terraform-aws-jitsi

This repository contains Terraform code to create an Jitsi Meet instance on AWS backed by an RDS Aurora Serverless database for authentication.

Terraform Module:

https://registry.terraform.io/modules/hajowieland/aws/jitsi/

Blog Post:

https://napo.io/posts/jitsi-on-aws-with-terraform/

Table of Contents

• Prerequisites
• Features
• Usage
  • Cross-Account
  • Single-Account
  • Add authenticated Users
• Notes
• Links
• Changelog
• TODO

Prerequisites

You need the following before deploying this Terraform module:

1. AWS Account and IAM Role to deploy these AWS resources
2. Route53 Public Hosted Zone
3. Route53 Private Hosted Zone
4. OPTIONAL: If your Route53 zones are in a different AWS Account, the IAM Role in this account to create records in the above zones.

Features

• ✅ Jitsi Meet (Ubuntu 18.04)
  • ✅ Authentication (Users need to be authenticated to create new conferences) + Guest access (can only join existing conferences)
  • ✅ LetsEncrypt certificate for HTTPS
  • ✅ Collaborative working on a shared document during Jitsi conference (etherpad-lite)
  • ✅ SQL Database for Jitsi authorized accounts
• ✅ Aurora Serverless
  • ✅ MySQL
  • ✅ Can scale down to 0 to reduce costs
  • ❌ PostgreSQL (can't yet scale down to zero)
• ✅ AutoScalingGroup
  • ✅ ASG notifications (+ SNS Topic)
  • ❌ Mulitple EC2 instances (ASG > 1)
• ✅ CloudWatch Logs (+ CloudWatch Agent)
• ✅ Route53 Public & Private records
  • ✅ OPTIONAL: Cross-Account for Public & Private records
• SecurityGroup
  • ✅ Allow SSH by workstation IPv4 (can be disabled)
  • ✅ Add other allowed IPv4 CIDRs for SSH
  • ✅ Restrict Jitsi access CIDRs (Default: not restricted)
• ✅ OPTIONAL: AWS Key Pair (Default: true)
• ✅ OPTIONAL: SSM Parameters for AWS Key Pair (Default: true)
• ✅ OPTIONAL: Automatic EBS Snapshots via Data Lifecycle Manager (Default: true)

Usage

MySQL with cross-account

✔ Cross-account for Route53 records

✔ Allow additional CIDRs (+ your workstation's IPV4 CIDR) for SSH access

module "jitsi" {
  source  = "hajowieland/jitsi/aws"
  version = "1.0.0"

  aws_region = "eu-central-1"

  name   = "jitsi-meet"
  host   = "meet"
  domain = "example.com" # should match public and private hosted zone
  # will result in FQDN => meet.example.com

  ec2_instance_type = "t3a.large"
  vpc_id            = "vpc-123"
  public_subnet_ids = ["subnet-id-1", "subnet-id-2", "subnet-id-3"]
  
  # If the Route53 zones are in a different AWS Account:
  enable_cross_account = "1"
  arn_role             = "arn:aws:iam::other-account-id:role/route53-jitsi-other-account"

  public_zone_id  = "Z0123publiczone"
  private_zone_id = "Z456privatezone
  
  letsencrypt_email = "[email protected]"

  # If you want to allow other SSH IPv4 CIDRs (in addition to your workstation's IPV4 address):
  ssh_cidrs = {
    "first-ip-to-allow"  = "127.0.0.1/32",
    "second-ip-to-allow" = "127.0.0.2/32"
  }
}

MySQL with one account

✔ Cross-account for Route53 records

✔ Only allow your workstation's IPV4 CIDR for SSH access

module "jitsi" {
  source     = "hajowieland/jitsi/aws"
  version    = "1.0.0"

  aws_region = "eu-west-1"

  name   = "jitsi-meet"
  host   = "meet"
  domain = "example.com" # should match public and private hosted zone
  # will result in FQDN => meet.example.com

  db_driver  = "postgresql" # Set this for Postgres

  ec2_instance_type = "t3a.medium"
  vpc_id            = "vpc-123"
  public_subnet_ids = ["subnet-id-1", "subnet-id-2", "subnet-id-3"]
  
  public_zone_id  = "Z0819publiczone"
  private_zone_id = "Z134rivatezone
  
  letsencrypt_email = "[email protected]"
}

Add authenticated Users

To create a new user in Prosody which can create new conferences, ssh into the Jitsi instance and execute:

prosodyctl adduser newuser@<HOST>.<DOMAIN>

# Example
prosodyctl adduser [email protected]

Notes

• ↪️ The Jitsi instance can be terminated at any time (AutoScalingGroup will then start a fresh new instance, but the authorized users in the SQL database will retain)
• 💰To reduce costs, you can stop the instance (e.g. with diodonfrost/lambda-scheduler-stop-start) - Aurora Serverless will then scale down to zero.
• If you do not specify a RDS DB Subnet Group (´var.db_subnet_group_name`), then the Aurora DB will be created in the same subnets as Jitsi (⚠️Public Subnets!)
• When you enable var.enable_cross_account you need to specify (var.arn_role) an IAM role in the AWS Account where the Public & Private Route53 Zones reside in. This role has to have the policy to allow route53:ChangeResourceRecordSets on the desired Route53 Zones.
• Route53 records will be created in UserData => during a terraform destroy these records have be deleted manually (see TODO)
• Only MySQL is supported at the moment, because PostgreSQL in Aurora-Serverless can not scale down to zero

Links

• https://github.com/jitsi/jitsi-meet/blob/master/doc/quick-install.md
• https://aws.amazon.com/blogs/opensource/getting-started-with-jitsi-an-open-source-web-conferencing-solution/

Changelog

• 08/02/2021: v1.1.0 (Thanks @leonardehrenfried )
• 19/04/2020: Initial commit 🚀

TODO

• Enable SG restriction of IPv6 subnets, too
• Enable Clustering with multiple jvb-videobridges for high availability and load balancing
• Aurora optional so user can provide pre-existing Aurora DB
• Add PostgreSQL even if it does not support scaling down to zero
• Create Terraform null_resource for destroy to delete Route53 records

Requirements

Providers

Inputs

[
  "GroupMinSize",
  "GroupMaxSize",
  "GroupDesiredCapacity",
  "GroupInServiceInstances",
  "GroupPendingInstances",
  "GroupStandbyInstances",
  "GroupTerminatingInstances",
  "GroupTotalInstances"
]

{
  "ALL-IPv4": "0.0.0.0/0"
}

{
  "Module": "terraform-aws-jitsi",
  "Project": "Jitsi"
}

{
  "SnapshotCreator": "DLM"
}

Outputs