sbbb/base/media/livekit-values.yaml

# Base LiveKit Helm values (chart: livekit/livekit-server).
# DOMAIN_SUFFIX is replaced by overlay patches.
# API keys/secrets come from the livekit-keys Secret (loaded via extraEnv or config file).
# Reference: https://github.com/livekit/livekit-helm/blob/master/server-sample.yaml

livekit:
  # LiveKit server config injected as config.yaml
  port: 7880
  log_level: info

  rtc:
    port_range_start: 49152
    port_range_end:   49252
    use_external_ip:  true

  turn:
    enabled:           true
    domain:            meet.DOMAIN_SUFFIX
    tls_port:          5349
    udp_port:          3478
    external_tls:      true
    relay_range_start: 13333
    relay_range_end:   23333

  redis:
    # Valkey is protocol-compatible with Redis; LiveKit sees this as a Redis endpoint
    address: valkey.data.svc.cluster.local:6379

  # API keys — loaded from K8s Secret managed by VSO (secret/livekit in OpenBao).
  # The keys.yaml field contains "devkey: <api-secret>" in YAML format.
  key_file: keys.yaml

storeKeysInSecret:
  enabled: true
  existingSecret: livekit-api-credentials

deployment:
  # hostNetwork gives LiveKit direct access to the host network namespace,
  # which is the only practical way to expose the 10k-port TURN relay range
  # (13333-23333) without listing individual hostPorts in the pod spec.
  hostNetwork: true
  resources:
    limits:
      memory: 128Mi
    requests:
      memory: 64Mi
      cpu: 100m

# Recreate strategy: hostPorts (TURN UDP relay range) block RollingUpdate —
# the new pod cannot schedule while the old one still holds the host ports.
deploymentStrategy:
  type: Recreate