Restrict access to LiveKit SFU by differentiating full-access and restricted Matrix users for room creation

[fkwp]

Closes: #95

To ensure the proper and secure use of infrastructure

• Add ability to differentiate between full-access and restricted users
  • Full-access users are Matrix users of homeservers belonging to the same or related deployment alongside the MatrixRTC backend,
  • All other Matrix users are considered as restricted users.
• Give different access to the LiveKit SFU dependent on the users origin
  • Full-access users
    • JWT service will automatically create LiveKit SFU rooms if required.
  • Restricted users
    • Access to LiveKit SFU is restricted for remote users.
    • Remote users can join existing LiveKit SFU rooms, but missing rooms will not be automatically created to ensure the proper and secure use of infrastructure.

Note due to the SFU selection algorithm and the order of events this will NOT limit or prevent video conferences across Matrix federation.

Homeservers of full-access users are defined by the LIVEKIT_LOCAL_HOMESERVERS LIVEKIT_FULL_ACCESS_HOMESERVERS environment variable via a comma separated list. It supports * as a wildcard to give full-access to users from all homeservers.

Note this requires MatrixRTC client implementation with more robust handling of SFU error cases. Hence, for now we recommend using it with LIVEKIT_FULL_ACCESS_HOMESERVERS=*

[pReya]

@fkwp Do you know why this hasn't been merged, yet? As a spectator I can't tell what's still missing to get this merged.

[fkwp]

@fkwp Do you know why this hasn't been merged, yet? As a spectator I can't tell what's still missing to get this merged.

This is currently blocked by a missing MatrixRTC client implementation which requires more robust handling of SFU error cases.

[BillCarsonFr]

I think the readme Installation section is outdated and miss the new -e LIVEKIT_FULL_ACCESS_HOMESERVERS = (per my understanding it is required)

Other than that, just some nits

[fkwp]

I think the readme Installation section is outdated and miss the new -e LIVEKIT_FULL_ACCESS_HOMESERVERS = (per my understanding it is required)

Other than that, just some nits

Updated the readme 8cfc4db

currently its defaulting to * such that it is not a breaking change. Going forward we should change it.

[BillCarsonFr]

Ok.