Commit Graph

339 Commits

Author SHA1 Message Date
evilham 11ecb37dd9
[__jitsi_meet] Add --abort-conference-count parameter
Only has an effect if the prometheus exporter is enabled and if it is not
empty (default).
If at least this many conferences are active on the server, the type will
bail out before making any changes.
This is useful if you want to avoid service disruptions due to e.g. an SLA.

Sponsored by:
2022-06-21 11:19:11 +02:00
evilham 03a9b8b333
[__jitsi_meet*] Update to 2.0.7439-1

Sponsored by:,
2022-06-21 11:12:27 +02:00
evilham 7a3b706b16
[__jitsi_meet*] Update to 2.0.7416-1

Sponsored by:,
2022-06-16 17:43:30 +02:00
evilham 756e5b17c6
[__jitsi_meet*] Update to 2.0.7287-1
Sponsored by:,
2022-06-07 15:00:00 +02:00
evilham 797f7c8648
[__jitsi_meet] Improve manpage regarding ufw and SSH
This documents the fact that this type does not make decisions about anything
other than Jitsi-Meet itself and therefore care should be taken with the SSH

Related to:	ungleich-public/cdist-contrib#23
Reported by:	@pedro
2022-05-08 21:47:26 +02:00
evilham 1791d35f84
[__jitsi_meet_domain] Add a muc_room_cache_size for jibri
@pedro is working on this and this change matched my workflow better :-)
2022-04-28 17:43:33 +02:00
evilham 8e1d0b68f1
[__jitsi_meet*] Add new parameters for heavier branding
This uses nginx' server-side includes, so each domain configured by
`__jitsi_meet_domain` can have its own customisation.

Note that the file customisation file must exist for each domain,
`__jitsi_meet_domain` takes care of that already.

Sponsored by:,
2022-04-28 17:42:30 +02:00
evilham aa3f2eeb00
[__jitsi_meet_domain] Make shellcheck happy and fix escaping issue
The escaping issue was overlooked because it was in a comment block; it wasn't

No functional changes intended.

Sponsored by:,
2022-04-28 17:34:32 +02:00
evilham a63d9ec458
[__jitsi_meet] Configure jicofo so metrics are more useful
By default the REST API provided by jicofo is less useful than desired.
This is a tad under-documented, so finding the right settings was tricky :-).

Sponsored by:,
2022-04-28 17:32:15 +02:00
evilham 0cff414884
[__jitsi_meet] Simplify exporter logic and update it to 1.2.0
This uses the newly merged __single_binary_service and:

- Fixes the bug where once added, the exporter could not be removed
- Simplifies keeping it up to date

Sponsored by:,
2022-04-28 17:28:46 +02:00
evilham 977b530dab
[__single_binary_service] Update manpage to remove __evilham prefix 2022-04-28 17:22:19 +02:00
evilham 1865ff9dce Add 'type/__single_binary_service/' from commit '1af7e960fa882efc7202cad5cc01d3136886fa0a'
git-subtree-dir: type/__single_binary_service
git-subtree-mainline: 67bc8aa02b
git-subtree-split: 1af7e960fa
2022-04-28 17:20:02 +02:00
fnux 67bc8aa02b
__uacme_obtain: allow use of stdin with the --renew-hook parameter 2022-04-25 17:10:50 +02:00
evilham 151dc32fb5
[__jitsi_meet*] Add support for simultaneous interpretations
By using which consists of very small and simple
static files, we enable interpretations by default.

With this commit, any DOMAIN created with __jitsi_meet_domain will serve jsi on
https://DOMAIN/i/ and any ROOM can be used with simultaneous interpretation on

Sponsored by:,
2022-04-21 19:46:03 +02:00
evilham 7e2ba98d36
[__jitsi_meet] Fix issue with jicofo memory adaptation
That was being a bit of a mess.

Sponsored by:,
2022-04-21 17:52:49 +02:00
evilham 1658121549
[__jitsi_meet*] Update to 2.0.7210
While there, make things a tad easier to maintain.

Note that in this version, jitsi switches to using nginx upstreams; it shouldn't
be relevant for instances fully managed with these types.

Sponsored by:,
2022-04-21 15:52:47 +02:00
evilham c5070a3a33
[__jitsi_meet] Fix adjustment of jicofo's max memory
Leftover from last commit >,<

Sponsored by:,
2022-04-21 14:44:10 +02:00
evilham 80bbbd3aa8
[__jitsi_meet] Adapt jicofo and videobridge memory usage
This enables us to setup smaller jitsi instances that work reliably.

We set 3 threshholds:
- < 3G RAM: use 0.75G max memory
- < 5G RAM: use 1G max memory
- < 8G RAM: use 2G max memory
- >= 8G RAM: use 3G max memory (jitsi's default)

For more information as to why and how this is done, see:
as investigated back in the day by @pedro

Sponsored by:,
2022-04-21 14:37:08 +02:00
evilham 87cc109bf1
[__jitsi_meet*] Make rooms on different domains not equivalent
This is a backwards-compatible change.

We switch the approach from "treat all domains as if they were the main domain"
to: "each domain has its own prosody settings".

This works perfectly fine, even with secured domains.

There is a caveat with secured domains, in that they use the main domain to log
in; this means that users are shared across all domains (as they were before
this commit).

This is due to jicofo refusing to start meetings from a domain that is not
configured, and it only accepting one domain.

Right now, this is acceptable, however we could want to authenticate against
e.g. different LDAP / IMAP servers in the future, so this would need addressing
at that stage.

Probably the best way to solve it is by patching jicofo, so it accepts starting
conferences from multiple domains and getting that patch upstream.

Sponsored by:,
2022-04-21 13:20:30 +02:00
evilham a12b343660
[__jitsi_meet_domain] Add analytics settings parameter
with this, admins can take advantage of e.g. matomo to have some usage

The parameter defaults to `disabled: true`, which is the most privacy-friendly!

Sponsored by:
2022-04-21 13:13:12 +02:00
evilham 29cafd4f9a
[__jitsi_meet_domain] Simplify logic for secured domains 2022-04-16 13:22:16 +02:00
evilham fa37ede84f
[__jitsi_meet] Unconfuse jitsi-version and secured domains
Closes #14 by committing to keeping the package up to date as promptly as
possible; else weird  things happen and there are no real good solutions for
this.  E.g. we have seen in the past that due to security issues, a jitsi
dependency  needs to be upgraded, but some package that jitsi-meet depends upon
also has an upper limit on that package's version.

A note was added to the manpage in order make it explicit that maintenance of
this type can be sponsored to ensure its proper functioning.

Closes #15 by using `__file`. This will also allow us to have more control over
jicofo's settings, which might be important when we start doing recordings.

Sponsored by:
2022-04-10 19:45:08 +02:00
sparrowhawk af04f7464b
[__nginx_vhost]: follow Alpine vhost default directory change.
Since nginx package version v1.10.1-r3, Alpine packagers have changed
the default vhost directory from conf.d to http.d [0]. This reflects
this change.

[0]: alpine package commit 383ba9c0a200ed1f4b11d7db74207526ad90bbe3
2022-03-14 16:15:58 +01:00
sparrowhawk a6f6a7fba8
[__jitsi_meet]: Fix deprecated usage of __debconf_set_selections.
Replace the --file parameter with the --line parameter, as recommended
since cdist 6.9.6.
2022-03-14 15:30:11 +01:00
evilham a1b3a034c7
[__jitsi_meet_domain] Support the --state parameter
This enables removing domains in a simple fashion.

Closes #3.
2022-03-10 21:28:28 +01:00
evilham ac99cd8d84
[__jitsi_meet_domain] Update to 2.0.7001-1
Obsoletes #13
2022-03-10 21:23:45 +01:00
evilham ac03f05766 [__jitsi_meet] Fix bug with secured domains
This is a leftover from when we were using __line instead of __block.

Closes #15

Reported by:  @pedro
2022-03-10 21:20:52 +01:00
evilham ecd10de2d3
[__opendkim*] FreeBSD support and minor fixes
While adding FreeBSD support to the type I noticed various issues:

- We were making sure that the KeyTable and SigningTable were created in
  __opendkim_genkey, but that was being done with the default cdist permissions
  (0400) which could result in issues when reloading the service after privilege
  This is addressed by checking that it exists/creating it in __opendkim (just
  once, not once per __opendkim_genkey call) with laxer permissions (0444).
- In __opendkim, the service was being started after the config file was
  installed. This is insufficient as OpenDKIM will refuse to start with the
  generated config if either SigningTable or KeyTable do not exist yet.
- __opendkim_genkey had the implicit assumption that the --directory parameter
  always ended in a slash. This was not documented and error-prone; we are now
  a bit laxer and add the trailing slash if it is missing.
- __opendkim_genkey was not changing permissions for the resulting .txt file.
  This was not critical for it to function, but it was inconsistent.
- As documented in #17, __opendkim allows for a --userid parameter that might
  cause issues with keys generated by __opendkim_genkey.
  This issue has not been addressed yet, but I recommend deprecating the
  --userid parameter.
2022-03-10 20:08:51 +01:00
sparrowhawk 422b97bc1b
[systemd_resolved]: make singleton. 2022-02-28 16:18:51 +01:00
sparrowhawk f6d0cbbeb7
__systemd_resolved: initial implementation. 2022-02-28 16:18:49 +01:00
fnux 9a779aafa3
__matrix_synapse: add --disable-{displayname,3pid}-changes flag 2022-02-08 13:45:29 +01:00
sparrowhawk 727fbd55fb
[bird_radv] Add option to include MTU in RAs. 2022-02-07 13:46:08 +01:00
sparrowhawk 6310db7301
[bird_bgp]: minor cleanup. 2022-02-07 13:33:57 +01:00
sparrowhawk 3f52e758fc
__systemd-network: initial implementation. 2022-02-02 14:09:16 +01:00
sparrowhawk 4fdba43dd6
[__matrix_synapse]: typos in manpage. 2022-02-02 11:49:50 +01:00
fnux c32a1836aa
__matrix_synapse: add --sso-template-dir parameter 2022-01-24 11:23:38 +01:00
fnux 287d8df9bd
__matrix_synapse: set message min lifetime (although currently ignored
by synapse)
2022-01-24 08:56:12 +01:00
fnux 723d7ed250
__matrix_element: add more branding parameters 2022-01-16 14:14:42 +01:00
fnux 974e42e20e
__matrix_synapse: add --saml2-mapping-provider-extra-settings flag 2022-01-16 12:41:37 +01:00
fnux c198a74a34
__matrix_element: add --identity_server_url flag 2022-01-12 16:22:41 +01:00
fnux 35e1477521
__matrix_synapse: fix ignored --enable-3pid-lookups flag 2022-01-12 16:22:41 +01:00
fnux b2c1fee672
__matrix_synapse: add --saml2-mapping-provider-module flag 2022-01-12 16:22:41 +01:00
fnux eecb2b4629
__bird_ospf: ass -extra-area-configuration parameter 2022-01-11 16:12:45 +01:00
sparrowhawk 023206d3d9
borg-repo: add ubuntu as supported OS. 2022-01-11 09:24:43 +01:00
fnux c466733111
__matrix_synapse: add --enable-3pid-lookups flag, normalize indentation 2022-01-07 11:42:13 +01:00
fnux afe76af679
__matterbridge: add support for ubuntu, fix configuration via STDIN 2021-12-23 12:30:58 +01:00
fnux 35e299a5d1
__matrix_synapse: add --saml2-sp-key and --saml2-sp-cert flags 2021-12-23 10:46:21 +01:00
evilham e052178122 [__jitsi*] Update to 2.0.6726
Sponsored by:
2021-12-22 20:05:37 +01:00
fnux a38275f6d7
__uacme*, __nginx: allow external ACME provider, EAB authentication 2021-12-14 12:37:18 +01:00
fnux 698525fcd2
__matrix_synapse: add saml2-idp-medatada-url flag to manpage 2021-12-06 08:41:13 +01:00