[__bird_radv] add --default-lifetime parameter

Some systems use etckeeper and having the logs there was not a great
idea to begin with :-).

type/__bird_radv/man.rst

@@ -26,6 +26,18 @@ OPTIONAL PARAMETERS
 mtu
   An optional MTU setting to include in the router advertisements.
 
+default-preference
+  This option specifies the Default Router Preference value to advertise to
+  hosts. Default: medium.
+
+route-preference
+  This option specifies the default value of advertised route preference for
+  specific routes. Default: medium.
+
+default-lifetime
+  This option specifies the time (in seconds) how long (since the receipt of RA)
+  hosts may use the router as a default router. 0 means do not use as a default
+  router. Default: 3.
 
 OPTIONAL MULTIPLE PARAMETERS
 ----------------------------

type/__bird_radv/manifest

@@ -58,27 +58,48 @@ fi
 MTU=
 if [ -f "${__object:?}/parameter/mtu" ];
 then
-	MTU="link mtu $(cat "${__object:?}/parameter/mtu")"
+	MTU="link mtu $(cat "${__object:?}/parameter/mtu");"
+fi
+
+DEFAULT_PREFERENCE=
+if [ -f "${__object:?}/parameter/default-preference" ];
+then
+	DEFAULT_PREFERENCE="default preference $(cat "${__object:?}/parameter/default-preference");"
+fi
+
+ROUTE_PREFERENCE=
+if [ -f "${__object:?}/parameter/route-preference" ];
+then
+	ROUTE_PREFERENCE="route preference $(cat "${__object:?}/parameter/route-preference");"
+fi
+
+DEFAULT_LIFETIME=
+if [ -f "${__object:?}/parameter/default-lifetime" ];
+then
+	DEFAULT_LIFETIME="default lifetime $(cat "${__object:?}/parameter/default-lifetime");"
 fi
 
 __file "${confdir:?}/radv-${__object_id:?}.conf" \
 	--mode 0640 --owner root --group bird \
 	--source - << EOF
-ipv6 table radv_routes;
+ipv6 table radv_routes_${__object_id};
 
 protocol static {
 	description "Routes advertised via RAs";
-	ipv6 { table radv_routes; };
+	ipv6 { table radv_routes_${__object_id}; };
 
 $(sed -e 's/^/\troute /' -e 's/$/ unreachable;/' "${__object:?}/parameter/route")
 }
 
 protocol radv ${__object_id:?} {
 	propagate routes ${have_routes:?};
-	ipv6 { table radv_routes; export all; };
+	ipv6 { table radv_routes_${__object_id}; export all; };
 
 	interface "$(cat "${__object:?}/parameter/interface")" {
 	$MTU
+	$DEFAULT_LIFETIME
+	$DEFAULT_PREFERENCE
+	$ROUTE_PREFERENCE
 	};
 
 $RDNS

type/__bird_radv/parameter/optional

@@ -1 +1,4 @@
 mtu
+default-preference
+route-preference
+default-lifetime

type/__jitsi_meet/explorer/jicofo-authpassword

@@ -0,0 +1,26 @@
+#!/bin/sh -eu
+
+JICOFO_AUTHPASSWORD=""
+# We need this to properly configure jicofo
+
+# Default to reading debconf
+DEBCONF_PASS_FILE="/var/cache/debconf/passwords.dat"
+if [ -f "${DEBCONF_PASS_FILE}" ]; then
+	JICOFO_AUTHPASSWORD="$(grep -A1 'Template: jicofo/jicofo-authpassword' "${DEBCONF_PASS_FILE}" | tail -n 1 | cut -d ' ' -f 2-)"
+fi
+
+# Try jicofo.conf if necessary
+JICOFO_CONF_FILE="/etc/jitsi/jicofo/jicofo.conf"
+if [ -z "${JICOFO_AUTHPASSWORD}" ] && [ -f "${JICOFO_CONF_FILE}" ]; then
+	JICOFO_AUTHPASSWORD="$(grep -E '^[[:space:]]*password:' "${JICOFO_CONF_FILE}" | sed -E 's!^[^:]*:[[:space:]]*"(.*)"$!\1!')"
+fi
+
+# And fallback to config file if necessary
+JICOFO_CONFIG_FILE="/etc/jitsi/jicofo/config"
+if [ -z "${JICOFO_AUTHPASSWORD}" ] && [ -f "${JICOFO_CONFIG_FILE}" ]; then
+	JICOFO_AUTHPASSWORD="$(grep -E '^JICOFO_AUTH_PASSWORD=' "${JICOFO_CONFIG_FILE}" | cut -d '=' -f 2-)"
+fi
+
+# If we didn't find it, this is likely a new installation and we'll generate
+# the password on the manifest
+echo "${JICOFO_AUTHPASSWORD:-}"

type/__jitsi_meet/explorer/jitsi-status

@@ -0,0 +1,6 @@
+#!/bin/sh -eu
+
+if [ ! -f "${__object}/parameter/disable-prometheus-exporter" ]; then
+	# TODO: detect curl / depend on it?
+	curl -s localhost:9888/metrics
+fi

type/__jitsi_meet/files/debconf_settings.sh

@@ -5,9 +5,6 @@
 if false; then
 	# We are currently not using these, just here as documentation
 	DEBCONF_SETTINGS="$(cat <<EOF
-# Jicofo user password:
-jicofo	jicofo/jicofo-authpassword	password	STH
-jitsi-meet-prosody	jicofo/jicofo-authpassword	password	STH
 # The secret used to connect to xmpp server as component
 jitsi-meet-prosody	jitsi-videobridge/jvbsecret	password	STH
 jitsi-videobridge	jitsi-videobridge/jvbsecret	password	STH
@@ -40,6 +37,9 @@ jitsi-videobridge	jitsi-videobridge/jvb-hostname	string	${JITSI_HOST}
 jitsi-videobridge2	jitsi-videobridge/jvb-hostname	string	${JITSI_HOST}
 # The hostname of the current installation:
 jitsi-meet-prosody	jitsi-meet-prosody/jvb-hostname string	${JITSI_HOST}
+# Jicofo user password:
+jicofo	jicofo/jicofo-authpassword	password	${JICOFO_AUTHPASSWORD}
+jitsi-meet-prosody	jicofo/jicofo-authpassword	password	${JICOFO_AUTHPASSWORD}
 # SSL certificate for the Jitsi Meet instance
 # Choices: Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate), I want to use my own certificate
 jitsi-meet-web-config	jitsi-meet/cert-choice	select	Generate a new self-signed certificate (You will later get a chance to obtain a Let's encrypt certificate)

type/__jitsi_meet/files/jicofo.conf.sh

@@ -10,6 +10,10 @@ jicofo {
   xmpp: {
     client: {
       client-proxy: focus.${JITSI_HOST:?}
+      xmpp-domain: "${JITSI_HOST:?}"
+      domain: "auth.${JITSI_HOST:?}"
+      username: "focus"
+      password: "${JICOFO_AUTHPASSWORD:?}"
     }
     trusted-domains: [ "recorder.${JITSI_HOST:?}" ]
   }

type/__jitsi_meet/man.rst

@@ -21,10 +21,10 @@ You will also need the `__jitsi_meet_domain` type in order to finish setting up
 the web frontend (including TLS certificates) and its settings.
 
 You may want to use the `files/ufw` example manifest for a `__ufw`-based
-firewall compatible with this type.
-This file does not include rules for TCP port 9888, which exposes the
-prometheus exporter if not disabled.
-You should apply your own rules here.
+firewall compatible with this type that allows all ports needed by Jitsi-Meet.
+Note however that this will not deal with rules for SSH or for TCP port 9888,
+which exposes the prometheus exporter if not disabled.
+Remember to apply your own rules here, particularly regarding SSH.
 
 This type only works on De{bi,vu}an systems.
 
@@ -47,6 +47,14 @@ NOTE: This type currently does not deal with setting up coturn.
 
 OPTIONAL PARAMETERS
 -------------------
+abort-conference-count
+    Only has an effect if the prometheus exporter is enabled and if it is not
+    empty (default).
+    If at least this many conferences are active on the server, the type will
+    bail out before making any changes.
+    This is useful if you want to avoid service disruptions due to e.g. an SLA.
+
+
 turn-secret
     The shared secret for the TURN server.
 
@@ -76,9 +84,11 @@ EXAMPLES
 
 .. code-block:: sh
 
-    # Setup the firewall
+    # Setup the firewall for Jitsi-Meet
     . "${__global}/type/__jitsi_meet/files/ufw"
     export require="__ufw"
+    # Setup firewall SSH rules as necessary
+    __ufw_rule ssh --rule 'allow 22/tcp from 10.0.0.0/24'
     # Setup Jitsi on this host
     __jitsi_meet \
       --turn-server "turn.exo.cat" \

type/__jitsi_meet/manifest

@@ -10,6 +10,28 @@ case "${os}" in
 	;;
 esac
 
+current_conferences="$(cat "${__object}/explorer/jitsi-status" | grep -E "^jitsi_conferences[[:space:]]" | cut -d ' ' -f 2)"
+
+JICOFO_AUTHPASSWORD="$(cat "${__object}/explorer/jicofo-authpassword")"
+if [ -z "${JICOFO_AUTHPASSWORD}" ]; then
+	# This is probably a first time installation, we'll generate the
+	# password which will be set in debconf by this type
+	# https://github.com/jitsi/jicofo/blob/aafb61b5363a1c4abdbf08e1444a6276b807993e/debian/postinst#L43
+	JICOFO_AUTHPASSWORD="$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c 16)"
+fi
+
+ABORT_CONFERENCE_COUNT="$(cat "${__object}/parameter/abort-conference-count")"
+
+if [ -n "${current_conferences}" ] && [ -n "${ABORT_CONFERENCE_COUNT}" ] && \
+	[ "${ABORT_CONFERENCE_COUNT}" -le "${current_conferences}" ]; then
+	cat <<-EOF
+Early bail out was requested when at least ${ABORT_CONFERENCE_COUNT} conferences are taking place.
+There are currently ${current_conferences} active conferences.
+
+Try again at a later time or remove or increase --abort-conference-count
+	EOF
+	exit 1
+fi
 
 JITSI_HOST="${__target_host}"
 if [ -f "${__object}/parameter/jitsi-version" ]; then
@@ -127,8 +149,9 @@ require="__directory${NGINX_ETC}/sites-available" __file "${NGINX_ETC}/sites-ava
 server_names_hash_bucket_size 64;
 
 types {
-# nginx's default mime.types doesn't include a mapping for wasm
+# nginx's default mime.types doesn't include a mapping for wasm or wav.
     application/wasm     wasm;
+    audio/wav            wav;
 }
 
 server {
@@ -197,6 +220,7 @@ __file "/etc/prosody/conf.d/${JITSI_HOST}.zauth.cfg.lua" \
 
 export SECURED_DOMAINS_STATE
 export JITSI_HOST
+export JICOFO_AUTHPASSWORD
 "${__type}/files/jicofo.conf.sh" | \
 	__file /etc/jitsi/jicofo/jicofo.conf --mode 0444 --source '-'
 
@@ -232,8 +256,8 @@ __file "/usr/share/jitsi-meet/body.html" \
 EOF
 
 # These two should be changed on new release
-EXPORTER_VERSION="1.2.0"
-EXPORTER_CHECKSUM="sha256:6377ffa7be0c7deb66545616add7245da96f8b7746d6712f41cfa9fe72c935ce"
+EXPORTER_VERSION="1.2.1"
+EXPORTER_CHECKSUM="sha256:46d4b8475b72fd7632a5203f1cc3c7067bed4629902b7780a1da85e4e06c2129"
 EXPORTER_URL="https://github.com/systemli/prometheus-jitsi-meet-exporter/releases/download/${EXPORTER_VERSION}/prometheus-jitsi-meet-exporter_${EXPORTER_VERSION}_linux_amd64.tar.gz"
 if [ -f "${__object}/parameter/disable-prometheus-exporter" ]; then
 	EXPORTER_STATE="absent"

type/__jitsi_meet/parameter/optional

@@ -1,3 +1,4 @@
+abort-conference-count
 jitsi-version
 turn-secret
 turn-server

type/__jitsi_meet_domain/files/_update_jitsi_configurations.sh

@@ -7,7 +7,7 @@
 
 # We could automate this, but are using it as an indicator for the
 # latest branch with which we conciliated changes.
-BRANCH="jitsi-meet_7210"
+BRANCH="jitsi-meet_8319"
 REPO="https://github.com/jitsi/jitsi-meet"
 
 get_url() {

type/__jitsi_meet_domain/files/interface_config.js.sh

@@ -38,7 +38,6 @@ var interfaceConfig = {
     CLOSE_PAGE_GUEST_HINT: false, // A html text to be shown to guests on the close page, false disables it
 
     DEFAULT_BACKGROUND: '#040404',
-    DEFAULT_LOGO_URL: '${BRANDING_WATERMARK_PATH}',
     DEFAULT_WELCOME_PAGE_LOGO_URL: '${BRANDING_WATERMARK_PATH}',
 
     DISABLE_DOMINANT_SPEAKER_INDICATOR: false,
@@ -88,11 +87,6 @@ var interfaceConfig = {
 
     GENERATE_ROOMNAMES_ON_WELCOME_PAGE: true,
 
-    /**
-     * Hide the logo on the deep linking pages.
-     */
-    HIDE_DEEP_LINKING_LOGO: false,
-
     /**
      * Hide the invite prompt in the header when alone in the meeting.
      */
@@ -101,7 +95,6 @@ var interfaceConfig = {
     JITSI_WATERMARK_LINK: 'https://jitsi.org',
 
     LANG_DETECTION: true, // Allow i18n to detect the system language
-    LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live', // Documentation reference for the live streaming feature.
     LOCAL_THUMBNAIL_RATIO: 16 / 9, // 16:9
 
     /**
@@ -121,23 +114,6 @@ var interfaceConfig = {
      */
     MOBILE_APP_PROMO: true,
 
-    /**
-     * Specify custom URL for downloading android mobile app.
-     */
-    MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
-
-    /**
-     * Specify custom URL for downloading f droid app.
-     */
-    MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',
-
-    /**
-     * Specify URL for downloading ios mobile app.
-     */
-    MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
-
-    NATIVE_APP_NAME: 'Jitsi Meet',
-
     // Names of browsers which should show a warning stating the current browser
     // has a suboptimal experience. Browsers which are not listed as optimal or
     // unsupported are considered suboptimal. Valid values are:
@@ -155,7 +131,7 @@ var interfaceConfig = {
     RECENT_LIST_ENABLED: true,
     REMOTE_THUMBNAIL_RATIO: 1, // 1:1
 
-    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'sounds' ],
+    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'sounds', 'more' ],
 
     /**
      * Specify which sharing features should be displayed. If the value is not set
@@ -172,7 +148,6 @@ var interfaceConfig = {
      */
     SHOW_CHROME_EXTENSION_BANNER: false,
 
-    SHOW_DEEP_LINKING_IMAGE: false,
     SHOW_JITSI_WATERMARK: true,
     SHOW_POWERED_BY: false,
     SHOW_PROMOTIONAL_CLOSE_PAGE: false,
@@ -213,6 +188,31 @@ var interfaceConfig = {
      */
     // TILE_VIEW_MAX_COLUMNS: 5,
 
+    // List of undocumented settings
+    /**
+     INDICATOR_FONT_SIZES
+     PHONE_NUMBER_REGEX
+    */
+
+    // -----------------DEPRECATED CONFIGS BELOW THIS LINE-----------------------------
+
+    /**
+     * Specify URL for downloading ios mobile app.
+     */
+    // MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
+
+    /**
+     * Specify custom URL for downloading android mobile app.
+     */
+    // MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
+
+    /**
+     * Specify mobile app scheme for opening the app from the mobile browser.
+     */
+    // APP_SCHEME: 'org.jitsi.meet',
+
+    // NATIVE_APP_NAME: 'Jitsi Meet',
+
     /**
      * Specify Firebase dynamic link properties for the mobile apps.
      */
@@ -225,22 +225,19 @@ var interfaceConfig = {
     // },
 
     /**
-     * Specify mobile app scheme for opening the app from the mobile browser.
+     * Hide the logo on the deep linking pages.
      */
-    // APP_SCHEME: 'org.jitsi.meet',
+    // HIDE_DEEP_LINKING_LOGO: false,
 
     /**
      * Specify the Android app package name.
      */
     // ANDROID_APP_PACKAGE: 'org.jitsi.meet',
 
-    // List of undocumented settings
     /**
-     INDICATOR_FONT_SIZES
-     PHONE_NUMBER_REGEX
-    */
-
-    // -----------------DEPRECATED CONFIGS BELOW THIS LINE-----------------------------
+     * Specify custom URL for downloading f droid app.
+     */
+    // MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',
 
     // Connection indicators (
     // CONNECTION_INDICATOR_AUTO_HIDE_ENABLED,
@@ -253,12 +250,19 @@ var interfaceConfig = {
     // Please use defaultLocalDisplayName from config.js
     // DEFAULT_LOCAL_DISPLAY_NAME: 'me',
 
+    // Please use defaultLogoUrl from config.js
+    DEFAULT_LOGO_URL: '${BRANDING_WATERMARK_PATH}',
+
     // Please use defaultRemoteDisplayName from config.js
     // DEFAULT_REMOTE_DISPLAY_NAME: 'Fellow Jitster',
 
     // Moved to config.js as \`toolbarConfig.initialTimeout\`.
     // INITIAL_TOOLBAR_TIMEOUT: 20000,
 
+    // Moved to config.js as \`toolbarConfig.alwaysVisible\`.
+    // Documentation reference for the live streaming feature.
+    // LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live',
+
     // Moved to config.js as \`toolbarConfig.alwaysVisible\`.
     // TOOLBAR_ALWAYS_VISIBLE: false,
 

type/__jitsi_meet_domain/files/interface_config.js.sh.orig

@@ -27,7 +27,6 @@ var interfaceConfig = {
     CLOSE_PAGE_GUEST_HINT: false, // A html text to be shown to guests on the close page, false disables it
 
     DEFAULT_BACKGROUND: '#040404',
-    DEFAULT_LOGO_URL: 'images/watermark.svg',
     DEFAULT_WELCOME_PAGE_LOGO_URL: 'images/watermark.svg',
 
     DISABLE_DOMINANT_SPEAKER_INDICATOR: false,
@@ -77,11 +76,6 @@ var interfaceConfig = {
 
     GENERATE_ROOMNAMES_ON_WELCOME_PAGE: true,
 
-    /**
-     * Hide the logo on the deep linking pages.
-     */
-    HIDE_DEEP_LINKING_LOGO: false,
-
     /**
      * Hide the invite prompt in the header when alone in the meeting.
      */
@@ -90,7 +84,6 @@ var interfaceConfig = {
     JITSI_WATERMARK_LINK: 'https://jitsi.org',
 
     LANG_DETECTION: true, // Allow i18n to detect the system language
-    LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live', // Documentation reference for the live streaming feature.
     LOCAL_THUMBNAIL_RATIO: 16 / 9, // 16:9
 
     /**
@@ -110,23 +103,6 @@ var interfaceConfig = {
      */
     MOBILE_APP_PROMO: true,
 
-    /**
-     * Specify custom URL for downloading android mobile app.
-     */
-    MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
-
-    /**
-     * Specify custom URL for downloading f droid app.
-     */
-    MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',
-
-    /**
-     * Specify URL for downloading ios mobile app.
-     */
-    MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
-
-    NATIVE_APP_NAME: 'Jitsi Meet',
-
     // Names of browsers which should show a warning stating the current browser
     // has a suboptimal experience. Browsers which are not listed as optimal or
     // unsupported are considered suboptimal. Valid values are:
@@ -144,7 +120,7 @@ var interfaceConfig = {
     RECENT_LIST_ENABLED: true,
     REMOTE_THUMBNAIL_RATIO: 1, // 1:1
 
-    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'sounds' ],
+    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'sounds', 'more' ],
 
     /**
      * Specify which sharing features should be displayed. If the value is not set
@@ -161,7 +137,6 @@ var interfaceConfig = {
      */
     SHOW_CHROME_EXTENSION_BANNER: false,
 
-    SHOW_DEEP_LINKING_IMAGE: false,
     SHOW_JITSI_WATERMARK: true,
     SHOW_POWERED_BY: false,
     SHOW_PROMOTIONAL_CLOSE_PAGE: false,
@@ -202,6 +177,31 @@ var interfaceConfig = {
      */
     // TILE_VIEW_MAX_COLUMNS: 5,
 
+    // List of undocumented settings
+    /**
+     INDICATOR_FONT_SIZES
+     PHONE_NUMBER_REGEX
+    */
+
+    // -----------------DEPRECATED CONFIGS BELOW THIS LINE-----------------------------
+
+    /**
+     * Specify URL for downloading ios mobile app.
+     */
+    // MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
+
+    /**
+     * Specify custom URL for downloading android mobile app.
+     */
+    // MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
+
+    /**
+     * Specify mobile app scheme for opening the app from the mobile browser.
+     */
+    // APP_SCHEME: 'org.jitsi.meet',
+
+    // NATIVE_APP_NAME: 'Jitsi Meet',
+
     /**
      * Specify Firebase dynamic link properties for the mobile apps.
      */
@@ -214,22 +214,19 @@ var interfaceConfig = {
     // },
 
     /**
-     * Specify mobile app scheme for opening the app from the mobile browser.
+     * Hide the logo on the deep linking pages.
      */
-    // APP_SCHEME: 'org.jitsi.meet',
+    // HIDE_DEEP_LINKING_LOGO: false,
 
     /**
      * Specify the Android app package name.
      */
     // ANDROID_APP_PACKAGE: 'org.jitsi.meet',
 
-    // List of undocumented settings
     /**
-     INDICATOR_FONT_SIZES
-     PHONE_NUMBER_REGEX
-    */
-
-    // -----------------DEPRECATED CONFIGS BELOW THIS LINE-----------------------------
+     * Specify custom URL for downloading f droid app.
+     */
+    // MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',
 
     // Connection indicators (
     // CONNECTION_INDICATOR_AUTO_HIDE_ENABLED,
@@ -242,12 +239,19 @@ var interfaceConfig = {
     // Please use defaultLocalDisplayName from config.js
     // DEFAULT_LOCAL_DISPLAY_NAME: 'me',
 
+    // Please use defaultLogoUrl from config.js
+    // DEFAULT_LOGO_URL: 'images/watermark.svg',
+
     // Please use defaultRemoteDisplayName from config.js
     // DEFAULT_REMOTE_DISPLAY_NAME: 'Fellow Jitster',
 
     // Moved to config.js as `toolbarConfig.initialTimeout`.
     // INITIAL_TOOLBAR_TIMEOUT: 20000,
 
+    // Please use `liveStreaming.helpLink` from config.js
+    // Documentation reference for the live streaming feature.
+    // LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live',
+
     // Moved to config.js as `toolbarConfig.alwaysVisible`.
     // TOOLBAR_ALWAYS_VISIBLE: false,
 

type/__jitsi_meet_domain/files/jitsi-version

@@ -1 +1 @@
-2.0.7210-1
+2.0.8319-1

type/__jitsi_meet_domain/files/nginx.sh

@@ -7,8 +7,9 @@ JITSI_NGINX_CONFIG="$(cat <<EOF
 #server_names_hash_bucket_size 64;
 #
 #types {
-## nginx's default mime.types doesn't include a mapping for wasm
+## nginx's default mime.types doesn't include a mapping for wasm or wav.
 #    application/wasm     wasm;
+#    audio/wav            wav;
 #}
 # These upstreams are managed by __jitsi_meet
 #upstream prosody {
@@ -21,6 +22,17 @@ JITSI_NGINX_CONFIG="$(cat <<EOF
 #    server 127.0.0.1:9090;
 #    keepalive 2;
 #}
+#map \$arg_vnode \$prosody_node {
+#    default prosody;
+#    v1 v1;
+#    v2 v2;
+#    v3 v3;
+#    v4 v4;
+#    v5 v5;
+#    v6 v6;
+#    v7 v7;
+#    v8 v8;
+#}
 server {
     listen 80;
     listen [::]:80;
@@ -91,6 +103,13 @@ server {
         alias /usr/share/jitsi-meet/libs/external_api.min.js;
     }
 
+    location = /_api/room-info {
+        proxy_pass http://prosody/room-info?prefix=\$prefix&\$args;
+        proxy_http_version 1.1;
+        proxy_set_header X-Forwarded-For \$remote_addr;
+        proxy_set_header Host \$http_host;
+    }
+
     # ensure all static content can always be found first
     location ~ ^/(libs|css|static|images|fonts|lang|sounds|connection_optimization|.well-known)/(.*)\$
     {
@@ -102,6 +121,7 @@ server {
             expires 1y;
         }
     }
+
     # Paths for jsi / interpreters
     location ~ ^/i/(img/[^./]*.png|jsi.js|style.css)$
     {
@@ -193,6 +213,14 @@ server {
         rewrite ^/(.*)\$ /xmpp-websocket;
     }
 
+    location ~ ^/([^/?&:'"]+)/_api/room-info {
+        set \$subdomain "\$1.";
+        set \$subdir "\$1/";
+        set \$prefix "\$1";
+
+        rewrite ^/(.*)\$ /_api/room-info;
+    }
+
     # Anything that didn't match above, and isn't a real file, assume it's a room name and redirect to /
     location ~ ^/([^/?&:'"]+)/(.*)\$ {
         set \$subdomain "\$1.";

type/__jitsi_meet_domain/files/nginx.sh.orig

@@ -1,8 +1,9 @@
 server_names_hash_bucket_size 64;
 
 types {
-# nginx's default mime.types doesn't include a mapping for wasm
+# nginx's default mime.types doesn't include a mapping for wasm or wav.
     application/wasm     wasm;
+    audio/wav            wav;
 }
 upstream prosody {
     zone upstreams 64K;
@@ -14,6 +15,17 @@ upstream jvb1 {
     server 127.0.0.1:9090;
     keepalive 2;
 }
+map $arg_vnode $prosody_node {
+    default prosody;
+    v1 v1;
+    v2 v2;
+    v3 v3;
+    v4 v4;
+    v5 v5;
+    v6 v6;
+    v7 v7;
+    v8 v8;
+}
 server {
     listen 80;
     listen [::]:80;
@@ -73,6 +85,13 @@ server {
         alias /usr/share/jitsi-meet/libs/external_api.min.js;
     }
 
+    location = /_api/room-info {
+        proxy_pass http://prosody/room-info?prefix=$prefix&$args;
+        proxy_http_version 1.1;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header Host $http_host;
+    }
+
     # ensure all static content can always be found first
     location ~ ^/(libs|css|static|images|fonts|lang|sounds|connection_optimization|.well-known)/(.*)$
     {
@@ -87,7 +106,7 @@ server {
 
     # BOSH
     location = /http-bind {
-        proxy_pass http://prosody/http-bind?prefix=$prefix&$args;
+        proxy_pass http://$prosody_node/http-bind?prefix=$prefix&$args;
         proxy_http_version 1.1;
         proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header Host $http_host;
@@ -96,7 +115,7 @@ server {
 
     # xmpp websockets
     location = /xmpp-websocket {
-        proxy_pass http://prosody/xmpp-websocket?prefix=$prefix&$args;
+        proxy_pass http://$prosody_node/xmpp-websocket?prefix=$prefix&$args;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
@@ -156,6 +175,14 @@ server {
         rewrite ^/(.*)$ /xmpp-websocket;
     }
 
+    location ~ ^/([^/?&:'"]+)/_api/room-info {
+        set $subdomain "$1.";
+        set $subdir "$1/";
+        set $prefix "$1";
+
+        rewrite ^/(.*)$ /_api/room-info;
+    }
+
     # Anything that didn't match above, and isn't a real file, assume it's a room name and redirect to /
     location ~ ^/([^/?&:'"]+)/(.*)$ {
         set $subdomain "$1.";

type/__jitsi_meet_domain/files/prosody.cfg.lua.sh

@@ -75,8 +75,7 @@ ${PROSODY_MAIN_END}
 ${PROSODY_DOMAIN_START}
 -- This will be managed by __jitsi_meet_domain
 VirtualHost "${JITSI_DOMAIN:?}"
-    -- enabled = false -- Remove this line to enable this host
-    authentication = "anonymous"
+    authentication = "jitsi-anonymous" -- do not delete me
     -- Properties below are modified by jitsi-meet-tokens package config
     -- and authentication above is switched to "token"
     --app_id="example_app_id"
@@ -92,6 +91,7 @@ VirtualHost "${JITSI_DOMAIN:?}"
     av_moderation_component = "avmoderation.${JITSI_DOMAIN:?}"
     speakerstats_component = "speakerstats.${JITSI_DOMAIN:?}"
     conference_duration_component = "conferenceduration.${JITSI_DOMAIN:?}"
+    end_conference_component = "endconference.${JITSI_DOMAIN:?}"
     -- we need bosh
     modules_enabled = {
         "bosh";
@@ -100,9 +100,11 @@ VirtualHost "${JITSI_DOMAIN:?}"
         "speakerstats";
         "external_services";
         "conference_duration";
+        "end_conference";
         "muc_lobby_rooms";
         "muc_breakout_rooms";
         "av_moderation";
+        "room_metadata";
 ${PROSODY_WEBSOCKET}        "websocket";
 ${PROSODY_WEBSOCKET}        "smacks";
     }
@@ -113,6 +115,7 @@ ${PROSODY_WEBSOCKET}        "smacks";
     c2s_require_encryption = false
     lobby_muc = "lobby.${JITSI_DOMAIN:?}"
     breakout_rooms_muc = "breakout.${JITSI_DOMAIN:?}"
+    room_metadata_component = "metadata.${JITSI_DOMAIN:?}"
     main_muc = "conference.${JITSI_DOMAIN:?}"
     -- muc_lobby_whitelist = { "recorder.${JITSI_DOMAIN:?}" } -- Here we can whitelist jibri to enter lobby enabled rooms
 
@@ -136,7 +139,6 @@ Component "breakout.${JITSI_DOMAIN:?}" "muc"
     modules_enabled = {
         "muc_meeting_id";
         "muc_domain_mapper";
-        --"token_verification";
         "muc_rate_limit";
         "polls";
     }
@@ -184,6 +186,9 @@ Component "speakerstats.${JITSI_DOMAIN:?}" "speakerstats_component"
 Component "conferenceduration.${JITSI_DOMAIN:?}" "conference_duration_component"
     muc_component = "conference.${JITSI_DOMAIN:?}"
 
+Component "endconference.${JITSI_DOMAIN:?}" "end_conference"
+    muc_component = "conference.${JITSI_DOMAIN:?}"
+
 Component "avmoderation.${JITSI_DOMAIN:?}" "av_moderation_component"
     muc_component = "conference.${JITSI_DOMAIN:?}"
 
@@ -196,6 +201,10 @@ Component "lobby.${JITSI_DOMAIN:?}" "muc"
         "muc_rate_limit";
         "polls";
     }
+
+Component "metadata.${JITSI_DOMAIN:?}" "room_metadata_component"
+    muc_component = "conference.${JITSI_DOMAIN:?}"
+    breakout_rooms_component = "breakout.${JITSI_DOMAIN:?}"
 ${PROSODY_DOMAIN_END}
 
 ${PROSODY_SECUREDOMAIN_START}

type/__jitsi_meet_domain/files/prosody.cfg.lua.sh.orig

@@ -36,8 +36,7 @@ unlimited_jids = {
 }
 
 VirtualHost "jitmeet.example.com"
-    -- enabled = false -- Remove this line to enable this host
-    authentication = "anonymous"
+    authentication = "jitsi-anonymous" -- do not delete me
     -- Properties below are modified by jitsi-meet-tokens package config
     -- and authentication above is switched to "token"
     --app_id="example_app_id"
@@ -53,6 +52,7 @@ VirtualHost "jitmeet.example.com"
     av_moderation_component = "avmoderation.jitmeet.example.com"
     speakerstats_component = "speakerstats.jitmeet.example.com"
     conference_duration_component = "conferenceduration.jitmeet.example.com"
+    end_conference_component = "endconference.jitmeet.example.com"
     -- we need bosh
     modules_enabled = {
         "bosh";
@@ -61,13 +61,16 @@ VirtualHost "jitmeet.example.com"
         "speakerstats";
         "external_services";
         "conference_duration";
+        "end_conference";
         "muc_lobby_rooms";
         "muc_breakout_rooms";
         "av_moderation";
+        "room_metadata";
     }
     c2s_require_encryption = false
     lobby_muc = "lobby.jitmeet.example.com"
     breakout_rooms_muc = "breakout.jitmeet.example.com"
+    room_metadata_component = "metadata.jitmeet.example.com"
     main_muc = "conference.jitmeet.example.com"
     -- muc_lobby_whitelist = { "recorder.jitmeet.example.com" } -- Here we can whitelist jibri to enter lobby enabled rooms
 
@@ -91,7 +94,6 @@ Component "breakout.jitmeet.example.com" "muc"
     modules_enabled = {
         "muc_meeting_id";
         "muc_domain_mapper";
-        --"token_verification";
         "muc_rate_limit";
         "polls";
     }
@@ -125,6 +127,9 @@ Component "speakerstats.jitmeet.example.com" "speakerstats_component"
 Component "conferenceduration.jitmeet.example.com" "conference_duration_component"
     muc_component = "conference.jitmeet.example.com"
 
+Component "endconference.jitmeet.example.com" "end_conference"
+    muc_component = "conference.jitmeet.example.com"
+
 Component "avmoderation.jitmeet.example.com" "av_moderation_component"
     muc_component = "conference.jitmeet.example.com"
 
@@ -137,3 +142,7 @@ Component "lobby.jitmeet.example.com" "muc"
         "muc_rate_limit";
         "polls";
     }
+
+Component "metadata.jitmeet.example.com" "room_metadata_component"
+    muc_component = "conference.jitmeet.example.com"
+    breakout_rooms_component = "breakout.jitmeet.example.com"

type/__runit/manifest

@@ -6,7 +6,14 @@ os="$(cat "${__global}/explorer/os")"
 case "${os}" in
 	debian|devuan)
 		# zero-config sysvinit and systemd compatibility
-		__package runit-run
+		os_version="$(cat "${__global}/explorer/os_version")"
+		debian_package="runit-run"
+		case "${os_version}" in
+			beowulf)
+				debian_package="runit"
+			;;
+		esac
+		__package "${debian_package}"
 	;;
 	freebsd)
 		__key_value \

type/__runit_service/manifest

@@ -33,18 +33,25 @@ if [ "${state}" != "present" ]; then
 	exit
 fi
 
+# Setup run file
+__file --state "${state}" --mode 0550 --source "${source}" \
+	--onchange "sv restart '${sv}' || true" \
+	"${run_file}"
+export require="${require} __file${run_file}"
+
 if [ -f "${__object}/parameter/log" ]; then
 	# Setup logger if requested
-	__directory --parents "${svdir}/${sv}/log/main"
-	export require="${require} __directory${svdir}/${sv}/log/main"
+	logdir="/var/log/runit"
+	__directory --parents "${svdir}/${sv}/log"
+	__directory --state absent "${svdir}/${sv}/log/main"  # Remove lingering old fashioned log
+	__directory --parents "${logdir}/${sv}"
+	export require="${require} __directory${svdir}/${sv}/log __directory${logdir}/${sv}"
 	__file "${svdir}/${sv}/log/run" \
 		--state "${state}" \
 		--mode 0755 \
+		--onchange "sv restart '${sv}/log' || true" \
 		--source "-" <<EOF
 #!/bin/sh
-exec svlogd -tt ./main
+exec svlogd -tt '${logdir}/${sv}'
 EOF
 fi
-
-# Setup run file
-__file --state "${state}" --mode 0755 --source "${source}" "${run_file}"

type/__single_binary_service/man.rst

@@ -90,6 +90,11 @@ binary
     If `--unpack` is used, a binary with this name must be unpacked.
     Otherwise, the contents of `--url` will be placed under this binary name.
 
+env
+    An `env` file consiting of `ENVIRONMENT_VARIABLE=VALUE`, one variable per
+    line.
+    Empty lines and those starting with `#` are ignored.
+
 service-args
     Any extra arguments to pass along with `--service-exec`. Beware that any
     service-args having the format `--config=/etc/foo.cfg` should be

type/__single_binary_service/manifest

@@ -112,7 +112,7 @@ if [ "${USER}" != "root" ] && \
 		--system \
 		--state "${STATE}" \
 		--home "${USER_HOME_DIR}" \
-		--comment "cdist-managed ${SERVICE_NAME} user" \
+		--comment "cdist-managed service user" \
 		${USER_CREATE_HOME}
 	# Track dependencies
 	service_require="${service_require} __user/${USER}"
@@ -136,11 +136,21 @@ fi
 
 
 
+# These messages will trigger a service restart (overridden for systemd)
+service_config_reload_pattern="^__file${CONFIG_FILE_DEST}"
+
 # This should setup the object in $service_definition_require
 # See above.
 case "${INIT}" in
 	systemd)
 		if [ -z "${SERVICE_DEFINITION}" ]; then
+			SYSTEMD_ENV_FILE="/etc/systemd/system/${SERVICE_NAME}.env"
+			__file "${SYSTEMD_ENV_FILE}" \
+				--mode 0400 \
+				--source "${__object}/parameter/env"
+			# We need to take into account the envionment file for systemd too
+			service_config_reload_pattern="(${service_config_reload_pattern}|^__file${SYSTEMD_ENV_FILE})"
+
 			SERVICE_DEFINITION="$(cat <<EOF
 [Unit]
 Description=${SERVICE_DESCRIPTION}
@@ -153,6 +163,7 @@ User=${USER}
 Group=${GROUP}
 ExecStart=${SERVICE_EXEC}
 Restart=always
+EnvironmentFile=${SYSTEMD_ENV_FILE}
 ${WORKING_DIRECTORY_SYSTEMD}
 
 [Install]
@@ -169,12 +180,18 @@ EOF
 	;;
 	runit|sysvinit)
 		if [ -z "${SERVICE_DEFINITION}" ]; then
+			RUNIT_ENV="$(sed -Ee 's!^([[:alnum:]_]+)=(.*)$!export \1=\2!' "${__object}/parameter/env")"
 			SERVICE_DEFINITION="$(cat <<EOF
 #!/bin/sh -e
 ${WORKING_DIRECTORY_RUNIT}
+# User-provided environment
+${RUNIT_ENV}
+# System vars
 export HOME="\$(getent passwd '${USER}' | cut -d: -f6)"
 export USER="${USER}"
 export GROUP="${GROUP}"
+
+exec 2>&1
 exec chpst -u "${USER}:${GROUP}" ${SERVICE_EXEC}
 EOF
 )"
@@ -279,10 +296,10 @@ EOF
 			--onchange "${perform_service_upgrade}" \
 			--source "-"
 else
-	# We only restart here if there was a config change
+	# We only restart here if there was a config or env change
 	# but there was not a version change
 	require="${service_require}" __check_messages \
 		"single_binary_service_${__object_id}" \
-		--pattern "^__file${CONFIG_FILE_DEST}" \
+		--pattern "${service_config_reload_pattern}" \
 		--execute "$(sv_cmd restart)"
 fi

type/__single_binary_service/parameter/optional

@@ -1,4 +1,5 @@
 config-file-source
+env
 user
 group
 state