brainAThome

Hello everyone, I'm contacting you because I'm reaching my limits with the setup of Element Call (LiveKit backend) for my Matrix Synapse server on Unraid. Despite days of troubleshooting, every video call fails."Waiting for media..."hang. Call signaling via the JWT service works, but the media stream (audio/video) is not established. I have already tried many things: First with coturn (failed due to similar network/IP detection problems in bridge mode), now with the recommendedLiveKit + JWT-Service. I hope someone has experience with this configuration on Unraid. My system: Unraid Version: 7.1.4 Server IP (Unraid Host): UNRAID_IP (z.B. 192.168.178.95) Docker network:PrimaryIPVLAN(br0) is configured. Docker Standard Bridge (172.17.0.0/16) and others are also active. Matrix Synapse:Docker container (Matrix-Synapse), config under /mnt/user/appdata/synapse/homeserver.yaml, accessible via https://MAIN_DOMAIN. homeserver.yaml has been extended with experimental features (msc3266, msc4222, msc4140) and adjusted rc_message/rc_delayed_event_mgmt limits for MatrixRTC. Reverse Proxy:Nginx Proxy Manager (NPM, official container jc21/nginx-proxy-manager), manages SSL (Let's Encrypt) for all domains. Router:FRITZ!Box (ROUTER_IP). Port forwarding for LiveKit (TCP 7880, 7881; UDP 65246-65500) is configured for the UNRAID_IP.Important:A test with"Exposed Host"has the problemnotFixed – the router firewall does not seem to be the cause. DDNS:MAIN_DOMAIN (via DDNS provider) for Synapse + RTC_DOMAIN (via DuckDNS container) for the LiveKit backend. Both correctly point to my dynamic public IP (currently PUBLIC_IP). Clients:Tested with the latestElement Desktop App (Windows) and Element Web (Chrome)Clients have been reloaded multiple times (including cache clearing). Microphone/camera permissions have been granted. Current LiveKit/JWT configuration (Plan M - Minimal Host Mode): Since all attempts inBridge-Modus(wrong nodeIP despite STUN success, unexplained UDP port conflicts address already in use, ignoring DETECT_EXTERNAL_IP / external-ip=hostname in config) and withMacVLAN/IPVLAN(Network creation error Pool overlaps / device busy) failed, the LiveKit containers run as a last attempt in theHost-Modus: docker-compose.yaml (/mnt/user/appdata/element-call-backend/docker-compose.yaml): YAML version: '3.7' # Ignored, but FYI services: matrix-element-call-jwt: image: ghcr.io/element-hq/lk-jwt-service:latest # ... container_name, hostname ... environment: - LK_JWT_PORT=7080 # Host-Port 7080 - LIVEKIT_URL=https://RTC_DOMAIN/livekit/sfu - LIVEKIT_KEY=LIVEKIT_KEY - LIVEKIT_SECRET=LIVEKIT_SECRET - LIVEKIT_FULL_ACCESS_HOMESERVERS=HAUPT_DOMAIN network_mode: host restart: unless-stopped matrix-element-call-livekit: image: livekit/livekit-server:latest # ... container_name, hostname ... command: --config /etc/livekit.yaml network_mode: host restart: unless-stopped volumes: - ./livekit.yaml:/etc/livekit.yaml:ro livekit.yaml(/mnt/user/appdata/element-call-backend/livekit.yaml): (Minimal config for host mode) YAML port: 7880 bind_addresses: ["0.0.0.0"] # Should be ignored in host mode rtc: tcp_port: 7881 port_range_start: 65246 # Area already shared in FritzBox port_range_end: 65500 use_external_ip: true # Attempt automatic detection logging: level: debug # Debug level enabled turn: enabled: false keys: LIVEKIT_KEY: "LIVEKIT_SECRET" LiveKit Logs (Start): The logs show that LiveKit detects and appears to be using the correct public IP: starting LiveKit server ... "nodeIP": "OEFFENTLICHE_IP", ... "rtc.portICERange": [65246, 65500] ✅ NPM configuration: Proxy Host RTC_DOMAIN: SSL: Let's Encrypt active & valid (status "Online" after fixing UNRECOGNIZED_NAME_ALERT and LEGACY_RENEGOTIATION errors), Force SSL, HSTS, HTTP/2 on.Websockets Support an. Advanced Tab (Targets host IPs): Nginx # JWT Service location ^~ /livekit/jwt/ { /* ... Header ... */ proxy_pass http://UNRAID_IP:7080/; } # LiveKit SFU location ^~ /livekit/sfu/ { /* ... Header inkl. Upgrade/Connection ... */ proxy_pass http://UNRAID_IP:7880/; } Proxy Host HAUPT_DOMAIN: Advanced Tab (Well-Known): Nginx location /.well-known/matrix/client { /* ... Header ... */ return 200 '{"m.homeserver": {"base_url": "https://HAUPT_DOMAIN"}, /*...*/ "org.matrix.msc4143.rtc_foci": [{"type": "livekit", "livekit_service_url": "https://RTC_DOMAIN/livekit/jwt"}]}'; } curl test on .well-known is successful. The problem: Despite this configuration (server detectsapparentlycorrect external IP in the log, ports open, NPM forwards, clients up to date) every call remains with"Waiting for media..."hang. TheDebug-Logs von LiveKitshow during the call attemptno obvious ICE errors, binding errors or UDP problems– only the initial warnings during IP validation ("could not validate external IP", "error reading from UDP socket: use of closed network connection"), but the server still starts with the correct nodeIP. My guess: Although the nodeIP looks correct in the startup log, LiveKit in host mode under Unraid/IPVLAN may announcefaulty ICE candidates(e.g. still the internal IP UNRAID_IP or a Docker IP for the UDP connection), or the Unraid host blocks/drops the incoming UDP packets on ports 65246-65500,beforethey reach the LiveKit process (despite host mode). My question: Has anyoneLiveKit successfully runs in host mode on Unraid (specifically with IPVLAN as primary Docker network)Is it running? Are there any known kernel parameters (sysctl), firewall rules (iptables on the host), or Docker/IPVLAN settings that need to be adjusted to ensure that UDP packets are correctly forwarded for media relaying in host mode? Why does the media connection fail even though the starting node IP is correct and no errors are visible in the debug logs during the call? I'm really desperate and grateful for any advice! Thank you in advance!