Adds jitsi app.

jitsi/app.yaml

@@ -0,0 +1,5 @@
+name: jitsi
+is: jitsi
+description: Jitsi Meet is a fully encrypted, open-source video conferencing platform that you can self-host with no account required.
+icon: https://raw.githubusercontent.com/jitsi/jitsi-meet/master/images/jitsilogo.png
+latest: stable

jitsi/versions/stable/README.md

@@ -0,0 +1,21 @@
+# Jitsi
+
+Jitsi Meet is an open-source video conferencing platform. No account or installation is required to join a meeting.
+
+## Configuration
+
+Key settings in `config.yaml`:
+
+- **domain** - Where Jitsi will be accessible
+- **jvbStunServers** - STUN servers for WebRTC NAT traversal (defaults to Google's public STUN servers)
+
+## Usage
+
+Just visit the app URL and enter a meeting room name (or click the microphone icon to start one). Share the URL with participants — they can join from any modern browser without installing anything.
+
+## Notes
+
+- Jitsi uses WebRTC for peer-to-peer video — audio/video quality depends on participants' network conditions
+- By default, anyone can create and join meetings — authentication can be enabled via the Jitsi admin settings if you need to restrict access
+- The internal component secrets (`jicofoAuthPassword`, `jvbAuthPassword`, `jicofoComponentSecret`) are auto-generated and used for communication between Jitsi's internal services (Jicofo, JVB, Prosody) — do not change them after deployment
+- For large meetings (10+ participants), consider tuning the JVB (Video Bridge) resource limits

jitsi/versions/stable/deployment-jicofo.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jitsi-jicofo
+  namespace: {{ .namespace }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: jicofo
+  template:
+    metadata:
+      labels:
+        component: jicofo
+    spec:
+      securityContext:
+        runAsNonRoot: false
+        runAsUser: 0
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: jitsi-jicofo
+          image: jitsi/jicofo:jicofo-1.0-1184-1
+          env:
+            - name: XMPP_DOMAIN
+              value: "{{ .xmppDomain }}"
+            - name: XMPP_AUTH_DOMAIN
+              value: "{{ .xmppAuthDomain }}"
+            - name: XMPP_MUC_DOMAIN
+              value: "{{ .xmppMucDomain }}"
+            - name: XMPP_INTERNAL_MUC_DOMAIN
+              value: "{{ .xmppInternalMucDomain }}"
+            - name: XMPP_SERVER
+              value: prosody
+            - name: XMPP_PORT
+              value: "5222"
+            - name: JICOFO_COMPONENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-secrets
+                  key: jicofoComponentSecret
+            - name: JICOFO_AUTH_USER
+              value: focus
+            - name: JICOFO_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-secrets
+                  key: jicofoAuthPassword
+            - name: JVB_BREWERY_MUC
+              value: jvbbrewery
+            - name: ENABLE_AUTH
+              value: "0"
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
+          securityContext:
+            readOnlyRootFilesystem: false
+      restartPolicy: Always

jitsi/versions/stable/deployment-jvb.yaml

@@ -0,0 +1,72 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jitsi-jvb
+  namespace: {{ .namespace }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: jvb
+  template:
+    metadata:
+      labels:
+        component: jvb
+    spec:
+      securityContext:
+        runAsNonRoot: false
+        runAsUser: 0
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: jitsi-jvb
+          image: jitsi/jvb:jvb-2.3-296-g318c08ddc-1
+          ports:
+            - name: rtp-udp
+              containerPort: 10000
+              protocol: UDP
+            - name: colibri-ws
+              containerPort: 9090
+              protocol: TCP
+          env:
+            - name: XMPP_DOMAIN
+              value: "{{ .xmppDomain }}"
+            - name: XMPP_AUTH_DOMAIN
+              value: "{{ .xmppAuthDomain }}"
+            - name: XMPP_INTERNAL_MUC_DOMAIN
+              value: "{{ .xmppInternalMucDomain }}"
+            - name: XMPP_SERVER
+              value: prosody
+            - name: XMPP_PORT
+              value: "5222"
+            - name: JVB_AUTH_USER
+              value: jvb
+            - name: JVB_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-secrets
+                  key: jvbAuthPassword
+            - name: JVB_BREWERY_MUC
+              value: jvbbrewery
+            - name: JVB_STUN_SERVERS
+              value: "{{ .jvbStunServers }}"
+            - name: JVB_DISABLE_STUN
+              value: "false"
+            - name: JVB_TCP_HARVESTER_DISABLED
+              value: "false"
+            - name: ENABLE_COLIBRI_WEBSOCKET
+              value: "1"
+            - name: PUBLIC_URL
+              value: "https://{{ .domain }}"
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 256Mi
+          securityContext:
+            readOnlyRootFilesystem: false
+      restartPolicy: Always

jitsi/versions/stable/deployment-prosody.yaml

@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jitsi-prosody
+  namespace: {{ .namespace }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: prosody
+  template:
+    metadata:
+      labels:
+        component: prosody
+    spec:
+      securityContext:
+        runAsNonRoot: false
+        runAsUser: 0
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: jitsi-prosody
+          image: jitsi/prosody:prosody-13.0.6
+          ports:
+            - name: xmpp-c2s
+              containerPort: 5222
+              protocol: TCP
+            - name: xmpp-component
+              containerPort: 5347
+              protocol: TCP
+            - name: xmpp-bosh
+              containerPort: 5280
+              protocol: TCP
+          env:
+            - name: XMPP_DOMAIN
+              value: "{{ .xmppDomain }}"
+            - name: XMPP_AUTH_DOMAIN
+              value: "{{ .xmppAuthDomain }}"
+            - name: XMPP_MUC_DOMAIN
+              value: "{{ .xmppMucDomain }}"
+            - name: XMPP_INTERNAL_MUC_DOMAIN
+              value: "{{ .xmppInternalMucDomain }}"
+            - name: XMPP_GUEST_DOMAIN
+              value: "{{ .xmppGuestDomain }}"
+            - name: JICOFO_COMPONENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-secrets
+                  key: jicofoComponentSecret
+            - name: JICOFO_AUTH_USER
+              value: focus
+            - name: JICOFO_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-secrets
+                  key: jicofoAuthPassword
+            - name: JVB_AUTH_USER
+              value: jvb
+            - name: JVB_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-secrets
+                  key: jvbAuthPassword
+            - name: ENABLE_AUTH
+              value: "0"
+            - name: ENABLE_GUESTS
+              value: "1"
+            - name: AUTH_TYPE
+              value: internal
+            - name: PUBLIC_URL
+              value: "https://{{ .domain }}"
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
+          securityContext:
+            readOnlyRootFilesystem: false
+      restartPolicy: Always

jitsi/versions/stable/deployment-web.yaml

@@ -0,0 +1,87 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jitsi-web
+  namespace: {{ .namespace }}
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: web
+  template:
+    metadata:
+      labels:
+        component: web
+    spec:
+      securityContext:
+        runAsNonRoot: false
+        runAsUser: 0
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: jitsi-web
+          image: jitsi/web:web-1.0.9282-1
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          env:
+            - name: PUBLIC_URL
+              value: "https://{{ .domain }}"
+            - name: XMPP_DOMAIN
+              value: "{{ .xmppDomain }}"
+            - name: XMPP_AUTH_DOMAIN
+              value: "{{ .xmppAuthDomain }}"
+            - name: XMPP_MUC_DOMAIN
+              value: "{{ .xmppMucDomain }}"
+            - name: XMPP_INTERNAL_MUC_DOMAIN
+              value: "{{ .xmppInternalMucDomain }}"
+            - name: XMPP_GUEST_DOMAIN
+              value: "{{ .xmppGuestDomain }}"
+            - name: XMPP_SERVER
+              value: prosody
+            - name: XMPP_PORT
+              value: "5222"
+            - name: XMPP_BOSH_URL_BASE
+              value: "http://prosody:5280"
+            - name: JVB_STUN_SERVERS
+              value: "{{ .jvbStunServers }}"
+            - name: ENABLE_AUTH
+              value: "0"
+            - name: ENABLE_GUESTS
+              value: "1"
+            - name: JICOFO_AUTH_USER
+              value: focus
+            - name: JICOFO_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-secrets
+                  key: jicofoAuthPassword
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 50m
+              memory: 64Mi
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          securityContext:
+            readOnlyRootFilesystem: false
+      restartPolicy: Always

jitsi/versions/stable/ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jitsi
+  namespace: {{ .namespace }}
+  annotations:
+    external-dns.alpha.kubernetes.io/target: {{ .externalDnsDomain }}
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+    external-dns.alpha.kubernetes.io/ttl: "60"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: {{ .domain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: jitsi-web
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - {{ .domain }}
+      secretName: {{ .tlsSecretName }}

jitsi/versions/stable/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: {{ .namespace }}
+labels:
+  - includeSelectors: true
+    pairs:
+      app: jitsi
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - deployment-web.yaml
+  - deployment-prosody.yaml
+  - deployment-jicofo.yaml
+  - deployment-jvb.yaml
+  - service.yaml
+  - ingress.yaml

jitsi/versions/stable/manifest.yaml

@@ -0,0 +1,16 @@
+version: web-1.0.9282-2
+defaultConfig:
+  namespace: jitsi
+  domain: "jitsi.{{ .cloud.domain }}"
+  externalDnsDomain: "{{ .cloud.domain }}"
+  tlsSecretName: wildcard-wild-cloud-tls
+  xmppDomain: meet.jitsi
+  xmppAuthDomain: auth.meet.jitsi
+  xmppMucDomain: muc.meet.jitsi
+  xmppInternalMucDomain: internal-muc.meet.jitsi
+  xmppGuestDomain: guest.meet.jitsi
+  jvbStunServers: "stun.l.google.com:19302,stun1.l.google.com:19302"
+defaultSecrets:
+  - key: jicofoAuthPassword
+  - key: jvbAuthPassword
+  - key: jicofoComponentSecret

jitsi/versions/stable/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .namespace }}

jitsi/versions/stable/service.yaml

@@ -0,0 +1,61 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jitsi-web
+  namespace: {{ .namespace }}
+  labels:
+    component: web
+spec:
+  selector:
+    component: web
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: prosody
+  namespace: {{ .namespace }}
+  labels:
+    component: prosody
+spec:
+  selector:
+    component: prosody
+  ports:
+    - name: xmpp-c2s
+      port: 5222
+      targetPort: 5222
+      protocol: TCP
+    - name: xmpp-component
+      port: 5347
+      targetPort: 5347
+      protocol: TCP
+    - name: xmpp-bosh
+      port: 5280
+      targetPort: 5280
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jitsi-jvb
+  namespace: {{ .namespace }}
+  labels:
+    component: jvb
+spec:
+  type: NodePort
+  selector:
+    component: jvb
+  ports:
+    - name: rtp-udp
+      port: 10000
+      targetPort: 10000
+      protocol: UDP
+    - name: colibri-ws
+      port: 9090
+      targetPort: 9090
+      protocol: TCP