WIP: Unfree problems

nixos/roles/matrix/livekit.nix

@@ -1,22 +1,23 @@
 { config, lib, ... }:
 {
-  sops.secrets.livekit_key_sfu = { };
+  # Shared key file — same secret used by lk-jwt-service (see lk-jwt.nix)
+  sops.secrets.livekit_key = { };
 
   services.livekit = {
     enable = true;
     openFirewall = true;
-    keyFile = config.sops.secrets.livekit_key_sfu.path;
+    keyFile = config.sops.secrets.livekit_key.path;
     settings = {
       rtc = {
         tcp_port = 7881;
-        #udp_port = 7882;
         port_range_start = 50000;
         port_range_end = 60000;
         use_external_ip = true;
         node_ip = "178.254.8.35";
       };
       room = {
-        auto_create = true;
+        # Must be false — rooms are created by the JWT service on demand
+        auto_create = false;
         enabled_codecs = [
           { mime = "video/VP8"; }
           { mime = "video/VP9"; }
@@ -27,7 +28,17 @@
       };
     };
   };
-  networking.firewall.allowedTCPPorts = [ 7881 ];
+
+  networking.firewall = {
+    allowedTCPPorts = [ 7881 ];
+    # WebRTC media relay — must be open or calls connect then immediately drop
+    allowedUDPPortRanges = [
+      {
+        from = 50000;
+        to = 60000;
+      }
+    ];
+  };
 
   systemd.services.livekit.serviceConfig = {
     PrivateUsers = lib.mkForce false;
@@ -50,5 +61,4 @@
     };
     groups.livekit = { };
   };
-
 }