WIP: Livekit

nixos/roles/livekit.nix

@@ -1,68 +0,0 @@
-{ pkgs, ... }:
-let
-  keyFile = "/run/livekit/livekit.key";
-  domain = "cyperpunk.de";
-  synapseUrl = "http://100.109.179.25:8008";
-in
-{
-  services = {
-    livekit = {
-      enable = true;
-      openFirewall = true;
-      inherit keyFile;
-      settings = {
-        rtc = {
-          tcp_port = 7881;
-          udp_port = 7882;
-          port_range_start = 50000;
-          port_range_end = 60000;
-          use_external_ip = true;
-          node_ip = "178.254.8.35";
-        };
-        room = {
-          auto_create = false;
-          enabled_codecs = [
-            { mime = "video/VP8"; }
-            { mime = "video/VP9"; }
-            { mime = "video/H264"; }
-            { mime = "audio/opus"; }
-          ];
-          enable_remote_unmute = true;
-        };
-      };
-    };
-
-    lk-jwt-service = {
-      enable = true;
-      #livekitUrl = "wss://cyperpunk.de/livekit/sfu";
-      inherit keyFile;
-      livekitUrl = "wss://127.0.0.1:7880";
-    };
-  };
-
-  systemd.services = {
-    livekit-key = {
-      before = [
-        "lk-jwt-service.service"
-        "livekit.service"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [
-        livekit
-        coreutils
-        gawk
-      ];
-      script = ''
-        mkdir -p /run/livekit
-        echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}"
-      '';
-      serviceConfig.Type = "oneshot";
-      unitConfig.ConditionPathExists = "!${keyFile}";
-    };
-
-    lk-jwt-service.environment = {
-      LIVEKIT_FULL_ACCESS_HOMESERVERS = domain;
-      MATRIX_BASE_URL = synapseUrl;
-    };
-  };
-}

nixos/roles/matrix/clients.nix

@@ -126,13 +126,13 @@ let
         preferred_domain = "jitsi.cyperpunk.de";
       };
       element_call = {
-        url = "https://element.cyperpunk.de/widgets/element-call";
+        url = "https://element-call.cyperpunk.de";
         use_exclusively = true;
         participant_limit = 8;
         brand = "Cyperpunk Call";
       };
       livekit = {
-        livekit_service_url = "https://cyperpunk.de/livekit/jwt";
+        livekit_service_url = "https://cyperpunk.de/livekit/jwt/";
       };
       setting_defaults = {
         custom_themes = catppuccinThemes;

nixos/roles/matrix/default.nix

@@ -4,8 +4,8 @@
 {
   imports = [
     ./synapse.nix
-    #    ./coturn.nix
     ./clients.nix
+    ./lk-jwt.nix
   ];
 
   #networking.firewall = {

nixos/roles/matrix/livekit.nix

@@ -0,0 +1,30 @@
+{ config, ... }:
+{
+  sops.secrets.livekit_key = { };
+
+  services.livekit = {
+    enable = true;
+    openFirewall = true;
+    keyFile = config.sops.secrets.livekit_key.path;
+    settings = {
+      rtc = {
+        tcp_port = 7881;
+        udp_port = 7882;
+        port_range_start = 50000;
+        port_range_end = 60000;
+        use_external_ip = true;
+        node_ip = "178.254.8.35";
+      };
+      room = {
+        auto_create = false;
+        enabled_codecs = [
+          { mime = "video/VP8"; }
+          { mime = "video/VP9"; }
+          { mime = "video/H264"; }
+          { mime = "audio/opus"; }
+        ];
+        enable_remote_unmute = true;
+      };
+    };
+  };
+}

nixos/roles/matrix/lk-jwt.nix

@@ -0,0 +1,19 @@
+{ config, ... }:
+let
+  domain = "cyperpunk.de";
+  synapseUrl = "http://100.109.179.25:8008";
+in
+{
+  sops.secrets.livekit_key = { };
+
+  services.lk-jwt-service = {
+    enable = true;
+    keyFile = config.sops.secrets.livekit_key.path;
+    livekitUrl = "wss://cyperpunk.de/livekit/sfu";
+  };
+
+  systemd.services.lk-jwt-service.environment = {
+    LIVEKIT_FULL_ACCESS_HOMESERVERS = domain;
+    MATRIX_BASE_URL = synapseUrl;
+  };
+}

nixos/roles/matrix/synapse.nix

@@ -49,6 +49,7 @@
                 names = [
                   "client"
                   "federation"
+                  "openid"
                 ];
                 compress = false;
               }

nixos/roles/nginx.nix

@@ -41,7 +41,7 @@ let
         		"org.matrix.msc4143.rtc_foci":[
         				{
         						"type":"livekit",
-        						"livekit_service_url":"https://cyperpunk.de/livekit/jwt"
+        						"livekit_service_url":"https://cyperpunk.de/livekit/jwt/"
         				}
         		]
         }';
@@ -116,7 +116,7 @@ in
           };
           "^~ /livekit/jwt/" = {
             priority = 400;
-            proxyPass = "http://127.0.0.1:8080/";
+            proxyPass = "http://${upstream}:8080/";
           };
           "^~ /livekit/sfu/" = {
             priority = 400;