studio/meet
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
849f8ac08ce6c77cc65b97441e4035a99528ebeb
meet/src/helm/env.d/dev-keycloak/values.meet.yaml.gotmpl

260 lines
8.5 KiB
Go Template
Raw Normal View History

🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
image:
repository: localhost:5001/meet-backend
pullPolicy: Always
tag: "latest"
backend:
replicas: 1
envVars:
DJANGO_CSRF_TRUSTED_ORIGINS: https://meet.127.0.0.1.nip.io,http://meet.127.0.0.1.nip.io
DJANGO_CONFIGURATION: Production
DJANGO_ALLOWED_HOSTS: meet.127.0.0.1.nip.io
DJANGO_SECRET_KEY: {{ .Values.djangoSecretKey }}
DJANGO_SETTINGS_MODULE: meet.settings
DJANGO_SILENCED_SYSTEM_CHECKS: security.W004, security.W008
DJANGO_SUPERUSER_PASSWORD: admin
DJANGO_EMAIL_HOST: "mailcatcher"
DJANGO_EMAIL_PORT: 1025
DJANGO_EMAIL_USE_SSL: False
✨(backend) add email notifications for screen recordings Implement backend method to send email notifications when screen recordings are ready for download. Enables users to be alerted when their recordings are available. Frontend implementation to follow in upcoming commits. This service is triggered by the storage hook from Minio. Add minimal unit test coverage for notification service, addressing previous lack of tests in this area. The notification service was responsible for calling the unstable summary service feature, which was developped way too quickly. The email template has been reviewed by a LLM, to make it user-friendly and crystal clear.
2025-04-14 18:48:50 +02:00
DJANGO_EMAIL_BRAND_NAME: "La Suite Numérique"
DJANGO_EMAIL_SUPPORT_EMAIL: "test@yopmail.com"
DJANGO_EMAIL_LOGO_IMG: https://meet.127.0.0.1.nip.io/assets/logo-suite-numerique.png
🩹(backend) fix email domain environment variable Value wasn't properly set to a domain, but to an URL. Fix it.
2025-04-15 15:54:49 +02:00
DJANGO_EMAIL_DOMAIN: meet.127.0.0.1.nip.io
✨(backend) introduce configuration for app base URL Add new application base URL configuration setting. While somewhat redundant with existing domain setting, these serve different purposes in the application. Base URL will be used for constructing complete URLs in notifications and external references.
2025-04-15 15:55:56 +02:00
DJANGO_EMAIL_APP_BASE_URL: https://meet.127.0.0.1.nip.io
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
OIDC_OP_JWKS_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/certs
OIDC_OP_AUTHORIZATION_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/auth
OIDC_OP_TOKEN_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/token
OIDC_OP_USER_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/userinfo
🐛(frontend) correct Keycloak logout endpoint in tilt stack Replace invalid session/end endpoint with correct logout endpoint in Keycloak configuration. Fixes broken logout functionality that prevented developers from properly signing out of the application during development.
2025-02-26 18:46:08 +01:00
OIDC_OP_LOGOUT_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/logout
🔧(helm) offer a standalone dev environment Offer a standalone dev environment or a dinum specific dev environment with ProConnect authentication. Needed to refactor the way secrets are managed in the project, and also re-organize the Helm chart to make it totally standalone. Particulary useful for external wanting to run the project. Work done by @rouja.
2024-12-20 14:07:01 +01:00
OIDC_RP_CLIENT_ID: meet
OIDC_RP_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
OIDC_RP_SIGN_ALGO: RS256
OIDC_RP_SCOPES: "openid email"
OIDC_REDIRECT_ALLOWED_HOSTS: https://meet.127.0.0.1.nip.io
OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
LOGIN_REDIRECT_URL: https://meet.127.0.0.1.nip.io
LOGIN_REDIRECT_URL_FAILURE: https://meet.127.0.0.1.nip.io
LOGOUT_REDIRECT_URL: https://meet.127.0.0.1.nip.io
♻️(tilt) remove bitnami dependencies from dev stack Remove dependencies on bitnami Helm charts since recent changes in bitnami organization led to charts no longer being maintained or published. Enhanced the Tilt dependencies to avoid any bootstrap or refresh errors while developping using the Tilt stack. Making components dependant from each others increase slightly the time required to spin up the stack the first time.
2025-08-01 18:04:56 +02:00
DB_HOST: postgres
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
DB_NAME: meet
DB_USER: dinum
DB_PASSWORD: pass
DB_PORT: 5432
REDIS_URL: redis://default:pass@redis-master:6379/1
STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
{{- with .Values.livekit.keys }}
{{- range $key, $value := . }}
LIVEKIT_API_SECRET: {{ $value }}
LIVEKIT_API_KEY: {{ $key }}
{{- end }}
{{- end }}
LIVEKIT_API_URL: https://livekit.127.0.0.1.nip.io/
🩹(backend) allow enforcing WSS protocol to resolve browser compatibility The LiveKit API URL is necessary to interact with the API. It uses https protocol. Eplicit wss protocol is necessary in Websocket constructor for some older browsers. This resolves critical compatibility issues with legacy browsers (notably Firefox <124, Chrome <125, Edge <125) that lack support for HTTPS URLs in the WebSocket() constructor. Without explicit WSS URLs, WebSocket signaling connections may fail, crash, or be blocked entirely in these environments. The setting is optional and defaults to the current behavior when not specified, ensuring zero breaking changes for existing deployments.
2025-08-01 13:21:16 +02:00
LIVEKIT_FORCE_WSS_PROTOCOL: True
🩹(frontend) fix connection warmup with WebSocket pre-authentication Connection warmup wasn't working properly - only works when trying to establish WebSocket first, then workaround kicks in. Call WebSocket endpoint without auth info expecting 401 error, but enough to initiate cache for subsequent WebSocket functionality. Scope this **dirty** trick to Firefox users only. Haven't figured out how to detect proxy from JS code simply. Tested in staging and works on our constrained WiFi.
2025-07-24 15:52:34 +02:00
LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND: True
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
ALLOW_UNREGISTERED_ROOMS: False
FRONTEND_SILENCE_LIVEKIT_DEBUG: False
🌐(frontend) remove hardcoded DINUM-specific URLs from support forms Replace instance-specific URLs with configurable values to make the application more generic and reusable for other deployments.
2025-06-02 22:16:24 +02:00
FRONTEND_SUPPORT: "{'id': '58ea6697-8eba-4492-bc59-ad6562585041', 'help_article_transcript': 'https://lasuite.crisp.help/fr/article/visio-transcript-1sjq43x', 'help_article_recording': 'https://lasuite.crisp.help/fr/article/visio-enregistrement-wgc8o0', 'help_article_more_tools': 'https://lasuite.crisp.help/fr/article/visio-tools-bvxj23'}"
FRONTEND_TRANSCRIPT: "{'form_beta_users': 'https://grist.numerique.gouv.fr/o/docs/forms/3fFfvJoTBEQ6ZiMi8zsQwX/17'}"
🔧(frontend) make feedback form configurable via backend settings Implement conditional rendering that hides all feedback-related UI components when feedback is disabled in backend configuration. Also, feedback URL is now customizable.
2025-04-28 16:48:26 +02:00
FRONTEND_FEEDBACK: "{'url': 'https://grist.numerique.gouv.fr/o/docs/cbMv4G7pLY3Z/USER-RESEARCH-or-LA-SUITE/f/26'}"
🔧(frontend) make web app manifest optional Add configuration to conditionally include manifest article, allowing deployments to customize or disable MoreLink component.
2025-06-06 22:52:23 +02:00
FRONTEND_MANIFEST_LINK: "https://docs.numerique.gouv.fr/docs/1ef86abf-f7e0-46ce-b6c7-8be8b8af4c3d/"
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: meet
AWS_S3_SECRET_ACCESS_KEY: password
AWS_STORAGE_BUCKET_NAME: meet-media-storage
AWS_S3_REGION_NAME: local
RECORDING_ENABLE: True
RECORDING_STORAGE_EVENT_ENABLE: True
RECORDING_STORAGE_EVENT_TOKEN: password
SUMMARY_SERVICE_ENDPOINT: http://meet-summary:80/api/v1/tasks/
SUMMARY_SERVICE_API_TOKEN: password
✨(backend) add email notifications for screen recordings Implement backend method to send email notifications when screen recordings are ready for download. Enables users to be alerted when their recordings are available. Frontend implementation to follow in upcoming commits. This service is triggered by the storage hook from Minio. Add minimal unit test coverage for notification service, addressing previous lack of tests in this area. The notification service was responsible for calling the unstable summary service feature, which was developped way too quickly. The email template has been reviewed by a LLM, to make it user-friendly and crystal clear.
2025-04-14 18:48:50 +02:00
SCREEN_RECORDING_BASE_URL: https://meet.127.0.0.1.nip.io/recordings
✨(backend) add 10-digit PIN codes on rooms for telephony Enable users to join rooms via SIP telephony by: - Dialing the SIP trunk number - Entering the room's PIN followed by '#' The PIN code needs to be generated before the LiveKit room is created, allowing the owner to send invites to participants in advance. With 10-digit PINs (10^10 combinations) and a large number of rooms (e.g., 1M), collisions become statistically inevitable. A retry mechanism helps reduce the chance of repeated collisions but doesn't eliminate the overall risk. With 100K generated PINs, the probability of at least one collision exceeds 39%, due to the birthday paradox. To scale safely, we’ll later propose using multiple trunks. Each trunk will handle a separate PIN namespace, and the combination of trunk_id and PIN will ensure uniqueness. Room assignment will be evenly distributed across trunks to balance load and minimize collisions. Following XP principles, we’ll ship the simplest working version of this feature. The goal is to deliver value quickly without over-engineering. We’re not solving scaling challenges we don’t currently face. Our production load is around 10,000 rooms — well within safe limits for the initial implementation. Discussion points: - The `while` loop should be reviewed. Should we add rate limiting for failed attempts? - A systematic existence check before `INSERT` is more costly for a rare event and doesn't prevent race conditions, whereas retrying on integrity errors is more efficient overall. - Should we add logging or monitoring to track and analyze collisions? I tried to balance performance and simplicity while ensuring the robustness of the PIN generation process.
2025-05-13 10:41:47 +02:00
ROOM_TELEPHONY_ENABLED: True
🔧(tilt) configure telephony in tilt stack for development Add default telephony configuration to the tilt stack to enable development workflow around authentication features. Note: This is a fake/mock configuration and is not functional for production use. It's intended solely for development purposes.
2025-08-05 10:33:51 +02:00
ROOM_TELEPHONY_DEFAULT_COUNTRY: 'FR'
ROOM_TELEPHONY_PHONE_NUMBER: '+33901020304'
⬆️(docker) upgrade backend image to python 3.13 Python 3.13 is now stable, our libraries are compatible with it. We also upgrade the alpine version and node one used in the backend.
2025-06-23 14:28:54 +02:00
SSL_CERT_FILE: /usr/local/lib/python3.13/site-packages/certifi/cacert.pem
✨(backend) add start-subtitle endpoint Allow any user, anonymous or authenticated, to start subtitling in a room only if they are an active participant of it. Subtitling a room consists of starting the multi-user transcriber agent. This agent forwards all participants' audio to an STT server and returns transcription segments for any active voice to the room. User roles in the backend room system cannot be used to determine subtitle permissions. The transcriber agent can be triggered multiple times but will only join a room once. Unicity is managed by the agent itself. Any user with a valid LiveKit token can initiate subtitles. Feature flag logic is implemented on the frontend. The frontend ensures the "start subtitle" action is only available to users who should see it. The backend does not enforce feature flags in this version. Authentication in our system does not imply access to a room. The only valid proof of access is the LiveKit API token issued by the backend. Security consideration: A LiveKit API token is valid for 6 hours and cannot be revoked at the end of a meeting. It is important to verify that the token was issued for the correct room. Calls to the agent dispatch endpoint must be server-initiated. The backend proxies these calls, as clients cannot securely contact the agent dispatch endpoint directly (per LiveKit documentation). Room ID is passed as a query parameter. There is currently no validation ensuring that the room exists prior to agent dispatch. TODO: implement validation or error handling for non-existent rooms. The backend does not forward LiveKit tokens to the agent. Default API rate limiting is applied to prevent abuse.
2025-08-19 15:29:19 +02:00
ROOM_SUBTITLE_ENABLED: True
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
migrate:
command:
- "/bin/sh"
- "-c"
- |
🔥(backend) remove demo data generation from tilt migration job Remove call to generate demo data in tilt stack as it was never useful to developers and only complicated the migration job unnecessarily. Migration job should be laser focused on applying database migrations rather than seeding mock data, improving clarity and reducing complexity.
2025-08-25 17:02:07 +02:00
python manage.py migrate --no-input
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
restartPolicy: Never
command:
- "gunicorn"
- "-c"
- "/usr/local/etc/gunicorn/meet.py"
- "meet.wsgi:application"
- "--reload"
createsuperuser:
command:
- "/bin/sh"
- "-c"
- |
python manage.py createsuperuser --email admin@example.com --password admin
restartPolicy: Never
✨(tilt) add missing certificate authority for Python Avoid disabling SSL verification in development environment, simply mount in the right folder, an extra volume, that declares the certificate authority necessary to validate nip.io domains.
2025-01-13 17:19:28 +01:00
# Extra volume mounts to manage our local custom CA and avoid to set ssl_verify: false
extraVolumeMounts:
- name: certs
⬆️(docker) upgrade backend image to python 3.13 Python 3.13 is now stable, our libraries are compatible with it. We also upgrade the alpine version and node one used in the backend.
2025-06-23 14:28:54 +02:00
mountPath: /usr/local/lib/python3.13/site-packages/certifi/cacert.pem
✨(tilt) add missing certificate authority for Python Avoid disabling SSL verification in development environment, simply mount in the right folder, an extra volume, that declares the certificate authority necessary to validate nip.io domains.
2025-01-13 17:19:28 +01:00
subPath: cacert.pem
# Extra volumes to manage our local custom CA and avoid to set ssl_verify: false
extraVolumes:
- name: certs
configMap:
name: certifi
items:
- key: cacert.pem
path: cacert.pem
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
frontend:
envVars:
🔧(frontend) make app title customizable with env variable override Replace default "visio" with "LaSuite Meet" and allow env variable customization. Default Docker image uses "LaSuite Meet", but deployments can override with custom values by setting env vars and rebuilding.
2025-06-06 21:57:57 +02:00
VITE_APP_TITLE: "LaSuite Meet"
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
VITE_PORT: 8080
VITE_HOST: 0.0.0.0
VITE_API_BASE_URL: https://meet.127.0.0.1.nip.io/
replicas: 1
image:
✨(tilt) add Tilt environment for testing DINUM frontend image Introduce new development environment to test custom DINUM image locally and validate white-label customizations.
2025-06-26 19:17:25 +02:00
repository: localhost:5001/meet-frontend-generic
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
pullPolicy: Always
tag: "latest"
ingress:
enabled: true
host: meet.127.0.0.1.nip.io
ingressAdmin:
enabled: true
host: meet.127.0.0.1.nip.io
posthog:
ingress:
enabled: false
🔧(helm) offer a standalone dev environment Offer a standalone dev environment or a dinum specific dev environment with ProConnect authentication. Needed to refactor the way secrets are managed in the project, and also re-organize the Helm chart to make it totally standalone. Particulary useful for external wanting to run the project. Work done by @rouja.
2024-12-20 14:07:01 +01:00
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
ingressAssets:
enabled: false
summary:
replicas: 1
envVars:
APP_NAME: summary-microservice
APP_API_TOKEN: password
AWS_STORAGE_BUCKET_NAME: meet-media-storage
AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: meet
AWS_S3_SECRET_ACCESS_KEY: password
AWS_S3_SECURE_ACCESS: False
🔧(backend) rename OpenAI settings to WhisperX to avoid confusion Rename incorrectly named OpenAI configuration settings since they're used to instantiate WhisperX client which is not OpenAI compatible, preventing confusion about actual service dependencies.
2025-09-09 18:21:22 +02:00
WHISPERX_API_KEY: your-secret-value
WHISPERX_BASE_URL: https://configure-your-url.com
WHISPERX_ASR_MODEL: large-v2
✨(summary) introduce summary logic for meeting transcripts Implement summarization functionality that processes completed meeting transcripts to generate concise summaries. First draft base on a simple recursive agentic scenario. Observability and evaluation will be added in the next PRs.
2025-09-09 22:16:21 +02:00
LLM_BASE_URL: https://configure-your-url.com
LLM_API_KEY: your-secret-value
LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
WEBHOOK_API_TOKEN: password
WEBHOOK_URL: https://www.mock-impress.com/webhook/
CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
📈(summary) kickstart analytics tracking in summary microservice Add product analytics to understand summary feature usage and behavior. Track transcript and task metadata for insights without exposing sensitive content or speaker data. Hacky but functional PostHog usage - fully optional for self-hosting. Extensive tracking approach works for current needs despite not being PostHog's typical use case.
2025-07-08 23:13:04 +02:00
TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
🔧(helm) offer a standalone dev environment Offer a standalone dev environment or a dinum specific dev environment with ProConnect authentication. Needed to refactor the way secrets are managed in the project, and also re-organize the Helm chart to make it totally standalone. Particulary useful for external wanting to run the project. Work done by @rouja.
2024-12-20 14:07:01 +01:00
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
image:
repository: localhost:5001/meet-summary
pullPolicy: Always
tag: "latest"
🔧(helm) offer a standalone dev environment Offer a standalone dev environment or a dinum specific dev environment with ProConnect authentication. Needed to refactor the way secrets are managed in the project, and also re-organize the Helm chart to make it totally standalone. Particulary useful for external wanting to run the project. Work done by @rouja.
2024-12-20 14:07:01 +01:00
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
command:
- "uvicorn"
- "summary.main:app"
- "--host"
- "0.0.0.0"
- "--port"
- "8000"
- "--reload"
celery:
replicas: 1
envVars:
APP_NAME: summary-microservice
APP_API_TOKEN: password
AWS_STORAGE_BUCKET_NAME: meet-media-storage
AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
AWS_S3_ACCESS_KEY_ID: meet
AWS_S3_SECRET_ACCESS_KEY: password
AWS_S3_SECURE_ACCESS: False
🔧(backend) rename OpenAI settings to WhisperX to avoid confusion Rename incorrectly named OpenAI configuration settings since they're used to instantiate WhisperX client which is not OpenAI compatible, preventing confusion about actual service dependencies.
2025-09-09 18:21:22 +02:00
WHISPERX_API_KEY: your-secret-value
WHISPERX_BASE_URL: https://configure-your-url.com
WHISPERX_ASR_MODEL: large-v2
✨(summary) introduce summary logic for meeting transcripts Implement summarization functionality that processes completed meeting transcripts to generate concise summaries. First draft base on a simple recursive agentic scenario. Observability and evaluation will be added in the next PRs.
2025-09-09 22:16:21 +02:00
LLM_BASE_URL: https://configure-your-url.com
LLM_API_KEY: your-secret-value
LLM_MODEL: meta-llama/Llama-3.1-8B-Instruct
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
WEBHOOK_API_TOKEN: password
WEBHOOK_URL: https://www.mock-impress.com/webhook/
CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
📈(summary) kickstart analytics tracking in summary microservice Add product analytics to understand summary feature usage and behavior. Track transcript and task metadata for insights without exposing sensitive content or speaker data. Hacky but functional PostHog usage - fully optional for self-hosting. Extensive tracking approach works for current needs despite not being PostHog's typical use case.
2025-07-08 23:13:04 +02:00
TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
🔧(helm) offer a standalone dev environment Offer a standalone dev environment or a dinum specific dev environment with ProConnect authentication. Needed to refactor the way secrets are managed in the project, and also re-organize the Helm chart to make it totally standalone. Particulary useful for external wanting to run the project. Work done by @rouja.
2024-12-20 14:07:01 +01:00
🔨(tilt) improve local stack Improve the local tilt file in order to be abble to start all thing without any dependencies to DINUM environment
2024-12-06 12:18:51 +01:00
image:
repository: localhost:5001/meet-summary
pullPolicy: Always
tag: "latest"
command:
- "celery"
- "-A"
- "summary.core.celery_worker"
- "worker"
- "--pool=solo"
- "--loglevel=info"
✨(backend) add authenticated recording file access method Implement secure recording file access through authentication instead of exposing S3 bucket or using temporary signed links with loose permissions. Inspired by docs and @spaccoud's implementation, with comprehensive viewset checks to prevent unauthorized recording downloads. The ingress reserved to media intercept the original request, and thanks to Nginx annotations, check with the backend if the user is allowed to donwload this recording file. This might introduce a dependency to Nginx in the project by the way. Note: Tests are integration-based rather than unit tests, requiring minio in the compose stack and CI environment. Implementation includes known botocore deprecation warnings that per GitHub issues won't be resolved for months.
2025-04-14 16:41:49 +02:00
🧱(backend) add Helm chart for LiveKit agent deployment Create basic Helm chart for LiveKit agent framework deployment on Kubernetes, inspired by meet-summary FastAPI server configuration. Integrate chart into local tilt development stack and properly handle certificate issues that typically occur when calling LiveKit server with nip.io domain names.
2025-06-20 18:17:28 +02:00
agents:
replicas: 1
envVars:
LIVEKIT_URL: https://livekit.127.0.0.1.nip.io/
{{- with .Values.livekit.keys }}
{{- range $key, $value := . }}
LIVEKIT_API_SECRET: {{ $value }}
LIVEKIT_API_KEY: {{ $key }}
{{- end }}
{{- end }}
image:
repository: localhost:5001/meet-agents
pullPolicy: Always
tag: "latest"
# Extra volume mounts to manage our local custom CA and avoid to disable ssl
extraVolumeMounts:
- name: certs
mountPath: /usr/lib/ssl/cert.pem
subPath: cert.pem
# Extra volumes to manage our local custom CA and avoid to disable ssl
extraVolumes:
- name: certs
configMap:
name: certifi
items:
- key: cacert.pem
path: cert.pem
✨(backend) add authenticated recording file access method Implement secure recording file access through authentication instead of exposing S3 bucket or using temporary signed links with loose permissions. Inspired by docs and @spaccoud's implementation, with comprehensive viewset checks to prevent unauthorized recording downloads. The ingress reserved to media intercept the original request, and thanks to Nginx annotations, check with the backend if the user is allowed to donwload this recording file. This might introduce a dependency to Nginx in the project by the way. Note: Tests are integration-based rather than unit tests, requiring minio in the compose stack and CI environment. Implementation includes known botocore deprecation warnings that per GitHub issues won't be resolved for months.
2025-04-14 16:41:49 +02:00
ingressMedia:
enabled: true
host: meet.127.0.0.1.nip.io
annotations:
nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1
serviceMedia:
host: minio.meet.svc.cluster.local
port: 9000
Reference in New Issue Copy Permalink