WebRTC SFU of the realtime voice agents: signalling over WebSocket, media over UDP on a fixed port range, no TURN (bank network), Redis for the distributed mode.
Generated from catalog/services/livekit.yaml: do not edit by hand.
Summary
| |
|---|
| Version | 1.13.11 |
| Use | install and configure, configure and connect |
| Layer | functional (AI catalog) |
| Category | AI serving |
| Installation methods | binary, podman |
| External connection | no |
| Sandbox only | no |
Licence
| |
|---|
| SPDX identifier | Apache-2.0 |
| Licence policy | core licence (MIT or Apache-2.0) |
| Licence exception | - |
| Platform component | livekit |
Packages and artifacts
A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.
Images are pinned by tag in the descriptor, and by digest when the descriptor declares one (the offline bundle then refuses a pulled image that does not carry it); the digest is recorded in the mirror of the Manager when the offline bundle is imported, and every pull or load is checked against it.
Supported systems and architectures
| Method | Operating systems | Architectures |
|---|
binary | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64 (architecture of the artifacts of the descriptor) |
podman | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64, aarch64 (not restricted by the descriptor) |
Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.
Prerequisites
Host
- at least 4 CPU (warning,
cpu).
Network and ports
| Component | Port name | Port | Opened in the host firewall |
|---|
livekit-server | signal | 7880/tcp | yes |
livekit-server | media | 50000-50100/udp | yes |
livekit-server | metrics | 6789/tcp | yes |
Kernel parameters
| Parameter | Value |
|---|
net.core.rmem_max | 5000000 |
net.core.wmem_max | 5000000 |
Services and connections needed
Details and resolution: see Dependencies.
Installation methods and modes
| Method | Default | What the method uses |
|---|
binary | yes | the binary archives of the descriptor, unpacked under the service directory |
podman | - | the container images of the descriptor, run by Podman under systemd |
Components
| Component | Kind | Installation methods | Ports |
|---|
LiveKit server (livekit-server) | master | binary, podman | 7880/tcp, 50000-50100/udp, 6789/tcp |
Single node (single) (default)
One media server, local room state.
What the mode deploys:
| Component | Placement |
|---|
livekit-server | min 1, max 1 |
Distributed (distributed)
Several media servers routing rooms through Redis.
What the mode deploys:
| Component | Placement |
|---|
livekit-server | min 2, recommended 3 |
Install this service
The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.
-
Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.
-
Choose the service. On the Service step, select LiveKit server. The card shows the licence Apache-2.0 and the dependencies the installation needs. Pick the Method among binary, podman (default binary).
-
Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode: single (default), distributed. Each mode deploys the components listed in Installation methods and modes.
-
Bind the dependencies. On the Bindings step, choose for each dependency (redis, redis) Install with the platform or Use an existing connection; an optional dependency can stay on No binding.
-
Configure. On the Configure step, review the parameters (see Configuration parameters). Passwords left empty with a generated default are generated and sealed by the Manager.
-
Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.
-
Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services.
Connect an existing service
| |
|---|
| Schemes | https, http |
| Default port | 7880 |
| Authentication | required |
| Health check | / |
| Authentication method | Fields | Description |
|---|
api_key_secret | api_key, api_secret | API key and secret of the keys section; the Manager signs a short JWT (roomList) to check them. |
Official documentation: https://docs.livekit.io/reference/other/roomservice-api/
High availability
| |
|---|
| Cluster | native (native) |
| High availability | external (external) |
| Failover | client side (client) |
| Replication | shared store (shared-store) |
| Quorum | none (none) |
| Discovery | registry (registry) |
| Entry point | load balancer (load-balancer) |
| Official documentation | https://docs.livekit.io/transport/self-hosting/distributed/ |
| Peer TLS parameter | tls_enabled |
Prerequisites
| Prerequisite | Must be highly available | Modes | Description |
|---|
redis | yes | distributed | Highly available Redis holding the node registry and the room routing. |
Topology per mode
| Modes | Highest catalog level | Distribution | Quorum component | Fault domains | Description |
|---|
single | standalone (standalone) | single (single) | - | 1 | One media server, local room state. |
distributed | cluster (cluster) | active-active (active-active) | - | 2 | Several media servers registering in Redis, which routes each room to one node. |
Notes
- A room lives on a single node: the abrupt loss of that node cuts the session in progress, the clients reconnect and the room restarts on another node.
Configuration parameters
Network
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Signalling port (port) | port | 7880 | - | no | no | yes | WebSocket and HTTP API port. |
First media port (udp_port_start) | port | 50000 | - | no | no | yes | Start of the UDP media range. |
Last media port (udp_port_end) | port | 50100 | - | no | no | yes | End of the UDP media range (keep the firewall rule in line). |
Metrics port (metrics_port) | port | 6789 | - | no | no | no | Prometheus port. |
TLS at the proxy (tls_enabled) | bool | false | - | no | no | no | Clients use wss:// (TLS terminated by the load balancer in front of the signalling port). |
Security
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
API key (api_key) | string | navin | - | no | no | no | Key name of the API key pair (EAI_LIVEKIT_API_KEY). |
API secret (api_secret) | password | generated | - | no | yes | no | Secret of the API key pair (EAI_LIVEKIT_API_SECRET), at least 32 characters. |
Redis ACL user (redis_username) | string | (empty) | - | no | no | no | ACL user of LiveKit in Redis; empty: the user of the redis binding (the redis service of the catalog only has its default user). |
Integrations
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|
Redis message bus (redis_bus) | bool | false | - | no | no | yes | Put the single node on Redis (redis binding): LiveKit SIP, Egress and Ingress only talk to LiveKit Server through Redis, so telephony and recordings need it. The distributed mode always uses Redis. (single) |
Webhook URLs (webhook_urls) | list | [] | - | no | no | yes | Receivers of the room, participant, track, egress and ingress events, for example the LiveKit webhook route of Navin Enterprise; each request is signed with the API key pair (Authorization header, JWT with the sha256 of the body). |
Ingress RTMP base URL (ingress_rtmp_base_url) | string | (empty) | - | no | no | no | Prefix of the RTMP URLs that CreateIngress returns (livekit-ingress service, optional, not used by the telephony); empty: none. |
Ingress WHIP base URL (ingress_whip_base_url) | string | (empty) | - | no | no | no | Prefix of the WHIP URLs that CreateIngress returns; empty: none. |
Dependencies
For each active dependency the Manager takes the first of: the binding chosen in the wizard; a service of the same installation that provides it; a service already installed in the cluster; the only connection of the expected type. Otherwise an optional dependency stays unbound, and a required one is added to the installation in its default mode (the column below names the catalog service added).
| Binding | Provided by | Connection type | Endpoint | Optional | When nothing is bound | Description |
|---|
redis (distributed) | redis | redis | redis | no | redis is added to the installation | Room routing shared by the nodes (TLS, ACL user livekit). |
redis (single) | redis | redis | redis | yes | stays unbound (optional) | Message bus of LiveKit SIP, Egress and Ingress on a single node, read only when redis_bus is on (the same Redis as theirs). |
Endpoints
| Endpoint | Scheme | Component | Port | Path | TLS parameter | Binding parameters | Binding secrets | Provisioning command |
|---|
signal | ws | livekit-server | 7880 (port) | - | tls_enabled | api_key, redis_bus | api_secret | - |
Client configuration files
Files rendered for the client configuration download:
livekit.env (client.env.j2)
Commands
| Command | Component | Target | Description |
|---|
Recent logs (logs) | livekit-server | chosen host | Last lines of the server journal. |
Health checks
Liveness (per instance)
| Component | Check | Details |
|---|
livekit-server | HTTP http://{{ host.ip or '127.0.0.1' }}:{{ config.port }}/ | Expected 200; 30 retries; interval 1 s; timeout 3 s |
Preflight checks
| Check | Type | Meaning | Severity | Components |
|---|
signal_port_free | port_free {"param": "port"} | port 7880 free on the host | blocking | every component |
cpu | cpu_count {"min": 4} | at least 4 CPU | warning | every component |
Uninstall
Paths removed when the data is purged: {{ paths.log }}.
Quick links
- Metrics:
http://{{ host.fqdn }}:{{ config.metrics_port }}/metrics
Upstream documentation