finallycoffee/matrix-docker-ansible-deploy
finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Auto-enable TURN support for LiveKit Server

Browse Source
This commit is contained in:
Slavi Pantaleev 2025-04-06 16:11:23 +03:00
parent b14b932af3
commit 5972f4c81a
2 changed files with 49 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/configuring-playbook-livekit-server.md
View File

@ -25,4 +25,8 @@ To ensure LiveKit Server functions correctly, the following firewall rules and p
- `7882/udp`: ICE/UDP Mux
- `3479/udp`: TURN/UDP
- `5350/tcp`: TURN/TCP
💡 The suggestions above are inspired by the upstream [Ports and Firewall](https://docs.livekit.io/home/self-hosting/ports-firewall/) documentation based on how LiveKit is configured in the playbook. If you've using custom configuration for the LiveKit Server role, you may need to adjust the firewall rules accordingly.

45
group_vars/matrix_servers
View File

@ -6314,6 +6314,24 @@ livekit_server_container_image_self_build: "{{ matrix_architecture not in ['arm6
livekit_server_container_network: "{{ matrix_addons_container_network }}"
livekit_server_container_additional_networks_auto: "{{ [matrix_playbook_reverse_proxyable_services_additional_network] if (livekit_server_container_labels_traefik_enabled and matrix_playbook_reverse_proxyable_services_additional_network) else [] }}"
livekit_server_container_additional_volumes_auto: |
{{
(
[
{
'src': (traefik_certs_dumper_dumped_certificates_dir_path + '/' + livekit_server_config_turn_domain + '/certificate.crt'),
'dst': livekit_server_config_turn_cert_file,
'options': 'ro',
},
{
'src': (traefik_certs_dumper_dumped_certificates_dir_path + '/' + livekit_server_config_turn_domain + '/privatekey.key'),
'dst': livekit_server_config_turn_key_file,
'options': 'ro',
},
] if (matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and livekit_server_config_turn_enabled and (livekit_server_config_turn_cert_file and livekit_server_config_turn_key_file)) else []
)
}}
livekit_server_container_labels_traefik_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] }}"
livekit_server_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxyable_services_additional_network }}"
livekit_server_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
@ -6338,6 +6356,33 @@ livekit_server_config_turn_tls_port: 5350
# Note that TURN is not enabled by default. See `livekit_server_config_turn_enabled`.
livekit_server_config_turn_udp_port: 3479
# LiveKit's TURN implementation requires SSL certificates.
# We only enable it if we can provide them automatically via Traefik + Traefik Certs Dumper.
livekit_server_config_turn_enabled: "{{ matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled }}"
livekit_server_config_turn_cert_file: |-
{{
{
'playbook-managed-traefik': ('/certificate.crt' if traefik_certs_dumper_enabled else ''),
'other-traefik-container': ('/certificate.crt' if traefik_certs_dumper_enabled else ''),
'none': '',
}[matrix_playbook_reverse_proxy_type]
}}
livekit_server_config_turn_key_file: |-
{{
{
'playbook-managed-traefik': ('/privatekey.key' if traefik_certs_dumper_enabled else ''),
'other-traefik-container': ('/privatekey.key' if traefik_certs_dumper_enabled else ''),
'none': '',
}[matrix_playbook_reverse_proxy_type]
}}
livekit_server_systemd_required_services_list_auto: |
{{
([traefik_certs_dumper_identifier + '-wait-for-domain@' + livekit_server_config_turn_domain + '.service'] if matrix_playbook_reverse_proxy_type in ['playbook-managed-traefik', 'other-traefik-container'] and traefik_certs_dumper_enabled and livekit_server_config_turn_enabled else [])
}}
########################################################################
# #
# /livekit-server #