jitsi fixed passwords

clusters/base/apps/jitsi/helmrelease.yaml

@@ -20,6 +20,21 @@ spec:
       retries: 5
   driftDetection:
     mode: enabled
+  # fixed xmpp credentials: the chart generates random ones on every render, which
+  # desyncs jicofo/jvb from the already running prosody after an upgrade
+  valuesFrom:
+    - kind: Secret
+      name: jitsi-secrets
+      valuesKey: JICOFO_AUTH_PASSWORD
+      targetPath: jicofo.xmpp.password
+    - kind: Secret
+      name: jitsi-secrets
+      valuesKey: JICOFO_COMPONENT_SECRET
+      targetPath: jicofo.xmpp.componentSecret
+    - kind: Secret
+      name: jitsi-secrets
+      valuesKey: JVB_AUTH_PASSWORD
+      targetPath: jvb.xmpp.password
   values:
     publicURL: https://v.aggtaa.com
 
@@ -40,8 +55,10 @@ spec:
     # media traffic: UDP 10000 must be forwarded from the WAN router to the JVB service ip (kubectl get svc -n video)
     jvb:
       UDPPort: 10000
+      # wan ip first, then the service ip for clients on the lan (no hairpin nat needed);
+      # the chart passes this string as-is to JVB_ADVERTISE_IPS, which accepts a comma separated list
       publicIPs:
-        - 91.233.45.43
+        - 91.233.45.43,10.0.64.9
       service:
         enabled: true
         type: LoadBalancer