- Shipped
- August 5, 2026 at 1:33 AM UTC
- Author
- Kamo
- Commit
- 1a1a7dd
The bridge never completed a single ICE connection in the 35 days this pod has been up (0 successes, 18 terminations). Every conference joined over XMPP fine and then sat there with no audio or video until the client gave up and showed "Something went wrong". Cause: Meet/jvb's own /etc/cont-init.d/10-config derives the NAT mapping's local address from `ip route get 1`. On this pod's last start the node had no default route yet, so LOCAL_ADDRESS came out empty, the rendered jvb.conf got `local-address = ""`, ice4j resolved that to 127.0.0.1, and the resulting **************** mask=47.181.8.84) matched no harvested candidate. The STUN mapping harvester — the only other source of a public address — died at the same moment on "unresolved address" because cluster DNS was not up either (stunDiscoveryFailed=true). The bridge therefore offered clients only 10.42.0.151 (cilium), 10.8.1.1 (wg0) and 10.0.50.0 (eno50), none of which any browser can reach, and it bound UDP/10000 on those three addresses only — never on 192.168.4.22, which is where the router actually delivers media (verified: UDP probes to 47.181.8.84:10000 arrive on eno49 at 192.168.4.22:10000). Both inputs were sampled once, at startup, and never revisited, so the pod stayed broken for its whole lifetime while looking perfectly healthy. - Add an init container that blocks (visibly, as Init:0/1) until the node has a default route with the expected source address and DNS resolves, then writes /config/custom-jvb.conf — jvb.conf ends with `include "custom-jvb.conf"`, so it overrides the templated values. It pins ICE harvesting to the node address and maps it to the public address explicitly, instead of trusting a derivation that silently yields "". - Use getent, not dig, for the DNS wait: dig segfaults in this image (exit 139), which is also the source of the `any valid prefix is expected rather than ";;"` line the image logs on every start. - Back /config with an emptyDir so the init container can seed it. - Set JVB_WS_DOMAIN: the image otherwise falls back to PUBLIC_URL and advertises the colibri-ws URL as wss://localhost:8443/..., which no browser can reach. (Latent today — lib-Meet-meet prefers SCTP when both are offered.) - Add the jvb-k1m1 Service: the meet nginx proxies /colibri-ws/<server-id>/ to **************** and no such name existed. - Point the Meet-jvb Service's colibri port at 9090; 8080 on this hostNetwork node is CockroachDB. - Drop the dead OCTOR_RELAY_ID typo and the deprecated DOCKER_HOST_ADDRESS.