janus.jcfg
The main file. It holds the general settings, the DTLS certificates, the media and NAT options, and which plugins, transports, event handlers and loggers to switch off.
How to read the tables
Sample is the value in the C sample file. In the port says whether the Rust source mentions the key as a string (read) or not (not found). It is a grep, not a proof: a key that is "read" may be read only in some modes, and a key that is "not found" is accepted and ignored with a warning, as the compatibility notes describe.
Reference
File: janus.jcfg in the configs folder. Sample: conf/janus.jcfg.sample.in in the C repo.
General configuration: folders where the configuration and the plugins can be found, how output should be logged, whether Janus should run as a daemon or in foreground, default interface to use, debug/logging level and, if needed, shared apisecret and/or token authentication mechanism between application(s) and Janus.
general
| Key | Sample | Meaning | In the port |
|---|---|---|---|
configs_folder | "@confdir@" | Configuration files folder | read |
plugins_folder | "@plugindir@" | Plugins folder | read |
transports_folder | "@transportdir@" | Transports folder | read |
events_folder | "@eventdir@" | Event handlers folder | read |
loggers_folder | "@loggerdir@" | External loggers folder | read |
log_to_stdout | false (commented out) | Whether the Janus output should be written to stdout or not (default=true) | read |
log_to_file | "/path/to/janus.log" (commented out) | Whether to use a log file or not | read |
log_rotate_sig | "SIGUSR1" (commented out) | Signal to handle for log rotation, valid values are "SIGUSR1" and "SIGHUP". Default is no setting, which disables the signal handler for log rotation. | read |
debug_level | 4 | Debug/logging level, valid values are 0-7 | read |
debug_timestamps | true (commented out) | Whether to show a timestamp for each log line | read |
debug_colors | false (commented out) | Whether colors should be disabled in the log | read |
debug_locks | true (commented out) | Whether to enable debugging of locks (very verbose!) | read |
log_prefix | "[janus] " (commented out) | In case you want log lines to be prefixed by some custom text, you can use the 'log_prefix' property. It supports terminal colors, meaning something like "[\x1b[32mjanus\x1b[0m] " would show a green "janus" string in square brackets (assuming debug_colors=true). | read |
daemonize | true (commented out) | Whether Janus should run as a daemon or not (default=run in foreground) | read |
pid_file | "/path/to/janus.pid" (commented out) | PID file to create when Janus has been started, and to destroy at shutdown | read |
check_openfiles_limit | 500000 (commented out) | This is where you can check, at startup, the limits to how many file descriptors Janus can open. This has an impact on network sockets, threads, actual files, and so on. It's an important aspect of configuring Janus, since if it opens more file descriptors than it is allowed to, it will crash. This is well explained and addressed in the FAQ on configuring ulimit: https://janus.conf.meetecho.com/docs/FAQ.html#ulimit The 'check_openfiles_limit' property can help ensure you are not caught by surprise, since depending on how Janus is configured (e.g., with respect to event loops), the number of PeerConnections/mountpoints, the media topology, etc., the maximum number of open files may be reached way later than Janus was started, and catch you by surprise. More precisely, 'check_openfiles_limit' can be used to ensure the current limit to open file descriptors is at least the value you want: if not, Janus will immediately shutdown, allowing you to go and fix that externally (e.g., via ulimit, before starting Janus, as explained in the FAQ). | read |
api_secret | "janusrocks" (commented out) | String that all Janus requests must contain to be accepted/authorized by the Janus core. Useful if you're wrapping all Janus API requests in your servers (that is, not in the browser, where you do the things your way) and you don't want other application to mess with this Janus instance. | read |
token_auth | true (commented out) | Enable a token based authentication mechanism to force users to always provide a valid token in all requests. Useful if you want to authenticate requests from web users. | read |
token_auth_secret | "janus" (commented out) | Use HMAC signed tokens (with token_auth). Note that without this, the Admin API MUST be enabled, as tokens are added and removed through messages sent there. | read |
token_auth_hash | "sha1" (commented out) | Hash function used for signed-token authentication. Defaults to sha1. Supported values: sha1, sha256. | read |
admin_secret | "janusoverlord" | String that all Janus requests must contain to be accepted/authorized by the admin/monitor. only needed if you enabled the admin API in any of the available transports. | read |
interface | "1.2.3.4" (commented out) | Interface to use (will be used in SDP) | read |
server_name | "MyJanusInstance" (commented out) | Public name of this Janus instance as it will appear in an info request | read |
session_timeout | 60 (commented out) | How long (in seconds) we should wait before deciding a Janus session has timed out. A session times out when no request is received for session_timeout seconds (default=60s). Setting this to 0 will disable the timeout mechanism, which is NOT suggested as it may risk having orphaned sessions (sessions not controlled by any transport and never freed). To avoid timeouts, keep-alives can be used. | read |
candidates_timeout | 45 (commented out) | How long (in seconds) we should keep hold of pending (trickle) candidates before discarding them (default=45s). Notice that setting this to 0 will NOT disable the timeout, but will be considered an invalid value and ignored. | read |
reclaim_session_timeout | 0 (commented out) | How long (in seconds) we should wait for a janus session to be reclaimed after the transport is gone. After the transport is gone, a session times out when no request is received for reclaim_session_timeout seconds (default=0s). Setting this to 0 will disable the timeout mechanism, and sessions will be destroyed immediately if the transport is gone. | read |
recordings_tmp_ext | "tmp" (commented out) | The extension for recordings, in Janus, is .mjr, a custom format we devised ourselves. By default, we save to .mjr directly. If you'd rather the recording filename have a temporary extension while it's being saved, and only have the .mjr extension when the recording is over (e.g., to automatically trigger some external scripts), then uncomment and set the recordings_tmp_ext property to the extension to add to the base (e.g., tmp --> .mjr.tmp). | read |
event_loops | 8 (commented out) | By default, Janus handles each have their own event loop and related thread for all the media routing and management. If for some reason you'd rather limit the number of loop/threads, and you want handles to share those, you can do that configuring the event_loops property: this will spawn the specified amount of threads at startup, run a separate event loop on each of them, and add new handles to one of them when attaching. Notice that, while cutting the number of threads and possibly reducing context switching, this might have an impact on the media delivery, especially if the available loops can't take care of all the handles and their media in time. As such, if you want to use this you should provision the correct value according to the available resources (e.g., CPUs available). | read |
allow_loop_indication | true (commented out) | In case a static number of event loops is configured as explained above, by default new handles will be allocated on one loop or another by the Janus core itself. In some cases it may be helpful to manually tell the Janus core which loop a handle should be added to, e.g., to group viewers of the same stream on the same loop. This is possible via the Janus API when performing the 'attach' request, but only if allow_loop_indication is set to true; it's set to false by default to avoid abuses. Don't change if you don't know what you're doing! | read |
task_pool_size | 100 (commented out) | By default, while the Janus core is single thread when it comes to processing incoming messages, it also uses a task pool with an indefinite amount of helper threads spawned on demand to handle messages addressed to plugins. If you want to limit this task pool size with a maximum number of concurrent threads, set the 'task_pool_size' property accordingly: a value of '0' means 'indefinite' and is the default. Notice that threads are automatically destroyed when unused for a while, so whatever value you choose simply puts a cap on the maximum concurrency. Don't change if you don't know what you're doing! | read |
opaqueid_in_api | true (commented out) | Opaque IDs set by applications are typically only passed to event handlers for correlation purposes, but not sent back to the user or application in the related Janus API responses or events; in case you need them to be in the Janus API too, set this property to 'true'. | read |
restrict_info_api | true (commented out) | By default, the "info" endpoint is unauthenticated, allowing any caller to discover loaded plugins and server details. Setting this to 'true' restricts the endpoint so that a valid api_secret or token is required to access it, e.g., when Janus runs behind a reverse proxy and you want to reduce server fingerprinting. Note that this option has no effect unless api_secret or token_auth is also configured. | read |
hide_dependencies | true (commented out) | By default, a call to the "info" endpoint of either the Janus or Admin API now also returns the versions of the main dependencies (e.g., libnice, libsrtp, which crypto library is in use and so on). Should you want that info not to be disclose, set 'hide_dependencies' to true. | read |
exit_on_dl_error | false (commented out) | If a Janus shared libary cannot be loaded or an expected symbol is not found, exit immediately. | read |
no_webrtc_encryption | true (commented out) | The following is ONLY useful when debugging RTP/RTCP packets, e.g., to look at unencrypted live traffic with a browser. By default it is obviously disabled, as WebRTC mandates encryption. | read |
protected_folders | [ | Janus provides ways via its API to specify custom paths to save files to (e.g., recordings, pcap captures and the like). In order to avoid people can mess with folders they're not supposed to, you can configure an array of folders that Janus should prevent creating files in. If the 'protected_folder' property below is commented, no folder is protected. Notice that at the moment this only covers attempts to start an .mjr recording and pcap/text2pcap packet captures. | read |
certificates
| Key | Sample | Meaning | In the port |
|---|---|---|---|
cert_pem | "/path/to/certificate.pem" (commented out) | read | |
cert_key | "/path/to/key.pem" (commented out) | read | |
cert_pwd | "secretpassphrase" (commented out) | read | |
dtls_accept_selfsigned | false (commented out) | read | |
dtls_ciphers | "your-desired-openssl-ciphers" (commented out) | read | |
rsa_private_key | false (commented out) | read |
media
| Key | Sample | Meaning | In the port |
|---|---|---|---|
ipv6 | true (commented out) | read | |
ipv6_linklocal | true (commented out) | read | |
min_nack_queue | 500 (commented out) | read | |
rtp_port_range | "20000-40000" (commented out) | read | |
dtls_mtu | 1200 (commented out) | read | |
no_media_timer | 1 (commented out) | read | |
slowlink_threshold | 4 (commented out) | read | |
twcc_period | 100 (commented out) | read | |
dtls_timeout | 500 (commented out) | read | |
nack_optimizations | true (commented out) | Janus can do some optimizations on the NACK queue, specifically when keyframes are involved. Namely, you can configure Janus so that any time a keyframe is sent to a user, the NACK buffer for that connection is emptied. This allows Janus to ignore NACK requests for packets sent shortly before the keyframe was sent, since it can be assumed that the keyframe will restore a complete working image for the user anyway (which is the main reason why video retransmissions are typically required). While this optimization is known to work fine in most cases, it can backfire in some edge cases, and so is disabled by default. | read |
dscp | 46 (commented out) | If you need DSCP packet marking and prioritization, you can configure the 'dscp' property to a specific values, and Janus will try to set it on all outgoing packets using libnice. Normally, the specs suggest to use different values depending on whether audio, video or data are used, but since all PeerConnections in Janus are bundled, we can only use one. You can refer to this document for more info: https://tools.ietf.org/html/draft-ietf-tsvwg-rtcweb-qos-18#page-6 That said, DON'T TOUCH THIS IF YOU DON'T KNOW WHAT IT MEANS! | read |
rtp_port_range_perhandle_override | false (commented out) | By default the 'rtp_port_range' configured above (if any) is shared by all PeerConnections. If you want to let clients confine a single handle to a narrower sub-range, you can set the 'rtp_port_range_perhandle_override' property to true: when enabled, an 'attach' request may provide optional 'min_port' and 'max_port' properties to restrict that handle's RTP/RTCP ports. The requested range is confined within the global 'rtp_port_range' above: a range that falls outside it is ignored and the global range is used instead. When this is disabled (the default), the 'min_port' and 'max_port' properties are ignored, so the existing behavior is preserved. | read |
nat
| Key | Sample | Meaning | In the port |
|---|---|---|---|
stun_server | "stun.voip.eutelia.it" (commented out) | read | |
stun_port | 3478 (commented out) | read | |
nice_debug | "nice_debug option is NOT SUPPORTED ANYMORE! Please set NICE_DEBUG and G_MESSAGES_DEBUG env vars when starting Janus" (commented out) | read | |
full_trickle | true (commented out) | read | |
ice_nomination | "regular" (commented out) | read | |
ice_consent_freshness | true (commented out) | read | |
ice_keepalive_conncheck | true (commented out) | read | |
ice_lite | true (commented out) | read | |
ice_tcp | true (commented out) | read | |
hangup_on_failed | true (commented out) | By default, Janus implements a grace period when detecting ICE failures in PeerConnections, to give time to applications to react to that, e.g., by enforcing an ICE restart. If you want an ICE failure to result in the PeerConnection being closed right away (e.g., with the help of consent freshness) then you can do that by uncommenting the following property and set it to true | read |
ignore_mdns | true (commented out) | By default Janus tries to resolve mDNS (.local) candidates: even though this is now done asynchronously and shouldn't keep the API busy, even in case mDNS resolution takes a long time to timeout, you can choose to drop all .local candidates instead, which is helpful in case you know clients will never be in the same private network as the one the Janus instance is running from. Notice that this will cause ICE to fail if mDNS is the only way to connect! | read |
nat_1_1_mapping | "1.2.3.4" (commented out) | In case you're deploying Janus on a server which is configured with a 1:1 NAT (e.g., Amazon EC2), you might want to also specify the public address of the machine using the setting below. This will result in all host candidates (which normally have a private IP address) to be rewritten with the public address provided in the settings. As such, use the option with caution and only if you know what you're doing. Make sure you keep ICE Lite disabled, though, as it's not strictly speaking a publicly reachable server, and a NAT is still involved. If you'd rather keep the private IP address in place, rather than replacing it (and so have both of them as advertised candidates), then set the 'keep_private_host' property to true. Multiple public IP addresses can be specified as a comma separated list if the Janus is deployed in a DMZ between two 1-1 NAT for internal and external users. | read |
keep_private_host | true (commented out) | read | |
turn_server | "myturnserver.com" (commented out) | You can configure a TURN server in two different ways: specifying a statically configured TURN server, and thus provide the address of the TURN server, the transport (udp/tcp/tls) to use, and a set of valid credentials to authenticate. Notice that you should NEVER configure a TURN server for Janus unless it's really what you want! If you want users to use TURN, then you need to configure that on the client side, and NOT in Janus. The following TURN configuration should ONLY be enabled when Janus itself is sitting behind a restrictive firewall (e.g., it's part of a service installed on a box in a private home). | read |
turn_port | 3478 (commented out) | read | |
turn_type | "udp" (commented out) | read | |
turn_user | "myuser" (commented out) | read | |
turn_pwd | "mypassword" (commented out) | read | |
turn_rest_api | "http://yourbackend.com/path/to/api" (commented out) | You can also make use of the TURN REST API to get info on one or more TURN services dynamically. This makes use of the proposed standard of such an API (https://tools.ietf.org/html/draft-uberti-behave-turn-rest-00) which is currently available in both rfc5766-turn-server and coturn. You enable this by specifying the address of your TURN REST API backend, the HTTP method to use (GET or POST) and, if required, the API key Janus must provide. The timeout can be configured in seconds, with a default of 10 seconds and a minimum of 1 second. Notice that the 'opaque_id' provided via Janus API will be used as the username for a specific PeerConnection by default; if that one is missing, the 'session_id' will be used as the username instead. | read |
turn_rest_api_key | "anyapikeyyoumayhaveset" (commented out) | read | |
turn_rest_api_method | "GET" (commented out) | read | |
turn_rest_api_timeout | 10 (commented out) | read | |
allow_force_relay | true (commented out) | In case a TURN server is provided, you can allow applications to force Janus to use TURN (https://github.com/meetecho/janus-gateway/pull/2774). This is NOT allowed by default: only enable it if you know what you're doing. | read |
ice_enforce_list | "eth0" (commented out) | You can also choose which interfaces should be explicitly used by the gateway for the purpose of ICE candidates gathering, thus excluding others that may be available. To do so, use the 'ice_enforce_list' setting and pass it a comma-separated list of interfaces or IP addresses to enforce. This is especially useful if the server hosting the gateway has several interfaces, and you only want a subset to be used. Any of the following examples are valid: ice_enforce_list = "eth0" ice_enforce_list = "eth0,eth1" ice_enforce_list = "eth0,192.168." ice_enforce_list = "eth0,192.168.0.1" By default, no interface is enforced, meaning Janus will try to use them all. | read |
ice_ignore_list | "vmnet" | In case you don't want to specify specific interfaces to use, but would rather tell Janus to use all the available interfaces except some that you don't want to involve, you can also choose which interfaces or IP addresses should be excluded and ignored by the gateway for the purpose of ICE candidates gathering. To do so, use the 'ice_ignore_list' setting and pass it a comma-separated list of interfaces or IP addresses to ignore. This is especially useful if the server hosting the gateway has several interfaces you already know will not be used or will simply always slow down ICE (e.g., virtual interfaces created by VMware). Partial strings are supported, which means that any of the following examples are valid: ice_ignore_list = "vmnet8,192.168.0.1,10.0.0.1" ice_ignore_list = "vmnet,192.168." Just beware that the ICE ignore list is not used if an enforce list has been configured. By default, Janus ignores all interfaces whose name starts with 'vmnet', to skip VMware interfaces: | read |
ignore_unreachable_ice_server | true (commented out) | In case you want to allow Janus to start even if the configured STUN or TURN server is unreachable, you can set 'ignore_unreachable_ice_server' to true. WARNING: We do not recommend to ignore reachability problems, particularly if you run Janus in the cloud. Before enabling this flag, make sure your system is correctly configured and Janus starts after the network layer of your machine is ready. Note that Linux distributions offer such directives. You could use the following directive in systemd: 'After=network-online.target' https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Before= | read |
plugins
| Key | Sample | Meaning | In the port |
|---|---|---|---|
disable | "libjanus_echotest.so,libjanus_recordplay.so" (commented out) | read |
transports
| Key | Sample | Meaning | In the port |
|---|---|---|---|
disable | "libjanus_rabbitmq.so" (commented out) | read |
loggers
| Key | Sample | Meaning | In the port |
|---|---|---|---|
disable | "libjanus_jsonlog.so" (commented out) | read |
events
| Key | Sample | Meaning | In the port |
|---|---|---|---|
broadcast | true (commented out) | read | |
combine_media_stats | true (commented out) | read | |
disable | "libjanus_sampleevh.so" (commented out) | read | |
stats_period | 5 (commented out) | read |