Stable endpoints and deprecations
MSC4195 finally landed. 🎉 As a result, this release adds support for the stable Client-Server endpoints as per the merged version of the MSC. The unstable Client-Server endpoints and the legacy standalone endpoints remain supported in addition.
Caution
Serving the Client-Server endpoints as per the MSC requires setting up lk-jwt-service as an application service on the homeserver. Since the MSC has been accepted, not running as an application service is deprecated as of this release and support for it will be removed in future versions. Details on how to configure the application service can be found in README.md.
For the same reason, fronting more than one homeserver via LIVEKIT_FULL_ACCESS_HOMESERVERS is deprecated as well and will be removed in future versions. This setting already only affects the legacy endpoints. For security reasons it is strongly recommended to only put the one homeserver that lk-jwt-service was set up as an application service for into LIVEKIT_FULL_ACCESS_HOMESERVERS.
A last-minute change in the MSC was to RECOMMEND granting publishing permissions to remote users. This acts as a fallback and allows users to join sessions even if their own homeserver doesn't provide an SFU. Server operators can granularly control whether to allow remote publishing with the new LIVEKIT_REMOTE_CAN_PUBLISH_HOMESERVERS environment variable.
A related change in the final MSC was to RECOMMEND disabling the permission to update one's own metadata for participants. The service now disables this permission by default on tokens. Admins that rely on this feature, may reenable the permission with the new LIVEKIT_CAN_UPDATE_OWN_METADATA environment variable.
MSC4196 also landed and to support the transition to its stable identifiers, the service now maps m.call#ROOM slot IDs to m.call#room. This means clients will end up in the same LiveKit room regardless of which spelling they used.
Finally, lk-jwt-service is now able to bind to a Unix socket via the LIVEKIT_JWT_BIND environment variable. Thanks to GitHub user @cyberb for contributing this feature.
Docker image
The service is available as a Docker image from the GitHub Container Registry.
docker pull ghcr.io/element-hq/lk-jwt-service:0.10.0
Precompiled binaries
The service is available as static precompiled binaries for amd64 and arm64 on linux attached to this release below.
What's Changed
- Allow remote users to publish by default and enable admins to narrow the permission via LIVEKIT_REMOTE_CAN_PUBLISH_HOMESERVERS by @Johennes in #251
- Update all non-major dependencies by @renovate[bot] in #254
- Update Rust crate jsonwebtoken to v11 by @renovate[bot] in #255
- Add env var for controlling canUpdateOwnMetadata and canPublishData by @Johennes in #247 (note: this is modified again below by #257)
- Add stable endpoints now that MSC4195 has been merged by @Johennes in #253
- Listen on a unix socket when LIVEKIT_JWT_BIND is a path by @cyberb in #256
- Remove LIVEKIT_CAN_PUBLISH_DATA and make canPublishData always follow canPublish by @Johennes in #257
- Make it explicit why we set can_publish_data by @Johennes in #259
- Do not log the OpenID token by @Johennes in #260
- Map between m.call#ROOM and m.call#room by @Johennes in #258
- Announce deprecations in the README by @Johennes in #261
New Contributors
Full Changelog: v0.9.0...v0.10.0