From 076340227f359e2265ebc809f3c8b7edff08bd17 Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Sun, 18 Oct 2026 01:27:00 -0400 Subject: [PATCH] docs(livekit): bind lk-jwt-service to 127.0.0.1:8071, not all interfaces (#24) voice-limit-guard (:8070) is meant to be the only way to get a LiveKit token, but lk-jwt-service bound :8071 on every interface, so any LAN host could mint an unguarded token (no max_users, full publish sources in audio-only rooms). The guard runs on the same LXC: document the loopback bind in the setup steps and the port table. Refs #24 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 7f4f5bd..17edfba 100644 --- a/README.md +++ b/README.md @@ -67,7 +67,7 @@ matrix/ - coturn config: `/etc/turnserver.conf` - LiveKit config: `/etc/livekit/config.yaml` - LiveKit service: `livekit-server.service` -- lk-jwt-service: `lk-jwt-service.service` (now binds `:8071` via drop-in `/etc/systemd/system/lk-jwt-service.service.d/override.conf`; serves JWT tokens for MatrixRTC at `/sfu/get` and legacy `/get_token`) +- lk-jwt-service: `lk-jwt-service.service` (now binds `127.0.0.1:8071` via drop-in `/etc/systemd/system/lk-jwt-service.service.d/override.conf`; serves JWT tokens for MatrixRTC at `/sfu/get` and legacy `/get_token`) - voice-limit-guard: `voice-limit-guard.service` (binds `:8070`, fronts lk-jwt-service — enforces hard per-room voice participant limits **and publish permissions (screenshare/camera via JWT re-signing)** for ALL clients; script `/opt/voice-limit-guard/voice-limit-guard.py`) — see [Voice Channel Limits & Call Permissions](#voice-channel-limits--call-permissions) - Hookshot: `/opt/hookshot/`, service: `matrix-hookshot.service` - Hookshot config: `/opt/hookshot/config.yml` @@ -238,7 +238,9 @@ install -D -m644 /opt/matrix-config/livekit/voice-limit-guard.py /opt/voice-limi install -m644 /opt/matrix-config/systemd/voice-limit-guard.service /etc/systemd/system/voice-limit-guard.service # one-time: rebind lk-jwt-service to :8071 mkdir -p /etc/systemd/system/lk-jwt-service.service.d -printf '[Service]\nEnvironment=LIVEKIT_JWT_BIND=:8071\n' > /etc/systemd/system/lk-jwt-service.service.d/override.conf +# Loopback only (matrix #24): the guard runs on this LXC; binding all +# interfaces let any LAN host mint unguarded tokens straight from :8071. +printf '[Service]\nEnvironment=LIVEKIT_JWT_BIND=127.0.0.1:8071\n' > /etc/systemd/system/lk-jwt-service.service.d/override.conf systemctl daemon-reload && systemctl restart lk-jwt-service && systemctl enable --now voice-limit-guard ``` @@ -290,7 +292,7 @@ The token in `draupnir/production.yaml` in this repo is **intentionally redacted | 7880 | LiveKit HTTP | 0.0.0.0 | | 7881 | LiveKit RTC TCP | 0.0.0.0 | | 8070 | voice-limit-guard (fronts lk-jwt-service) | 0.0.0.0 | -| 8071 | lk-jwt-service (behind guard) | 0.0.0.0 | +| 8071 | lk-jwt-service (behind guard) | 127.0.0.1 (matrix #24; was 0.0.0.0) | | 8080 | synapse-admin (nginx) | 0.0.0.0 | | 3478 | coturn STUN/TURN | 0.0.0.0 | | 5349 | coturn TURNS/TLS | 0.0.0.0 | -- 2.47.3