k3s/services/matrix/matrix-livekit.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: livekit-config-tmpl
  namespace: matrix
data:
  livekit.yaml: |
    port: 7880
    rtc:
      tcp_port: 7881
      udp_port: 7882
      use_external_ip: false
      node_ip: "192.168.1.160"
    turn:
      cert_file: ""
      key_file: ""
      tls_port: 0
      udp_port: 3478
      external_tls: false
    # Crucial for Matrix integration: Only the JWT service can create rooms
    room:
      auto_create: false
    webhook:
      api_key: "${LIVEKIT_KEY}" # Swapped to match the key name inside matrix-secrets
      urls:
        - https://matrix-rtc.mynest.love/sfu_webhook
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: livekit
  namespace: matrix
  annotations:
    keel.sh/policy: "all"
    keel.sh/match-tag: "true"
    keel.sh/schedule: "0 3 * * *"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: livekit
  template:
    metadata:
      labels:
        app: livekit
    spec:
      initContainers:
        - name: generate-config
          image: alpine:latest
          command: ["/bin/sh", "-c", "apk add gettext && envsubst < /tmpl/livekit.yaml > /etc/livekit/livekit.yaml"]
          envFrom:
            - secretRef:
                name: matrix-secrets
          volumeMounts:
            - name: config-tmpl
              mountPath: /tmpl/livekit.yaml
              subPath: livekit.yaml
            - name: livekit-runtime-config
              mountPath: /etc/livekit
      containers:
        - name: livekit
          image: livekit/livekit-server:latest
          args: ["--config", "/etc/livekit/livekit.yaml"] # Point to the generated file path
          ports:
            - containerPort: 7880
            - containerPort: 7881
            - containerPort: 7882
              protocol: UDP
            - containerPort: 3478
              protocol: UDP
          env:
            - name: LK_KEY
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: LIVEKIT_KEY
            - name: LK_SECRET
              valueFrom:
                secretKeyRef:
                  name: matrix-secrets
                  key: LIVEKIT_SECRET
            - name: LIVEKIT_KEYS
              value: '$(LK_KEY): $(LK_SECRET)'
          volumeMounts:
            - name: livekit-runtime-config
              mountPath: /etc/livekit
      volumes:
        - name: livekit-runtime-config
          emptyDir: {}
        - name: config-tmpl
          configMap:
            name: livekit-config-tmpl
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: lk-jwt-service
  namespace: matrix
  annotations:
    keel.sh/policy: "all"
    keel.sh/match-tag: "true"
    keel.sh/schedule: "0 3 * * *"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: lk-jwt-service
  template:
    metadata:
      labels:
        app: lk-jwt-service
    spec:
      hostAliases:
        - ip: "192.168.1.150"
          hostnames:
            - "starling.mynest.love"
            - "mas.mynest.love"
            - "matrix-rtc.mynest.love"
      containers:
        - name: lk-jwt-service
          image: ghcr.io/element-hq/lk-jwt-service:0.4.2
          ports:
            - containerPort: 8080
          envFrom:
            - secretRef:
                name: matrix-secrets
          env:
            - name: LIVEKIT_URL
              value: "wss://matrix-rtc.mynest.love"
            - name: LIVEKIT_FULL_ACCESS_HOMESERVERS
              value: "starling.mynest.love"