matrix-docker-ansible-deploy/roles/custom/matrix-livekit-jwt-service/defaults/main.yml

# SPDX-FileCopyrightText: 2022 MDAD project contributors
# SPDX-FileCopyrightText: 2024 wjbeckett
# SPDX-FileCopyrightText: 2024 - 2026 Slavi Pantaleev
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---

# Project source code URL: https://github.com/element-hq/lk-jwt-service

matrix_livekit_jwt_service_enabled: false

matrix_livekit_jwt_service_scheme: https
matrix_livekit_jwt_service_hostname: ""
matrix_livekit_jwt_service_path_prefix: "/livekit-jwt-service"

matrix_livekit_jwt_service_base_path: "{{ matrix_base_data_path }}/livekit-jwt-service"

matrix_livekit_jwt_service_container_network: ''

matrix_livekit_jwt_service_container_http_host_bind_port: ''

matrix_livekit_jwt_service_container_additional_networks: "{{ (matrix_livekit_jwt_service_container_additional_networks_auto + matrix_livekit_jwt_service_container_additional_networks_custom) | unique }}"
matrix_livekit_jwt_service_container_additional_networks_auto: []
matrix_livekit_jwt_service_container_additional_networks_custom: []

# renovate: datasource=docker depName=ghcr.io/element-hq/lk-jwt-service
matrix_livekit_jwt_service_version: 0.6.0

matrix_livekit_jwt_service_container_image_self_build: false
matrix_livekit_jwt_service_container_repo: "https://github.com/element-hq/lk-jwt-service.git"
matrix_livekit_jwt_service_container_repo_version: "{{ 'main' if matrix_livekit_jwt_service_version == 'latest' else ('v' + matrix_livekit_jwt_service_version) }}"
matrix_livekit_jwt_service_container_src_files_path: "{{ matrix_livekit_jwt_service_base_path }}/container-src"

matrix_livekit_jwt_service_container_image: "{{ matrix_livekit_jwt_service_container_image_registry_prefix }}element-hq/lk-jwt-service:{{ matrix_livekit_jwt_service_container_image_tag }}"
matrix_livekit_jwt_service_container_image_registry_prefix: "{{ 'localhost/' if matrix_livekit_jwt_service_container_image_self_build else matrix_livekit_jwt_service_container_image_registry_prefix_upstream }}"
matrix_livekit_jwt_service_container_image_registry_prefix_upstream: "{{ matrix_livekit_jwt_service_container_image_registry_prefix_upstream_default }}"
matrix_livekit_jwt_service_container_image_registry_prefix_upstream_default: ghcr.io/
matrix_livekit_jwt_service_container_image_tag: "{{ matrix_livekit_jwt_service_version }}"

matrix_livekit_jwt_service_container_labels_traefik_enabled: true
matrix_livekit_jwt_service_container_labels_traefik_docker_network: "{{ matrix_livekit_jwt_service_container_network }}"
matrix_livekit_jwt_service_container_labels_traefik_hostname: "{{ matrix_livekit_jwt_service_hostname }}"
# The path prefix must either be `/` or not end with a slash (e.g. `/livekit-jwt-service`).
matrix_livekit_jwt_service_container_labels_traefik_path_prefix: "{{ matrix_livekit_jwt_service_path_prefix }}"
matrix_livekit_jwt_service_container_labels_traefik_rule: "Host(`{{ matrix_livekit_jwt_service_container_labels_traefik_hostname }}`){% if matrix_livekit_jwt_service_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ matrix_livekit_jwt_service_container_labels_traefik_path_prefix }}`){% endif %}"
matrix_livekit_jwt_service_container_labels_traefik_priority: 0
matrix_livekit_jwt_service_container_labels_traefik_entrypoints: web-secure
matrix_livekit_jwt_service_container_labels_traefik_tls: "{{ matrix_livekit_jwt_service_container_labels_traefik_entrypoints != 'web' }}"
matrix_livekit_jwt_service_container_labels_traefik_tls_certResolver: default  # noqa var-naming

# Controls which additional headers to attach to all HTTP responses.
# To add your own headers, use `matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_custom`
matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers: "{{ matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_auto | combine(matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_custom) }}"
matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_auto: {}
matrix_livekit_jwt_service_container_labels_traefik_additional_response_headers_custom: {}

# matrix_livekit_jwt_service_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `../templates/labels.j2` for details.
#
# Example:
# matrix_livekit_jwt_service_container_labels_additional_labels: |
#   my.label=1
#   another.label="here"
matrix_livekit_jwt_service_container_labels_additional_labels: ''

# A list of extra arguments to pass to the container
matrix_livekit_jwt_service_container_extra_arguments: []

# Controls whether the container's built-in healthcheck is left enabled.
#
# lk-jwt-service v0.6.0 added a healthcheck which builds its URL as
# `http://localhost:$LIVEKIT_JWT_BIND/healthz`, interpolating the bind address
# into the port slot. Because LIVEKIT_JWT_BIND is a bind address (`:8080`), the
# resulting URL is invalid and the check can never pass, leaving the container
# permanently unhealthy. Traefik skips unhealthy containers, so the service
# stops being routed and Element Call cannot obtain an SFU token.
#
# There is no way to correct the check from here: the image is built `FROM
# scratch`, so it has no shell for a `--health-cmd` override to use.
#
# Re-enable this once upstream fixes the check.
# See: https://github.com/element-hq/lk-jwt-service/pull/186
matrix_livekit_jwt_service_container_healthcheck_enabled: false

# Controls the port that the service listens on internally in the container.
# This is still used for Traefik configuration and container port binding.
matrix_livekit_jwt_service_container_port: 8080

# Controls the LIVEKIT_JWT_BIND environment variable.
# This is the preferred method in v0.4.0+, replacing the deprecated LIVEKIT_JWT_PORT.
# Format: "host:port" or ":port" (to bind to all interfaces).
# The default ":8080" binds to all interfaces on port 8080.
matrix_livekit_jwt_service_environment_variable_livekit_jwt_bind: ":{{ matrix_livekit_jwt_service_container_port }}"

# Controls the LIVEKIT_KEY environment variable
matrix_livekit_jwt_service_environment_variable_livekit_key: ""

# Controls the LIVEKIT_URL environment variable
matrix_livekit_jwt_service_environment_variable_livekit_url: ""

# Controls the LIVEKIT_SECRET environment variable
matrix_livekit_jwt_service_environment_variable_livekit_secret: ""

# Controls the LIVEKIT_FULL_ACCESS_HOMESERVERS environment variable.
# Comma-separated list of Matrix homeservers whose users are authorized with full access to LiveKit SFU features
# (like creating rooms on the SFU).
#
# This is a required setting and the service refuses to start without it.
# Setting it to `*` grants full access to any federated Matrix user, but listing only the homeserver(s)
# you intend to serve is strongly recommended.
#
# To add additional homeservers, use `matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom`.
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers: "{{ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list | join(',') }}"
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list: "{{ matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_default + matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_auto + matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom }}"
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_default: ["{{ matrix_domain }}"]
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_auto: []
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom: []

# Controls the LIVEKIT_CS_API_URL_OVERRIDES environment variable.
#
# To learn where a user's homeserver serves its Client-Server API, the service performs `.well-known` discovery.
# That is, it requests `https://<server-name>/.well-known/matrix/client` over the network and reads `m.homeserver.base_url` out of it.
# Entries listed here are consulted first, so that the server names they cover are resolved without discovery.
#
# Keys are Matrix server names and values are Client-Server API base URLs (including the scheme).
# A playbook may inject an entry for the homeserver it manages, pointing the service at it directly.
#
# To add your own entries, use `matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom`.
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides: "{{ matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map.items() | map('join', '=') | join(',') }}"
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map: "{{ matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_auto | combine(matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom) }}"
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_auto: {}
matrix_livekit_jwt_service_environment_variable_livekit_cs_api_url_overrides_map_custom: {}

# Additional environment variables to pass to the container.
#
# Environment variables take priority over settings in the configuration file.
#
# Example:
# matrix_livekit_jwt_service_environment_variables_extension: |
#   KEY=value
matrix_livekit_jwt_service_environment_variables_extension: ''

# List of systemd services that LiveKit JWT Service service depends on
matrix_livekit_jwt_service_systemd_required_services_list: "{{ matrix_livekit_jwt_service_systemd_required_services_list_default + matrix_livekit_jwt_service_systemd_required_services_list_auto + matrix_livekit_jwt_service_systemd_required_services_list_custom }}"
matrix_livekit_jwt_service_systemd_required_services_list_default: "{{ [devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [] }}"
matrix_livekit_jwt_service_systemd_required_services_list_auto: []
matrix_livekit_jwt_service_systemd_required_services_list_custom: []

# matrix_livekit_jwt_service_restart_necessary controls whether the service
# will be restarted (when true) or merely started (when false) by the
# systemd service manager role (when conditional restart is enabled).
#
# This value is automatically computed during installation based on whether
# any configuration files, the systemd service file, or the container image changed.
# The default of `false` means "no restart needed" — appropriate when the role's
# installation tasks haven't run (e.g., due to --tags skipping them).
matrix_livekit_jwt_service_restart_necessary: false

# Support additional container arguments for the LiveKit JWT service
matrix_livekit_jwt_service_container_additional_arguments: []

# A list of additional "volumes" to mount in the container.
# Contains definition objects like this: `{"type": "bind", "src": "/outside", "dst": "/inside", "options": "readonly"}.
# See the `--mount` documentation for the `docker run` command.
# Note: internally, this uses the `--mount` flag for mounting the specified volumes.
matrix_livekit_jwt_service_container_additional_volumes: "{{ matrix_livekit_jwt_service_container_additional_volumes_auto + matrix_livekit_jwt_service_container_additional_volumes_custom }}"
matrix_livekit_jwt_service_container_additional_volumes_auto: []
matrix_livekit_jwt_service_container_additional_volumes_custom: []