28 ms·
Running your own secure communication service with Matrix and Jitsi
- solinent 7y agoHere are some text instructions: https://github.com/jitsi/jitsi-meet/blob/master/doc/manual-install.md https://github.com/jitsi/jitsi-meet/blob/master/doc/manual-i... Instead of generating the certs with prosody (there was some issue since my system uses p11-kit), I found it easier to just generate them all with certbot. update-ca-trust doesn't seem to correctly add them to the Java keystore and then you'll encounter problems. Certbot does. If you're on a debian based distro you shouldn't have to worry, however. All you really have to do is copy/paste configs and then also change the url in the config. Here's the process for adding the certs using p11-kit. https://github.com/jitsi/jitsi-meet/issues/2842#issuecomment-385284622 https://github.com/jitsi/jitsi-meet/issues/2842#issuecomment... and the comment below.
- teekert 7y agoSo, what are the lines I need to add to my docker-compose.yaml ;)
- Arathorn 7y agoThis was deliberately the Debian package flavoured installation. We'll probably do a Docker one too (which will likely be a lot faster, but also a lot more mysterious as to what's actually going on :)
- smartbit 7y agoDocker would be nice indeed, an helm chart would be even more convenient.
- Arathorn 7y agoTo be clear - Docker & Helm installations of course exist for Synapse: * https://github.com/matrix-org/synapse/blob/master/INSTALL.md#docker-images-and-ansible-playbooks https://github.com/matrix-org/synapse/blob/master/INSTALL.md... is the official Docker instructions * https://github.com/dacruz21/matrix-chart https://github.com/dacruz21/matrix-chart is a Helm one etc
- ptman 7y agoAnd there's https://github.com/spantaleev/matrix-docker-ansible-deploy https://github.com/spantaleev/matrix-docker-ansible-deploy
- johnchristopher 7y agoIt'd be really cool if you could also add how to setup federation :). edit: for docker with synapse living on subdomain.domain.tld and addresses like @user:domain.tld, I don't know ^^.
- lub 7y agoWhat you want is named delegation and there is a document about it in the synapse repository: https://github.com/matrix-org/synapse/blob/master/docs/delegate.md https://github.com/matrix-org/synapse/blob/master/docs/deleg... Just in case you weren't already aware of it :)
- diafygi 7y agoIs there a way to integrate a phone call-in number to Jitsi? Maybe via Twilio or something?
- ThinkingGuy 7y agoI haven't tried it myself but according to the FAQ: "Jitsi offers a telephony interface that allows users to dial into a conference or for placing dial-out reminder calls. You can try this for free on meet.jit.si. Self-installed Jitsi Meet deployments will need to setup and configure Jigasi with a SIP provider to connect to the phone network. " https://jitsi.org/user-faq/ https://jitsi.org/user-faq/
- saghul 7y agoYes, you can deploy Jigasi (https://github.com/jitsi/jigasi https://github.com/jitsi/jigasi) to VoIP access to Jitsi Meet.
- dangerboysteve 7y agoif you go to the jitsi.org site and start a meeting, there is a share box that can be popped up and it shows a dial-in number for your conf. So it must have sip integration.
- ThinkingGuy 7y agoI think I may have found a typo in the instructions. Under the section for setting up the Matrix .well-known info, shouldn't the line: cat '{ "m.server": "matrix.dangerousdemos.net:443" }' > server be echo '{ "m.server": "matrix.dangerousdemos.net:443" }' > server instead?
- Arathorn 7y agooops, my bad - thanks! https://github.com/matrix-org/matrix.org/commit/42e8a90932ae8f455221dea652e18ecd19b1692d https://github.com/matrix-org/matrix.org/commit/42e8a90932ae.... CI will pick up the fix in a few minutes.
- KingFelix 7y agoIm following the instructions and getting all 404 pages after I install Synapse, nginx and ssl are all good, I am missing something? I assume its my server block, but I have made many changes / adjustments and still getting a 404 on all my pages??
- deepersprout 7y agoDoes someone have experience running Jitsi with 4+ users? Like in conferences with maybe up to 12 people? Can it handle it?
- Arathorn 7y agoWe regularly run it with 40-50 users, and it's fine... as long as you limit the number of displayed video streams to 12-15 or fewer. This tends to happen organically with people muting video, or otherwise you can configure Jitsi to limit it to show video for the last 12 people who spoke. Otherwise you risk overloading people on devices which can't render >12 simultaneous video streams without melting. You can push the limit higher if you know everyone is on a fast machine however. One thing worth noting is that if a one or more user connects via Firefox then quality degrades for everyone - but fixes for this look to be in flight over at https://github.com/jitsi/jitsi-meet/issues/4758 https://github.com/jitsi/jitsi-meet/issues/4758
- gnufx 7y agoWhat server resources to you need for those 40-50 users with Jitsi/Matrix? I haven't seen estimates of required resources when I've looked, but I assume there's some doc somewhere. (Thanks for the good work.)
- Arathorn 7y agoRoughly speaking we're seeing Jitsi serve around 1000 concurrent streams (i.e. 25x 50-user conferences) on a typical 4 core box with 8GB of RAM. However, it's worth noting that Jitsi is pretty low resource - all it's doing is forwarding streams of data around the place. All the heavy lifting is done by the clients when displaying all the concurrent videos, so it's the clients which tend to be the bottleneck.
- esamueljohnson 7y ago> you can configure Jitsi to limit it to show video for the last 12 people who spoke Can you please point me to where this can be done.
- villgax 7y agoJitsi despite its frequent re-occurence here is a nightmare to configure with so many bells & whistle to setup just one basic functionality. Try setting it up with word-to-word instructions for setup & later SSL certs to work on your own iOS app of Jitsi meet without ripping your hair out.
- oxidising 7y agoThis hasn't been my experience at all. Setting it up on a VM using their installation instructions (https://github.com/jitsi/jitsi-meet/blob/master/doc/quick-install.md https://github.com/jitsi/jitsi-meet/blob/master/doc/quick-in...) was very easy.
- EvanAnderson 7y agoSame experience here. I had a VM up and running in about 30 minutes. (Having said that, I never got test meetings to work reliably. My clients, both on the LAN and on the Internet, would repeatedly "disconnect" and "reconnect" every few seconds. I didn't spend too much time on it because the company ended up making a "let's standardize on WebEx" decision the next day.)
- xrd 7y agoSuper easy for me. I followed the instructions to setup on Ubuntu and it was ten minutes with zero confusion. Just copy the steps from the guide. Even the let's encrypt script installed certbot and configured whatever was needed with the existing web server. Then I just hit the url and it worked perfectly. The biggest surprise was when I tried to access that same page from an Android phone. It prompted me to install the jitsi app. After I installed it, it directed me to my jitsi server. For me it was flawless and even better that I expected. It's a strong competitor to zoom because of the fact that it works right inside the browser really well.
- villgax 7y agoAndroid isn't the problem, I mentioned iOS. I know WebRTC works and all starting iOS 11, but the problem remains with the way Jitsi configures SSL in the nginx conf. iOS Safari is simply unable to establish a secure connection despite the server having a valid LetEncrypt cert.
- smartbit 7y agoExtinction Rebellion switched to Jitsi, Matrix etc. From the slide at t=2078: *.organise.earth *.rebellion.global OWN3D OWNED (self hosted) Team Chat Slack Mattermost (Team Edition) Cloud Storage Google Drive Nextcloud (2 instances) Collaborative docs Google docs Only Office Etherpad-Lite Surveys Google Forms LimeSurvey Video Conferencing Zoom Jitsi-Meet Webmail Gmail, etc Rainloop (Postfix, Dovecot) Collaborative Dev Github gitlab Mailinglist manager Mail Chimp Mailtrain Actions/Operations WhatsApp, Skype Signal, Wire Social Twitter Mastodon Video Youtube Peertube Site Jekyll Admin Gender Bros Any https://media.ccc.de/v/36c3-11008-server_infrastructure_for_global_rebellion#t=2078 https://media.ccc.de/v/36c3-11008-server_infrastructure_for_... > In this talk Julian will outline his work as sysadmin, systems and security architect for the climate and environmental defense movement Extinction Rebellion. Responsible for 30 server deployments in 11 months, including a community hub spanning dozens of national teams (some of which operate in extremely hostile conditions), he will show why community-owned free and open source infrastructure is mission-critical for the growth, success and safety of global civil disobedience movements.
- 3fe9a03ccd14ca5 7y ago“Admin Gender”?
- martin_a 7y agoI think it's more of a joke with the "we changed from second column to third column"-thing that's going on in that list.
- smartbit 7y agoIt's a copy from the screen for your convenience. Click on the link to see yourselves. I've updated the list to remove the misunderstanding Extinction Rebellion is fostering Inclusion & Diversity, I think is what he is trying to say. If you don't like what Julian wrote, please contact him.
- KaoruAoiShiho 7y agoCan Jitsi be used as a streaming server? A small number of people in a call, 3-5, streaming to thousands. Live podcasts etc?
- neilalexander 7y agoThere is a document on how to live-stream to YouTube: https://jitsi.org/live-streaming-and-recording-a-jitsi-conference/ https://jitsi.org/live-streaming-and-recording-a-jitsi-confe...
- KaoruAoiShiho 7y agoOkay so jitsi can't be the "youtube" itself?
- tsukurimashou 7y agoyoutube and other steaming platforms use a lot of servers to handle the load, so no jitsi can't be youtube itself unless you have a beast of a connection and even then you'd cap your connection after a hundred users. CDNs like cloudflare does the same but for websites.
- KaoruAoiShiho 7y agoI already have a lot of servers. I was asking if jitsi is server side software that can handle the encoding / delivery to users. The answer is no. Jitsi is apparently completely unscalable.
- kitd 7y agoJitsi is apparently completely unscalable. Is this intended as a criticism? You wanted it to do a job it was never designed to do.
- KaoruAoiShiho 7y ago
- eof 7y agoany recommendations on an sufficient instance size for 4-5 people to use it for comms?
- d_runs_far 7y agoI've been running it on a 4 core, 8GB ram droplet at DigitalOcean with no problems. We typically have 3-6 people in multiple sessions at the same time. In the test install, I did it with a $10 droplet, and it stuttered with 30 people in one conference, but didn't drop anyone.
- xrd 7y agoWhat does matrix add to jitsi? Jitsi is already easy to run over https. Does this make it so you can't randomly enter rooms if you know the name and there is no password set?
- SparkyMcUnicorn 7y agoChat/Messaging and any other real-time data you want.
- Arathorn 7y agoMatrix adds featureful decentralised e2e-encrypted chat alongside the voice/video conferencing, and makes it possible to coordinate the location of a given conference for a given room. It doesn't impose additional auth currently to the conferences (but it could). It also maintains your displaynames & avatars for you inside the Jitsi :)
- Teever 7y agoAre the e2e-encrypted chats enabled by default?
- dade_ 7y agoIt's the Slack for your Zoom.
- 3fe9a03ccd14ca5 7y agoIt’s still a ways to go for non technical users. We tried Jitsi to mixed success. Some people had it work flawless the first time, others had to switch browsers, still others couldn’t use it at all, probably because of some privacy or cookie blocking extension. Open source software needs to be as easy to use and configure as the alternative if they really hope to gain wise adoption.
- pbhjpbhj 7y agoThat's interesting by brother and I have both worked in IT (he still does) and came independently to the same conclusion, that for domestic offerings meet.jit.si was the least friction - you literally just go the website and so far it just works. Yesterday my kids used it for a 4hr call, no interruptions though audio quality dropped on occasions - I think it was the remote iPad's multiplexing that was struggling but couldn't be sure.
- tsukurimashou 7y ago"Open source software needs" Open source software doesn't owe you anything and you can use the alternative if that doesn't satisfy you. People want self hosted, free software with privacy BUT also all other features that big companies add to their software. I'm sorry but you have to make compromises. Most people decide to compromise their freedom and privacy. If you really want the software to improve the best way is to contribute (or donate if that's an option), complaining things could be better on the other hand don't help much.
- shostack 7y agoAre there any good guides on self-hosting this for private family group chats on a home machine or something similar?
- gmixer 7y agoI've done this recently - follow the vultr guide https://www.vultr.com/docs/how-to-install-jitsi-meet-on-ubuntu-18-04-lts https://www.vultr.com/docs/how-to-install-jitsi-meet-on-ubun... then the jitsi docs to secure your meetings as required https://github.com/jitsi/jicofo#secure-domain https://github.com/jitsi/jicofo#secure-domain . Then you can use basic Auth in nginx https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/ https://docs.nginx.com/nginx/admin-guide/security-controls/c... to secure the site.
- Huijaaja42 7y agoSadly many schools etc probs won't use this since most schools lack proper it-staff.
- sschueller 7y agoI operate a matrix server but I recently found Jami which supposedly is p2p encrypted. Does anyone use it? Downsides? https://jami.net/ https://jami.net/
- evandrofisico 7y agotried the mobile version, because of the p2p aspect it sucks your battery dry.
- t0astbread 7y agoI tried it a while ago and message delivery took minutes between me and a friend. It also won't do well on Android versions that kill background tasks and effectively force you to use Firebase Cloud Messaging for push (although you can't really blame it for that).
- drcross 7y agoCan anyone comment on if this will run successfully on a raspberry pi 3 for a small number of users (<10)?
- treve 7y agoNo experience with the Pi, but I ran it on a free EC2 instance and synapse loves RAM, so I have doubt.
- neiljohnson 7y agoMany people do just that, but it really depends on what you use it for. Synapse resource usage is dependent on the complexity of the rooms that it participates in, not the number of users. So if you intend to use it just to talk to a few friends, you'll have no problems at all. If you want to join rooms with 1000s of other servers participating then it will be hungrier.
- mgbmtl 7y agoAny suggestions on simple auth methods to avoid running an open Jitsi server? Last time I tested it, it seemed to be very open by default, letting anyone create meetings. I got lost when digging deeper. If I install-and-forget, I want to avoid situations where strangers are using my Jitsi server and overloading the system, or pretending to be our company. Last I checked, it was not possible to have simple auth, or monitor/list calls. I also run an Asterisk VoIP server with a WebRTC bridge (because most Linux SIP clients have terrible usability). That can make one pretty paranoid :)
- plett 7y agoYes, I installed Jitsi Meet over the weekend and enabled auth so you need credentials to start a new conference, but anyone with the link (and optionally password too) can join unauthenticated. I followed these instructions to add the auth https://github.com/jitsi/jicofo#secure-domain https://github.com/jitsi/jicofo#secure-domain
- fock 7y agomy university' setup has something asking for "host credentials" before starting the session, so I think it's possible. If it's just for internal use, one could just put basic HTTP(s)-auth in front?
- johnmaguire2013 7y agoYou could use something like the Duo Network Gateway or Cloudflare Access to protect it.
- jvanveen 7y agoI've been experimenting with Asterisk WebRTC (video & audio) and developing a SIP + P2P webphone for some time now. Quite close to something that's useable imho. See https://github.com/garage11/ca11 https://github.com/garage11/ca11 in case you're interested
- esamueljohnson 7y agoYou can enable authentication in Prosody. https://github.com/jitsi/jitsi-meet/blob/master/doc/example-config-files/prosody.cfg.lua.example https://github.com/jitsi/jitsi-meet/blob/master/doc/example-...
- JoeAltmaier 7y agoI hope those things are much better than they used to be. Last I looked, they were a bunch of APIs glued together to look like a media server. No hard features; no guarantees. Almost a mockup of what a media switching server should look like on the outside; nothing inside.
- macawfish 7y agoThere's also rocket chat! I love matrix, don't get me wrong...
- j45 7y agoFor self hosting .. is there some sort of a guide available that helps understand the resourcing needs relative to concurrent active users? I'd like to hop on this, and think it will work great, but would like to make sure there's a way to right size a particular installation.
- tsukurimashou 7y agosee comment bellow https://news.ycombinator.com/item?id=22804464 https://news.ycombinator.com/item?id=22804464 and other comments talk about it too
- chme 7y agoWhat would the hardware requirements for such a stack be? Last I read was that synapse requires a lot to memory and I guess that managing audio/video streams will be cpu intensive.
- fleetside72 7y agoI have an old R710 with 24 cores and 32GB I got on ebay for $200 in my dining room with 10mbits upload/100 download and it works great. bought my .me domain for $5. It's a wonderful time to be alive.
- SaltySolomon 7y agoFor how many users?
- fleetside72 7y agoI've run 6 on jitsi.
- spockz 7y agoI’ve run 10-12 users with video and desktop screen sharing on a 6 core azure vm with between 20-30% cpu load with spikes to 46%. It also depends a bit on the adaptive bit rate. Image quality of FaceTime is higher than Jitsi.
- cheald 7y agoI'm running Mattermost and Jitsi for my employer on a $20 droplet (2 vCPU/4GB RAM) and it works like a champ. Meetings of 5-10 are common, but we've run meetings larger than that too. As a facilitator of 1:1 adhoc meetings, it's basically zero overhead, because the server just coordinates a P2P connection then gets out of the way.
- AnonC 7y agoTangentially, I wanted to run Jitsi Meet for some meetings and created an account on Digital Ocean, only for the account to be promptly locked with no access to a human for support...just automated replies rehashing the same text again and again for tickets saying that I could provide more information if I believed that was in error (with no responses after providing additional information). Now I'm looking at trying Linode. Any other provider recommendations are welcome.
- KingFelix 7y agoI use DO, and VULTR too, they have had some pretty cheap cloud servers ~2.5 sometimes
- _ink_ 7y agoI am quite happy with the Hetzner Cloud services.
- illuminated 7y agoI've been using SoYouStart [0] for the last several years. It's an OVH company and they have really great servers for a great price. [0] https://www.soyoustart.com/ https://www.soyoustart.com/
- phaer 7y agoI am using a hetzner.cloud box for €5.88/month for a personal Jitsi instance without problems. There servers are in Europe though, so if you are somewhere else on the globe, it might be better idea to look for a provider which is geographically closer to you
- martin_a 7y agoThinking about doing the same. Any experience with how much load those cloud instances can take?
- phaer 7y agoDepends on the instance I guess, but a few dozen users on a cx21 seem to be no trouble at all. As someone else already mentioned in this thread, Jitsi does no transcoding server-side and is pretty low on resources.
- illuminated 7y agoI have had a matrix instance on one of my servers running but integrating Jitsi was a real pain. And even when the integration is done correctly the user experience of using it within Matrix is at least weird. It appears as an "attachment" in the conversation and is very non-intuitive for everyone.
- xf86alsa 7y agoJitsi is much easier to add in the latest Riot-web version. No longer do you need to set up your own integration manager. You just add the jitsi URL to Riot's config.json and you're done.
- pmlnr 7y ago> The installer magically detects you have nginx installed and adds in an appropriate vhost! Yes, because those of us who run their own vidconf setup want automagically mangled nginx configs. Other than that, thank you for the guide.
- fleetside72 7y ago...I kinda thought it was neet-o
- warrenm 7y agoLike a Dorito!
- jeltz 7y agoYeah, I hate things which automatically mess up my configuration files.
- lousken 7y agois there any way to transfer e2e chats from matrix.org homeserver account to my own server?
- ta999999171 7y agoAdd your new user account to your rooms, leave with old user acct.
- MayeulC 7y agoJust join the chats from your server, they will exist on both matrix.org and your server. Then you may leave with your old matrix.org account. As for history, you could just import your key backup, if the room history is set to visible. Truly decentralized accounts will likely come at a later point, especially with all the work surrounding p2p matrix, where each p2p client is a server.
- lousken 7y agoI've tested this with a couple of test accounts. By default the e2e rooms history are set like this: Who can read history? Members only (since the point in time of selecting this option) but this option doesn't seem to work for me. The history didn't synchronize when i added my own homeserver account and verified it with other accounts - do i need to import the keys from the old account first for it to show up or am i misunderstanding how this option works?
- xf86alsa 7y agoAs of recent Riot/web versions old messages that can't be decrypted in rooms will not be shown (saves the user from being blasted with Unable to Decrypt errors). So the messages are likely there, but you won't see them until you import your e2e keys.
- lousken 7y agoSome messages got reordered but other than that it works! Thank you
- deleted 7y ago[deleted]
- joshuaellinger 7y agoI just setup my own Jitsi server at Digital Ocean. It was easy and it works well. My only tip is that you really have to get the DNS name right. There is no easy way to change it post install. I had a typo on the first pass. Next step is securing the launch screen. Since it sits behind NGINX, do the configuration there.
- Uehreka 7y agoHas anyone done a recent comparison of Jitsi and Janus? The only benchmark I can find is from 2018 and seemed a bit shallow. I’d be interested in seeing which one could deliver the best performance while running on a really cheap EC2 box. My guess would be Janus, since it’s C and Jitsi is Java, but maybe Jitsi has something about its architecture that gives it an edge.
- shmerl 7y agoWhy is Jitsi needed exactly, or it's handling server side video multiplexing? Matrix itself doesn't support it?
- daagma 7y agoh
- daagma 7y agoHi guys and thanks for this tutorial. Has I'm new to docker and synapse but I would like to setup the same thing using docker but I'm not finding a clean step by step tutorial on how to do this. My goal is to set in way I could use docker swarm in future. Any advises or links? thanks in advance