commit 8b4b0bf00d38a99fae1267c4982db8458582038f
parent d82952d2d4dea542021f97ab09d3cf509364a26d
Author: MTRNord <mtrnord1@gmail.com>
Date: Fri, 2 May 2025 00:19:02 +0200
Test livekit
Diffstat:
1 file changed, 70 insertions(+), 34 deletions(-)
diff --git a/apps/base/matrix/livekit/release.yaml b/apps/base/matrix/livekit/release.yaml
@@ -6,7 +6,7 @@ metadata:
spec:
secretName: livekit.matrix.midnightthoughts.space-tls
privateKey:
- rotationPolicy: ENC[AES256_GCM,data:mD/4+L74,iv:m9QwmEOPZOo9Fwy9IT6X1hfrz7kI+EvtCba2fYeo41E=,tag:GBoTq2QKCHrH5GAMzCYENQ==,type:str]
+ rotationPolicy: ENC[AES256_GCM,data:Gg30EjR2,iv:/6pMR/Hoe4V3mu5tpPhPtTmdWv+IlDLAwfu16kTl0jg=,tag:T7ArLggv/ye0GdLW+PUYIg==,type:str]
issuerRef:
name: letsencrypt-dns
kind: ClusterIssuer
@@ -25,15 +25,15 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdVMvTkNpUlpRVFp2NTdO
- MTIweXBxNWZJKzhwZ3pYcm5sQkdFSkc2OWpjCnBxaXFzMHd4NjJLUzVSU2xQWGRG
- K2oxcE5yaWtmTEJsUG1DTjhVQ0VEQVUKLS0tIFJHM2h5Lzd5L0ExV2ppWm45djhr
- MTlPTy9sVlE1bmFsWVpDU0NKOGxSOW8KDhJeFob2f1BtJBBNSihLLs/4ak+zvyOi
- 6JtLtBhroyFAL6kRvL169rOwDYCc4DhMydZND4S+oqdxkr4N8fmaXw==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-05-01T21:59:06Z"
- mac: ENC[AES256_GCM,data:HTWXfbYqE4ITeAXFvnY15ahjmP3lKM20Y7yLZzIwsshsxwc1YL5VICBwpUrQ0pl0Ys/f+TJ9J6N+y/0a3saqQ3yKcgNAt2rqhXTBJlaRu7Q7A233Bjw+iVhDW3R8SsCrs1wzbexfofVDz790E+8V6mtnYyswZsebsprSDAmBfaw=,iv:sDCFwFlwKBW/ffTIbpfggHkIaElJroofk/DL94vtkxI=,tag:w9MWuHyLWQQVIPuVX+2Skg==,type:str]
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnplWS9tWmhoNFBWQS9s
+ M2hxSWp4blJIZ255Q2t1K3lzbnBhSk5Eb0M0CmFvZER6UXErZW1ybGRlSVVzeDhn
+ Tk9lVVZoTU5vcDRqM3dOS2pVZVNOTWcKLS0tIGVuVEpNNlB4OFBnK3BiN0JiMzBq
+ bjRoS3hwNERmMnhkQU8yTVVYNE9XOVUKGtwCOFJog8ZHI6t6kGAFGQYSG/kzRVzQ
+ fFDO4GsRsk760K0kKXkMfP4ePISGgmjhGP7uV4blp3/s/4vb+nXbmg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-05-01T22:18:52Z"
+ mac: ENC[AES256_GCM,data:jxx2qu8BkBEy+4mCan3k4FbVj04GnynLPQkWKtZkOGIsgHomn6utQMKlPZCpcIbcnvyQlhA1kENWB/WVXxzytXheYsQGlzyh0XUu8lHWuKbCA+aOaemOTjnvydt2Nh5XLOxsso72FoRBCF7jPZ2R+zjJiCx8dPFEBPY2JU6Z5EQ=,iv:fzBvlmU5tcUEUHCdkLmwm8/tC1yc6tIV4rdN2hs2pVg=,tag:kpwmXNjvt31oUFQCPWq33Q==,type:str]
pgp: []
encrypted_regex: ^(woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
@@ -52,15 +52,15 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdVMvTkNpUlpRVFp2NTdO
- MTIweXBxNWZJKzhwZ3pYcm5sQkdFSkc2OWpjCnBxaXFzMHd4NjJLUzVSU2xQWGRG
- K2oxcE5yaWtmTEJsUG1DTjhVQ0VEQVUKLS0tIFJHM2h5Lzd5L0ExV2ppWm45djhr
- MTlPTy9sVlE1bmFsWVpDU0NKOGxSOW8KDhJeFob2f1BtJBBNSihLLs/4ak+zvyOi
- 6JtLtBhroyFAL6kRvL169rOwDYCc4DhMydZND4S+oqdxkr4N8fmaXw==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-05-01T21:59:06Z"
- mac: ENC[AES256_GCM,data:HTWXfbYqE4ITeAXFvnY15ahjmP3lKM20Y7yLZzIwsshsxwc1YL5VICBwpUrQ0pl0Ys/f+TJ9J6N+y/0a3saqQ3yKcgNAt2rqhXTBJlaRu7Q7A233Bjw+iVhDW3R8SsCrs1wzbexfofVDz790E+8V6mtnYyswZsebsprSDAmBfaw=,iv:sDCFwFlwKBW/ffTIbpfggHkIaElJroofk/DL94vtkxI=,tag:w9MWuHyLWQQVIPuVX+2Skg==,type:str]
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnplWS9tWmhoNFBWQS9s
+ M2hxSWp4blJIZ255Q2t1K3lzbnBhSk5Eb0M0CmFvZER6UXErZW1ybGRlSVVzeDhn
+ Tk9lVVZoTU5vcDRqM3dOS2pVZVNOTWcKLS0tIGVuVEpNNlB4OFBnK3BiN0JiMzBq
+ bjRoS3hwNERmMnhkQU8yTVVYNE9XOVUKGtwCOFJog8ZHI6t6kGAFGQYSG/kzRVzQ
+ fFDO4GsRsk760K0kKXkMfP4ePISGgmjhGP7uV4blp3/s/4vb+nXbmg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-05-01T22:18:52Z"
+ mac: ENC[AES256_GCM,data:jxx2qu8BkBEy+4mCan3k4FbVj04GnynLPQkWKtZkOGIsgHomn6utQMKlPZCpcIbcnvyQlhA1kENWB/WVXxzytXheYsQGlzyh0XUu8lHWuKbCA+aOaemOTjnvydt2Nh5XLOxsso72FoRBCF7jPZ2R+zjJiCx8dPFEBPY2JU6Z5EQ=,iv:fzBvlmU5tcUEUHCdkLmwm8/tC1yc6tIV4rdN2hs2pVg=,tag:kpwmXNjvt31oUFQCPWq33Q==,type:str]
pgp: []
encrypted_regex: ^(woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
@@ -110,7 +110,7 @@ spec:
# one or more API key/secret pairs
# see https://docs.livekit.io/guides/getting-started/#generate-api-key-and-secret
keys:
- woosh: ENC[AES256_GCM,data:V9tPJRosTKqQHBqa0n0p+uiM7a0LO8iOibSFmxYT29J4/dQoWMpOVWsQIwWCdlXUcDsACD6jVSi+kXdgR3AwZg==,iv:Wnz8xGQQbUxpyD5S6erlVY80cyMSWtEtV/C9hSHgiGA=,tag:PechMLnqtArRKcRrChGUWQ==,type:str]
+ woosh: ENC[AES256_GCM,data:T21nut0F4Cmc6OhFM3wdVoAPM9ZjuGDsGYGZdHJC/jItg23OBKql4bLXjY1H+9ccmhCzGS2ieiagZjPMgxW4Ow==,iv:70YVy8oU2UoCxHX9WSAr4CYKiHTdXnY5hy71hWu3G6U=,tag:AGz6iuSyMH7Djoe8Dz3Eow==,type:str]
turn:
enabled: true
# must match domain of your TLS cert
@@ -125,9 +125,9 @@ spec:
# Kubernetes Secret containing TLS cert for <turn.myhost.com>
# See https://docs.livekit.io/deploy/kubernetes/#importing-ssl-certificates
secretName: livekit.matrix.midnightthoughts.space-tls
- # set the Kubernetes serviceType for the TURN service. By default it sets it to "LoadBalancer" but for Hetzner you want ClusterIP and use a custom ingress
+ # set the Kubernetes serviceType for the TURN service. By default it sets it to "LoadBalancer" but for Hetzner you want NodePort and use a custom ingress
# See kubernetes serviceTypes on official documentation: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
- serviceType: ClusterIP
+ serviceType: NodePort
loadBalancer:
# valid values: disable, alb, aws, gke, gke-managed-cert, gke-native-vpc, do, hetzner
# on AWS, we recommend using alb load balancer, which supports TLS termination
@@ -143,8 +143,8 @@ spec:
# clusterIssuer: letsencrypt-prod
tls:
- hosts:
- - livekit.matrix.midnightthoughts.space
- - turn.matrix.midnightthoughts.space
+ - livekit.matrix.midnightthoughts.space
+ - turn.matrix.midnightthoughts.space
# with alb, certificates needs to reside in ACM for self-discovery
# with do, use cert-manager and create certificate for turn. Load balancer is autoamtic
# with gke, specify one or more secrets to use for the certificate
@@ -152,7 +152,7 @@ spec:
secretName: livekit.matrix.midnightthoughts.space-tls
# Set the external DNS annotations for the load balancer here as Hetzner LB doesn't support UDP. So the load balancer is a NodePort meaning it is directly routing to the nodes.
extraAnnotations:
- external-dns.alpha.kubernetes.io/hostname: livekit.matrix.midnightthoughts.space
+ external-dns.alpha.kubernetes.io/hostname: turn.matrix.midnightthoughts.space
# Ensure the ingress class name is set to the one used by your cluster
ingressClassName: fake
# autoscaling requires resources to be defined
@@ -183,15 +183,51 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdVMvTkNpUlpRVFp2NTdO
- MTIweXBxNWZJKzhwZ3pYcm5sQkdFSkc2OWpjCnBxaXFzMHd4NjJLUzVSU2xQWGRG
- K2oxcE5yaWtmTEJsUG1DTjhVQ0VEQVUKLS0tIFJHM2h5Lzd5L0ExV2ppWm45djhr
- MTlPTy9sVlE1bmFsWVpDU0NKOGxSOW8KDhJeFob2f1BtJBBNSihLLs/4ak+zvyOi
- 6JtLtBhroyFAL6kRvL169rOwDYCc4DhMydZND4S+oqdxkr4N8fmaXw==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-05-01T21:59:06Z"
- mac: ENC[AES256_GCM,data:HTWXfbYqE4ITeAXFvnY15ahjmP3lKM20Y7yLZzIwsshsxwc1YL5VICBwpUrQ0pl0Ys/f+TJ9J6N+y/0a3saqQ3yKcgNAt2rqhXTBJlaRu7Q7A233Bjw+iVhDW3R8SsCrs1wzbexfofVDz790E+8V6mtnYyswZsebsprSDAmBfaw=,iv:sDCFwFlwKBW/ffTIbpfggHkIaElJroofk/DL94vtkxI=,tag:w9MWuHyLWQQVIPuVX+2Skg==,type:str]
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnplWS9tWmhoNFBWQS9s
+ M2hxSWp4blJIZ255Q2t1K3lzbnBhSk5Eb0M0CmFvZER6UXErZW1ybGRlSVVzeDhn
+ Tk9lVVZoTU5vcDRqM3dOS2pVZVNOTWcKLS0tIGVuVEpNNlB4OFBnK3BiN0JiMzBq
+ bjRoS3hwNERmMnhkQU8yTVVYNE9XOVUKGtwCOFJog8ZHI6t6kGAFGQYSG/kzRVzQ
+ fFDO4GsRsk760K0kKXkMfP4ePISGgmjhGP7uV4blp3/s/4vb+nXbmg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-05-01T22:18:52Z"
+ mac: ENC[AES256_GCM,data:jxx2qu8BkBEy+4mCan3k4FbVj04GnynLPQkWKtZkOGIsgHomn6utQMKlPZCpcIbcnvyQlhA1kENWB/WVXxzytXheYsQGlzyh0XUu8lHWuKbCA+aOaemOTjnvydt2Nh5XLOxsso72FoRBCF7jPZ2R+zjJiCx8dPFEBPY2JU6Z5EQ=,iv:fzBvlmU5tcUEUHCdkLmwm8/tC1yc6tIV4rdN2hs2pVg=,tag:kpwmXNjvt31oUFQCPWq33Q==,type:str]
+ pgp: []
+ encrypted_regex: ^(woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: livekit
+ namespace: matrix
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - livekit.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: livekit-livekit-server
+ port: 80
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnplWS9tWmhoNFBWQS9s
+ M2hxSWp4blJIZ255Q2t1K3lzbnBhSk5Eb0M0CmFvZER6UXErZW1ybGRlSVVzeDhn
+ Tk9lVVZoTU5vcDRqM3dOS2pVZVNOTWcKLS0tIGVuVEpNNlB4OFBnK3BiN0JiMzBq
+ bjRoS3hwNERmMnhkQU8yTVVYNE9XOVUKGtwCOFJog8ZHI6t6kGAFGQYSG/kzRVzQ
+ fFDO4GsRsk760K0kKXkMfP4ePISGgmjhGP7uV4blp3/s/4vb+nXbmg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-05-01T22:18:52Z"
+ mac: ENC[AES256_GCM,data:jxx2qu8BkBEy+4mCan3k4FbVj04GnynLPQkWKtZkOGIsgHomn6utQMKlPZCpcIbcnvyQlhA1kENWB/WVXxzytXheYsQGlzyh0XUu8lHWuKbCA+aOaemOTjnvydt2Nh5XLOxsso72FoRBCF7jPZ2R+zjJiCx8dPFEBPY2JU6Z5EQ=,iv:fzBvlmU5tcUEUHCdkLmwm8/tC1yc6tIV4rdN2hs2pVg=,tag:kpwmXNjvt31oUFQCPWq33Q==,type:str]
pgp: []
encrypted_regex: ^(woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
