cqrenet/matrix-docker-ansible-deploy
6
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2026-09-19 14:20:10 +00:00
Code Issues Wiki Activity

Upgrade LiveKit JWT Service to 0.7.0

Browse Source 
Document the multi-SFU publishing policy and re-enable the repaired image healthcheck. Verify trusted and remote grants and room creation against a real SFU.

Supersedes #5596.
This commit is contained in:
Slavi Pantaleev
2026-09-18 00:28:20 +03:00
parent 859aa30463
commit 6e9fcfc9d6
11 changed files with 299 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuring-playbook-livekit-jwt-service.md
+25 -1
View File
@@ -1,5 +1,5 @@
<!--
SPDX-FileCopyrightText: 2025 Slavi Pantaleev
SPDX-FileCopyrightText: 2025 - 2026 Slavi Pantaleev
SPDX-License-Identifier: AGPL-3.0-or-later
-->
@@ -16,3 +16,27 @@ Take a look at:
- `roles/custom/matrix-livekit-jwt-service/defaults/main.yml` for some variables that you can customize via your `vars.yml` file
- `roles/custom/matrix-livekit-jwt-service/templates/env.j2` for the component's default configuration.
## Federated calls and trusted homeservers
Since LiveKit JWT Service 0.7.0, only users from homeservers listed in `matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list` may publish audio, video, or screen shares on your SFU. The list defaults to your `matrix_domain`. Other federated users receive media here and publish on their own homeserver's SFU, using clients with multi-SFU support. See [upstream's explanation](https://github.com/element-hq/lk-jwt-service/issues/238#issuecomment-5709655222).
Current Element Call supports this in its `compatibility` mode using the existing JWT endpoint. Older clients, clients configured to use a single SFU, and callers without their own SFU may join but be unable to publish media.
If you intentionally provide SFU access to another trusted homeserver, add its Matrix server name to your `inventory/host_vars/matrix.example.com/vars.yml` file:
```yaml
matrix_livekit_jwt_service_environment_variable_livekit_full_access_homeservers_list_custom:
- example.org
```
This lets all users of that homeserver publish and trigger room creation on your SFU, including outside your calls. Using `'*'` grants these permissions to every homeserver.
To temporarily retain the previous behavior while updating clients or arranging SFU access:
```yaml
matrix_livekit_jwt_service_version: 0.6.0
matrix_livekit_jwt_service_container_healthcheck_enabled: false
```
Remove both overrides when ready to upgrade. The healthcheck must remain disabled on 0.6.0 because it is broken in that image.