Step 1 – Verify Jitsi Meet Works

Your server’s IP address and root password are shown in the Server Information section on the Overview tab of your server in the client portal. Open https://your.server.ip in a browser. Your server gets a browser-trusted Let’s Encrypt certificate for its IP address on first boot, so the page opens without a warning. If the server is not reachable from the internet on port 80 (for example, behind a router), the certificate cannot be issued and the browser shows a warning for a self-signed certificate – in that case proceed to the site or connect a domain (Step 2).

On the Jitsi Meet welcome page:

1. Type a meeting name (e.g., “team-standup” or “project-review”)
2. Click Start meeting
3. Allow your browser to access the camera and microphone when prompted
4. Share the meeting link with participants – they can join directly from their browser without installing anything

Note: By default, anyone with the link can create and join meetings. No authentication is required. See the “Enabling Authentication” section below to restrict access.

If you placed the server behind a VyOS router on a private network, forward ports 22 (SSH), 80 (HTTP), 443 (HTTPS) and 10000/UDP (media) to the server on the router’s Configuration tab (Port forwarding). The UDP port is critical – without it, participants connect but have no audio or video. Behind the router the server has only a private address, so it does not get the IP certificate: point a domain to the router’s public address and set it up (Step 2) – on an address with a certificate warning, browsers may block the camera and microphone.

Firewall. If you turn on the Firewall for this server in the client portal, allow incoming TCP port 80 in its rules, along with 443 (HTTPS) and 10000/UDP (media). Certificates renew over port 80 – the IP certificate every few days – and without that rule the certificate expires and the browser starts showing a warning.

Step 2 – Set Up a Domain and SSL (Recommended)

Jitsi Meet works by IP address out of the box. To use a custom domain with a trusted SSL certificate, point your domain’s A record to your server IP, then connect via SSH and run:

ssh root@your.server.ip

/opt/setup/get-ssl.sh your-domain.com

The script will obtain a Let’s Encrypt certificate and reconfigure Jitsi Meet for the domain. After completion, access your instance at https://your-domain.com without any browser warnings. Automatic renewal is already configured.

Enabling Authentication

By default, anyone can create meetings on your server. To require authentication for meeting creators while still allowing guests to join via link, edit the Prosody configuration:

# Edit Prosody config
nano /etc/prosody/conf.avail/your-domain.cfg.lua

# Change authentication from "jitsi-anonymous" to "internal_hashed":
#   authentication = "internal_hashed"

# Add a guest VirtualHost at the end of the file:
#   VirtualHost "guest.your-domain"
#       authentication = "anonymous"
#       modules_enabled = { "turncredentials"; }
#       c2s_require_encryption = false

Update the Jitsi Meet config to enable the guest domain:

# Edit Jitsi Meet config
nano /etc/jitsi/meet/your-domain-config.js

# Uncomment or add the anonymousdomain line:
#   anonymousdomain: 'guest.your-domain',

Configure Jicofo and create an authenticated user:

# Edit Jicofo config - add inside jicofo { authentication { section:
nano /etc/jitsi/jicofo/jicofo.conf
#   enabled = true
#   type = XMPP
#   login-url = "your-domain"

# Create an authenticated user
prosodyctl register YOUR_USERNAME your-domain YOUR_PASSWORD

# Restart all services
systemctl restart prosody jicofo jitsi-videobridge2

Now only authenticated users can create meetings, while guests can still join via a shared link.

Customization

Common customizations in /etc/jitsi/meet/your-domain-config.js:

• Disable camera by default: startWithVideoMuted: true
• Disable microphone by default: startWithAudioMuted: true
• Set default language: defaultLanguage: 'en'
• Limit video streams: channelLastN: 20

After changes, restart the services: systemctl restart prosody jicofo jitsi-videobridge2 nginx

Firewall and Ports

Important: UDP port 10000 must be open for video and audio to work. If participants can connect but have no audio/video, check that this port is not blocked.

Fail2Ban – Brute-Force Protection

Your server comes with Fail2Ban pre-configured to protect SSH from brute-force attacks.

Useful commands:

# Check banned IPs
fail2ban-client status sshd

# Unban an IP
fail2ban-client set sshd unbanip 1.2.3.4

If you accidentally lock yourself out, open the Console on your server’s Overview tab in the client portal and unban your IP.

Service Management

# Check status of all Jitsi services
systemctl status prosody jicofo jitsi-videobridge2 nginx

# Restart all services
systemctl restart prosody jicofo jitsi-videobridge2 nginx

# View logs
journalctl -u jitsi-videobridge2 -f
journalctl -u jicofo -f
journalctl -u prosody -f

Updates

Jitsi Meet is installed from the official repository:

apt update && apt upgrade -y

It is recommended to take a snapshot before updating.

Software Included

• Jitsi Meet Handbook: jitsi.github.io/handbook
• Jitsi Community Forum: community.jitsi.org