Disable the broken LiveKit JWT Service container healthcheck

lk-jwt-service v0.6.0 ships a healthcheck which builds its URL as
http://localhost:$LIVEKIT_JWT_BIND/healthz, interpolating the bind
address into the port slot. We set LIVEKIT_JWT_BIND to ":8080", so the
check requests http://localhost::8080/healthz, which does not parse and
can never succeed. The container therefore sits permanently unhealthy,
Traefik skips unhealthy containers, and the service stops being routed,
so Element Call fails to obtain an SFU token.

No value satisfies both sides: the service passes LIVEKIT_JWT_BIND to
ListenAndServe, which needs a full bind address, while the healthcheck
needs a bare port. The check only works when the variable is unset and
its own "8080" fallback applies, which would mean ignoring a configured
port. Correcting the check from here is not possible either, as the
image is built FROM scratch and has no shell for a --health-cmd
override to use.

Turn the healthcheck off, behind a variable so it can be turned back on
once upstream fixes it. This restores the pre-v0.6.0 behavior, where the
image carried no healthcheck at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/custom/matrix-livekit-jwt-service/defaults/main.yml

@@ -67,6 +67,22 @@ matrix_livekit_jwt_service_container_labels_additional_labels: ''
 # A list of extra arguments to pass to the container
 matrix_livekit_jwt_service_container_extra_arguments: []
 
+# Controls whether the container's built-in healthcheck is left enabled.
+#
+# lk-jwt-service v0.6.0 added a healthcheck which builds its URL as
+# `http://localhost:$LIVEKIT_JWT_BIND/healthz`, interpolating the bind address
+# into the port slot. Because LIVEKIT_JWT_BIND is a bind address (`:8080`), the
+# resulting URL is invalid and the check can never pass, leaving the container
+# permanently unhealthy. Traefik skips unhealthy containers, so the service
+# stops being routed and Element Call cannot obtain an SFU token.
+#
+# There is no way to correct the check from here: the image is built `FROM
+# scratch`, so it has no shell for a `--health-cmd` override to use.
+#
+# Re-enable this once upstream fixes the check.
+# See: https://github.com/element-hq/lk-jwt-service/pull/186
+matrix_livekit_jwt_service_container_healthcheck_enabled: false
+
 # Controls the port that the service listens on internally in the container.
 # This is still used for Traefik configuration and container port binding.
 matrix_livekit_jwt_service_container_port: 8080

roles/custom/matrix-livekit-jwt-service/templates/systemd/matrix-livekit-jwt-service.service.j2

@@ -18,6 +18,9 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
     --log-driver=none \
     --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \
     --cap-drop=ALL \
+    {% if not matrix_livekit_jwt_service_container_healthcheck_enabled %}
+    --no-healthcheck \
+    {% endif %}
     --network={{ matrix_livekit_jwt_service_container_network }} \
     {% if matrix_livekit_jwt_service_container_http_host_bind_port %}
     -p {{ matrix_livekit_jwt_service_container_http_host_bind_port }}:{{ matrix_livekit_jwt_service_container_port }} \