bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
titan-iac/services/comms/livekit.yaml

182 lines
7.6 KiB
YAML
Raw Blame History

# services/comms/livekit.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: livekit
labels:
app: livekit
spec:
replicas: 1
selector:
matchLabels:
app: livekit
template:
metadata:
annotations:
checksum/config: livekit-config-v5
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/agent-init-first: "true"
vault.hashicorp.com/role: "comms"
vault.hashicorp.com/agent-inject-secret-turn-shared-secret__TURN_STATIC_AUTH_SECRET: "kv/data/atlas/comms/turn-shared-secret"
vault.hashicorp.com/agent-inject-template-turn-shared-secret__TURN_STATIC_AUTH_SECRET: |
{{- with secret "kv/data/atlas/comms/turn-shared-secret" -}}{{ .Data.data.TURN_STATIC_AUTH_SECRET }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-livekit-api__primary: "kv/data/atlas/comms/livekit-api"
vault.hashicorp.com/agent-inject-template-livekit-api__primary: |
{{- with secret "kv/data/atlas/comms/livekit-api" -}}{{ .Data.data.primary }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-atlasbot-credentials-runtime__bot-password: "kv/data/atlas/comms/atlasbot-credentials-runtime"
vault.hashicorp.com/agent-inject-template-atlasbot-credentials-runtime__bot-password: |
{{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "bot-password" }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-atlasbot-credentials-runtime__seeder-password: "kv/data/atlas/comms/atlasbot-credentials-runtime"
vault.hashicorp.com/agent-inject-template-atlasbot-credentials-runtime__seeder-password: |
{{- with secret "kv/data/atlas/comms/atlasbot-credentials-runtime" -}}{{ index .Data.data "seeder-password" }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-chat-ai-keys-runtime__matrix: "kv/data/atlas/shared/chat-ai-keys-runtime"
vault.hashicorp.com/agent-inject-template-chat-ai-keys-runtime__matrix: |
{{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.matrix }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-chat-ai-keys-runtime__homepage: "kv/data/atlas/shared/chat-ai-keys-runtime"
vault.hashicorp.com/agent-inject-template-chat-ai-keys-runtime__homepage: |
{{- with secret "kv/data/atlas/shared/chat-ai-keys-runtime" -}}{{ .Data.data.homepage }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-admin-client-runtime__client_secret: "kv/data/atlas/comms/mas-admin-client-runtime"
vault.hashicorp.com/agent-inject-template-mas-admin-client-runtime__client_secret: |
{{- with secret "kv/data/atlas/comms/mas-admin-client-runtime" -}}{{ .Data.data.client_secret }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-synapse-db__POSTGRES_PASSWORD: "kv/data/atlas/comms/synapse-db"
vault.hashicorp.com/agent-inject-template-synapse-db__POSTGRES_PASSWORD: |
{{- with secret "kv/data/atlas/comms/synapse-db" -}}{{ .Data.data.POSTGRES_PASSWORD }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-db__password: "kv/data/atlas/comms/mas-db"
vault.hashicorp.com/agent-inject-template-mas-db__password: |
{{- with secret "kv/data/atlas/comms/mas-db" -}}{{ .Data.data.password }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-secrets-runtime__matrix_shared_secret: "kv/data/atlas/comms/mas-secrets-runtime"
vault.hashicorp.com/agent-inject-template-mas-secrets-runtime__matrix_shared_secret: |
{{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.matrix_shared_secret }}{{- end -}}
vault.hashicorp.com/agent-inject-secret-mas-secrets-runtime__keycloak_client_secret: "kv/data/atlas/comms/mas-secrets-runtime"
vault.hashicorp.com/agent-inject-template-mas-secrets-runtime__keycloak_client_secret: |
{{- with secret "kv/data/atlas/comms/mas-secrets-runtime" -}}{{ .Data.data.keycloak_client_secret }}{{- end -}}
labels:
app: livekit
spec:
serviceAccountName: comms-vault
enableServiceLinks: false
nodeSelector:
hardware: rpi5
affinity:
nodeAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 50
preference:
matchExpressions:
- key: hardware
operator: In
values: ["rpi5","rpi4"]
initContainers:
- name: render-config
image: alpine:3.20
command: ["/bin/sh","-c"]
args:
- |
set -euo pipefail
. /vault/scripts/comms_vault_env.sh
umask 077
TURN_PASSWORD_ESCAPED="$(printf '%s' "${TURN_PASSWORD}" | sed 's/[\\/&]/\\&/g')"
sed "s/@@TURN_PASSWORD@@/${TURN_PASSWORD_ESCAPED}/g" /etc/livekit-template/livekit.yaml > /etc/livekit/livekit.yaml
chmod 0644 /etc/livekit/livekit.yaml
volumeMounts:
- name: config-template
mountPath: /etc/livekit-template
readOnly: true
- name: config
mountPath: /etc/livekit
readOnly: false
- name: vault-scripts
mountPath: /vault/scripts
readOnly: true
containers:
- name: livekit
image: livekit/livekit-server:v1.9.0
command:
- /bin/sh
- -c
- |
set -euo pipefail
. /vault/scripts/comms_vault_env.sh
umask 077
printf "%s: %s\n" "${LIVEKIT_API_KEY_ID}" "${LIVEKIT_API_SECRET}" > /var/run/livekit/keys
chmod 600 /var/run/livekit/keys
exec /livekit-server --config /etc/livekit/livekit.yaml --key-file /var/run/livekit/keys
env:
- name: LIVEKIT_API_KEY_ID
value: primary
ports:
- containerPort: 7880
name: http
protocol: TCP
- containerPort: 7881
name: rtc-tcp
protocol: TCP
- containerPort: 7882
name: rtc-udp
protocol: UDP
- containerPort: 7883
name: rtc-udp2
protocol: UDP
volumeMounts:
- name: config
mountPath: /etc/livekit
readOnly: true
- name: runtime-keys
mountPath: /var/run/livekit
- name: vault-scripts
mountPath: /vault/scripts
readOnly: true
resources:
requests:
cpu: 500m
memory: 512Mi
limits:
cpu: "2"
memory: 1Gi
volumes:
- name: config-template
configMap:
name: livekit-config
items:
- key: livekit.yaml
path: livekit.yaml
- name: config
emptyDir: {}
- name: runtime-keys
emptyDir: {}
- name: vault-scripts
configMap:
name: comms-vault-env
defaultMode: 0555
---
apiVersion: v1
kind: Service
metadata:
name: livekit
annotations:
metallb.universe.tf/address-pool: communication-pool
spec:
type: LoadBalancer
loadBalancerClass: metallb
loadBalancerIP: 192.168.22.6
externalTrafficPolicy: Local
selector:
app: livekit
ports:
- name: http
port: 7880
targetPort: 7880
protocol: TCP
- name: rtc-tcp
port: 7881
targetPort: 7881
protocol: TCP
- name: rtc-udp-7882
port: 7882
targetPort: 7882
protocol: UDP
- name: rtc-udp-7883
port: 7883
targetPort: 7883
protocol: UDP
Reference in New Issue View Git Blame Copy Permalink