chore(issues): close 0167+0168+0169+0170 livekit hardening bundle

VPS commit: 8eef89b (egutierrez/element_matrix_chat)

- 0167: STUN leak fixed (use_external_ip:false + node_ip hardcoded)
- 0168: UDP range expanded 50000-50200 -> 50000-50500
- 0169: API secret rotated (old key LK44e009c6e92b -> new LK5f6b38bb)
- 0170: livekit.example.yaml refreshed + header comments cleaned

Verification:
- 0 STUN packets to Google during restart (tcpdump 60s window)
- Endpoint /livekit/sfu/ HTTP 200
- LiveKit logs: nodeIP=135.125.201.30, portICERange=[50000,50500]
- Containers livekit + livekit-jwt healthy

New secret stored in pass: matrix/livekit-secret-rotation-2026-05-25

dev/issues/completed/0167-matrix-livekit-stun-leak.md

@@ -0,0 +1,62 @@
+---
+id: "0167"
+title: "Eliminar STUN leak a Google en LiveKit (hardcode external_ip)"
+status: pendiente
+type: infra
+domain:
+  - matrix
+scope: app:element_matrix_chat
+priority: baja
+depends: []
+blocks: []
+related: ["0166"]
+created: 2026-05-24
+updated: 2026-05-24
+tags: [matrix, livekit, privacy, stun]
+---
+# 0167 — Eliminar STUN leak a Google en LiveKit (hardcode external_ip)
+
+**Status:** pendiente
+**Created:** 2026-05-24
+**Type:** infra
+**Priority:** baja
+**Domain:** matrix
+**Scope:** app:element_matrix_chat
+**Depends:** —
+**Blocks:** —
+
+## Problema
+
+`rtc.use_external_ip: true` con `external_ip` vacio → LiveKit hace STUN query a `stun.l.google.com:19302` cada arranque para descubrir IP publica. Leak metadata server (IP del VPS) a Google. Contradice premisa "self-host privacy first".
+
+## Objetivo
+
+LiveKit conoce su IP publica sin contactar STUN externos.
+
+## Plan
+
+1. Determinar IP publica VPS: `curl -s ifconfig.me`.
+2. Editar `configs/livekit/livekit.yaml`:
+   ```yaml
+   rtc:
+     use_external_ip: false
+     node_ip: "<IP_PUBLICA>"
+   ```
+3. Si TURN propio desplegado (issue 0166), usar coturn como STUN propio.
+4. Restart `element_matrix_chat-livekit-1`.
+5. Test: call funciona igual.
+6. Auditar: `docker logs element_matrix_chat-livekit-1 | grep -i stun` no muestra queries a google.
+
+## Acceptance
+
+- [ ] `tcpdump -i eth0 dst stun.l.google.com` no captura paquetes tras restart.
+- [ ] Calls Element Call siguen funcionando 1:1 y grupo.
+
+## Definition of Done
+
+- [ ] Repetibilidad: reboot VPS, 0 paquetes a stun.l.google.com.
+- [ ] Observabilidad: log LiveKit confirma IP hardcoded.
+
+## Notas
+
+Bajo impacto operacional pero alta consistencia con doctrina self-host. Si IP del VPS cambia (rara vez con VPS estatico), actualizar config manual o automatizar con script de healthcheck.