WIP: Livekit

nixos/roles/matrix/livekit.nix

@@ -9,7 +9,7 @@
     settings = {
       rtc = {
         tcp_port = 7881;
-        udp_port = 7882;
+        #udp_port = 7882;
         port_range_start = 50000;
         port_range_end = 60000;
         use_external_ip = true;
@@ -31,11 +31,24 @@
 
   systemd.services.livekit.serviceConfig = {
     PrivateUsers = lib.mkForce false;
+    DynamicUser = lib.mkForce false;
+    User = "livekit";
+    Group = "livekit";
     RestrictAddressFamilies = lib.mkForce [
       "AF_INET"
       "AF_INET6"
       "AF_NETLINK"
       "AF_UNIX"
     ];
+    SystemCallFilter = lib.mkForce [ "@system-service" ];
   };
+
+  users = {
+    users.livekit = {
+      isSystemUser = true;
+      group = "livekit";
+    };
+    groups.livekit = { };
+  };
+
 }