From 619aba983ec65dc9c18a78ce28baaa084fa0aa4e Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 19 Aug 2026 16:03:11 +0300 Subject: [PATCH] Disable the broken LiveKit JWT Service container healthcheck lk-jwt-service v0.6.0 ships a healthcheck which builds its URL as http://localhost:$LIVEKIT_JWT_BIND/healthz, interpolating the bind address into the port slot. We set LIVEKIT_JWT_BIND to ":8080", so the check requests http://localhost::8080/healthz, which does not parse and can never succeed. The container therefore sits permanently unhealthy, Traefik skips unhealthy containers, and the service stops being routed, so Element Call fails to obtain an SFU token. No value satisfies both sides: the service passes LIVEKIT_JWT_BIND to ListenAndServe, which needs a full bind address, while the healthcheck needs a bare port. The check only works when the variable is unset and its own "8080" fallback applies, which would mean ignoring a configured port. Correcting the check from here is not possible either, as the image is built FROM scratch and has no shell for a --health-cmd override to use. Turn the healthcheck off, behind a variable so it can be turned back on once upstream fixes it. This restores the pre-v0.6.0 behavior, where the image carried no healthcheck at all. Co-Authored-By: Claude Opus 5 (1M context) --- .../matrix-livekit-jwt-service/defaults/main.yml | 16 ++++++++++++++++ .../matrix-livekit-jwt-service.service.j2 | 3 +++ 2 files changed, 19 insertions(+) diff --git a/roles/custom/matrix-livekit-jwt-service/defaults/main.yml b/roles/custom/matrix-livekit-jwt-service/defaults/main.yml index 5f437afda..31fad4932 100644 --- a/roles/custom/matrix-livekit-jwt-service/defaults/main.yml +++ b/roles/custom/matrix-livekit-jwt-service/defaults/main.yml @@ -67,6 +67,22 @@ matrix_livekit_jwt_service_container_labels_additional_labels: '' # A list of extra arguments to pass to the container matrix_livekit_jwt_service_container_extra_arguments: [] +# Controls whether the container's built-in healthcheck is left enabled. +# +# lk-jwt-service v0.6.0 added a healthcheck which builds its URL as +# `http://localhost:$LIVEKIT_JWT_BIND/healthz`, interpolating the bind address +# into the port slot. Because LIVEKIT_JWT_BIND is a bind address (`:8080`), the +# resulting URL is invalid and the check can never pass, leaving the container +# permanently unhealthy. Traefik skips unhealthy containers, so the service +# stops being routed and Element Call cannot obtain an SFU token. +# +# There is no way to correct the check from here: the image is built `FROM +# scratch`, so it has no shell for a `--health-cmd` override to use. +# +# Re-enable this once upstream fixes the check. +# See: https://github.com/element-hq/lk-jwt-service/pull/186 +matrix_livekit_jwt_service_container_healthcheck_enabled: false + # Controls the port that the service listens on internally in the container. # This is still used for Traefik configuration and container port binding. matrix_livekit_jwt_service_container_port: 8080 diff --git a/roles/custom/matrix-livekit-jwt-service/templates/systemd/matrix-livekit-jwt-service.service.j2 b/roles/custom/matrix-livekit-jwt-service/templates/systemd/matrix-livekit-jwt-service.service.j2 index 058013d92..706f5a004 100644 --- a/roles/custom/matrix-livekit-jwt-service/templates/systemd/matrix-livekit-jwt-service.service.j2 +++ b/roles/custom/matrix-livekit-jwt-service/templates/systemd/matrix-livekit-jwt-service.service.j2 @@ -18,6 +18,9 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --log-driver=none \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ + {% if not matrix_livekit_jwt_service_container_healthcheck_enabled %} + --no-healthcheck \ + {% endif %} --network={{ matrix_livekit_jwt_service_container_network }} \ {% if matrix_livekit_jwt_service_container_http_host_bind_port %} -p {{ matrix_livekit_jwt_service_container_http_host_bind_port }}:{{ matrix_livekit_jwt_service_container_port }} \