slim down required files to working example

src/main/cljc/dda/c4k_jitsi/core.cljc

@@ -12,24 +12,18 @@
 (def config? (s/keys :req-un [::jitsi/fqdn]
                      :opt-un [::jitsi/issuer ::jitsi/ingress-type]))
 
-(def auth? (s/keys :req-un []))
+(def auth? (s/keys :req-un [::jitsi/jvb-auth-password ::jitsi/jicofo-auth-password ::jitsi/jicofo-component-secret]))
 
 (defn k8s-objects [config]
    (map (fn [x] (yaml/to-string x))
-   [(jitsi/generate-jicofo-deployment config)
+   [(jitsi/generate-ingress config)
-    (jitsi/generate-jicofo-pvc)
+    (jitsi/generate-secret config)
-    (jitsi/generate-jvb-deployment config)
+    (jitsi/generate-jicofo-deployment)
-    (jitsi/generate-jvb-pvc)
+    (jitsi/generate-jvb-deployment)
     (jitsi/generate-jvb-service)
-    (jitsi/generate-networkpolicy)
+    (jitsi/generate-prosody-deployment)
-    (jitsi/generate-prosody-deployment config)
+    (jitsi/generate-web-deployment)
-    (jitsi/generate-prosody-pvc-config)
+    (jitsi/generate-web-service)]))
-    (jitsi/generate-prosody-pvc-plugins)
-    (jitsi/generate-prosody-service)
-    (jitsi/generate-web-deployment config)
-    (jitsi/generate-web-pvc-config)
-    (jitsi/generate-web-pvc-crontabs)
-    (jitsi/generate-web-pvc-transcripts)]))
 
 (defn-spec generate any?
   [my-config config?

src/main/cljc/dda/c4k_jitsi/jitsi.cljc

@@ -8,72 +8,51 @@
 
 (s/def ::fqdn pred/fqdn-string?)
 (s/def ::issuer pred/letsencrypt-issuer?)
+(s/def ::jvb-auth-password pred/bash-env-string?)
+(s/def ::jicofo-auth-password pred/bash-env-string?)
+(s/def ::jicofo-component-secret pred/bash-env-string?)
 
 #?(:cljs
    (defmethod yaml/load-resource :jitsi [resource-name]
      (case resource-name
+       "jitsi/ingress.yaml"              (rc/inline "jitsi/ingress.yaml")
        "jitsi/jicofo-deployment.yaml"    (rc/inline "jitsi/jicofo-deployment.yaml")
-       "jitsi/jicofo-pvc.yaml"           (rc/inline "jitsi/jicofo-pvc.yaml")
        "jitsi/jvb-deployment.yaml"       (rc/inline "jitsi/jvb-deployment.yaml")
-       "jitsi/jvb-pvc.yaml"              (rc/inline "jitsi/jvb-pvc.yaml")
        "jitsi/jvb-service.yaml"          (rc/inline "jitsi/jvb-service.yaml")
-       "jitsi/networkpolicy.yaml"        (rc/inline "jitsi/networkpolicy.yaml")
        "jitsi/prosody-deployment.yaml"   (rc/inline "jitsi/prosody-deployment.yaml")
-       "jitsi/prosody-pvc-config.yaml"   (rc/inline "jitsi/prosody-pvc-config.yaml")
+       "jitsi/secret.yaml"               (rc/inline "jitsi/secret.yaml")
-       "jitsi/prosody-pvc-plugins.yaml"  (rc/inline "jitsi/prosody-pvc-plugins.yaml")
-       "jitsi/prosody-service.yaml"      (rc/inline "jitsi/prosody-service.yaml")
        "jitsi/web-deployment.yaml"       (rc/inline "jitsi/web-deployment.yaml")
-       "jitsi/web-pvc-config.yaml"       (rc/inline "jitsi/web-pvc-config.yaml")
-       "jitsi/web-pvc-crontabs.yaml"     (rc/inline "jitsi/web-pvc-crontabs.yaml")
-       "jitsi/web-pvc-transcripts.yaml"  (rc/inline "jitsi/web-pvc-transcripts.yaml")
        "jitsi/web-service.yaml"          (rc/inline "jitsi/web-service.yaml")
        (throw (js/Error. "Undefined Resource!")))))
- 
+
-(defn generate-jicofo-deployment [config]
+(defn generate-ingress [config]
+  (->
+   ; TODO: Update fqdn from config
+   (yaml/from-string (yaml/load-resource "jitsi/ingress.yaml"))))
+
+(defn generate-secret [config]
+  (->
+   ; TODO: Update secrets from auth
+   (yaml/from-string (yaml/load-resource "jitsi/secret.yaml"))))
+
+(defn generate-jicofo-deployment []
   (->
    (yaml/from-string (yaml/load-resource "jitsi/jicofo-deployment.yaml"))))
 
-(defn generate-jicofo-pvc []
+(defn generate-jvb-deployment []
-  (yaml/from-string (yaml/load-resource "jitsi/jicofo-pvc.yaml")))
-
-(defn generate-jvb-deployment [config]
   (->
    (yaml/from-string (yaml/load-resource "jitsi/jvb-deployment.yaml"))))
 
-(defn generate-jvb-pvc []
-  (yaml/from-string (yaml/load-resource "jitsi/jvb-pvc.yaml")))
-
 (defn generate-jvb-service []
   (yaml/from-string (yaml/load-resource "jitsi/jvb-service.yaml")))
 
-(defn generate-networkpolicy []
+(defn generate-prosody-deployment []
-  (yaml/from-string (yaml/load-resource "jitsi/networkpolicy.yaml")))
-
-(defn generate-prosody-deployment [config]
   (->
    (yaml/from-string (yaml/load-resource "jitsi/prosody-deployment.yaml"))))
 
-(defn generate-prosody-pvc-config []
+(defn generate-web-deployment []
-  (yaml/from-string (yaml/load-resource "jitsi/prosody-pvc-config.yaml")))
-
-(defn generate-prosody-pvc-plugins []
-  (yaml/from-string (yaml/load-resource "jitsi/prosody-pvc-plugins.yaml")))
-
-(defn generate-prosody-service []
-  (yaml/from-string (yaml/load-resource "jitsi/prosody-service.yaml")))
-
-(defn generate-web-deployment [config]
   (->
    (yaml/from-string (yaml/load-resource "jitsi/web-deployment.yaml"))))
 
-(defn generate-web-pvc-config []
-  (yaml/from-string (yaml/load-resource "jitsi/web-pvc-config.yaml")))
-
-(defn generate-web-pvc-crontabs []
-  (yaml/from-string (yaml/load-resource "jitsi/web-pvc-crontabs.yaml")))
-
-(defn generate-web-pvc-transcripts []
-  (yaml/from-string (yaml/load-resource "jitsi/web-pvc-transcripts.yaml")))
-
 (defn generate-web-service []
   (yaml/from-string (yaml/load-resource "jitsi/web-service.yaml")))

src/main/resources/jitsi/ingress.yaml

@@ -0,0 +1,22 @@
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: jitsi
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging-issuer
+spec:
+  tls:
+  - hosts:
+    - fqdn
+    secretName: tls-jitsi
+  rules:
+  - host: fqdn
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: web
+            port:
+              number: 80

src/main/resources/jitsi/jicofo-deployment.yaml

@@ -1,30 +1,46 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: jicofo
+  labels:
+    app: jitsi
+  name: jitsi
 spec:
-  selector:
-    matchLabels:
-      app: jicofo
   strategy:
     type: Recreate
+  selector:
+    matchLabels:
+      app: jitsi
   template:
     metadata:
       labels:
-        app: jicofo
+        app: jitsi
-        jitsi-network/meet.jitsi: "true"
     spec:
       containers:
-      - env:
+        - name: jicofo
-        - name: SENTRY_DSN
+          image: jitsi/jicofo:stable-6826
-          value: '"0"'
+          imagePullPolicy: IfNotPresent
-        image: jitsi/jicofo:stable-6865
+          env:
-        imagePullPolicy: IfNotPresent
+            - name: XMPP_SERVER
-        name: jicofo
+              value: localhost
-        volumeMounts:
+            - name: XMPP_DOMAIN
-        - mountPath: /config
+              value: meet.jitsi
-          name: jicofo-claim-config
+            - name: XMPP_AUTH_DOMAIN
-      volumes:
+              value: auth.meet.jitsi
-      - name: jicofo-claim-config
+            - name: XMPP_MUC_DOMAIN
-        persistentVolumeClaim:
+              value: muc.meet.jitsi
-          claimName: jicofo-claim-config
+            - name: XMPP_INTERNAL_MUC_DOMAIN
+              value: internal-muc.meet.jitsi
+            - name: JICOFO_COMPONENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-config
+                  key: JICOFO_COMPONENT_SECRET
+            - name: JICOFO_AUTH_USER
+              value: focus
+            - name: JICOFO_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-config
+                  key: JICOFO_AUTH_PASSWORD
+            - name: TZ
+              value: Europe/Berlin

src/main/resources/jitsi/jicofo-pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jicofo-claim-config
-  labels:
-    app: jicofo
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

src/main/resources/jitsi/jvb-deployment.yaml

@@ -1,41 +1,54 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: jvb
+  labels:
+    app: jitsi
+  name: jitsi
 spec:
-  selector:
-    matchLabels:
-      app: jvb
   strategy:
     type: Recreate
+  selector:
+    matchLabels:
+      app: jitsi
   template:
     metadata:
       labels:
-        app: jvb
+        app: jitsi
-        jitsi-network/meet.jitsi: "true"
-        service: jvb-service
     spec:
       containers:
-      - env:
+        - name: jvb
-        - name: JVB_PORT
+          image: jitsi/jvb:stable-6826
-          value: "10000"
+          imagePullPolicy: IfNotPresent
-        - name: JVB_TCP_MAPPED_PORT
+          env:
-          value: "4443"
+            - name: XMPP_SERVER
-        - name: JVB_TCP_PORT
+              value: localhost
-          value: "4443"
+            - name: DOCKER_HOST_ADDRESS
-        - name: SENTRY_DSN
+              value: localhost
-          value: '"0"'
+            - name: XMPP_DOMAIN
-        image: jitsi/jvb:stable-6865
+              value: meet.jitsi
-        imagePullPolicy: IfNotPresent
+            - name: XMPP_AUTH_DOMAIN
-        name: jvb
+              value: auth.meet.jitsi
-        ports:
+            - name: XMPP_INTERNAL_MUC_DOMAIN
-        - containerPort: 10000
+              value: internal-muc.meet.jitsi
-          protocol: UDP
+            - name: JVB_STUN_SERVERS
-        - containerPort: 4443
+              value: stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302
-        volumeMounts:
+            - name: JICOFO_AUTH_USER
-        - mountPath: /config
+              value: focus
-          name: jvb-claim-config
+            - name: JVB_TCP_HARVESTER_DISABLED
-      volumes:
+              value: "true"
-      - name: jvb-claim-config
+            - name: JVB_AUTH_USER
-        persistentVolumeClaim:
+              value: jvb
-          claimName: jvb-claim-config
+            - name: JVB_PORT
+              value: "30300"
+            - name: JVB_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-config
+                  key: JVB_AUTH_PASSWORD
+            - name: JICOFO_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-config
+                  key: JICOFO_AUTH_PASSWORD
+            - name: TZ
+              value: Europe/Berlin

src/main/resources/jitsi/jvb-pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jvb-claim-config
-  labels:
-    app: jvb
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

src/main/resources/jitsi/jvb-service.yaml

@@ -1,11 +1,16 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: jvb-service
+  labels:
+    service: jvb
+  name: jvb-udp
 spec:
+  type: NodePort
+  externalTrafficPolicy: Cluster
   ports:
-  - port: 10000
+  - port: 30300
     protocol: UDP
-  - port: 4443
+    targetPort: 30300
+    nodePort: 30300
   selector:
-    app: jvb
+    app: jitsi

src/main/resources/jitsi/networkpolicy.yaml

@@ -1,13 +0,0 @@
-apiVersion: extensions/v1beta1
-kind: NetworkPolicy
-metadata:
-  name: meet.jitsi
-spec:
-  ingress:
-  - from:
-    - podSelector:
-        matchLabels:
-          jitsi-network/meet.jitsi: "true"
-  podSelector:
-    matchLabels:
-      jitsi-network/meet.jitsi: "true"

src/main/resources/jitsi/prosody-deployment.yaml

@@ -1,37 +1,53 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: prosody
+  labels:
+    app: jitsi
+  name: jitsi
 spec:
-  selector:
-    matchLabels:
-      app: prosody
   strategy:
     type: Recreate
+  selector:
+    matchLabels:
+      app: jitsi
   template:
     metadata:
       labels:
-        app: prosody
+        app: jitsi
-        jitsi-network/meet.jitsi: "true"
-        service: prosody-service
     spec:
       containers:
-      - image: jitsi/prosody:stable-6865
+        - name: prosody
-        imagePullPolicy: IfNotPresent
+          image: jitsi/prosody:stable-6826
-        name: prosody
+          imagePullPolicy: IfNotPresent
-        ports:
+          env:
-        - containerPort: 5222
+            - name: XMPP_DOMAIN
-        - containerPort: 5347
+              value: meet.jitsi
-        - containerPort: 5280
+            - name: XMPP_AUTH_DOMAIN
-        volumeMounts:
+              value: auth.meet.jitsi
-        - mountPath: /config
+            - name: XMPP_MUC_DOMAIN
-          name: prosody-claim-config
+              value: muc.meet.jitsi
-        - mountPath: /prosody-plugins-custom
+            - name: XMPP_INTERNAL_MUC_DOMAIN
-          name: prosody-claim-plugins
+              value: internal-muc.meet.jitsi
-      volumes:
+            - name: JICOFO_COMPONENT_SECRET
-      - name: prosody-claim-config
+              valueFrom:
-        persistentVolumeClaim:
+                secretKeyRef:
-          claimName: prosody-claim-config
+                  name: jitsi-config
-      - name: prosody-claim-plugins
+                  key: JICOFO_COMPONENT_SECRET
-        persistentVolumeClaim:
+            - name: JVB_AUTH_USER
-          claimName: prosody-claim-plugins
+              value: jvb
+            - name: JVB_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-config
+                  key: JVB_AUTH_PASSWORD
+            - name: JICOFO_AUTH_USER
+              value: focus
+            - name: JICOFO_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: jitsi-config
+                  key: JICOFO_AUTH_PASSWORD
+            - name: TZ
+              value: Europe/Berlin
+            - name: JVB_TCP_HARVESTER_DISABLED
+              value: "true"

src/main/resources/jitsi/prosody-pvc-config.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prosody-claim-config
-  labels:
-    app: prosody
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

src/main/resources/jitsi/prosody-pvc-plugins.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prosody-claim-plugins
-  labels:
-    app: prosody
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

src/main/resources/jitsi/prosody-service.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: prosody-service
-spec:
-  ports:
-  - port: 5222
-  - port: 5347
-  - port: 5280
-  selector:
-    app: prosody

src/main/resources/jitsi/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: jitsi-config
+type: Opaque
+data:
+  JVB_AUTH_PASSWORD: "jvb-auth"
+  JICOFO_AUTH_PASSWORD: "jicofo-auth"
+  JICOFO_COMPONENT_SECRET: "comp-sec"

src/main/resources/jitsi/web-deployment.yaml

@@ -1,41 +1,40 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: jitsi-web
+  labels:
+    app: jitsi
+  name: jitsi
 spec:
-  selector:
-    matchLabels:
-      app: jitsi-web
   strategy:
     type: Recreate
+  selector:
+    matchLabels:
+      app: jitsi
   template:
     metadata:
       labels:
         app: jitsi
-        jitsi-network/meet.jitsi: "true"
-        service: jitsi-web-service
     spec:
       containers:
-      - image: jitsi/web:stable-6865
+        - name: web
-        imagePullPolicy: IfNotPresent
+          image: jitsi/web:stable-6826
-        name: jitsi-web
+          imagePullPolicy: IfNotPresent
-        ports:
+          env:
-        - containerPort: 80
+            - name: XMPP_SERVER
-        - containerPort: 443
+              value: localhost
-        volumeMounts:
+            - name: JICOFO_AUTH_USER
-        - mountPath: /config
+              value: focus
-          name: web-claim-config
+            - name: XMPP_DOMAIN
-        - mountPath: /var/spool/cron/crontabs
+              value: meet.jitsi
-          name: web-claim-crontabs
+            - name: XMPP_AUTH_DOMAIN
-        - mountPath: /usr/share/jitsi-meet/transcripts
+              value: auth.meet.jitsi
-          name: web-claim-transcripts
+            - name: XMPP_INTERNAL_MUC_DOMAIN
-      volumes:
+              value: internal-muc.meet.jitsi
-      - name: web-claim-config
+            - name: XMPP_BOSH_URL_BASE
-        persistentVolumeClaim:
+              value: http://127.0.0.1:5280
-          claimName: web-claim-config
+            - name: XMPP_MUC_DOMAIN
-      - name: web-claim-crontabs
+              value: muc.meet.jitsi
-        persistentVolumeClaim:
+            - name: TZ
-          claimName: web-claim-crontabs
+              value: Europe/Berlin
-      - name: web-claim-transcripts
+            - name: JVB_TCP_HARVESTER_DISABLED
-        persistentVolumeClaim:
+              value: "true"
-          claimName: web-claim-transcripts

src/main/resources/jitsi/web-pvc-config.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: web-claim-config
-  labels:
-    app: jitsi
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

src/main/resources/jitsi/web-pvc-crontabs.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: web-claim-crontabs
-  labels:
-    app: jitsi  
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

src/main/resources/jitsi/web-pvc-transcripts.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: web-claim-transcripts
-  labels:
-    app: jitsi
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

src/main/resources/jitsi/web-service.yaml

@@ -1,12 +1,16 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: jitsi-web-service
+  labels:
+    service: web
+  name: web
 spec:
-  selector:
-    app: jitsi-web
   ports:
-  - port: 8000
+  - name: "http"
-  - port: 8443
+    port: 80
+    targetPort: 80
+  - name: "https"
+    port: 443
+    targetPort: 443
   selector:
-    service: jitsi-web-service
+    app: jitsi