From 9fd2a88c7963e46538b3fb60270710f46b6fb4ea Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Feb 2026 10:09:23 +0000
Subject: [PATCH 1/5] fix: add livekit_server_container_http_host_bind_port for
 nginx-on-host setups
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The upstream galaxy/livekit_server role never publishes port 7880 (HTTP
signaling) to the host — it assumes a Traefik container on the same Docker
network. This breaks setups where nginx runs on a separate host and proxies
to the Matrix server over LAN.

Changes:
- Fork galaxy/livekit_server → roles/custom/livekit_server/ so the patch
  survives `make roles` (which wipes roles/galaxy/)
- Add livekit_server_container_http_host_bind_port variable (defaults to "")
  in defaults/main.yml; when set, publishes the HTTP port via -p flag
- Add {% if livekit_server_container_http_host_bind_port %} block in the
  systemd service template to conditionally map the port
- Guard network-creation tasks with `and livekit_server_container_network != 'host'`
  to prevent 403 errors when network: host is configured
- Update setup.yml: galaxy/livekit_server → custom/livekit_server

Usage in vars.yml:
  livekit_server_container_http_host_bind_port: '192.168.90.83:7880'

https://claude.ai/code/session_01SbRgWsRDKpTZ2TTbWDhtEB
---
 roles/custom/livekit_server/defaults/main.yml | 444 ++++++++++++++++++
 roles/custom/livekit_server/meta/main.yml     |  22 +
 roles/custom/livekit_server/tasks/install.yml | 128 +++++
 roles/custom/livekit_server/tasks/main.yml    |  28 ++
 .../custom/livekit_server/tasks/uninstall.yml |  47 ++
 .../livekit_server/tasks/validate_config.yml  |  48 ++
 .../livekit_server/templates/config.yaml.j2   |  66 +++
 roles/custom/livekit_server/templates/env.j2  |   9 +
 .../custom/livekit_server/templates/labels.j2 |  97 ++++
 .../systemd/livekit-server.service.j2         |  83 ++++
 roles/custom/livekit_server/vars/main.yml     |   8 +
 setup.yml                                     |   2 +-
 12 files changed, 981 insertions(+), 1 deletion(-)
 create mode 100644 roles/custom/livekit_server/defaults/main.yml
 create mode 100644 roles/custom/livekit_server/meta/main.yml
 create mode 100644 roles/custom/livekit_server/tasks/install.yml
 create mode 100644 roles/custom/livekit_server/tasks/main.yml
 create mode 100644 roles/custom/livekit_server/tasks/uninstall.yml
 create mode 100644 roles/custom/livekit_server/tasks/validate_config.yml
 create mode 100644 roles/custom/livekit_server/templates/config.yaml.j2
 create mode 100644 roles/custom/livekit_server/templates/env.j2
 create mode 100644 roles/custom/livekit_server/templates/labels.j2
 create mode 100644 roles/custom/livekit_server/templates/systemd/livekit-server.service.j2
 create mode 100644 roles/custom/livekit_server/vars/main.yml

diff --git a/roles/custom/livekit_server/defaults/main.yml b/roles/custom/livekit_server/defaults/main.yml
new file mode 100644
index 000000000..ce7f57974
--- /dev/null
+++ b/roles/custom/livekit_server/defaults/main.yml
@@ -0,0 +1,444 @@
+# SPDX-FileCopyrightText: 2022 MDAD project contributors
+# SPDX-FileCopyrightText: 2024 wjbeckett
+# SPDX-FileCopyrightText: 2024, 2025 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2025, 2026 Suguru Hirahara
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+# Project source code URL: https://github.com/livekit/livekit
+
+livekit_server_enabled: false
+
+livekit_server_identifier: livekit-server
+livekit_server_base_path: "/{{ livekit_server_identifier }}"
+livekit_server_config_path: "{{ livekit_server_base_path }}/config"
+
+# renovate: datasource=docker depName=docker.io/livekit/livekit-server
+livekit_server_version: v1.9.11
+
+livekit_server_uid: ""
+livekit_server_gid: ""
+
+# The scheme used for serving LiveKit Server.
+livekit_server_scheme: https
+
+# The hostname at which LiveKit Server is served.
+livekit_server_hostname: ""
+
+# The path at which LiveKit Server is served.
+livekit_server_path_prefix: /
+
+livekit_server_container_image: "{{ livekit_server_container_image_registry_prefix }}livekit/livekit-server:{{ livekit_server_version }}"
+livekit_server_container_image_registry_prefix: "{{ 'localhost/' if livekit_server_container_image_self_build else livekit_server_container_image_registry_prefix_upstream }}"
+livekit_server_container_image_registry_prefix_upstream: "{{ livekit_server_container_image_registry_prefix_upstream_default }}"
+livekit_server_container_image_registry_prefix_upstream_default: docker.io/
+livekit_server_container_image_force_pull: "{{ livekit_server_container_image.endswith(':latest') }}"
+
+livekit_server_container_image_self_build: false
+livekit_server_container_image_self_build_name: "livekit/livekit:{{ livekit_server_container_image_self_build_repo_version }}"
+livekit_server_container_image_self_build_repo: "https://github.com/livekit/livekit.git"
+livekit_server_container_image_self_build_repo_version: "{{ livekit_server_version if livekit_server_version != 'latest' else 'main' }}"
+livekit_server_container_image_self_build_src_files_path: "{{ livekit_server_base_path }}/docker-src"
+
+# The base container network. It will be auto-created by this role if it doesn't exist already.
+livekit_server_container_network: "{{ livekit_server_identifier }}"
+
+# Controls whether to publish the HTTP port (livekit_server_config_port / 7880) on the host.
+# Useful when a reverse proxy (e.g. nginx) runs on the host rather than in a container network.
+# Accepts: "<ip>:<host_port>" (e.g. "192.168.90.83:7880"), "<host_port>" (e.g. "7880"),
+# or empty string "" to skip publishing this port.
+livekit_server_container_http_host_bind_port: ""
+
+# Specify how the container publishes its RTC port and which interface to do it on.
+#
+# Takes an interface "<ip address>" (e.g. "127.0.0.1"), or empty string to listen on all interfaces.
+# Takes a null/none value (`~`) or 'none' (as a string) to prevent listening.
+livekit_server_container_rtc_listen_interface: "{{ '' if livekit_server_container_network != 'host' else 'none' }}"
+
+# Specify how the container publishes its TURN port and which interface to do it on.
+#
+# Takes an interface "<ip address>" (e.g. "127.0.0.1"), or empty string to listen on all interfaces.
+# Takes a null/none value (`~`) or 'none' (as a string) to prevent listening.
+livekit_server_container_turn_listen_interface: "{{ '' if livekit_server_container_network != 'host' else 'none' }}"
+
+# Specify how the container publishes its metrics and which interface to do it on.
+#
+# Takes an interface "<ip address>" (e.g. "127.0.0.1"), or empty string to listen on all interfaces.
+# Takes a null/none value (`~`) or 'none' (as a string) to prevent listening.
+# See `livekit_server_config_prometheus_port`.
+livekit_server_container_metrics_listen_interface: ~
+
+# A list of additional container networks that the container would be connected to.
+# The role does not create these networks, so make sure they already exist.
+# Use this to expose this container to another reverse proxy, which runs in a different container network.
+livekit_server_container_additional_networks: "{{ livekit_server_container_additional_networks_auto + livekit_server_container_additional_networks_custom }}"
+livekit_server_container_additional_networks_auto: []
+livekit_server_container_additional_networks_custom: []
+
+# A list of additional "volumes" to mount in the container.
+# This list gets populated dynamically at runtime. You can provide a different default value,
+# if you wish to mount your own files into the container.
+# Contains definition objects like this: `{"type": "bind", "src": "/outside", "dst": "/inside", "options": "readonly"}.
+# See the `--mount` documentation for the `docker run` command.
+livekit_server_container_additional_volumes: "{{ livekit_server_container_additional_volumes_auto + livekit_server_container_additional_volumes_custom }}"
+livekit_server_container_additional_volumes_auto: []
+livekit_server_container_additional_volumes_custom: []
+
+# livekit_server_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
+# See `../templates/labels.j2` for details.
+#
+# To inject your own other container labels, see `livekit_server_container_labels_additional_labels_custom`.
+livekit_server_container_labels_traefik_enabled: true
+livekit_server_container_labels_traefik_docker_network: "{{ livekit_server_container_network }}"
+livekit_server_container_labels_traefik_hostname: "{{ livekit_server_hostname }}"
+# The path prefix must either be `/` or not end with a slash (e.g. `/element`).
+livekit_server_container_labels_traefik_path_prefix: "{{ livekit_server_path_prefix }}"
+livekit_server_container_labels_traefik_rule: "Host(`{{ livekit_server_container_labels_traefik_hostname }}`){% if livekit_server_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ livekit_server_container_labels_traefik_path_prefix }}`){% endif %}"
+livekit_server_container_labels_traefik_priority: 0
+livekit_server_container_labels_traefik_entrypoints: web-secure
+livekit_server_container_labels_traefik_tls: "{{ livekit_server_container_labels_traefik_entrypoints != 'web' }}"
+livekit_server_container_labels_traefik_tls_certResolver: default  # noqa var-naming
+
+# Controls whether labels will be added that expose metrics (see `livekit_server_metrics_proxying_enabled`)
+livekit_server_container_labels_public_metrics_enabled: "{{ livekit_server_config_prometheus_enabled and livekit_server_metrics_proxying_enabled }}"
+livekit_server_container_labels_public_metrics_traefik_path: "{{ livekit_server_metrics_proxying_path }}"
+livekit_server_container_labels_public_metrics_traefik_rule: "Host(`{{ livekit_server_metrics_proxying_hostname }}`) && Path(`{{ livekit_server_container_labels_public_metrics_traefik_path }}`)"
+livekit_server_container_labels_public_metrics_traefik_priority: 0
+livekit_server_container_labels_public_metrics_traefik_entrypoints: "{{ livekit_server_container_labels_traefik_entrypoints }}"
+livekit_server_container_labels_public_metrics_traefik_tls: "{{ livekit_server_container_labels_traefik_tls }}"
+livekit_server_container_labels_public_metrics_traefik_tls_certResolver: "{{ livekit_server_container_labels_traefik_tls_certResolver }}"  # noqa var-naming
+livekit_server_container_labels_public_metrics_middleware_basic_auth_enabled: false
+# See: https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/basicauth/
+livekit_server_container_labels_public_metrics_middleware_basic_auth_users: ""
+
+# livekit_server_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
+# See `../templates/labels.j2` for details.
+# To add your own custom labels, use `livekit_server_container_labels_additional_labels_custom`
+#
+# Example:
+# livekit_server_container_labels_additional_labels_custom:
+#   - my.label=1
+#   - another.label="here"
+livekit_server_container_labels_additional_labels: "{{ livekit_server_container_labels_additional_labels_auto + livekit_server_container_labels_additional_labels_custom }}"
+livekit_server_container_labels_additional_labels_auto: []
+livekit_server_container_labels_additional_labels_custom: []
+
+# A list of extra arguments to pass to the container (`docker create` command)
+livekit_server_container_extra_arguments: "{{ livekit_server_container_extra_arguments_auto + livekit_server_container_extra_arguments_custom }}"
+livekit_server_container_extra_arguments_auto: []
+livekit_server_container_extra_arguments_custom: []
+
+# Specifies the maximum size of the socket receive buffer (`net.core.rmem_max`) kernel parameter on the host (which will cascade into the container) to at least this value.
+# If the host uses a larger value, this will be ignored.
+#
+# We intentionally increase these buffers to 7.5MB, to LiveKit Server happy.
+# It may otherwise report something like:
+# > rtcconfig/rtc_unix.go:31        UDP receive buffer is too small for a production set-up        {"current": 425984, "suggested": 5000000}
+#
+#
+# The reason we apply this at the host level, not via `docker run --sysctl` is that
+# the `docker run --sysctl` option doesn't seem to work here (likely because it's Alpine in the container or something):
+# > Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: open /proc/sys/net/core/rmem_max: permission denied
+# This same error is produced even if the container is started as root, with all capabilities, and `--privileged`, etc.
+#
+# If this is blank, no sysctl changes will be made.
+livekit_server_host_sysctl_minimum_net_core_rmem_max: 7500000
+
+# Specifies the maximum size of the socket send buffer (`net.core.wmem_max`) kernel parameter on the host (which will cascade into the container) to at least this value.
+# If the host uses a larger value, this will be ignored.
+#
+# See the comment for `livekit_server_host_sysctl_minimum_net_core_rmem_max` for more details
+# about why we need to increase these buffers.
+#
+# If this is blank, no sysctl changes will be made.
+livekit_server_host_sysctl_minimum_net_core_wmem_max: 7500000
+
+# List of systemd services that the LiveKit Server service depends on
+livekit_server_systemd_required_services_list: "{{ livekit_server_systemd_required_services_list_default + livekit_server_systemd_required_services_list_auto + livekit_server_systemd_required_services_list_custom }}"
+livekit_server_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
+livekit_server_systemd_required_services_list_auto: []
+livekit_server_systemd_required_services_list_custom: []
+
+# List of systemd services that the LiveKit Server systemd service wants
+livekit_server_systemd_wanted_services_list: "{{ livekit_server_systemd_wanted_services_list_default + livekit_server_systemd_wanted_services_list_auto + livekit_server_systemd_wanted_services_list_custom }}"
+livekit_server_systemd_wanted_services_list_default: []
+livekit_server_systemd_wanted_services_list_auto: []
+livekit_server_systemd_wanted_services_list_custom: []
+
+# Holds the final LiveKit Server configuration (a combination of the default and its extension).
+# You most likely don't need to touch this variable. Instead, see `livekit_server_configuration_yaml` or `livekit_server_configuration_extension_yaml`.
+livekit_server_configuration: "{{ livekit_server_configuration_yaml | from_yaml | combine(livekit_server_configuration_extension, recursive=True) }}"
+
+# Default LiveKit Server configuration template which covers the generic use case.
+# You can customize it by controlling the various variables inside it.
+#
+# For a more advanced customization, you can extend the default (see `livekit_server_configuration_extension_yaml`)
+# or completely replace this variable with your own template.
+livekit_server_configuration_yaml: "{{ lookup('template', 'templates/config.yaml.j2') }}"
+
+livekit_server_configuration_extension_yaml: |
+  # Your custom YAML configuration for LiveKit Server goes here.
+  # This configuration extends the default starting configuration (`livekit_server_configuration_yaml`).
+  #
+  # You can override individual variables from the default configuration, or introduce new ones.
+  #
+  # If you need something more special, you can take full control by
+  # completely redefining `livekit_server_configuration_yaml`.
+  #
+  # Example configuration extension follows:
+  #
+  # logging:
+  #   level: debug
+
+livekit_server_configuration_extension: "{{ livekit_server_configuration_extension_yaml | from_yaml if livekit_server_configuration_extension_yaml | from_yaml is mapping else {} }}"
+
+# Controls the `port` configuration property.
+# See: https://docs.livekit.io/home/self-hosting/ports-firewall/
+livekit_server_config_port: 7880
+
+# Controls the `bind_addresses` configuration property.
+livekit_server_config_bind_addresses: ["::"]
+
+# Specify the timezone
+livekit_server_environment_variables_tz: UTC
+
+# Additional environment variables.
+livekit_server_environment_variables_additional_variables: ""
+
+########################################################################################
+#                                                                                      #
+# Room                                                                                 #
+#                                                                                      #
+########################################################################################
+
+# Controls the `room.auto_create` configuration property.
+# (Allow rooms to be automatically created when participants join).
+#
+# This defaults to true based on upstream defaults.
+# Ref: https://github.com/livekit/livekit/blob/5e483e7554e5afbf254acf84e3ec0aa6e108e758/config-sample.yaml#L168-L170
+livekit_server_config_room_auto_create: true
+
+########################################################################################
+#                                                                                      #
+# /Room                                                                                #
+#                                                                                      #
+########################################################################################
+
+########################################################################################
+#                                                                                      #
+# RTC                                                                                  #
+#                                                                                      #
+########################################################################################
+
+# Controls the `rtc.tcp_port` configuration property
+# See: https://docs.livekit.io/home/self-hosting/ports-firewall/
+livekit_server_config_rtc_tcp_port: 7881
+
+# Controls the `rtc.port_range_start` configuration property.
+# This must be defined together with `livekit_server_config_rtc_port_range_end`,
+# or alternatively `livekit_server_config_rtc_udp_port` can be defined as a single port that handles all traffic.
+# Example: 50100
+# See: https://docs.livekit.io/home/self-hosting/ports-firewall/
+livekit_server_config_rtc_port_range_start: ""
+
+# Controls the `rtc.port_range_end` configuration property.
+# This must be defined together with `livekit_server_config_rtc_port_range_start`,
+# or alternatively `livekit_server_config_rtc_udp_port` can be defined as a single port that handles all traffic.
+# Example: 50200
+# See: https://docs.livekit.io/home/self-hosting/ports-firewall/
+livekit_server_config_rtc_port_range_end: ""
+
+# Controls the `rtc.udp_port` configuration property.
+# As an alternative to this, one may define both `livekit_server_config_rtc_port_range_start` and `livekit_server_config_rtc_port_range_end`.
+# Example: 7882
+# See: https://docs.livekit.io/home/self-hosting/ports-firewall/
+livekit_server_config_rtc_udp_port: 7882
+
+# Controls the `rtc.use_external_ip` configuration property.
+# When set to true, attempts to discover the host's public IP via STUN.
+# This is useful for cloud environments such as AWS & Google where hosts have an internal IP that maps to an external one.
+# Related to: `livekit_server_config_rtc_node_ip`
+livekit_server_config_rtc_use_external_ip: true
+
+# Controls the `rtc.node_ip` configuration property.
+# This is the IP address sent to the client in case you cannot rely on external IP auto-detection.
+# Related to `livekit_server_config_rtc_use_external_ip`
+# See: https://github.com/livekit/livekit/issues/3747
+livekit_server_config_rtc_node_ip: ""
+
+########################################################################################
+#                                                                                      #
+# /RTC                                                                                 #
+#                                                                                      #
+########################################################################################
+
+########################################################################################
+#                                                                                      #
+# TURN                                                                                 #
+#                                                                                      #
+########################################################################################
+
+# Controls the `turn.enabled` configuration property.
+# When set to true, enables TURN server.
+livekit_server_config_turn_enabled: false
+
+# Controls the `turn.domain` configuration property.
+# Example: livekit.example.com
+livekit_server_config_turn_domain: "{{ livekit_server_hostname }}"
+
+# Controls the `turn.cert_file` configuration property.
+# Path to the TLS certificate file in the container.
+# Files on the host can be mounted into the container using `livekit_server_container_additional_volumes`.
+livekit_server_config_turn_cert_file: ""
+
+# Controls the `turn.key_file` configuration property.
+# Path to the TLS key file in the container.
+# Files on the host can be mounted into the container using `livekit_server_container_additional_volumes`.
+livekit_server_config_turn_key_file: ""
+
+# Controls the `turn.external_tls` configuration property.
+livekit_server_config_turn_external_tls: false
+
+# Controls the `turn.tls_port` configuration property.
+# See: https://docs.livekit.io/home/self-hosting/ports-firewall/
+livekit_server_config_turn_tls_port: 5349
+
+# Controls the `turn.udp_port` configuration property.
+# See: https://docs.livekit.io/home/self-hosting/ports-firewall/
+livekit_server_config_turn_udp_port: 3478
+
+########################################################################################
+#                                                                                      #
+# /TURN                                                                                #
+#                                                                                      #
+########################################################################################
+
+########################################################################################
+#                                                                                      #
+# Prometheus                                                                           #
+#                                                                                      #
+########################################################################################
+
+# When set to true, enables Prometheus metrics.
+livekit_server_config_prometheus_enabled: false
+
+# Controls the `prometheus.port` configuration property, which affects the metrics port (in the container) that LiveKit Server exposes.
+livekit_server_config_prometheus_port: 8081
+
+# Controls the `prometheus.username` configuration property.
+# As an alternative, can configure authentication via `livekit_server_container_labels_public_metrics_middleware_basic_auth_users` as well.
+livekit_server_config_prometheus_username: ""
+
+# Controls the `prometheus.password` configuration property.
+# As an alternative, can configure authentication via `livekit_server_container_labels_public_metrics_middleware_basic_auth_users` as well.
+livekit_server_config_prometheus_password: ""
+
+########################################################################################
+#                                                                                      #
+# /Prometheus                                                                          #
+#                                                                                      #
+########################################################################################
+
+# Controls the `keys` configuration property.
+livekit_server_config_keys: "{{ livekit_server_config_keys_auto | combine(livekit_server_config_keys_custom, recursive=True) }}"
+livekit_server_config_keys_auto: {}
+livekit_server_config_keys_custom: {}
+
+########################################################################################
+#                                                                                      #
+# Limits                                                                               #
+#                                                                                      #
+########################################################################################
+
+# Ref:
+# - https://github.com/livekit/livekit/blob/46651c1978c8ae29d9b2d544b8b089c0960c9314/config-sample.yaml#L311-L330
+# - https://github.com/livekit/livekit/blob/46651c1978c8ae29d9b2d544b8b089c0960c9314/pkg/config/config.go#L395-L401
+# - for `num_tracks` and `bytes_per_sec`, the config-sample-yaml comments seem to be misleading. Defaults seem to be `0` in LiveKit code.
+
+# Controls the `limit.num_tracks` configuration property.
+# Set to -1 or 0 to disable the limit.
+livekit_server_config_limit_num_tracks: 0
+
+# Controls the `limit.bytes_per_sec` configuration property.
+# Set to 0 to disable the limit.
+livekit_server_config_limit_bytes_per_sec: 0
+
+# Controls the `limit.subscription_limit_video` configuration property.
+# How many video tracks a single participant can subscribe to at the same time.
+# 0 means no limit.
+livekit_server_config_limit_subscription_limit_video: 0
+
+# Controls the `limit.subscription_limit_audio` configuration property.
+# How many audio tracks a single participant can subscribe to at the same time.
+# 0 means no limit.
+livekit_server_config_limit_subscription_limit_audio: 0
+
+# Controls the `limit.max_metadata_size` configuration property.
+# Limit size of room and participant's metadata. 0 means no limit.
+livekit_server_config_limit_max_metadata_size: 64000
+
+# Controls the `limit.max_attributes_size` configuration property.
+# Limit total size of all attributes on a participant. 0 means no limit.
+livekit_server_config_limit_max_attributes_size: 64000
+
+# Controls the `limit.max_room_name_length` configuration property.
+# Limit length of room names. 0 means no limit.
+livekit_server_config_limit_max_room_name_length: 256
+
+# Controls the `limit.max_participant_identity_length` configuration property.
+# Limit length of participant identity. 0 means no limit.
+livekit_server_config_limit_max_participant_identity_length: 256
+
+# Controls the `limit.max_participant_name_length` configuration property.
+# Limit length of participant names. 0 means no limit.
+livekit_server_config_limit_max_participant_name_length: 256
+
+########################################################################################
+#                                                                                      #
+# /Limits                                                                              #
+#                                                                                      #
+########################################################################################
+
+########################################################################################
+#                                                                                      #
+# Logging                                                                              #
+#                                                                                      #
+########################################################################################
+
+# Controls the `logging.level` configuration property.
+# Valid values: debug, info, warn, error
+livekit_server_config_logging_level: info
+
+# Controls the `logging.pion_level` configuration property
+livekit_server_config_logging_pion_level: error
+
+# Controls the `logging.json` configuration property.
+# When set to true, emits json fields.
+livekit_server_config_logging_json: false
+
+# Controls the `logging.sample` configuration property.
+# For production setups, enables sampling algorithm.
+# See: https://github.com/uber-go/zap/blob/master/FAQ.md#why-sample-application-logs
+livekit_server_config_logging_sample: false
+
+########################################################################################
+#                                                                                      #
+# /Logging                                                                             #
+#                                                                                      #
+########################################################################################
+
+# Controls whether LiveKitServer's metrics should be proxied (exposed) publicly via Traefik.
+livekit_server_metrics_proxying_enabled: false
+livekit_server_metrics_proxying_hostname: ""
+livekit_server_metrics_proxying_path: /metrics/livekit-server
+
+# livekit_server_restart_necessary controls whether the LiveKit Server systemd
+# service will be restarted (when true) or merely started (when false) by the
+# systemd service manager role (when conditional restart is enabled).
+#
+# This value is automatically computed during installation based on whether
+# any configuration files, the systemd service file, or the container image changed.
+# The default of `false` means "no restart needed" — appropriate when the role's
+# installation tasks haven't run (e.g., due to --tags skipping them).
+livekit_server_restart_necessary: false
diff --git a/roles/custom/livekit_server/meta/main.yml b/roles/custom/livekit_server/meta/main.yml
new file mode 100644
index 000000000..df1908d15
--- /dev/null
+++ b/roles/custom/livekit_server/meta/main.yml
@@ -0,0 +1,22 @@
+---
+galaxy_info:
+  author: MASH
+  company: MASH
+  role_name: livekit_server
+  namespace: mash
+  description: LiveKit Server
+  platforms:
+    - name: Debian
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
+    - name: ArchLinux
+      versions:
+        - all
+    - name: EL
+      versions:
+        - all
+  license: AGPL-3.0-or-later
+  min_ansible_version: '2.1'
diff --git a/roles/custom/livekit_server/tasks/install.yml b/roles/custom/livekit_server/tasks/install.yml
new file mode 100644
index 000000000..ce63814a6
--- /dev/null
+++ b/roles/custom/livekit_server/tasks/install.yml
@@ -0,0 +1,128 @@
+# SPDX-FileCopyrightText: 2022 MDAD project contributors
+# SPDX-FileCopyrightText: 2024 wjbeckett
+# SPDX-FileCopyrightText: 2024, 2025 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2025, 2026 Suguru Hirahara
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Ensure LiveKit Server paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: "0750"
+    owner: "{{ livekit_server_uid }}"
+    group: "{{ livekit_server_gid }}"
+  with_items:
+    - { path: "{{ livekit_server_base_path }}", when: true }
+    - { path: "{{ livekit_server_config_path }}", when: true }
+    - { path: "{{ livekit_server_container_image_self_build_src_files_path }}", when: "{{ livekit_server_container_image_self_build }}" }
+  when: "item.when | bool"
+
+- name: Ensure LiveKit Server support files installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/{{ item }}.j2"
+    dest: "{{ livekit_server_base_path }}/{{ item }}"
+    mode: "0640"
+    owner: "{{ livekit_server_uid }}"
+    group: "{{ livekit_server_gid }}"
+  with_items:
+    - env
+    - labels
+  register: livekit_server_support_files_result
+
+- name: Ensure LiveKit Server configuration installed
+  ansible.builtin.copy:
+    content: "{{ livekit_server_configuration | to_nice_yaml(indent=2, width=999999) }}"
+    dest: "{{ livekit_server_config_path }}/config.yaml"
+    mode: "0640"
+    owner: "{{ livekit_server_uid }}"
+    group: "{{ livekit_server_gid }}"
+  register: livekit_server_config_result
+
+- name: Run if self-building of LiveKit Server container image is not enabled
+  when: "not livekit_server_container_image_self_build | bool"
+  block:
+    - name: Ensure LiveKit Server container image is pulled via community.docker.docker_image
+      when: devture_systemd_docker_base_container_image_pull_method == 'ansible-module'
+      community.docker.docker_image:
+        name: "{{ livekit_server_container_image }}"
+        source: "{{ 'pull' if ansible_version.major > 2 or ansible_version.minor > 7 else omit }}"
+        force_source: "{{ livekit_server_container_image_force_pull if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else livekit_server_container_image_force_pull }}"
+      register: livekit_server_container_image_pull_result
+      retries: "{{ devture_playbook_help_container_retries_count }}"
+      delay: "{{ devture_playbook_help_container_retries_delay }}"
+      until: livekit_server_container_image_pull_result is not failed
+
+    - name: Ensure LiveKit Server container image is pulled via ansible.builtin.command
+      when: devture_systemd_docker_base_container_image_pull_method == 'command'
+      ansible.builtin.command:
+        cmd: "{{ devture_systemd_docker_base_host_command_docker }} pull {{ livekit_server_container_image }}"
+      register: livekit_server_container_image_pull_result
+      retries: "{{ devture_playbook_help_container_retries_count }}"
+      delay: "{{ devture_playbook_help_container_retries_delay }}"
+      until: livekit_server_container_image_pull_result is not failed
+      changed_when: "'Downloaded newer image' in livekit_server_container_image_pull_result.stdout"
+
+- name: Run if self-building of LiveKit Server container image is enabled
+  when: "livekit_server_container_image_self_build | bool"
+  block:
+    - name: Ensure LiveKit Server repository is present on self-build
+      ansible.builtin.git:
+        repo: "{{ livekit_server_container_image_self_build_repo }}"
+        version: "{{ livekit_server_container_image_self_build_repo_version }}"
+        dest: "{{ livekit_server_container_image_self_build_src_files_path }}"
+        force: "yes"
+      become: true
+      become_user: "{{ livekit_server_uid }}"
+      register: livekit_server_git_pull_results
+
+    - name: Ensure LiveKit Server container image is built
+      community.docker.docker_image:
+        name: "{{ livekit_server_container_image_self_build_name }}"
+        source: build
+        force_source: "{{ livekit_server_git_pull_results.changed if ansible_version.major > 2 or ansible_version.minor >= 8 else omit }}"
+        force: "{{ omit if ansible_version.major > 2 or ansible_version.minor >= 8 else livekit_server_git_pull_results.changed }}"
+        build:
+          dockerfile: Dockerfile
+          path: "{{ livekit_server_container_image_self_build_src_files_path }}"
+          pull: true
+          args:
+
+- name: Ensure LiveKit Server container network is created via community.docker.docker_network
+  when: devture_systemd_docker_base_container_network_creation_method == 'ansible-module' and livekit_server_container_network != 'host'
+  community.docker.docker_network:
+    enable_ipv6: "{{ devture_systemd_docker_base_ipv6_enabled }}"
+    name: "{{ livekit_server_container_network }}"
+    driver: bridge
+    driver_options: "{{ devture_systemd_docker_base_container_networks_driver_options }}"
+
+- name: Ensure LiveKit Server container network is created via ansible.builtin.command
+  when: devture_systemd_docker_base_container_network_creation_method == 'command' and livekit_server_container_network != 'host'
+  ansible.builtin.command:
+    cmd: >-
+      {{ devture_systemd_docker_base_host_command_docker }} network create
+      {% if devture_systemd_docker_base_ipv6_enabled %}--ipv6{% endif %}
+      {{ devture_systemd_docker_base_container_networks_driver_options_string }}
+      {{ livekit_server_container_network }}
+  register: network_creation_result
+  changed_when: network_creation_result.rc == 0
+  failed_when: network_creation_result.rc != 0 and 'already exists' not in network_creation_result.stderr
+
+- name: Ensure LiveKit Server systemd service is installed
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/systemd/livekit-server.service.j2"
+    dest: "{{ devture_systemd_docker_base_systemd_path }}/{{ livekit_server_identifier }}.service"
+    mode: "0644"
+  register: livekit_server_systemd_service_result
+
+- name: Determine whether LiveKit Server needs a restart
+  ansible.builtin.set_fact:
+    livekit_server_restart_necessary: >-
+      {{
+        livekit_server_support_files_result.changed | default(false)
+        or livekit_server_config_result.changed | default(false)
+        or livekit_server_systemd_service_result.changed | default(false)
+        or livekit_server_container_image_pull_result.changed | default(false)
+      }}
diff --git a/roles/custom/livekit_server/tasks/main.yml b/roles/custom/livekit_server/tasks/main.yml
new file mode 100644
index 000000000..77479a81e
--- /dev/null
+++ b/roles/custom/livekit_server/tasks/main.yml
@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2022 MDAD project contributors
+# SPDX-FileCopyrightText: 2024 wjbeckett
+# SPDX-FileCopyrightText: 2024 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Perform LiveKit Server installation tasks
+  when: livekit_server_enabled | bool
+  tags:
+    - setup-all
+    - setup-livekit-server
+    - install-all
+    - install-livekit-server
+  block:
+    - name: Validate LiveKit Server configuration
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/validate_config.yml"
+    - name: Install LiveKit Server
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/install.yml"
+
+- name: Perform LiveKit Server uninstallation tasks
+  when: not livekit_server_enabled | bool
+  tags:
+    - setup-all
+    - setup-livekit-server
+  block:
+    - name: Uninstall LiveKit Server
+      ansible.builtin.include_tasks: "{{ role_path }}/tasks/uninstall.yml"
diff --git a/roles/custom/livekit_server/tasks/uninstall.yml b/roles/custom/livekit_server/tasks/uninstall.yml
new file mode 100644
index 000000000..aab82cd9a
--- /dev/null
+++ b/roles/custom/livekit_server/tasks/uninstall.yml
@@ -0,0 +1,47 @@
+# SPDX-FileCopyrightText: 2022 MDAD project contributors
+# SPDX-FileCopyrightText: 2024 wjbeckett
+# SPDX-FileCopyrightText: 2024 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2025 Suguru Hirahara
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: Check existence of LiveKit Server service
+  ansible.builtin.stat:
+    path: "{{ devture_systemd_docker_base_systemd_path }}/{{ livekit_server_identifier }}.service"
+  register: livekit_server_service_stat
+
+- name: Uninstall LiveKit Server systemd services and files
+  when: livekit_server_service_stat.stat.exists | bool
+  block:
+    - name: Ensure LiveKit Server is stopped
+      ansible.builtin.service:
+        name: "{{ livekit_server_identifier }}"
+        state: stopped
+        enabled: false
+        daemon_reload: true
+
+    - name: Ensure LiveKit Server systemd service does not exist
+      ansible.builtin.file:
+        path: "{{ devture_systemd_docker_base_systemd_path }}/{{ livekit_server_identifier }}.service"
+        state: absent
+
+    - name: Ensure LiveKit Server container network does not exist via community.docker.docker_network
+      when: devture_systemd_docker_base_container_network_creation_method == 'ansible-module'
+      community.docker.docker_network:
+        name: "{{ livekit_server_container_network }}"
+        state: absent
+
+    - name: Ensure LiveKit Server container network does not exist via ansible.builtin.command
+      when: devture_systemd_docker_base_container_network_creation_method == 'command'
+      ansible.builtin.command:
+        cmd: >-
+          {{ devture_systemd_docker_base_host_command_docker }} network rm
+          {{ livekit_server_container_network }}
+      register: network_deletion_result
+      changed_when: livekit_server_container_network in network_deletion_result.stdout
+
+    - name: Ensure LiveKit Server path does not exist
+      ansible.builtin.file:
+        path: "{{ livekit_server_base_path }}"
+        state: absent
diff --git a/roles/custom/livekit_server/tasks/validate_config.yml b/roles/custom/livekit_server/tasks/validate_config.yml
new file mode 100644
index 000000000..702445eeb
--- /dev/null
+++ b/roles/custom/livekit_server/tasks/validate_config.yml
@@ -0,0 +1,48 @@
+# SPDX-FileCopyrightText: 2022 MDAD project contributors
+# SPDX-FileCopyrightText: 2023 - 2024 Slavi Pantaleev
+# SPDX-FileCopyrightText: 2024 wjbeckett
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+- name: (Deprecation) Catch and report renamed settings
+  ansible.builtin.fail:
+    msg: >-
+      Your configuration contains a variable, which now has a different name.
+      Please change your configuration to rename the variable (`{{ item.old }}` -> `{{ item.new }}`).
+  when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0"
+  with_items:
+    - { "old": "livekit_server_container_repo", "new": "livekit_server_container_image_self_build_repo" }
+    - { "old": "livekit_server_container_repo_version", "new": "livekit_server_container_image_self_build_repo_version" }
+    - { "old": "livekit_server_container_src_files_path", "new": "livekit_server_container_image_self_build_src_files_path" }
+
+- name: Fail if required LiveKit Server settings are not defined
+  ansible.builtin.fail:
+    msg: >-
+      You need to define a required configuration setting (`{{ item.name }}`).
+  when: "item.when | bool and lookup('vars', item.name, default='') | string | length == 0"
+  with_items:
+    - { "name": "livekit_server_identifier", when: true }
+    - { "name": "livekit_server_uid", when: true }
+    - { "name": "livekit_server_gid", when: true }
+    - { "name": "livekit_server_hostname", when: true }
+    - { "name": "livekit_server_container_network", when: true }
+    - { "name": "livekit_server_config_turn_domain", when: "{{ livekit_server_config_turn_enabled | bool }}" }
+    - { "name": "livekit_server_config_turn_cert_file", when: "{{ livekit_server_config_turn_enabled | bool }}" }
+    - { "name": "livekit_server_config_turn_key_file", when: "{{ livekit_server_config_turn_enabled | bool }}" }
+
+- name: Fail if LiveKit Server port range configuration is invalid
+  ansible.builtin.fail:
+    msg: >-
+      You need to either define both port range settings (livekit_server_config_rtc_port_range_start and livekit_server_config_rtc_port_range_end)
+      or define a single UDP port (livekit_server_config_rtc_udp_port).
+  when: >
+    (livekit_server_config_rtc_port_range_start | string | length > 0 and livekit_server_config_rtc_port_range_end | string | length == 0) or
+    (livekit_server_config_rtc_port_range_start | string | length == 0 and livekit_server_config_rtc_port_range_end | string | length > 0) or
+    (livekit_server_config_rtc_port_range_start | string | length == 0 and livekit_server_config_rtc_port_range_end | string | length == 0 and livekit_server_config_rtc_udp_port | string | length == 0)
+
+- name: Fail if LiveKit Server logging level is invalid
+  ansible.builtin.fail:
+    msg: >-
+      livekit_server_config_logging_level must be 'debug', 'info', 'warn', or 'error'
+  when: "livekit_server_config_logging_level not in ['debug', 'info', 'warn', 'error']"
diff --git a/roles/custom/livekit_server/templates/config.yaml.j2 b/roles/custom/livekit_server/templates/config.yaml.j2
new file mode 100644
index 000000000..7c13fc217
--- /dev/null
+++ b/roles/custom/livekit_server/templates/config.yaml.j2
@@ -0,0 +1,66 @@
+#jinja2: lstrip_blocks: True
+
+port: {{ livekit_server_config_port | int | to_json }}
+
+bind_addresses: {{ livekit_server_config_bind_addresses | to_json }}
+
+room:
+  auto_create: {{ livekit_server_config_room_auto_create | to_json }}
+
+rtc:
+  tcp_port: {{ livekit_server_config_rtc_tcp_port | int | to_json }}
+
+  {% if livekit_server_config_rtc_udp_port %}
+  udp_port: {{ livekit_server_config_rtc_udp_port | int | to_json }}
+  {% endif %}
+
+  {% if livekit_server_config_rtc_port_range_start %}
+  port_range_start: {{ livekit_server_config_rtc_port_range_start | int | to_json }}
+  {% endif %}
+
+  {% if livekit_server_config_rtc_port_range_end %}
+  port_range_end: {{ livekit_server_config_rtc_port_range_end | int | to_json }}
+  {% endif %}
+
+  use_external_ip: {{ livekit_server_config_rtc_use_external_ip | to_json }}
+
+  {% if livekit_server_config_rtc_node_ip %}
+  node_ip: {{ livekit_server_config_rtc_node_ip | to_json }}
+  {% endif %}
+
+turn:
+  enabled: {{ livekit_server_config_turn_enabled | to_json }}
+{% if livekit_server_config_turn_enabled %}
+  domain: {{ livekit_server_config_turn_domain | to_json }}
+  cert_file: {{ livekit_server_config_turn_cert_file | to_json }}
+  key_file: {{ livekit_server_config_turn_key_file | to_json }}
+  tls_port: {{ livekit_server_config_turn_tls_port | int | to_json }}
+  udp_port: {{ livekit_server_config_turn_udp_port | int | to_json }}
+  external_tls: {{ livekit_server_config_turn_external_tls | to_json }}
+{% endif %}
+
+{% if livekit_server_config_prometheus_enabled %}
+prometheus:
+  port: {{ livekit_server_config_prometheus_port | int | to_json }}
+  username: {{ livekit_server_config_prometheus_username | to_json }}
+  password: {{ livekit_server_config_prometheus_password | to_json }}
+{% endif %}
+
+keys: {{ livekit_server_config_keys | to_json }}
+
+limit:
+  num_tracks: {{ livekit_server_config_limit_num_tracks | to_json }}
+  bytes_per_sec: {{ livekit_server_config_limit_bytes_per_sec | to_json }}
+  subscription_limit_video: {{ livekit_server_config_limit_subscription_limit_video | to_json }}
+  subscription_limit_audio: {{ livekit_server_config_limit_subscription_limit_audio | to_json }}
+  max_metadata_size: {{ livekit_server_config_limit_max_metadata_size | to_json }}
+  max_attributes_size: {{ livekit_server_config_limit_max_attributes_size | to_json }}
+  max_room_name_length: {{ livekit_server_config_limit_max_room_name_length | to_json }}
+  max_participant_identity_length: {{ livekit_server_config_limit_max_participant_identity_length | to_json }}
+  max_participant_name_length: {{ livekit_server_config_limit_max_participant_name_length | to_json }}
+
+logging:
+  level: {{ livekit_server_config_logging_level | to_json }}
+  pion_level: {{ livekit_server_config_logging_pion_level | to_json }}
+  json: {{ livekit_server_config_logging_json | to_json }}
+  sample: {{ livekit_server_config_logging_sample | to_json }}
diff --git a/roles/custom/livekit_server/templates/env.j2 b/roles/custom/livekit_server/templates/env.j2
new file mode 100644
index 000000000..cd2f6422b
--- /dev/null
+++ b/roles/custom/livekit_server/templates/env.j2
@@ -0,0 +1,9 @@
+{#
+SPDX-FileCopyrightText: 2026 Suguru Hirahara
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+TZ={{ livekit_server_environment_variables_tz }}
+
+{{ livekit_server_environment_variables_additional_variables }}
diff --git a/roles/custom/livekit_server/templates/labels.j2 b/roles/custom/livekit_server/templates/labels.j2
new file mode 100644
index 000000000..443e87237
--- /dev/null
+++ b/roles/custom/livekit_server/templates/labels.j2
@@ -0,0 +1,97 @@
+{#
+SPDX-FileCopyrightText: 2024 wjbeckett
+SPDX-FileCopyrightText: 2024 - 2025 Slavi Pantaleev
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+{% if livekit_server_container_labels_traefik_enabled %}
+traefik.enable=true
+
+{% if livekit_server_container_labels_traefik_docker_network %}
+traefik.docker.network={{ livekit_server_container_labels_traefik_docker_network }}
+{% endif %}
+
+traefik.http.services.{{ livekit_server_identifier }}.loadbalancer.server.port={{ livekit_server_config_port }}
+
+{% if livekit_server_config_prometheus_enabled %}
+traefik.http.services.{{ livekit_server_identifier }}-metrics.loadbalancer.server.port={{ livekit_server_config_prometheus_port }}
+{% endif %}
+
+{% set middlewares = [] %}
+
+{% if livekit_server_container_labels_traefik_path_prefix != '/' %}
+traefik.http.middlewares.{{ livekit_server_identifier }}-slashless-redirect.redirectregex.regex=^({{ livekit_server_container_labels_traefik_path_prefix | quote }})$
+traefik.http.middlewares.{{ livekit_server_identifier }}-slashless-redirect.redirectregex.replacement=${1}/
+{% set middlewares = middlewares + [livekit_server_identifier + '-slashless-redirect'] %}
+
+traefik.http.middlewares.{{ livekit_server_identifier }}-strip-prefix.stripprefix.prefixes={{ livekit_server_container_labels_traefik_path_prefix }}
+{% set middlewares = middlewares + [livekit_server_identifier + '-strip-prefix'] %}
+{% endif %}
+
+traefik.http.routers.{{ livekit_server_identifier }}.rule={{ livekit_server_container_labels_traefik_rule }}
+
+{% if livekit_server_container_labels_traefik_priority | int > 0 %}
+traefik.http.routers.{{ livekit_server_identifier }}.priority={{ livekit_server_container_labels_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.{{ livekit_server_identifier }}.service={{ livekit_server_identifier }}
+
+{% if middlewares | length > 0 %}
+traefik.http.routers.{{ livekit_server_identifier }}.middlewares={{ middlewares | join(',') }}
+{% endif %}
+
+traefik.http.routers.{{ livekit_server_identifier }}.entrypoints={{ livekit_server_container_labels_traefik_entrypoints }}
+
+traefik.http.routers.{{ livekit_server_identifier }}.tls={{ livekit_server_container_labels_traefik_tls | to_json }}
+{% if livekit_server_container_labels_traefik_tls %}
+traefik.http.routers.{{ livekit_server_identifier }}.tls.certResolver={{ livekit_server_container_labels_traefik_tls_certResolver }}
+{% endif %}
+
+{% if livekit_server_container_labels_public_metrics_enabled %}
+########################################################################
+#                                                                      #
+# Metrics                                                              #
+#                                                                      #
+########################################################################
+
+{% set metrics_middlewares = [] %}
+
+{% if livekit_server_container_labels_public_metrics_middleware_basic_auth_enabled %}
+{% set metrics_middlewares = metrics_middlewares + [livekit_server_identifier + '-metrics-basic-auth'] %}
+traefik.http.middlewares.{{ livekit_server_identifier }}-metrics-basic-auth.basicauth.users={{ livekit_server_container_labels_public_metrics_middleware_basic_auth_users }}
+{% endif %}
+
+{% set metrics_middlewares = metrics_middlewares + [livekit_server_identifier + '-metrics-replacepath'] %}
+traefik.http.middlewares.{{ livekit_server_identifier }}-metrics-replacepath.replacepath.path={{ livekit_server_metrics_proxying_path_prefix }}
+
+traefik.http.routers.{{ livekit_server_identifier }}-metrics.rule={{ livekit_server_container_labels_public_metrics_traefik_rule }}
+
+{% if metrics_middlewares | length > 0 %}
+traefik.http.routers.{{ livekit_server_identifier }}-metrics.middlewares={{ metrics_middlewares | join(',') }}
+{% endif %}
+
+{% if livekit_server_container_labels_public_metrics_traefik_priority | int > 0 %}
+traefik.http.routers.{{ livekit_server_identifier }}-metrics.priority={{ livekit_server_container_labels_public_metrics_traefik_priority }}
+{% endif %}
+
+traefik.http.routers.{{ livekit_server_identifier }}-metrics.service={{ livekit_server_identifier }}-metrics
+traefik.http.routers.{{ livekit_server_identifier }}-metrics.entrypoints={{ livekit_server_container_labels_public_metrics_traefik_entrypoints }}
+
+traefik.http.routers.{{ livekit_server_identifier }}-metrics.tls={{ livekit_server_container_labels_public_metrics_traefik_tls | to_json }}
+{% if livekit_server_container_labels_public_metrics_traefik_tls %}
+traefik.http.routers.{{ livekit_server_identifier }}-metrics.tls.certResolver={{ livekit_server_container_labels_public_metrics_traefik_tls_certResolver }}
+{% endif %}
+
+########################################################################
+#                                                                      #
+# /Metrics                                                             #
+#                                                                      #
+########################################################################
+{% endif %}
+
+{% endif %}
+
+{% for arg in livekit_server_container_labels_additional_labels %}
+{{ arg }}
+{% endfor %}
diff --git a/roles/custom/livekit_server/templates/systemd/livekit-server.service.j2 b/roles/custom/livekit_server/templates/systemd/livekit-server.service.j2
new file mode 100644
index 000000000..644f24588
--- /dev/null
+++ b/roles/custom/livekit_server/templates/systemd/livekit-server.service.j2
@@ -0,0 +1,83 @@
+{#
+SPDX-FileCopyrightText: 2022 MDAD project contributors
+SPDX-FileCopyrightText: 2024 Slavi Pantaleev
+SPDX-FileCopyrightText: 2024 wjbeckett
+SPDX-FileCopyrightText: 2026 Suguru Hirahara
+
+SPDX-License-Identifier: AGPL-3.0-or-later
+#}
+
+[Unit]
+Description=LiveKit Server
+{% for service in livekit_server_systemd_required_services_list %}
+After={{ service }}
+Requires={{ service }}
+{% endfor %}
+{% for service in livekit_server_systemd_wanted_services_list %}
+Wants={{ service }}
+{% endfor %}
+
+[Service]
+Type=simple
+Environment="HOME={{ devture_systemd_docker_base_systemd_unit_home_path }}"
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ livekit_server_identifier }} 2>/dev/null || true'
+ExecStartPre=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ livekit_server_identifier }} 2>/dev/null || true'
+
+{% if livekit_server_host_sysctl_minimum_net_core_rmem_max %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_sh }} -c 'current_rmem=$(sysctl -n net.core.rmem_max); if [ "$current_rmem" -lt {{ livekit_server_host_sysctl_minimum_net_core_rmem_max }} ]; then sysctl -w net.core.rmem_max={{ livekit_server_host_sysctl_minimum_net_core_rmem_max }}; fi'
+{% endif %}
+{% if livekit_server_host_sysctl_minimum_net_core_wmem_max %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_sh }} -c 'current_wmem=$(sysctl -n net.core.wmem_max); if [ "$current_wmem" -lt {{ livekit_server_host_sysctl_minimum_net_core_wmem_max }} ]; then sysctl -w net.core.wmem_max={{ livekit_server_host_sysctl_minimum_net_core_wmem_max }}; fi'
+{% endif %}
+
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
+      --rm \
+      --name={{ livekit_server_identifier }} \
+      --log-driver=none \
+      --user={{ livekit_server_uid }}:{{ livekit_server_gid }} \
+      --cap-drop=ALL \
+      --network={{ livekit_server_container_network }} \
+      {% if livekit_server_container_rtc_listen_interface is not in [none, 'none'] %}
+      -p {{ livekit_server_container_rtc_listen_interface }}{{ ':' if livekit_server_container_rtc_listen_interface else '' }}{{ livekit_server_config_rtc_tcp_port }}:{{ livekit_server_config_rtc_tcp_port }} \
+      {% endif %}
+      {% if livekit_server_container_rtc_listen_interface is not in [none, 'none'] and livekit_server_config_rtc_port_range_start and livekit_server_config_rtc_port_range_end %}
+      -p {{ livekit_server_container_rtc_listen_interface }}{{ ':' if livekit_server_container_rtc_listen_interface else '' }}{{ livekit_server_config_rtc_port_range_start }}-{{ livekit_server_config_rtc_port_range_end }}:{{ livekit_server_config_rtc_port_range_start }}-{{ livekit_server_config_rtc_port_range_end }}/udp \
+      {% endif %}
+      {% if livekit_server_container_rtc_listen_interface is not in [none, 'none'] and livekit_server_config_rtc_udp_port %}
+      -p {{ livekit_server_container_rtc_listen_interface }}{{ ':' if livekit_server_container_rtc_listen_interface else '' }}{{ livekit_server_config_rtc_udp_port }}:{{ livekit_server_config_rtc_udp_port }}/udp \
+      {% endif %}
+      {% if livekit_server_container_turn_listen_interface is not in [none, 'none'] and livekit_server_config_turn_enabled %}
+      -p {{ livekit_server_container_turn_listen_interface }}{{ ':' if livekit_server_container_turn_listen_interface else '' }}{{ livekit_server_config_turn_tls_port }}:{{ livekit_server_config_turn_tls_port }} \
+      {% endif %}
+      {% if livekit_server_container_turn_listen_interface is not in [none, 'none'] and livekit_server_config_turn_enabled %}
+      -p {{ livekit_server_container_turn_listen_interface }}{{ ':' if livekit_server_container_turn_listen_interface else '' }}{{ livekit_server_config_turn_udp_port }}:{{ livekit_server_config_turn_udp_port }}/udp \
+      {% endif %}
+      {% if livekit_server_container_metrics_listen_interface is not in [none, 'none'] and livekit_server_config_prometheus_enabled %}
+      -p {{ livekit_server_container_metrics_listen_interface }}{{ ':' if livekit_server_container_metrics_listen_interface else '' }}{{ livekit_server_config_prometheus_port }}:{{ livekit_server_config_prometheus_port }} \
+      {% endif %}
+      {% if livekit_server_container_http_host_bind_port %}
+      -p {{ livekit_server_container_http_host_bind_port }}:{{ livekit_server_config_port }} \
+      {% endif %}
+      --env-file={{ livekit_server_base_path }}/env \
+      --label-file={{ livekit_server_base_path }}/labels \
+      --mount type=bind,src={{ livekit_server_config_path }}/config.yaml,dst=/livekit-config.yaml,ro \
+      {% for volume in livekit_server_container_additional_volumes %}
+      --mount type={{ volume.type | default('bind' if '/' in volume.src else 'volume') }},src={{ volume.src }},dst={{ volume.dst }}{{ (',' + volume.options) if volume.options else '' }} \
+      {% endfor %}
+      {{ livekit_server_container_image_self_build_name if livekit_server_container_image_self_build else livekit_server_container_image }} \
+      --config /livekit-config.yaml
+
+{% for network in livekit_server_container_additional_networks %}
+ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} network connect {{ network }} {{ livekit_server_identifier }}
+{% endfor %}
+
+ExecStart={{ devture_systemd_docker_base_host_command_docker }} start --attach {{ livekit_server_identifier }}
+
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} stop -t {{ devture_systemd_docker_base_container_stop_grace_time_seconds }} {{ livekit_server_identifier }} 2>/dev/null || true'
+ExecStop=-{{ devture_systemd_docker_base_host_command_sh }} -c '{{ devture_systemd_docker_base_host_command_docker }} rm {{ livekit_server_identifier }} 2>/dev/null || true'
+Restart=always
+RestartSec=30
+SyslogIdentifier={{ livekit_server_identifier }}
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/custom/livekit_server/vars/main.yml b/roles/custom/livekit_server/vars/main.yml
new file mode 100644
index 000000000..ffa9c805b
--- /dev/null
+++ b/roles/custom/livekit_server/vars/main.yml
@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2024 Slavi Pantaleev
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+---
+livekit_server_public_url: "{{ livekit_server_scheme }}://{{ livekit_server_hostname }}{{ livekit_server_path_prefix }}"
+
+livekit_server_websocket_public_url: "{{ 'wss' if livekit_server_scheme == 'https' else 'ws' }}://{{ livekit_server_hostname }}{{ livekit_server_path_prefix }}"
diff --git a/setup.yml b/setup.yml
index d6890adef..5214dac9a 100644
--- a/setup.yml
+++ b/setup.yml
@@ -124,7 +124,7 @@
 
     - custom/matrix-element-admin
     - custom/matrix-element-call
-    - galaxy/livekit_server
+    - custom/livekit_server
     - custom/matrix-livekit-jwt-service
 
     - role: galaxy/postgres_backup

From 8379ca34cff12e75f80ed53a27e1863d43b7aeb1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Feb 2026 10:37:08 +0000
Subject: [PATCH 2/5] fix: revert setup.yml, add livekit.yml standalone
 playbook

- Revert setup.yml to use galaxy/livekit_server (avoids loading all
  uninstalled galaxy roles when running with --tags)
- Add livekit.yml: minimal standalone playbook that only includes
  galaxy/systemd_docker_base and custom/livekit_server, so livekit
  setup can run independently without requiring all other galaxy roles

Usage:
  ansible-playbook -i inventory/hosts livekit.yml \
    --tags=setup-livekit-server,start-group-services

https://claude.ai/code/session_01SbRgWsRDKpTZ2TTbWDhtEB
---
 livekit.yml | 15 +++++++++++++++
 setup.yml   |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 livekit.yml

diff --git a/livekit.yml b/livekit.yml
new file mode 100644
index 000000000..ee9b36eea
--- /dev/null
+++ b/livekit.yml
@@ -0,0 +1,15 @@
+---
+# Standalone playbook for LiveKit Server setup.
+# Use instead of setup.yml to avoid loading all unrelated galaxy roles.
+#
+# Usage:
+#   ansible-playbook -i inventory/hosts livekit.yml --tags=setup-livekit-server,start-group-services
+#
+- name: "Set up LiveKit Server"
+  hosts: "{{ target if target is defined else 'matrix_servers' }}"
+  become: true
+
+  roles:
+    - role: galaxy/systemd_docker_base
+
+    - role: custom/livekit_server
diff --git a/setup.yml b/setup.yml
index 5214dac9a..d6890adef 100644
--- a/setup.yml
+++ b/setup.yml
@@ -124,7 +124,7 @@
 
     - custom/matrix-element-admin
     - custom/matrix-element-call
-    - custom/livekit_server
+    - galaxy/livekit_server
     - custom/matrix-livekit-jwt-service
 
     - role: galaxy/postgres_backup

From 755b5d091a7766d005983dcf32847582d4314cd2 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Feb 2026 10:38:46 +0000
Subject: [PATCH 3/5] fix: add matrix-base role to livekit.yml to resolve
 undefined variables

matrix_user_uid/gid, matrix_server_fqn_matrix, matrix_addons_container_network
are all defined by custom/matrix-base and required by livekit_server role.

https://claude.ai/code/session_01SbRgWsRDKpTZ2TTbWDhtEB
---
 livekit.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/livekit.yml b/livekit.yml
index ee9b36eea..4bababa6b 100644
--- a/livekit.yml
+++ b/livekit.yml
@@ -12,4 +12,6 @@
   roles:
     - role: galaxy/systemd_docker_base
 
+    - role: custom/matrix-base
+
     - role: custom/livekit_server

From 7feb80bb2e7cb8c78e4866b84bf0223b3b561ba6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Feb 2026 10:40:00 +0000
Subject: [PATCH 4/5] fix: add playbook_help role to livekit.yml for retries
 variables

devture_playbook_help_container_retries_count/delay are defined by
galaxy/playbook_help and required by install.yml image pull tasks.

https://claude.ai/code/session_01SbRgWsRDKpTZ2TTbWDhtEB
---
 livekit.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/livekit.yml b/livekit.yml
index 4bababa6b..53317df34 100644
--- a/livekit.yml
+++ b/livekit.yml
@@ -10,6 +10,8 @@
   become: true
 
   roles:
+    - role: galaxy/playbook_help
+
     - role: galaxy/systemd_docker_base
 
     - role: custom/matrix-base

From 8f4420fd0e60533874f8864742350c7622926412 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Feb 2026 12:38:58 +0000
Subject: [PATCH 5/5] docs: document nginx trailing-slash requirement for
 livekit-jwt-service

When using an external nginx (e.g. on a separate host) to reverse-proxy
the LiveKit JWT Service at a path prefix, the nginx location block MUST
include a trailing slash.

Without it: `location ^~ /livekit-jwt-service` + `proxy_pass .../;`
replaces `/livekit-jwt-service` with `/`, producing `//get_token`
(double slash). Go's net/http issues a 301 redirect to normalize the
path. Element Call follows the redirect to the wrong URL, fails to get a
JWT token, and the call establishes at the Matrix signaling level but
without any audio or video.

With trailing slash: `location ^~ /livekit-jwt-service/` replaces the
prefix correctly, producing `/get_token` with a single slash.

The same trailing-slash rule applies to the livekit-server location
block to avoid path issues for any sub-paths.

The built-in Traefik setup is unaffected (uses stripprefix middleware).

https://claude.ai/code/session_01SbRgWsRDKpTZ2TTbWDhtEB
---
 ...onfiguring-playbook-livekit-jwt-service.md | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/docs/configuring-playbook-livekit-jwt-service.md b/docs/configuring-playbook-livekit-jwt-service.md
index eaf3be171..94ba3ab3b 100644
--- a/docs/configuring-playbook-livekit-jwt-service.md
+++ b/docs/configuring-playbook-livekit-jwt-service.md
@@ -16,3 +16,42 @@ Take a look at:
 
 - `roles/custom/matrix-livekit-jwt-service/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
 - `roles/custom/matrix-livekit-jwt-service/templates/env.j2` for the component's default configuration.
+
+## Using with an external nginx reverse-proxy
+
+If you use nginx (running on a separate host or outside Docker) to reverse-proxy the LiveKit JWT Service, the location block **must include a trailing slash** after the path prefix.
+
+The service runs on `/livekit-jwt-service` by default (set via `matrix_livekit_jwt_service_path_prefix`). nginx rewrites paths using the `proxy_pass` URI via string replacement: without the trailing slash, `location ^~ /livekit-jwt-service` combined with `proxy_pass http://BACKEND_HOST:PORT/;` replaces `/livekit-jwt-service` with `/`, turning `/livekit-jwt-service/get_token` into `//get_token` (double slash). Go's `net/http` server then issues a 301 redirect to normalize the path, which prevents Element Call from obtaining a LiveKit JWT token and causes calls to connect at the signaling level but without audio/video.
+
+**Correct nginx configuration:**
+
+```nginx
+# Note the trailing slash in location — required to avoid the double-slash path bug
+location ^~ /livekit-jwt-service/ {
+    proxy_pass http://MATRIX_SERVER_HOST:8091/;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+}
+```
+
+Similarly, when reverse-proxying the LiveKit Server's HTTP/WebSocket port:
+
+```nginx
+# Note the trailing slash in location — required for correct path rewriting
+location ^~ /livekit-server/ {
+    proxy_pass http://MATRIX_SERVER_HOST:7880/;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_read_timeout 3600s;
+    proxy_send_timeout 3600s;
+}
+```
+
+The playbook's built-in Traefik reverse-proxy handles path stripping correctly using its `stripprefix` middleware, so this only affects setups using an external nginx.