How To Install Jitsi Meet on Ubuntu 18.04
Tags: linux, video, tutorial, webrtc
Published: 2020-04-27 15:03:27

---
title: How To Install Jitsi Meet on Ubuntu 18.04
published: true
description: In this tutorial, you will install and configure a Jitsi Meet, an open-source video-conferencing app, server on Ubuntu 18.04.
tags: linux, video, tutorial, webrtc
canonical_url: https://www.digitalocean.com/community/tutorials/how-to-install-jitsi-meet-on-ubuntu-18-04 
---
_The author selected the [Open Internet/Free Speech Fund](https://www.brightfunds.org/funds/open-internet-free-speech) to receive a donation as part of the [Write for DOnations](https://do.co/w4do-cta) program._

### Introduction

[Jitsi Meet](https://jitsi.org/jitsi-meet/) is an open-source video-conferencing application based on [WebRTC](https://en.wikipedia.org/wiki/WebRTC). A Jitsi Meet server provides multi-person video conference rooms that you can access using nothing more than your browser and provides comparable functionality to a Zoom or Skype conference call. The benefit of a Jitsi conference is that all your data only passes through your server, and the end-to-end TLS encryption ensures that no one can snoop on the call. With Jitsi you can be sure that your private information stays that way.

In this tutorial, you will install and configure a Jitsi Meet server on Ubuntu 18.04\. The default configuration allows anyone to create a new conference room. This is not ideal for a server that is publicly available on the internet so you will also configure Jitsi Meet so that only registered users can create new conference rooms. After you have created the conference room, any users can join, as long as they have the unique address and the optional password.

## Prerequisites

Before you begin this guide you’ll need the following:

*   One Ubuntu 18.04 server set up by following the [Initial Server Setup with Ubuntu 18.04](https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-18-04) tutorial, including a non-root sudo-enabled user. The size of the server you will need mostly depends on the available bandwidth and the number of participants you expect to be using the server. The following table will give you some idea of what is needed.
*   A domain name configured to point to your server. You can learn how to point domains to DigitalOcean Droplets by following the [How To Set Up a Host Name with DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-set-up-a-host-name-with-digitalocean) tutorial. Throughout this guide, the example domain name <span class="highlight">`jitsi.your-domain`</span> is used.

When you are choosing a server to run your Jitsi Meet instance you will need to consider the system resources needed to host conference rooms. The following benchmark information was collected from a single-core virtual machine using high-quality video settings:

![https://p78.f0.n0.cdn.getcloudapp.com/items/lluD2N2y/Image%202020-04-27%20at%2010.54.51%20AM.png?v=1b6db82c2d3cb9916f81c4529c9605e7](https://p78.f0.n0.cdn.getcloudapp.com/items/lluD2N2y/Image%202020-04-27%20at%2010.54.51%20AM.png?v=1b6db82c2d3cb9916f81c4529c9605e7)

The jump in resource use between two and three participants is because Jitsi will route the call data directly between the clients when there are two of them. When more than two clients are present then call data is routed through the Jitsi Meet server.

## Step 1 — Setting the System Hostname

In this step, you will change the system’s hostname to match the domain name that you intend to use for your Jitsi Meet instance and resolve that hostname to the localhost IP, `127.0.0.1`. Jitsi Meet uses both of these settings when it installs and generates its configuration files.

First, set the system’s hostname to the domain name that you will use for your Jitsi instance. The following command will set the current hostname and modify the `/etc/hostname` that holds the system’s hostname between reboots:

    sudo hostnamectl set-hostname jitsi.your-domain

The command that you ran breaks down as follows:

*   `hostnamectl` is a utility from the [systemd](https://www.digitalocean.com/community/tutorials/systemd-essentials-working-with-services-units-and-the-journal) tool suite to manage the system hostname.
*   `set-hostname` sets the system hostname.

Check that this was successful by running the following:

    hostname

This will return the hostname you set with the `hostnamectl` command:

    Output
    jitsi.your-domain

Next, you will set a local mapping of the server’s hostname to the loopback IP address, `127.0.0.1`. Do this by opening the `/etc/hosts` file with a text editor:

    sudo nano /etc/hosts

Then, add the following line:

    127.0.0.1 jitsi.your-domain

Mapping your Jitsi Meet server’s domain name to `127.0.0.1` allows your Jitsi Meet server to use several networked processes that accept local connections from each other on the `127.0.0.1` IP address. These connections are authenticated and encrypted with a TLS certificate, which is registered to your domain name. Locally mapping the domain name to `127.0.0.1` makes it possible to use the TLS certificate for these local network connections.

Save and exit your file.

Your server now has the hostname that Jitsi requires for installation. In the next step, you will open the firewall ports that are needed by Jitsi and the TLS certificate installer.

## Step 2 — Configuring the Firewall

When you followed the [Initial Server Setup with Ubuntu 18.04](https://www.digitalocean.com/community/tutorials/initial-server-setup-with-ubuntu-18-04) guide you enabled the UFW firewall and opened the SSH port. The Jitsi server needs some ports opened so that it can communicate with the call clients. Also, the TLS installation process needs to have a port open so that it can authenticate the certificate request.

The ports that you will open are the following:

*   `80/tcp` used in the TLS certificate request.
*   `443/tcp` used for the conference room creation web page.
*   `4443/tcp,10000/udp` used to transmit and receive the encrypted call traffic.

Run the following `ufw` commands to open these ports:

    sudo ufw allow 80/tcp
    sudo ufw allow 443/tcp
    sudo ufw allow 4443/tcp
    sudo ufw allow 10000/udp

Check that they were all added with the `ufw status` command:

    sudo ufw status

You will see the following output if these ports are open:

    Output
    Status: active

    To                         Action      From
    --                         ------      ----
    OpenSSH                    ALLOW       Anywhere
    80/tcp                     ALLOW       Anywhere
    443/tcp                    ALLOW       Anywhere
    4443/tcp                   ALLOW       Anywhere
    10000/udp                  ALLOW       Anywhere
    OpenSSH (v6)               ALLOW       Anywhere (v6)
    80/tcp (v6)                ALLOW       Anywhere (v6)
    443/tcp (v6)               ALLOW       Anywhere (v6)
    4443/tcp (v6)              ALLOW       Anywhere (v6)
    10000/udp (v6)             ALLOW       Anywhere (v6)

The server is now ready for the Jitsi installation, which you will complete in the next step.

## Step 3 — Installing Jitsi Meet

In this step, you will add the Jitsi stable repository to your server and then install the Jitsi Meet package from that repository. This will ensure that you are always running the latest stable Jitsi Meet package.

First, download the Jitsi GPG key with the `wget` downloading utility:

    wget https://download.jitsi.org/jitsi-key.gpg.key

The `apt` package manager will use this GPG key to validate the packages that you will download from the Jitsi repository.

Next, add the GPG key you downloaded to `apt`’s keyring using the `apt-key` utility:

    sudo apt-key add jitsi-key.gpg.key

You can now delete the GPG key file as it is no longer needed:

    rm jitsi-key.gpg.key

Now, you will add the Jitsi repository to your server by creating a new source file that contains the Jitsi repository. Open and create the new file with your editor:

    sudo nano /etc/apt/sources.list.d/jitsi-stable.list

Add this line to the file for the Jitsi repository:

    deb https://download.jitsi.org stable/

Save and exit your editor.

Finally, perform a system update to collect the package list from the Jitsi repository and then install the `jitsi-meet` package:

    sudo apt update
    sudo apt install jitsi-meet

During the installation of `jitsi-meet` you will be prompted to enter the domain name (for example, `jitsi.your-domain`) that you want to use for your Jitsi Meet instance.

![Image showing the jitsi-meet installation hostname dialog](https://assets.digitalocean.com/articles/jitsimeet1804/step3a.png)

**Note:** You move the cursor from the hostname field to highlight the **<OK>** button with the `TAB` key. Press `ENTER` when **<OK>** is highlighted to submit the hostname.

You will then be shown a new dialog box that asks if you want Jitsi to create and use a [self-signed](https://en.wikipedia.org/wiki/Self-signed_certificate) TLS certificate or use an existing one you already have:

![Image showing the jitsi-meet installation certificate dialog](https://assets.digitalocean.com/articles/jitsimeet1804/step3b.png)

If you do not have a TLS certificate for your Jitsi domain select the first, **Generate a new self-signed certificate**, option.

Your Jitsi Meet instance is now installed using a self-signed TLS certificate. This will cause browser warnings, so you will get a signed TLS certificate in the next step.

## Step 4 — Obtaining a Signed TLS Certificate

Jitsi Meet uses TLS certificates to encrypt the call traffic so that no one can listen to your call as it travels over the internet. TLS certificates are the same certificates that are used by websites to enable HTTPS URLs.

Jitsi Meet supplies a program to automatically download a TLS certificate for your domain name that uses the [Certbot](https://certbot.eff.org/) utility. You will need to install this program before you run the certificate installation script.

First, add the Certbot repository to your system to ensure that you have the latest version of Certbot. Run the following command to add the new repository and update your system:

    sudo add-apt-repository ppa:certbot/certbot

Next, install the `certbot` package:

    sudo apt install certbot

Your server is now ready to run the TLS certificate installation program provided by Jitsi Meet:

    sudo /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh

When you run the script you will be shown the following prompt for an email address:

    Output
    -------------------------------------------------------------------------
    This script will:
    - Need a working DNS record pointing to this machine(for domain jitsi.example.com)
    - Download certbot-auto from https://dl.eff.org to /usr/local/sbin
    - Install additional dependencies in order to request Let’s Encrypt certificate
    - If running with jetty serving web content, will stop Jitsi Videobridge
    - Configure and reload nginx or apache2, whichever is used
    - Configure the coturn server to use Let's Encrypt certificate and add required deploy hooks
    - Add command in weekly cron job to renew certificates regularly

    You need to agree to the ACME server's Subscriber Agreement (https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf)
    by providing an email address for important account notifications
    Enter your email and press [ENTER]:

This email address will be submitted to the certificate issuer [`https://letsencrypt.org`](https://letsencrypt.org/) and will be used to notify you about security and other matters related to the TLS certificate. You must enter an email address here to proceed with the installation. The installation will then complete without any further prompts.

When it finishes, your Jitsi Meet instance will be configured to use a signed TLS certificate for your domain name. Certificate renewals will also happen automatically because the installer placed a renewal script at `/etc/cron.weekly/letsencrypt-renew` that will run each week.

The TLS installer used port `80` to verify you had control of your domain name. Now that you have obtained the certificate your server no longer needs to have port `80` open because port `80` is used for regular, non-encrypted HTTP traffic. Jitsi Meet only serves its website via HTTPS on port `443`.

Close this port in your firewall with the following `ufw` command:

    sudo ufw delete allow 80/tcp

Your Jitsi Meet server is now up and running and available for testing. Open a browser and point it to your domain name. You will be able to create a new conference room and invite others to join you.

The default configuration for Jitsi Meet is that anyone visiting your Jitsi Meet server homepage can create a new conference room. This will use your server’s system resources to run the conference room and is not desirable for unauthorized users. In the next step, you will configure your Jitsi Meet instance to only allow registered users to create conference rooms.

## Step 5 — Locking Conference Creation

In this step, you will configure your Jitsi Meet server to only allow registered users to create conference rooms. The files that you will edit were generated by the installer and are configured with your domain name.

The variable `your_domain` will be used in place of a domain name in the following examples.

First, open `sudo nano /etc/prosody/conf.avail/your_domain.cfg.lua` with a text editor:

    sudo nano /etc/prosody/conf.avail/your_domain.cfg.lua

Edit this line:

    ...
            authentication = "anonymous"
    ...

To the following:

    ...
            authentication = "internal_plain"
    ...

This configuration tells Jitsi Meet to force username and password authentication before allowing conference room creation by a new visitor.

Then, in the same file, add the following section to the end of the file:

    ...
    VirtualHost "guest.your_domain"
        authentication = "anonymous"
        c2s_require_encryption = false

This configuration allows anonymous users to join conference rooms that were created by an authenticated user. However, the guest must have a unique address and an optional password for the room to enter it.

Here, you added `guest.` to the front of your domain name. For example, for `jitsi.your-domain` you would put `guest.jitsi.your-domain`. The `guest.` hostname is only used internally by Jitsi Meet. You will never enter it into a browser or need to create a DNS record for it.

Open another configuration file at `/etc/jitsi/meet/your_domain-config.js` with a text editor:

    sudo nano /etc/jitsi/meet/your_domain-config.js

Edit this line:

    ...
            // anonymousdomain: 'guest.example.com',
    ...

To the following:

    ...
            anonymousdomain: 'guest.your_domain',
    ...

Again, by using the `guest.<span class="highlight">your_domain</span>` hostname that you used earlier this configuration tells Jitsi Meet what internal hostname to use for the un-authenticated guests.

Next, open `/etc/jitsi/jicofo/sip-communicator.properties`:

    sudo nano /etc/jitsi/jicofo/sip-communicator.properties

And add the following line to complete the configuration changes:

    org.jitsi.jicofo.auth.URL=XMPP:your_domain

This configuration points one of the Jitsi Meet processes to the local server that performs the user authentication that is now required.

Your Jitsi Meet instance is now configured so that only registered users can create conference rooms. After a conference room is created, anyone can join it without needing to be a registered user. All they will need is the unique conference room address and an optional password set by the room’s creator.

Now that Jitsi Meet is configured to require authenticated users for room creation you need to register these users and their passwords. You will use the [`prosodyctl`](https://wiki.mattrude.com/Prosodyctl) utility to do this.

Run the following command to add a user to your server:

    sudo prosodyctl register user your_domain password

The user that you add here is **not** a system user. They will only be able to create a conference room and are not able to log in to your server via SSH.

Finally, restart the Jitsi Meet processes to load the new configuration:

    sudo systemctl restart prosody.service
    sudo systemctl restart jicofo.service
    sudo systemctl restart jitsi-videobridge2.service

The Jitsi Meet instance will now request a username and password with a dialog box when a conference room is created.

![Image showing the Jitsi username and password box](https://assets.digitalocean.com/articles/jitsimeet1804/step5a.png)

Your Jitsi Meet server is now set up and securely configured.

## Conclusion

In this article, you deployed a Jitsi Meet server that you can use to host secure and private video conference rooms. You can extend your Jitsi Meet instance with instructions from the [Jitsi Meet Wiki](https://github.com/jitsi/jitsi-meet/wiki).

---

[![CC 4.0 License](https://i.creativecommons.org/l/by-nc-sa/4.0/88x31.png)](http://creativecommons.org/licenses/by-nc-sa/4.0/)

_This work is licensed under a [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License](http://creativecommons.org/licenses/by-nc-sa/4.0/)_