Lotus CIandClaude Opus 5.5
46d0e98424
Lint / Shell (shellcheck) (push) Successful in 2m0s
Lint / JS (eslint) (push) Successful in 2m1s
Lint / No secrets in webhook configs (push) Successful in 18s
Lint / Landing page is rendered (matrix (push) Successful in 18s
Lint / Python (ruff) (push) Successful in 25s
Lint / Secret scan (gitleaks) (push) Successful in 14s
Lint / Shell (shellcheck) (pull_request) Successful in 9s
Lint / JS (eslint) (pull_request) Successful in 9s
Lint / No secrets in webhook configs (pull_request) Successful in 7s
Lint / Python deps (pip-audit) (push) Successful in 1m7s
Lint / Landing page is rendered (matrix (pull_request) Successful in 4s
Lint / Python (ruff) (pull_request) Successful in 6s
Lint / Secret scan (gitleaks) (pull_request) Successful in 6s
Lint / Python deps (pip-audit) (pull_request) Successful in 30s
Production setup for the Discord voice bridge on LXC 151: config and appservice-registration templates (secrets rendered on the server), an idempotent install script (one Synapse restart on first install, creates the bot account so it can be invited), and a hardened systemd unit. voice-limit-guard: VOICE_LIMIT_EXEMPT_USERS lets the bridge's own bot listen in a call without taking a slot; relayed Discord speakers still count. Unit tests added (61 pass); verified live on the dev stack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
27 lines
1.1 KiB
Desktop File
27 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=Voice Limit Guard (hard per-room voice channel participant limits, fronts lk-jwt-service)
|
|
After=network.target livekit-server.service lk-jwt-service.service
|
|
Wants=lk-jwt-service.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/bin/env python3 /opt/voice-limit-guard/voice-limit-guard.py
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
# Secrets come from the deploy env file, never from this unit — it is in git.
|
|
# Provides MATRIX_TOKEN (server-admin), LIVEKIT_KEY and LIVEKIT_SECRET.
|
|
# NOTE: LIVEKIT_KEY/SECRET must match /etc/livekit/config.yaml and
|
|
# lk-jwt-service (which reads the same env file). Rotating means changing
|
|
# all three together, or every call fails to get a token.
|
|
EnvironmentFile=/etc/matrix-deploy.env
|
|
Environment=GUARD_BIND_HOST=0.0.0.0
|
|
Environment=GUARD_BIND_PORT=8070
|
|
Environment=GUARD_UPSTREAM=http://127.0.0.1:8071
|
|
Environment=LIVEKIT_API=http://127.0.0.1:7880
|
|
Environment=SYNAPSE_API=http://127.0.0.1:8008
|
|
# The voice bridge's bot listens in calls but is not a person (Discord speakers still count).
|
|
Environment=VOICE_LIMIT_EXEMPT_USERS=@lotus-voice_bot:matrix\\.lotusguild\\.org
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|