From ddd99ba2445a10c8a8f202dee272a2d01583d5c6 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Wed, 19 Aug 2026 13:57:21 +0300 Subject: [PATCH] Point LiveKit JWT Service at our homeserver directly, instead of having it discover it lk-jwt-service v0.6.0 stopped honoring the delay_cs_api_url request parameter and now locates a user's Client-Server API by fetching the /.well-known/matrix/client file of that user's base domain itself. For our own homeserver, this makes the service leave the server over the public network only to come back to it, which is wasteful at best and does not work at all where the base domain is not reachable from the host. Since we know where our homeserver is, we tell the service directly via the new LIVEKIT_CS_API_URL_OVERRIDES environment variable. Federated homeservers keep being resolved through discovery. The service now also joins the container network that the homeserver's Client-Server API is reachable on, like our other add-on services do. It used to only be connected to it by coincidence, via the reverse-proxy network, which left it unable to reach the homeserver when the playbook is not managing Traefik. Co-Authored-By: Claude Opus 5 (1M context) --- group_vars/matrix_servers | 9 +++++++++ .../matrix-livekit-jwt-service/defaults/main.yml | 15 +++++++++++++++ .../matrix-livekit-jwt-service/templates/env.j2 | 2 ++ 3 files changed, 26 insertions(+) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 441f25d2f..addf82b88 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -6659,6 +6659,8 @@ matrix_livekit_jwt_service_container_network: "{{ matrix_addons_container_networ matrix_livekit_jwt_service_container_additional_networks_auto: | {{ + ([] if matrix_addons_homeserver_container_network == '' else [matrix_addons_homeserver_container_network]) + + ([matrix_playbook_reverse_proxyable_services_additional_network] if (matrix_livekit_jwt_service_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else []) }} @@ -6669,6 +6671,13 @@ matrix_livekit_jwt_service_container_labels_traefik_tls_certResolver: "{{ traefi matrix_livekit_jwt_service_environment_variable_livekit_url: "{{ livekit_server_websocket_public_url }}" +# The service discovers where a homeserver's Client-Server API lives by fetching the `/.well-known/matrix/client` +# file of that homeserver's base domain over the public network. +# For our own homeserver, we already know the answer and can spare it the round trip, which would otherwise +# need to leave the server and come back to it. +# Other (federated) homeservers are still resolved via discovery. +matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_auto: "{{ {matrix_domain: matrix_addons_homeserver_client_api_url} }}" + matrix_livekit_jwt_service_environment_variable_livekit_key: "{{ (matrix_homeserver_generic_secret_key + ':lk.key') | hash('sha512') | to_uuid }}" matrix_livekit_jwt_service_environment_variable_livekit_secret: "{{ (matrix_homeserver_generic_secret_key + ':lk.secret') | hash('sha512') | to_uuid }}" diff --git a/roles/custom/matrix-livekit-jwt-service/defaults/main.yml b/roles/custom/matrix-livekit-jwt-service/defaults/main.yml index 2d542b6e3..5f437afda 100644 --- a/roles/custom/matrix-livekit-jwt-service/defaults/main.yml +++ b/roles/custom/matrix-livekit-jwt-service/defaults/main.yml @@ -101,6 +101,21 @@ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_auto: [] matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom: [] +# Controls the LIVEKIT_CS_API_URL_OVERRIDES environment variable. +# +# To learn where a user's homeserver serves its Client-Server API, the service performs `.well-known` discovery. +# That is, it requests `https:///.well-known/matrix/client` over the network and reads `m.homeserver.base_url` out of it. +# Entries listed here are consulted first, so that the server names they cover are resolved without discovery. +# +# Keys are Matrix server names and values are Client-Server API base URLs (including the scheme). +# A playbook may inject an entry for the homeserver it manages, pointing the service at it directly. +# +# To add your own entries, use `matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom`. +matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides: "{{ matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map.items() | map('join', '=') | join(',') }}" +matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map: "{{ matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_auto | combine(matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom) }}" +matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_auto: {} +matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom: {} + # Additional environment variables to pass to the container. # # Environment variables take priority over settings in the configuration file. diff --git a/roles/custom/matrix-livekit-jwt-service/templates/env.j2 b/roles/custom/matrix-livekit-jwt-service/templates/env.j2 index 15ac9d4a7..afe93b36e 100644 --- a/roles/custom/matrix-livekit-jwt-service/templates/env.j2 +++ b/roles/custom/matrix-livekit-jwt-service/templates/env.j2 @@ -13,4 +13,6 @@ LIVEKIT_SECRET={{ matrix_livekit_jwt_service_environment_variable_livekit_secret LIVEKIT_FULL_ACCESS_HOMESERVERS={{ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers }} +LIVEKIT_CS_API_URL_OVERRIDES={{ matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides }} + {{ matrix_livekit_jwt_service_environment_variables_extension }}