Toggle SFU room creation restrictions to on

[benbz]

Added in #635 with 0.3.0 of the MatrixRTC authoriser service. Controls whether LIVEKIT_FULL_ACCESS_HOMESERVERS is set to $.Values.serverName (true) or * (false).

Unsure if this can be toggled yet, so draft and cc @fkwp for advice

[github-actions]

dyff of changes in rendered templates of CI manifests

Full contents of manifests and dyffs are available in https://github.com/element-hq/ess-helm/actions/runs/20129756391/artifacts/4836039124

example-default-enabled-components-checkov-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost

example-default-enabled-components-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost

pytest-matrix-rtc-synapse-wellknown-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ ess.localhost

quick-setup-certificates-pg-external-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ your.tld

quick-setup-certificates-pg-with-helm-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ your.tld

quick-setup-external-cert-pg-external-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ your.tld

quick-setup-external-cert-pg-with-helm-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ your.tld

quick-setup-letsencrypt-pg-external-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ your.tld

quick-setup-letsencrypt-pg-with-helm-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ your.tld

quick-setup-wildcard-cert-pg-external-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ your.tld

quick-setup-wildcard-cert-pg-with-helm-values.yaml

@@ Deployment/ess-ci/release-name-matrix-rtc-authorisation-service - spec.template.spec.containers.matrix-rtc-authorisation-service.env.LIVEKIT_FULL_ACCESS_HOMESERVERS.value @@
- *
+ your.tld

[fkwp]

does this change also configures the SFU to restrict room creation ?

room:
  auto_create: false

[benbz]

does this change also configures the SFU to restrict room creation ?

room:
  auto_create: false

That is hard-coded off regardless of the value of matrixRTC.restrictRoomCreationToLocalUsers.

[fkwp]

Added in #635 with 0.3.0 of the MatrixRTC authoriser service. Controls whether LIVEKIT_FULL_ACCESS_HOMESERVERS is set to $.Values.serverName (true) or * (false).

Unsure if this can be toggled yet, so draft and cc @fkwp for advice

It would work. It's important that the lk-jwt-service can reach out to the SFU to create the room in advance. However, that's already the case as the config is currently defaulting to *

[benbz]

Added in #635 with 0.3.0 of the MatrixRTC authoriser service. Controls whether LIVEKIT_FULL_ACCESS_HOMESERVERS is set to $.Values.serverName (true) or * (false).
Unsure if this can be toggled yet, so draft and cc @fkwp for advice

It would work. It's important that the lk-jwt-service can reach out to the SFU to create the room in advance. However, that's already the case as the config is currently defaulting to *

So as per the original comment until clients are upgraded to support the new mechanism, enough clients now support the new mechanism and enough time has passed since they gained support for it?

[fkwp]

Added in #635 with 0.3.0 of the MatrixRTC authoriser service. Controls whether LIVEKIT_FULL_ACCESS_HOMESERVERS is set to $.Values.serverName (true) or * (false).
Unsure if this can be toggled yet, so draft and cc @fkwp for advice

It would work. It's important that the lk-jwt-service can reach out to the SFU to create the room in advance. However, that's already the case as the config is currently defaulting to *

So as per the original comment until clients are upgraded to support the new mechanism, enough clients now support the new mechanism and enough time has passed since they gained support for it?

I See, it should be fine.

[jaywink]

Change ok. I am wondering however if this should be listed in the breaking changes section of the changelog? On the fence so not pushing for it.

[benbz]

Change ok. I am wondering however if this should be listed in the breaking changes section of the changelog? On the fence so not pushing for it.

I don't think it is particularly important, but let's do it just in case