Wire Forge-native release infrastructure

nixos/modules/burrow-jitsi.nix

@@ -0,0 +1,45 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.services.burrow.jitsi;
+in
+{
+  options.services.burrow.jitsi = {
+    enable = lib.mkEnableOption "the Burrow Jitsi Meet deployment";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "meet.burrow.net";
+      description = "Public Jitsi Meet domain.";
+    };
+
+    videobridgeUdpPort = lib.mkOption {
+      type = lib.types.port;
+      default = 10000;
+      description = "Public UDP port used by Jitsi Videobridge media traffic.";
+    };
+
+    enableHttpProxy = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Expose Jitsi through the repo-owned Caddy reverse proxy.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.jitsi-meet = {
+      enable = true;
+      hostName = cfg.domain;
+      nginx.enable = false;
+    };
+
+    services.jitsi-videobridge.openFirewall = true;
+
+    networking.firewall.allowedUDPPorts = [ cfg.videobridgeUdpPort ];
+
+    services.caddy.virtualHosts."${cfg.domain}".extraConfig = lib.mkIf cfg.enableHttpProxy ''
+      encode gzip zstd
+      reverse_proxy 127.0.0.1:5280
+    '';
+  };
+}