dev: one-command local calls stack (LiveKit + JWT issuer + voice-limit guard + https well-known) and a seeded voice room

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

scripts/dev-homeserver.sh

@@ -4,9 +4,19 @@
 # SQLite, media served. Everything lives in .dev-homeserver/ (gitignored).
 #
 #   scripts/dev-homeserver.sh start    # install (first run) + start on :8008
+#   scripts/dev-homeserver.sh calls    # + LiveKit SFU, JWT issuer, voice-limit guard, https well-known
 #   scripts/dev-homeserver.sh stop
 #   scripts/dev-homeserver.sh reset    # wipe the database and media
-#   python3 scripts/dev-seed.py 400    # alice/bob + "Busy Room" with images
+#   python3 scripts/dev-seed.py 400    # alice/bob + "Busy Room" with images (+ "Voice Lounge" call room)
+#
+# Calls: `calls` downloads livekit-server (v1.13.7 release binary) into
+# .dev-homeserver/, runs it on :7880 with key devkey, a minimal lk-jwt-service
+# clone (scripts/dev-lk-jwt.py, :8071), the real voice-limit-guard from the
+# sibling matrix repo in front of it (:8070, needs ../matrix checked out and an
+# admin user — dev-seed makes alice one), and a self-signed https server on
+# :443 serving /.well-known/matrix/client with the LiveKit focus (the client
+# autodiscovers the server NAME, not :8008). Drive it with Playwright using
+# --use-fake-device-for-media-stream and ignoreHTTPSErrors.
 #
 # Then `npm start` and log in at http://127.0.0.1:5173/login/http%3A%2F%2Flocalhost%3A8008/
 # as alice / password123.
@@ -32,7 +42,7 @@ install() {
     python3 - "$CFG" <<'PY'
 import sys, re
 p = sys.argv[1]; s = open(p).read()
-s = s.replace("      - client\n", "      - client\n      - media\n", 1)
+s = s.replace("      - client\n", "      - client\n      - media\n      - federation\n", 1)
 s += """
 enable_registration: true
 enable_registration_without_verification: true
@@ -46,10 +56,16 @@ suppress_key_server_warning: true
 # URL previews (embed facades use the homeserver's cached thumbnail)
 url_preview_enabled: true
 url_preview_ip_range_blacklist: ['127.0.0.0/8', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', '100.64.0.0/10', '169.254.0.0/16', '::1/128', 'fe80::/10', 'fc00::/7']
-# scheduled messages (MSC4140 delayed events)
+# scheduled messages (MSC4140 delayed events) + MatrixRTC transports (MSC4143) + room summaries (MSC3266)
 max_event_delay_duration: 24h
 experimental_features:
   msc4140_enabled: true
+  msc4143_enabled: true
+  msc3266_enabled: true
+matrix_rtc:
+  transports:
+    - type: livekit
+      livekit_service_url: http://127.0.0.1:8070
 """
 open(p, "w").write(s)
 PY
@@ -72,10 +88,50 @@ start() {
 
 stop() {
   if [ -f "$PIDFILE" ]; then kill "$(cat "$PIDFILE")" 2>/dev/null || true; rm -f "$PIDFILE"; echo stopped; fi
+  for f in "$DIR"/calls-*.pid; do [ -f "$f" ] && { kill "$(cat "$f")" 2>/dev/null || true; rm -f "$f"; }; done
+}
+
+calls() {
+  start
+  local LK="$DIR/livekit-server"
+  if [ ! -x "$LK" ]; then
+    curl -sL "https://github.com/livekit/livekit/releases/download/v1.13.7/livekit_1.13.7_linux_amd64.tar.gz" | tar xz -C "$DIR" livekit-server
+  fi
+  cat > "$DIR/livekit.yaml" <<'YAML'
+port: 7880
+bind_addresses: ["127.0.0.1"]
+rtc:
+  tcp_port: 7881
+  port_range_start: 50000
+  port_range_end: 50100
+  use_external_ip: false
+  node_ip: 127.0.0.1
+keys:
+  devkey: devsecretdevsecretdevsecretdevsecret
+room:
+  auto_create: true
+YAML
+  local bg
+  bg() { local name="$1"; shift; ( setsid nohup "$@" > "$DIR/calls-$name.log" 2>&1 < /dev/null & echo $! > "$DIR/calls-$name.pid" ); }
+  bg livekit "$LK" --config "$DIR/livekit.yaml"
+  bg jwt env PORT=8071 LIVEKIT_KEY=devkey LIVEKIT_SECRET=devsecretdevsecretdevsecretdevsecret LIVEKIT_URL=ws://127.0.0.1:7880 SYNAPSE_API=http://127.0.0.1:8008 python3 "$ROOT/scripts/dev-lk-jwt.py"
+  if [ ! -f "$DIR/wk.crt" ]; then openssl req -x509 -newkey rsa:2048 -nodes -keyout "$DIR/wk.key" -out "$DIR/wk.crt" -days 365 -subj "/CN=localhost" 2>/dev/null; fi
+  bg wellknown env CERT="$DIR/wk.crt" KEY="$DIR/wk.key" python3 "$ROOT/scripts/dev-wellknown.py"
+  local GUARD="$ROOT/../matrix/livekit/voice-limit-guard.py"
+  local TOKEN_FILE="$DIR/admin.token"
+  if [ -f "$GUARD" ] && [ -f "$TOKEN_FILE" ]; then
+    bg guard env GUARD_BIND_HOST=127.0.0.1 GUARD_BIND_PORT=8070 GUARD_UPSTREAM=http://127.0.0.1:8071 LIVEKIT_API=http://127.0.0.1:7880 LIVEKIT_KEY=devkey LIVEKIT_SECRET=devsecretdevsecretdevsecretdevsecret SYNAPSE_API=http://127.0.0.1:8008 MATRIX_TOKEN="$(cat "$TOKEN_FILE")" python3 "$GUARD"
+  else
+    echo "voice-limit-guard not started (need ../matrix checkout and $TOKEN_FILE from dev-seed.py); pointing the focus straight at the issuer"
+    bg guard env PORT=8070 LIVEKIT_KEY=devkey LIVEKIT_SECRET=devsecretdevsecretdevsecretdevsecret LIVEKIT_URL=ws://127.0.0.1:7880 SYNAPSE_API=http://127.0.0.1:8008 python3 "$ROOT/scripts/dev-lk-jwt.py"
+  fi
+  sleep 2
+  echo "calls stack up: livekit :7880, jwt :8071, guard :8070, well-known https://localhost/.well-known/matrix/client"
 }
 
 case "${1:-}" in
   start) start ;;
+  calls) calls ;;
   stop) stop ;;
   reset) stop; rm -f "$DIR"/homeserver.db* ; rm -rf "$DIR/media_store"; echo "database wiped"; ;;
   *) echo "usage: $0 start|stop|reset" >&2; exit 2 ;;