SimpleTwo · Control Plane

Two private networks, and the split matters. Network B holds the database: only postgres and messaging are on it. Network A holds the SFU pool: redis and the livekit nodes. Keeping them apart is what makes “an SFU cannot reach the database” a fact about routing rather than a firewall rule somebody has to keep true — an SFU is a large third-party binary listening on the public internet, and it has no business sharing a network with the database. The coordinator has a leg in each; nothing else spans both.

The one rule that silently breaks calls. A private address must never be advertised to clients. “Private address” goes in the host’s private address field; the address clients use goes in node IP for an SFU. Put a private address in the second one and every call connects, carries no media and times out with nothing in any log.

Order. 1) postgres → 2) messaging (then redeploy postgres once: the access rule is narrowed to the messaging host’s /32 and cannot be written before that host exists) → 3) redis → 4) livekit node A → 5) livekit node B → 6) turn. A second SFU node without redis is refused: two nodes without the bus each keep their own room table, so two people “in the same room” on different nodes cannot see each other and nothing reports a problem.

Sizing to start. postgres 2 vCPU / 4 GB / 40 GB SSD · messaging 2 vCPU / 4 GB (attachments live on its disk until S3 exists) · redis 1 vCPU / 1 GB (it holds room routing, not data) · each livekit 4 vCPU / 8 GB and real bandwidth — an SFU forwards every stream to every participant, so egress is the limit long before CPU · turn 2 vCPU / 2 GB, bandwidth-bound for the same reason · support 1 vCPU / 1 GB / 10 GB — two small Go daemons and a JSON state file; the thinking happens on the model provider's side, so it never grows with load the way media hosts do. Deploy it last: it needs messaging live and the Support provisioning (Settings) run, in either order.

Ports the deploy opens for you (host firewall, when ufw or firewalld is present): livekit 7880/tcp, 7881/tcp, 50000-60000/udp · turn 3478/udp+tcp and 49152-65535/udp · messaging its listen port, plus 443 when it terminates its own TLS. Redis is the exception: 6379 is opened only to the SFU nodes’ addresses, never to the world, and on a host with no firewall tooling the deploy fails rather than leave a database reachable.

Certificates. messaging obtains its own (autocert) for the hostname you set under Settings. An SFU needs TLS in front of 7880 for iOS to connect at all, and an enrolled host no longer needs you to arrange that: the coordinator runs the ACME order and the host serves the one challenge file, because the name points at the host while the account key stays here. The edge front then terminates 443 and proxies every path to 7880 — every path, since moderation arrives on the same host and port as the client’s WebSocket, and a front that forwards only the socket breaks mute and remove while calls still look fine.