Update Jitsi configs to latest upstream samples

Bring our 5 configs into line with current upstream versions (jitsi-meet_7648 and stable-7648-4 tags from the jitsi-meet and docker-jitsi-meet repositories respectively). Attempt to preserve most of our earlier overrides: * configure Etherpad integration * disable background blurring * disable watermarks * open shared document on join * start with audio and video muted * redirect HTTP to HTTPS * disable XMPP WebSockets * disable P2P connections * templated credentials * templated unique JVB server identifiers Drop any options we previously set which later became defaults (like useRoomAsSharedDocumentName or UTC as the TZ). Identify the upstream repo and tag on which each file is based. Stop claiming Firefox is not recommended, now that the default configuration adds a pre-join page which helps browsers realize they should not treat the audio stream as unsolicited. Switch to newer vars for muting audio and video as a boolean rather than at a participant threshold. Update the docker-compose files to use the stable tag instead of latest, since upstream seems to just stop refreshing the latest tag far too often. Clean up extra envvars we were setting for JVB which we didn't pass through to the containers. Change-Id: I1e5a3836917f3d90ad7dd1c0771871740fda3cda
2022-08-31 17:07:38 +00:00 · 2022-08-31 17:07:38 +00:00 · a2eda2203a
commit a2eda2203a
parent 25ba188137
7 changed files with 756 additions and 534 deletions
--- a/playbooks/roles/jitsi-meet/files/interface_config.js
+++ b/playbooks/roles/jitsi-meet/files/interface_config.js
@ -1,87 +1,60 @@
+/* Based on
+ * https://github.com/jitsi/jitsi-meet/blob/jitsi-meet_7648/interface_config.js
+ * Licensed under the ASL v2.
+ */
+
 /* eslint-disable no-unused-vars, no-var, max-len */
+/* eslint sort-keys: ["error", "asc", {"caseSensitive": false}] */
+
+/**
+ * !!!IMPORTANT!!!
+ *
+ * This file is considered deprecated. All options will eventually be moved to
+ * config.js, and no new options should be added here.
+ */

 var interfaceConfig = {
-    // TO FIX: this needs to be handled from SASS variables. There are some
-    // methods allowing to use variables both in css and js.
-    DEFAULT_BACKGROUND: '#474747',
-
-    /**
-     * Whether or not the blurred video background for large video should be
-     * displayed on browsers that can support it.
-     */
-    DISABLE_VIDEO_BACKGROUND: true,
-
-    INITIAL_TOOLBAR_TIMEOUT: 20000,
-    TOOLBAR_TIMEOUT: 4000,
-    TOOLBAR_ALWAYS_VISIBLE: false,
-    DEFAULT_REMOTE_DISPLAY_NAME: 'Fellow Jitster',
-    DEFAULT_LOCAL_DISPLAY_NAME: 'me',
-    SHOW_JITSI_WATERMARK: false,
-    JITSI_WATERMARK_LINK: 'https://jitsi.org',
-
-    // if watermark is disabled by default, it can be shown only for guests
-    SHOW_WATERMARK_FOR_GUESTS: false,
-    SHOW_BRAND_WATERMARK: false,
-    BRAND_WATERMARK_LINK: '',
-    SHOW_POWERED_BY: false,
-    SHOW_DEEP_LINKING_IMAGE: false,
-    GENERATE_ROOMNAMES_ON_WELCOME_PAGE: true,
-    DISPLAY_WELCOME_PAGE_CONTENT: true,
    APP_NAME: 'Jitsi Meet',
-    NATIVE_APP_NAME: 'Jitsi Meet',
-    PROVIDER_NAME: 'Jitsi',
-    LANG_DETECTION: false, // Allow i18n to detect the system language
-    INVITATION_POWERED_BY: true,
+    AUDIO_LEVEL_PRIMARY_COLOR: 'rgba(255,255,255,0.4)',
+    AUDIO_LEVEL_SECONDARY_COLOR: 'rgba(255,255,255,0.2)',

    /**
-     * If we should show authentication block in profile
+     * A UX mode where the last screen share participant is automatically
+     * pinned. Valid values are the string "remote-only" so remote participants
+     * get pinned but not local, otherwise any truthy value for all participants,
+     * and any falsy value to disable the feature.
+     *
+     * Note: this mode is experimental and subject to breakage.
     */
-    AUTHENTICATION_ENABLE: true,
+    AUTO_PIN_LATEST_SCREEN_SHARE: 'remote-only',
+    BRAND_WATERMARK_LINK: '',

-    /**
-     * The name of the toolbar buttons to display in the toolbar. If present,
-     * the button will display. Exceptions are "livestreaming" and "recording"
-     * which also require being a moderator and some values in config.js to be
-     * enabled. Also, the "profile" button will not display for user's with a
-     * jwt.
-     */
-    TOOLBAR_BUTTONS: [
-        'microphone', 'camera', 'closedcaptions', 'desktop', 'fullscreen',
-        'fodeviceselection', 'hangup', 'profile', 'info', 'chat', 'recording',
-        'livestreaming', 'etherpad', 'sharedvideo', 'settings', 'raisehand',
-        'videoquality', 'filmstrip', 'invite', 'feedback', 'stats', 'shortcuts',
-        'tileview'
-    ],
+    CLOSE_PAGE_GUEST_HINT: false, // A html text to be shown to guests on the close page, false disables it

-    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar' ],
+    DEFAULT_BACKGROUND: '#040404',
+    DEFAULT_LOGO_URL: 'images/watermark.svg',
+    DEFAULT_WELCOME_PAGE_LOGO_URL: 'images/watermark.svg',

-    // Determines how the video would fit the screen. 'both' would fit the whole
-    // screen, 'height' would fit the original video height to the height of the
-    // screen, 'width' would fit the original video width to the width of the
-    // screen respecting ratio.
-    VIDEO_LAYOUT_FIT: 'both',
-
-    /**
-     * Whether to only show the filmstrip (and hide the toolbar).
-     */
-    filmStripOnly: false,
-
-    /**
-     * Whether to show thumbnails in filmstrip as a column instead of as a row.
-     */
-    VERTICAL_FILMSTRIP: true,
-
-    // A html text to be shown to guests on the close page, false disables it
-    CLOSE_PAGE_GUEST_HINT: false,
-    RANDOM_AVATAR_URL_PREFIX: false,
-    RANDOM_AVATAR_URL_SUFFIX: false,
-    FILM_STRIP_MAX_HEIGHT: 120,
-
-    // Enables feedback star animation.
-    ENABLE_FEEDBACK_ANIMATION: false,
-    DISABLE_FOCUS_INDICATOR: false,
    DISABLE_DOMINANT_SPEAKER_INDICATOR: false,

+    /**
+     * If true, notifications regarding joining/leaving are no longer displayed.
+     */
+    DISABLE_JOIN_LEAVE_NOTIFICATIONS: false,
+
+    /**
+     * If true, presence status: busy, calling, connected etc. is not displayed.
+     */
+    DISABLE_PRESENCE_STATUS: false,
+
+    /**
+     * Whether the ringing sound in the call/ring overlay is disabled. If
+     * {@code undefined}, defaults to {@code false}.
+     *
+     * @type {boolean}
+     */
+    DISABLE_RINGING: false,
+
    /**
     * Whether the speech to text transcription subtitles panel is disabled.
     * If {@code undefined}, defaults to {@code false}.
@ -91,19 +64,46 @@ var interfaceConfig = {
    DISABLE_TRANSCRIPTION_SUBTITLES: false,

    /**
-     * Whether the ringing sound in the call/ring overlay is disabled. If
-     * {@code undefined}, defaults to {@code false}.
-     *
-     * @type {boolean}
+     * Whether or not the blurred video background for large video should be
+     * displayed on browsers that can support it.
     */
-    DISABLE_RINGING: false,
-    AUDIO_LEVEL_PRIMARY_COLOR: 'rgba(255,255,255,0.4)',
-    AUDIO_LEVEL_SECONDARY_COLOR: 'rgba(255,255,255,0.2)',
-    POLICY_LOGO: null,
+    DISABLE_VIDEO_BACKGROUND: true,
+
+    DISPLAY_WELCOME_FOOTER: true,
+    DISPLAY_WELCOME_PAGE_ADDITIONAL_CARD: false,
+    DISPLAY_WELCOME_PAGE_CONTENT: false,
+    DISPLAY_WELCOME_PAGE_TOOLBAR_ADDITIONAL_CONTENT: false,
+
+    ENABLE_DIAL_OUT: true,
+
+    ENABLE_FEEDBACK_ANIMATION: false, // Enables feedback star animation.
+
+    FILM_STRIP_MAX_HEIGHT: 120,
+
+    GENERATE_ROOMNAMES_ON_WELCOME_PAGE: true,
+
+    /**
+     * Hide the logo on the deep linking pages.
+     */
+    HIDE_DEEP_LINKING_LOGO: false,
+
+    /**
+     * Hide the invite prompt in the header when alone in the meeting.
+     */
+    HIDE_INVITE_MORE_HEADER: false,
+
+    JITSI_WATERMARK_LINK: 'https://jitsi.org',
+
+    LANG_DETECTION: true, // Allow i18n to detect the system language
    LOCAL_THUMBNAIL_RATIO: 16 / 9, // 16:9
-    REMOTE_THUMBNAIL_RATIO: 1, // 1:1
-    // Documentation reference for the live streaming feature.
-    LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live',
+
+    /**
+     * Maximum coefficient of the ratio of the large video to the visible area
+     * after the large video is scaled to fit the window.
+     *
+     * @type {number}
+     */
+    MAXIMUM_ZOOMING_COEFFICIENT: 1.3,

    /**
     * Whether the mobile app Jitsi Meet is to be promoted to participants
@ -115,44 +115,82 @@ var interfaceConfig = {
    MOBILE_APP_PROMO: true,

    /**
-     * Maximum coeficient of the ratio of the large video to the visible area
-     * after the large video is scaled to fit the window.
-     *
-     * @type {number}
+     * Specify custom URL for downloading android mobile app.
     */
-    MAXIMUM_ZOOMING_COEFFICIENT: 1.3,
+    MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
+
+    /**
+     * Specify custom URL for downloading f droid app.
+     */
+    MOBILE_DOWNLOAD_LINK_F_DROID: 'https://f-droid.org/en/packages/org.jitsi.meet/',
+
+    /**
+     * Specify URL for downloading ios mobile app.
+     */
+    MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
+
+    NATIVE_APP_NAME: 'Jitsi Meet',
+
+    // Names of browsers which should show a warning stating the current browser
+    // has a suboptimal experience. Browsers which are not listed as optimal or
+    // unsupported are considered suboptimal. Valid values are:
+    // chrome, chromium, edge, electron, firefox, nwjs, opera, safari
+    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'firefox', 'nwjs', 'electron', 'safari' ],
+
+    POLICY_LOGO: null,
+    PROVIDER_NAME: 'Jitsi',
+
+    /**
+     * If true, will display recent list
+     *
+     * @type {boolean}
+     */
+    RECENT_LIST_ENABLED: true,
+    REMOTE_THUMBNAIL_RATIO: 1, // 1:1
+
+    SETTINGS_SECTIONS: [ 'devices', 'language', 'moderator', 'profile', 'calendar', 'sounds', 'more' ],
+
+    /**
+     * Specify which sharing features should be displayed. If the value is not set
+     * all sharing features will be shown. You can set [] to disable all.
+     */
+    // SHARING_FEATURES: ['email', 'url', 'dial-in', 'embed'],
+
+    SHOW_BRAND_WATERMARK: false,
+
+    /**
+     * Decides whether the chrome extension banner should be rendered on the landing page and during the meeting.
+     * If this is set to false, the banner will not be rendered at all. If set to true, the check for extension(s)
+     * being already installed is done before rendering.
+     */
+    SHOW_CHROME_EXTENSION_BANNER: false,
+
+    SHOW_DEEP_LINKING_IMAGE: false,
+    SHOW_JITSI_WATERMARK: false,
+    SHOW_POWERED_BY: false,
+    SHOW_PROMOTIONAL_CLOSE_PAGE: false,

    /*
     * If indicated some of the error dialogs may point to the support URL for
     * help.
     */
-    SUPPORT_URL: 'https://github.com/jitsi/jitsi-meet/issues/new',
+    SUPPORT_URL: 'https://community.jitsi.org/',
+
+    // Browsers, in addition to those which do not fully support WebRTC, that
+    // are not supported and should show the unsupported browser page.
+    UNSUPPORTED_BROWSERS: [],

    /**
-     * Whether the connection indicator icon should hide itself based on
-     * connection strength. If true, the connection indicator will remain
-     * displayed while the participant has a weak connection and will hide
-     * itself after the CONNECTION_INDICATOR_HIDE_TIMEOUT when the connection is
-     * strong.
-     *
-     * @type {boolean}
+     * Whether to show thumbnails in filmstrip as a column instead of as a row.
     */
-    CONNECTION_INDICATOR_AUTO_HIDE_ENABLED: true,
+    VERTICAL_FILMSTRIP: true,

-    /**
-     * How long the connection indicator should remain displayed before hiding.
-     * Used in conjunction with CONNECTION_INDICATOR_AUTOHIDE_ENABLED.
-     *
-     * @type {number}
-     */
-    CONNECTION_INDICATOR_AUTO_HIDE_TIMEOUT: 5000,
-
-    /**
-     * If true, hides the connection indicators completely.
-     *
-     * @type {boolean}
-     */
-    CONNECTION_INDICATOR_DISABLED: false,
+    // Determines how the video would fit the screen. 'both' would fit the whole
+    // screen, 'height' would fit the original video height to the height of the
+    // screen, 'width' would fit the original video width to the width of the
+    // screen respecting ratio, 'nocrop' would make the video as large as
+    // possible and preserve aspect ratio without cropping.
+    VIDEO_LAYOUT_FIT: 'both',

    /**
     * If true, hides the video quality label indicating the resolution status
@ -162,33 +200,6 @@ var interfaceConfig = {
     */
    VIDEO_QUALITY_LABEL_DISABLED: false,

-    /**
-     * If true, will display recent list
-     *
-     * @type {boolean}
-     */
-    RECENT_LIST_ENABLED: true,
-
-    // Names of browsers which should show a warning stating the current browser
-    // has a suboptimal experience. Browsers which are not listed as optimal or
-    // unsupported are considered suboptimal. Valid values are:
-    // chrome, chromium, edge, electron, firefox, nwjs, opera, safari
-    OPTIMAL_BROWSERS: [ 'chrome', 'chromium', 'nwjs', 'electron' ],
-
-    // Browsers, in addition to those which do not fully support WebRTC, that
-    // are not supported and should show the unsupported browser page.
-    UNSUPPORTED_BROWSERS: [],
-
-    /**
-     * A UX mode where the last screen share participant is automatically
-     * pinned. Valid values are the string "remote-only" so remote participants
-     * get pinned but not local, otherwise any truthy value for all participants,
-     * and any falsy value to disable the feature.
-     *
-     * Note: this mode is experimental and subject to breakage.
-     */
-    AUTO_PIN_LATEST_SCREEN_SHARE: 'remote-only'
-
    /**
     * How many columns the tile view can expand to. The respected range is
     * between 1 and 5.
@ -196,14 +207,15 @@ var interfaceConfig = {
    // TILE_VIEW_MAX_COLUMNS: 5,

    /**
-     * Specify custom URL for downloading android mobile app.
+     * Specify Firebase dynamic link properties for the mobile apps.
     */
-    // MOBILE_DOWNLOAD_LINK_ANDROID: 'https://play.google.com/store/apps/details?id=org.jitsi.meet',
-
-    /**
-     * Specify URL for downloading ios mobile app.
-     */
-    // MOBILE_DOWNLOAD_LINK_IOS: 'https://itunes.apple.com/us/app/jitsi-meet/id1165103905',
+    // MOBILE_DYNAMIC_LINK: {
+    //    APN: 'org.jitsi.meet',
+    //    APP_CODE: 'w2atb',
+    //    CUSTOM_DOMAIN: undefined,
+    //    IBI: 'com.atlassian.JitsiMeet.ios',
+    //    ISI: '1165103905'
+    // },

    /**
     * Specify mobile app scheme for opening the app from the mobile browser.
@ -215,12 +227,50 @@ var interfaceConfig = {
     */
    // ANDROID_APP_PACKAGE: 'org.jitsi.meet',

+    // List of undocumented settings
    /**
-     * Override the behavior of some notifications to remain displayed until
-     * explicitly dismissed through a user action. The value is how long, in
-     * milliseconds, those notifications should remain displayed.
-     */
-    // ENFORCE_NOTIFICATION_AUTO_DISMISS_TIMEOUT: 15000,
+     INDICATOR_FONT_SIZES
+     PHONE_NUMBER_REGEX
+    */
+
+    // -----------------DEPRECATED CONFIGS BELOW THIS LINE-----------------------------
+
+    // Connection indicators (
+    // CONNECTION_INDICATOR_AUTO_HIDE_ENABLED,
+    // CONNECTION_INDICATOR_AUTO_HIDE_TIMEOUT,
+    // CONNECTION_INDICATOR_DISABLED) got moved to config.js.
+
+    // Please use disableModeratorIndicator from config.js
+    // DISABLE_FOCUS_INDICATOR: false,
+
+    // Please use defaultLocalDisplayName from config.js
+    // DEFAULT_LOCAL_DISPLAY_NAME: 'me',
+
+    // Please use defaultRemoteDisplayName from config.js
+    // DEFAULT_REMOTE_DISPLAY_NAME: 'Fellow Jitster',
+
+    // Moved to config.js as `toolbarConfig.initialTimeout`.
+    // INITIAL_TOOLBAR_TIMEOUT: 20000,
+
+    // Please use `liveStreaming.helpLink` from config.js
+    // Documentation reference for the live streaming feature.
+    // LIVE_STREAMING_HELP_LINK: 'https://jitsi.org/live',
+
+    // Moved to config.js as `toolbarConfig.alwaysVisible`.
+    // TOOLBAR_ALWAYS_VISIBLE: false,
+
+    // This config was moved to config.js as `toolbarButtons`.
+    // TOOLBAR_BUTTONS: [],
+
+    // Moved to config.js as `toolbarConfig.timeout`.
+    // TOOLBAR_TIMEOUT: 4000,
+
+    // Allow all above example options to include a trailing comma and
+    // prevent fear when commenting out the last value.
+    // eslint-disable-next-line sort-keys
+    makeJsonParserHappy: 'even if last key had a trailing comma'
+
+    // No configuration value should follow this line.
 };

 /* eslint-enable no-unused-vars, no-var, max-len */
--- a/playbooks/roles/jitsi-meet/files/jitsi-meet-docker/jvb-docker-compose.yaml
+++ b/playbooks/roles/jitsi-meet/files/jitsi-meet-docker/jvb-docker-compose.yaml
@ -1,12 +1,13 @@
-# Based on https://github.com/jitsi/docker-jitsi-meet/blob/df404476160526d8512fb23b606965b98f7f25f3/docker-compose.yml
+# Based on https://github.com/jitsi/docker-jitsi-meet/blob/stable-7648-4/docker-compose.yml
 # Licensed under the ASL v2.

-version: '2'
+version: '3.5'

 services:
    # Video bridge
    jvb:
-        image: docker.io/jitsi/jvb
+        image: docker.io/jitsi/jvb:stable
+        restart: ${RESTART_POLICY:-unless-stopped}
        network_mode: host
        volumes:
            - ${CONFIG}/jvb:/config
--- a/playbooks/roles/jitsi-meet/files/jitsi-meet-docker/meet-docker-compose.yaml
+++ b/playbooks/roles/jitsi-meet/files/jitsi-meet-docker/meet-docker-compose.yaml
@ -1,12 +1,13 @@
-# Based on https://github.com/jitsi/docker-jitsi-meet/blob/df404476160526d8512fb23b606965b98f7f25f3/docker-compose.yml
+# Based on https://github.com/jitsi/docker-jitsi-meet/blob/stable-7648-4/docker-compose.yml
 # Licensed under the ASL v2.

-version: '2'
+version: '3.5'

 services:
    # Frontend
    web:
-        image: docker.io/jitsi/web
+        image: docker.io/jitsi/web:stable
+        restart: ${RESTART_POLICY:-unless-stopped}
        network_mode: host
        volumes:
            - ${CONFIG}/web:/config
@ -41,12 +42,13 @@ services:
            - JIBRI_RECORDER_USER
            - JIBRI_RECORDER_PASSWORD
            - ENABLE_RECORDING
-            - START_VIDEO_MUTED
-            - START_AUDIO_MUTED
+            - START_WITH_AUDIO_MUTED
+            - START_WITH_VIDEO_MUTED

    # XMPP server
    prosody:
-        image: docker.io/jitsi/prosody
+        image: docker.io/jitsi/prosody:stable
+        restart: ${RESTART_POLICY:-unless-stopped}
        network_mode: host
        volumes:
            - ${CONFIG}/prosody:/config
@ -103,7 +105,8 @@ services:

    # Focus component
    jicofo:
-        image: docker.io/jitsi/jicofo
+        image: docker.io/jitsi/jicofo:stable
+        restart: ${RESTART_POLICY:-unless-stopped}
        network_mode: host
        volumes:
            - ${CONFIG}/jicofo:/config
@ -127,7 +130,8 @@ services:

    # Video bridge
    jvb:
-        image: docker.io/jitsi/jvb
+        image: docker.io/jitsi/jvb:stable
+        restart: ${RESTART_POLICY:-unless-stopped}
        network_mode: host
        volumes:
            - ${CONFIG}/jvb:/config
--- a/playbooks/roles/jitsi-meet/files/meet.conf
+++ b/playbooks/roles/jitsi-meet/files/meet.conf
@ -1,4 +1,13 @@
+# Unchanged copy of
+# https://github.com/jitsi/docker-jitsi-meet/blob/stable-7648-4/web/rootfs/defaults/meet.conf
+# Licensed under the ASL v2.
+
+{{ $ENABLE_COLIBRI_WEBSOCKET := .Env.ENABLE_COLIBRI_WEBSOCKET | default "1" | toBool }}
+{{ $ENABLE_JAAS_COMPONENTS := .Env.ENABLE_JAAS_COMPONENTS | default "0" | toBool }}
 {{ $ENABLE_XMPP_WEBSOCKET := .Env.ENABLE_XMPP_WEBSOCKET | default "1" | toBool }}
+{{ $ENABLE_SUBDOMAINS := .Env.ENABLE_SUBDOMAINS | default "true" | toBool -}}
+{{ $XMPP_DOMAIN := .Env.XMPP_DOMAIN | default "meet.jitsi" -}}
+{{ $XMPP_BOSH_URL_BASE := .Env.XMPP_BOSH_URL_BASE | default "http://xmpp.meet.jitsi:5280" -}}

 server_name _;

@ -17,6 +26,13 @@ error_page 404 /static/404.html;
 add_header X-Content-Type-Options nosniff;
 add_header X-XSS-Protection "1; mode=block";

+{{ if .Env.DEPLOYMENTINFO_SHARD }}
+add_header X-Jitsi-Shard {{ .Env.DEPLOYMENTINFO_SHARD }};
+{{ end }}
+
+# Opt out of FLoC (deprecated)
+add_header Permissions-Policy "interest-cohort=()";
+
 location = /config.js {
    alias /config/config.js;
 }
@ -29,41 +45,74 @@ location = /external_api.js {
    alias /usr/share/jitsi-meet/libs/external_api.min.js;
 }

+{{ if $ENABLE_JAAS_COMPONENTS }}
+location = /_api/room-info {
+    proxy_pass {{ $XMPP_BOSH_URL_BASE }}/room-info?prefix=$prefix&$args;
+    proxy_http_version 1.1;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header Host $http_host;
+}
+{{ end }}
+
 # ensure all static content can always be found first
-location ~ ^/(libs|css|static|images|fonts|lang|sounds|connection_optimization|.well-known)/(.*)$
-{
+location ~ ^/(libs|css|static|images|fonts|lang|sounds|connection_optimization|.well-known)/(.*)$ {
    add_header 'Access-Control-Allow-Origin' '*';
    alias /usr/share/jitsi-meet/$1/$2;
+
+    # cache all versioned files
+    if ($arg_v) {
+        expires 1y;
+    }
 }

+{{ if $ENABLE_COLIBRI_WEBSOCKET }}
 # colibri (JVB) websockets
-location ~ ^/colibri-ws/([a-zA-Z0-9-\.]+)/(.*) {
-    proxy_pass http://$1:9090/colibri-ws/$1/$2$is_args$args;
+location ~ ^/colibri-ws/([a-zA-Z0-9-\._]+)/(.*) {
+    tcp_nodelay on;
+
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection "upgrade";
-    tcp_nodelay on;
+    proxy_set_header Connection $connection_upgrade;
+
+    proxy_pass http://$1:9090/colibri-ws/$1/$2$is_args$args;
 }
+{{ end }}

 # BOSH
 location = /http-bind {
-    proxy_pass {{ .Env.XMPP_BOSH_URL_BASE }}/http-bind;
    proxy_set_header X-Forwarded-For $remote_addr;
-    proxy_set_header Host {{ .Env.XMPP_DOMAIN }};
+    proxy_set_header Host {{ $XMPP_DOMAIN }};
+
+    proxy_pass {{ $XMPP_BOSH_URL_BASE }}/http-bind;
 }

 {{ if $ENABLE_XMPP_WEBSOCKET }}
 # xmpp websockets
 location = /xmpp-websocket {
-    proxy_pass {{ .Env.XMPP_BOSH_URL_BASE }}/xmpp-websocket;
-    proxy_http_version 1.1;
-
-    proxy_set_header Connection "upgrade";
-    proxy_set_header Upgrade $http_upgrade;
-
-    proxy_set_header Host {{ .Env.XMPP_DOMAIN }};
-    proxy_set_header X-Forwarded-For $remote_addr;
    tcp_nodelay on;
+
+    proxy_http_version 1.1;
+    proxy_set_header Connection $connection_upgrade;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Host {{ $XMPP_DOMAIN }};
+    proxy_set_header X-Forwarded-For $remote_addr;
+
+    proxy_pass {{ $XMPP_BOSH_URL_BASE }}/xmpp-websocket;
+}
+{{ end }}
+
+{{ if .Env.ETHERPAD_URL_BASE }}
+# Etherpad-lite
+location ^~ /etherpad/ {
+    proxy_buffering off;
+    proxy_cache_bypass $http_upgrade;
+
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header X-Forwarded-For $remote_addr;
+
+    proxy_pass {{ .Env.ETHERPAD_URL_BASE }}/;
 }
 {{ end }}

@ -75,22 +124,48 @@ location @root_path {
    rewrite ^/(.*)$ / break;
 }

-{{ if .Env.ETHERPAD_URL_BASE }}
-# Etherpad-lite
-location /etherpad/ {
-    proxy_http_version 1.1;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection 'upgrade';
-    # Commented out as we want the default behavior of using
-    # $proxy_host as the Host header value
-    #proxy_set_header Host $host;
-    proxy_cache_bypass $http_upgrade;
+{{ if $ENABLE_SUBDOMAINS }}
+    location ~ ^/([^/?&:'"]+)/config.js$ {
+        set $subdomain "$1.";
+        set $subdir "$1/";

-    proxy_pass {{ .Env.ETHERPAD_URL_BASE }}/;
-    proxy_set_header X-Forwarded-For $remote_addr;
-    proxy_buffering off;
-    # Commented out as we want the default behavior of using
-    # $proxy_host as the Host header value
-    #proxy_set_header Host {{ .Env.XMPP_DOMAIN }};
-}
+        alias /config/config.js;
+    }
+
+    # BOSH for subdomains
+    location ~ ^/([^/?&:'"]+)/http-bind {
+        set $subdomain "$1.";
+        set $subdir "$1/";
+        set $prefix "$1";
+
+        rewrite ^/(.*)$ /http-bind;
+    }
+
+    {{ if $ENABLE_XMPP_WEBSOCKET }}
+    # websockets for subdomains
+    location ~ ^/([^/?&:'"]+)/xmpp-websocket {
+        set $subdomain "$1.";
+        set $subdir "$1/";
+        set $prefix "$1";
+
+        rewrite ^/(.*)$ /xmpp-websocket;
+    }
+    {{ end }}
+
+    {{ if $ENABLE_JAAS_COMPONENTS }}
+    location ~ ^/([^/?&:'"]+)/_api/room-info {
+        set $subdomain "$1.";
+        set $subdir "$1/";
+        set $prefix "$1";
+
+        rewrite ^/(.*)$ /_api/room-info;
+    }
+    {{ end }}
+
+    # Anything that didn't match above, and isn't a real file, assume it's a room name and redirect to /
+    location ~ ^/([^/?&:'"]+)/(.*)$ {
+        set $subdomain "$1.";
+        set $subdir "$1/";
+        rewrite ^/([^/?&:'"]+)/(.*)$ /$2;
+    }
 {{ end }}
--- a/playbooks/roles/jitsi-meet/files/settings-config.js
+++ b/playbooks/roles/jitsi-meet/files/settings-config.js
@ -1,40 +1,70 @@
+// Based on
+// https://github.com/jitsi/docker-jitsi-meet/blob/stable-7648-4/web/rootfs/defaults/settings-config.js
+// Licensed under the ASL v2.
+
+// Customized for OpenDev, all overrides go here (and remember to comment out
+// any defaults from the example):
+config.openSharedDocumentOnJoin = true;
+
 {{ $DEPLOYMENTINFO_USERREGION := .Env.DEPLOYMENTINFO_USERREGION | default "" -}}
-{{ $BRIDGE_CHANNEL := .Env.BRIDGE_CHANNEL | default "websocket" -}}
 {{ $ENABLE_AUDIO_PROCESSING := .Env.ENABLE_AUDIO_PROCESSING | default "true" | toBool -}}
+{{ $ENABLE_BREAKOUT_ROOMS := .Env.ENABLE_BREAKOUT_ROOMS | default "true" | toBool -}}
 {{ $ENABLE_CALENDAR := .Env.ENABLE_CALENDAR | default "false" | toBool -}}
-{{ $ENABLE_FILE_RECORDING_SERVICE := .Env.ENABLE_FILE_RECORDING_SERVICE | default "false" | toBool -}}
-{{ $ENABLE_FILE_RECORDING_SERVICE_SHARING := .Env.ENABLE_FILE_RECORDING_SERVICE_SHARING | default "false" | toBool -}}
+{{ $ENABLE_FILE_RECORDING_SHARING := .Env.ENABLE_FILE_RECORDING_SHARING | default "false" | toBool -}}
 {{ $ENABLE_IPV6 := .Env.ENABLE_IPV6 | default "true" | toBool -}}
 {{ $ENABLE_LIPSYNC := .Env.ENABLE_LIPSYNC | default "false" | toBool -}}
-{{ $ENABLE_NO_AUDIO_DETECTION := .Env.ENABLE_NO_AUDIO_DETECTION | default "false" | toBool -}}
+{{ $ENABLE_NO_AUDIO_DETECTION := .Env.ENABLE_NO_AUDIO_DETECTION | default "true" | toBool -}}
 {{ $ENABLE_P2P := .Env.ENABLE_P2P | default "true" | toBool -}}
-{{ $ENABLE_PREJOIN_PAGE := .Env.ENABLE_PREJOIN_PAGE | default "false" | toBool -}}
+{{ $ENABLE_PREJOIN_PAGE := .Env.ENABLE_PREJOIN_PAGE | default "true" | toBool -}}
 {{ $ENABLE_WELCOME_PAGE := .Env.ENABLE_WELCOME_PAGE | default "true" | toBool -}}
 {{ $ENABLE_CLOSE_PAGE := .Env.ENABLE_CLOSE_PAGE | default "false" | toBool -}}
 {{ $ENABLE_RECORDING := .Env.ENABLE_RECORDING | default "false" | toBool -}}
+{{ $ENABLE_SERVICE_RECORDING := .Env.ENABLE_SERVICE_RECORDING | default ($ENABLE_RECORDING | printf "%t") | toBool -}}
+{{ $ENABLE_LIVESTREAMING := .Env.ENABLE_LIVESTREAMING | default "false" | toBool -}}
 {{ $ENABLE_REMB := .Env.ENABLE_REMB | default "true" | toBool -}}
 {{ $ENABLE_REQUIRE_DISPLAY_NAME := .Env.ENABLE_REQUIRE_DISPLAY_NAME | default "false" | toBool -}}
 {{ $ENABLE_SIMULCAST := .Env.ENABLE_SIMULCAST | default "true" | toBool -}}
 {{ $ENABLE_STATS_ID := .Env.ENABLE_STATS_ID | default "false" | toBool -}}
 {{ $ENABLE_STEREO := .Env.ENABLE_STEREO | default "false" | toBool -}}
+{{ $ENABLE_OPUS_RED := .Env.ENABLE_OPUS_RED | default "false" | toBool -}}
 {{ $ENABLE_TALK_WHILE_MUTED := .Env.ENABLE_TALK_WHILE_MUTED | default "false" | toBool -}}
 {{ $ENABLE_TCC := .Env.ENABLE_TCC | default "true" | toBool -}}
 {{ $ENABLE_TRANSCRIPTIONS := .Env.ENABLE_TRANSCRIPTIONS | default "false" | toBool -}}
+{{ $ENABLE_JAAS_COMPONENTS := .Env.ENABLE_JAAS_COMPONENTS | default "0" | toBool }}
+{{ $ENABLE_MULTI_STREAM := .Env.ENABLE_MULTI_STREAM | default "true" | toBool }}
+{{ $HIDE_PREJOIN_DISPLAY_NAME := .Env.HIDE_PREJOIN_DISPLAY_NAME | default "false" | toBool -}}
+{{ $PUBLIC_URL := .Env.PUBLIC_URL | default "https://localhost:8443" -}}
 {{ $RESOLUTION := .Env.RESOLUTION | default "720" -}}
 {{ $RESOLUTION_MIN := .Env.RESOLUTION_MIN | default "180" -}}
 {{ $RESOLUTION_WIDTH := .Env.RESOLUTION_WIDTH | default "1280" -}}
 {{ $RESOLUTION_WIDTH_MIN := .Env.RESOLUTION_WIDTH_MIN | default "320" -}}
 {{ $START_AUDIO_ONLY := .Env.START_AUDIO_ONLY | default "false" | toBool -}}
 {{ $START_AUDIO_MUTED := .Env.START_AUDIO_MUTED | default 10 -}}
+{{ $START_WITH_AUDIO_MUTED := .Env.START_WITH_AUDIO_MUTED | default "false" | toBool -}}
+{{ $START_SILENT := .Env.START_SILENT | default "false" | toBool -}}
 {{ $DISABLE_AUDIO_LEVELS := .Env.DISABLE_AUDIO_LEVELS | default "false" | toBool -}}
 {{ $ENABLE_NOISY_MIC_DETECTION := .Env.ENABLE_NOISY_MIC_DETECTION | default "true" | toBool -}}
 {{ $START_VIDEO_MUTED := .Env.START_VIDEO_MUTED | default 10 -}}
+{{ $START_WITH_VIDEO_MUTED := .Env.START_WITH_VIDEO_MUTED | default "false" | toBool -}}
 {{ $DESKTOP_SHARING_FRAMERATE_MIN := .Env.DESKTOP_SHARING_FRAMERATE_MIN | default 5 -}}
 {{ $DESKTOP_SHARING_FRAMERATE_MAX := .Env.DESKTOP_SHARING_FRAMERATE_MAX | default 5 -}}
 {{ $TESTING_OCTO_PROBABILITY := .Env.TESTING_OCTO_PROBABILITY | default "0" -}}
 {{ $TESTING_CAP_SCREENSHARE_BITRATE := .Env.TESTING_CAP_SCREENSHARE_BITRATE | default "1" -}}
-{{ $XMPP_DOMAIN := .Env.XMPP_DOMAIN -}}
-{{ $XMPP_RECORDER_DOMAIN := .Env.XMPP_RECORDER_DOMAIN -}}
+{{ $XMPP_DOMAIN := .Env.XMPP_DOMAIN | default "meet.jitsi" -}}
+{{ $XMPP_RECORDER_DOMAIN := .Env.XMPP_RECORDER_DOMAIN | default "recorder.meet.jitsi" -}}
+{{ $DISABLE_DEEP_LINKING  := .Env.DISABLE_DEEP_LINKING | default "false" | toBool -}}
+{{ $VIDEOQUALITY_ENFORCE_PREFERRED_CODEC := .Env.VIDEOQUALITY_ENFORCE_PREFERRED_CODEC | default "false" | toBool -}}
+{{ $DISABLE_POLLS := .Env.DISABLE_POLLS | default "false" | toBool -}}
+{{ $DISABLE_REACTIONS := .Env.DISABLE_REACTIONS | default "false" | toBool -}}
+{{ $DISABLE_REMOTE_VIDEO_MENU := .Env.DISABLE_REMOTE_VIDEO_MENU | default "false" | toBool -}}
+{{ $DISABLE_PRIVATE_CHAT:= .Env.DISABLE_PRIVATE_CHAT | default "false" | toBool -}}
+{{ $DISABLE_KICKOUT := .Env.DISABLE_KICKOUT | default "false" | toBool -}}
+{{ $DISABLE_GRANT_MODERATOR := .Env.DISABLE_GRANT_MODERATOR | default "false" | toBool -}}
+{{ $ENABLE_E2EPING := .Env.ENABLE_E2EPING | default "false" | toBool -}}
+{{ $DISABLE_LOCAL_RECORDING := .Env.DISABLE_LOCAL_RECORDING | default "false" | toBool -}}
+{{ $ENABLE_LOCAL_RECORDING_NOTIFY_ALL_PARTICIPANT := .Env.ENABLE_LOCAL_RECORDING_NOTIFY_ALL_PARTICIPANT | default "false" | toBool -}}
+{{ $ENABLE_LOCAL_RECORDING_SELF_START := .Env.ENABLE_LOCAL_RECORDING_SELF_START | default "false" | toBool -}}
+{{ $DISABLE_PROFILE := .Env.DISABLE_PROFILE | default "false" | toBool -}}


 // Video configuration.
@ -48,13 +78,21 @@ config.constraints.video.height = { ideal: {{ $RESOLUTION }}, max: {{ $RESOLUTIO
 config.constraints.video.width = { ideal: {{ $RESOLUTION_WIDTH }}, max: {{ $RESOLUTION_WIDTH }}, min: {{ $RESOLUTION_WIDTH_MIN }}};
 config.disableSimulcast = {{ not $ENABLE_SIMULCAST }};
 config.startVideoMuted = {{ $START_VIDEO_MUTED }};
+config.startWithVideoMuted = {{ $START_WITH_VIDEO_MUTED }};

 {{ if .Env.START_BITRATE -}}
 config.startBitrate = '{{ .Env.START_BITRATE }}';
 {{ end -}}
- 
+
+if (!config.hasOwnProperty('flags')) config.flags = {};
+config.flags.sourceNameSignaling = {{ $ENABLE_MULTI_STREAM }};
+config.flags.sendMultipleVideoStreams = {{ $ENABLE_MULTI_STREAM }};
+config.flags.receiveMultipleVideoStreams = {{ $ENABLE_MULTI_STREAM }};
+
+
 // ScreenShare Configuration.
 //
+
 config.desktopSharingFrameRate = { min: {{ $DESKTOP_SHARING_FRAMERATE_MIN }}, max: {{ $DESKTOP_SHARING_FRAMERATE_MAX }} };

 // Audio configuration.
@ -63,9 +101,19 @@ config.desktopSharingFrameRate = { min: {{ $DESKTOP_SHARING_FRAMERATE_MIN }}, ma
 config.enableNoAudioDetection = {{ $ENABLE_NO_AUDIO_DETECTION }};
 config.enableTalkWhileMuted = {{ $ENABLE_TALK_WHILE_MUTED }};
 config.disableAP = {{ not $ENABLE_AUDIO_PROCESSING }};
-config.stereo = {{ $ENABLE_STEREO }};
+
+if (!config.hasOwnProperty('audioQuality')) config.audioQuality = {};
+config.audioQuality.stereo = {{ $ENABLE_STEREO }};
+
+{{ if .Env.AUDIO_QUALITY_OPUS_BITRATE -}}
+config.audioQuality.opusMaxAverageBitrate = '{{ .Env.AUDIO_QUALITY_OPUS_BITRATE }}';
+{{ end -}}
+
 config.startAudioOnly = {{ $START_AUDIO_ONLY }};
 config.startAudioMuted = {{ $START_AUDIO_MUTED }};
+config.startWithAudioMuted = {{ $START_WITH_AUDIO_MUTED }};
+config.startSilent = {{ $START_SILENT }};
+config.enableOpusRed = {{ $ENABLE_OPUS_RED }};
 config.disableAudioLevels = {{ $DISABLE_AUDIO_LEVELS }};
 config.enableNoisyMicDetection = {{ $ENABLE_NOISY_MIC_DETECTION }};

@ -78,31 +126,35 @@ if (!config.hasOwnProperty('p2p')) config.p2p = {};
 config.p2p.enabled = {{ $ENABLE_P2P }};


+// Breakout Rooms
+//
+
+config.hideAddRoomButton = {{ $ENABLE_BREAKOUT_ROOMS | not }};
+
+
 // Etherpad
 //

 {{ if .Env.ETHERPAD_PUBLIC_URL -}}
 config.etherpad_base = '{{ .Env.ETHERPAD_PUBLIC_URL }}';
 {{ else if .Env.ETHERPAD_URL_BASE -}}
-config.etherpad_base = '{{.Env.PUBLIC_URL}}/etherpad/p/';
+config.etherpad_base = '{{ $PUBLIC_URL }}/etherpad/p/';
 {{ end -}}

-config.useRoomAsSharedDocumentName = true;
-config.openSharedDocumentOnJoin = true;
-
-
 // Recording.
 //

-{{ if $ENABLE_RECORDING -}}
+{{ if $ENABLE_RECORDING  -}}

 config.hiddenDomain = '{{ $XMPP_RECORDER_DOMAIN }}';

-// Whether to enable file recording or not
-config.fileRecordingsEnabled = true;
+if (!config.hasOwnProperty('recordingService')) config.recordingService = {};
+
+// Whether to enable file recording or not using the "service" defined by the finalizer in Jibri
+config.recordingService.enabled = {{ $ENABLE_SERVICE_RECORDING }};

 // Whether to enable live streaming or not.
-config.liveStreamingEnabled = true;
+config.liveStreamingEnabled = {{ $ENABLE_LIVESTREAMING }};

 {{ if .Env.DROPBOX_APPKEY -}}
 // Enable the dropbox integration.
@ -116,22 +168,20 @@ config.dropbox.redirectURI = '{{ .Env.DROPBOX_REDIRECT_URI }}';
 {{ end -}}
 {{ end -}}

-{{ if $ENABLE_FILE_RECORDING_SERVICE -}}
-// When integrations like dropbox are enabled only that will be shown,
-// by enabling fileRecordingsServiceEnabled, we show both the integrations
-// and the generic recording service (its configuration and storage type
-// depends on jibri configuration)
-config.fileRecordingsServiceEnabled = true;
-{{ end -}}
-{{ if $ENABLE_FILE_RECORDING_SERVICE_SHARING -}}
 // Whether to show the possibility to share file recording with other people
 // (e.g. meeting participants), based on the actual implementation
 // on the backend.
-config.fileRecordingsServiceSharingEnabled = true;
-{{ end -}}
+config.recordingService.sharingEnabled = {{ $ENABLE_FILE_RECORDING_SHARING }};
 {{ end -}}


+// Local recording configuration.
+if (!config.hasOwnProperty('localRecording')) config.localRecording = {};
+config.localRecording.disable = {{ $DISABLE_LOCAL_RECORDING }};
+config.localRecording.notifyAllParticipants = {{ $ENABLE_LOCAL_RECORDING_NOTIFY_ALL_PARTICIPANT }};
+config.localRecording.disableSelfRecording = {{ $ENABLE_LOCAL_RECORDING_SELF_START }};
+
+
 // Analytics.
 //

@ -188,13 +238,17 @@ config.enableStatsID = {{ $ENABLE_STATS_ID }};
 // Dial in/out services.
 //

+{{ if $ENABLE_JAAS_COMPONENTS }}
+config.dialInConfCodeUrl = 'https://conference-mapper.jitsi.net/v1/access';
+config.dialInNumbersUrl = 'https://conference-mapper.jitsi.net/v1/access/dids';
+{{ else }}
 {{ if .Env.CONFCODE_URL -}}
 config.dialInConfCodeUrl = '{{ .Env.CONFCODE_URL }}';
 {{ end -}}
-
 {{ if .Env.DIALIN_NUMBERS_URL -}}
 config.dialInNumbersUrl = '{{ .Env.DIALIN_NUMBERS_URL }}';
 {{ end -}}
+{{ end -}}

 {{ if .Env.DIALOUT_AUTH_URL -}}
 config.dialOutAuthUrl = '{{ .Env.DIALOUT_AUTH_URL }}';
@ -236,7 +290,16 @@ config.peopleSearchQueryTypes = ['user','conferenceRooms'];
 //

 // Prejoin page.
-config.prejoinPageEnabled = {{ $ENABLE_PREJOIN_PAGE }};
+if (!config.hasOwnProperty('prejoinConfig')) config.prejoinConfig = {};
+config.prejoinConfig.enabled = {{ $ENABLE_PREJOIN_PAGE }};
+
+// Hides the participant name editing field in the prejoin screen.
+config.prejoinConfig.hideDisplayName = {{ $HIDE_PREJOIN_DISPLAY_NAME }};
+
+// List of buttons to hide from the extra join options dropdown on prejoin screen.
+{{ if .Env.HIDE_PREJOIN_EXTRA_BUTTONS -}}
+config.prejoinConfig.hideExtraJoinButtons = [ '{{ join "','" (splitList "," .Env.HIDE_PREJOIN_EXTRA_BUTTONS) }}' ];
+{{ end -}}

 // Welcome page.
 config.enableWelcomePage = {{ $ENABLE_WELCOME_PAGE }};
@ -244,14 +307,22 @@ config.enableWelcomePage = {{ $ENABLE_WELCOME_PAGE }};
 // Close page.
 config.enableClosePage = {{ $ENABLE_CLOSE_PAGE }};

+// Default language.
+{{ if .Env.DEFAULT_LANGUAGE -}}
+config.defaultLanguage = '{{ .Env.DEFAULT_LANGUAGE }}';
+{{ end -}}
+
 // Require users to always specify a display name.
 config.requireDisplayName = {{ $ENABLE_REQUIRE_DISPLAY_NAME }};

+
 // Chrome extension banner.
 {{ if .Env.CHROME_EXTENSION_BANNER_JSON -}}
 config.chromeExtensionBanner = {{ .Env.CHROME_EXTENSION_BANNER_JSON }};
 {{ end -}}

+// Disables profile and the edit of all fields from the profile settings (display name and email)
+config.disableProfile = {{ $DISABLE_PROFILE }};

 // Advanced.
 //
@ -262,8 +333,6 @@ config.enableLipSync = {{ $ENABLE_LIPSYNC }};
 config.enableRemb = {{ $ENABLE_REMB }};
 config.enableTcc = {{ $ENABLE_TCC }};

-config.openBridgeChannel = '{{ $BRIDGE_CHANNEL }}';
-
 // Enable IPv6 support.
 config.useIPv6 = {{ $ENABLE_IPV6 }};

@ -273,6 +342,8 @@ config.transcribingEnabled = {{ $ENABLE_TRANSCRIPTIONS }};
 {{ if .Env.DYNAMIC_BRANDING_URL -}}
 // External API url used to receive branding specific information.
 config.dynamicBrandingUrl = '{{ .Env.DYNAMIC_BRANDING_URL }}';
+{{ else if .Env.BRANDING_DATA_URL  -}}
+config.brandingDataUrl = '{{ .Env.BRANDING_DATA_URL }}';
 {{ end -}}

 {{ if .Env.TOKEN_AUTH_URL -}}
@ -290,10 +361,18 @@ if (!config.hasOwnProperty('deploymentInfo')) config.deploymentInfo = {};
 config.deploymentInfo.environment = '{{ .Env.DEPLOYMENTINFO_ENVIRONMENT }}';
 {{ end -}}

+{{ if .Env.DEPLOYMENTINFO_SHARD -}}
+config.deploymentInfo.shard = '{{ .Env.DEPLOYMENTINFO_SHARD }}';
+{{ end -}}
+
 {{ if .Env.DEPLOYMENTINFO_ENVIRONMENT_TYPE -}}
 config.deploymentInfo.envType = '{{ .Env.DEPLOYMENTINFO_ENVIRONMENT_TYPE }}';
 {{ end -}}

+{{ if .Env.DEPLOYMENTINFO_REGION -}}
+config.deploymentInfo.region = '{{ .Env.DEPLOYMENTINFO_REGION }}';
+{{ end -}}
+
 {{ if $DEPLOYMENTINFO_USERREGION -}}
 config.deploymentInfo.userRegion = '{{ $DEPLOYMENTINFO_USERREGION }}';
 {{ end -}}
@ -307,3 +386,69 @@ if (!config.testing.hasOwnProperty('octo')) config.testing.octo = {};

 config.testing.capScreenshareBitrate = {{ $TESTING_CAP_SCREENSHARE_BITRATE }};
 config.testing.octo.probability = {{ $TESTING_OCTO_PROBABILITY }};
+
+// Deep Linking
+config.disableDeepLinking = {{ $DISABLE_DEEP_LINKING }};
+
+// P2P preferred codec
+{{ if .Env.P2P_PREFERRED_CODEC -}}
+config.p2p.preferredCodec = '{{ .Env.P2P_PREFERRED_CODEC }}';
+{{ end -}}
+
+// enable preffered video Codec
+if (!config.hasOwnProperty('videoQuality')) config.videoQuality = {};
+{{ if .Env.VIDEOQUALITY_PREFERRED_CODEC -}}
+config.videoQuality.preferredCodec = '{{ .Env.VIDEOQUALITY_PREFERRED_CODEC }}';
+{{ end -}}
+
+config.videoQuality.enforcePreferredCodec = {{ $VIDEOQUALITY_ENFORCE_PREFERRED_CODEC }};
+
+if (!config.videoQuality.hasOwnProperty('maxBitratesVideo')) config.videoQuality.maxBitratesVideo = null;
+{{ if and .Env.VIDEOQUALITY_BITRATE_H264_LOW .Env.VIDEOQUALITY_BITRATE_H264_STANDARD .Env.VIDEOQUALITY_BITRATE_H264_HIGH -}}
+config.videoQuality.maxBitratesVideo = config.videoQuality.maxBitratesVideo || {}
+config.videoQuality.maxBitratesVideo.H264 = { low: {{ .Env.VIDEOQUALITY_BITRATE_H264_LOW }}, standard: {{ .Env.VIDEOQUALITY_BITRATE_H264_STANDARD }}, high: {{ .Env.VIDEOQUALITY_BITRATE_H264_HIGH }} };
+{{ end -}}
+{{ if and .Env.VIDEOQUALITY_BITRATE_VP8_LOW .Env.VIDEOQUALITY_BITRATE_VP8_STANDARD .Env.VIDEOQUALITY_BITRATE_VP8_HIGH -}}
+config.videoQuality.maxBitratesVideo = config.videoQuality.maxBitratesVideo || {}
+config.videoQuality.maxBitratesVideo.VP8 = { low: {{ .Env.VIDEOQUALITY_BITRATE_VP8_LOW }}, standard: {{ .Env.VIDEOQUALITY_BITRATE_VP8_STANDARD }}, high: {{ .Env.VIDEOQUALITY_BITRATE_VP8_HIGH }} };
+{{ end -}}
+{{ if and .Env.VIDEOQUALITY_BITRATE_VP9_LOW .Env.VIDEOQUALITY_BITRATE_VP9_STANDARD .Env.VIDEOQUALITY_BITRATE_VP9_HIGH -}}
+config.videoQuality.maxBitratesVideo = config.videoQuality.maxBitratesVideo || {}
+config.videoQuality.maxBitratesVideo.VP9 = { low: {{ .Env.VIDEOQUALITY_BITRATE_VP9_LOW }}, standard: {{ .Env.VIDEOQUALITY_BITRATE_VP9_STANDARD }}, high: {{ .Env.VIDEOQUALITY_BITRATE_VP9_HIGH }} };
+{{ end -}}
+
+ // Reactions
+config.disableReactions = {{ $DISABLE_REACTIONS }};
+
+// Polls
+config.disablePolls = {{ $DISABLE_POLLS }};
+
+// Configure toolbar buttons
+{{ if .Env.TOOLBAR_BUTTONS -}}
+config.toolbarButtons = [ '{{ join "','" (splitList "," .Env.TOOLBAR_BUTTONS) }}' ];
+{{ end -}}
+
+// Hides the buttons at pre-join screen
+{{ if .Env.HIDE_PREMEETING_BUTTONS -}}
+config.hiddenPremeetingButtons = [ '{{ join "','" (splitList "," .Env.HIDE_PREMEETING_BUTTONS) }}' ];
+{{ end -}}
+
+// Configure remote participant video menu
+if (!config.hasOwnProperty('remoteVideoMenu')) config.remoteVideoMenu = {};
+config.remoteVideoMenu.disabled = {{ $DISABLE_REMOTE_VIDEO_MENU }};
+config.remoteVideoMenu.disableKick = {{ $DISABLE_KICKOUT }};
+config.remoteVideoMenu.disableGrantModerator = {{ $DISABLE_GRANT_MODERATOR }};
+config.remoteVideoMenu.disablePrivateChat = {{ $DISABLE_PRIVATE_CHAT }};
+
+// Configure e2eping
+if (!config.hasOwnProperty('e2eping')) config.e2eping = {};
+config.e2eping.enabled = {{ $ENABLE_E2EPING }};
+{{ if .Env.E2EPING_NUM_REQUESTS -}}
+config.e2eping.numRequests = {{ .Env.E2EPING_NUM_REQUESTS }};
+{{ end -}}
+{{ if .Env.E2EPING_MAX_CONFERENCE_SIZE -}}
+config.e2eping.maxConferenceSize = {{ .Env.E2EPING_MAX_CONFERENCE_SIZE }};
+{{ end -}}
+{{ if .Env.E2EPING_MAX_MESSAGE_PER_SECOND -}}
+config.e2eping.maxMessagePerSecond = {{ .Env.E2EPING_MAX_MESSAGE_PER_SECOND }};
+{{ end }}
--- a/playbooks/roles/jitsi-meet/templates/jvb-env.j2
+++ b/playbooks/roles/jitsi-meet/templates/jvb-env.j2
@ -1,56 +1,112 @@
-# Based on https://github.com/jitsi/docker-jitsi-meet/blob/df404476160526d8512fb23b606965b98f7f25f3/env.example
+# Based on https://github.com/jitsi/docker-jitsi-meet/blob/stable-7648-4/env.example
 # Licensed under the ASL v2.

-# Customized for OpenDev:
-
-# Directory where all configuration will be stored.
+# Customized for OpenDev, all overrides go here (and remember to comment out
+# any defaults from the example):
 CONFIG=/var/jitsi-meet
+XMPP_SERVER={{ meetpad_jvb_xmpp_server }}
+XMPP_AUTH_DOMAIN=auth.localhost
+XMPP_INTERNAL_MUC_DOMAIN=internal-muc.localhost
+JVB_AUTH_PASSWORD={{ meetpad_jvb_auth_password }}
+JVB_PORT=10000

-# Directory where templates to generate configs are stored.
-DEFAULTS=/var/jitsi-meet/defaults
+# shellcheck disable=SC2034

-# System time zone.
-TZ=Etc/UTC
+################################################################################
+################################################################################
+# Welcome to the Jitsi Meet Docker setup!
+#
+# This sample .env file contains some basic options to get you started.
+# The full options reference can be found here:
+# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
+################################################################################
+################################################################################

-# Public URL for the web service.
-PUBLIC_URL=https://meetpad.opendev.org
-
-# Set etherpad-lite URL (uncomment to enable).
-ETHERPAD_URL_BASE=https://etherpad.opendev.org

 #
 # Basic configuration options
 #

-# IP address of the Docker host. See the "Running on a LAN environment" section
-# in the README.
+# Directory where all configuration will be stored
+#CONFIG=~/.jitsi-meet-cfg
+
+# Exposed HTTP port
+HTTP_PORT=8000
+
+# Exposed HTTPS port
+HTTPS_PORT=8443
+
+# System time zone
+TZ=UTC
+
+# Public URL for the web service (required)
+#PUBLIC_URL=https://meet.example.com
+
+# IP address of the Docker host
+# See the "Running behind NAT or on a LAN environment" section in the Handbook:
+# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-nat-or-on-a-lan-environment
 #DOCKER_HOST_ADDRESS=192.168.1.1

+
+#
+# JaaS Components (beta)
+# https://jaas.8x8.vc
+#
+
+# Enable JaaS Components (hosted Jigasi)
+#ENABLE_JAAS_COMPONENTS=0
+
 #
 # Let's Encrypt configuration
 #

-# Enable Let's Encrypt certificate generation.
+# Enable Let's Encrypt certificate generation
 #ENABLE_LETSENCRYPT=1

-# Domain for which to generate the certificate.
+# Domain for which to generate the certificate
 #LETSENCRYPT_DOMAIN=meet.example.com

-# E-Mail for receiving important account notifications (mandatory).
+# E-Mail for receiving important account notifications (mandatory)
 #LETSENCRYPT_EMAIL=alice@atlanta.net

+# Use the staging server (for avoiding rate limits while testing)
+#LETSENCRYPT_USE_STAGING=1
+
+
+#
+# Etherpad integration (for document sharing)
+#
+
+# Set etherpad-lite URL in docker local network (uncomment to enable)
+#ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001
+
+# Set etherpad-lite public URL, including /p/ pad path fragment (uncomment to enable)
+#ETHERPAD_PUBLIC_URL=https://etherpad.my.domain/p/
+
+# Name your etherpad instance!
+ETHERPAD_TITLE=Video Chat
+
+# The default text of a pad
+ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
+
+# Name of the skin for etherpad
+ETHERPAD_SKIN_NAME=colibris
+
+# Skin variants for etherpad
+ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
+

 #
 # Basic Jigasi configuration options (needed for SIP gateway support)
 #

-# SIP URI for incoming / outgoing calls.
+# SIP URI for incoming / outgoing calls
 #JIGASI_SIP_URI=test@sip2sip.info

 # Password for the specified SIP account as a clear text
 #JIGASI_SIP_PASSWORD=passw0rd

-# SIP server (use the SIP account domain if in doubt).
+# SIP server (use the SIP account domain if in doubt)
 #JIGASI_SIP_SERVER=sip2sip.info

 # SIP server port
@ -59,54 +115,54 @@ ETHERPAD_URL_BASE=https://etherpad.opendev.org
 # SIP server transport
 #JIGASI_SIP_TRANSPORT=UDP

+
 #
-# Authentication configuration (see README for details)
+# Authentication configuration (see handbook for details)
 #

-# Enable authentication.
+# Enable authentication
 #ENABLE_AUTH=1

-# Enable guest access.
+# Enable guest access
 #ENABLE_GUESTS=1

-# Select authentication type: internal, jwt or ldap
+# Select authentication type: internal, jwt, ldap or matrix
 #AUTH_TYPE=internal

-# JWT auuthentication
+# JWT authentication
 #

-# Application identifier.
+# Application identifier
 #JWT_APP_ID=my_jitsi_app_id

-# Application secret known only to your token.
+# Application secret known only to your token generator
 #JWT_APP_SECRET=my_jitsi_app_secret

-# (Optional) Set asap_accepted_issuers as a comma separated list.
+# (Optional) Set asap_accepted_issuers as a comma separated list
 #JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client

-# (Optional) Set asap_accepted_audiences as a comma separated list.
+# (Optional) Set asap_accepted_audiences as a comma separated list
 #JWT_ACCEPTED_AUDIENCES=my_server1,my_server2

-
 # LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page)
 #

-# LDAP url for connection.
+# LDAP url for connection
 #LDAP_URL=ldaps://ldap.domain.com/

 # LDAP base DN. Can be empty
 #LDAP_BASE=DC=example,DC=domain,DC=com

-# LDAP user DN. Do not specify this parameter for the anonymous bind.
+# LDAP user DN. Do not specify this parameter for the anonymous bind
 #LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com

-# LDAP user password. Do not specify this parameter for the anonymous bind.
+# LDAP user password. Do not specify this parameter for the anonymous bind
 #LDAP_BINDPW=LdapUserPassw0rd

 # LDAP filter. Tokens example:
-# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail.
-# %s - %s is replaced by the complete service string.
-# %r - %r is replaced by the complete realm string.
+# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail
+# %s - %s is replaced by the complete service string
+# %r - %r is replaced by the complete realm string
 #LDAP_FILTER=(sAMAccountName=%u)

 # LDAP authentication method
@ -118,16 +174,16 @@ ETHERPAD_URL_BASE=https://etherpad.opendev.org
 # LDAP TLS using
 #LDAP_USE_TLS=1

-# List of SSL/TLS ciphers to allow.
+# List of SSL/TLS ciphers to allow
 #LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC

 # Require and verify server certificate
 #LDAP_TLS_CHECK_PEER=1

-# Path to CA cert file. Used when server sertificate verify is enabled.
+# Path to CA cert file. Used when server certificate verify is enabled
 #LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt

-# Path to CA certs directory. Used when server sertificate verify is enabled.
+# Path to CA certs directory. Used when server certificate verify is enabled
 #LDAP_TLS_CACERT_DIR=/etc/ssl/certs

 # Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps://
@ -135,75 +191,36 @@ ETHERPAD_URL_BASE=https://etherpad.opendev.org


 #
-# Advanced configuration options (you generally don't need to change these)
+# Security
+#
+# Set these to strong passwords to avoid intruders from impersonating a service account
+# The service(s) won't start unless these are specified
+# Running ./gen-passwords.sh will update .env with strong passwords
+# You may skip the Jigasi and Jibri passwords if you are not using those
+# DO NOT reuse passwords
 #

-# Internal XMPP domain.
-XMPP_DOMAIN=localhost
+# XMPP password for Jicofo client connections
+#JICOFO_AUTH_PASSWORD=

-# Internal XMPP server
-XMPP_SERVER={{ meetpad_jvb_xmpp_server }}
+# XMPP password for JVB client connections
+#JVB_AUTH_PASSWORD=

-# Internal XMPP server URL
-XMPP_BOSH_URL_BASE=http://localhost:5280
+# XMPP password for Jigasi MUC client connections
+#JIGASI_XMPP_PASSWORD=

-# Internal XMPP domain for authenticated services.
-XMPP_AUTH_DOMAIN=auth.localhost
+# XMPP recorder password for Jibri client connections
+#JIBRI_RECORDER_PASSWORD=

-# XMPP domain for the MUC.
-XMPP_MUC_DOMAIN=muc.localhost
+# XMPP password for Jibri client connections
+#JIBRI_XMPP_PASSWORD=

-# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools.
-XMPP_INTERNAL_MUC_DOMAIN=internal-muc.localhost
+#
+# Docker Compose options
+#

-# XMPP domain for unauthenticated users.
-XMPP_GUEST_DOMAIN=guest.localhost
+# Container restart policy
+#RESTART_POLICY=unless-stopped

-# Custom Prosody modules for XMPP_DOMAIN (comma separated)
-XMPP_MODULES=
-
-# Custom Prosody modules for MUC component (comma separated)
-XMPP_MUC_MODULES=
-
-# Custom Prosody modules for internal MUC component (comma separated)
-XMPP_INTERNAL_MUC_MODULES=
-
-# MUC for the JVB pool.
-JVB_BREWERY_MUC=jvbbrewery
-
-# XMPP user for JVB client connections.
-JVB_AUTH_USER=jvb
-
-# XMPP password for JVB client connections.
-JVB_AUTH_PASSWORD={{ meetpad_jvb_auth_password }}
-
-# STUN servers used to discover the server's public IP.
-JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302
-
-# Media port for the Jitsi Videobridge
-JVB_PORT=10000
-
-# TCP Fallback for Jitsi Videobridge for when UDP isn't available
-JVB_TCP_HARVESTER_DISABLED=true
-JVB_TCP_PORT=4443
-
-# A comma separated list of APIs to enable when the JVB is started. The default is none.
-# See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information
-#JVB_ENABLE_APIS=rest,colibri
-
-# Disable HTTPS. This can be useful if TLS connections are going to be handled outside of this setup.
-#DISABLE_HTTPS=1
-
-# Redirects HTTP traffic to HTTPS. Only works with the standard HTTPS port (443).
-ENABLE_HTTP_REDIRECT=1
-
-# Participants after the Nth (value below) joining will have their video muted.
-# This should mute video for all participants who join.
-START_VIDEO_MUTED=0
-
-# Participants after the Nth (value below) joining will have their audio muted.
-# This should mute audio for all participants who join.
-START_AUDIO_MUTED=0
-
-# Disable P2P connections for meetings between two participants.
-ENABLE_P2P=false
+# Jitsi image version (useful for local development)
+#JITSI_IMAGE_VERSION=latest
--- a/playbooks/roles/jitsi-meet/templates/meet-env.j2
+++ b/playbooks/roles/jitsi-meet/templates/meet-env.j2
@ -1,56 +1,130 @@
-# Based on https://github.com/jitsi/docker-jitsi-meet/blob/df404476160526d8512fb23b606965b98f7f25f3/env.example
+# Based on https://github.com/jitsi/docker-jitsi-meet/blob/stable-7648-4/env.example
 # Licensed under the ASL v2.

-# Customized for OpenDev:
-
-# Directory where all configuration will be stored.
+# Customized for OpenDev, all overrides go here (and remember to comment out
+# any defaults from the example):
 CONFIG=/var/jitsi-meet
-
-# Directory where templates to generate configs are stored.
 DEFAULTS=/var/jitsi-meet/defaults
-
-# System time zone.
-TZ=Etc/UTC
-
-# Public URL for the web service.
 PUBLIC_URL=https://meetpad.opendev.org
-
-# Set etherpad-lite URL (uncomment to enable).
 ETHERPAD_URL_BASE=https://etherpad.opendev.org
+ENABLE_XMPP_WEBSOCKET=0
+XMPP_DOMAIN=localhost
+XMPP_SERVER=localhost
+XMPP_BOSH_URL_BASE=http://localhost:5280
+XMPP_AUTH_DOMAIN=auth.localhost
+XMPP_MUC_DOMAIN=muc.localhost
+XMPP_INTERNAL_MUC_DOMAIN=internal-muc.localhost
+XMPP_GUEST_DOMAIN=guest.localhost
+JVB_AUTH_PASSWORD={{ meetpad_jvb_auth_password }}
+JVB_PORT=10000
+JICOFO_COMPONENT_SECRET={{ meetpad_jicofo_component_secret }}
+JICOFO_AUTH_PASSWORD={{ meetpad_jicofo_auth_password }}
+JIGASI_XMPP_PASSWORD={{ meetpad_jigasi_xmpp_password }}
+XMPP_RECORDER_DOMAIN=recorder.localhost
+JIBRI_RECORDER_PASSWORD={{ meetpad_jibri_recorder_password }}
+JIBRI_XMPP_PASSWORD={{ meetpad_jibri_xmpp_password }}
+ENABLE_HTTP_REDIRECT=1
+START_WITH_AUDIO_MUTED=true
+START_WITH_VIDEO_MUTED=true
+ENABLE_P2P=false
+
+# shellcheck disable=SC2034
+
+################################################################################
+################################################################################
+# Welcome to the Jitsi Meet Docker setup!
+#
+# This sample .env file contains some basic options to get you started.
+# The full options reference can be found here:
+# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker
+################################################################################
+################################################################################
+

 #
 # Basic configuration options
 #

-# IP address of the Docker host. See the "Running on a LAN environment" section
-# in the README.
+# Directory where all configuration will be stored
+#CONFIG=~/.jitsi-meet-cfg
+
+# Exposed HTTP port
+HTTP_PORT=8000
+
+# Exposed HTTPS port
+HTTPS_PORT=8443
+
+# System time zone
+TZ=UTC
+
+# Public URL for the web service (required)
+#PUBLIC_URL=https://meet.example.com
+
+# IP address of the Docker host
+# See the "Running behind NAT or on a LAN environment" section in the Handbook:
+# https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#running-behind-nat-or-on-a-lan-environment
 #DOCKER_HOST_ADDRESS=192.168.1.1

+
+#
+# JaaS Components (beta)
+# https://jaas.8x8.vc
+#
+
+# Enable JaaS Components (hosted Jigasi)
+#ENABLE_JAAS_COMPONENTS=0
+
 #
 # Let's Encrypt configuration
 #

-# Enable Let's Encrypt certificate generation.
+# Enable Let's Encrypt certificate generation
 #ENABLE_LETSENCRYPT=1

-# Domain for which to generate the certificate.
+# Domain for which to generate the certificate
 #LETSENCRYPT_DOMAIN=meet.example.com

-# E-Mail for receiving important account notifications (mandatory).
+# E-Mail for receiving important account notifications (mandatory)
 #LETSENCRYPT_EMAIL=alice@atlanta.net

+# Use the staging server (for avoiding rate limits while testing)
+#LETSENCRYPT_USE_STAGING=1
+
+
+#
+# Etherpad integration (for document sharing)
+#
+
+# Set etherpad-lite URL in docker local network (uncomment to enable)
+#ETHERPAD_URL_BASE=http://etherpad.meet.jitsi:9001
+
+# Set etherpad-lite public URL, including /p/ pad path fragment (uncomment to enable)
+#ETHERPAD_PUBLIC_URL=https://etherpad.my.domain/p/
+
+# Name your etherpad instance!
+ETHERPAD_TITLE=Video Chat
+
+# The default text of a pad
+ETHERPAD_DEFAULT_PAD_TEXT="Welcome to Web Chat!\n\n"
+
+# Name of the skin for etherpad
+ETHERPAD_SKIN_NAME=colibris
+
+# Skin variants for etherpad
+ETHERPAD_SKIN_VARIANTS="super-light-toolbar super-light-editor light-background full-width-editor"
+

 #
 # Basic Jigasi configuration options (needed for SIP gateway support)
 #

-# SIP URI for incoming / outgoing calls.
+# SIP URI for incoming / outgoing calls
 #JIGASI_SIP_URI=test@sip2sip.info

 # Password for the specified SIP account as a clear text
 #JIGASI_SIP_PASSWORD=passw0rd

-# SIP server (use the SIP account domain if in doubt).
+# SIP server (use the SIP account domain if in doubt)
 #JIGASI_SIP_SERVER=sip2sip.info

 # SIP server port
@ -59,54 +133,54 @@ ETHERPAD_URL_BASE=https://etherpad.opendev.org
 # SIP server transport
 #JIGASI_SIP_TRANSPORT=UDP

+
 #
-# Authentication configuration (see README for details)
+# Authentication configuration (see handbook for details)
 #

-# Enable authentication.
+# Enable authentication
 #ENABLE_AUTH=1

-# Enable guest access.
+# Enable guest access
 #ENABLE_GUESTS=1

-# Select authentication type: internal, jwt or ldap
+# Select authentication type: internal, jwt, ldap or matrix
 #AUTH_TYPE=internal

-# JWT auuthentication
+# JWT authentication
 #

-# Application identifier.
+# Application identifier
 #JWT_APP_ID=my_jitsi_app_id

-# Application secret known only to your token.
+# Application secret known only to your token generator
 #JWT_APP_SECRET=my_jitsi_app_secret

-# (Optional) Set asap_accepted_issuers as a comma separated list.
+# (Optional) Set asap_accepted_issuers as a comma separated list
 #JWT_ACCEPTED_ISSUERS=my_web_client,my_app_client

-# (Optional) Set asap_accepted_audiences as a comma separated list.
+# (Optional) Set asap_accepted_audiences as a comma separated list
 #JWT_ACCEPTED_AUDIENCES=my_server1,my_server2

-
 # LDAP authentication (for more information see the Cyrus SASL saslauthd.conf man page)
 #

-# LDAP url for connection.
+# LDAP url for connection
 #LDAP_URL=ldaps://ldap.domain.com/

 # LDAP base DN. Can be empty
 #LDAP_BASE=DC=example,DC=domain,DC=com

-# LDAP user DN. Do not specify this parameter for the anonymous bind.
+# LDAP user DN. Do not specify this parameter for the anonymous bind
 #LDAP_BINDDN=CN=binduser,OU=users,DC=example,DC=domain,DC=com

-# LDAP user password. Do not specify this parameter for the anonymous bind.
+# LDAP user password. Do not specify this parameter for the anonymous bind
 #LDAP_BINDPW=LdapUserPassw0rd

 # LDAP filter. Tokens example:
-# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail.
-# %s - %s is replaced by the complete service string.
-# %r - %r is replaced by the complete realm string.
+# %1-9 - if the input key is user@mail.domain.com, then %1 is com, %2 is domain and %3 is mail
+# %s - %s is replaced by the complete service string
+# %r - %r is replaced by the complete realm string
 #LDAP_FILTER=(sAMAccountName=%u)

 # LDAP authentication method
@ -118,16 +192,16 @@ ETHERPAD_URL_BASE=https://etherpad.opendev.org
 # LDAP TLS using
 #LDAP_USE_TLS=1

-# List of SSL/TLS ciphers to allow.
+# List of SSL/TLS ciphers to allow
 #LDAP_TLS_CIPHERS=SECURE256:SECURE128:!AES-128-CBC:!ARCFOUR-128:!CAMELLIA-128-CBC:!3DES-CBC:!CAMELLIA-128-CBC

 # Require and verify server certificate
 #LDAP_TLS_CHECK_PEER=1

-# Path to CA cert file. Used when server sertificate verify is enabled.
+# Path to CA cert file. Used when server certificate verify is enabled
 #LDAP_TLS_CACERT_FILE=/etc/ssl/certs/ca-certificates.crt

-# Path to CA certs directory. Used when server sertificate verify is enabled.
+# Path to CA certs directory. Used when server certificate verify is enabled
 #LDAP_TLS_CACERT_DIR=/etc/ssl/certs

 # Wether to use starttls, implies LDAPv3 and requires ldap:// instead of ldaps://
@ -135,180 +209,36 @@ ETHERPAD_URL_BASE=https://etherpad.opendev.org


 #
-# Advanced configuration options (you generally don't need to change these)
+# Security
+#
+# Set these to strong passwords to avoid intruders from impersonating a service account
+# The service(s) won't start unless these are specified
+# Running ./gen-passwords.sh will update .env with strong passwords
+# You may skip the Jigasi and Jibri passwords if you are not using those
+# DO NOT reuse passwords
 #

-# Needed to make newer jitsi meet happy. Testing with this set to 1 results
-# in "You have been disconnected" client errors. Need to do more investigating
-# into how this is meant to work.
-ENABLE_XMPP_WEBSOCKET=0
+# XMPP password for Jicofo client connections
+#JICOFO_AUTH_PASSWORD=

-# Internal XMPP domain.
-XMPP_DOMAIN=localhost
+# XMPP password for JVB client connections
+#JVB_AUTH_PASSWORD=

-# Internal XMPP server
-XMPP_SERVER=localhost
+# XMPP password for Jigasi MUC client connections
+#JIGASI_XMPP_PASSWORD=

-# Internal XMPP server URL
-XMPP_BOSH_URL_BASE=http://localhost:5280
+# XMPP recorder password for Jibri client connections
+#JIBRI_RECORDER_PASSWORD=

-# Internal XMPP domain for authenticated services.
-XMPP_AUTH_DOMAIN=auth.localhost
+# XMPP password for Jibri client connections
+#JIBRI_XMPP_PASSWORD=

-# XMPP domain for the MUC.
-XMPP_MUC_DOMAIN=muc.localhost
-
-# XMPP domain for the internal MUC used for jibri, jigasi and jvb pools.
-XMPP_INTERNAL_MUC_DOMAIN=internal-muc.localhost
-
-# XMPP domain for unauthenticated users.
-XMPP_GUEST_DOMAIN=guest.localhost
-
-# Custom Prosody modules for XMPP_DOMAIN (comma separated)
-XMPP_MODULES=
-
-# Custom Prosody modules for MUC component (comma separated)
-XMPP_MUC_MODULES=
-
-# Custom Prosody modules for internal MUC component (comma separated)
-XMPP_INTERNAL_MUC_MODULES=
-
-# MUC for the JVB pool.
-JVB_BREWERY_MUC=jvbbrewery
-
-# XMPP user for JVB client connections.
-JVB_AUTH_USER=jvb
-
-# XMPP password for JVB client connections.
-JVB_AUTH_PASSWORD={{ meetpad_jvb_auth_password }}
-
-# STUN servers used to discover the server's public IP.
-JVB_STUN_SERVERS=stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302
-
-# Media port for the Jitsi Videobridge
-JVB_PORT=10000
-
-# TCP Fallback for Jitsi Videobridge for when UDP isn't available
-JVB_TCP_HARVESTER_DISABLED=true
-JVB_TCP_PORT=4443
-
-# A comma separated list of APIs to enable when the JVB is started. The default is none.
-# See https://github.com/jitsi/jitsi-videobridge/blob/master/doc/rest.md for more information
-#JVB_ENABLE_APIS=rest,colibri
-
-# XMPP component password for Jicofo.
-JICOFO_COMPONENT_SECRET={{ meetpad_jicofo_component_secret }}
-
-# XMPP user for Jicofo client connections. NOTE: this option doesn't currently work due to a bug.
-JICOFO_AUTH_USER=focus
-
-# XMPP password for Jicofo client connections.
-JICOFO_AUTH_PASSWORD={{ meetpad_jicofo_auth_password }}
-
-# Base URL of Jicofo's reservation REST API
-#JICOFO_RESERVATION_REST_BASE_URL=http://reservation.example.com
-
-# XMPP user for Jigasi MUC client connections.
-JIGASI_XMPP_USER=jigasi
-
-# XMPP password for Jigasi MUC client connections.
-JIGASI_XMPP_PASSWORD={{ meetpad_jigasi_xmpp_password }}
-
-# MUC name for the Jigasi pool.
-JIGASI_BREWERY_MUC=jigasibrewery
-
-# Minimum port for media used by Jigasi.
-JIGASI_PORT_MIN=20000
-
-# Maximum port for media used by Jigasi.
-JIGASI_PORT_MAX=20050
-
-# Enable SDES srtp
-#JIGASI_ENABLE_SDES_SRTP=1
-
-# Keepalive method
-#JIGASI_SIP_KEEP_ALIVE_METHOD=OPTIONS
-
-# Health-check extension
-#JIGASI_HEALTH_CHECK_SIP_URI=keepalive
-
-# Health-check interval
-#JIGASI_HEALTH_CHECK_INTERVAL=300000
 #
-# Enable Jigasi transcription.
-#ENABLE_TRANSCRIPTIONS=1
+# Docker Compose options
+#

-# Jigasi will recordord an audio when transcriber is on. Default false.
-#JIGASI_TRANSCRIBER_RECORD_AUDIO=true
+# Container restart policy
+#RESTART_POLICY=unless-stopped

-# Jigasi will send transcribed text to the chat when transcriber is on. Default false.
-#JIGASI_TRANSCRIBER_SEND_TXT=true
-
-# Jigasi post to the chat an url with transcription file. Default false.
-#JIGASI_TRANSCRIBER_ADVERTISE_URL=true
-
-# Credentials for connect to Cloud Google API from Jigasi. Path located inside the container.
-# Please read https://cloud.google.com/text-to-speech/docs/quickstart-protocol
-# section "Before you begin" from 1 to 5 paragraph. Copy the key on
-# the docker host to ${CONFIG}/jigasi/key.json and to enable this setting:
-#GOOGLE_APPLICATION_CREDENTIALS=/config/key.json
-
-# Enable recording
-#ENABLE_RECORDING=1
-
-# XMPP domain for the jibri recorder
-XMPP_RECORDER_DOMAIN=recorder.localhost
-
-# XMPP recorder user for Jibri client connections.
-JIBRI_RECORDER_USER=recorder
-
-# XMPP recorder password for Jibri client connections.
-JIBRI_RECORDER_PASSWORD={{ meetpad_jibri_recorder_password }}
-
-# Directory for recordings inside Jibri container.
-JIBRI_RECORDING_DIR=/config/recordings
-
-# The finalizing script. Will run after recording is complete.
-JIBRI_FINALIZE_RECORDING_SCRIPT_PATH=/config/finalize.sh
-
-# XMPP user for Jibri client connections.
-JIBRI_XMPP_USER=jibri
-
-# XMPP password for Jibri client connections.
-JIBRI_XMPP_PASSWORD={{ meetpad_jibri_xmpp_password }}
-
-# MUC name for the Jibri pool.
-JIBRI_BREWERY_MUC=jibribrewery
-
-# MUC connection timeout
-JIBRI_PENDING_TIMEOUT=90
-
-# When jibri gets a request to start a service for a room, the room
-# jid will look like: roomName@optional.prefixes.subdomain.xmpp_domain
-# We'll build the url for the call by transforming that into:
-# https://xmpp_domain/subdomain/roomName
-# So if there are any prefixes in the jid (like jitsi meet, which
-# has its participants join a muc at conference.xmpp_domain) then
-# list that prefix here so it can be stripped out to generate
-# the call url correctly.
-JIBRI_STRIP_DOMAIN_JID=muc
-
-# Directory for logs inside Jibri container.
-JIBRI_LOGS_DIR=/config/logs
-
-# Disable HTTPS. This can be useful if TLS connections are going to be handled outside of this setup.
-#DISABLE_HTTPS=1
-
-# Redirects HTTP traffic to HTTPS. Only works with the standard HTTPS port (443).
-ENABLE_HTTP_REDIRECT=1
-
-# Participants after the Nth (value below) joining will have their video muted.
-# This should mute video for all participants who join.
-START_VIDEO_MUTED=0
-
-# Participants after the Nth (value below) joining will have their audio muted.
-# This should mute audio for all participants who join.
-START_AUDIO_MUTED=0
-
-# Disable P2P connections for meetings between two participants.
-ENABLE_P2P=false
+# Jitsi image version (useful for local development)
+#JITSI_IMAGE_VERSION=latest