From b0d928d0f2b9d79b074e543382145f28e1ecb594 Mon Sep 17 00:00:00 2001
From: Henry-Hiles <henry@henryhiles.com>
Date: Sat, 17 Oct 2026 20:56:05 -0400
Subject: [PATCH] use nixpkgs#548367

---
 clients/quadraticserver/matrix/call.nix | 16 +++++++++++++---
 flake.lock                              | 13 +++++++++++++
 flake.nix                               |  5 +++++
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/clients/quadraticserver/matrix/call.nix b/clients/quadraticserver/matrix/call.nix
index aff7a36..791ae24 100644
--- a/clients/quadraticserver/matrix/call.nix
+++ b/clients/quadraticserver/matrix/call.nix
@@ -1,6 +1,7 @@
 {
   lib,
   config,
+  inputs,
   ...
 }:
 
@@ -9,6 +10,10 @@ let
   lkJwtServiceDomain = "lk-jwt.call.federated.nexus";
 in
 {
+  # TODO: remove once https://github.com/NixOS/nixpkgs/pull/548367 is merged
+  disabledModules = [ "services/matrix/lk-jwt-service.nix" ];
+  imports = [ inputs.lk-jwt-service-module.outPath ];
+
   systemd.services = {
     livekit.serviceConfig.Restart = lib.mkForce "always";
     lk-jwt-service.serviceConfig.Restart = lib.mkForce "always";
@@ -31,13 +36,18 @@ in
 
     lk-jwt-service = {
       enable = true;
-      livekitUrl = "wss://${livekitDomain}";
-      keyFile = config.services.livekit.keyFile;
+      environment = {
+        LIVEKIT_URL = "wss://${livekitDomain}";
+        LIVEKIT_KEY_FILE = config.services.livekit.keyFile;
+        LIVEKIT_JWT_BIND = "127.0.0.4:8080";
+        LIVEKIT_FULL_ACCESS_HOMESERVERS = [ "federated.nexus" ];
+      };
     };
 
     caddy.virtualHosts = {
       "${livekitDomain}".extraConfig = "reverse_proxy 127.0.0.1:7880";
-      "${lkJwtServiceDomain}".extraConfig = "reverse_proxy 127.0.0.1:8080";
+      "${lkJwtServiceDomain}".extraConfig =
+        "reverse_proxy ${config.services.lk-jwt-service.environment.LIVEKIT_JWT_BIND}";
     };
   };
 }
diff --git a/flake.lock b/flake.lock
index 8f5045b..7601d55 100644
--- a/flake.lock
+++ b/flake.lock
@@ -738,6 +738,18 @@
         "url": "https://git.federated.nexus/Henry-Hiles/lasuite_docs_proxy"
       }
     },
+    "lk-jwt-service-module": {
+      "flake": false,
+      "locked": {
+        "narHash": "sha256-UkmiOkQFrQTzbPK3mjyobI9WnYB2zruLiMOgLYY/V40=",
+        "type": "file",
+        "url": "https://raw.githubusercontent.com/j0hax/nixpkgs/lk-jwt-service-restructure/nixos/modules/services/matrix/lk-jwt-service.nix"
+      },
+      "original": {
+        "type": "file",
+        "url": "https://raw.githubusercontent.com/j0hax/nixpkgs/lk-jwt-service-restructure/nixos/modules/services/matrix/lk-jwt-service.nix"
+      }
+    },
     "matrixoidc": {
       "inputs": {
         "flake-parts": "flake-parts_7",
@@ -1079,6 +1091,7 @@
         "flake-parts": "flake-parts_5",
         "home-manager": "home-manager",
         "lasuite-docs-proxy": "lasuite-docs-proxy",
+        "lk-jwt-service-module": "lk-jwt-service-module",
         "matrixoidc": "matrixoidc",
         "nexus": "nexus",
         "nexusbot": "nexusbot",
diff --git a/flake.nix b/flake.nix
index 9e5b402..35f2ac2 100755
--- a/flake.nix
+++ b/flake.nix
@@ -79,6 +79,11 @@
       url = "github:Silvenga/redlib";
       flake = false;
     };
+    # TODO: remove once https://github.com/NixOS/nixpkgs/pull/548367 is merged
+    lk-jwt-service-module = {
+      url = "file+https://raw.githubusercontent.com/j0hax/nixpkgs/lk-jwt-service-restructure/nixos/modules/services/matrix/lk-jwt-service.nix";
+      flake = false;
+    };
   };
 
   outputs =