egutierrez
00c7fc728e
VPS commit: 8eef89b (egutierrez/element_matrix_chat) - 0167: STUN leak fixed (use_external_ip:false + node_ip hardcoded) - 0168: UDP range expanded 50000-50200 -> 50000-50500 - 0169: API secret rotated (old key LK44e009c6e92b -> new LK5f6b38bb) - 0170: livekit.example.yaml refreshed + header comments cleaned Verification: - 0 STUN packets to Google during restart (tcpdump 60s window) - Endpoint /livekit/sfu/ HTTP 200 - LiveKit logs: nodeIP=135.125.201.30, portICERange=[50000,50500] - Containers livekit + livekit-jwt healthy New secret stored in pass: matrix/livekit-secret-rotation-2026-05-25
63 lines
1.8 KiB
Markdown
63 lines
1.8 KiB
Markdown
---
|
|
id: "0167"
|
|
title: "Eliminar STUN leak a Google en LiveKit (hardcode external_ip)"
|
|
status: pendiente
|
|
type: infra
|
|
domain:
|
|
- matrix
|
|
scope: app:element_matrix_chat
|
|
priority: baja
|
|
depends: []
|
|
blocks: []
|
|
related: ["0166"]
|
|
created: 2026-05-24
|
|
updated: 2026-05-24
|
|
tags: [matrix, livekit, privacy, stun]
|
|
---
|
|
# 0167 — Eliminar STUN leak a Google en LiveKit (hardcode external_ip)
|
|
|
|
**Status:** pendiente
|
|
**Created:** 2026-05-24
|
|
**Type:** infra
|
|
**Priority:** baja
|
|
**Domain:** matrix
|
|
**Scope:** app:element_matrix_chat
|
|
**Depends:** —
|
|
**Blocks:** —
|
|
|
|
## Problema
|
|
|
|
`rtc.use_external_ip: true` con `external_ip` vacio → LiveKit hace STUN query a `stun.l.google.com:19302` cada arranque para descubrir IP publica. Leak metadata server (IP del VPS) a Google. Contradice premisa "self-host privacy first".
|
|
|
|
## Objetivo
|
|
|
|
LiveKit conoce su IP publica sin contactar STUN externos.
|
|
|
|
## Plan
|
|
|
|
1. Determinar IP publica VPS: `curl -s ifconfig.me`.
|
|
2. Editar `configs/livekit/livekit.yaml`:
|
|
```yaml
|
|
rtc:
|
|
use_external_ip: false
|
|
node_ip: "<IP_PUBLICA>"
|
|
```
|
|
3. Si TURN propio desplegado (issue 0166), usar coturn como STUN propio.
|
|
4. Restart `element_matrix_chat-livekit-1`.
|
|
5. Test: call funciona igual.
|
|
6. Auditar: `docker logs element_matrix_chat-livekit-1 | grep -i stun` no muestra queries a google.
|
|
|
|
## Acceptance
|
|
|
|
- [ ] `tcpdump -i eth0 dst stun.l.google.com` no captura paquetes tras restart.
|
|
- [ ] Calls Element Call siguen funcionando 1:1 y grupo.
|
|
|
|
## Definition of Done
|
|
|
|
- [ ] Repetibilidad: reboot VPS, 0 paquetes a stun.l.google.com.
|
|
- [ ] Observabilidad: log LiveKit confirma IP hardcoded.
|
|
|
|
## Notas
|
|
|
|
Bajo impacto operacional pero alta consistencia con doctrina self-host. Si IP del VPS cambia (rara vez con VPS estatico), actualizar config manual o automatizar con script de healthcheck.
|