apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: jitsi
  namespace: video
spec:
  interval: 30m
  chart:
    spec:
      chart: jitsi-meet
      version: ">=1.0.0 <2.0.0"
      sourceRef:
        kind: HelmRepository
        name: jitsi
  install:
    remediation:
      retries: -1
  upgrade:
    remediation:
      retries: 5
  driftDetection:
    mode: enabled
  # fixed xmpp credentials: the chart generates random ones on every render, which
  # desyncs jicofo/jvb from the already running prosody after an upgrade
  valuesFrom:
    - kind: Secret
      name: jitsi-secrets
      valuesKey: JICOFO_AUTH_PASSWORD
      targetPath: jicofo.xmpp.password
    - kind: Secret
      name: jitsi-secrets
      valuesKey: JICOFO_COMPONENT_SECRET
      targetPath: jicofo.xmpp.componentSecret
    - kind: Secret
      name: jitsi-secrets
      valuesKey: JVB_AUTH_PASSWORD
      targetPath: jvb.xmpp.password
  values:
    publicURL: https://v.aggtaa.com

    web:
      ingress:
        enabled: true
        ingressClassName: traefik
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
        hosts:
          - host: v.aggtaa.com
            paths: ["/"]
        tls:
          - secretName: jitsi-tls
            hosts:
              - v.aggtaa.com

    # media traffic: UDP 10000 must be forwarded from the WAN router to the JVB service ip (kubectl get svc -n video)
    jvb:
      UDPPort: 10000
      # wan ip first, then the service ip for clients on the lan (no hairpin nat needed);
      # the chart passes this string as-is to JVB_ADVERTISE_IPS, which accepts a comma separated list
      publicIPs:
        - 91.233.45.43,10.0.64.9
      service:
        enabled: true
        type: LoadBalancer
        externalTrafficPolicy: Cluster

  postRenderers:
    - kustomize:
        patches:
          # dmz-pool has a single ip held by traefik, so use the dedicated public-ports-pool (see infra/metallb/config.yaml)
          - target:
              kind: Service
              name: jitsi-jitsi-meet-jvb
            patch: |
              - op: add
                path: /metadata/annotations/metallb.io~1address-pool
                value: public-ports-pool