┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│   Nginx     │────▶│  Jitsi Web  │     │  Jicofo     │
│  (反向代理/ │     │  (前端静态  │     │  (会议焦点  │
│   SSL终结)  │     │   资源服务) │     │   控制组件) │
└─────────────┘     └─────────────┘     └──────┬──────┘
                                                │
                        ┌─────────────┐         │
                        │  Prosody    │◀────────┘
                        │  (XMPP信令  │
                        │   服务器)   │
                        └──────┬──────┘
                               │
              ┌────────────────┼────────────────┐
              ▼                ▼                ▼
        ┌──────────┐    ┌──────────┐    ┌──────────┐
        │ JVB #1   │    │ JVB #2   │    │  Jibri   │
        │ (媒体转发)│    │ (媒体转发)│    │ (录制/直播)│
        └──────────┘    └──────────┘    └──────────┘

# 启用 BBR 与网络缓冲优化
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
net.core.rmem_max=26214400
net.core.wmem_max=26214400
net.ipv4.udp_mem=25600 51200 102400
fs.file-max=1000000

git clone https://github.com/jitsi/docker-jitsi-meet.git
cd docker-jitsi-meet
git checkout stable-8943   # 锁定稳定版本，避免主分支频繁变动
cp env.example .env

# ========== 基础标识 ==========
CONFIG=./jitsi-meet-cfg          # 持久化目录，建议挂载独立数据盘
TZ=Asia/Shanghai                 # 时区
PUBLIC_URL=https://meet.example.com  # 对外访问地址，必须 HTTPS

# ========== 网络与端口 ==========
HTTP_PORT=80
HTTPS_PORT=443
# JVB 暴露 UDP 端口段（宿主机:容器），防火墙需同步放行
JVB_PORT=10000
JVB_TCP_PORT=4443                # TCP 回退端口
JVB_TCP_MAPPED_PORT=4443
JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302

# ========== 认证与安全 ==========
ENABLE_AUTH=1                    # 开启登录鉴权，防止滥用
ENABLE_GUESTS=0                  # 禁止匿名入会，按业务调整
AUTH_TYPE=internal               # 内置账号体系，可对接 LDAP/OAuth
JICOFO_AUTH_USER=focus
JICOFO_AUTH_PASSWORD=StrongPwd_Focus_2024
JVB_AUTH_USER=jvb
JVB_AUTH_PASSWORD=StrongPwd_JVB_2024
JIBRI_AUTH_USER=jibri
JIBRI_AUTH_PASSWORD=StrongPwd_Jibri_2024

# ========== 录制与直播（可选） ==========
ENABLE_RECORDING=1
JIBRI_RECORDING_DIR=/config/recordings
JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh

# ========== 性能调优 ==========
JVB_BREWERY_MUC=jvbbrewery@internal.auth.meet.example.com
JVB_ENABLE_APIS=rest,colibri
JVB_WS_DOMAIN=meet.example.com
JVB_WS_SERVER_ID=jvb-1

# 1. 生成内部通信密钥
./gen-passwords.sh

# 2. 申请 Let's Encrypt 证书（需域名已解析到本机）
# 方式一：使用 Certbot 手动申请后挂载到 ./jitsi-meet-cfg/web/certs/
# 方式二：启用内置 Let's Encrypt 伴生容器（需 80 端口公网可达）
# 在 .env 中设置：
# ENABLE_LETSENCRYPT=1
# LETSENCRYPT_DOMAIN=meet.example.com
# LETSENCRYPT_EMAIL=ops@example.com

# 后台启动基础四件套：web、prosody、jicofo、jvb
docker compose up -d web prosody jicofo jvb

# 观察日志确认健康
docker compose logs -f --tail=100

# Jibri 需要特权模式与 /dev/shm 挂载，宿主机需安装 docker、chrome、ffmpeg
docker compose up -d jibri

# /etc/nginx/conf.d/jitsi.conf
upstream jitsi_web {
    server 127.0.0.1:8000;   # 对应 docker compose 中 web 容器映射端口
}

server {
    listen 443 ssl http2;
    server_name meet.example.com;

    ssl_certificate /etc/letsencrypt/live/meet.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/meet.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # 安全响应头
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header Referrer-Policy strict-origin-when-cross-origin;
    add_header Content-Security-Policy "frame-ancestors 'self';";

    # WebSocket 透传（JVB WebSocket 信令）
    location /xmpp-websocket/ {
        proxy_pass http://jitsi_web;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }

    location / {
        proxy_pass http://jitsi_web;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# .env 追加
AUTH_TYPE=ldap
LDAP_URL=ldaps://ldap.example.com:636
LDAP_BASE=ou=people,dc=example,dc=com
LDAP_BIND_DN=cn=jitsi,ou=service,dc=example,dc=com
LDAP_BIND_PASSWORD=LdapBindPwd_2024
LDAP_FILTER=(uid=%u)
LDAP_AUTH_METHOD=bind
LDAP_VERSION=3
LDAP_USE_TLS=1
LDAP_TLS_CIPHERS=HIGH
LDAP_TLS_CHECK_PEER=1
LDAP_TLS_CACERT_FILE=/config/ldap/ca.pem

#!/bin/bash
# $1 = 录制文件目录
# $2 = 会议名称
# $3 = 会议 ID
set -euo pipefail

REC_DIR="$1"
MEETING_NAME="$2"
MEETING_ID="$3"
DEST_BUCKET="s3://company-meeting-recordings/${MEETING_ID}/"

# 1. 合并 WebM 分片（Jibri 输出为多段 .webm）
ffmpeg -y -f concat -safe 0 -i <(for f in "${REC_DIR}"/*.webm; do echo "file '$f'"; done) 
       -c copy "${REC_DIR}/${MEETING_ID}.webm"

# 2. 转码为 MP4（兼容性更好）
ffmpeg -y -i "${REC_DIR}/${MEETING_ID}.webm" -c:v libx264 -preset fast -crf 23 
       -c:a aac -b:a 128k "${REC_DIR}/${MEETING_ID}.mp4"

# 3. 上传对象存储（需宿主机配置 awscli / rclone）
rclone copy "${REC_DIR}/${MEETING_ID}.mp4" "${DEST_BUCKET}" --progress

# 4. 清理本地临时文件
rm -rf "${REC_DIR}"/*.webm "${REC_DIR}/${MEETING_ID}.webm"

# 宿主机 ./jitsi-meet-cfg/jvb/jvb-java-opts.conf（挂载至容器 /config/jvb-java-opts.conf）
-XX:+UseZGC                          # JDK 17+ 推荐 ZGC，亚毫秒级停顿
-XX:MaxRAMPercentage=75.0            # 容器内存限制 8G 时堆约 6G
-XX:+ZGenerational                   # 启用分代 ZGC（JDK 21+），进一步降低年轻代分配压力
-XX:-ZProactive                      # 关闭主动回收，避免媒体高峰期抢占 CPU
-XX:ConcGCThreads=4                  # 并发 GC 线程数 = min(4, CPU核数/8)
-XX:+UnlockDiagnosticVMOptions
-XX:+LogVMOutput                     # GC 日志落盘便于事后复盘
-XX:LogFile=/config/logs/jvb_gc_%p.log

# /etc/sysctl.d/99-jitsi-highperf.conf
# 1. 扩大 UDP 缓冲区，吸收突发流量
net.core.netdev_max_backlog=30000
net.core.somaxconn=65535
net.ipv4.udp_rmem_min=8192
net.ipv4.udp_wmem_min=8192

# 2. 启用 BBRv2 + ECN，弱网丢包场景吞吐提升 15%+
net.ipv4.tcp_congestion_control=bbr
net.ipv4.tcp_ecn=1

# 3. 关闭不必要的内核安全检查（需评估风险）
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0

# 假设 JVB 容器网卡为 eth0，宿主机物理网卡为 ens5
# 1. 开启物理网卡多队列（需驱动支持）
ethtool -L ens5 combined 8   # 设为 CPU 核心数

# 2. 容器启动参数添加 --cpuset-cpus="0-7" --cap-add=NET_ADMIN
# 3. 容器内执行（或入口脚本自动化）：
for i in /sys/class/net/eth0/queues/rx-*; do
    echo f > $i/rps_cpus   # 将中断分发到 0-7 核
done
for i in /sys/class/net/eth0/queues/tx-*; do
    echo f > $i/xps_cpus
done

// 强制开启 Simulcast（多码流）与 VP9 SVC（可扩展视频编码）
p2p: { enabled: true, preferH264: false },
disableSimulcast: false,
channelLastN: 25,                 // 仅转发最近发言 25 人视频，大幅降低下行带宽
lastNLimits: {                    // 动态 lastN 阈值
    5: 20,
    10: 15,
    20: 10,
    50: 5
},
videoQuality: {
    maxBitratesVideo: {           // 终端上行码率上限（kbps）
        low: 200,
        standard: 500,
        high: 1500
    },
    // 启用 VP9 SVC（需客户端支持，Chrome 90+、Firefox 85+）
    preferredCodec: 'VP9',
    scalabilityMode: 'L3T3_KEY'   // 3 层空间 + 3 层时间分层
},

# .env 关键补充
# 1. 部署自建 Coturn 集群（至少 2 节点，跨可用区）
JVB_STUN_SERVERS=turn.example.com:3478
JVB_TURN_SERVERS=turn.example.com:3478?transport=udp,turn.example.com:3478?transport=tcp,turns.example.com:5349?transport=tcp
JVB_TURN_CREDENTIALS=turnuser:StrongTurnPwd_2024
JVB_TURN_TLS_CERT_PATH=/config/certs/turn.pem

# 2. JVB 侧强制开启 ICE-TCP 与 TURN-TLS 回退
JVB_ICE_TRANSPORT_POLICY=all
JVB_ENABLE_ICE_TCP=true
JVB_ICE_TCP_PORT=4443

listening-port=3478
tls-listening-port=5349
listening-ip=0.0.0.0
relay-ip=0.0.0.0
external-ip=<公网IP>/<内网IP>  # 多网卡场景指定
min-port=49152
max-port=65535
use-auth-secret
static-auth-secret=<32字节Base64密钥>
realm=meet.example.com
total-quota=1000
stale-nonce=600
cert=/etc/turn/certs/turn.pem
pkey=/etc/turn/certs/turn.key
# 关键：启用 TCP/TLS 穿透企业出口防火墙
allow-loopback-peers
no-multicast-peers

// 启用 Google Congestion Controller (GCC) 增强版
pcConfig: {
    iceTransportPolicy: 'all',
    iceServers: [ /* 自动从 JVB 获取 */ ],
    // 强制使用 REMB + Transport-CC 双重带宽估算
    googCpuOveruseDetection: true,
    googCpuUnderuseThreshold: 55,
    googCpuOveruseThreshold: 85
},
// 丢包隐藏与冗余编码
enableRtx: true,                    // RTX 重传
enableUlpfec: true,                 // UL-FEC 前向纠错（牺牲 5% 带宽换 30% 丢包恢复）
enableRed: true,                    // RED 冗余音频编码
// 弱网下自动降级策略
constraints: {
    video: {
        width: { ideal: 1280, max: 1920 },
        height: { ideal: 720, max: 1080 },
        frameRate: { ideal: 30, max: 30 },
        // 关键：允许浏览器根据带宽动态降分辨率/帧率
        degradability: 'balanced'
    }
}

-- ./jitsi-meet-cfg/prosody/conf.d/tenant_iso.lua
-- 每个租户独立 VirtualHost + Component，物理隔离信令域
VirtualHost "tenant-a.meet.example.com"
    authentication = "internal_hashed"
    modules_enabled = { "muc_lobby_rooms"; "token_verification"; }
    app_id = "tenant-a-appid"
    app_secret = "tenant-a-secret"

Component "conference.tenant-a.meet.example.com" "muc"
    storage = "internal"
    modules_enabled = { "muc_meeting_id"; "muc_domain_mapper"; }
    muc_room_locking = true
    muc_room_default_public_jids = false

-- 租户 B 完全独立，互不可见
VirtualHost "tenant-b.meet.example.com"
    ...

map $host $tenant_id {
    hostnames;
    tenant-a.meet.example.com  tenant-a;
    tenant-b.meet.example.com  tenant-b;
    default                    default;
}

server {
    server_name ~^(?<sub>.+).meet.example.com$;
    location / {
        # 透传租户标识给 Jicofo/JVB
        proxy_set_header X-Tenant-ID $tenant_id;
        proxy_pass http://jitsi_web;
    }
}

# .env 统一开启 JWT
ENABLE_AUTH=1
TOKEN_AUTH_URL=meet.example.com
TOKEN_AUTH_SECRET=<共享密钥Base64>
TOKEN_AUTH_ISSUER=meet-issuer
TOKEN_AUTH_AUDIENCE=meet-audience

import jwt, time, uuid

def generate_meeting_token(tenant_id, user_id, room_name, role="moderator", ttl=3600):
    payload = {
        "iss": "meet-issuer",
        "aud": "meet-audience",
        "sub": f"{tenant_id}.meet.example.com",  # 关键：绑定虚拟主机
        "room": room_name,
        "context": {
            "user": {
                "id": user_id,
                "name": "User Name",
                "avatar": "https://cdn.example.com/avatar.png",
                "email": "user@tenant.com",
                "moderator": role == "moderator"
            },
            "features": {
                "recording": role == "moderator",
                "livestreaming": role == "moderator",
                "transcription": True,
                "screen-sharing": True
            }
        },
        "exp": int(time.time()) + ttl,
        "jti": str(uuid.uuid4())  # 防重放
    }
    return jwt.encode(payload, SHARED_SECRET, algorithm="HS256")

// Jitsi Meet External API 初始化
const domain = 'meet.example.com';
const options = {
    roomName: 'tenant-a-room-123',
    jwt: '<后端签发Token>',
    configOverwrite: { disableInviteFunctions: true },
    interfaceConfigOverwrite: { DEFAULT_LOGO_URL: 'https://cdn.tenant-a.com/logo.png' }
};
const api = new JitsiMeetExternalAPI(domain, options);

// components/JitsiMeeting.tsx
import { useEffect, useRef } from 'react';
import JitsiMeetExternalAPI from 'lib-jitsi-meet';

interface Props {
  tenantId: string;
  roomName: string;
  userInfo: { id: string; name: string; role: 'moderator' | 'participant' };
  onMeetingEnd: () => void;
  onError: (err: Error) => void;
}

export const JitsiMeeting = ({ tenantId, roomName, userInfo, onMeetingEnd, onError }: Props) => {
  const containerRef = useRef<HTMLDivElement>(null);
  const apiRef = useRef<JitsiMeetExternalAPI | null>(null);

  useEffect(() => {
    if (!containerRef.current) return;

    const domain = `${tenantId}.meet.example.com`;
    const token = generateTokenOnBackend(tenantId, roomName, userInfo); // 调用后端 API

    const options = {
      roomName,
      jwt: token,
      width: '100%',
      height: '100%',
      parentNode: containerRef.current,
      configOverwrite: {
        startWithAudioMuted: true,
        startWithVideoMuted: false,
        prejoinPageEnabled: true,
        enableWelcomePage: false,
        // 业务定制：隐藏不需功能
        disableInviteFunctions: true,
        disableProfile: true,
        hideConferenceSubject: true,
      },
      interfaceConfigOverwrite: {
        TOOLBAR_BUTTONS: [
          'microphone', 'camera', 'desktop', 'chat', 'raisehand',
          'videoquality', 'filmstrip', 'fullscreen', 'hangup'
        ],
        DEFAULT_BACKGROUND: `#${tenantId.slice(-6)}`, // 租户品牌色
      },
      onload: () => console.log('[Jitsi] Loaded'),
    };

    const api = new JitsiMeetExternalAPI(domain, options);
    apiRef.current = api;

    // 事件订阅
    api.addEventListener('videoConferenceJoined', () => console.log('Joined'));
    api.addEventListener('conferenceTerminated', onMeetingEnd);
    api.addEventListener('readyToClose', onMeetingEnd);
    api.addEventListener('error', onError);

    // 业务扩展：监听屏幕共享状态同步至后端
    api.addEventListener('screenSharingStatusChanged', (data) => {
      syncScreenShareStatus(roomName, userInfo.id, data.on);
    });

    return () => {
      api.dispose();
      apiRef.current = null;
    };
  }, [tenantId, roomName, userInfo]);

  return <div ref={containerRef} style={{ width: '100%', height: '100vh' }} />;
};

-- prosody/modules/mod_http_event_hook.lua (自定义模块)
module:hook("muc-occupant-joined", function(event)
    local room, occupant = event.room, event.occupant;
    local payload = {
        event = "user_joined",
        tenant = room.jid.host:match("^(.+)%.meet%.example%.com$"),
        room = room.jid.node,
        user_id = occupant.jid.node,
        timestamp = os.time()
    };
    -- 异步 HTTP POST 至业务网关（需配置重试/熔断）
    http.post("https://api.business.com/v1/meeting/events", payload);
end);

module:hook("muc-occupant-left", function(event) ... end);
module:hook("muc-occupant-pre-join", function(event) 
    -- 入会前风控：黑名单、并发限制、地域封锁
    if is_blocked(event.occupant.jid.node) then
        return { status_code = 403; reason = "Blocked by risk control" };
    end
end);

# docker-compose.override.yml 补充
services:
  jvb:
    environment:
      - JVB_ENABLE_APIS=rest,colibri,stats
      - JVB_STATS_INTERVAL=5000  # 5秒推送一次
    ports:
      - "8080:8080"  # 暴露 /colibri/stats 给 Prometheus

┌─────────────┐     专线/加速通道      ┌──────────────────┐
│  核心控制面  │◀─────────────────────▶│  边缘媒体节点组   │
│ (北京/上海)  │   信令/元数据/录制     │ (华北/华东/华南/海外)│
│ Prosody     │                        │ JVB + Coturn      │
│ Jicofo      │                        │ 就近接入/转发      │
│ Jibri       │                        │ 无状态/可弹性伸缩  │
└─────────────┘                        └──────────────────┘
        ▲                                        ▲
        │ DNS GSLB / HTTPDNS                     │ 客户端 SDK 自动测速选优
        ▼                                        ▼
   用户接入层                              终端用户

#!/bin/bash
# chaos-drill.sh 每周二 02:00 自动执行
set -euo pipefail

TARGET_JVB=$(docker ps --filter "name=jvb" --format "{{.Names}}" | shuf -n1)
echo "[Chaos] Target: $TARGET_JVB"

# 1. 注入网络分区（模拟交换机故障）
docker exec $TARGET_JVB tc qdisc add dev eth0 root netem loss 50% delay 200ms
sleep 60
# 观测：Jicofo 是否在 30s 内踢出该 JVB，会议是否平滑迁移
check_migration_latency

# 2. 注入 CPU 压力（模拟 GC 停顿）
docker exec $TARGET_JVB stress-ng --cpu 4 --timeout 120s &
sleep 90
check_audio_video_freeze

# 3. 杀掉 Prosody Leader（模拟脑裂）
docker kill prosody-primary
sleep 30
check_prosody_failover  # 验证从节点自动晋升

# 4. 恢复环境
docker exec $TARGET_JVB tc qdisc del dev eth0 root
docker start prosody-primary
echo "[Chaos] Drill completed. Report generated."