Deploying Jitsi Meet on a VPS: Secure Video Conferencing with SSL and a TURN Server
TL;DR
In this detailed guide, we will step-by-step set up our own Jitsi Meet video conferencing server on a Virtual Private Server (VPS) running Ubuntu 24.04 LTS. We will ensure full connection security using SSL certificates from Let's Encrypt and configure a TURN server for reliable operation in complex network environments, so you can conduct private and secure video meetings for your team or community.
- Installation and basic configuration of the Ubuntu 24.04 LTS operating system.
- Deployment of all Jitsi Meet components (Jitsi Videobridge, Jitsi Meet Web, Prosody, Jicofo).
- Automatic configuration of Let's Encrypt SSL certificates for a secure HTTPS connection.
- Configuration of a TURN/STUN server (Coturn) for NAT and firewall traversal.
- Ensuring basic server security and recommendations for backups and maintenance.
What we are configuring and why
In today's world of remote work and distributed teams, reliable and secure communication tools have become critically important. Jitsi Meet is a completely free and open-source video conferencing platform that allows you to create high-quality video meetings directly in your browser, without the need to install additional applications. Unlike proprietary solutions such as Zoom or Google Meet, Jitsi Meet gives you full control over data and privacy, as you host it on your own server.
We will set up the full Jitsi Meet stack, which includes: Jitsi Videobridge (routes video and audio streams), Jitsi Meet Web (web interface), Prosody (XMPP server for signaling), and Jicofo (manages conferences). A key element of our setup will be ensuring security with SSL certificates from Let's Encrypt, which guarantees encryption of all traffic between clients and the server. This is critical for protecting your confidential information from interception.
Additionally, we will deploy and configure a TURN server (Coturn). TURN (Traversal Using Relays around NAT) is a protocol that allows media streams to pass through complex network environments, such as corporate firewalls and networks with symmetric NAT, where a direct P2P connection between conference participants is impossible. Without a TURN server, many users will encounter connection problems, especially when trying to join a conference from office networks or networks with restricted access. Having your own TURN server significantly increases the reliability and availability of your Jitsi Meet platform, ensuring uninterrupted communication for all participants.
Ultimately, upon completion of this tutorial, you will have a fully functional, secure, and reliable Jitsi Meet platform, ready for use by your team, clients, or for personal needs. You will be able to conduct video conferences, share your screen, use chat, and other features, knowing that all data is under your control.
Alternatives to Jitsi Meet on a VPS include solutions such as BigBlueButton or Nextcloud Talk. However, Jitsi Meet stands out for its ease of deployment and light client experience, requiring no installation. The choice of a self-hosted solution on a VPS instead of cloud-managed services is due to several factors: full control over data, no restrictions on the number of participants or call duration (dependent only on your server's capacity), customization options, and often lower long-term cost compared to paid subscriptions for commercial services.
What VPS configuration is needed for this task
Choosing the right VPS configuration for Jitsi Meet is critical for stable operation and video conference quality. Resource requirements depend heavily on the expected number of simultaneous participants and usage intensity.
Minimum requirements for a small team (up to 10-15 simultaneous participants):
- Processor (CPU): 2 x86-64 cores, preferably with a clock speed of 2.5 GHz or higher. Jitsi Videobridge actively uses the CPU for routing media streams.
- Random Access Memory (RAM): 4 GB. This is sufficient for the operating system and all Jitsi components.
- Disk Space: 50 GB SSD. SSD ensures fast loading and operation of all components.
- Network: Stable connection of 200 Mbps or higher. Good inbound and outbound bandwidth is very important.
Recommended VPS plan for medium loads (up to 25-30 simultaneous participants):
For more comfortable operation and scalability, especially if conferences with a large number of participants, screen sharing, and recording are planned, the following configuration is recommended:
- Processor (CPU): 4 x86-64 cores, 3.0 GHz or higher.
- Random Access Memory (RAM): 8 GB DDR4.
- Disk Space: 100 GB SSD.
- Network: 1 Gbps symmetric channel.
A VPS with such characteristics can be obtained, for example, from VPS with specified characteristics. It is important to ensure that the chosen provider offers a reliable network and sufficient bandwidth, as Jitsi Meet is very sensitive to latency and channel quality.
When a dedicated server is needed, not a VPS
If you plan to regularly host conferences with 50 or more simultaneous participants, or if you need the ability to record multiple conferences simultaneously (using Jibri), then you should consider renting a dedicated server. A dedicated server will provide you with exclusive access to all physical resources, which will eliminate the influence of "neighbors" on the VPS on performance. For such scenarios, a dedicated server with 8+ CPU cores, 16+ GB RAM, and a high-speed NVMe disk, as well as a guaranteed 1 Gbps channel, will be required. A suitable dedicated server can be found among the offerings of suitable dedicated servers.
Location: what it affects
The location of your VPS or dedicated server directly affects the latency for conference participants. The closer the server is to most of your users, the lower the latency will be, and the better the video and audio quality. Choose a data center located geographically close to your primary audience. For example, if your team is in Europe, choose a server in a European data center. High latency can lead to "lags," audio and video desynchronization, and a general deterioration of the user experience.
Server preparation
Before installing Jitsi Meet, you need to perform basic server preparation. We will use Ubuntu Server 24.04 LTS, as it is the current and supported version until 2026. All commands are executed as a user with sudo privileges.
1. System Update
First, let's update the package list and installed packages to the latest versions:
sudo apt update -y # Update the list of available packages
sudo apt upgrade -y # Upgrade all installed packages
sudo apt autoremove -y # Remove unnecessary packages
2. Install basic utilities
Let's make sure that the necessary utilities, which may be needed during the setup process, are installed:
sudo apt install -y curl wget git net-tools apt-transport-https ca-certificates software-properties-common
3. Hostname and DNS configuration
For Jitsi Meet, a correctly configured hostname and corresponding DNS records are critical. Choose a domain name, for example, meet.yourdomain.com. Make sure that an A-record pointing to the public IP address of your VPS is created for this domain in your DNS provider.
Let's set the hostname on the server:
sudo hostnamectl set-hostname meet.yourdomain.com # Set the hostname
echo "127.0.0.1 meet.yourdomain.com" | sudo tee -a /etc/hosts # Add entry to /etc/hosts
Replace meet.yourdomain.com with your actual domain name.
4. Firewall (UFW) configuration
Let's configure the UFW (Uncomplicated Firewall) firewall to ensure basic security. We will open only the necessary ports:
sudo ufw allow OpenSSH # Allow SSH access
sudo ufw allow http # Allow HTTP (for Certbot)
sudo ufw allow https # Allow HTTPS
sudo ufw allow 10000/udp # Port for Jitsi Videobridge (UDP)
sudo ufw allow 3478/udp # Port for STUN/TURN (UDP)
sudo ufw allow 5349/tcp # Port for TURN (TCP, if used)
sudo ufw enable # Enable firewall
sudo ufw status verbose # Check firewall status
A confirmation may be required in response to sudo ufw enable. Enter y.
5. Install Fail2ban (bruteforce protection)
Fail2ban will help protect your SSH server from brute-force password attacks by blocking IP addresses from which numerous failed login attempts occur:
sudo apt install -y fail2ban # Install Fail2ban
sudo systemctl enable fail2ban # Enable Fail2ban autostart
sudo systemctl start fail2ban # Start Fail2ban
The default configuration for SSH is usually sufficient. If you wish, you can create a /etc/fail2ban/jail.local file for fine-tuning, for example:
sudo nano /etc/fail2ban/jail.local
File content:
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
maxretry = 3
bantime = 1h
Save the file (Ctrl+X, Y, Enter) and restart Fail2ban:
sudo systemctl restart fail2ban
6. Create a user with sudo (optional, but recommended)
If you are working as root, it is recommended to create a new user with sudo privileges and work under that user to enhance security:
sudo adduser username # Create a new user
sudo usermod -aG sudo username # Add user to the sudo group
Replace username with your desired username. After that, exit the root session and log in as the new user. All subsequent commands requiring privileges should be executed with sudo.
The server is ready for Jitsi Meet installation.
Software installation — step-by-step
Software Installation — Step-by-Step
Now that the server is prepared, we will proceed with the installation of Jitsi Meet and all its components. We will use the official Jitsi repositories for Ubuntu.
1. Adding Jitsi Repositories
Jitsi Meet is not included in the standard Ubuntu repositories, so we need to add the official Jitsi repository and its GPG key to authenticate the packages.
# Download the Jitsi repository GPG key
curl https://download.jitsi.org/jitsi-key.gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/jitsi-keyring.gpg
# Add the Jitsi repository to the APT sources list
echo "deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/" | sudo tee /etc/apt/sources.list.d/jitsi-stable.list > /dev/null
# Update the package list so APT recognizes the new repository
sudo apt update -y
These commands will add the key and the repository, then update the package cache. Now the system knows where to download Jitsi Meet from.
2. Installing Jitsi Meet
After adding the repository, you can install the main jitsi-meet package. This package will install all necessary dependencies, including Jitsi Videobridge, Prosody, Jicofo, and Nginx (or another web server if not already installed).
sudo apt install -y jitsi-meet
During the installation, you will be prompted to enter the hostname for your Jitsi Meet instance. Enter the fully qualified domain name you configured earlier (e.g., meet.yourdomain.com). This is a critical step for Jitsi and SSL certificates to function correctly.
Next, you will be asked to choose the method for configuring SSL certificates. Select the option "Generate a new self-signed certificate (You will later get a Let's Encrypt certificate)". This will allow Jitsi to install a temporary self-signed certificate, which we will then replace with a full Let's Encrypt certificate.
The version of Jitsi Meet that will be installed will be the current "stable" version for 2026, available in the repository.
3. Configuring SSL Certificates with Let's Encrypt
Jitsi Meet comes with a convenient script for automatic installation and configuration of SSL certificates from Let's Encrypt. This will ensure a secure HTTPS connection.
# Run the script to obtain an SSL certificate
sudo /usr/share/jitsi-meet/scripts/install-letsencrypt-cert.sh
The script will ask for your email address. This address will be used by Let's Encrypt for certificate expiration notifications. Enter it and press Enter. The script will automatically contact Let's Encrypt, perform domain ownership verification (usually via HTTP-01 challenge, using port 80, which we opened in UFW), and install the certificates. It will also configure automatic certificate renewal.
If errors occur, ensure that:
- Your domain name (e.g.,
meet.yourdomain.com) correctly points to the public IP address of your VPS. - Ports 80 and 443 are open in your firewall (UFW).
- There are no other services on the server occupying port 80.
4. Installing and Configuring Coturn (TURN/STUN Server)
While Jitsi Meet can function without a separate TURN server in simple network configurations, its presence is critically important for ensuring communication between participants behind complex firewalls or NAT. Jitsi automatically installs Coturn as a dependency, but it needs to be configured correctly.
# Check if Coturn is installed (it should have been installed with jitsi-meet)
sudo apt install -y coturn
Now you need to configure Coturn. The main configuration file is located at /etc/coturn/turnserver.conf. We will make changes to ensure it works correctly with Jitsi.
sudo nano /etc/coturn/turnserver.conf
Comment out all lines in the file (by adding # at the beginning of each line) and add the following parameters. Replace YOUR_PUBLIC_IP with the public IP address of your VPS, and meet.yourdomain.com with your domain name:
# --- Jitsi Meet Coturn Configuration ---
# Listening ports for TURN/STUN
listening-port=3478
tls-listening-port=5349
# Min/Max ports for UDP relay
min-port=49152
max-port=65535
# External IP address of your server
external-ip=YOUR_PUBLIC_IP
# Realm for authentication (use your domain)
realm=meet.yourdomain.com
# Static user for authentication (replace with strong credentials)
# user=jitsi:JitsiStrongPassword123
# Use a shared secret for Jitsi authentication (recommended)
# This secret must match the one configured in Jitsi
static-auth-secret=YOUR_JITSI_SHARED_SECRET
# Enable verbose logging (optional, for debugging)
# verbose
# Disable loopback calls
no-loopback-peers
# Disable TLS fingerprinting (optional, for compatibility)
no-tls-system-certs
# Enable long-term credential mechanism for security
lt-cred-mech
# Set up a log file
log-file=/var/log/coturn.log
# Disable the default 'turnserver' user
no-daemon
Important: Replace YOUR_PUBLIC_IP with the actual public IP address of your VPS. For static-auth-secret, generate a strong secret, for example, using the command head /dev/urandom | tr -dc A-Za-z0-9_ | head -c 32 ; echo ''. We will use this same secret later in the Jitsi configuration. Comment out the line user=jitsi:JitsiStrongPassword123 if you are using static-auth-secret, which is the preferred method for Jitsi.
Save the changes and exit the editor. Now you need to enable Coturn and start it:
# Enable Coturn to run as a service
sudo sed -i 's/#TURNSERVER_ENABLED=1/TURNSERVER_ENABLED=1/' /etc/default/coturn
# Restart the Coturn service to apply changes
sudo systemctl restart coturn
# Check the status of the Coturn service
sudo systemctl status coturn
Ensure that Coturn is running and working without errors. If there are errors, check the /var/log/coturn.log file.
5. Installation Verification
After all these steps, your Jitsi Meet server should be installed and configured. Open a web browser and go to your domain address (e.g., https://meet.yourdomain.com). You should see the Jitsi Meet welcome page. Try creating a conference. If everything works, the basic installation was successful.
