Element call does not work in test cluster ("Waiting for media...")

[xiyori]

Element call initially goes through but after everyone joins the room there is no audio or video feed:

I set up Element stack for testing purposes following this guide. Exact steps:

• Edit hosts:

...
127.0.0.1    chat.ess.localhost
127.0.0.1    account.ess.localhost
127.0.0.1    matrixrtc.ess.localhost
127.0.0.1    ess.localhost
127.0.0.1    matrix.ess.localhost

• Edit hostnames.yaml:

# Copyright 2024-2025 New Vector Ltd
#
# SPDX-License-Identifier: AGPL-3.0-only

elementWeb:
  ingress:
    host: chat.ess.localhost

matrixAuthenticationService:
  ingress:
    host: account.ess.localhost

matrixRTC:
  ingress:
    host: matrixrtc.ess.localhost
  hostAliases:
  - hostnames:
    - ess.localhost
    - matrixrtc.ess.localhost
    ip: '127.0.0.1'
  sfu:
    additional:
      example-value:
        config: |
          rtc:
            use_external_ip: false

serverName: ess.localhost

synapse:
  ingress:
    host: matrix.ess.localhost
  hostAliases:
  - hostnames:
    - ess.localhost
    - matrix.ess.localhost
    ip: '127.0.0.1'

• ./scripts/setup_test_cluster.sh
• helm -n ess upgrade -i ess charts/matrix-stack -f charts/matrix-stack/ci/test-cluster-mixin.yaml -f ~/ess-config-values/hostnames.yaml --wait --debug
• kubectl exec -n ess -it deploy/ess-matrix-authentication-service -- mas-cli manage register-user
• In the browser go through every domain name in hosts and accept security exception
• Log in, create room and initiate call

I also tried using 2 separate devices instead of browser sessions on one device and got the same results. What am I doing wrong? Is it possible to test element call like this at all?

[benbz]

I'm able to get it to work locally with

$ helm get values -n ess ess                                                                                                                                               
USER-SUPPLIED VALUES:
certManager:
  clusterIssuer: ess-selfsigned
elementWeb:
  ingress:
    host: element.ess.localhost
ingress:
  controllerType: ingress-nginx
matrixAuthenticationService:
  ingress:
    host: mas.ess.localhost
matrixRTC:
  extraEnv:
  - name: LIVEKIT_INSECURE_SKIP_VERIFY_TLS
    value: YES_I_KNOW_WHAT_I_AM_DOING
  hostAliases:
  - hostnames:
    - ess.localhost
    - mrtc.ess.localhost
    - synapse.ess.localhost
    ip: '{{ ( (lookup "v1" "Service" "ingress-nginx" "ingress-nginx-controller") |
      default (dict "spec" (dict "clusterIP" "127.0.0.1")) ).spec.clusterIP }}'
  ingress:
    host: mrtc.ess.localhost
serverName: ess.localhost
synapse:
  ingress:
    host: synapse.ess.localhost

I think the important bits you're missing are

• matrixRTC.hostAliases[0].hostnames needs matrix.ess.localhost in it
• matrixRTC.hostAliases[0].ip should be the IP of the ingress controller in cluster and not localhost (in the Pod not on your machine)

hostAliases for Synapse aren't needed as it doesn't make relevant outbound requests. The SFU additional config with rtc.use_external_ip: false doesn't seem necessary.

I'll make a change to test-cluster-mixin.yaml to update matrixRTC.hostAliases as appropriate

[xiyori]

Thank you for looking into it, I added matrix.ess.localhost and requests started to go through. However, the call still doesn't work both with and without rtc.use_external_ip: false. My server is behind a NAT that has a public IP. When STUN is enabled, mrtc uses it as nodeIP on startup.

Here are the log files. With external IP enabled the first call was without 30881-2 ports forwarded in NAT and the second one was with forwarding enabled.

disable_external_ip.log
enable_external_ip.log

[heal-afk]

Plus 1 on this issue.
In my case, the matrix doesn't pass federalization after setup.

Get "https://<ip>:8448/_matrix/key/v2/server": dial tcp <ip>:8448: connect: connection refused

Furthermore, when trying to connect to a voice call, I see an error in the logs of ess-matrix-rtc-authorisation-service-55897dff8-fkdm9 pod.

Failed to look up user info: Get "matrix://<domain>/_matrix/federation/v1/openid/userinfo?access_token=": dial tcp <ip>:8448: connect: connection refused

It seems that port 8008 of ess-synapse-main-0 isn't properly routed to external port 8448, but I can't fix it.

[benbz]

Plus 1 on this issue. In my case, the matrix doesn't pass federalization after setup.

Get "https://<ip>:8448/_matrix/key/v2/server": dial tcp <ip>:8448: connect: connection refused

Furthermore, when trying to connect to a voice call, I see an error in the logs of ess-matrix-rtc-authorisation-service-55897dff8-fkdm9 pod.

Failed to look up user info: Get "matrix://<domain>/_matrix/federation/v1/openid/userinfo?access_token=": dial tcp <ip>:8448: connect: connection refused

It seems that port 8008 of ess-synapse-main-0 isn't properly routed to external port 8448, but I can't fix it.

This is a separate issue. If you're seeing port 8448 being used you haven't deployed well-known delegation files or they're not working in your setup. The well-known delegation files point federation traffic to the Synapse domain name on port 443. Port 8448 should never be used in an ESS setup and is correctly not exposed

[benbz]

Thank you for looking into it, I added matrix.ess.localhost and requests started to go through. However, the call still doesn't work both with and without rtc.use_external_ip: false. My server is behind a NAT that has a public IP. When STUN is enabled, mrtc uses it as nodeIP on startup.

Here are the log files. With external IP enabled the first call was without 30881-2 ports forwarded in NAT and the second one was with forwarding enabled.

disable_external_ip.log enable_external_ip.log

There's nothing obvious to me that I'm seeing in the logs sorry.

The best I can suggest is to try with 25.9.1 and using the explicit values that #733 introduced (rather than setting use_external_ip and the node IP in additional configuration). Also confirming that ports 30881/TCP and 30882/UDP are correctly open & forwarded all the way between your test devices and the cluster.

[elch01]

Sorry for hijacking this issue, but i cant for the life of me get element call to work...
as of 25.9.2 i cant deploy the stack unless node_ip: 198.51.100.1 & use_external_ip: false is defined.
Otherwise i get dial tcp 10.42.0.75:7880: connect: connection refused when looking at the pod description for sfu.

And now if i do include it, it deploys fine, but when entering a call it fails after about 30 seconds with "Error Code: UNKNOWN_ERROR" and [Lifecycle] Failed to connect ConnectionError: could not establish pc connection is shown in the console.
Tested in chrome and firefox.

livekit logs:

2025-09-30T21:12:25.635Z	INFO	livekit	service/roommanager.go:402	starting RTC session	{"room": "!SbiIebTwmuBpMinEWY:domain", "roomID": "RM_oUVQXgBpPqVT", "participant": "@elch:domain:T688TruTfi", "pID": "PA_yYG3kj9WBCv9", "remote": false, "room": "!SbiIebTwmuBpMinEWY:domain", "nodeID": "ND_pMXcnGme8s3C", "numParticipants": 0, "participantInit": {"Identity": "@elch:domain:T688TruTfi", "Reconnect": false, "ReconnectReason": "RR_UNKNOWN", "AutoSubscribe": true, "Client": {"sdk": "JS", "version": "2.15.5", "protocol": 16, "os": "Linux", "deviceModel": "Other", "browser": "Chrome", "browserVersion": "140.0.0"}, "Grants": {"Identity": "@elch:domain:T688TruTfi", "Kind": "", "Video": {"RoomCreate": false, "RoomList": false, "RoomRecord": false, "RoomAdmin": false, "RoomJoin": true, "Room": "!SbiIebTwmuBpMinEWY:domain", "CanPublish": true, "CanSubscribe": true, "CanPublishData": "not-set", "CanPublishSources": [], "CanUpdateOwnMetadata": "not-set", "IngressAdmin": false, "Hidden": false, "Recorder": false, "Agent": false, "CanSubscribeMetrics": "not-set", "DestinationRoom": ""}, "SIP": {}, "Agent": {}, "Inference": {}, "RoomConfig": {}, "RoomPreset": ""}, "Region": "", "AdaptiveStream": true, "ID": "", "SubscriberAllowPause": "not-set", "DisableICELite": false, "CreateRoom": {"name": "!SbiIebTwmuBpMinEWY:domain"}, "AddTrackRequests": [], "PublisherOffer": {}, "SyncState": {}, "UseSinglePeerConnection": false}}
2025-09-30T21:12:40.660Z	INFO	livekit	rtc/participant.go:1472	participant closing	{"room": "!SbiIebTwmuBpMinEWY:domain", "roomID": "RM_oUVQXgBpPqVT", "participant": "@elch:domain:T688TruTfi", "pID": "PA_yYG3kj9WBCv9", "remote": false, "sendLeave": false, "reason": "SIGNAL_SOURCE_CLOSE", "isExpectedToResume": false}
2025-09-30T21:12:40.660Z	INFO	livekit	rtc/room.go:1325	removing participant without connection	{"room": "!SbiIebTwmuBpMinEWY:domain", "roomID": "RM_oUVQXgBpPqVT", "participant": "@elch:domain:T688TruTfi", "pID": "PA_yYG3kj9WBCv9", "remote": false, "publisherCandidates": ["[local][trickle] udp4 host 198.51.100.1:30882 (resolved: 198.51.100.1:30882)", "[local][trickle] tcp4 host 198.51.100.1:30881 (resolved: 198.51.100.1:30881)", "[remote][trickle] udp4 host 172.18.0.1:46389", "[remote][trickle] udp4 host local_ip:45266", "[remote][trickle] udp4 srflx my_ip...:58693  related local_ip:45266", "[remote][trickle] udp4 srflx my_ip...:23154  related 172.18.0.1:46389", "[remote][trickle] udp4 srflx my_ip...:15414  related 172.18.0.1:46389", "[remote][trickle] udp4 srflx my_ip...:54700  related local_ip:45266", "[remote][trickle] tcp4 host 172.18.0.1:9", "[remote][trickle] tcp4 host local_ip:9"], "subscriberCandidates": ["[local][trickle] udp4 host 198.51.100.1:30882 (resolved: 198.51.100.1:30882)", "[local][trickle] tcp4 host 198.51.100.1:30881 (resolved: 198.51.100.1:30881)", "[remote][trickle] udp4 host 172.18.0.1:52227", "[remote][trickle] udp4 host local_ip:50573", "[remote][trickle] udp4 srflx my_ip...:39247  related local_ip:50573", "[remote][trickle] udp4 srflx my_ip...:54532  related 172.18.0.1:52227", "[remote][trickle] udp4 srflx my_ip...:5705  related 172.18.0.1:52227", "[remote][trickle] udp4 srflx my_ip...:26605  related local_ip:50573", "[remote][trickle] tcp4 host 172.18.0.1:9", "[remote][trickle] tcp4 host local_ip:9"], "connectionType": "unknown", "reason": "SIGNAL_SOURCE_CLOSE", "clientInfo": {"sdk": "JS", "version": "2.15.5", "protocol": 16, "os": "Linux", "deviceModel": "Other", "browser": "Chrome", "browserVersion": "140.0.0"}}
2025-09-30T21:12:40.660Z	INFO	livekit.transport	rtc/transport.go:2799	ICE candidate pair stats	{"room": "!SbiIebTwmuBpMinEWY:domain", "roomID": "RM_oUVQXgBpPqVT", "participant": "@elch:domain:T688TruTfi", "pID": "PA_yYG3kj9WBCv9", "remote": false, "transport": "PUBLISHER", "stats": [{"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "172.18.0.1:46389 udp type(host/), priority(2122260223)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.681Z", "lastRequestSentAt": "2025-09-30T21:12:26.182Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "my_ip...:58693 udp type(srflx/), priority(1685987071)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.702Z", "lastRequestSentAt": "2025-09-30T21:12:26.584Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "my_ip...:23154 udp type(srflx/), priority(1686052607)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.703Z", "lastRequestSentAt": "2025-09-30T21:12:26.784Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "my_ip...:15414 udp type(srflx/), priority(1686052607)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.780Z", "lastRequestSentAt": "2025-09-30T21:12:26.984Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "my_ip...:54700 udp type(srflx/), priority(1685987071)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.779Z", "lastRequestSentAt": "2025-09-30T21:12:26.984Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "local_ip:45266 udp type(host/), priority(2122194687)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.681Z", "lastRequestSentAt": "2025-09-30T21:12:26.182Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}]}
2025-09-30T21:12:40.661Z	INFO	livekit.transport	rtc/transport.go:2799	ICE candidate pair stats	{"room": "!SbiIebTwmuBpMinEWY:domain", "roomID": "RM_oUVQXgBpPqVT", "participant": "@elch:domain:T688TruTfi", "pID": "PA_yYG3kj9WBCv9", "remote": false, "transport": "SUBSCRIBER", "stats": [{"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "my_ip...:54532 udp type(srflx/), priority(1686052607)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.688Z", "lastRequestSentAt": "2025-09-30T21:12:26.784Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "my_ip...:5705 udp type(srflx/), priority(1686052607)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.779Z", "lastRequestSentAt": "2025-09-30T21:12:26.984Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "172.18.0.1:52227 udp type(host/), priority(2122260223)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.665Z", "lastRequestSentAt": "2025-09-30T21:12:26.182Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "my_ip...:26605 udp type(srflx/), priority(1685987071)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.780Z", "lastRequestSentAt": "2025-09-30T21:12:27.184Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "local_ip:50573 udp type(host/), priority(2122194687)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.665Z", "lastRequestSentAt": "2025-09-30T21:12:26.383Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}, {"state": "failed", "nominated": false, "local": "198.51.100.1:30882 udp type(host/), priority(2130706431)", "remote": "my_ip...:39247 udp type(srflx/), priority(1685987071)", "requestsSent": 8, "responsesReceived": 0, "requestsReceived": 0, "responsesSent": 0, "firstRequestSentAt": "2025-09-30T21:12:25.688Z", "lastRequestSentAt": "2025-09-30T21:12:26.584Z", "firstResponseReceivedAt": "1754-08-30T22:43:41.128Z", "lastResponseReceivedAt": "1754-08-30T22:43:41.128Z", "firstRequestReceivedAt": "1754-08-30T22:43:41.128Z", "lastRequestReceivedAt": "1754-08-30T22:43:41.128Z"}]}

My ports are correcly forwarded:

$ nc -v -u -z -w 3 domain 30882
Connection to domain (ip) 30882 port [udp/*] succeeded!```

telnet domain 30881
Trying ip...
Connected to domain.
Escape character is '^]'

All outgoing traffic is set to ACCEPT in both the local firewall and the central firewall (handled in the VPS firewall config)

Other than the hostnames.yaml defining my own domains and subdomains ( + the livekit overrides) it's the stock config as followed by the install instructions on README.md

What am i doing wrong, i've redeployed many times even re-installed the VPS just to make sure...
Would be extemely grateful for any help.

[ExtremTrucker]

Plus 1 on this issue. In my case, the matrix doesn't pass federalization after setup.

Get "https://<ip>:8448/_matrix/key/v2/server": dial tcp <ip>:8448: connect: connection refused

Furthermore, when trying to connect to a voice call, I see an error in the logs of ess-matrix-rtc-authorisation-service-55897dff8-fkdm9 pod.

Failed to look up user info: Get "matrix://<domain>/_matrix/federation/v1/openid/userinfo?access_token=": dial tcp <ip>:8448: connect: connection refused

It seems that port 8008 of ess-synapse-main-0 isn't properly routed to external port 8448, but I can't fix it.

Same issue here.
I’m experiencing the same problem exactly as described above.

Worth noting: the same code runs fine few weeks ago in a minimal test setup.
As soon as I integrate it into the main setup the error shows up.

[jmgooden94]

+1 for me

I try setting manualIP to my server's public IP (since I'm behind a NAT, and have a reverse proxy in front of the K3S cluster), but the value I set isn't respected and the LiveKit server comes up with "nodeIP": "198.50.100.1" regardless of the value I specify in my manualIP config.

This result in it being impossible to connect to the LiveKit server, even though all of the other RTC configuration is correct (verified with this handy testmatrix script).

2025-10-02T01:18:40.362Z        INFO    livekit service/server.go:264   starting LiveKit server {"portHttp": 7880, "nodeID": "ND_jgmFHyDMWtTj", "nodeIP": "198.51.100.1", "version": "1.9.1", "rtc.portTCP": 30881, "rtc.portUDP": {"Start":30882,"End":0}, "portPrometheus": 6789}

It seems like maybe one of these default configs is trumping the user-specified configs?

• ess-helm/charts/matrix-stack/ci/fragments/matrix-rtc-manual-ip.yaml

  Line 7 in 296d5b9

  manualIP: 198.51.100.2

• ess-helm/charts/matrix-stack/ci/matrix-rtc-no-stun-manual-ip-values.yaml

  Line 30 in 296d5b9

  manualIP: 198.51.100.2

After even more digging, I can confirm that the IP is getting plumbed through all of the config correctly, but the LiveKit server is starting up with the wrong IP. When I look at the output of the helm template or grep the deploy logs from help, I can see the NODE_IP env variable being set with the correct IP, but even after doing all of this I still see the placeholder "nodeIP": "198.51.100.1" when the server starts up.

[gaelgatelement]

I try setting manualIP to my server's public IP (since I'm behind a NAT, and have a reverse proxy in front of the K3S cluster), but the value I set isn't respected and the LiveKit server comes up with "nodeIP": "198.50.100.1" regardless of the value I specify in my manualIP config.

This is expected, as the env var will take over the internal IP. See the comment :

  # To workaround https://github.com/livekit/livekit/issues/2088
  # Any IP address is acceptable, it doesn't need to be a correct one,
  # it just needs to be present to get LiveKit to skip checking all local interfaces
  # We assign here a TEST-NET IP which is
  # overridden by the NODE_IP env var at runtime
  node_ip: 198.51.100.1

Did you set useStunToDiscoverPublicIP: false as well?

[gaelgatelement]

Quick feedback : We found where the actual issue is, we are going to provide a fix shortly with a new release!

[benbz]

Quick feedback : We found where the actual issue is, we are going to provide a fix shortly with a new release!

25.9.3 is now out with the fix for the issue with 25.9.2 relating to node_ip not being set correctly.

It doesn't necessarily fix the original issue here, other than the original reported should retry with the settings from #733 against 25.9.3.

I will also repeat that all comments relating to port 8448 have nothing to do with this issue and should be opened as new issues after correctly verifying your well-knowns work with https://federationtester.matrix.org/

[ExtremTrucker]

I'm able to get it to work locally with

$ helm get values -n ess ess
USER-SUPPLIED VALUES:
certManager:
clusterIssuer: ess-selfsigned
elementWeb:
ingress:
host: element.ess.localhost
ingress:
controllerType: ingress-nginx
matrixAuthenticationService:
ingress:
host: mas.ess.localhost
matrixRTC:
extraEnv:

• name: LIVEKIT_INSECURE_SKIP_VERIFY_TLS
  value: YES_I_KNOW_WHAT_I_AM_DOING
  hostAliases:
• hostnames:
  • ess.localhost
  • mrtc.ess.localhost
  • synapse.ess.localhost
    ip: '{{ ( (lookup "v1" "Service" "ingress-nginx" "ingress-nginx-controller") |
    default (dict "spec" (dict "clusterIP" "127.0.0.1")) ).spec.clusterIP }}'
    ingress:
    host: mrtc.ess.localhost
    serverName: ess.localhost
    synapse:
    ingress:
    host: synapse.ess.localhost
    I think the important bits you're missing are

• matrixRTC.hostAliases[0].hostnames needs matrix.ess.localhost in it
• matrixRTC.hostAliases[0].ip should be the IP of the ingress controller in cluster and not localhost (in the Pod not on your machine)

hostAliases for Synapse aren't needed as it doesn't make relevant outbound requests. The SFU additional config with rtc.use_external_ip: false doesn't seem necessary.

I'll make a change to test-cluster-mixin.yaml to update matrixRTC.hostAliases as appropriate

Thank you for pointing that out.

Setting the hostAliases.hostnames and IP lookup finally solved the problem for me.

[elch01]

Tried a couple of deployments again, i can now ommit node_ip: but use_external_ip: false is still required.
And setting up a call responds with "Error Code: MISSING_MATRIX_RTC_FOCUS."

Web console Error: Call is not supported