https://livekit.io logo
Join Slack
Powered by
I have hosted a domain on my server with an SSL ce...
# ask-ai
a
I have hosted a domain on my server with an SSL cert using nginx. How do I configure it to redirect traffic to my livekit server?
t
Thanks for reaching out, Talha. I'm an AI assistant and I'm here to help. Give me a moment while I research this topic.
I'd be happy to help you set up NGINX to redirect traffic to your LiveKit server by configuring it as a reverse proxy. Here's a clear example to guide you through the process: 1. HTTPS and WebSocket (WSS) Configuration:
Copy code
server {
    listen 443 ssl http2;
    server_name <http://your-domain.com|your-domain.com>;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;

    # WebSocket upgrade for LiveKit signaling
    location / {
        proxy_pass <http://localhost:7880;>
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
2. RTMP Ingress (Optional):
Copy code
stream {
    server {
        listen 1935;
        proxy_pass localhost:1935;
    }
}
3. WHIP Ingress (Optional):
Copy code
server {
    listen 443 ssl;
    server_name <http://your-domain.com|your-domain.com>;

    ssl_certificate /path/to/whip-cert.pem;
    ssl_certificate_key /path/to/whip-key.pem;

    location /whip {
        proxy_pass <http://localhost:8080;>
        proxy_http_version 1.1;
        proxy_set_header Host $host;
    }
}
To ensure everything runs smoothly, please make sure to: • Open UDP ports 50000-60000 for WebRTC media traffic. • Configure your LiveKit server with the correct base URLs for RTMP and WHIP. • Use NGINX's stream module for RTMP and UDP traffic if needed. If you have any questions or need more examples, feel free to reach out. I'm here to help you every step of the way! Sources: config-sample.yaml | Docs::Home | Docs::Home | Docs::Home
a
port: 7880 log_level: info rtc: tcp_port: 7881 port_range_start: 50000 port_range_end: 60000 redis: address: localhost:6379 keys: APIbLLHJzVJJEei: ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE turn: enabled: true tls_port: 8488 domain: enbot-dev.enteract.cloud cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt key_file: /etc/pki/tls/private/star.enteract.cloud.key This is the config which is passed to livekit server when started. LIVEKIT_API_KEY="APIbLLHJzVJJEei" LIVEKIT_API_SECRET="ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE" LIVEKIT_URL="wss://enbot-dev.enteract.cloud:7880" These are my secret creds map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { listen 80; server_name enbot-dev.enteract.cloud; return 301 https://$host$request_uri; } server { listen 443 ssl; server_name enbot-dev.enteract.cloud; ssl_certificate /etc/pki/tls/certs/star.enteract.cloud.crt; ssl_certificate_key /etc/pki/tls/private/star.enteract.cloud.key; ssl_trusted_certificate /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem; access_log /var/log/nginx/enbot-dev.enteract.cloud-access.log prod; error_log /var/log/nginx/enbot-dev.enteract.cloud-error.log warn; location /static/ { alias /var/www/bot-crm-dev/static/; autoindex off; try_files $uri $uri/ =404; } # Serve index.html directly from static directory location = / { root /var/www/bot-crm-dev; try_files /static/index.html =404; } client_max_body_size 1000M; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 600s; proxy_connect_timeout 600s; proxy_send_timeout 600s; proxy_pass http://enbot-dev-api/; autoindex on; proxy_buffers 80 160k; proxy_buffer_size 160k; add_header X-Frame-Options "ALLOWALL"; } } upstream enbot-dev-api { server 127.0.0.1:8488; } server { listen 8488; server_name enbot-dev.enteract.cloud; # allow up to 5 MB client_max_body_size 5M; location / { include proxy_params; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_pass http://unix:/var/www/bot-crm-dev/bot-crm-dev.sock; } } This is my nginx file., it is already used by another process (should I make a new one?)
t
It seems like your current NGINX configuration is already being used by another process. No worries! Would you prefer to update this existing configuration to include LiveKit, or would you like me to help you create a new, separate configuration file just for LiveKit? I'm here to guide you through whichever option feels best for you.
a
Existing one, also tell me what should be my new LIVEKIT_URL and what should I write in my turn config (tls_port, domain, cert file etc)
t
Hi there! To help you smoothly integrate LiveKit into your existing NGINX setup, here are the key updates and settings you'll need: 1. Update LIVEKIT_URL: Please set your 
LIVEKIT_URL
to: 
<wss://enbot-dev.enteract.cloud>
. This is the URL your clients will use to connect to the LiveKit server. 2. TURN Configuration: Next, update your TURN settings in the LiveKit configuration file like this:
Copy code
turn:
  enabled: true
  tls_port: 443
  domain: enbot-dev.enteract.cloud
  cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt
  key_file: /etc/pki/tls/private/star.enteract.cloud.key
Make sure the 
domain
matches your TLS certificate, and the 
tls_port
is set to 443, which helps with compatibility across most networks. 3. NGINX Configuration: Finally, in your current NGINX configuration, add the following inside the 
location /
block to proxy WebSocket traffic to LiveKit:
Copy code
proxy_pass <http://127.0.0.1:7880;>
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
If anything feels unclear or if you’d like me to walk you through any part of this, just let me know—I’m here to help! Sources: Docs::Recipes | web/.env.sample | env.example | .env.example | Deploying LiveKit | LiveKit Docs
a
map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { listen 80; server_name enbot-dev.enteract.cloud; return 301 https://$host$request_uri; } server { listen 443 ssl; server_name enbot-dev.enteract.cloud; ssl_certificate /etc/pki/tls/certs/star.enteract.cloud.crt; ssl_certificate_key /etc/pki/tls/private/star.enteract.cloud.key; ssl_trusted_certificate /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem; access_log /var/log/nginx/enbot-dev.enteract.cloud-access.log prod; error_log /var/log/nginx/enbot-dev.enteract.cloud-error.log warn; location /static/ { alias /var/www/bot-crm-dev/static/; autoindex off; try_files $uri $uri/ =404; } # Serve index.html directly from static directory location = / { root /var/www/bot-crm-dev; try_files /static/index.html =404; } client_max_body_size 1000M; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 600s; proxy_connect_timeout 600s; proxy_send_timeout 600s; proxy_pass http://enbot-dev-api/; autoindex on; proxy_buffers 80 160k; proxy_buffer_size 160k; add_header X-Frame-Options "ALLOWALL"; proxy_pass http://127.0.0.1:7880; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } upstream enbot-dev-api { server 127.0.0.1:8488; } server { listen 8488; server_name enbot-dev.enteract.cloud; # allow up to 5 MB client_max_body_size 5M; location / { include proxy_params; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_pass http://unix:/var/www/bot-crm-dev/bot-crm-dev.sock; } } is this good?
t
Thank you for sharing your updated NGINX configuration! It looks mostly on point, but I’d love to help you fine-tune a few details to make sure everything runs smoothly: 1. Avoid Duplicate `proxy_pass`: In your 
location /
block, I noticed there are two 
proxy_pass
directives (
<API_BACKEND_URL>
and 
<LIVEKIT_SIGNALING_URL>
). Since NGINX only allows one 
proxy_pass
per location block, it would be best to remove the 
proxy_pass <API_BACKEND_URL>
line if this block is intended for LiveKit traffic. 2. WebSocket Upgrade: You’ve done a great job including the WebSocket upgrade headers! Just double-check that the 
proxy_pass
is pointing to 
<LIVEKIT_SIGNALING_URL>
to ensure LiveKit signaling works perfectly. 3. TURN Configuration: To make sure your TURN server is set up correctly, please confirm these settings in your LiveKit configuration file:
Copy code
turn:
  enabled: true
  tls_port: 443
  domain: enbot-dev.enteract.cloud
  cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt
  key_file: /etc/pki/tls/private/star.enteract.cloud.key
4. Testing: Once you’ve made these tweaks, it’s a good idea to test your configuration using 
nginx -t
to catch any syntax issues. If all looks good, go ahead and reload NGINX with 
nginx -s reload
. If you run into any bumps along the way or have more questions, please don’t hesitate to reach out—I’m here to help!
a
map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { listen 80; server_name enbot-dev.enteract.cloud; return 301 https://$host$request_uri; } server { listen 443 ssl; server_name enbot-dev.enteract.cloud; ssl_certificate /etc/pki/tls/certs/star.enteract.cloud.crt; ssl_certificate_key /etc/pki/tls/private/star.enteract.cloud.key; ssl_trusted_certificate /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem; access_log /var/log/nginx/enbot-dev.enteract.cloud-access.log prod; error_log /var/log/nginx/enbot-dev.enteract.cloud-error.log warn; location /static/ { alias /var/www/bot-crm-dev/static/; autoindex off; try_files $uri $uri/ =404; } # Serve index.html directly from static directory location = / { root /var/www/bot-crm-dev; try_files /static/index.html =404; } client_max_body_size 1000M; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 600s; proxy_connect_timeout 600s; proxy_send_timeout 600s; autoindex on; proxy_buffers 80 160k; proxy_buffer_size 160k; add_header X-Frame-Options "ALLOWALL"; proxy_pass http://127.0.0.1:7880; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } server { listen 8488; server_name enbot-dev.enteract.cloud; # allow up to 5 MB client_max_body_size 5M; location / { include proxy_params; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_pass http://unix:/var/www/bot-crm-dev/bot-crm-dev.sock; } } update this to work separately with the livekit server
t
To help you update your NGINX configuration to work smoothly with the LiveKit server separately, you can create a dedicated server block just for LiveKit traffic. Here’s an updated configuration that should do the trick: 1. Add a New Server Block for LiveKit:
Copy code
server {
    listen 443 ssl;
    server_name enbot-dev.enteract.cloud;

    ssl_certificate             /etc/pki/tls/certs/star.enteract.cloud.crt;
    ssl_certificate_key         /etc/pki/tls/private/star.enteract.cloud.key;
    ssl_trusted_certificate     /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem;

    access_log  /var/log/nginx/livekit-access.log;
    error_log   /var/log/nginx/livekit-error.log warn;

    location / {
        proxy_pass <http://127.0.0.1:7880;>
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 600s;
        proxy_connect_timeout 600s;
        proxy_send_timeout 600s;
    }
}
2. Keep Existing Configuration for Other Services: You can leave your existing server blocks for other services, like 
enbot-dev-api
, just as they are. This way, LiveKit traffic will be handled separately without affecting anything else. 3. Test and Reload: • Run 
nginx -t
to check for any syntax errors in your configuration. • Reload NGINX with 
nginx -s reload
to apply the changes. If you run into any issues or want me to help with further tweaks, just let me know—I’m here to help!
a
keys: APIbLLHJzVJJEei: ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE log_level: info port: 7880 redis: address: localhost:6379 rtc: port_range_end: 60000 port_range_start: 50000 tcp_port: 7881 turn: cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt domain: wss://livekit-server-dev.enteract.cloud enabled: true key_file: /etc/pki/tls/private/star.enteract.cloud.key tls_port: 443 2025-09-17T191353.611+0500 INFO livekit hwstats/memory_linux.go:67 failed reading cgroup specific memory stats, falling back to system wide implementation 2025-09-17T191353.611+0500 INFO livekit redis/redis.go:142 connecting to redis {"simple": true, "addr": "localhost:6379"} TURN domain is not correct
t
It looks like the error is happening because the TURN domain configuration isn’t quite right. To fix this, the 
domain
field in your TURN setup should exactly match the domain name of your LiveKit server, but without including the 
wss://
prefix. Here’s how you can update your TURN configuration:
Copy code
turn:
  enabled: true
  tls_port: 443
  domain: livekit-server-dev.enteract.cloud
  cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt
  key_file: /etc/pki/tls/private/star.enteract.cloud.key
Once you’ve made this adjustment, please restart your LiveKit server and try the connection again. If you run into any more trouble or have questions, I’m here to help—just let me know!
a
# HTTP to HTTPS server { listen 80; server_name livekit-server-dev.enteract.cloud; return 301 https://$host$request_uri; } server { listen 443 ssl; server_name livekit-server-dev.enteract.cloud; ssl_certificate /etc/pki/tls/certs/star.enteract.cloud.crt; ssl_certificate_key /etc/pki/tls/private/star.enteract.cloud.key; ssl_trusted_certificate /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem; access_log /var/log/nginx/livekit-server-dev.enteract.cloud-access.log prod; error_log /var/log/nginx/livekit-server-dev.enteract.cloud-error.log warn; client_max_body_size 1000M; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://livekit-server-dev-api/; autoindex on; proxy_buffers 80 160k; proxy_buffer_size 160k; add_header X-Frame-Options "ALLOWALL"; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 600s; proxy_connect_timeout 600s; proxy_send_timeout 600s; } } upstream livekit-server-dev-api { server 127.0.0.1:8496; } server { listen 8496; server_name livekit-server-dev.enteract.cloud; location / { include proxy_params; proxy_pass http://127.0.0.1:7880; } }I keys: APIbLLHJzVJJEei: ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE log_level: info port: 7880 redis: address: localhost:6379 rtc: port_range_end: 60000 port_range_start: 50000 tcp_port: 7881 turn: cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt domain: livekit-server-dev.enteract.cloud enabled: true key_file: /etc/pki/tls/private/star.enteract.cloud.key tls_port: 8496 What changes are required to make this run livekit-server --config lk_server_config.yaml 2025-09-17T191542.793+0500 INFO livekit hwstats/memory_linux.go:67 failed reading cgroup specific memory stats, falling back to system wide implementation 2025-09-17T191542.793+0500 INFO livekit redis/redis.go:142 connecting to redis {"simple": true, "addr": "localhost:6379"} could not listen on TURN TCP port: listen tcp4 0.0.0.08496 bind: address already in use
t
It looks like the error is telling us that the TURN TCP port 
8496
is already being used by another process. No worries—we can work through this together! You have a couple of options to fix this: 1. Change the TURN Port: You can update your TURN configuration in the 
lk_server_config.yaml
file to use a different port that’s free. For example:
Copy code
turn:
  enabled: true
  tls_port: 8500
  domain: livekit-server-dev.enteract.cloud
  cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt
  key_file: /etc/pki/tls/private/star.enteract.cloud.key
After that, don’t forget to update your NGINX configuration to use this new port:
Copy code
upstream livekit-server-dev-api {
    server 127.0.0.1:8500;
}
2. Identify and Stop the Conflicting Process: If you prefer, you can find out which process is using port 
8496
by running this command:
Copy code
sudo lsof -i :8496
Once you know what’s running there, you can stop that process if it’s not needed. After making these changes, just restart your LiveKit server and NGINX. If you run into any trouble or have more questions, feel free to reach out—I’m here to help!
a
nginx is running on 8496, if someone connected to the domain, they will be routed to this port. I think I should route it or what should be done about it?
t
If NGINX is already using port 
8496
, no worries! You can easily configure it to route traffic to the LiveKit TURN server running on a different internal port. Let me guide you through the steps to adjust your setup: 1. Update LiveKit TURN Configuration: First, let's change the TURN server's 
tls_port
to an unused port, like `8500`:
Copy code
turn:
  enabled: true
  tls_port: 8500
  domain: livekit-server-dev.enteract.cloud
  cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt
  key_file: /etc/pki/tls/private/star.enteract.cloud.key
2. Update NGINX to Route TURN Traffic: Next, update your NGINX configuration so it forwards traffic from port 
8496
to the TURN server's new port:
Copy code
server {
    listen 8496 ssl;
    server_name livekit-server-dev.enteract.cloud;

    ssl_certificate             /etc/pki/tls/certs/star.enteract.cloud.crt;
    ssl_certificate_key         /etc/pki/tls/private/star.enteract.cloud.key;
    ssl_trusted_certificate     /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem;

    location / {
        proxy_pass <http://127.0.0.1:8500;>
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
3. Test and Restart: • Run 
nginx -t
to check the configuration for any syntax errors. • Reload NGINX with 
nginx -s reload
to apply the changes. • Finally, restart the LiveKit server so the new TURN configuration takes effect. This way, NGINX will handle incoming traffic on port 
8496
and forward it smoothly to the TURN server on port 
8500
. If you run into any questions or need a hand with any step, just let me know—I’m here to help!
a
keys: APIbLLHJzVJJEei: ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE log_level: info port: 7880 redis: address: localhost:6379 rtc: port_range_end: 60000 port_range_start: 50000 tcp_port: 7881 turn: cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt domain: livekit-server-dev.enteract.cloud enabled: true key_file: /etc/pki/tls/private/star.enteract.cloud.key tls_port: 8365 server { listen 80; server_name livekit-server-dev.enteract.cloud; return 301 https://$host$request_uri; } server { listen 443 ssl; server_name livekit-server-dev.enteract.cloud; ssl_certificate /etc/pki/tls/certs/star.enteract.cloud.crt; ssl_certificate_key /etc/pki/tls/private/star.enteract.cloud.key; ssl_trusted_certificate /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem; access_log /var/log/nginx/livekit-server-dev.enteract.cloud-access.log prod; error_log /var/log/nginx/livekit-server-dev.enteract.cloud-error.log warn; client_max_body_size 1000M; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://livekit-server-dev-api/; autoindex on; proxy_buffers 80 160k; proxy_buffer_size 160k; add_header X-Frame-Options "ALLOWALL"; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_read_timeout 600s; proxy_connect_timeout 600s; proxy_send_timeout 600s; } } upstream livekit-server-dev-api { server 127.0.0.1:8496; } server { listen 8496; server_name livekit-server-dev.enteract.cloud; location / { include proxy_params; proxy_pass http://127.0.0.1:8365; } } livekit agent is trying to connect this error comes up WSServerHandshakeError: 502, message='Invalid response status', url='wss://livekit-server-dev.enteract.cloud/agent'
t
It looks like the error is showing that the WebSocket handshake is failing with a 502 status. This usually means the WebSocket traffic isn’t being routed correctly to the LiveKit server. Don’t worry, I’m here to help you through this! Here are some steps we can take to get this sorted out: 1. Verify NGINX Configuration for WebSocket Traffic: First, please check that the 
location /
block in your NGINX configuration for port 
443
includes the necessary WebSocket headers and properly routes traffic to the LiveKit signaling port (
7880
):
Copy code
server {
    listen 443 ssl;
    server_name livekit-server-dev.enteract.cloud;

    ssl_certificate             /etc/pki/tls/certs/star.enteract.cloud.crt;
    ssl_certificate_key         /etc/pki/tls/private/star.enteract.cloud.key;
    ssl_trusted_certificate     /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem;

    location / {
        proxy_pass <http://127.0.0.1:7880;>
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 600s;
        proxy_connect_timeout 600s;
        proxy_send_timeout 600s;
    }
}
2. Check TURN Configuration: Next, let’s make sure your TURN server is properly configured and running on port 
8365
. The NGINX block for port 
8496
should forward traffic to the TURN server like this:
Copy code
server {
    listen 8496;
    server_name livekit-server-dev.enteract.cloud;

    location / {
        proxy_pass <http://127.0.0.1:8365;>
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
3. Test Connectivity: • Make sure the LiveKit server is up and running, and accessible on port 
7880
. • Try testing the WebSocket connection using a tool like 
wscat
or even your browser console to confirm that 
<wss://livekit-server-dev.enteract.cloud>
is reachable. If you give these a try and still run into issues, please don’t hesitate to reach out. I’m here to help you every step of the way!
a
what should be my yaml file?
t
I've put together a recommended YAML configuration file for your LiveKit server based on your setup. Take a look:
Copy code
keys:
  APIbLLHJzVJJEei: ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE

log_level: info

port: 7880

redis:
  address: localhost:6379

rtc:
  port_range_start: 50000
  port_range_end: 60000
  tcp_port: 7881

turn:
  enabled: true
  tls_port: 8365
  domain: livekit-server-dev.enteract.cloud
  cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt
  key_file: /etc/pki/tls/private/star.enteract.cloud.key
Here's a quick explanation to help you understand each part: • `keys`: These are your API key and secret used for authentication. • `log_level`: Set to 
info
so you get general logging details. • `port`: This is the signaling port for WebSocket connections (
7880
). • `redis`: Contains the connection details for your Redis instance. • `rtc`: Configures WebRTC with the port range and TCP fallback port. • `turn`: Settings for the TURN server, including TLS port, domain, and certificate file paths. Once you save this as 
lk_server_config.yaml
, you can start your LiveKit server by running:
Copy code
livekit-server --config lk_server_config.yaml
If you have any questions or need help tweaking this further, please don’t hesitate to reach out. I’m here to support you!
a
raise err_exc_cls(url)\naiohttp.client_exceptions.InvalidUrlClientError: :/livekit-server-dev.enteract.cloud/agent" my secrets: LIVEKIT_API_KEY=APIbLLHJzVJJEei LIVEKIT_API_SECRET=ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE LIVEKIT_URL=livekit-server-dev.enteract.cloud LIVEKIT_TURN_PORT = 8365 yaml: port: 7880 log_level: info rtc: tcp_port: 7881 port_range_start: 50000 port_range_end: 60000 redis: address: localhost:6379 keys: APIbLLHJzVJJEei: ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE turn: enabled: true tls_port: 8365 domain: livekit-server-dev.enteract.cloud cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt key_file: /etc/pki/tls/private/star.enteract.cloud.key nginx conf: # HTTP to HTTPS server { listen 80; server_name livekit-server-dev.enteract.cloud; return 301 https://$host$request_uri; } server { listen 443 ssl; server_name livekit-server-dev.enteract.cloud; ssl_certificate /etc/pki/tls/certs/star.enteract.cloud.crt; ssl_certificate_key /etc/pki/tls/private/star.enteract.cloud.key; ssl_trusted_certificate /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem; location / { proxy_pass http://127.0.0.1:7880; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 600s; proxy_connect_timeout 600s; proxy_send_timeout 600s; } } upstream livekit-server-dev-api { server 127.0.0.1:8496; } server { listen 8496; server_name livekit-server-dev.enteract.cloud; location / { proxy_pass http://127.0.0.1:8365; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; } } what could be the issue
t
It looks like the error is pointing to the 
LIVEKIT_URL
not being formatted quite right. To get everything working smoothly, the 
LIVEKIT_URL
should include the WebSocket protocol prefix (
wss://
). Here’s how you can update your environment variable:
Copy code
LIVEKIT_URL=<wss://livekit-server-dev.enteract.cloud>
Also, a few other things to double-check: 1. NGINX Configuration: Your NGINX setup for port 
443
is properly routing WebSocket traffic to 
<LIVEKIT_SIGNALING_URL>
, which is great! 2. TURN Configuration: The TURN server is set up on port 
8365
, and NGINX is forwarding traffic from 
8496
to 
8365
. That looks good too. 3. Restart Services: • Once you’ve updated the 
LIVEKIT_URL
, be sure to restart your application so the changes take effect. • Also, please make sure the LiveKit server is running and accessible on port 
7880
. If you run into any more issues or have questions, feel free to reach out—I’m here to help!
a
my secrets: LIVEKIT_API_KEY=APIbLLHJzVJJEei LIVEKIT_API_SECRET=ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE LIVEKIT_URL = "wss://livekit-server-dev.enteract.cloud" LIVEKIT_PORT = 8082 LIVEKIT_URL_TURN = "livekit-server-dev.enteract.cloud" LIVEKIT_TURN_PORT = 8365 yaml: port: 7880 log_level: info rtc: tcp_port: 7881 port_range_start: 50000 port_range_end: 60000 redis: address: localhost:6379 keys: APIbLLHJzVJJEei: ZSLMLLihE5l8sauRKnmNRIFm9nvC73Yf3k96QOWzbgE turn: enabled: true tls_port: 8365 domain: livekit-server-dev.enteract.cloud cert_file: /etc/pki/tls/certs/star.enteract.cloud.crt key_file: /etc/pki/tls/private/star.enteract.cloud.key nginx conf: map $http_upgrade $connection_upgrade { default upgrade; '' close; } server { listen 443 ssl; server_name livekit-server-dev.enteract.cloud; # SSL configurations ssl_certificate /etc/pki/tls/certs/star.enteract.cloud.crt; ssl_certificate_key /etc/pki/tls/private/star.enteract.cloud.key; ssl_trusted_certificate /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem; ssl_stapling on; ssl_stapling_verify on; ssl_verify_depth 2; access_log /var/log/nginx/livekit-server-dev-access.log; error_log /var/log/nginx/livekit-server-dev-error.log warn; location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto $scheme; # WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; port_in_redirect off; proxy_pass http://livekit-server-dev/; proxy_buffers 80 160k; proxy_buffer_size 160k; add_header X-Frame-Options "ALLOWALL"; } } # Upstream for WebSocket backend upstream livekit-server-dev { server 127.0.0.1:8496; } # Internal backend listener (optional, for reference) server { listen 8496; server_name livekit-server-dev.enteract.cloud; location / { include proxy_params; # WebSocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_pass http://127.0.0.1:7880; } } Can you identify the issue here? The server and the agent don't connect.
t
It looks like the issue might be connected to the WebSocket routing and the upstream configuration in your NGINX setup. Let’s walk through some adjustments and checks together to get this sorted out: 1. Update the Upstream Configuration: Right now, your upstream block points to port 
8496
, but since the LiveKit server is running on port 
7880
, updating this will help. Here’s how you can update the upstream block:
Copy code
upstream livekit-server-dev {
    server 127.0.0.1:7880;
}
2. Verify the Proxy Pass: In the 
location /
block, double-check that the 
proxy_pass
directive points to the updated upstream like this:
Copy code
proxy_pass <http://127.0.0.1:7880;>
3. Check WebSocket Headers: Your WebSocket headers seem to be set up correctly. Just make sure the 
$connection_upgrade
variable is properly defined in your NGINX configuration as shown here:
Copy code
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}
4. Test Connectivity: • Confirm that the LiveKit server is up and running on port 
7880
. • Try testing the WebSocket connection with a tool like 
wscat
to see if 
<wss://livekit-server-dev.enteract.cloud>
is reachable. 5. Restart Services: • Once you’ve made these changes, restart NGINX using 
nginx -s reload
. • Also, restart the LiveKit server to make sure all the new settings take effect. If you run into any more issues or need a hand with anything else, please don’t hesitate to reach out. I’m here to help!
a
The above exception was the direct cause of the following exception:\n\nTraceback (most recent call last):\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/livekit/agents/worker.py\", line 653, in _connection_task\n ws = await self._http_session.ws_connect(\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/aiohttp/client.py\", line 1061, in _ws_connect\n resp = await self.request(\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/aiohttp/client.py\", line 770, in _request\n resp = await handler(req)\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/aiohttp/client.py\", line 725, in _connect_and_send_request\n conn = await self._connector.connect(\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/aiohttp/connector.py\", line 622, in connect\n proto = await self._create_connection(req, traces, timeout)\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/aiohttp/connector.py\", line 1189, in _create_connection\n _, proto = await self._create_direct_connection(req, traces, timeout)\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/aiohttp/connector.py\", line 1561, in _create_direct_connection\n raise last_exc\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/aiohttp/connector.py\", line 1530, in _create_direct_connection\n transp, proto = await self._wrap_create_connection(\n File \"/var/www/bot-crm-dev/venv/lib/python3.10/site-packages/aiohttp/connector.py\", line 1265, in _wrap_create_connection\n raise ClientConnectorCertificateError(req.connection_key, exc) from exc\naiohttp.client_exceptions.ClientConnectorCertificateError: Cannot connect to host livekit-server-dev.enteract.cloud:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1017)')]", "timestamp": "2025-10-16T104947.335500+00:00"} What does this error mean?
t
It looks like the error is telling us that the SSL certificate for 
livekit-server-dev.enteract.cloud
couldn’t be verified. This usually happens when the client can’t validate the certificate chain because an intermediate certificate might be missing or incorrect. Don’t worry, I’m here to help you through it! Here’s what you can do: 1. Verify the Certificate Chain: First, double-check that the 
ssl_trusted_certificate
in your NGINX configuration includes the full certificate chain, which means the root and intermediate certificates. You can update your NGINX configuration like this:
Copy code
ssl_certificate /etc/pki/tls/certs/star.enteract.cloud.crt;
ssl_certificate_key /etc/pki/tls/private/star.enteract.cloud.key;
ssl_trusted_certificate /etc/pki/tls/certs/star.enteract.cloud.ca-bundle.pem;
2. Test the Certificate: Next, try running this command to check the certificate chain:
Copy code
openssl s_client -connect livekit-server-dev.enteract.cloud:443 -showcerts
This will help you see if the full chain is being presented and is valid. 3. Update the Client: If your client is using a custom CA bundle, make sure it includes the intermediate certificates. If you’re just testing and want a quick workaround (though not recommended for production), you can disable SSL verification temporarily like this:
Copy code
verify_ssl=False
4. Restart NGINX: Finally, after you’ve updated the certificate settings, don’t forget to restart NGINX to apply the changes:
Copy code
nginx -s reload
If you run into any trouble or have questions along the way, just let me know—I’m here to help!
Open in Slack
PreviousNext
Powered by