# 1. 安装 Docker Engine 与 Compose 插件
curl -fsSL https://get.docker.com | bash
docker compose version   # 验证 v2.x 可用

# 2. 关闭防火墙或放行端口（示例为 ufw）
ufw allow 80,443/tcp
ufw allow 10000:20000/udp
ufw allow 5222,5269,5347/tcp
ufw enable

version: "3.8"

services:
  # ---------- 前端 ----------
  web:
    image: jitsi/web:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./config/web:/config:Z
      - ./certs:/usr/local/share/ca-certificates:ro
    environment:
      - ENABLE_LETSENCRYPT=1
      - LETSENCRYPT_DOMAIN=meet.example.com
      - LETSENCRYPT_EMAIL=admin@example.com
      - PUBLIC_URL=https://meet.example.com
      - XMPP_DOMAIN=meet.example.com
      - XMPP_AUTH_DOMAIN=auth.meet.example.com
      - JICOFO_AUTH_USER=focus
      - JVB_AUTH_USER=jvb
      - ENABLE_AUTH=1
      - ENABLE_GUESTS=1
      - DISABLE_HTTPS=0
    networks:
      - jitsi-net

  # ---------- 信令 ----------
  prosody:
    image: jitsi/prosody:latest
    restart: unless-stopped
    expose:
      - "5222"
      - "5269"
      - "5347"
    volumes:
      - ./config/prosody:/config:Z
      - ./prosody-plugins:/prosody-plugins:Z
    environment:
      - XMPP_DOMAIN=meet.example.com
      - XMPP_AUTH_DOMAIN=auth.meet.example.com
      - JICOFO_AUTH_USER=focus
      - JVB_AUTH_USER=jvb
      - AUTH_TYPE=internal
      - ENABLE_LOBBY=1
      - ENABLE_RECORDING=1
      - JIBRI_RECORDING_DIR=/recordings
      - JIBRI_XMPP_USER=jibri
      - JIBRI_BREWERY=jibribrewery
    networks:
      - jitsi-net

  # ---------- 会议焦点 ----------
  jicofo:
    image: jitsi/jicofo:latest
    restart: unless-stopped
    volumes:
      - ./config/jicofo:/config:Z
    environment:
      - XMPP_DOMAIN=meet.example.com
      - XMPP_AUTH_DOMAIN=auth.meet.example.com
      - JICOFO_AUTH_USER=focus
      - JICOFO_AUTH_PASSWORD=${JICOFO_PASSWORD}
      - JVB_BREWERY=jvbbrewery
    depends_on:
      - prosody
    networks:
      - jitsi-net

  # ---------- 视频桥接 ----------
  jvb:
    image: jitsi/jvb:latest
    restart: unless-stopped
    ports:
      - "10000:10000/udp"
      - "4443:4443/tcp"
    volumes:
      - ./config/jvb:/config:Z
    environment:
      - XMPP_DOMAIN=meet.example.com
      - XMPP_AUTH_DOMAIN=auth.meet.example.com
      - JVB_AUTH_USER=jvb
      - JVB_AUTH_PASSWORD=${JVB_PASSWORD}
      - JVB_BREWERY=jvbbrewery
      - JVB_PORT=10000
      - JVB_TCP_HARVESTER_DISABLED=true
      - JVB_STUN_SERVERS=stun.l.google.com:19302
      - DOCKER_HOST_ADDRESS=${PUBLIC_IP}
    depends_on:
      - prosody
    networks:
      - jitsi-net

  # ---------- 录制/直播（可选） ----------
  jibri:
    image: jitsi/jibri:latest
    restart: unless-stopped
    volumes:
      - ./config/jibri:/config:Z
      - ./recordings:/recordings:Z
    environment:
      - XMPP_DOMAIN=meet.example.com
      - XMPP_AUTH_DOMAIN=auth.meet.example.com
      - JIBRI_AUTH_USER=jibri
      - JIBRI_AUTH_PASSWORD=${JIBRI_PASSWORD}
      - JIBRI_RECORDING_DIR=/recordings
      - JIBRI_BREWERY=jibribrewery
      - JIBRI_PENDING_TIMEOUT=90
    depends_on:
      - prosody
    networks:
      - jitsi-net
    # 生产环境建议单独部署 GPU 节点，此处仅作演示
    deploy:
      resources:
        limits:
          memory: 4G

networks:
  jitsi-net:
    driver: bridge

# 强制生成高强度密码，切勿使用示例值
JICOFO_PASSWORD=$(openssl rand -base64 24)
JVB_PASSWORD=$(openssl rand -base64 24)
JIBRI_PASSWORD=$(openssl rand -base64 24)
PUBLIC_IP=203.0.113.10   # 替换为真实公网 IP

# 1. 创建目录结构
mkdir -p config/{web,prosody,jicofo,jvb,jibri} recordings prosody-plugins certs

# 2. 启动栈
docker compose up -d

# 3. 观察日志
docker compose logs -f --tail=100

# 每日增量备份配置与录制文件
tar -czf /backup/jitsi-$(date +%F).tar.gz config/ recordings/
# 对接对象存储（S3/MinIO）实现异地灾备

# docker-compose.override.yml (扩展片段)
services:
  jvb-1:
    extends: jvb-base
    environment:
      - JVB_BREWERY=jvbbrewery
      - JVB_REGION=region-sh-01
    deploy:
      placement:
        constraints: [node.labels.zone == sh-01]

  jvb-2:
    extends: jvb-base
    environment:
      - JVB_BREWERY=jvbbrewery
      - JVB_REGION=region-sh-02
    deploy:
      placement:
        constraints: [node.labels.zone == sh-02]

  # Octo 级联配置（跨机房/跨云厂商互通）
  jvb-octo:
    image: jitsi/jvb:latest
    environment:
      - JVB_OCTO_ENABLED=true
      - JVB_OCTO_BIND_ADDRESS=0.0.0.0
      - JVB_OCTO_PUBLIC_ADDRESS=203.0.113.20
      - JVB_OCTO_PORT=4096
      - JVB_OCTO_REGION=region-sh-01
      - JVB_OCTO_SECRET=${OCTO_SECRET}

# 1. 外挂 PostgreSQL（替代内置内存存储）
# docker-compose.yml prosody 服务新增：
environment:
  - AUTH_TYPE=internal
  - PROSODY_DB_DRIVER=PostgreSQL
  - PROSODY_DB_HOST=pg-primary.internal
  - PROSODY_DB_PORT=5432
  - PROSODY_DB_NAME=prosody
  - PROSODY_DB_USER=prosody
  - PROSODY_DB_PASSWORD_FILE=/run/secrets/prosody_db_pwd

# 2. 启用集群模块 (mod_cluster)
# 挂载自定义 prosody.cfg.lua 片段至 /config/prosody/conf.d/99-cluster.lua

-- 99-cluster.lua 关键片段
Component "conference.meet.example.com" "muc"
    modules_enabled = { "muc_meeting_id", "token_verification", "cluster" }
    cluster_nodes = { "prosody-1.internal", "prosody-2.internal" } -- 或通过 DNS SRV 自动发现

# 连接跟踪表扩容（防止 nf_conntrack 溢出导致丢包）
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_buckets = 262144
net.netfilter.nf_conntrack_tcp_timeout_established = 1200
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 60

# UDP 缓冲区扩大至 50MB（关键：解决大并发下内核丢包）
net.core.rmem_max = 52428800
net.core.wmem_max = 52428800
net.core.rmem_default = 33554432
net.core.wmem_default = 33554432
net.core.netdev_max_backlog = 10000
net.ipv4.udp_mem = 102400 873800 16777216

# BBR 拥塞控制 + FQ 调度（提升弱网对抗能力）
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# 端口范围扩大（配合 JVB 动态端口）
net.ipv4.ip_local_port_range = 10000 65535

jvb:
  environment:
    - JAVA_SYS_PROPS=-XX:+UseG1GC -XX:MaxGCPauseMillis=50 -XX:+ParallelRefProcEnabled -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=16m -XX:G1ReservePercent=15 -XX:InitiatingHeapOccupancyPercent=45 -Djdk.nio.maxCachedBufferSize=2000000 -Dorg.ice4j.ice.harvest.DISABLE_AWS_HARVESTER=true -Dorg.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES=stun.l.google.com:19302
    # 关键媒体参数
    - VIDEOBRIDGE_MAX_THREADS=2000
    - VIDEOBRIDGE_RTP_PORT_LOW=10000
    - VIDEOBRIDGE_RTP_PORT_HIGH=20000
    - JVB_ENABLE_APIS=rest,colibri

// config/web/config.js 片段
disableSimulcast: false,          // 开启分层编码
enableLayerSuspension: true,      // 订阅端自动降层
preferSVC: true,                  // 优先 VP9 SVC / AV1 SVC
channelLastN: 25,                 // 仅转发最近发言 25 人视频流
lastNLimits: {                    // 动态 lastN 阈值
    5: 20,
    10: 15,
    20: 10,
    50: 5
}

deploy:
  resources:
    limits:
      cpus: '7.5'      # 预留 0.5 核给宿主机网络栈
      memory: 12G
    reservations:
      cpus: '4'
      memory: 8G
  # 生产建议：使用 cpuset 绑定物理核心，避免 NUMA 跨节点访问
  # cpuset: "0-7,16-23"  # 根据 lscpu 输出规划

infra-jitsi/
├── apps/
│   ├── base/                 # Kustomize 基础资源
│   │   ├── deployment.yaml
│   │   ├── service.yaml
│   │   ├── configmap.yaml
│   │   └── kustomization.yaml
│   ├── overlays/
│   │   ├── dev/
│   │   │   ├── kustomization.yaml  # replicas: 1, resources: small
│   │   │   └── secrets.enc.yaml    # SealedSecrets 加密
│   │   ├── staging/
│   │   └── prod/
│   │       ├── kustomization.yaml  # replicas: 6, resources: large, HPA
│   │       └── secrets.enc.yaml
├── charts/                   # Helm 依赖（PostgreSQL, MinIO, Cert-Manager）
├── pipelines/
│   ├── ci.yaml               # 镜像构建、安全扫描、单元测试
│   ├── cd.yaml               # ArgoCD Application 定义
│   └── chaos.yaml            # Chaos Mesh 故障注入演练
└── docs/
    └── runbooks/             # 故障处理手册、扩容 SOP

# pipelines/cd.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: jitsi-prod
  namespace: argocd
spec:
  project: production
  source:
    repoURL: https://git.example.com/infra-jitsi.git
    targetRevision: main
    path: apps/overlays/prod
    kustomize:
      images:
        - jitsi/web:v2.0.123
        - jitsi/jvb:v2.0.123
  destination:
    server: https://kubernetes.default.svc
    namespace: jitsi-prod
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
    retry:
      limit: 5
      backoff:
        duration: 30s
        factor: 2
        maxDuration: 5m
  # 金丝雀发布策略（配合 Flagger + Istio/NGINX Ingress）
  strategy:
    canary:
      steps:
        - setWeight: 10
        - pause: {duration: 10m}
        - setWeight: 50
        - pause: {duration: 30m}
        - setWeight: 100
      analysis:
        templates:
          - templateName: success-rate
        args:
          - name: service-name
            value: jitsi-web

modules_enabled = {
    "log_auth";           -- 认证日志
    "muc_log_http";       -- 会议室进出日志推送至 HTTP 端点
    "mod_audit";          -- 自定义审计模块（需二次开发）
}
log = {
    { level = "INFO", filename = "/var/log/prosody/audit.log", format = "json" };
}

#!/bin/bash
# Jibri 录制完成后自动触发
INPUT_FILE="$1"
OUTPUT_FILE="${INPUT_FILE}.enc"
DEK=$(aws kms generate-data-key --key-id alias/jitsi-recordings --key-spec AES_256 --query Plaintext --output text | base64 -d)
ENCRYPTED_DEK=$(aws kms generate-data-key --key-id alias/jitsi-recordings --key-spec AES_256 --query CiphertextBlob --output text)

openssl enc -aes-256-gcm -salt -in "$INPUT_FILE" -out "$OUTPUT_FILE" -pass pass:"$DEK" -md sha256
# 将 ENCRYPTED_DEK 存入数据库元数据表，原文件碎纸机删除
shred -n 3 -z -u "$INPUT_FILE"

# SLO 定义示例 (Sloth / PrometheusRule)
apiVersion: sloth.slok.dev/v1
kind: PrometheusServiceLevel
metadata:
  name: jitsi-meeting-availability
spec:
  service: "jitsi"
  labels:
    env: prod
    team: infra
  slos:
    - name: "Meeting Creation Success"
      objective: 99.9
      description: "用户发起会议并成功进入房间的比例"
      sli:
        events:
          error_query: sum(rate(jicofo_conference_create_failed_total[5m]))
          total_query: sum(rate(jicofo_conference_create_total[5m]))
      alerting:
        name: JitsiMeetingCreationBurnRate
        labels:
          severity: critical
        page_alert:
          burn_rate: 2      # 2x 预算消耗速率触发 PagerDuty
        ticket_alert:
          burn_rate: 1      # 1x 触发工单

# pipelines/chaos.yaml (Chaos Mesh 示例)
apiVersion: chaos-mesh.org/v1alpha1
kind: PodChaos
metadata:
  name: jvb-kill-random
spec:
  action: pod-failure
  mode: one
  duration: "30s"
  selector:
    namespaces: ["jitsi-prod"]
    labelSelectors:
      app: jvb
  scheduler:
    cron: "@monthly"
---
# 验证点：会议是否自动迁移至其他 JVB、用户无感知、告警是否触发