https:\/\/meet.jit.si<\/a> if using Jitsi Meet, or 8×8.vc if using JaaS. But as previously stated, Jitsi meet or Jaas requires a Google login or Jaas login, respectively.The app.js (version 1)<\/h3>\n\n\n\n Enter the app.js. I wrote a small js to run and generate the JWT since I could not get the Jist app to work with JaaS. Here is the Code:<\/p>\n\n\n\n
\/\/ ==BLOCK1=====<\/strong>\n\/\/ === set constants===\nconst https = require('https');\nconst fs = require('fs');\nconst express = require('express');\nconst jwt = require('jsonwebtoken');\nconst app = express();\n\n\/\/ ====BLOCK2===<\/strong>\n\/\/ === 8x8 App credentials ===\nconst APP_ID = \"vpaas-magic-cookie-123456\"; \nconst KID = \"vpaas-magic-cookie-123456\/aabbcc\"; \n\n\/\/ === Load private key for JWT signing ===\nconst PRIVATE_KEY = fs.readFileSync(\".\/private.pk\");\n\n\/\/ === Load Let's Encrypt certificates ===\nconst options = {\n key: fs.readFileSync(\"\/dir\/letsencrypt-key.pem\"),\n cert: fs.readFileSync(\"\/dir\/combined-bundle.pem\")\n};\n\/\/ ===BLOCK 3===<\/strong>\n\/\/ === Jitsi redirect route ===\napp.get(['\/jitsi', '\/jitsi\/:room'], (req, res) => {\n \/\/ This grabs the room name if Mattermost sends it, otherwise generates a random one\n const room = req.params.room || Math.random().toString(36).substring(2, 10);\n const username = \"Type Your Name\";\n const email = \"user@example.com\";\n\/\/ === Block 4 ===<\/strong>\n const payload = {\n aud: \"jitsi\",\n iss: \"chat\",\n sub: APP_ID,\n room: \"*\",\n exp: Math.floor(Date.now() \/ 1000) + 3600,\n context: { \n user: { \n name: username, \n email: email, \n moderator: true \n } \n }\n };\n\n const token = jwt.sign(payload, PRIVATE_KEY, {\n algorithm: 'RS256',\n header: { kid: KID }\n });\n\n const url = `https:\/\/8x8.vc\/${APP_ID}\/${room}?jwt=${token}`;\n res.redirect(url);\n});\n\/\/ == Block 5 ==<\/strong>\n\/\/ === Start HTTPS server on port 3000 ===\nhttps.createServer(options, app).listen(3000, () => {\n console.log(\"Jitsi proxy HTTPS running on port 3000\");\n});<\/code><\/pre>\n\n\n\n\nThe first “block” sets some constants to be use.<\/li>\n\n\n\n The second “block” set the API and keys needed for JaaS and SSL<\/li>\n\n\n\n The third “block” sets the room name to be used and name to be used in the room. MatterMost should set a room name. In case it fails, a name is generated. I could not get MatterMost to pass the MatterMost username to JaaS. So I hard coded “Type Your Name” to show in the connection box. <\/li>\n\n\n\n The 4th block is what gets packed in the JWT. \n\naud: tells 8×8 that I am using the jitsi part of my JaaS account<\/li>\n\n\n\n iss: tells JaaS it was issued by chat integration<\/li>\n\n\n\n sub: tells JaaS that the subject is my APP_ID<\/li>\n\n\n\n room: tell JaaS what room this is good for<\/li>\n\n\n\n exp: says how long the JWT is good for<\/li>\n\n\n\n user: adds the user name, email set above. It also sets everyone as a moderator, in my case<\/li>\n<\/ul>\n<\/li>\n\n\n\n The 5th block starts the app.js Reverse Proxy<\/h3>\n\n\n\n MatterMost runs on port 8065 by default. It does not run on Https. I also already have a webserver using port 443 and I only have 1 IP coming in from the outside. Thus I could not run MatterMost on 443. So I set up a reverse proxy using nginx on 4433 and pointed it to 8065. This worked well, but users had to go to Https:\/\/mattermost.server:4433 and it just looked clunky and I had port 3000 open for the app.js, though at least it was using a cert. I wanted to close off ports 8065 and 3000 from being open on my firewall\/router to the internet.<\/p>\n\n\n\n
I decided to set up my original web server that is running on port 443 as a revers proxy and point it to Matter most. Set up like this pic…<\/p>\n\n\n\n Traffic comes in from the interwebs on port 80 or port 443. All traffic goes to my web server first. If it is for my website, it stays on that web server. If its on https and is for the Mattermost server, it gets proxied over http to the MatterMost server. The MatterMost server also runs a proxy. It takes the http\/port 80 traffic and routes it to either the MatterMost server on port 8065 or the app.js on port 3000.<\/p>\n\n\n\n
There are 3 parts to this. The web server is running a reverse proxy using Apache. The MatterMost server is running a reverse proxy running on NGINX. The app.js on the MatterMost server got an updated config file.<\/p>\n\n\n\n
Apache Reverse Proxy<\/h3>\n\n\n\n I thought reverse proxy were some hard magical-like-unicorns thing. Its not, its just part of the <VirtualHost> in the Apache config file. The web server run on Ubuntu, so the Apache config file is located in \/etc\/apache2\/sites-available\/. I am using the 000-default.conf. <\/p>\n\n\n\n
# ---------------------------------------------------------\n# 1. LOCAL WEBSITE: www.site.com<\/strong>\n# ---------------------------------------------------------\n<VirtualHost *:443>\n ServerName www.site.com\n DocumentRoot \/var\/www\/html\n\n SSLEngine on\n SSLCertificateFile \/dir\/combined-bundle.pem\n SSLCertificateKeyFile \/dir\/letsencrypt-key.pem\n\n <Directory \/var\/www\/html>\n Options Indexes FollowSymLinks\n AllowOverride All\n Require all granted\n <\/Directory>\n<\/VirtualHost>\n\n# ---------------------------------------------------------\n# 2. PROXY FOR MATTERMOST: mattermost.site.com<\/strong>\n# ---------------------------------------------------------\n<VirtualHost *:443>\n ServerName mattermost.site.com\n\n SSLEngine on\n SSLCertificateFile \/dir\/combined-bundle.pem\n SSLCertificateKeyFile \/dir\/letsencrypt-key.pem\n\n # 1. SSL Proxy Logic (No longer strictly needed for Server B, but fine to leave)<\/em>\n SSLProxyEngine On\n SSLProxyVerify none \n SSLProxyCheckPeerCN off\n SSLProxyCheckPeerName off\n SSLProxyCheckPeerExpire off\n\n # 2. Modern Proxy Logic<\/em>\n ProxyPreserveHost On\n ProxyRequests Off\n \n # Updated Jitsi Bridge (Point to HTTP)<\/em>\n ProxyPass \/jitsi http:\/\/192.168.1.156\/jitsi\n ProxyPassReverse \/jitsi http:\/\/192.168.50.156\/jitsi\n\n # Updated General Mattermost Proxy (Point to HTTP)<\/em>\n ProxyPass \/ http:\/\/192.168.1.123\/\n ProxyPassReverse \/ http:\/\/192.168.1.123\/\n\n # 3. Secure Headers (CRITICAL: This tells Mattermost it is SECURE even though internal link is HTTP)<\/em>\n RequestHeader set X-Forwarded-Proto \"https\"\n RequestHeader set X-Forwarded-Port \"443\"\n\n # Updated WebSockets for the Mattermost client (Use ws:\/\/ instead of wss:\/\/)\n RewriteEngine On\n RewriteCond %{HTTP:Upgrade} =websocket [NC]\n RewriteRule \/(.*) ws:\/\/192.168.1.123\/$1 [P,L]\n\n ErrorLog ${APACHE_LOG_DIR}\/matter_error.log\n<\/VirtualHost>\n\n# ---------------------------------------------------------\n# 3. HTTP TO HTTPS REDIRECT <\/strong>\n# ---------------------------------------------------------\n<VirtualHost *:80>\n ServerAdmin webmaster@localhost\n DocumentRoot \/var\/www\/html\n\n # This catch-all redirector sends ANY site on this server to its HTTPS version\n RewriteEngine On\n RewriteCond %{HTTPS} off\n RewriteRule ^(.*)$ https:\/\/%{HTTP_HOST}$1 [R=301,L]\n\n ErrorLog ${APACHE_LOG_DIR}\/error.log\n CustomLog ${APACHE_LOG_DIR}\/access.log combined\n<\/VirtualHost><\/code><\/pre>\n\n\n\nThis is in 3 parts. <\/p>\n\n\n\n
\nPart 1 keeps the https traffic meant for my web server on the server.<\/li>\n\n\n\n Part 2 This sets up and proxys over https traffic to the MatterMost server.\n\ntop of that section loads up the SSL certs needed. I will talk later about the combined cert.<\/li>\n\n\n\n 1- is the old part where I was talking SSL between servers. Not really needed by left.<\/li>\n\n\n\n 2- sets up some proxy perimeters:ProxyPreserveHost<\/strong> On<\/strong><\/em>-tells the proxy to leave original full domain name in the proxy. Without this it might send the IP or truncated name. NGINX would get confusedProxyRequests Off<\/strong><\/em>-this stops other people form using the proxy and locks it to this specific site, mattermost.site.comProxyPass<\/strong><\/em> and ProxyPassReverse<\/em> <\/strong>– tell the web server where to send the data <\/li>\n\n\n\n3- sets up some SSL trickery to pass to MatterMostRequestHeader set X-Forwarded-Proto “https”<\/strong><\/em>-tells MatterMost that its ok to generate all its links with https even though the incoming request are httpRequestHeader set X-Forwarded-Port “443”<\/strong><\/em>-tells MatterMost to keep working on 443 and not 80Rewrite<\/em><\/strong>-This is where the proxy tells MatterMost to stop using HTTP and switch to websocket<\/li>\n<\/ul>\n<\/li>\n\n\n\nPart 3 This tells the web server to move all port 80 request over to 443. This may become a problem when I go to do a SSL cert renewal.<\/li>\n<\/ul>\n\n\n\nNGINX Reverse Proxy<\/h3>\n\n\n\n The MatterMost server runs NGINX on Debian. Here is its reverse proxy located in \/etc\/nginx\/sites-enabled\/<\/p>\n\n\n\n
server {\n listen 80;\n server_name mattermost.site.com;\n\n # Logic for Jitsi Proxy<\/strong>\n location \/jitsi\/ {\n proxy_pass http:\/\/127.0.0.1:3000\/; \n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto https;\n\n proxy_http_version 1.1;\n proxy_set_header Upgrade $http_upgrade;\n proxy_set_header Connection \"upgrade\";\n proxy_buffering off;\n }\n\n # Logic for Mattermost<\/strong>\n location \/ {\n client_max_body_size 50M;\n proxy_read_timeout 600s;\n proxy_send_timeout 600s;\n send_timeout 600s;\n\n proxy_set_header Upgrade $http_upgrade;\n proxy_set_header Connection \"upgrade\";\n proxy_set_header Host $http_host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto \"https\"; \n \n proxy_pass http:\/\/127.0.0.1:8065;\n }\n}<\/code><\/pre>\n\n\n\nIt has two parts. Jitsi and MatterMost settings for the reverse proxy. It should be noted that they MUST be in this order. <\/p>\n\n\n\n
Logic for Jitsi Proxy<\/strong>– location \/jitsi\/<\/em><\/strong>-says apply these setting to request in the format of matter.server.com\/jitsiproxy_pass http:\/\/127.0.0.1:3000\/;<\/em><\/strong> – forward to port 3000, the node.js appproxy_set_header Host $host;<\/em><\/strong>-keeps the domain nameproxy_set_header X-Real-IP $remote_addr;<\/em><\/strong>-passes the IP address of the userproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;<\/em><\/strong>-like a log to tell how the user got hereproxy_set_header X-Forwarded-Proto https<\/em><\/strong>;-same as Apache. Use https not httpproxy_http_version 1.1;<\/em><\/strong>-use this version because it supports websocketsproxy_set_header Upgrade $http_upgrade<\/em><\/strong>;-move from http to websocketsproxy_set_header Connection “upgrade”;<\/em><\/strong>-move from http to websocketsproxy_buffering off<\/em><\/strong>-do it, do it now<\/p>\n\n\n\nLogic for Mattermost<\/strong><\/p>\n\n\n\nclient_max_body_size 50M;<\/em><\/strong>-sets max attachment size, like a pdfTimeout<\/em><\/strong>-all of these lines keep the websocket open for 10min. I was seeing some resend errors in chatproxy_set_header<\/em><\/strong>– all of these do the same we explained above and in Apacheproxy_pass http:\/\/127.0.0.1:8065;<\/em><\/strong>-send the stuff to MatterMost software running on port 8065The app.js (version 2)<\/h3>\n\n\n\n Now that users were not going directly to the MatterMost server to run JaaS directly, I needed to update the app.js from above.<\/p>\n\n\n\n
const http = require('http'); \/\/ 1. Changed from https to http<\/strong>\nconst fs = require('fs');\nconst express = require('express');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\n\n\/**\n * CRITICAL: This tells Express to trust the headers sent by Nginx.\n *\/<\/strong>\napp.set('trust proxy', true);\n\n\/\/ === 8x8 App credentials ===<\/strong>\nconst APP_ID = \"vpaas-magic-cookie-123456\"; \nconst KID = \"vpaas-magic-cookie-123456\/aabbcc\"; \n\n\/\/ === Load private key for JWT signing ===<\/strong>\nconst PRIVATE_KEY = fs.readFileSync(\".\/private.pk\");\n\n\/\/ --- NOTE: Certificate loading removed from here ---<\/strong>\n\n\/\/ === Jitsi redirect route ===<\/em><\/strong>\napp.get(['\/', '\/:room'], (req, res) => {\n const room = req.params.room;\n\n if (!room || room === 'jitsi') {\n return res.send('Jitsi Bridge is active. Waiting for a room name from Mattermost...');\n }\n\n const username = \"Type Your Name\";\n const email = \"user@example.com\";\n\n const payload = {\n aud: \"jitsi\",\n iss: \"chat\",\n sub: APP_ID,\n room: \"*\",\n exp: Math.floor(Date.now() \/ 1000) + 3600,\n context: { \n user: { \n name: username, \n email: email, \n moderator: true \n } \n }\n };\n\n const token = jwt.sign(payload, PRIVATE_KEY, {\n algorithm: 'RS256',\n header: { kid: KID }\n });\n\n const url = `https:\/\/8x8.vc\/${APP_ID}\/${room}?jwt=${token}`;\n \n res.send(`\n<!DOCTYPE html>\n<html>\n<head>\n <title>Meeting Launcher<\/title>\n <style>\n body { background-color: #141517; color: white; font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; }\n .container { text-align: center; padding: 20px; }\n .loader { border: 4px solid #3d3d3d; border-top: 4px solid #3895ff; border-radius: 50%; width: 30px; height: 30px; animation: spin 1s linear infinite; margin: 20px auto; }\n @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } }\n .btn { display: inline-block; margin-top: 20px; padding: 12px 24px; background-color: #166de0; color: white; text-decoration: none; border-radius: 4px; font-weight: bold; transition: background 0.2s; }\n .btn:hover { background-color: #1a7fa0; }\n .status-text { opacity: 0.8; font-size: 0.95em; line-height: 1.5; }\n <\/style>\n <script type=\"text\/javascript\">\n window.open(\"${url}\", \"_blank\");\n setTimeout(function() {\n const loader = document.querySelector('.loader');\n const title = document.querySelector('h2');\n const status = document.querySelector('.status-text');\n const button = document.querySelector('.btn');\n if (loader) loader.style.display = 'none';\n if (title) title.innerText = 'Meeting Launched';\n if (status) status.innerHTML = 'We attempted to open the meeting in a new window.<br>If you are already in the meeting, you can close this tab.';\n if (button) button.innerText = 'RE-OPEN MEETING MANUALLY';\n }, 2000);\n <\/script>\n<\/head>\n<body>\n <div class=\"container\">\n <div class=\"loader\"><\/div>\n <h2>Launching Meeting...<\/h2>\n <p class=\"status-text\">Opening your default browser for camera and microphone support.<\/p>\n <a href=\"${url}\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"btn\">\n OPEN MEETING MANUALLY\n <\/a>\n <\/div>\n<\/body>\n<\/html>\n`);\n});\n\n\/\/ === Start HTTP server on port 3000 (options removed) ===<\/strong>\nhttp.createServer(app).listen(3000, () => {\n console.log(\"Jitsi proxy HTTP running on port 3000\");\n});<\/code><\/pre>\n\n\n\n\nThe first part is basically the same as above. Also notice the change from httpS to http<\/li>\n\n\n\n The second part loads the API and Key for JaaS. You will note that the SSL certs were removed.<\/li>\n\n\n\n The third part still sets up the room and user names. I did still have to use “Type Your Name”<\/li>\n\n\n\n The 4th part does the same as the 4th part in version1. It sets what gets packed into the JWT.<\/li>\n\n\n\n The 5th part, <!DOCTYPE html>, is entirely new. One the windows desktop client it refused to give control to the client for the camera and the mic. I believe because the desktop client was still seeing it as being a port 80 request. Chrome (the “browser” inside the client) will not give control unless on an https port. What this whole section does is pops-out JaaS to the default browser when the meeting button is pressed inside MatterMost. It also sets a message and a reconnect button to display on the page that does pop-up in the MatterMost desktop client.<\/li>\n\n\n\n The 6th part starts the app.js running http on port 3000<\/li>\n<\/ul>\n\n\n\nPlugin Change<\/strong>Adroid MatterMost App and Certs<\/h3>\n\n\n\n At the very begining of this journey I had a hard time getting the MatterMost app on android to connect. It would alway say it could not find the server. A web browser on the Andriod phone would work fine. It seems that Android and iOS do not like just the key.pem and the cert.pem like everything else I was using MatterMost on. You must have a combined chain pem. That is why you see me using the combined-bundle.pem in my config files for the web servers. I combined them by hand, but I believe I can get all of this via certbot. I will eventually do another how to on automating certbot and getting the combined pem automated. <\/p>\n","protected":false},"excerpt":{"rendered":"
I set up a MatterMost server and wanted to use Jist as a Service (Jaas) and did not find a lot of info on doing this. So here is what I did, cuz I gotta write crap down. I used a MatterMost turnkey Linux download from Proxmox. I then signed up for JaaS at this […]<\/p>\n","protected":false},"author":1,"featured_media":3219,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-3204","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-figured-it-out"],"_links":{"self":[{"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=\/wp\/v2\/posts\/3204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3204"}],"version-history":[{"count":24,"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=\/wp\/v2\/posts\/3204\/revisions"}],"predecessor-version":[{"id":3231,"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=\/wp\/v2\/posts\/3204\/revisions\/3231"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=\/wp\/v2\/media\/3219"}],"wp:attachment":[{"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smegnl.medina.oh.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/smegnl.medina.oh.us\/wp-content\/uploads\/2026\/04\/matter1.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/smegnl.medina.oh.us\/wp-content\/uploads\/2026\/04\/matter2.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/smegnl.medina.oh.us\/wp-content\/uploads\/2026\/04\/matter3.png\")
<\/figure>\n\n\n\n