Jitsi Meet Docker Setup Guide with NGINX & Certbot

Jitsi Meet Docker Setup Guide with NGINX & Certbot

This guide helps you deploy Jitsi Meet using Docker, with NGINX reverse proxy, SSL via Certbot, and full .env configuration. 🔒 Secure your video conferencing server under our sample DNS [https://jitsi.example.com.](https://jitsi.example.com.)

📦 Prerequisites

• Ubuntu 20.04+ (or Debian-based)
• Root or sudo access
• Domain name pointing to your server (e.g., jitsi.example.com)
• Docker and Docker Compose

🐳 Step 1: Clone the Jitsi Docker Repository

# Download and extract the latest release. DO NOT clone the git repository. See below if you are interested in running test images:
wget $(curl -s https://api.github.com/repos/jitsi/docker-jitsi-meet/releases/latest | grep 'zip' | cut -d\" -f4)

# unzip <filename>

# Create a .env file by copying and adjusting env.example:
cp env.example .env

🛠️ Step 2: Configure .env File

Edit .env file and configure following fields:

# Docker ports (local)
HTTP_PORT=8000
HTTPS_PORT=8443

# Public domain
PUBLIC_URL=https://jitsi.example.com

# Authentication
ENABLE_AUTH=0
ENABLE_GUESTS=1

# Local config directory
CONFIG=~/.jitsi-meet-cfg

# Timezone
TZ=Asia/Ashgabat

One important thing to note! 🧩 I’m routing 8443 as HTTPS INSIDE DOCKER CONTAINER, and I’m using default HTTPS 443 as a Public URL for NGINX routing and app public access.

🔐 Generate Strong Passwords

This script populates the .env with secure secrets for internal services.

./gen-passwords.sh

Create required CONFIG directories

#    For linux:

mkdir -p ~/.jitsi-meet-cfg/{web,transcripts,prosody/config,prosody/prosody-plugins-custom,jicofo,jvb,jigasi,jibri}

#    For Windows:

echo web,transcripts,prosody/config,prosody/prosody-plugins-custom,jicofo,jvb,jigasi,jibri
mkdir "~/.jitsi-meet-cfg/$_"

🚀 Step 3: Start the Jitsi Docker Containers

docker compose up -d

Jitsi will now run internally on:

• [http://localhost:8000](http://localhost:8000)
• [https://localhost:8443](https://localhost:8443)

🌐 Step 4: Configure NGINX for Reverse Proxy

📄 Create NGINX Config File

Path: /etc/nginx/sites-available/jitsi.example.com

# Required for WebSocket support
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    server_name jitsi.example.com;    
    location / {
        proxy_pass http://localhost:8000;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
    }

    # XMPP WebSocket
    location /xmpp-websocket {
        proxy_pass http://localhost:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        tcp_nodelay on;
    }

    # Colibri WebSocket (for video)
    location /colibri-ws {
        proxy_pass http://localhost:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        tcp_nodelay on;
    }

    location /http-bind {
        proxy_pass http://localhost:8000;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
    }
}

🔗 Enable Site

sudo ln -s /etc/nginx/sites-available/jitsi.example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

🔐 Step 5 (optional): Install SSL via Certbot

Install Certbot:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

Issue the certificate:

sudo certbot --nginx -d jitsi.example.com

🔁 To auto-renew SSL:

sudo crontab -e

Add this line:

0 3 * * * /usr/bin/certbot renew --quiet

Final NGINX Configuration file example:

# Required for WebSocket support
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl;
    server_name jitsi.example.com;

    ssl_certificate /etc/ssl/fullchain.pem;
    ssl_certificate_key /etc/ssl/privkey.pem;

    # # if you use letsencrypt:
    # include /etc/letsencrypt/options-ssl-nginx.conf;
    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    # SSL Settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # Jitsi Meet
    location / {
        proxy_pass http://localhost:8000;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
    }

    # XMPP WebSocket
    location /xmpp-websocket {
        proxy_pass http://localhost:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        tcp_nodelay on;
    }

    # Colibri WebSocket (for video)
    location /colibri-ws {
        proxy_pass http://localhost:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        tcp_nodelay on;
    }

    location /http-bind {
        proxy_pass http://localhost:8000;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
    }
}

server {
    if ($host = jitsi.example.com) {
        return 301 https://$host$request_uri;
    }
    server_name jitsi.example.com;
    listen 80;
    return 404;
}

✅ Step 6: Access Jitsi Meet

Visit your domain:

👉 **https://jitsi.example.com**

You should see the Jitsi Meet interface, ready to create or join meetings.

🔧 Tips

To update Jitsi:

git pull
docker compose pull
docker compose up -d

To stop Jitsi:

docker compose down

Your configuration data lives in ~/.jitsi-meet-cfg.

🧠 Troubleshooting

🛑 “502 Bad Gateway”: Ensure Docker containers are running, and proxy is correctly set. 🔒 SSL fails: DNS must point to the server IP, and ports 80/443 must be open. 📞 Audio/Video issues: Open UDP port 10000 (Jitsi Videobridge) "sudo ufw allow 10000/udp"

🌐 Firewall Notes (UFW)

sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw allow 10000/udp
sudo ufw enable

🏁 Summary

✅ Docker-based Jitsi instance ✅ Public domain with SSL ✅ Easy access at https://jitsi.example.com

Good luck in setting up stuff! Leave a comment if you find it helpful!