Proteus · Infrastructure · 2026-07-08

jitsi.boas.dev — G0 self-host, live

The self-hosted Jitsi conference is deployed and verified — co-hosted on the Hostinger VPS beside n8n-prod. This is the live target the in-meeting transcription UI and the jigasi bridge build against.

LIVE — HTTP/2 200 metis#41 · #110 Track D docker-jitsi-meet stable-11031 srv908592 · 31.97.217.14 PR #254

What's deployed — verified live

CheckResultDetail
Edge https://jitsi.boas.dev✓ 200HTTP/2, traefik-terminated TLS (mytlschallenge), routed to web
Conference stack✓ upweb · prosody · jicofo · jvb (4 containers)
n8n-prod co-host✓ safeUp throughout deploy · ~5 GB RAM still free · load nominal
Resource caps✓ honoredweb 14/192M · jicofo 123/512M · jvb 157/900M · prosody 25/320M (~320 MB actual)
Media path✓ openUDP 10000 direct (grey DNS) + TCP 4443 fallback
Auth gate (rule #19)✓ closedsecure-domain — room creation requires host; guests join only
SSOT✓ persistedfleet_services.jitsi-boas-dev registered, verified

Architecture

Participant browser · our UI HTTPS 443 UDP 10000 media srv908592 · Hostinger VPS · 2 vCPU / 7.8 GB traefik :80/:443 · TLS JITSI (capped) web prosody (XMPP) jicofo jvb (media) n8n-prod untouched G1 — next jigasi (bridge) hosted ASR (vendor) XMPP

Solid = live today. Dashed (G1) = jigasi attaches over prosody's XMPP transcriber config — the exact access 8x8 JaaS structurally won't expose, which is the whole reason to self-host. ASR is a hosted vendor call, decoupled.

Decisions taken this session

Architecture

Self-host Jitsi = only path to our in-meeting UI

An in-meeting transcript layer we design requires owning the meeting client. Zoom/Meet/JaaS won't let us paint a caption surface. Self-hosted jitsi-meet is the one client we own — render surface + transcription-injection in one.

Compute · operator pivot

Hosted ASR, not an owned GPU

GPUs too expensive for 1–3 low-frequency meetings. A hosted vendor is acceptable — the veto was Google STT specifically, not all rented compute. skynet/metis-051 GPU procurement dropped. Cents/meeting vs $2–3.5k capex.

Placement

Co-host on srv908592, no dedicated VPS

Spend retracted. Only ASR needs a GPU and jigasi→ASR is a network hop, so the conference is CPU-only. Hard container caps keep a JVB spike from starving n8n-prod; split later only if prod actually degrades.

Security

Credential-split deploy + secure-domain auth

Proteus owns version-controlled config; only secret material (passwords, host account) crosses to the operator/hades leg — never an LLM transcript. Room creation is auth-gated (rule #19); no open public meeting server.

Bridge

jigasi is unavoidable

A refreshed sweep confirmed no hosted transcription service supports Jitsi natively (they target Zoom/Meet/Teams). jigasi remains the bridge between the self-hosted conference and the ASR — adopted OSS, not a rebuild.

Today · decoupled

Local test path on the M4

For a same-day proof, transcription decouples from the platform entirely: whisper.cpp on the M4 (already installed) transcribes the meeting audio — no jitsi, no GPU, no vendor. Diarization is the only trade, recoverable later.

Deploy split — the credential boundary

proteus — config / infra ✓ done

  • clone + pin stable-11031
  • resource-cap override + traefik labels
  • non-secret .env config script
  • DNS jitsi.boas.dev grey → 31.97.217.14
  • post-up verify · fleet_services register
  • artifacts committed — PR #254

operator / hades — secret leg

  • gen-passwords.sh — mint XMPP/JVB/Jicofo secrets
  • host-account register (secure-domain)
  • docker compose up
  • credential stays at /root/jitsi-hostadmin.cred on the VPS — never in-repo, never in a session

What's next

  • G1 — jigasi + ASR: attach jigasi over prosody's transcriber config; wire the hosted ASR. Gated on the vendor pick (Icelandic + realtime + diarization — hermes deep-diving). metis-owned.
  • Caption UI: Apollo designs the live-transcript surface on the self-hosted jitsi-meet frontend — can start now against the live target.
  • Auth model: secure-domain today; may flip to JWT so the frontend mints per-user tokens. Later decision, not a blocker.
  • VPS hygiene: pending kernel update (restart-required) — schedule a maintenance window; not mid-demo.
Proteus · fleet infrastructure · srv908592 co-host · deployed + verified 2026-07-08 · artifacts deploy/hostinger/jitsi/ · PR #254 · runbook jitsi-boas-dev-phase1-cutover.md