/etc/nginx/sites-enabled/jitsi.mydomain.com.conf
server_names_hash_bucket_size 64;
server {
listen 80;
listen [::]:80;
server_name jitsi.mydomain.com;
location ^~ /.well-known/acme-challenge/ {
default_type "text/plain";
root /usr/share/jitsi-meet;
}
location = /.well-known/acme-challenge/ {
return 404;
}
location / {
return 301 https://$host$request_uri;
}
}
server {
listen 4444 ssl;
listen [::]:4444 ssl;
server_name jitsi.mydomain.com;
[…]
/etc/nginx/modules-enabled/jitsi-multiplex-turnserver.conf
stream {
map $ssl_preread_server_name $name {
jitsi.mydomain.com web_backend;
turn-jitsi.mydomain.com turn_backend;
}
upstream web_backend {
server 127.0.0.1:4444;
}
upstream turn_backend {
server <MY_PUBLIC_IP>:443;
}
server {
listen 443;
listen [::]:443;
# since 1.11.5
ssl_preread on;
proxy_pass $name;
# Increase buffer to serve video
proxy_buffer_size 10m;
}
}
/etc/turnserver.conf
# jitsi-meet coturn config. Do not modify this line
use-auth-secret
keep-address-family
static-auth-secret=<SECRET>
realm=jitsi.mydomain.com
cert=/etc/coturn/certs/turn-jitsi.mydomain.com.fullchain.pem
pkey=/etc/coturn/certs/turn-jitsi.mydomain.com.privkey.pem
no-multicast-peers
no-cli
no-loopback-peers
no-tcp-relay
no-tcp
listening-port=3478
tls-listening-port=5349
no-tlsv1
no-tlsv1_1
# https://ssl-config.mozilla.org/#server=haproxy&version=2.1&config=intermediate&openssl=1.1.0g&guideline=5.4
cipher-list=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
# jitsi-meet coturn relay disable config. Do not modify this line
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.88.99.0-192.88.99.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=240.0.0.0-255.255.255.255
syslog
/etc/prosody/conf.d/jitsi.mydomain.com.cfg.lua
plugin_paths = { "/usr/share/jitsi-meet/prosody-plugins/" }
-- domain mapper options, must at least have domain base set to use the mapper
muc_mapper_domain_base = "jitsi.mydomain.com";
turncredentials_secret = "<SECRET_same_as_in_turnserver.conf>";
turncredentials = {
{ type = "stun", host = "jitsi.mydomain.com", port = "3478" },
-- { type = "turn", host = "jitsi.mydomain.com", port = "3478", transport = "udp" },
-- { type = "stun", host = "turn-jitsi.mydomain.com", port = "443" },
{ type = "turn", host = "jitsi.mydomain.com", port = "3478", transport = "udp" },
{ type = "turns", host = "turn-jitsi.mydomain.com", port = "443", transport = "tcp" }
};
cross_domain_bosh = false;
consider_bosh_secure = true;
-- https_ports = { }; -- Remove this line to prevent listening on port 5284
-- https://ssl-config.mozilla.org/#server=haproxy&version=2.1&config=intermediate&openssl=1.1.0g&guideline=5.4
ssl = {
protocol = "tlsv1_2+";
ciphers = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
}
VirtualHost "jitsi.mydomain.com"
-- enabled = false -- Remove this line to enable this host
authentication = "anonymous"
-- Properties below are modified by jitsi-meet-tokens package config
-- and authentication above is switched to "token"
--app_id="example_app_id"
--app_secret="example_app_secret"
-- Assign this host a certificate for TLS, otherwise it would use the one
-- set in the global section (if any).
-- Note that old-style SSL on port 5223 only supports one certificate, and will always
-- use the global one.
ssl = {
key = "/etc/prosody/certs/jitsi.mydomain.com.key";
certificate = "/etc/prosody/certs/jitsi.mydomain.com.crt";
}
speakerstats_component = "speakerstats.jitsi.mydomain.com"
conference_duration_component = "conferenceduration.jitsi.mydomain.com"
-- we need bosh
modules_enabled = {
"bosh";
"pubsub";
"ping"; -- Enable mod_ping
"speakerstats";
"turncredentials";
"conference_duration";
"muc_lobby_rooms";
}
c2s_require_encryption = false
lobby_muc = "lobby.jitsi.mydomain.com"
main_muc = "conference.jitsi.mydomain.com"
-- muc_lobby_whitelist = { "recorder.jitsi.mydomain.com" } -- Here we can whitelist jibri to enter lobby enabled rooms
Component "conference.jitsi.mydomain.com" "muc"
storage = "none"
modules_enabled = {
"muc_meeting_id";
"muc_domain_mapper";
-- "token_verification";
}
admins = { "focus@auth.jitsi.mydomain.com" }
muc_room_locking = false
muc_room_default_public_jids = true
-- internal muc component
Component "internal.auth.jitsi.mydomain.com" "muc"
storage = "none"
modules_enabled = {
"ping";
}
admins = { "focus@auth.jitsi.mydomain.com", "jvb@auth.jitsi.mydomain.com" }
muc_room_locking = false
muc_room_default_public_jids = true
VirtualHost "auth.jitsi.mydomain.com"
ssl = {
key = "/etc/prosody/certs/auth.jitsi.mydomain.com.key";
certificate = "/etc/prosody/certs/auth.jitsi.mydomain.com.crt";
}
authentication = "internal_plain"
Component "focus.jitsi.mydomain.com"
component_secret = "<ANOTHER_SECRET>"
Component "speakerstats.jitsi.mydomain.com" "speakerstats_component"
muc_component = "conference.jitsi.mydomain.com"
Component "conferenceduration.jitsi.mydomain.com" "conference_duration_component"
muc_component = "conference.jitsi.mydomain.com"
Component "lobby.jitsi.mydomain.com" "muc"
storage = "none"
restrict_room_creation = true
muc_room_locking = false
muc_room_default_public_jids = true
It was related to a possible proxy.