feat: add livekit

services/default.nix

@@ -3,5 +3,6 @@
   imports = [
     ./openssh.nix
     ./nginx.nix
+    ./livekit.nix
   ];
 }

services/livekit.nix

@@ -0,0 +1,52 @@
+{ lib, pkgs, ... }:
+let
+  serviceConfig = import ../config/services.nix;
+  cfg = serviceConfig.livekit;
+  keyFile = cfg.keyFile;
+  publicUrl = "wss://${cfg.domain}/livekit/sfu/";
+  trustedHomeservers =
+    if builtins.isList cfg.trusted_homeservers then
+      cfg.trusted_homeservers
+    else
+      throw "config/services.nix livekit.trusted_homeservers must be a list of domains.";
+  trustedHomeserversEnv = builtins.concatStringsSep "," trustedHomeservers;
+in
+{
+  services.livekit = lib.mkIf cfg.enable {
+    enable = true;
+    settings.room.auto_create = false;
+    inherit keyFile;
+    openFirewall = true;
+    settings = {
+      port = cfg.port;
+      rtc = {
+        port_range_start = cfg.rtc_port_range_start;
+        port_range_end = cfg.rtc_port_range_end;
+      };
+    };
+  };
+
+  services.lk-jwt-service = lib.mkIf cfg.enable {
+    enable = true;
+    livekitUrl = publicUrl;
+    inherit keyFile;
+    port = cfg.jwt_port;
+  };
+
+  systemd.services.livekit-key = lib.mkIf cfg.enable {
+    before = [ "lk-jwt-service.service" "livekit.service" ];
+    wantedBy = [ "multi-user.target" ];
+    path = with pkgs; [ livekit coreutils gawk ];
+    script = ''
+        echo "Key missing, generating key"
+        mkdir -p "$(dirname "${keyFile}")"
+        echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}"
+    '';
+    serviceConfig.Type = "oneshot";
+    unitConfig.ConditionPathExists = "!${keyFile}";
+  };
+
+  systemd.services.lk-jwt-service = lib.mkIf cfg.enable {
+    environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = trustedHomeserversEnv;
+  };
+}

services/nginx.nix

@@ -1,25 +1,42 @@
 { config, lib, ... }:
 let
+  nginxConfig = import ../intermediate/nginx.nix;
   serviceConfig = import ../config/services.nix;
-  nginxModel = import ../intermediate/nginx.nix;
+  acmeDomains = nginxConfig.localServiceAcmeDomains;
+  acmeEmailConfigured =
+    config.security.acme ? defaults
+    && builtins.isAttrs config.security.acme.defaults
+    && config.security.acme.defaults ? email
+    && builtins.isString config.security.acme.defaults.email
+    && config.security.acme.defaults.email != "";
 in
 {
-  assertions = [
-    {
-      assertion = nginxModel.validatedEndpoints != [];
-      message = "No endpoints configured. Add endpoint declarations under config/endpoints/.";
-    }
-  ];
+  config = lib.mkIf serviceConfig.nginx.enable {
+    assertions = lib.optional (acmeDomains != [] && !acmeEmailConfigured) {
+      assertion = false;
+      message = "TLS local proxy endpoints exist, but security.acme.defaults.email is missing or empty.";
+    };
 
-  services.nginx = {
-    enable = serviceConfig.nginx.enable;
+    services.nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      virtualHosts = nginxConfig.virtualHosts;
+      streamConfig = nginxConfig.streamConfig;
+    };
 
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    streamConfig = nginxModel.streamConfig;
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = serviceConfig.nginx.acmeEmail;
+      certs = builtins.listToAttrs (map (domain: {
+        name = domain;
+        value = {
+          webroot = "/var/lib/acme/acme-challenge";
+          group = "nginx";
+        };
+      }) acmeDomains);
+    };
+
+    networking.firewall.allowedTCPPorts = nginxConfig.publicListenPorts;
   };
-
-  networking.firewall.allowedTCPPorts = nginxModel.nginxUsedPorts;
 }