docs/hub: update Element Calling port guidance to the new port set

User-facing polish to match the element-calling port changes:

- helpers.js: port-forward guide example now shows the 40000-40099 range
  instead of the removed 30000-40000.
- versions.json: livekit dev fallback 1.5.2 -> 1.13.6 (the Nix-generated
  version in sovran-hub.nix already derives from pkgs.livekit.version).
- server.py: docstring/comment examples reference 40000-40099.
- CHANGELOG.md: record the calling changes under [Unreleased].

The tile/modal port tables themselves are data-driven from server.py's
port_requirements / _PORTS_ELEMENT_CALLING (updated in the previous commit),
so no further UI changes are needed.

CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [Unreleased]
+
+### Changed
+- Element Calling: pin LiveKit to 1.13.6 and advertise the LAN interface
+  (rtc.advertise_internal_ip) so Wi-Fi callers get a local ICE candidate and
+  calls no longer depend on router NAT hairpin
+- Element Calling: use a single UDP media mux (7882); move the TURN relay to
+  40000-40099 and remove the unreachable 5349 TURN/TLS listener
+- Hub: update Element Calling router-port guidance to the new port set
+
+### Fixed
+- Element Calling: TURN relay could not deliver media to the SFU on routers
+  without NAT loopback (turn.allow_restricted_peer_cidrs now permits the LAN
+  subnet derived from the primary interface)
+
 ## [1.1.3] - 2026-08-27
 
 ### Added

app/sovran_systemsos_web/server.py

@@ -291,11 +291,10 @@ FEATURE_REGISTRY = [
         "port_requirements": [
             {"port": "80",          "protocol": "TCP",     "description": "HTTP (redirect to HTTPS)"},
             {"port": "443",         "protocol": "TCP",     "description": "HTTPS (domain)"},
-            {"port": "7881",        "protocol": "TCP",     "description": "LiveKit WebRTC signalling"},
-            {"port": "7882",        "protocol": "UDP",     "description": "LiveKit media (UDP mux)"},
-            {"port": "5349",        "protocol": "TCP",     "description": "TURN over TLS"},
-            {"port": "3478",        "protocol": "UDP",     "description": "TURN (STUN/relay)"},
-            {"port": "30000-40000", "protocol": "TCP/UDP", "description": "TURN relay (WebRTC)"},
+            {"port": "7881",        "protocol": "TCP",     "description": "WebRTC media (TCP fallback)"},
+            {"port": "7882",        "protocol": "UDP",     "description": "WebRTC media (UDP)"},
+            {"port": "3478",        "protocol": "UDP",     "description": "TURN relay + STUN"},
+            {"port": "40000-40099", "protocol": "UDP",     "description": "TURN relay (WebRTC media)"},
         ],
     },
     {
@@ -395,11 +394,10 @@ FEATURE_SERVICE_MAP = {
 
 # Port requirements for service tiles (keyed by unit name or icon)
 _PORTS_ELEMENT_CALLING = [
-    {"port": "7881",        "protocol": "TCP",     "description": "LiveKit WebRTC signalling"},
-    {"port": "7882",        "protocol": "UDP",     "description": "LiveKit media (UDP mux)"},
-    {"port": "5349",        "protocol": "TCP",     "description": "TURN over TLS"},
-    {"port": "3478",        "protocol": "UDP",     "description": "TURN (STUN/relay)"},
-    {"port": "30000-40000", "protocol": "TCP/UDP", "description": "TURN relay (WebRTC)"},
+    {"port": "7881",        "protocol": "TCP",     "description": "WebRTC media (TCP fallback)"},
+    {"port": "7882",        "protocol": "UDP",     "description": "WebRTC media (UDP)"},
+    {"port": "3478",        "protocol": "UDP",     "description": "TURN relay + STUN"},
+    {"port": "40000-40099", "protocol": "UDP",     "description": "TURN relay (WebRTC media)"},
 ]
 
 # Units whose port requirements exist purely so the user can forward them in
@@ -1114,7 +1112,7 @@ def _get_firewall_allowed_ports() -> dict[str, set[int]]:
         )
         if proc.returncode == 0:
             for line in proc.stdout.splitlines():
-                # e.g. ACCEPT tcp  -- ... dpt:443  or  dpts:7882:7894
+                # e.g. ACCEPT tcp  -- ... dpt:443  or  dpts:40000:40099
                 m = re.search(r'(tcp|udp).*dpts?:(\d+)(?::(\d+))?', line)
                 if m:
                     proto_match = m.group(1)
@@ -1172,7 +1170,7 @@ def _resolve_all_addresses_cached(domain: str) -> list[str]:
 
 
 def _port_range_to_ints(port_str: str) -> list[int]:
-    """Convert a port string like ``"443"``, ``"30000-40000"`` to a list of ints."""
+    """Convert a port string like ``"443"``, ``"40000-40099"`` to a list of ints."""
     port_str = port_str.strip()
     if re.match(r'^\d+$', port_str):
         return [int(port_str)]

app/sovran_systemsos_web/static/js/helpers.js

@@ -88,7 +88,7 @@ function renderPortForwardGuideHtml(ports, opts) {
     '<ul class="port-req-steps">' +
       '<li>Set the <strong>internal (private) port</strong> and the <strong>external (public) port</strong> to the <strong>same number</strong>.</li>' +
       '<li>Match the <strong>protocol</strong> exactly — a rule set to TCP will not pass UDP traffic. Where the table says <strong>TCP + UDP</strong>, create both rules (or pick &ldquo;Both&rdquo;/&ldquo;TCP/UDP&rdquo; if your router offers it).</li>' +
-      '<li>For a range such as <strong>30000-40000</strong>, use your router&rsquo;s port-range fields — start 30000, end 40000 — rather than one rule per port.</li>' +
+      '<li>For a range such as <strong>40000-40099</strong>, use your router&rsquo;s port-range fields — start 40000, end 40099 — rather than one rule per port.</li>' +
     '</ul>' +
     '<table class="' + tableClass + '">' +
       '<thead><tr><th>Port(s)</th><th>Protocol</th><th>Used for</th></tr></thead>' +

app/sovran_systemsos_web/versions.json

@@ -10,7 +10,7 @@
   "albyhub.service": "1.24.0",
   "mempool.service": "3.2.1",
   "matrix-synapse.service": "1.115.0",
-  "livekit.service": "1.5.2",
+  "livekit.service": "1.13.6",
   "vaultwarden.service": "1.32.0",
   "haven-relay.service": "0.1.0"
 }

flake.nix

@@ -19,6 +19,24 @@
 				system = prev.stdenv.hostPlatform.system;
 				config.allowUnfree = true;
 			};
+
+			# Pin LiveKit to 1.13.6: element-calling.nix sets
+			# rtc.advertise_internal_ip, which gives LAN callers a host candidate
+			# so calls work on Wi-Fi without the router needing NAT-hairpin. That
+			# flag is only honoured when node_ip is set manually from LiveKit
+			# v1.13.6 (mediatransportutil f234b53); nixpkgs-unstable currently
+			# ships 1.13.5. Remove this override once nixpkgs-unstable reaches
+			# >= 1.13.6.
+			livekit = prev.livekit.overrideAttrs (old: {
+				version = "1.13.6";
+				src = prev.fetchFromGitHub {
+					owner = "livekit";
+					repo = "livekit";
+					rev = "v1.13.6";
+					hash = "sha256-sUAx6ooeEUUqot5xuZv7xiQa3DdRFVULteTwYgFUzCI=";
+				};
+				vendorHash = "sha256-nOGSmoNuQQm/sIVI1HojsiS4GkbhA68uYMQ6X7d4a5Q=";
+			});
 		};
 	in
 	{

modules/element-calling.nix

@@ -185,6 +185,14 @@ EOF
       fi
       echo "Detected primary network interface: $IFACE"
 
+      # Derive the LAN subnet this box sits on so the embedded TURN relay
+      # is allowed to hand media to LiveKit's LAN host candidate (see the
+      # allow_restricted_peer_cidrs block below). Computed from the primary
+      # interface's own address, so it always matches the subnet the LAN
+      # clients (phones on Wi-Fi) actually live on.
+      LAN_CIDR=$(ip -4 -o addr show dev "$IFACE" | awk '{print $4}' | grep -vE '^(127\.|169\.254\.)' | head -n1 | python3 -c 'import sys, ipaddress; s = sys.stdin.read().strip(); print(str(ipaddress.ip_network(s, strict=False)) if s else "")' 2>/dev/null)
+      echo "Derived LAN CIDR for TURN relay: ${LAN_CIDR:-<none>}"
+
       # Generate the full LiveKit config the daemon will load. turn.domain and
       # rtc.interfaces.includes are only known at runtime, so they are
       # substituted here. The cert/key paths point at the LoadCredential-staged
@@ -229,10 +237,9 @@ port: 7880
 rtc:
   use_external_ip: false
   node_ip: $PUBLIC_IP
+  advertise_internal_ip: true
   tcp_port: 7881
   udp_port: 7882
-  port_range_start: 30000
-  port_range_end: 40000
   interfaces:
     includes:
       - $IFACE
@@ -244,10 +251,9 @@ port: 7880
 rtc:
   use_external_ip: true
   skip_external_ip_validation: true
+  advertise_internal_ip: true
   tcp_port: 7881
   udp_port: 7882
-  port_range_start: 30000
-  port_range_end: 40000
   interfaces:
     includes:
       - $IFACE
@@ -264,16 +270,37 @@ EOF
       # vhost (/livekit/jwt/sfu_webhook → 8073).
       LK_KEY=$(cut -d: -f1 < ${livekitKeyFile} | tr -d '[:space:]')
 
+      # TURN/TLS is intentionally not configured (no tls_port): LiveKit
+      # advertises turns:<domain>:443 to clients regardless of tls_port, so
+      # a 5349 TURN/TLS listener would be unreachable and only adds attack
+      # surface. The staged cert/key stay for a future TURN/TLS-on-443
+      # (Caddy layer4 SNI) setup.
       cat >> /run/livekit/livekit.yaml <<EOF
 room:
   auto_create: false
 turn:
   enabled: true
   domain: $MATRIX
-  tls_port: 5349
   udp_port: 3478
+  relay_range_start: 40000
+  relay_range_end: 40099
   cert_file: /run/credentials/livekit.service/turn-cert
   key_file: /run/credentials/livekit.service/turn-key
+EOF
+
+      # By default the embedded TURN relay refuses to send media to
+      # private/loopback peers. That would force its final hop to the
+      # public/WAN IP (hairpin NAT) — exactly what breaks calls on routers
+      # without NAT loopback. Allow the LAN subnet so the relay can deliver
+      # directly to LiveKit's LAN host candidate instead.
+      if [ -n "$LAN_CIDR" ]; then
+        cat >> /run/livekit/livekit.yaml <<EOF
+  allow_restricted_peer_cidrs:
+    - $LAN_CIDR
+EOF
+      fi
+
+      cat >> /run/livekit/livekit.yaml <<EOF
 webhook:
   api_key: $LK_KEY
   urls:
@@ -315,10 +342,14 @@ EOF
     "turn-key:/var/lib/livekit/turn.key"
   ];
 
-  networking.firewall.allowedTCPPorts = [ 5349 7881 ];
+  # 5349/TCP (TURN/TLS) is deliberately absent — see livekit-turn-setup. RTC
+  # media uses the single UDP mux (7882); the 30000-40000 range is gone so
+  # media is no longer spread across 10000 ports. The TURN relay allocation
+  # range (40000-40099) is kept separate from the media mux.
+  networking.firewall.allowedTCPPorts = [ 7881 ];
   networking.firewall.allowedUDPPorts = [ 3478 7882 ];
   networking.firewall.allowedUDPPortRanges = [
-    { from = 30000; to = 40000; } # LiveKit internal TURN relay range
+    { from = 40000; to = 40099; } # LiveKit embedded TURN relay allocation range
   ];
 
   ####### JWT SERVICE RUNTIME CONFIG #######