mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 5.5
9b88fccfc6
An earlier commit on this branch turned the three off because the ansible flavor ran them without a published port, proxy entry, domain or certificate. They now stay on and are wired end to end. Element Call: MDAD's LiveKit server and JWT service get their own entities in meta/services.yml with resource limits, local ports and a public media port (TCP and UDP). The runner container publishes them through container_ports, and the Synapse vhost proxies /livekit-server/ (websocket) and /livekit-jwt-service/ to them. The JWT service checks each OpenID token against the user's homeserver over federation, and federation was not reachable in this flavor: Synapse served it only on a plain-HTTP listener that the runner published directly on 8448. Synapse now serves the client and federation resources on one listener, OpenResty serves the Synapse vhost on 443 and as default_server on the federation port, the direct 8448 publish is gone, and the role writes /.well-known/matrix/server as the compose flavor does. With a self-signed CA the JWT container mounts the CA bundle as Synapse does. Jitsi: a new services.jitsi entity follows the shared-service contract. It is enabled in the ansible flavor off tor nodes. When web-app-jitsi is in the inventory, Element points at that shared Jitsi and MDAD's own Jitsi stays off. Otherwise MDAD runs its own Jitsi on jitsi.<domain> with a front-proxy vhost, its web port published to the runner and its videobridge on a public UDP port. The entity lists the jitsi domain, so the web health probe skips it whenever Matrix does not serve it. The jitsi_*_container_network overrides were dropped: MDAD reads none of them, Jitsi always ran on its own network. Variant 0 covers the shared case, variant 1 the internal one. On an onion-primary deploy both call stacks stay off, so Element never advertises a clearnet call surface. MDAD's Prosody keeps an account's first password, so after a credential rotation jicofo failed SASL with the new one. The role now derives the jicofo and videobridge passwords from the macaroon secret and recreates both accounts on every deploy. Heisenbridge stays on by default. It runs in the nested host network, where MDAD's container-name URLs do not resolve, so its homeserver URL and the appservice URL in its registration point at 127.0.0.1. A bootstrap that a previous deploy left failed (for example after a Docker Hub rate limit) is now reset and restarted, so a mode=update deploy converges instead of failing on the stale unit state. Playwright proves each path: the RTC spec fetches a LiveKit token from the JWT service and opens the SFU signalling websocket, the Jitsi spec checks Element's preferred domain and joins a conference (signing in through Keycloak first when the shared Jitsi sits behind SSO), and the Heisenbridge spec opens a DM with the bot and waits for its answer to "help". Closes #1165 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>