net.core.rmem_max=26214400
net.core.wmem_max=26214400
net.ipv4.udp_mem=26214400 26214400 26214400
net.core.netdev_max_backlog=5000

cd /opt
git clone --depth=1 https://github.com/jitsi/docker-jitsi-meet.git jitsi-meet
cd jitsi-meet
cp env.example .env

# 必改项
PUBLIC_URL=https://meet.example.com          # 完整访问地址
DOCKER_HOST_ADDRESS=192.168.x.x              # 服务器内网 IP（多网卡场景必填）
ENABLE_LETSENCRYPT=1                         # 自动申请 Let's Encrypt 证书
LETSENCRYPT_DOMAIN=meet.example.com
LETSENCRYPT_EMAIL=admin@example.com

# 安全加固项（强烈建议开启）
ENABLE_AUTH=1                                # 开启会议室密码/用户认证
ENABLE_GUESTS=0                              # 禁止匿名创建会议
AUTH_TYPE=internal                           # 内置用户库；可对接 LDAP/OAuth
JICOFO_AUTH_USER=focus
JICOFO_AUTH_PASSWORD=$(openssl rand -hex 16) # 自动生成强密码
JVB_AUTH_USER=jvb
JVB_AUTH_PASSWORD=$(openssl rand -hex 16)

# 性能调优
JVB_BREWERY_MUC=jvbbrewery@internal.auth.meet.example.com
JVB_PORT=10000                               # UDP 媒体端口
JVB_TCP_HARVESTER_DISABLED=true              # 禁用 TCP 回落（需防火墙放行 UDP）

# 一键生成所有服务间通信密钥
./gen-passwords.sh

# 后台启动全栈服务
docker compose up -d

# 观察日志确认健康
docker compose logs -f prosody | grep -E "listening|error"

# 1. HTTP -> HTTPS 跳转
curl -I http://meet.example.com | grep "301|302"

# 2. TLS 证书有效性
openssl s_client -connect meet.example.com:443 -servername meet.example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

# 3. WebSocket 信令通道
wscat -c wss://meet.example.com/xmpp-websocket  # 需安装 npm i -g wscat

# 主地域 JVB
org.jitsi.videobridge.octo.BIND_ADDRESS=10.0.1.10      # 内网互联 IP
org.jitsi.videobridge.octo.BIND_PORT=4096
org.jitsi.videobridge.octo.REGION=shanghai-az1
org.jitsi.videobridge.octo.ADVERTISED_ADDRESS=10.0.1.10

# 备地域 JVB (region 不同)
org.jitsi.videobridge.octo.REGION=beijing-az1

JICOFO_AUTH_USER=focus
JICOFO_OPTS="--region=shanghai-az1 --enable-octo=true"

# 1. 初始化 Schema (仅首次)
docker exec prosody prosodyctl --config /config/prosody.cfg.lua register focus auth.meet.example.com <password>
# 导入 schema.sql (见 docker-jitsi-meet/prosody/sql/postgresql/)

# 2. 修改 prosody.cfg.lua (通过 volume 挂载自定义配置)
VirtualHost "auth.meet.example.com"
    authentication = "internal_hashed"
    storage = "sql"
    sql = { driver = "PostgreSQL", database = "jitsi", username = "jitsi", password = "xxx", host = "db.internal" }

Component "conference.meet.example.com" "muc"
    storage = "sql"
    modules_enabled = { "muc_mam", "muc_mam_sql" } # 消息归档进 DB

# 1. 扩大 UDP 缓冲区（核心：防丢包）
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.core.rmem_default = 16777216
net.core.wmem_default = 16777216
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384

# 2. 网卡队列与中断优化
net.core.netdev_max_backlog = 10000
net.core.netdev_budget = 600
net.core.netdev_budget_usecs = 8000

# 3. 连接跟踪表扩容（防 nf_conntrack 溢出导致丢包）
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_buckets = 262144
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 60

# 4. BBRv2 拥塞控制（内核 5.10+）
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq

# 1. 启用 Simulcast 分层编码（客户端自适应带宽）
videobridge {
  enable-simulcast = true
  simulcast-encodings = [
    { rid = "h", scale-resolution-down-by = 1.0, max-bitrate = 2500000 },  # 1080p/720p
    { rid = "m", scale-resolution-down-by = 2.0, max-bitrate = 800000 },   # 360p
    { rid = "l", scale-resolution-down-by = 4.0, max-bitrate = 250000 }    # 180p
  ]
}

# 2. 带宽估算算法（Google GCC / REMB / Transport-CC）
# 推荐开启 Transport-CC (WebRTC 标准)，需客户端支持
videobridge.cc {
  transport-cc = true
  remb = false
}

# 3. 关闭不必要的 RTCP 报告间隔，减少信令开销
videobridge.rtcp {
  sender-report-interval = 5000  # ms，默认 1000，大房间可调大
}

# 4. 线程池与 CPU 亲和性（物理机/独享 vCPU 场景）
# -XX:ActiveProcessorCount=8 -Djdk.net.epoll.maxEvents=1024

// config.js 关键参数
p2p: { enabled: true, stunServers: [{ urls: 'stun:stun.l.google.com:19302' }] },
channelLastN: 25,                 // 大会议仅订阅最近发言 25 人
lastNLimits: { 5: 20, 10: 15, 20: 10, 30: 5 }, // 动态调整
constraints: {
  video: { height: { ideal: 720, max: 1080 }, frameRate: { ideal: 30, max: 30 } }
},
enableLayerSuspension: true,      // 悬挂非可见视频层，省带宽
enableRtx: true,                  // 重传机制

# docker-compose.turn.yml
services:
  turn:
    image: coturn/coturn:latest
    network_mode: host
    restart: always
    environment:
      TURN_SERVER_NAME: turn.meet.example.com
      TURN_REALM: meet.example.com
      TURN_USERNAME: turnuser
      TURN_PASSWORD: $(openssl rand -hex 16)
      TURN_MIN_PORT: 49152
      TURN_MAX_PORT: 65535
      TURN_EXTERNAL_IP: $(curl -s ifconfig.me)  # 公网 IP
      TURN_LISTENING_IP: 0.0.0.0
      TURN_TLS_LISTENING_PORT: 5349
      TURN_ALT_LISTENING_PORT: 80,443          # 穿透严格防火墙
      TURN_CERT_FILE: /certs/fullchain.pem
      TURN_PKEY_FILE: /certs/privkey.pem
      TURN_LOG_FILE: stdout
    volumes:
      - ./certs:/certs:ro
    healthcheck:
      test: ["CMD", "turnadmin", "-k", "-u", "healthcheck", "-r", "meet.example.com"]
      interval: 30s
      timeout: 10s
      retries: 3

ice {
  # 优先级：Host(本地) > Server Reflexive(STUN) > Relay(TURN)
  # 但弱网环境下，建议提前并行采集 Relay，避免串行超时
  gather-timeout = 3000  # ms，总采集超时
  nominate-timeout = 2000
  # 启用 ICE Restart 自动恢复网络切换
  restart-grace-period = 5000
}

# main.tf - 核心资源定义
module "jitsi_cluster" {
  source = "./modules/jitsi-ha"
  region = var.region
  vpc_id = var.vpc_id
  instance_type = "ecs.g7.2xlarge"  # 8vCPU 32GB
  jvb_count = 3
  jvb_spot_strategy = "SpotWithPriceLimit"
  spot_price_limit = "1.5"  # 元/小时，成本降 70%
  db_instance_class = "pg.x8.2xlarge"
  db_engine_version = "14.0"
  domain_name = "meet.example.com"
  acm_cert_arn = var.acm_cert_arn
}

# playbook/jitsi-hardening.yml
- hosts: jitsi_all
  become: yes
  vars_files: [ vault.yml ]  # 加密存储密钥
  roles:
    - { role: geerlingguy.docker, tags: docker }
    - { role: jitsi.sysctl, tags: kernel }
    - { role: jitsi.fail2ban, tags: security }
    - { role: jitsi.prometheus-node-exporter, tags: monitor }
    - { role: jitsi.logrotate, tags: logs }
  tasks:
    - name: Deploy .env with template
      template: src=.env.j2 dest=/opt/jitsi-meet/.env mode=0600 owner=root
      notify: restart jitsi stack

# .gitlab-ci.yml 片段
stages: [build, test, deploy-staging, canary, deploy-prod]

jvb_canary:
  stage: canary
  image: docker:latest
  services: [docker:dind]
  script:
    - docker build -t $REGISTRY/jvb:$CI_COMMIT_SHA -f Dockerfile.jvb .
    - docker push $REGISTRY/jvb:$CI_COMMIT_SHA
    - |
      # 仅替换 1 个 JVB 实例镜像标签，观测 30 分钟
      kubectl set image deployment/jvb-canary jvb=$REGISTRY/jvb:$CI_COMMIT_SHA -n jitsi
      sleep 1800
      # 自动化指标校验
      curl -s $PROMETHEUS_API/query?query=rate(jvb_packet_loss_total[5m]) | jq '.data.result[0].value[1] | tonumber < 0.01'
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

scrape_configs:
- job_name: 'jvb'
  kubernetes_sd_configs: [{ role: pod }]
  relabel_configs:
  - source_labels: [__meta_kubernetes_pod_label_app]
    action: keep
    regex: jvb
  - source_labels: [__meta_kubernetes_pod_name]
    action: replace
    target_label: pod

// Jicofo 侧伪代码
Span span = tracer.spanBuilder("conference-create")
    .setAttribute("conference.id", roomName)
    .setAttribute("region", jvbRegion)
    .startScopedSpan();

e2ee: { enabled: true },  // 默认关闭，需用户手动点击“开启加密”按钮

#!/bin/bash
# cleanup.sh
PSQL="psql -h $DB_HOST -U $DB_USER -d jitsi"
# 1. 清理过期会议记录
$PSQL -c "DELETE FROM muc_log WHERE time < now() - interval '180 days';"
# 2. 清理孤儿录制文件 (DB 记录已删但对象存储残留)
mc ls --recursive minio/jitsi-recordings | awk '$1 < '"$(date -d '-90 days' +%s)"' {print $5}' | xargs -r mc rm minio/
# 3. 输出审计报告
echo "Cleanup done at $(date)" >> /var/log/jitsi-cleanup.log