Install and maintain Jitsi on Ubuntu

Jitsi Meet is deployed from docker-jitsi-meet release stable-9646 under /opt/jitsi, with generated component passwords, Let’s Encrypt, and the required media port.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• TCP ports 80 and 443, plus UDP port 10000, open in both UFW and the provider firewall.
• A public IPv4 address correctly advertised to the Jitsi Videobridge.

What the AppStore installation creates

• Docker Engine and Docker Compose v2
• docker-jitsi-meet stable-9646 under /opt/jitsi/jitsi
• Persistent bind mounts below the deploying user’s ~/.jitsi-meet-cfg
• Built-in Jitsi web TLS with Let’s Encrypt

1. Install Docker Engine and Compose

sudo apt update
sudo apt install -y ca-certificates curl gnupg unzip
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
sudo systemctl enable --now docker

2. Download the pinned Jitsi release

sudo install -d -m 0755 /opt/jitsi
cd /opt/jitsi
sudo curl -fL https://github.com/jitsi/docker-jitsi-meet/archive/refs/tags/stable-9646.zip -o stable-9646.zip
sudo unzip stable-9646.zip
sudo ln -sfn /opt/jitsi/docker-jitsi-meet-stable-9646 /opt/jitsi/jitsi
cd /opt/jitsi/jitsi
sudo cp -n env.example .env

3. Configure Jitsi

Edit .env with the public URL, bind ports, XMPP domains, public IP, websocket settings, and certificate email.

cd /opt/jitsi/jitsi
sudo nano .env
# PUBLIC_URL=https://meet.example.com
# HTTP_PORT=80
# HTTPS_PORT=443
# ENABLE_LETSENCRYPT=1
# LETSENCRYPT_DOMAIN=meet.example.com
# LETSENCRYPT_EMAIL=admin@example.com
# DOCKER_HOST_ADDRESS=SERVER_PUBLIC_IP
# JVB_ADVERTISE_IPS=SERVER_PUBLIC_IP
# ENABLE_XMPP_WEBSOCKET=1
# ENABLE_COLIBRI_WEBSOCKET=1
# ENABLE_LOBBY=1
# ENABLE_PREJOIN_PAGE=1
sudo ./gen-passwords.sh

4. Create persistent directories and start

mkdir -p ~/.jitsi-meet-cfg/{web/letsencrypt,transcripts,prosody/config,prosody/prosody-plugins-custom,jicofo,jvb,jigasi,jibri}
cd /opt/jitsi/jitsi
sudo docker compose up -d
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 10000/udp
sudo ufw --force enable

Important files and data

• Compose project: /opt/jitsi/jitsi
• Secrets and deployment settings: /opt/jitsi/jitsi/.env
• Persistent configuration: ~/.jitsi-meet-cfg
• Container logs: docker compose logs

Health checks and logs

Run these checks after installation and after each upgrade:

cd /opt/jitsi/jitsi
sudo docker compose ps
sudo docker compose logs --tail=100
sudo ss -lunp | grep 10000
curl -I https://meet.example.com

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

cd /opt/jitsi/jitsi
sudo docker compose pull
sudo docker compose up -d
sudo docker compose ps
sudo docker image prune

Backup scope

• /opt/jitsi/jitsi/.env
• The full ~/.jitsi-meet-cfg tree
• Any recording or transcript storage if those optional services are enabled

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• Check jvb logs and advertised IP values when participants cannot exchange media.
• Do not regenerate component passwords on an existing installation unless all containers will receive the same updated values.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.