzdJ4dj16oeVksMyq0ogZVnOJNmPA6RgmCxp1C
++etvgGsqM30POgnRxrCNMcl9m9/zw5n1qYJ1NVHJUSxzaEZydeTWxEpQTj5myS9P
+59VHn36Qpb9Pmvd1RuO/MbxLCTpL9azA1dvnuMkK39gYwRw5Y8UWlBgDCI2yfiDW
+ayC/EkyuNCLYYDkySRQPAgMBAAGjUzBRMB0GA1UdDgQWBBTC4hoDqIVtld+urRcP
+G8v5Y8qHFDAfBgNVHSMEGDAWgBTC4hoDqIVtld+urRcPG8v5Y8qHFDAPBgNVHRMB
+Af8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQADjLM6wUKR2Ucd+QY6TjkwdXEV
+0cMKhdXLeibo27XBgWnj+HZaKCNxfgP6tmLh6EBfyLsSf83zgcS8SEiep9NPw67F
+98qHkU9vJWQfrcH9kCSfCRmGrEwMW56IE8rplbQpOBx/n9YLPGRwqN5RRUnG3rhl
+ukAZKm54Vt3pMNuQAPyirXQhaQ5G9jlss73nov/UOi7J2TTklPaJnmccldbFzwVU
+EqUneOPhW5/eu25wMI7TL4VaOKCY97vOHAdORAeHnP2Z1UrqmTWBqxc6gsCUmdMI
+DoCzO9p/u4UKiaen++u4qrgC8IBwfisuKS0exhL3hKXjUscllevzCwYlCVd7
+-----END CERTIFICATE-----

test/rootca.srl

@@ -0,0 +1 @@
+71CEED498339CBFE0A567191F0E5A511C6AEDFBE

test/steps.txt

@@ -0,0 +1,15 @@
+
+openssl req -x509 -nodes -new -sha256 -days 3653 -newkey rsa:2048 -keyout rootca.key -out rootca.pem -subj "/C=CN/CN=Test-Root-CA"
+openssl x509 -outform pem -in rootca.pem -out rootca.crt
+
+cat > domains.ext <<EOF
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost
+EOF
+
+openssl req -new -nodes -newkey rsa:2048 -keyout localhost.key -out localhost.csr -subj "/C=CN/ST=Shanghai/L=Shanghai/O=Test-Certificates/CN=localhost.local"
+openssl x509 -req -sha256 -days 3652 -in localhost.csr -CA rootca.pem -CAkey rootca.key -CAcreateserial -extfile domains.ext -out localhost.crt

tlsstore.yaml

@@ -0,0 +1,8 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: TLSStore
+metadata:
+  name: default
+  namespace: default
+spec:
+  defaultCertificate:
+    secretName: tls-secret

traefik-config.yaml.sh

@@ -0,0 +1,57 @@
+cat <<EOF
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    additionalArguments:
+      - "--log.level=DEBUG"
+EOF
+if [ -n "${CERT_RESOLVER}" ]; then
+  cat <<EOF
+      - "--certificatesresolvers.le-prod.acme.email=${ACME_EMAIL}"
+      - "--certificatesresolvers.le-prod.acme.storage=/data/acme-prod.json"
+      - "--certificatesresolvers.le-prod.acme.tlschallenge=true"
+      - "--certificatesresolvers.le-prod.acme.caServer=https://acme-v02.api.letsencrypt.org/directory"
+      - "--certificatesresolvers.le-staging.acme.email=${ACME_EMAIL}"
+      - "--certificatesresolvers.le-staging.acme.storage=/data/acme-staging.json"
+      - "--certificatesresolvers.le-staging.acme.tlschallenge=true"
+      - "--certificatesresolvers.le-staging.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory"
+EOF
+fi
+cat <<EOF
+    # dashboard:
+    #   enabled: true
+    ports:
+      traefik:
+        expose: false
+EOF
+if [ ${PUBLIC_PORT} -ne 443 ]; then
+  cat <<EOF
+      web:
+        expose: false
+      websecure:
+        expose: false
+      jitsi-meet:
+        port: ${PUBLIC_PORT}
+        expose: true
+        exposedPort: ${PUBLIC_PORT}
+        protocol: TCP
+EOF
+fi
+if [ -n "${EXCLUDE_JVB}" ]; then
+  cat <<EOF
+      xmpp-prod:
+        port: 5222
+        expose: true
+        exposedPort: 5222
+        protocol: TCP
+      xmpp-test:
+        port: 5223
+        expose: true
+        exposedPort: 5223
+        protocol: TCP
+EOF
+fi

traefik-values.yml

@@ -1,73 +0,0 @@
-globalArguments:
-  - "--api.insecure"
-  - "--accesslog"
-  - "--providers.kubernetescrd"
-#  - "--certificatesresolvers.shlug.acme.httpchallenge=true"
-#  - "--certificatesresolvers.shlug.acme.httpchallenge.entrypoint=web"
-  - "--certificatesresolvers.shlug.acme.email=webmaster@shlug.org"
-  - "--certificatesresolvers.shlug.acme.storage=/data/acme.json"
-  - "--certificatesresolvers.shlug.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
-
-# Configure ports
-ports:
-  traefik:
-    port: 9000
-    expose: false
-    # The exposed port for this service
-    exposedPort: 9000
-    # The port protocol (TCP/UDP)
-    protocol: TCP
-  web:
-    port: 8000
-    # hostPort: 8000
-    expose: true
-    exposedPort: 80
-    # The port protocol (TCP/UDP)
-    protocol: TCP
-    # Use nodeport if set. This is useful if you have configured Traefik in a
-    # LoadBalancer
-    nodePort: 30080
-    # Port Redirections
-    # Added in 2.2, you can make permanent redirects via entrypoints.
-    # https://docs.traefik.io/routing/entrypoints/#redirection
-    # redirectTo: websecure
-  websecure:
-    port: 8443
-    # hostPort: 8443
-    expose: true
-    exposedPort: 443
-    # The port protocol (TCP/UDP)
-    protocol: TCP
-    nodePort: 30443
-    # Enable HTTP/3.
-    # Requires enabling experimental http3 feature and tls.
-    # Note that you cannot have a UDP entrypoint with the same port.
-    # http3: true
-    # Set TLS at the entrypoint
-    # https://doc.traefik.io/traefik/routing/entrypoints/#tls
-    tls:
-      enabled: true
-      # this is the name of a TLSOption definition
-      options: ""
-      certResolver: "httpchallenge"
-      domains: 
-        - main: jitsi-test.shlug.org
-
-      # - main: example.com
-      #   sans:
-      #     - foo.example.com
-      #     - bar.example.com
-  metrics:
-    port: 9100
-    # hostPort: 9100
-    # Defines whether the port is exposed if service.type is LoadBalancer or
-    # NodePort.
-    #
-    # You may not want to expose the metrics port on production deployments.
-    # If you want to access it from outside of your cluster,
-    # use `kubectl port-forward` or create a secure ingress
-    expose: false
-    # The exposed port for this service
-    exposedPort: 9100
-    # The port protocol (TCP/UDP)
-    protocol: TCP

values.yml

@@ -1,12 +0,0 @@
-nameOverride: "shlug"
-
-jvb:
-  service:
-    type: NodePort
-  # It may be required to change the default port to a value allowed by Kubernetes (30000-32768)
-  UDPPort: 30000
-
-  # Use public IP of one of your node, or the public IP of a loadbalancer in front of the nodes
-  publicIP: 20.205.103.185
-
-publicURL: jisti.ycy.me