From 302eb4323341904d55b23b903656ca12797a10b0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 24 Jun 2026 01:21:05 +0000
Subject: [PATCH] fix: deliver livekit config via LoadCredential to fix
 DynamicUser permission denied

---
 modules/element-calling.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/modules/element-calling.nix b/modules/element-calling.nix
index 014b941..c49163e 100755
--- a/modules/element-calling.nix
+++ b/modules/element-calling.nix
@@ -144,7 +144,7 @@ turn:
   key_file: /run/credentials/livekit.service/turn-key
 EOF
 
-      chmod 640 /run/livekit/livekit.yaml
+      chmod 644 /run/livekit/livekit.yaml
     '';
   };
 
@@ -174,10 +174,11 @@ EOF
   # weakening it. Everything else about the standard unit is left intact.
   systemd.services.livekit.serviceConfig.ExecStart = lib.mkForce [
     ""
-    "${pkgs.livekit}/bin/livekit-server --config /run/livekit/livekit.yaml --key-file /run/credentials/livekit.service/livekit-secrets"
+    "${pkgs.livekit}/bin/livekit-server --config /run/credentials/livekit.service/livekit-config --key-file /run/credentials/livekit.service/livekit-secrets"
   ];
 
   systemd.services.livekit.serviceConfig.LoadCredential = [
+    "livekit-config:/run/livekit/livekit.yaml"
     "livekit-secrets:${livekitKeyFile}"
     "turn-cert:/var/lib/livekit/turn.crt"
     "turn-key:/var/lib/livekit/turn.key"