jitsi Meet

[ahmaddxb]

I'm having an issue getting jitsi working going through traefik. I can go to the URL externally but it doesn't allow me to use microphone and camera.

I have tested jitsi running through nginx proxy manager to rule out any configuration problems and it is working as expected.

Any help would be appreciated, Ive been trying to figure where I'm going wrong.

Below is my config

[ahmaddxb]

version: "3.9"

########################### NETWORKS
# There is no need to create any networks outside this docker-compose file.
# You may customize the network subnets (192.168.90.0/24 and 91.0/24) below as you please.
# Docker Compose version 3.5 or higher required to define networks this way.

networks:
  t2_proxy:
    name: t2_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.90.0/24
  default:
    driver: bridge
  socket_proxy:
    name: socket_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.91.0/24
  nextcloud:
    name: nextcloud
    driver: bridge
  meet.jitsi:
    name: meet.jitsi
########################### SECRETS

secrets:
  authelia_jwt_secret:
    file: $DOCKERDIR/docker/secrets/authelia_jwt_secret
  authelia_session_secret:
    file: $DOCKERDIR/docker/secrets/authelia_session_secret
  authelia_storage_mysql_password:
    file: $DOCKERDIR/docker/secrets/authelia_storage_mysql_password
  authelia_notifier_smtp_password:
    file: $DOCKERDIR/docker/secrets/authelia_notifier_smtp_password
  authelia_duo_api_secret_key:
    file: $DOCKERDIR/docker/secrets/authelia_duo_api_secret_key
  mysql_root_password:
    file: $DOCKERDIR/docker/secrets/mysql_root_password
  db_password:
    file: $DOCKERDIR/docker/secrets/db_password
  db_root_password:
    file: $DOCKERDIR/docker/secrets/db_root_password
########################### SERVICES
services:
  ############################# FRONTENDS

  # Traefik 2 - Reverse Proxy
  # Touch (create empty files) traefik.log and acme/acme.json. Set acme.json permissions to 600.
  # touch $DOCKERDIR/traefik2/acme/acme.json
  # chmod 600 $DOCKERDIR/traefik2/acme/acme.json
  # touch $DOCKERDIR/traefik2/traefik.log
  traefik:
    container_name: traefik
    image: traefik:2.5 # brie v2.5.x livarot v2.4.x # picodon v2.3.x
    restart: always
    hostname: traefik
    logging:
      driver: "json-file"
      options:
        max-size: 300m
    # profiles:
    # - core
    command: # CLI arguments
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=true
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      # Allow these IPs to set the X-Forwarded-* headers - Cloudflare IPs: https://www.cloudflare.com/ips/
      - --entrypoints.https.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
      - --entryPoints.traefik.address=:8080
      # - --entryPoints.ping.address=:8081
      - --api=true
      # - --api.insecure=true
      - --api.dashboard=true
      #- --ping=true
      - --pilot.token=$TRAEFIK_PILOT_TOKEN
      - --serversTransport.insecureSkipVerify=true
#      - --global.insecureSNI=true     ## Removed from v2.2.5  
      - --log=true
      - --log.level=WARN # (Default: error) DEBUG, INFO, WARN, ERROR, FATAL, PANIC
      - --accessLog=true
      - --accessLog.filePath=/traefik.log
      - --accessLog.bufferingSize=100 # Configuring a buffer of 100 lines
      - --accessLog.filters.statusCodes=400-499
      - --providers.docker=true
      # - --providers.docker.endpoint=unix:///var/run/docker.sock # Use Docker Socket Proxy instead for improved security
      - --providers.docker.endpoint=tcp://socket-proxy:2375
      # Automatically set Host rule for services
      # - --providers.docker.defaultrule=Host(`{{ index .Labels "com.docker.compose.service" }}.$DOMAINNAME0`)
      - --providers.docker.exposedByDefault=false
      # - --entrypoints.https.http.middlewares=chain-oauth@file
      - --entrypoints.https.http.tls.options=tls-opts@file
      # Add dns-cloudflare as default certresolver for all services. Also enables TLS and no need to specify on individual services
      - --entrypoints.https.http.tls.certresolver=dns-cloudflare
      - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME0
      - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME0
      # - --entrypoints.https.http.tls.domains[1].main=$DOMAINNAME1 # Pulls main cert for second domain
      # - --entrypoints.https.http.tls.domains[1].sans=*.$DOMAINNAME1 # Pulls wildcard cert for second domain
      - --providers.docker.network=t2_proxy
      - --providers.docker.swarmMode=false
      - --providers.file.directory=/rules # Load dynamic configuration from one or more .toml or .yml files in a directory
      # - --providers.file.filename=/path/to/file # Load dynamic configuration from a file
      - --providers.file.watch=true # Only works on top level files in the rules folder
      # - --certificatesResolvers.dns-cloudflare.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory # LetsEncrypt Staging Server - uncomment when testing
      - --certificatesResolvers.dns-cloudflare.acme.email=$CLOUDFLARE_EMAIL
      - --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.delayBeforeCheck=90 # To delay DNS check and reduce LE hitrate
    networks:
      t2_proxy:
        ipv4_address: 192.168.90.254 # You can specify a static IP
      socket_proxy:
    security_opt:
      - no-new-privileges:true
    #healthcheck:
    #  test: ["CMD", "traefik", "healthcheck", "--ping"]
    #  interval: 5s
    #  retries: 3
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      # - target: 8080
      #   published: 8080
      #   protocol: tcp
      #   mode: host
    volumes:
      - $DOCKERDIR/docker/traefik2/rules:/rules 
      # - /var/run/docker.sock:/var/run/docker.sock:ro # Use Docker Socket Proxy instead for improved security
      - $DOCKERDIR/docker/traefik2/acme/acme.json:/acme.json 
      - $DOCKERDIR/docker/traefik2/traefik.log:/traefik.log 
      - $DOCKERDIR/docker/shared:/shared
    environment:
      - CF_API_EMAIL=$CLOUDFLARE_EMAIL
      - CF_API_KEY=$CLOUDFLARE_API_KEY
    labels:
      #- "autoheal=true"
      - "traefik.enable=true"
      # HTTP-to-HTTPS Redirect
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # HTTP Routers
      - "traefik.http.routers.traefik-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME0`)"
      # - "traefik.http.routers.traefik-rtr.tls=true"
#      - "traefik.http.routers.traefik-rtr.tls.certresolver=dns-cloudflare" # Comment out this line after first run of traefik to force the use of wildcard certs
#      - "traefik.http.routers.traefik-rtr.tls.domains[0].main=$DOMAINNAME"
#      - "traefik.http.routers.traefik-rtr.tls.domains[0].sans=*.$DOMAINNAME"
#      - "traefik.http.routers.traefik-rtr.tls.domains[1].main=$SECONDDOMAINNAME" # Pulls main cert for second domain
#      - "traefik.http.routers.traefik-rtr.tls.domains[1].sans=*.$SECONDDOMAINNAME" # Pulls wildcard cert for second domain
      ## Services - API
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      ## Healthcheck/ping
      #- "traefik.http.routers.ping.rule=Host(`traefik.$DOMAINNAME0`) && Path(`/ping`)"
      #- "traefik.http.routers.ping.tls=true"
      #- "traefik.http.routers.ping.service=ping@internal"
      ## Middlewares
      - "traefik.http.routers.traefik-rtr.middlewares=chain-oauth@file"
# Flame labels
      - flame.type=application # "app" works too
      - flame.name=Traefik
      - flame.url=https://traefik.$DOMAINNAME0
      - flame.icon=https://raw.githubusercontent.com/walkxcode/dashboard-icons/master/png/traefik.png
    # - flame.icon=custom to make changes in app. ie: custom icon upload

  # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
  socket-proxy:
    container_name: socket-proxy
    image: tecnativa/docker-socket-proxy
    restart: always
    # profiles:
    # - core
    networks:
      socket_proxy:
        ipv4_address: 192.168.91.254 # You can specify a static IP
    privileged: true
    #ports:
    # - "127.0.0.1:2375:2375" # Port 2375 should only ever get exposed to the internal network. When possible use this line.
    # I use the next line instead, as I want portainer to manage multiple docker endpoints within my home network.
    # - "2375:2375"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg
      ## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
      # 0 to revoke access.
      # 1 to grant access.
      ## Granted by Default
      - EVENTS=1
      - PING=1
      - VERSION=1
      ## Revoked by Default
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=1 # Ouroboros
      # Not always needed
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - CONTAINERS=1 # Traefik, portainer, etc.
      - DISTRIBUTION=0
      - EXEC=0
      - IMAGES=1 # Portainer
      - INFO=1 # Portainer
      - NETWORKS=1 # Portainer
      - NODES=0
      - PLUGINS=0
      - SERVICES=1 # Portainer
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=1 # Portaienr
      - VOLUMES=1 # Portainer

    # Frontend
  web:
    image: jitsi/web:stable-6433
    restart: ${RESTART_POLICY}
    ports:
        - '${HTTP_PORT}:80'
        - '${HTTPS_PORT}:443'
    volumes:
        - ${CONFIG}/web:/config:Z
        - ${CONFIG}/web/crontabs:/var/spool/cron/crontabs:Z
        - ${CONFIG}/transcripts:/usr/share/jitsi-meet/transcripts:Z
    environment:
        - AMPLITUDE_ID
        - ANALYTICS_SCRIPT_URLS
        - ANALYTICS_WHITELISTED_EVENTS
        - CALLSTATS_CUSTOM_SCRIPT_URL
        - CALLSTATS_ID
        - CALLSTATS_SECRET
        - CHROME_EXTENSION_BANNER_JSON
        - CONFCODE_URL
        - CONFIG_EXTERNAL_CONNECT
        - DEFAULT_LANGUAGE
        - DEPLOYMENTINFO_ENVIRONMENT
        - DEPLOYMENTINFO_ENVIRONMENT_TYPE
        - DEPLOYMENTINFO_REGION
        - DEPLOYMENTINFO_SHARD
        - DEPLOYMENTINFO_USERREGION
        - DESKTOP_SHARING_FRAMERATE_MIN
        - DESKTOP_SHARING_FRAMERATE_MAX
        - DIALIN_NUMBERS_URL
        - DIALOUT_AUTH_URL
        - DIALOUT_CODES_URL
        - DISABLE_AUDIO_LEVELS
        - DISABLE_DEEP_LINKING
        - DISABLE_HTTPS
        - DISABLE_POLLS
        - DISABLE_REACTIONS
        - DROPBOX_APPKEY
        - DROPBOX_REDIRECT_URI
        - DYNAMIC_BRANDING_URL
        - ENABLE_AUDIO_PROCESSING
        - ENABLE_AUTH
        - ENABLE_CALENDAR
        - ENABLE_COLIBRI_WEBSOCKET
        - ENABLE_FILE_RECORDING_SERVICE
        - ENABLE_FILE_RECORDING_SERVICE_SHARING
        - ENABLE_FLOC
        - ENABLE_GUESTS
        - ENABLE_HSTS
        - ENABLE_HTTP_REDIRECT
        - ENABLE_IPV6
        - ENABLE_LETSENCRYPT
        - ENABLE_LIPSYNC
        - ENABLE_NO_AUDIO_DETECTION
        - ENABLE_NOISY_MIC_DETECTION
        - ENABLE_PREJOIN_PAGE
        - ENABLE_P2P
        - ENABLE_WELCOME_PAGE
        - ENABLE_CLOSE_PAGE
        - ENABLE_RECORDING
        - ENABLE_REMB
        - ENABLE_REQUIRE_DISPLAY_NAME
        - ENABLE_SIMULCAST
        - ENABLE_STATS_ID
        - ENABLE_STEREO
        - ENABLE_SUBDOMAINS
        - ENABLE_TALK_WHILE_MUTED
        - ENABLE_TCC
        - ENABLE_TRANSCRIPTIONS
        - ENABLE_XMPP_WEBSOCKET
        - ETHERPAD_PUBLIC_URL
        - ETHERPAD_URL_BASE
        - GOOGLE_ANALYTICS_ID
        - GOOGLE_API_APP_CLIENT_ID
        - INVITE_SERVICE_URL
        - JICOFO_AUTH_USER
        - LETSENCRYPT_DOMAIN
        - LETSENCRYPT_EMAIL
        - LETSENCRYPT_USE_STAGING
        - MATOMO_ENDPOINT
        - MATOMO_SITE_ID
        - MICROSOFT_API_APP_CLIENT_ID
        - NGINX_RESOLVER
        - NGINX_WORKER_PROCESSES
        - NGINX_WORKER_CONNECTIONS
        - PEOPLE_SEARCH_URL
        - PUBLIC_URL
        - P2P_PREFERRED_CODEC
        - RESOLUTION
        - RESOLUTION_MIN
        - RESOLUTION_WIDTH
        - RESOLUTION_WIDTH_MIN
        - START_AUDIO_MUTED
        - START_AUDIO_ONLY
        - START_BITRATE
        - START_SILENT
        - START_WITH_AUDIO_MUTED
        - START_VIDEO_MUTED
        - START_WITH_VIDEO_MUTED
        - TESTING_CAP_SCREENSHARE_BITRATE
        - TESTING_OCTO_PROBABILITY
        - TOKEN_AUTH_URL
        - TZ
        - VIDEOQUALITY_BITRATE_H264_LOW
        - VIDEOQUALITY_BITRATE_H264_STANDARD
        - VIDEOQUALITY_BITRATE_H264_HIGH
        - VIDEOQUALITY_BITRATE_VP8_LOW
        - VIDEOQUALITY_BITRATE_VP8_STANDARD
        - VIDEOQUALITY_BITRATE_VP8_HIGH
        - VIDEOQUALITY_BITRATE_VP9_LOW
        - VIDEOQUALITY_BITRATE_VP9_STANDARD
        - VIDEOQUALITY_BITRATE_VP9_HIGH
        - VIDEOQUALITY_ENFORCE_PREFERRED_CODEC
        - VIDEOQUALITY_PREFERRED_CODEC
        - XMPP_AUTH_DOMAIN
        - XMPP_BOSH_URL_BASE
        - XMPP_DOMAIN
        - XMPP_GUEST_DOMAIN
        - XMPP_MUC_DOMAIN
        - XMPP_RECORDER_DOMAIN
    networks:
        meet.jitsi:
        t2_proxy:
    labels:
        - "traefik.enable=true"
        ## HTTP Routers
        - "traefik.http.routers.meet-rtr.entrypoints=https"
        - "traefik.http.routers.meet-rtr.rule=Host(`meet.$DOMAINNAME0`)"
        ## Middlewares
        - "traefik.http.routers.meet-rtr.middlewares=chain-no-auth@file" # No Authentication
#              - "traefik.http.routers.nextcloud-rtr.middlewares=chain-basic-auth@file" # Basic Authentication
#            - "traefik.http.routers.meet-rtr.middlewares=chain-oauth@file" # Google OAuth 2.0
        ## HTTP Services
        - "traefik.http.routers.meet-rtr.service=meet-svc"
        - "traefik.http.services.meet-svc.loadbalancer.server.port=80"
# XMPP server
  prosody:
    image: jitsi/prosody:stable-6433
    restart: ${RESTART_POLICY}
    expose:
        - '5222'
        - '5347'
        - '5280'
    volumes:
        - ${CONFIG}/prosody/config:/config:Z
        - ${CONFIG}/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
    environment:
        - AUTH_TYPE
        - DISABLE_POLLS
        - ENABLE_AUTH
        - ENABLE_AV_MODERATION
        - ENABLE_GUESTS
        - ENABLE_LOBBY
        - ENABLE_XMPP_WEBSOCKET
        - GLOBAL_CONFIG
        - GLOBAL_MODULES
        - JIBRI_RECORDER_USER
        - JIBRI_RECORDER_PASSWORD
        - JIBRI_XMPP_USER
        - JIBRI_XMPP_PASSWORD
        - JICOFO_AUTH_USER
        - JICOFO_AUTH_PASSWORD
        - JICOFO_COMPONENT_SECRET
        - JIGASI_XMPP_USER
        - JIGASI_XMPP_PASSWORD
        - JVB_AUTH_USER
        - JVB_AUTH_PASSWORD
        - JWT_APP_ID
        - JWT_APP_SECRET
        - JWT_ACCEPTED_ISSUERS
        - JWT_ACCEPTED_AUDIENCES
        - JWT_ASAP_KEYSERVER
        - JWT_ALLOW_EMPTY
        - JWT_AUTH_TYPE
        - JWT_TOKEN_AUTH_MODULE
        - LOG_LEVEL
        - LDAP_AUTH_METHOD
        - LDAP_BASE
        - LDAP_BINDDN
        - LDAP_BINDPW
        - LDAP_FILTER
        - LDAP_VERSION
        - LDAP_TLS_CIPHERS
        - LDAP_TLS_CHECK_PEER
        - LDAP_TLS_CACERT_FILE
        - LDAP_TLS_CACERT_DIR
        - LDAP_START_TLS
        - LDAP_URL
        - LDAP_USE_TLS
        - PUBLIC_URL
        - TURN_CREDENTIALS
        - TURN_HOST
        - TURNS_HOST
        - TURN_PORT
        - TURNS_PORT
        - TZ
        - XMPP_DOMAIN
        - XMPP_AUTH_DOMAIN
        - XMPP_GUEST_DOMAIN
        - XMPP_MUC_DOMAIN
        - XMPP_INTERNAL_MUC_DOMAIN
        - XMPP_MODULES
        - XMPP_MUC_MODULES
        - XMPP_INTERNAL_MUC_MODULES
        - XMPP_RECORDER_DOMAIN
        - XMPP_CROSS_DOMAIN
    networks:
        t2_proxy:
        meet.jitsi:
            aliases:
                - ${XMPP_SERVER}

# Focus component
  jicofo:
    image: jitsi/jicofo:stable-6433
    restart: ${RESTART_POLICY}
    volumes:
        - ${CONFIG}/jicofo:/config:Z
    environment:
        - AUTH_TYPE
        - BRIDGE_AVG_PARTICIPANT_STRESS
        - BRIDGE_STRESS_THRESHOLD
        - ENABLE_AUTH
        - ENABLE_AUTO_OWNER
        - ENABLE_CODEC_VP8
        - ENABLE_CODEC_VP9
        - ENABLE_CODEC_H264
        - ENABLE_OCTO
        - ENABLE_RECORDING
        - ENABLE_SCTP
        - ENABLE_AUTO_LOGIN
        - JICOFO_AUTH_USER
        - JICOFO_AUTH_PASSWORD
        - JICOFO_ENABLE_BRIDGE_HEALTH_CHECKS
        - JICOFO_CONF_INITIAL_PARTICIPANT_WAIT_TIMEOUT
        - JICOFO_CONF_SINGLE_PARTICIPANT_TIMEOUT
        - JICOFO_ENABLE_HEALTH_CHECKS
        - JICOFO_SHORT_ID
        - JICOFO_RESERVATION_ENABLED 
        - JICOFO_RESERVATION_REST_BASE_URL 
        - JIBRI_BREWERY_MUC
        - JIBRI_REQUEST_RETRIES
        - JIBRI_PENDING_TIMEOUT
        - JIGASI_BREWERY_MUC
        - JIGASI_SIP_URI
        - JVB_BREWERY_MUC
        - MAX_BRIDGE_PARTICIPANTS
        - OCTO_BRIDGE_SELECTION_STRATEGY
        - SENTRY_DSN="${JICOFO_SENTRY_DSN:-0}"
        - SENTRY_ENVIRONMENT
        - SENTRY_RELEASE
        - TZ
        - XMPP_DOMAIN
        - XMPP_AUTH_DOMAIN
        - XMPP_INTERNAL_MUC_DOMAIN
        - XMPP_MUC_DOMAIN
        - XMPP_SERVER
    depends_on:
        - prosody
    networks:
        meet.jitsi:
        t2_proxy:

# Video bridge
  jvb:
    image: jitsi/jvb:stable-6433
    restart: ${RESTART_POLICY}
    ports:
        - '${JVB_PORT}:${JVB_PORT}/udp'
        - '${JVB_TCP_PORT}:${JVB_TCP_PORT}'
    volumes:
        - ${CONFIG}/jvb:/config:Z
    environment:
        - DOCKER_HOST_ADDRESS
        - ENABLE_COLIBRI_WEBSOCKET
        - ENABLE_OCTO
        - JVB_AUTH_USER
        - JVB_AUTH_PASSWORD
        - JVB_BREWERY_MUC
        - JVB_PORT
        - JVB_TCP_HARVESTER_DISABLED
        - JVB_TCP_PORT
        - JVB_TCP_MAPPED_PORT
        - JVB_STUN_SERVERS
        - JVB_ENABLE_APIS
        - JVB_OCTO_BIND_ADDRESS
        - JVB_OCTO_PUBLIC_ADDRESS
        - JVB_OCTO_BIND_PORT
        - JVB_OCTO_REGION
        - JVB_WS_DOMAIN
        - JVB_WS_SERVER_ID
        - PUBLIC_URL
        - SENTRY_DSN="${JVB_SENTRY_DSN:-0}"
        - SENTRY_ENVIRONMENT
        - SENTRY_RELEASE
        - COLIBRI_REST_ENABLED
        - SHUTDOWN_REST_ENABLED
        - TZ
        - XMPP_AUTH_DOMAIN
        - XMPP_INTERNAL_MUC_DOMAIN
        - XMPP_SERVER
    depends_on:
        - prosody
    networks:
        meet.jitsi:
        t2_proxy:

middlewares.yml

http:
  middlewares:
    middlewares-basic-auth:
      basicAuth:
        # users:
        #   - "user:$apsdfs.$EntPC0w3FtswWvC/6fTVJ7IUVtX1"
        usersFile: "/shared/.htpasswd" #be sure to mount the volume through docker-compose.yml
        realm: "Traefik 2 Basic Auth"

    middlewares-rate-limit:
      rateLimit:
        average: 100
        burst: 50

    middlewares-secure-headers:
      headers:
        accessControlAllowMethods:
          - GET
          - OPTIONS
          - PUT
        accessControlMaxAge: 100
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        # sslRedirect: true #replaced with middlewares-https-redirectscheme for v2.5.x
        stsSeconds: 63072000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        # frameDeny: true #overwritten by customFrameOptionsValue
        customFrameOptionsValue: "allow-from https:mydomain.com" #CSP takes care of this but may be needed for organizr.
        contentTypeNosniff: true
        browserXssFilter: true
        # sslForceHost: true # add sslHost to all of the services
        # sslHost: "example.com"
        referrerPolicy: "same-origin"
        # Setting contentSecurityPolicy is more secure but it can break things. Proper auth will reduce the risk.
        # the below line also breaks some apps due to 'none' - sonarr, radarr, etc.
        # contentSecurityPolicy: "frame-ancestors '*.example.com:*';object-src 'none';script-src 'none';"
        # Line below, featurePolicy, was deprecated in v2.5.x in favor permissionPolicy
        # featurePolicy: "camera 'none'; geolocation 'none'; microphone 'none'; payment 'none'; usb 'none'; vr 'none';"
        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), vr=()"
        customResponseHeaders:
          X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex,"
          server: ""

    middlewares-oauth:
      forwardAuth:
        address: "http://oauth:4181" # Make sure you have the OAuth service in docker-compose.yml
        trustForwardHeader: true
        authResponseHeaders:
          - "X-Forwarded-User"

    middlewares-authelia:
      forwardAuth:
        address: "http://authelia:9091/api/verify?rd=https://authelia.mydomain.com"
        trustForwardHeader: true
        authResponseHeaders:
          - "Remote-User"
          - "Remote-Groups"

    middlewares-https-redirectscheme:
      redirectScheme:
        scheme: https
        permanent: true

middlewares-chains.yml

http:
  middlewares:
    chain-no-auth:
      chain:
        middlewares:
          - middlewares-rate-limit
          - middlewares-https-redirectscheme
          - middlewares-secure-headers

    chain-basic-auth:
      chain:
        middlewares:
          - middlewares-rate-limit
          - middlewares-https-redirectscheme
          - middlewares-secure-headers
          - middlewares-basic-auth

    chain-nextcloud:
      chain:
        middlewares:
          - middlewares-rate-limit
          - nextcloud-middlewares-secure-headers
          - nextcloud-redirect

    chain-oauth:
      chain:
        middlewares:
          - middlewares-rate-limit
          - middlewares-https-redirectscheme
          - middlewares-secure-headers
          - middlewares-oauth

    chain-authelia:
      chain:
        middlewares:
          - middlewares-rate-limit
          - middlewares-https-redirectscheme
          - middlewares-secure-headers
          - middlewares-authelia

tls-opts.yml

tls:
  options:
    tls-opts:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
        - TLS_AES_128_GCM_SHA256
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256
        - TLS_FALLBACK_SCSV # Client is doing version fallback. See RFC 7507
      curvePreferences:
        - CurveP521
        - CurveP384
      sniStrict: true

[Cartache]

Maybe a stupid remark: did you try with a network name without “.”? Not suite this is allowed

[ahmaddxb]

Maybe a stupid remark: did you try with a network name without “.”? Not suite this is allowed

Thanks for the suggestion, I did change it to meetjitsi and still same result.

meet.jitsi was what they used in their docker-compose I based it on.

[ahmaddxb]

After more test if i comment out the line below from the middlewares.yml it works fine.

# permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), vr=()"

[inquam]

Yes of, that line disallows the browser from using your microphone, camera etc. You might want to have that set though so one way is to create a specific middleware to use with Jitsi that allows camera and microphone.

[ahmaddxb]

That is what I have actually done now to fix my issue.

What I cant figure out is the use case for this. Would like an example where this would be wanted self hosting docker containers.

[inquam]

Since most people make some of their containers reachable from the Internet and most containers don't need these permissions it seems like a good default state to not allow them. The more things you have open and allowed the more potential attack vectors of any given system you might be exposing.