titan-iac/services/comms/livekit.yaml

# services/comms/livekit.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: livekit
  labels:
    app: livekit
spec:
  replicas: 1
  selector:
    matchLabels:
      app: livekit
  template:
    metadata:
      annotations:
        checksum/config: livekit-config-v5
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-init-first: "true"
        vault.hashicorp.com/role: "comms"
        vault.hashicorp.com/agent-inject-secret-turn-secret: "kv/data/atlas/comms/turn-shared-secret"
        vault.hashicorp.com/agent-inject-template-turn-secret: |
          {{- with secret "kv/data/atlas/comms/turn-shared-secret" -}}{{ .Data.data.TURN_STATIC_AUTH_SECRET }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-livekit-primary: "kv/data/atlas/comms/livekit-api"
        vault.hashicorp.com/agent-inject-template-livekit-primary: |
          {{- with secret "kv/data/atlas/comms/livekit-api" -}}{{ .Data.data.primary }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-bot-pass: "kv/data/atlas/comms/atlasbot-credentials-runtime"
        vault.hashicorp.com/agent-inject-template-bot-pass: |
          {{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "bot-password" }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-seeder-pass: "kv/data/atlas/comms/atlasbot-credentials-runtime"
        vault.hashicorp.com/agent-inject-template-seeder-pass: |
          {{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "seeder-password" }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-chat-matrix: "kv/data/atlas/shared/chat-ai-keys-runtime"
        vault.hashicorp.com/agent-inject-template-chat-matrix: |
          {{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.matrix }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-chat-homepage: "kv/data/atlas/shared/chat-ai-keys-runtime"
        vault.hashicorp.com/agent-inject-template-chat-homepage: |
          {{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.homepage }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-mas-admin-secret: "kv/data/atlas/comms/mas-admin-client-runtime"
        vault.hashicorp.com/agent-inject-template-mas-admin-secret: |
          {{- with secret "kv/data/atlas/comms/mas-admin-client-runtime" -}}{{ .Data.data.client_secret }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-synapse-db-pass: "kv/data/atlas/comms/synapse-db"
        vault.hashicorp.com/agent-inject-template-synapse-db-pass: |
          {{- with secret "kv/data/atlas/comms/synapse-db" -}}{{ .Data.data.POSTGRES_PASSWORD }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-mas-db-pass: "kv/data/atlas/comms/mas-db"
        vault.hashicorp.com/agent-inject-template-mas-db-pass: |
          {{- with secret "kv/data/atlas/comms/mas-db" -}}{{ .Data.data.password }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-mas-matrix-shared: "kv/data/atlas/comms/mas-secrets-runtime"
        vault.hashicorp.com/agent-inject-template-mas-matrix-shared: |
          {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.matrix_shared_secret }}{{- end -}}
        vault.hashicorp.com/agent-inject-secret-mas-kc-secret: "kv/data/atlas/comms/mas-secrets-runtime"
        vault.hashicorp.com/agent-inject-template-mas-kc-secret: |
          {{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
      labels:
        app: livekit
    spec:
      serviceAccountName: comms-vault
      enableServiceLinks: false
      nodeSelector:
        hardware: rpi5
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 50
              preference:
                matchExpressions:
                  - key: hardware
                    operator: In
                    values: ["rpi5","rpi4"]
      initContainers:
        - name: render-config
          image: alpine:3.20
          command: ["/bin/sh","-c"]
          args:
            - |
              set -euo pipefail
              . /vault/scripts/comms_vault_env.sh
              umask 077
              TURN_PASSWORD_ESCAPED="$(printf '%s' "${TURN_PASSWORD}" | sed 's/[\\/&]/\\&/g')"
              sed "s/@@TURN_PASSWORD@@/${TURN_PASSWORD_ESCAPED}/g" /etc/livekit-template/livekit.yaml > /etc/livekit/livekit.yaml
              chmod 0644 /etc/livekit/livekit.yaml
          volumeMounts:
            - name: config-template
              mountPath: /etc/livekit-template
              readOnly: true
            - name: config
              mountPath: /etc/livekit
              readOnly: false
            - name: vault-scripts
              mountPath: /vault/scripts
              readOnly: true
      containers:
        - name: livekit
          image: livekit/livekit-server:v1.9.0
          command:
            - /bin/sh
            - -c
            - |
              set -euo pipefail
              . /vault/scripts/comms_vault_env.sh
              umask 077
              printf "%s: %s\n" "${LIVEKIT_API_KEY_ID}" "${LIVEKIT_API_SECRET}" > /var/run/livekit/keys
              chmod 600 /var/run/livekit/keys
              exec /livekit-server --config /etc/livekit/livekit.yaml --key-file /var/run/livekit/keys
          env:
            - name: LIVEKIT_API_KEY_ID
              value: primary
          ports:
            - containerPort: 7880
              name: http
              protocol: TCP
            - containerPort: 7881
              name: rtc-tcp
              protocol: TCP
            - containerPort: 7882
              name: rtc-udp
              protocol: UDP
            - containerPort: 7883
              name: rtc-udp2
              protocol: UDP
          volumeMounts:
            - name: config
              mountPath: /etc/livekit
              readOnly: true
            - name: runtime-keys
              mountPath: /var/run/livekit
            - name: vault-scripts
              mountPath: /vault/scripts
              readOnly: true
          resources:
            requests:
              cpu: 500m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 1Gi
      volumes:
        - name: config-template
          configMap:
            name: livekit-config
            items:
              - key: livekit.yaml
                path: livekit.yaml
        - name: config
          emptyDir: {}
        - name: runtime-keys
          emptyDir: {}
        - name: vault-scripts
          configMap:
            name: comms-vault-env
            defaultMode: 0555
---
apiVersion: v1
kind: Service
metadata:
  name: livekit
  annotations:
    metallb.universe.tf/address-pool: communication-pool
spec:
  type: LoadBalancer
  loadBalancerClass: metallb
  loadBalancerIP: 192.168.22.6
  externalTrafficPolicy: Local
  selector:
    app: livekit
  ports:
    - name: http
      port: 7880
      targetPort: 7880
      protocol: TCP
    - name: rtc-tcp
      port: 7881
      targetPort: 7881
      protocol: TCP
    - name: rtc-udp-7882
      port: 7882
      targetPort: 7882
      protocol: UDP
    - name: rtc-udp-7883
      port: 7883
      targetPort: 7883
      protocol: UDP