Merge tag 'tags/stable-10314' into openshift

guillaumevillemont · guillaumevillemont · commit 84e5dcc08335 · 2025-06-20T16:05:44.000+02:00
diff --git a/.github/workflows/unstable.yml b/.github/workflows/unstable.yml
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -1,9 +1,7 @@
-version: '3.5'
-
 services:
     # Frontend
     web:
-        image: jitsi/web:${JITSI_IMAGE_VERSION:-stable-10184}
+        image: jitsi/web:${JITSI_IMAGE_VERSION:-stable-10314}
         restart: ${RESTART_POLICY:-unless-stopped}
         ports:
             - '${HTTP_PORT}:80'
@@ -192,7 +190,7 @@ services:
 
                 # XMPP server
     prosody:
-        image: jitsi/prosody:${JITSI_IMAGE_VERSION:-stable-10184}
+        image: jitsi/prosody:${JITSI_IMAGE_VERSION:-stable-10314}
         restart: ${RESTART_POLICY:-unless-stopped}
         expose:
             - '${XMPP_PORT:-5222}'
@@ -342,7 +340,7 @@ services:
 
     # Focus component
     jicofo:
-        image: jitsi/jicofo:${JITSI_IMAGE_VERSION:-stable-10184}
+        image: jitsi/jicofo:${JITSI_IMAGE_VERSION:-stable-10314}
         restart: ${RESTART_POLICY:-unless-stopped}
         ports:
             - '127.0.0.1:${JICOFO_REST_PORT:-8888}:8888'
@@ -389,9 +387,14 @@ services:
             - JICOFO_ENABLE_LOAD_REDISTRIBUTION
             - JICOFO_ENABLE_REST
             - JICOFO_HEALTH_CHECKS_USE_PRESENCE
+            - JICOFO_ICE_FAILURE_INTERVAL
+            - JICOFO_ICE_FAILURE_MIN_ENDPOINTS
+            - JICOFO_ICE_FAILURE_THRESHOLD
             - JICOFO_MAX_MEMORY
             - JICOFO_MULTI_STREAM_BACKWARD_COMPAT
             - JICOFO_OCTO_REGION
+            - JICOFO_RESTART_REQUEST_MAX
+            - JICOFO_RESTART_REQUEST_INTERVAL
             - JICOFO_TRUSTED_DOMAINS
             - JIBRI_BREWERY_MUC
             - JIBRI_REQUEST_RETRIES
@@ -434,7 +437,7 @@ services:
 
                 # Video bridge
     jvb:
-        image: jitsi/jvb:${JITSI_IMAGE_VERSION:-stable-10184}
+        image: jitsi/jvb:${JITSI_IMAGE_VERSION:-stable-10314}
         restart: ${RESTART_POLICY:-unless-stopped}
         ports:
             - '${JVB_PORT:-10000}:${JVB_PORT:-10000}/udp'
diff --git a/jibri.yml b/jibri.yml
@@ -2,7 +2,7 @@ version: '3.5'
 
 services:
     jibri:
-        image: jitsi/jibri:${JITSI_IMAGE_VERSION:-stable-10184}
+        image: jitsi/jibri:${JITSI_IMAGE_VERSION:-stable-10314}
         restart: ${RESTART_POLICY:-unless-stopped}
         volumes:
             - ${CONFIG}/jibri:/config:Z
diff --git a/jicofo/rootfs/defaults/jicofo.conf b/jicofo/rootfs/defaults/jicofo.conf
@@ -14,6 +14,9 @@
 {{ $ENABLE_JVB_XMPP_SERVER := .Env.ENABLE_JVB_XMPP_SERVER | default "0" | toBool -}}
 {{ $ENABLE_SHARED_DOCUMENT_RANDOM_NAME := .Env.ENABLE_SHARED_DOCUMENT_RANDOM_NAME | default "0" | toBool -}}
 {{ $HEALTH_CHECKS_USE_PRESENCE := .Env.JICOFO_HEALTH_CHECKS_USE_PRESENCE | default "0" | toBool -}}
+{{ $ICE_FAILURE_INTERVAL := .Env.JICOFO_ICE_FAILURE_INTERVAL | default "60" -}}
+{{ $ICE_FAILURE_MIN_ENDPOINTS := .Env.JICOFO_ICE_FAILURE_MIN_ENDPOINTS | default "40" -}}
+{{ $ICE_FAILURE_THRESHOLD := .Env.JICOFO_ICE_FAILURE_THRESHOLD | default "0.1" -}}
 {{ $JIBRI_BREWERY_MUC := .Env.JIBRI_BREWERY_MUC | default "jibribrewery" -}}
 {{ $JIGASI_BREWERY_MUC := .Env.JIGASI_BREWERY_MUC | default "jigasibrewery" -}}
 {{ $JVB_BREWERY_MUC := .Env.JVB_BREWERY_MUC | default "jvbbrewery" -}}
@@ -22,6 +25,7 @@
 {{ $JVB_XMPP_INTERNAL_MUC_DOMAIN := .Env.JVB_XMPP_INTERNAL_MUC_DOMAIN | default "muc.jvb.meet.jitsi" -}}
 {{ $JVB_XMPP_PORT := .Env.JVB_XMPP_PORT | default "6222" -}}
 {{ $JVB_XMPP_SERVER := .Env.JVB_XMPP_SERVER | default "xmpp.jvb.meet.jitsi" -}}
+{{ $RESTART_REQUEST_INTERVAL := .Env.JICOFO_RESTART_REQUEST_INTERVAL | default "60" -}}
 {{ $VISITORS_MAX_VISITORS_PER_NODE := .Env.VISITORS_MAX_VISITORS_PER_NODE | default "250" }}
 {{ $VISITORS_MUC_PREFIX := .Env.PROSODY_VISITORS_MUC_PREFIX | default "muc" -}}
 {{ $VISITORS_REQUIRE_MUC_CONFIG := .Env.JICOFO_VISITORS_REQUIRE_MUC_CONFIG | default "0" | toBool }}
@@ -97,6 +101,9 @@ jicofo {
       {{ if .Env.JICOFO_ENABLE_ICE_FAILURE_DETECTION }}
       ice-failure-detection {
         enabled = {{ .Env.JICOFO_ENABLE_ICE_FAILURE_DETECTION | toBool }}
+        interval = {{ $ICE_FAILURE_INTERVAL }} seconds
+        min-endpoints = {{ $ICE_FAILURE_MIN_ENDPOINTS }}
+        threshold = {{ $ICE_FAILURE_THRESHOLD }}
       }
       {{ end }}
       {{ if .Env.JICOFO_ENABLE_LOAD_REDISTRIBUTION }}
@@ -206,6 +213,12 @@ jicofo {
       }
       {{ end }}
 
+      {{ if .Env.JICOFO_RESTART_REQUEST_MAX }}
+      restart-request-rate-limits {
+        max-requests = {{ .Env.JICOFO_RESTART_REQUEST_MAX }}
+        interval = {{ $RESTART_REQUEST_INTERVAL }} seconds
+      }
+      {{ end }}
     }
 
     {{ if .Env.JICOFO_ENABLE_HEALTH_CHECKS }}
diff --git a/jigasi.yml b/jigasi.yml
@@ -3,7 +3,7 @@ version: '3.5'
 services:
     # SIP gateway (audio)
     jigasi:
-        image: jitsi/jigasi:${JITSI_IMAGE_VERSION:-stable-10184}
+        image: jitsi/jigasi:${JITSI_IMAGE_VERSION:-stable-10314}
         restart: ${RESTART_POLICY:-unless-stopped}
         ports:
             - '${JIGASI_PORT_MIN:-20000}-${JIGASI_PORT_MAX:-20050}:${JIGASI_PORT_MIN:-20000}-${JIGASI_PORT_MAX:-20050}/udp'
@@ -44,6 +44,7 @@ services:
             - JIGASI_SIP_PORT
             - JIGASI_SIP_TRANSPORT
             - JIGASI_SIP_DEFAULT_ROOM
+            - JIGASI_STATS_ID
             - JIGASI_XMPP_USER
             - JIGASI_XMPP_PASSWORD
             - JIGASI_BREWERY_MUC
diff --git a/jigasi/Dockerfile b/jigasi/Dockerfile
@@ -8,7 +8,7 @@ LABEL org.opencontainers.image.url="https://github.com/jitsi/jigasi"
 LABEL org.opencontainers.image.source="https://github.com/jitsi/docker-jitsi-meet"
 LABEL org.opencontainers.image.documentation="https://jitsi.github.io/handbook/"
 
-ENV GOOGLE_APPLICATION_CREDENTIALS /config/key.json
+ENV GOOGLE_APPLICATION_CREDENTIALS=/config/key.json
 
 RUN apt-dpkg-wrap apt-get update && \
     apt-dpkg-wrap apt-get install -y jigasi jq jitsi-autoscaler-sidecar && \
diff --git a/jigasi/rootfs/defaults/sip-communicator.properties b/jigasi/rootfs/defaults/sip-communicator.properties
@@ -65,6 +65,10 @@ org.jitsi.jigasi.LOCAL_REGION={{ $JIGASI_LOCAL_REGION }}
 org.jitsi.jigasi.xmpp.acc.BOSH_URL_PATTERN={{ $BOSH_URL_PATTERN }}
 {{ end }}
 
+{{ if .Env.JIGASI_STATS_ID -}}
+org.jitsi.jigasi.STATS_ID={{ .Env.JIGASI_STATS_ID }}
+{{- end }}
+
 {{ if .Env.JIGASI_CONFIGURATION -}}
 {{ join "\n" (splitList "," .Env.JIGASI_CONFIGURATION | compact) }}
 {{ end -}}
diff --git a/jigasi/rootfs/usr/bin/init_jitsi_jigasi b/jigasi/rootfs/usr/bin/init_jitsi_jigasi
@@ -24,6 +24,9 @@ fi
 # set random jigasi nickname for the instance if is not set
 [ -z "${JIGASI_INSTANCE_ID}" ] && export JIGASI_INSTANCE_ID="jigasi-$(date +%N)"
 
+# set stats id for the instance
+[ -z "${JIGASI_STATS_ID}" ] && export JIGASI_STATS_ID="$JIGASI_INSTANCE_ID"
+
 # check for AUTOSCALER_URL, AUTOSCALER_SIDECAR_KEY_FILE and AUTOSCALER_SIDECAR_KEY_ID as indicator that sidecar should be enabled
 if [ -n "$AUTOSCALER_URL" ]; then
     if [ -z "$AUTOSCALER_SIDECAR_KEY_FILE" ]; then
diff --git a/prosody/Dockerfile b/prosody/Dockerfile
@@ -27,7 +27,7 @@ LABEL org.opencontainers.image.url="https://prosody.im/"
 LABEL org.opencontainers.image.source="https://github.com/jitsi/docker-jitsi-meet"
 LABEL org.opencontainers.image.documentation="https://jitsi.github.io/handbook/"
 
-ARG VERSION_JITSI_CONTRIB_PROSODY_PLUGINS="20241017"
+ARG VERSION_JITSI_CONTRIB_PROSODY_PLUGINS="20250426"
 ARG VERSION_MATRIX_USER_VERIFICATION_SERVICE_PLUGIN="1.8.0"
 ARG PROSODY_PACKAGE="prosody"
 
@@ -56,10 +56,6 @@ RUN set -x && \
     mv /usr/share/lua/5.3/inspect.lua /usr/share/lua/5.4/ && \
     rm -rf /usr/lib/lua/{5.1,5.2,5.3} && \
     rm -rf /usr/share/lua/{5.1,5.2,5.3} && \
-    wget -qO /prosody-plugins/mod_auth_cyrus.lua https://hg.prosody.im/prosody-modules/raw-file/65438e4ba563/mod_auth_cyrus/mod_auth_cyrus.lua && \
-    wget -qO /prosody-plugins/sasl_cyrus.lua https://hg.prosody.im/prosody-modules/raw-file/65438e4ba563/mod_auth_cyrus/sasl_cyrus.lua  && \
-    wget -qO /prosody-plugins/mod_http_health.lua https://hg.prosody.im/prosody-modules/raw-file/2b80188448d1/mod_http_health/mod_http_health.lua && \
-    wget -qO /prosody-plugins/mod_muc_moderation.lua https://hg.prosody.im/prosody-modules/raw-file/a58fb6a05412/mod_muc_moderation/mod_muc_moderation.lua && \
     wget https://github.com/matrix-org/prosody-mod-auth-matrix-user-verification/archive/refs/tags/v$VERSION_MATRIX_USER_VERIFICATION_SERVICE_PLUGIN.tar.gz && \
     tar -xf v$VERSION_MATRIX_USER_VERIFICATION_SERVICE_PLUGIN.tar.gz && \
     mv prosody-mod-auth-matrix-user-verification-$VERSION_MATRIX_USER_VERIFICATION_SERVICE_PLUGIN/mod_auth_matrix_user_verification.lua /prosody-plugins && \
diff --git a/prosody/rootfs/defaults/conf.d/jitsi-meet.cfg.lua b/prosody/rootfs/defaults/conf.d/jitsi-meet.cfg.lua
@@ -256,8 +256,11 @@ VirtualHost "{{ $XMPP_GUEST_DOMAIN }}"
         {{ if $ENABLE_XMPP_WEBSOCKET }}
         "smacks"; -- XEP-0198: Stream Management
         {{ end }}
+        {{ if .Env.XMPP_MODULES }}
+        "{{ join "\";\n        \"" (splitList "," .Env.XMPP_MODULES | compact) }}";
+        {{ end }}
     }
-
+    main_muc = "{{ $XMPP_MUC_DOMAIN }}"
     c2s_require_encryption = {{ $C2S_REQUIRE_ENCRYPTION }}
     {{ if $ENABLE_VISITORS }}
     allow_anonymous_s2s = true
@@ -309,6 +312,7 @@ Component "{{ $XMPP_MUC_DOMAIN }}" "muc"
     restrict_room_creation = true
     storage = "memory"
     modules_enabled = {
+        "muc_hide_all";
         "muc_meeting_id";
         {{ if .Env.XMPP_MUC_MODULES -}}
         "{{ join "\";\n        \"" (splitList "," .Env.XMPP_MUC_MODULES | compact) }}";
@@ -438,6 +442,7 @@ Component "lobby.{{ $XMPP_DOMAIN }}" "muc"
     muc_max_occupants = "{{ .Env.MAX_PARTICIPANTS }}"
     {{- end }}
     modules_enabled = {
+        "muc_hide_all";
         {{- if $ENABLE_RATE_LIMITS }}
         "muc_rate_limit";
         {{- end }}
@@ -461,6 +466,7 @@ Component "breakout.{{ $XMPP_DOMAIN }}" "muc"
     muc_tombstones = false
     muc_room_allow_persistent = false
     modules_enabled = {
+        "muc_hide_all";
         "muc_meeting_id";
         {{ if not $DISABLE_POLLS -}}
         "polls";
diff --git a/prosody/rootfs/prosody-plugins/mod_auth_cyrus.lua b/prosody/rootfs/prosody-plugins/mod_auth_cyrus.lua
@@ -0,0 +1,85 @@
+-- Prosody IM
+-- Copyright (C) 2008-2010 Matthew Wild
+-- Copyright (C) 2008-2010 Waqas Hussain
+--
+-- This project is MIT/X11 licensed. Please see the
+-- COPYING file in the source package for more information.
+--
+-- luacheck: ignore 212
+
+local log = require "util.logger".init("auth_cyrus");
+
+local usermanager_user_exists = require "core.usermanager".user_exists;
+
+local cyrus_service_realm = module:get_option("cyrus_service_realm");
+local cyrus_service_name = module:get_option("cyrus_service_name");
+local cyrus_application_name = module:get_option("cyrus_application_name");
+local require_provisioning = module:get_option("cyrus_require_provisioning") or false;
+local host_fqdn = module:get_option("cyrus_server_fqdn");
+
+prosody.unlock_globals(); --FIXME: Figure out why this is needed and
+						  -- why cyrussasl isn't caught by the sandbox
+local cyrus_new = module:require "sasl_cyrus".new;
+prosody.lock_globals();
+local new_sasl = function(realm)
+	return cyrus_new(
+		cyrus_service_realm or realm,
+		cyrus_service_name or "xmpp",
+		cyrus_application_name or "prosody",
+		host_fqdn
+	);
+end
+
+do -- diagnostic
+	local list;
+	for mechanism in pairs(new_sasl(module.host):mechanisms()) do
+		list = (not(list) and mechanism) or (list..", "..mechanism);
+	end
+	if not list then
+		module:log("error", "No Cyrus SASL mechanisms available");
+	else
+		module:log("debug", "Available Cyrus SASL mechanisms: %s", list);
+	end
+end
+
+local host = module.host;
+
+-- define auth provider
+local provider = {};
+log("debug", "initializing default authentication provider for host '%s'", host);
+
+function provider.test_password(username, password)
+	return nil, "Legacy auth not supported with Cyrus SASL.";
+end
+
+function provider.get_password(username)
+	return nil, "Passwords unavailable for Cyrus SASL.";
+end
+
+function provider.set_password(username, password)
+	return nil, "Passwords unavailable for Cyrus SASL.";
+end
+
+function provider.user_exists(username)
+	if require_provisioning then
+		return usermanager_user_exists(username, host);
+	end
+	return true;
+end
+
+function provider.create_user(username, password)
+	return nil, "Account creation/modification not available with Cyrus SASL.";
+end
+
+function provider.get_sasl_handler()
+	local handler = new_sasl(host);
+	if require_provisioning then
+		function handler.require_provisioning(username)
+			return usermanager_user_exists(username, host);
+		end
+	end
+	return handler;
+end
+
+module:provides("auth", provider);
+
diff --git a/prosody/rootfs/prosody-plugins/mod_http_health.lua b/prosody/rootfs/prosody-plugins/mod_http_health.lua
@@ -0,0 +1,39 @@
+module:set_global();
+
+local ip = require "util.ip";
+
+local modulemanager = require "core.modulemanager";
+
+local permitted_ips = module:get_option_set("http_health_allow_ips", { "::1", "127.0.0.1" });
+local permitted_cidr = module:get_option_string("http_health_allow_cidr");
+
+local function is_permitted(request)
+	local ip_raw = request.ip;
+	if permitted_ips:contains(ip_raw) or
+	   (permitted_cidr and ip.match(ip.new_ip(ip_raw), ip.parse_cidr(permitted_cidr))) then
+		return true;
+	end
+	return false;
+end
+
+module:provides("http", {
+	route = {
+		GET = function(event)
+			local request = event.request;
+			if not is_permitted(request) then
+				return 403; -- Forbidden
+			end
+
+			for host in pairs(prosody.hosts) do
+				local mods = modulemanager.get_modules(host);
+				for _, mod in pairs(mods) do
+					if mod.module.status_type == "error" then
+						return { status_code = 500; headers = { content_type = "text/plain" }; body = "HAS ERRORS\n" };
+					end
+				end
+			end
+
+			return { status_code = 200; headers = { content_type = "text/plain" }; body = "OK\n" };
+		end;
+	};
+});
diff --git a/prosody/rootfs/prosody-plugins/mod_muc_moderation.lua b/prosody/rootfs/prosody-plugins/mod_muc_moderation.lua
diff --git a/prosody/rootfs/prosody-plugins/sasl_cyrus.lua b/prosody/rootfs/prosody-plugins/sasl_cyrus.lua
diff --git a/transcriber.yml b/transcriber.yml
diff --git a/web/rootfs/defaults/settings-config.js b/web/rootfs/defaults/settings-config.js
