hosts/heather/arion-compose.nix

@@ -122,7 +122,6 @@ in
 
   # Custom network for jitsi (FQDN-based comms, prosody alias xmpp.meet.jitsi)
   networks.meet-jitsi.driver = "bridge";
-  networks.matrix-rtc.driver = "bridge";
   services = {
     # === Forgejo (git.iscg.dev) ===
     # Первый сервис, proof-of-concept для цепочки arion→docker→Caddy.
@@ -154,7 +153,7 @@ in
     #   /var/lib/tuwunel-secrets/tuwunel.toml  (root:docker 0640, bind-mount ro)
     # Cinny config: /var/lib/tuwunel-secrets/cinny-config.json (bind-mount ro).
     tuwunel = {
-      service.image = "ghcr.io/matrix-construct/tuwunel:v1.9.4";
+      service.image = "ghcr.io/matrix-construct/tuwunel:v1.9.3";
       service.container_name = "tuwunel";
       service.restart = "unless-stopped";
       service.volumes = [
@@ -167,51 +166,6 @@ in
         TUWUNEL_CONFIG = "/etc/tuwunel/tuwunel.toml";
       };
     };
-    # MatrixRTC: SFU and OpenID authorization. Secrets never enter the Nix store.
-    matrix-livekit = {
-      service.image = "livekit/livekit-server:v1.13.11";
-      service.container_name = "matrix-livekit";
-      out.service.mem_limit = "1g";
-      service.restart = "unless-stopped";
-      service.user = "65532:65532";
-      service.capabilities.ALL = false;
-      out.service.security_opt = [ "no-new-privileges:true" ];
-      out.service.read_only = true;
-      out.service.pids_limit = 256;
-      service.networks = [ "matrix-rtc" ];
-      service.command = "--config /run/secrets/livekit.yaml";
-      service.volumes = [
-        "/var/lib/matrix-rtc-secrets/livekit.yaml:/run/secrets/livekit.yaml:ro"
-        "/var/lib/matrix-rtc-secrets/turn-secret:/run/secrets/turn-secret:ro"
-      ];
-      service.ports = [ "127.0.0.1:7880:7880" "7881:7881/tcp" "7882:7882/udp" ];
-    };
-    matrix-rtc-jwt = {
-      service.image = "ghcr.io/element-hq/lk-jwt-service:0.9.0";
-      service.container_name = "matrix-rtc-jwt";
-      # Avoid public-IP hairpin NAT for same-host OpenID and SFU calls; TLS stays verified.
-      out.service.extra_hosts = [ "iscg.dev:host-gateway" ];
-      out.service.mem_limit = "256m";
-      service.restart = "unless-stopped";
-      service.user = "65532:65532";
-      service.capabilities.ALL = false;
-      out.service.security_opt = [ "no-new-privileges:true" ];
-      out.service.read_only = true;
-      out.service.pids_limit = 256;
-      service.networks = [ "matrix-rtc" ];
-      service.ports = [ "127.0.0.1:8081:8080" ];
-      service.volumes = [
-        "/var/lib/matrix-rtc-secrets/api-key:/run/secrets/api-key:ro"
-        "/var/lib/matrix-rtc-secrets/api-secret:/run/secrets/api-secret:ro"
-      ];
-      service.environment = {
-        LIVEKIT_URL = "wss://iscg.dev/livekit/sfu";
-        LIVEKIT_KEY_FROM_FILE = "/run/secrets/api-key";
-        LIVEKIT_SECRET_FROM_FILE = "/run/secrets/api-secret";
-        LIVEKIT_FULL_ACCESS_HOMESERVERS = "iscg.dev";
-        LIVEKIT_JWT_BIND = ":8080";
-      };
-    };
     cinny = {
       service.image = "ajbura/cinny:latest";
       service.container_name = "cinny";

hosts/heather/caddy.nix

@@ -58,13 +58,6 @@ Allow: /" 200
 
       # Matrix tuwunel (homeserver)
       "iscg.dev".extraConfig = ''
-        # MatrixRTC signalling and auth share the existing TLS hostname.
-        handle_path /livekit/jwt/* {
-          reverse_proxy 127.0.0.1:8081
-        }
-        handle_path /livekit/sfu/* {
-          reverse_proxy 127.0.0.1:7880
-        }
         # Static file sharing (https://iscg.dev/files/<name>).
         # handle_path stripает /files/ prefix → file_server ищет в root.
         # Не конфликтует с matrix (использует /_matrix/*, /.well-known/matrix).

hosts/heather/default.nix

@@ -96,13 +96,11 @@
       22000   # syncthing sync
       22067   # strelaysrv (relay)
       22070   # strelaysrv (status)
-      7881    # MatrixRTC LiveKit ICE/TCP
       3478    # coturn TURN (tcp+udp)
     ];
     firewall.allowedUDPPorts = [
       22000   # syncthing sync (QUIC)
       10000   # jitsi jvb (RTP media)
-      7882    # MatrixRTC LiveKit ICE/UDP mux
       3478    # coturn TURN
     ];
     # coturn RTP relay range