nixos/modules/services/networking/jigasi.nix

   1 { config, lib, pkgs, ... }:
   2 let
   3   cfg = config.services.jigasi;
   4   homeDirName = "jigasi-home";
   5   stateDir = "/tmp";
   6   sipCommunicatorPropertiesFile = "${stateDir}/${homeDirName}/sip-communicator.properties";
   7   sipCommunicatorPropertiesFileUnsubstituted = "${pkgs.jigasi}/etc/jitsi/jigasi/sip-communicator.properties";
   8 in
   9 {
  10   options.services.jigasi = with lib.types; {
  11     enable = lib.mkEnableOption "Jitsi Gateway to SIP - component of Jitsi Meet";
  12
  13     xmppHost = lib.mkOption {
  14       type = str;
  15       example = "localhost";
  16       description = ''
  17         Hostname of the XMPP server to connect to.
  18       '';
  19     };
  20
  21     xmppDomain = lib.mkOption {
  22       type = nullOr str;
  23       example = "meet.example.org";
  24       description = ''
  25         Domain name of the XMMP server to which to connect as a component.
  26
  27         If null, <option>xmppHost</option> is used.
  28       '';
  29     };
  30
  31     componentPasswordFile = lib.mkOption {
  32       type = str;
  33       example = "/run/keys/jigasi-component";
  34       description = ''
  35         Path to file containing component secret.
  36       '';
  37     };
  38
  39     userName = lib.mkOption {
  40       type = str;
  41       default = "callcontrol";
  42       description = ''
  43         User part of the JID for XMPP user connection.
  44       '';
  45     };
  46
  47     userDomain = lib.mkOption {
  48       type = str;
  49       example = "internal.meet.example.org";
  50       description = ''
  51         Domain part of the JID for XMPP user connection.
  52       '';
  53     };
  54
  55     userPasswordFile = lib.mkOption {
  56       type = str;
  57       example = "/run/keys/jigasi-user";
  58       description = ''
  59         Path to file containing password for XMPP user connection.
  60       '';
  61     };
  62
  63     bridgeMuc = lib.mkOption {
  64       type = str;
  65       example = "jigasibrewery@internal.meet.example.org";
  66       description = ''
  67         JID of the internal MUC used to communicate with Videobridges.
  68       '';
  69     };
  70
  71     defaultJvbRoomName = lib.mkOption {
  72       type = str;
  73       default = "";
  74       example = "siptest";
  75       description = ''
  76         Name of the default JVB room that will be joined if no special header is included in SIP invite.
  77       '';
  78     };
  79
  80     environmentFile = lib.mkOption {
  81       type = lib.types.nullOr lib.types.path;
  82       default = null;
  83       description = ''
  84         File containing environment variables to be passed to the jigasi service,
  85         in which secret tokens can be specified securely by defining values for
  86         <literal>JIGASI_SIPUSER</literal>,
  87         <literal>JIGASI_SIPPWD</literal>,
  88         <literal>JIGASI_SIPSERVER</literal> and
  89         <literal>JIGASI_SIPPORT</literal>.
  90       '';
  91     };
  92
  93     config = lib.mkOption {
  94       type = attrsOf str;
  95       default = { };
  96       example = lib.literalExpression ''
  97         {
  98           "org.jitsi.jigasi.auth.URL" = "XMPP:jitsi-meet.example.com";
  99         }
 100       '';
 101       description = ''
 102         Contents of the <filename>sip-communicator.properties</filename> configuration file for jigasi.
 103       '';
 104     };
 105   };
 106
 107   config = lib.mkIf cfg.enable {
 108     services.jicofo.config = {
 109       "org.jitsi.jicofo.jigasi.BREWERY" = "${cfg.bridgeMuc}";
 110     };
 111
 112     services.jigasi.config = lib.mapAttrs (_: v: lib.mkDefault v) {
 113       "org.jitsi.jigasi.BRIDGE_MUC" = cfg.bridgeMuc;
 114     };
 115
 116     users.groups.jitsi-meet = {};
 117
 118     systemd.services.jigasi = let
 119       jigasiProps = {
 120         "-Dnet.java.sip.communicator.SC_HOME_DIR_LOCATION" = "${stateDir}";
 121         "-Dnet.java.sip.communicator.SC_HOME_DIR_NAME" = "${homeDirName}";
 122         "-Djava.util.logging.config.file" = "${pkgs.jigasi}/etc/jitsi/jigasi/logging.properties";
 123       };
 124     in
 125     {
 126       description = "Jitsi Gateway to SIP";
 127       wantedBy = [ "multi-user.target" ];
 128       after = [ "network.target" ];
 129
 130       preStart = ''
 131         [ -f "${sipCommunicatorPropertiesFile}" ] && rm -f "${sipCommunicatorPropertiesFile}"
 132         mkdir -p "$(dirname ${sipCommunicatorPropertiesFile})"
 133         temp="${sipCommunicatorPropertiesFile}.unsubstituted"
 134
 135         export DOMAIN_BASE="${cfg.xmppDomain}"
 136         export JIGASI_XMPP_PASSWORD=$(cat "${cfg.userPasswordFile}")
 137         export JIGASI_DEFAULT_JVB_ROOM_NAME="${cfg.defaultJvbRoomName}"
 138
 139         # encode the credentials to base64
 140         export JIGASI_SIPPWD=$(echo -n "$JIGASI_SIPPWD" | base64 -w 0)
 141         export JIGASI_XMPP_PASSWORD_BASE64=$(cat "${cfg.userPasswordFile}" | base64 -w 0)
 142
 143         cp "${sipCommunicatorPropertiesFileUnsubstituted}" "$temp"
 144         chmod 644 "$temp"
 145         cat <<EOF >>"$temp"
 146         net.java.sip.communicator.impl.protocol.sip.acc1403273890647.SERVER_PORT=$JIGASI_SIPPORT
 147         net.java.sip.communicator.impl.protocol.sip.acc1403273890647.PREFERRED_TRANSPORT=udp
 148         EOF
 149         chmod 444 "$temp"
 150
 151         # Replace <<$VAR_NAME>> from example config to $VAR_NAME for environment substitution
 152         sed -i -E \
 153           's/<<([^>]+)>>/\$\1/g' \
 154           "$temp"
 155
 156         sed -i \
 157           's|\(net\.java\.sip\.communicator\.impl\.protocol\.jabber\.acc-xmpp-1\.PASSWORD=\).*|\1\$JIGASI_XMPP_PASSWORD_BASE64|g' \
 158           "$temp"
 159
 160         sed -i \
 161           's|\(#\)\(org.jitsi.jigasi.DEFAULT_JVB_ROOM_NAME=\).*|\2\$JIGASI_DEFAULT_JVB_ROOM_NAME|g' \
 162           "$temp"
 163
 164         ${pkgs.envsubst}/bin/envsubst \
 165           -o "${sipCommunicatorPropertiesFile}" \
 166           -i "$temp"
 167
 168         # Set the brewery room name
 169         sed -i \
 170           's|\(net\.java\.sip\.communicator\.impl\.protocol\.jabber\.acc-xmpp-1\.BREWERY=\).*|\1${cfg.bridgeMuc}|g' \
 171           "${sipCommunicatorPropertiesFile}"
 172         sed -i \
 173           's|\(org\.jitsi\.jigasi\.ALLOWED_JID=\).*|\1${cfg.bridgeMuc}|g' \
 174           "${sipCommunicatorPropertiesFile}"
 175
 176
 177         # Disable certificate verification for self-signed certificates
 178         sed -i \
 179           's|\(# \)\(net.java.sip.communicator.service.gui.ALWAYS_TRUST_MODE_ENABLED=true\)|\2|g' \
 180           "${sipCommunicatorPropertiesFile}"
 181       '';
 182
 183       restartTriggers = [
 184         config.environment.etc."jitsi/jigasi/sip-communicator.properties".source
 185       ];
 186       environment.JAVA_SYS_PROPS = lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "${k}=${toString v}") jigasiProps);
 187
 188       script = ''
 189         ${pkgs.jigasi}/bin/jigasi \
 190           --host="${cfg.xmppHost}" \
 191           --domain="${if cfg.xmppDomain == null then cfg.xmppHost else cfg.xmppDomain}" \
 192           --secret="$(cat ${cfg.componentPasswordFile})" \
 193           --user_name="${cfg.userName}" \
 194           --user_domain="${cfg.userDomain}" \
 195           --user_password="$(cat ${cfg.userPasswordFile})" \
 196           --configdir="${stateDir}" \
 197           --configdirname="${homeDirName}"
 198       '';
 199
 200       serviceConfig = {
 201         Type = "exec";
 202
 203         DynamicUser = true;
 204         User = "jigasi";
 205         Group = "jitsi-meet";
 206
 207         CapabilityBoundingSet = "";
 208         NoNewPrivileges = true;
 209         ProtectSystem = "strict";
 210         ProtectHome = true;
 211         PrivateTmp = true;
 212         PrivateDevices = true;
 213         ProtectHostname = true;
 214         ProtectKernelTunables = true;
 215         ProtectKernelModules = true;
 216         ProtectControlGroups = true;
 217         RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
 218         RestrictNamespaces = true;
 219         LockPersonality = true;
 220         RestrictRealtime = true;
 221         RestrictSUIDSGID = true;
 222         StateDirectory = baseNameOf stateDir;
 223         EnvironmentFile = cfg.environmentFile;
 224       };
 225     };
 226
 227     environment.etc."jitsi/jigasi/sip-communicator.properties".source =
 228       lib.mkDefault "${sipCommunicatorPropertiesFile}";
 229     environment.etc."jitsi/jigasi/logging.properties".source =
 230       lib.mkDefault "${stateDir}/logging.properties-journal";
 231   };
 232
 233   meta.maintainers = lib.teams.jitsi.members;
 234 }