# 更新软件源并安装 Docker Engine + Docker Compose v2
sudo apt update && sudo apt install -y 
    ca-certificates curl gnupg lsb-release

# 添加 Docker 官方 GPG 密钥与仓库
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | 
    sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] 
https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | 
    sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update && sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

# 验证安装
docker compose version
# 预期输出：Docker Compose version v2.x.x

# 示例：使用 acme.sh 申请泛域名证书（需 DNS API Token）
curl https://get.acme.sh | sh -s email=admin@example.com
~/.acme.sh/acme.sh --issue --dns dns_ali -d "meet.example.com" -d "*.meet.example.com"
# 证书默认生成在 ~/.acme.sh/meet.example.com/

/opt/jitsi/
├── docker-compose.yml          # 主编排文件
├── .env                        # 环境变量（敏感信息）
├── config/                     # 持久化配置目录
│   ├── web/                    # nginx 配置与证书
│   ├── prosody/                # XMPP 服务器数据
│   ├── jicofo/                 # 会议焦点组件
│   ├── jvb/                    # 视频桥接组件
│   └── recorder/               # 录制服务（可选）
└── scripts/                    # 运维辅助脚本

# 域名与网络
PUBLIC_URL=https://meet.example.com
DOCKER_HOST_ADDRESS=192.168.1.10   # 服务器内网 IP，用于 JVB 绑定

# 认证与安全（生产环境务必修改默认值）
JICOFO_AUTH_PASSWORD=StrongPassw0rd_Jicofo
JVB_AUTH_PASSWORD=StrongPassw0rd_JVB
JIGASI_XMPP_PASSWORD=StrongPassw0rd_Jigasi
JIBRI_XMPP_PASSWORD=StrongPassw0rd_Jibri
JIBRI_RECORDER_PASSWORD=StrongPassw0rd_Recorder
JIBRI_RECORDING_DIR=/config/recordings

# 证书路径（映射到容器 /config/web/certs）
SSL_CERT_PATH=./config/web/certs/fullchain.pem
SSL_KEY_PATH=./config/web/certs/privkey.pem

# 时区与语言
TZ=Asia/Shanghai
LANG=zh_CN.UTF-8

# 可选：启用录制与直播推流
ENABLE_RECORDING=1
ENABLE_LIVESTREAM=1

version: '3.8'

services:
  # 1. Web 前端 + Nginx 反向代理 + 信令转发
  web:
    image: jitsi/web:stable-8000
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./config/web:/config:Z
      - ./config/web/certs:/usr/local/share/ca-certificates:ro
    environment:
      - PUBLIC_URL=${PUBLIC_URL}
      - TZ=${TZ}
      - ENABLE_AUTH=1
      - ENABLE_GUESTS=1
      - AUTH_TYPE=internal
    networks:
      - jitsi-net

  # 2. Prosody XMPP 服务器（信令核心）
  prosody:
    image: jitsi/prosody:stable-8000
    restart: unless-stopped
    expose:
      - "5222"
      - "5347"
      - "5280"
    volumes:
      - ./config/prosody:/config:Z
      - ./config/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
    environment:
      - PUBLIC_URL=${PUBLIC_URL}
      - JICOFO_AUTH_PASSWORD=${JICOFO_AUTH_PASSWORD}
      - JVB_AUTH_PASSWORD=${JVB_AUTH_PASSWORD}
      - JIGASI_XMPP_PASSWORD=${JIGASI_XMPP_PASSWORD}
      - JIBRI_XMPP_PASSWORD=${JIBRI_XMPP_PASSWORD}
      - TZ=${TZ}
    networks:
      - jitsi-net

  # 3. Jicofo 会议焦点（会议控制与分配）
  jicofo:
    image: jitsi/jicofo:stable-8000
    restart: unless-stopped
    volumes:
      - ./config/jicofo:/config:Z
    environment:
      - JICOFO_AUTH_PASSWORD=${JICOFO_AUTH_PASSWORD}
      - JVB_BREWERY=jvb
      - TZ=${TZ}
    depends_on:
      - prosody
    networks:
      - jitsi-net

  # 4. JVB 视频桥接（SFU 媒体转发，高并发核心）
  jvb:
    image: jitsi/jvb:stable-8000
    restart: unless-stopped
    ports:
      - "10000:10000/udp"   # 媒体端口范围起
      - "20000:20000/udp"   # 媒体端口范围止（建议映射更宽范围）
      - "4443:4443/tcp"     # 备用 TCP 穿透
    volumes:
      - ./config/jvb:/config:Z
    environment:
      - DOCKER_HOST_ADDRESS=${DOCKER_HOST_ADDRESS}
      - JVB_AUTH_PASSWORD=${JVB_AUTH_PASSWORD}
      - JVB_PORT=10000
      - JVB_PORT_RANGE=10000-20000
      - TZ=${TZ}
    depends_on:
      - prosody
    networks:
      - jitsi-net
    # 生产环境建议开启 host 网络模式以减少 NAT 损耗
    # network_mode: host

networks:
  jitsi-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

cd /opt/jitsi

# 首次拉取镜像（建议国内环境配置镜像加速器）
docker compose pull

# 后台启动
docker compose up -d

# 实时查看聚合日志
docker compose logs -f --tail=100

# 进入 Prosody 容器注册用户
docker compose exec prosody prosodyctl register admin meet.example.com 'AdminPassw0rd'

# 授予焦点权限（可选，用于 API 调度）
docker compose exec prosody prosodyctl mod_admin_adhoc 'admin@meet.example.com' 'focus@auth.meet.example.com' 'owner'

# Nginx 片段示例
location / {
    proxy_pass http://127.0.0.1:8080;  # 指向 web 容器 80 端口
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
}

# 媒体端口 UDP 透传需使用 stream 模块
stream {
    upstream jvb_udp {
        server 127.0.0.1:10000;
    }
    server {
        listen 10000 udp reuseport;
        proxy_pass jvb_udp;
    }
}

# 扩大连接跟踪表与 UDP 缓冲
net.netfilter.nf_conntrack_max = 1048576
net.core.netdev_max_backlog = 30000
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.udp_mem = 25600 51200 102400
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384

sudo apt install -y fail2ban
cat > /etc/fail2ban/jail.d/jitsi.local <<'EOF'
[prosody-auth]
enabled = true
filter = prosody-auth
logpath = /opt/jitsi/config/prosody/data/prosody.log
maxretry = 5
bantime = 3600
findtime = 600
port = 5222,5269,5347
protocol = tcp
EOF
sudo systemctl restart fail2ban

# 在 docker-compose.yml 每个 service 下添加
logging:
  driver: "json-file"
  options:
    max-size: "50m"
    max-file: "5"
    labels: "service={{.Name}}"

#!/bin/bash
# backup_jitsi.sh - 每日 02:00 执行
set -euo pipefail
BACKUP_DIR="/mnt/backup/jitsi/$(date +%F)"
mkdir -p "$BACKUP_DIR"

# 1. 配置与证书
tar czf "$BACKUP_DIR/config.tar.gz" -C /opt/jitsi config/

# 2. Prosody 数据库（SQLite）
docker compose exec -T prosody prosodyctl backup "$BACKUP_DIR/prosody_dump.sql"

# 3. 录制文件（如启用）
# tar czf "$BACKUP_DIR/recordings.tar.gz" -C /opt/jitsi config/recordings/

# 保留 30 天
find /mnt/backup/jitsi -type d -mtime +30 -exec rm -rf {} ;

# 追加到 docker-compose.yml
jibri:
  image: jitsi/jibri:stable-8000
  restart: unless-stopped
  volumes:
    - ./config/jibri:/config:Z
    - /dev/shm:/dev/shm  # 必须共享宿主机共享内存
  environment:
    - JIBRI_XMPP_PASSWORD=${JIBRI_XMPP_PASSWORD}
    - JIBRI_RECORDER_PASSWORD=${JIBRI_RECORDER_PASSWORD}
    - JIBRI_RECORDING_DIR=${JIBRI_RECORDING_DIR}
    - TZ=${TZ}
  depends_on:
    - prosody
  networks:
    - jitsi-net
  # 需要宿主机安装 chrome + ffmpeg，建议独立 GPU 实例
  privileged: true

AUTH_TYPE=ldap
LDAP_URL=ldap://ldap.example.com:389
LDAP_BASE=ou=people,dc=example,dc=com
LDAP_BIND_DN=cn=jitsi,ou=service,dc=example,dc=com
LDAP_BIND_PASSWORD=LdapBindPassw0rd
LDAP_FILTER=(uid=%s)

AUTH_TYPE=oidc
OIDC_AUTH_URL=https://sso.example.com/realms/corp/protocol/openid-connect/auth
OIDC_TOKEN_URL=https://sso.example.com/realms/corp/protocol/openid-connect/token
OIDC_CLIENT_ID=jitsi-meet
OIDC_CLIENT_SECRET=OidcClientSecret

#!/bin/bash
# upgrade_jitsi.sh
set -euo pipefail
cd /opt/jitsi

# 1. 备份当前版本
./scripts/backup_jitsi.sh

# 2. 拉取新版镜像（指定版本号，避免 latest）
docker compose pull

# 3. 滚动重启（保持会话不中断需配合 JVB 优雅下线）
docker compose up -d --remove-orphans

# 4. 健康检查
sleep 30
./scripts/health_check.sh || { echo "升级失败，执行回滚"; docker compose down; docker compose up -d; exit 1; }

# 5. 清理旧镜像
docker image prune -f --filter "until=24h"

version: '3.8'

services:
  # 1. 外挂数据库：替代 Prosody 内置 SQLite
  postgres:
    image: postgres:16-alpine
    restart: always
    environment:
      POSTGRES_DB: jitsi
      POSTGRES_USER: jitsi
      POSTGRES_PASSWORD_FILE: /run/secrets/pg_password
    volumes:
      - pg_data:/var/lib/postgresql/data
      - ./sql/init_prosody.sql:/docker-entrypoint-initdb.d/init.sql:ro
    secrets:
      - pg_password
    networks: [infra-net]
    deploy:
      resources:
        limits: { cpus: '2', memory: 4G }
        reservations: { cpus: '1', memory: 2G }

  # 2. 外挂缓存：支撑 Prosody 分布式锁、会话缓存、限流计数
  redis:
    image: redis:7-alpine
    restart: always
    command: ["redis-server", "--appendonly", "yes", "--maxmemory", "2gb", "--maxmemory-policy", "allkeys-lru"]
    volumes:
      - redis_data:/data
    networks: [infra-net]
    deploy:
      resources:
        limits: { cpus: '1', memory: 3G }

  # 3. Prosody 集群模式（需 prosody-modules: mod_pubsub, mod_smacks, mod_carbon, mod_cloud_notify）
  prosody:
    image: jitsi/prosody:stable-8000
    restart: unless-stopped
    environment:
      - AUTH_TYPE=internal
      - ENABLE_LOBBY=1
      - ENABLE_RECORDING=1
      - JICOFO_AUTH_PASSWORD_FILE: /run/secrets/jicofo_pass
      - JVB_AUTH_PASSWORD_FILE: /run/secrets/jvb_pass
      # 关键：指向外部 PG/Redis
      - PROSODY_CONFIG_EXTRA=
        storage = "sql"
        sql = { driver = "PostgreSQL", database = "jitsi", username = "jitsi", password = "$(POSTGRES_PASSWORD)", host = "postgres" }
        -- Redis for distributed cache/locks
        cache = "redis"
        redis = { host = "redis", port = 6379 }
    secrets:
      - jicofo_pass
      - jvb_pass
      - pg_password
    volumes:
      - ./config/prosody:/config:Z
    networks: [infra-net, jitsi-net]
    deploy:
      replicas: 1  # Prosody 主节点单实例写入，读可扩展只读副本
      placement:
        constraints: [node.role == manager]  # 固定在管理节点便于 VIP 漂移

  # 4. Jicofo 高可用：通过 Prosody MUC 选主，仅 Leader 处理会议分配
  jicofo:
    image: jitsi/jicofo:stable-8000
    restart: unless-stopped
    environment:
      - JICOFO_AUTH_PASSWORD_FILE: /run/secrets/jicofo_pass
      - JVB_BREWERY=jvbbrewery@internal.auth.${DOMAIN}
      - JICOFO_RESERVATION_REST_BASE_URL=http://web:8080  # 可选：预留 API
    secrets:
      - jicofo_pass
    volumes:
      - ./config/jicofo:/config:Z
    networks: [jitsi-net]
    deploy:
      replicas: 2  # 双实例热备，自动选主
      update_config:
        parallelism: 1
        delay: 30s
        failure_action: rollback

  # 5. JVB 无状态扩展组：核心吞吐层，建议独立节点池
  jvb:
    image: jitsi/jvb:stable-8000
    restart: unless-stopped
    # 生产强烈建议 host 网络模式，规避 Docker 网桥性能损耗与 NAT 复杂性
    network_mode: host
    environment:
      - DOCKER_HOST_ADDRESS=${PUBLIC_IP}  # 必须为公网/浮动 IP
      - JVB_AUTH_PASSWORD_FILE: /run/secrets/jvb_pass
      - JVB_PORT=10000
      - JVB_PORT_RANGE=10000-20000
      - JVB_ENABLE_APIS=rest,colibri
      - JVB_STATS_INTERVAL=5000
      # 关键调优参数
      - VIDEOBRIDGE_MAX_THREADS=500
      - VIDEOBRIDGE_RTP_BUFFER_SIZE=1048576
    secrets:
      - jvb_pass
    volumes:
      - ./config/jvb:/config:Z
      - /dev/shm:/dev/shm  # 大页内存/共享内存加速
    networks: [jitsi-net]
    deploy:
      replicas: 3  # 起步 3 节点，按并发数线性扩容
      resources:
        limits: { cpus: '8', memory: 16G }
        reservations: { cpus: '4', memory: 8G }
      placement:
        preferences:
          - spread: node.labels.jvb-pool == true  # 专用标签节点池

  # 6. Web 前端：无状态，挂载共享配置与证书
  web:
    image: jitsi/web:stable-8000
    restart: unless-stopped
    ports: ["80:80", "443:443"]
    volumes:
      - web_config:/config:Z
      - certs:/usr/local/share/ca-certificates:ro
    environment:
      - PUBLIC_URL=https://${DOMAIN}
      - ENABLE_AUTH=1
      - ENABLE_GUESTS=1
      - XMPP_SERVER=prosody
      - XMPP_DOMAIN=${DOMAIN}
    networks: [jitsi-net]
    deploy:
      replicas: 3
      update_config:
        parallelism: 2
        delay: 10s

secrets:
  pg_password: { external: true }
  jicofo_pass: { external: true }
  jvb_pass: { external: true }

volumes:
  pg_data: { driver: local }
  redis_data: { driver: local }
  web_config: { driver: local }
  certs: { driver: local }

networks:
  infra-net: { driver: overlay, attachable: true }  # 基础设施网络
  jitsi-net: { driver: overlay, attachable: true }  # 业务网络

# monitoring/docker-compose.mon.yml
version: '3.8'
services:
  prometheus:
    image: prom/prometheus:v2.52.0
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prom_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.retention.time=30d'
      - '--web.enable-lifecycle'
    ports: ["9090:9090"]
    networks: [mon-net]

  grafana:
    image: grafana/grafana:10.4.0
    volumes:
      - ./dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./datasources:/etc/grafana/provisioning/datasources:ro
      - grafana_data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD_FILE=/run/secrets/gf_pass
      - GF_INSTALL_PLUGINS=grafana-piechart-panel
    secrets: [gf_pass]
    ports: ["3000:3000"]
    networks: [mon-net]

  # JVB 专用 Exporter (社区维护)
  jvb-exporter:
    image: jitsi/jvb-prometheus-exporter:latest
    environment:
      - JVB_HOST=jvb-1,jvb-2,jvb-3  # 逗号分隔或服务发现
      - JVB_PORT=8080
    networks: [jitsi-net, mon-net]

networks:
  mon-net: { external: true }
  jitsi-net: { external: true }

volumes:
  prom_data: {}
  grafana_data: {}

-- Prosody mod_tracing.lua 片段
module:hook("stanza/iq", function(event)
    local trace_id = event.stanza.attr["trace-id"] or generate_trace_id()
    event.stanza.attr["trace-id"] = trace_id
    -- 记录 Span: prosody.handle_iq
end)

# 1. 克隆源码 (锁定版本)
git clone --branch stable-8000 --depth 1 https://github.com/jitsi/jitsi-meet.git
cd jitsi-meet

# 2. 定制化配置
cat > config-overrides.js <<'EOF'
module.exports = {
  // 品牌化
  defaultLogoUrl: 'assets/logo-enterprise.svg',
  watermarkLink: 'https://meet.example.com',
  // 功能开关
  disableDeepLinking: false,
  enableCalendarIntegration: true,
  enableRecording: true,
  enableLiveStreaming: true,
  // 安全策略
  disableThirdPartyRequests: true,
  // 部署环境变量注入
  deploymentInfo: {
    environment: process.env.DEPLOY_ENV || 'prod',
    version: process.env.APP_VERSION || 'unknown',
    supportUrl: 'https://support.example.com'
  }
};
EOF

# 3. 构建镜像 (多阶段构建优化体积)
cat > Dockerfile.custom <<'EOF'
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
ARG DEPLOY_ENV=prod
ARG APP_VERSION
ENV DEPLOY_ENV=${DEPLOY_ENV} APP_VERSION=${APP_VERSION}
RUN npm run build

FROM nginx:alpine
COPY --from=builder /app/_site /usr/share/nginx/html
COPY nginx.custom.conf /etc/nginx/conf.d/default.conf
EXPOSE 80
EOF

# 4. CI/CD 集成 (GitLab CI 示例)
# .gitlab-ci.yml
build_web:
  stage: build
  image: docker:24
  services: [docker:dind]
  variables:
    DOCKER_TLS_CERTDIR: ""
  script:
    - docker build -t registry.example.com/jitsi/web:${CI_COMMIT_SHA} -f Dockerfile.custom .
    - docker push registry.example.com/jitsi/web:${CI_COMMIT_SHA}
  only: [tags, main]

# turn/docker-compose.turn.yml
version: '3.8'
services:
  coturn:
    image: coturn/coturn:4.6.2
    network_mode: host  # 必须 host 模式绑定 443/3478
    restart: unless-stopped
    command: >
      -n
      -r turn.example.com
      -a
      -u turnuser:turnpass
      --lt-cred-mech
      --realm=example.com
      --cert=/certs/fullchain.pem
      --pkey=/certs/privkey.pem
      --tls-listening-port=443
      --listening-port=3478
      --min-port=49152
      --max-port=65535
      --no-multicast-peers
      --log-file=stdout
    volumes:
      - ./certs:/certs:ro
    deploy:
      replicas: 2
      placement:
        constraints: [node.labels.edge == true]

# .env 追加
JVB_TURN_CREDENTIALS=turnuser:turnpass
JVB_TURN_HOST=turn.example.com
JVB_TURN_PORT=443
JVB_TURN_TRANSPORT=tls

# scripts/recording_lifecycle.py
import boto3, os, datetime
from pathlib import Path

s3 = boto3.client('s3', endpoint_url=os.getenv('S3_ENDPOINT'))
BUCKET = 'jitsi-recordings'
POLICIES = {
    'default': {'transition_ia': 30, 'transition_glacier': 90, 'expire': 365},
    'legal_hold': {'transition_ia': 7, 'transition_glacier': 30, 'expire': 2555}, # 7年
    'temp_meeting': {'expire': 7}
}

def apply_lifecycle():
    for obj in s3.list_objects_v2(Bucket=BUCKET)['Contents']:
        key = obj['Key']
        tenant, meeting_id, _ = key.split('/', 2)
        policy = POLICIES.get(get_tenant_policy(tenant), POLICIES['default'])
        # 设置 Object Tagging 触发 S3 Lifecycle Rule
        s3.put_object_tagging(Bucket=BUCKET, Key=key,
            Tagging={'TagSet': [
                {'Key': 'RetentionPolicy', 'Value': get_tenant_policy(tenant)},
                {'Key': 'Tenant', 'Value': tenant}
            ]})

if __name__ == '__main__':
    apply_lifecycle()

<LifecycleConfiguration>
  <Rule>
    <Filter><Tag><Key>RetentionPolicy</Key><Value>legal_hold</Value></Tag></Filter>
    <Transition><Days>7</Days><StorageClass>STANDARD_IA</StorageClass></Transition>
    <Transition><Days>30</Days><StorageClass>GLACIER</StorageClass></Transition>
    <Expiration><Days>2555</Days></Expiration>
  </Rule>
</LifecycleConfiguration>

# K8s HPA 示例 (若迁移至 K8s) / Docker Swarm 自定义控制器逻辑
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: jvb-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: jvb
  minReplicas: 3
  maxReplicas: 50
  metrics:
  - type: Prometheus
    prometheus:
      metricName: jvb_conference_count_per_instance
      target:
        type: AverageValue
        averageValue: "80"  # 单 JVB 80 个会议触发扩容
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 65
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 600  # 10 分钟冷却防抖
      policies:
      - type: Percent
        value: 10
        periodSeconds: 300
    scaleUp:
      stabilizationWindowSeconds: 60
      policies:
      - type: Percent
        value: 50
        periodSeconds: 60
      - type: Pods
        value: 4
        periodSeconds: 60
      selectPolicy: Max

# autoscaler.py (每 60s 运行一次)
import docker, requests, math

client = docker.from_env()
PROM = "http://prometheus:9090"

def get_avg_conferences_per_jvb():
    q = 'avg(jvb_conference_count) by (instance)'
    res = requests.get(f"{PROM}/api/v1/query", params={'query': q}).json()
    return sum(v['value'][1] for v in res['data']['result']) / len(res['data']['result'])

def scale_jvb(target=80, max_replicas=30):
    avg = get_avg_conferences_per_jvb()
    current = len([c for c in client.services.list(filters={'name': 'jvb'})])
    desired = min(max_replicas, max(3, math.ceil(avg / target * current)))
    if desired != current:
        service = client.services.get('jitsi_jvb')
        service.scale(desired)
        print(f"Scaled JVB: {current} -> {desired} (avg conferences: {avg:.1f})")

if __name__ == '__main__':
    scale_jvb()

timeline
    title 私有化视频会议平台演进路线
    section Phase 1 (0-1 月) : MVP 落地
        单节点 Docker Compose
        基础 HTTPS/认证/录制
        监控告警接入
    section Phase 2 (1-3 月) : 生产就绪
        HA 架构 (外挂 PG/Redis)
        多 JVB 节点池 + LB
        客户端白标发布
        等保三级整改
    section Phase 3 (3-6 月) : 平台化
        多租户 SaaS 化
        智能调度 (就近接入)
        语音转写/智能纪要 (ASR/LLM)
        移动端 SDK 深度集成
    section Phase 4 (6-12 月) : 智能化
        WebRTC Insertable Streams (背景虚化/水印)
        QUIC/WebTransport 传输层升级
        联邦互通 (Matrix/Interop)
        零信任网络接入 (ZTNA)

# 查看实时会议与参会人数
docker exec -it jvb-1 jvbctl conferences --details

# 强制踢出某会议所有用户 (需 Jicofo REST API)
curl -X DELETE "http://jicofo:8888/colibri/conferences/<conf-id>" -H "Authorization: Bearer <token>"

# 导出 Prosody 用户数据
docker exec prosody prosodyctl list_users meet.example.com > users_backup.txt

# 清理 7 天前录制文件 (挂载宿主机路径)
find /opt/jitsi/config/recordings -type f -mtime +7 -name "*.mp4" -delete

# 证书自动续期部署 (systemd timer)
# /etc/systemd/system/cert-renewal.service
# [Unit] Description=Renew Let's Encrypt Certs
# [Service] Type=oneshot ExecStart=/opt/jitsi/scripts/renew_certs.sh
# /etc/systemd/system/cert-renewal.timer
# [Timer] OnCalendar=daily Persistent=true
# [Install] WantedBy=timers.target