release.yaml (13984B)
1 apiVersion: cert-manager.io/v1 2 kind: Certificate 3 metadata: 4 name: livekit 5 namespace: matrix 6 spec: 7 secretName: livekit.matrix.midnightthoughts.space-tls 8 privateKey: 9 rotationPolicy: ENC[AES256_GCM,data:Gg30EjR2,iv:/6pMR/Hoe4V3mu5tpPhPtTmdWv+IlDLAwfu16kTl0jg=,tag:T7ArLggv/ye0GdLW+PUYIg==,type:str] 10 issuerRef: 11 name: letsencrypt-dns 12 kind: ClusterIssuer 13 commonName: livekit.matrix.midnightthoughts.space 14 dnsNames: 15 - turn.matrix.midnightthoughts.space 16 - livekit.matrix.midnightthoughts.space 17 additionalOutputFormats: 18 - type: CombinedPEM 19 - type: DER 20 sops: 21 kms: [] 22 gcp_kms: [] 23 azure_kv: [] 24 hc_vault: [] 25 age: 26 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 27 enc: | 28 -----BEGIN AGE ENCRYPTED FILE----- 29 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnplWS9tWmhoNFBWQS9s 30 M2hxSWp4blJIZ255Q2t1K3lzbnBhSk5Eb0M0CmFvZER6UXErZW1ybGRlSVVzeDhn 31 Tk9lVVZoTU5vcDRqM3dOS2pVZVNOTWcKLS0tIGVuVEpNNlB4OFBnK3BiN0JiMzBq 32 bjRoS3hwNERmMnhkQU8yTVVYNE9XOVUKGtwCOFJog8ZHI6t6kGAFGQYSG/kzRVzQ 33 fFDO4GsRsk760K0kKXkMfP4ePISGgmjhGP7uV4blp3/s/4vb+nXbmg== 34 -----END AGE ENCRYPTED FILE----- 35 lastmodified: "2025-05-01T22:18:52Z" 36 mac: ENC[AES256_GCM,data:jxx2qu8BkBEy+4mCan3k4FbVj04GnynLPQkWKtZkOGIsgHomn6utQMKlPZCpcIbcnvyQlhA1kENWB/WVXxzytXheYsQGlzyh0XUu8lHWuKbCA+aOaemOTjnvydt2Nh5XLOxsso72FoRBCF7jPZ2R+zjJiCx8dPFEBPY2JU6Z5EQ=,iv:fzBvlmU5tcUEUHCdkLmwm8/tC1yc6tIV4rdN2hs2pVg=,tag:kpwmXNjvt31oUFQCPWq33Q==,type:str] 37 pgp: [] 38 encrypted_regex: ^(woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 39 version: 3.9.1 40 --- 41 apiVersion: networking.k8s.io/v1 42 kind: IngressClass 43 metadata: 44 name: fake 45 spec: 46 controller: k8s.io/fake-ingrerss 47 sops: 48 kms: [] 49 gcp_kms: [] 50 azure_kv: [] 51 hc_vault: [] 52 age: 53 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 54 enc: | 55 -----BEGIN AGE ENCRYPTED FILE----- 56 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnplWS9tWmhoNFBWQS9s 57 M2hxSWp4blJIZ255Q2t1K3lzbnBhSk5Eb0M0CmFvZER6UXErZW1ybGRlSVVzeDhn 58 Tk9lVVZoTU5vcDRqM3dOS2pVZVNOTWcKLS0tIGVuVEpNNlB4OFBnK3BiN0JiMzBq 59 bjRoS3hwNERmMnhkQU8yTVVYNE9XOVUKGtwCOFJog8ZHI6t6kGAFGQYSG/kzRVzQ 60 fFDO4GsRsk760K0kKXkMfP4ePISGgmjhGP7uV4blp3/s/4vb+nXbmg== 61 -----END AGE ENCRYPTED FILE----- 62 lastmodified: "2025-05-01T22:18:52Z" 63 mac: ENC[AES256_GCM,data:jxx2qu8BkBEy+4mCan3k4FbVj04GnynLPQkWKtZkOGIsgHomn6utQMKlPZCpcIbcnvyQlhA1kENWB/WVXxzytXheYsQGlzyh0XUu8lHWuKbCA+aOaemOTjnvydt2Nh5XLOxsso72FoRBCF7jPZ2R+zjJiCx8dPFEBPY2JU6Z5EQ=,iv:fzBvlmU5tcUEUHCdkLmwm8/tC1yc6tIV4rdN2hs2pVg=,tag:kpwmXNjvt31oUFQCPWq33Q==,type:str] 64 pgp: [] 65 encrypted_regex: ^(woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 66 version: 3.9.1 67 --- 68 apiVersion: helm.toolkit.fluxcd.io/v2 69 kind: HelmRelease 70 metadata: 71 name: livekit 72 namespace: matrix 73 spec: 74 chart: 75 spec: 76 chart: ./livekit-server/ 77 sourceRef: 78 kind: GitRepository 79 name: livekit-nordeck 80 namespace: matrix 81 interval: 60m 82 timeout: 25m 83 install: 84 remediation: 85 retries: 3 86 values: 87 podHostNetwork: true 88 image: 89 tag: v1.8.4 90 pullPolicy: IfNotPresent 91 replicaCount: 3 92 # Suggested value for gracefully terminate the pod: 5 hours 93 terminationGracePeriodSeconds: 18000 94 livekit: 95 # port: 7880 96 # Uncomment to enable prometheus metrics 97 # prometheus_port: 6789 98 log_level: info 99 rtc: 100 use_external_ip: true 101 # default ports used 102 port_range_start: 50000 103 port_range_end: 60000 104 tcp_port: 7881 105 redis: 106 address: matrix-synapse-keydb.matrix.svc.cluster.local:6379 107 # db: 0 108 # username: 109 # password: 110 # use_tls: true 111 # one or more API key/secret pairs 112 # see https://docs.livekit.io/guides/getting-started/#generate-api-key-and-secret 113 keys: 114 woosh: ENC[AES256_GCM,data:T21nut0F4Cmc6OhFM3wdVoAPM9ZjuGDsGYGZdHJC/jItg23OBKql4bLXjY1H+9ccmhCzGS2ieiagZjPMgxW4Ow==,iv:70YVy8oU2UoCxHX9WSAr4CYKiHTdXnY5hy71hWu3G6U=,tag:AGz6iuSyMH7Djoe8Dz3Eow==,type:str] 115 turn: 116 enabled: true 117 # must match domain of your TLS cert 118 domain: turn.matrix.midnightthoughts.space 119 # tls_port must be 443 if turn load balancer is disabled 120 tls_port: 3478 121 # udp_port should be 443 for best connectivity through firewalls 122 udp_port: 443 123 # uncomment if you will manage TLS termination for TURN, secretName is not used 124 # when external_tls is set 125 # external_tls: true 126 # Kubernetes Secret containing TLS cert for <turn.myhost.com> 127 # See https://docs.livekit.io/deploy/kubernetes/#importing-ssl-certificates 128 secretName: livekit.matrix.midnightthoughts.space-tls 129 # set the Kubernetes serviceType for the TURN service. By default it sets it to "LoadBalancer" but for Hetzner you want NodePort and use a custom ingress 130 # See kubernetes serviceTypes on official documentation: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types 131 serviceType: NodePort 132 loadBalancerAnnotations: 133 external-dns.alpha.kubernetes.io/hostname: turn.matrix.midnightthoughts.space 134 external-dns.alpha.kubernetes.io/access: public 135 loadBalancer: 136 # valid values: disable, alb, aws, gke, gke-managed-cert, gke-native-vpc, do, hetzner 137 # on AWS, we recommend using alb load balancer, which supports TLS termination 138 # * in order to use alb, aws-ingress-controller must be installed 139 # https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html 140 # * for gke-managed-cert type follow https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs 141 # and set staticIpName to your reserved static IP, and certificateName to be 142 # name of the managed cert 143 # * for do uncomment clusterIssuer with your cert manager issuer 144 type: hetzner 145 # staticIpName: <nameofIpAddressCreated> 146 # certificateName: <nameOfCert> 147 # clusterIssuer: letsencrypt-prod 148 tls: 149 - hosts: 150 - livekit.matrix.midnightthoughts.space 151 - turn.matrix.midnightthoughts.space 152 # with alb, certificates needs to reside in ACM for self-discovery 153 # with do, use cert-manager and create certificate for turn. Load balancer is autoamtic 154 # with gke, specify one or more secrets to use for the certificate 155 # see: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-multi-ssl#specifying_certificates_for_your_ingress 156 secretName: livekit.matrix.midnightthoughts.space-tls 157 # Set the external DNS annotations for the load balancer here as Hetzner LB doesn't support UDP. So the load balancer is a NodePort meaning it is directly routing to the nodes. 158 extraAnnotations: 159 external-dns.alpha.kubernetes.io/hostname: turn.matrix.midnightthoughts.space 160 external-dns.alpha.kubernetes.io/access: public 161 # Ensure the ingress class name is set to the one used by your cluster 162 ingressClassName: fake 163 # autoscaling requires resources to be defined 164 autoscaling: 165 # set to true to enable autoscaling. when set, ignores replicaCount 166 enabled: false 167 minReplicas: 1 168 maxReplicas: 5 169 targetCPUUtilizationPercentage: 60 170 # if LiveKit should run only on specific nodes 171 # this can be used to isolate designated nodes 172 nodeSelector: {} 173 # node.kubernetes.io/instance-type: c5.2xlarge 174 resources: {} 175 # Due to port restrictions, you can run only one instance of LiveKit per physical 176 # node. Because of that, we recommend giving it plenty of resources to work with 177 # limits: 178 # cpu: 6000m 179 # memory: 2048Mi 180 # requests: 181 # cpu: 4000m 182 # memory: 1024Mi 183 sops: 184 kms: [] 185 gcp_kms: [] 186 azure_kv: [] 187 hc_vault: [] 188 age: 189 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 190 enc: | 191 -----BEGIN AGE ENCRYPTED FILE----- 192 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnplWS9tWmhoNFBWQS9s 193 M2hxSWp4blJIZ255Q2t1K3lzbnBhSk5Eb0M0CmFvZER6UXErZW1ybGRlSVVzeDhn 194 Tk9lVVZoTU5vcDRqM3dOS2pVZVNOTWcKLS0tIGVuVEpNNlB4OFBnK3BiN0JiMzBq 195 bjRoS3hwNERmMnhkQU8yTVVYNE9XOVUKGtwCOFJog8ZHI6t6kGAFGQYSG/kzRVzQ 196 fFDO4GsRsk760K0kKXkMfP4ePISGgmjhGP7uV4blp3/s/4vb+nXbmg== 197 -----END AGE ENCRYPTED FILE----- 198 lastmodified: "2025-05-01T22:18:52Z" 199 mac: ENC[AES256_GCM,data:jxx2qu8BkBEy+4mCan3k4FbVj04GnynLPQkWKtZkOGIsgHomn6utQMKlPZCpcIbcnvyQlhA1kENWB/WVXxzytXheYsQGlzyh0XUu8lHWuKbCA+aOaemOTjnvydt2Nh5XLOxsso72FoRBCF7jPZ2R+zjJiCx8dPFEBPY2JU6Z5EQ=,iv:fzBvlmU5tcUEUHCdkLmwm8/tC1yc6tIV4rdN2hs2pVg=,tag:kpwmXNjvt31oUFQCPWq33Q==,type:str] 200 pgp: [] 201 encrypted_regex: ^(woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 202 version: 3.9.1 203 --- 204 apiVersion: gateway.networking.k8s.io/v1 205 kind: HTTPRoute 206 metadata: 207 name: livekit 208 namespace: matrix 209 spec: 210 parentRefs: 211 - name: envoy-gateway 212 namespace: envoy-gateway 213 hostnames: 214 - livekit.matrix.midnightthoughts.space 215 rules: 216 - backendRefs: 217 - name: livekit-livekit-server 218 port: 80 219 sops: 220 kms: [] 221 gcp_kms: [] 222 azure_kv: [] 223 hc_vault: [] 224 age: 225 - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh 226 enc: | 227 -----BEGIN AGE ENCRYPTED FILE----- 228 YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2WnplWS9tWmhoNFBWQS9s 229 M2hxSWp4blJIZ255Q2t1K3lzbnBhSk5Eb0M0CmFvZER6UXErZW1ybGRlSVVzeDhn 230 Tk9lVVZoTU5vcDRqM3dOS2pVZVNOTWcKLS0tIGVuVEpNNlB4OFBnK3BiN0JiMzBq 231 bjRoS3hwNERmMnhkQU8yTVVYNE9XOVUKGtwCOFJog8ZHI6t6kGAFGQYSG/kzRVzQ 232 fFDO4GsRsk760K0kKXkMfP4ePISGgmjhGP7uV4blp3/s/4vb+nXbmg== 233 -----END AGE ENCRYPTED FILE----- 234 lastmodified: "2025-05-01T22:18:52Z" 235 mac: ENC[AES256_GCM,data:jxx2qu8BkBEy+4mCan3k4FbVj04GnynLPQkWKtZkOGIsgHomn6utQMKlPZCpcIbcnvyQlhA1kENWB/WVXxzytXheYsQGlzyh0XUu8lHWuKbCA+aOaemOTjnvydt2Nh5XLOxsso72FoRBCF7jPZ2R+zjJiCx8dPFEBPY2JU6Z5EQ=,iv:fzBvlmU5tcUEUHCdkLmwm8/tC1yc6tIV4rdN2hs2pVg=,tag:kpwmXNjvt31oUFQCPWq33Q==,type:str] 236 pgp: [] 237 encrypted_regex: ^(woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ 238 version: 3.9.1