This repository has no description
1{ self, ... }:
2{
3
4 # jitsi-meet 1.0.8792 is marked insecure in nixpkgs; secureify via overlay
5 # rather than nixpkgs.config.permittedInsecurePackages (which doesn't
6 # list-merge across modules and gets clobbered).
7 nixpkgs.overlays = [
8 (_final: prev: {
9 jitsi-meet = self.lib.secureify prev.jitsi-meet;
10 })
11 ];
12 services.jitsi-meet = {
13 enable = true;
14 hostName = "jitsi.lassul.us";
15 config = {
16 enableWelcomePage = true;
17 requireDisplayName = true;
18 analytics.disabled = true;
19 stunServers = [
20 # - https://www.kuketz-blog.de/jitsi-meet-server-einstellungen-fuer-einen-datenschutzfreundlichen-betrieb/
21 { urls = "turn:turn.matrix.org:3478?transport=udp"; }
22 { urls = "turn:turn.matrix.org:3478?transport=tcp"; }
23 ];
24 };
25 interfaceConfig = {
26 SHOW_JITSI_WATERMARK = false;
27 SHOW_WATERMARK_FOR_GUESTS = false;
28 GENERATE_ROOMNAMES_ON_WELCOME_PAGE = false;
29 DISABLE_PRESENCE_STATUS = true;
30 DEFAULT_REMOTE_DISPLAY_NAME = "Fellow Nixer";
31 };
32 };
33
34 # Disable AWS harvester (not needed) and configure NAT harvester
35 # so clients can establish media connections through NAT
36 services.jitsi-videobridge.extraProperties = {
37 "org.ice4j.ice.harvest.DISABLE_AWS_HARVESTER" = "true";
38 "org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS" = "0.0.0.0";
39 "org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS" = "95.217.192.59";
40 };
41
42 services.prosody.checkConfig = false;
43
44 services.nginx.virtualHosts."meet.lassul.us" = {
45 enableACME = true;
46 addSSL = true;
47 locations."/".return = "301 https://jitsi.lassul.us$request_uri";
48 };
49
50 networking.firewall.allowedTCPPorts = [
51 4443
52 10000
53 ];
54 networking.firewall.allowedUDPPorts = [ 10000 ];
55}