meet.nix

{ config, ... }:
let
  domain = "meet.example.org";
  meetBase = "https://${domain}";
  oidcBase = "https://keycloak.example.org/realms/myrealm/protocol/openid-connect";
in
{
  services.lasuite-meet = {
    inherit domain;
    enable = true;
    enableNginx = true;
    redis.createLocally = true;
    postgresql.createLocally = true;
    environmentFile = config.age.secrets.meet-secrets.path;
    settings = {
      LIVEKIT_API_URL = "${meetBase}/livekit";
      LIVEKIT_API_KEY = "meet";
      ALLOW_UNREGISTERED_ROOMS = false;

      OIDC_OP_JWKS_ENDPOINT = "${oidcBase}/certs";
      OIDC_OP_AUTHORIZATION_ENDPOINT = "${oidcBase}/auth";
      OIDC_OP_TOKEN_ENDPOINT = "${oidcBase}/token";
      OIDC_OP_USER_ENDPOINT = "${oidcBase}/userinfo";
      OIDC_OP_LOGOUT_ENDPOINT = "${oidcBase}/logout";
      OIDC_RP_CLIENT_ID = "lasuite-meet";
      OIDC_RP_SIGN_ALGO = "RS256";
      OIDC_RP_SCOPES = "openid email";
      OIDC_USE_PKCE = true;
      OIDC_REDIRECT_REQUIRE_HTTPS = true;
      OIDC_REDIRECT_ALLOWED_HOSTS = builtins.toJSON [ meetBase ];
      OIDC_USERINFO_FULLNAME_FIELDS = builtins.toJSON [
        "given_name"
        "family_name"
      ];

      LOGIN_REDIRECT_URL = meetBase;
      LOGIN_REDIRECT_URL_FAILURE = meetBase;
      LOGOUT_REDIRECT_URL = meetBase;
    };
    livekit = {
      enable = true;
      keyFile = config.age.secrets.livekit-keys.path;
      settings = {
        port = 7880;
        rtc = {
          tcp_port = 7881;
          udp_port = 7882;
        };
      };
    };
  };

  networking.firewall = {
    allowedTCPPorts = [ 7881 ];
    allowedUDPPorts = [ 7882 ];
  };

  services.nginx.virtualHosts.${domain} = {
    enableACME = true;
    forceSSL = true;
  };
}