{ ... }:
{
  services.livekit = {
    enable = true;
    settings.rtc.use_external_ip = true;
    openFirewall = true;
    keyFile = "/run/secrets/matrix-livekit-secret-key";
  };
  services.lk-jwt-service = {
    enable = true;
    port = 8082;
    livekitUrl = "wss://matrix-rtc.nekover.se/livekit/sfu";
    keyFile = "/run/secrets/matrix-livekit-secret-key";
  };
  systemd.services.lk-jwt-service.environment = {
    LIVEKIT_FULL_ACCESS_HOMESERVERS = "nekover.se";
  };

  sops.secrets."matrix-livekit-secret-key" = {
    mode = "0440";
    owner = "root";
    group = "root";
    restartUnits = [ "livekit.service" "lk-jwt-service.service" ];
  };
}