[melvincarvalho]

New page: Element Call and LiveKit (docs/deployment/element-call.md)

Explains how to self-host the MatrixRTC backend next to Synapse 1.163:

• what Element Call and MatrixRTC are, and how they differ from legacy 1:1 VoIP and TURN;
• the components (LiveKit SFU, lk-jwt-service) and how a call is set up;
• the LiveKit key, a minimal livekit.yaml, and optional built-in TURN/TLS;
• lk-jwt-service env vars, including LIVEKIT_FULL_ACCESS_HOMESERVERS and room.auto_create: false;
• Caddy and nginx routes;
• Synapse settings, matrix_rtc (livekit_service_url versus url), and the .well-known rtc_foci transition;
• application-service mode (MSC4502/MSC4512), summarised and linked;
• firewall ports, checks and common failures.

The page has two :::warning notes (the API key and secret, an open SFU, and appservice tokens) and a :::info Coming next note (MSC4143 and MSC4195 entered FCP on 2026-10-15).

Also in this PR:

• a sidebar entry under Deployment, after Docker;
• one linking sentence in docs/deployment/docker.md.

Versions verified (2026-10-18)

• Synapse 1.163.0 (local pinned clone)
• Element Call v0.28.0 (2026-10-13)
• Element Web v1.12.32 (bundles element-call-embedded 0.26.0)
• lk-jwt-service v0.9.0 (2026-10-13)
• LiveKit v1.13.10 (2026-10-14)

All versions come from the GitHub releases API. Image tags were checked in the registries:

• livekit/livekit-server:v1.13.10 on Docker Hub;
• ghcr.io/element-hq/lk-jwt-service:0.9.0 on GHCR.

How each config block was checked

• homeserver.yaml:
  • Every key is in the Synapse 1.163 schema, and the gate validates the block.
  • The msc4143_enabled and msc4222_enabled flags are in synapse/config/experimental.py.
  • msc3266_enabled was removed in 1.153 (CHANGES.md), so it is left out.
  • The transports endpoint is only registered when msc4143_enabled is set (synapse/rest/client/matrixrtc.py).
  • The url and livekit_service_url semantics come from the schema and from upgrade.md for 1.161.
• livekit.yaml:
  • Keys come from config-sample.yaml at v1.13.10.
  • The auto_create default of true and the warning for secrets under 32 characters come from pkg/config/config.go.
  • The root path returns OK (pkg/service/server.go).
  • The image entrypoint is livekit-server (Dockerfile).
• lk-jwt-service env:
  • Variable names come from the README and from src/config.rs at v0.9.0.
  • Routes (/sfu/get, /get_token, /healthz, /sfu_webhook) come from src/handler.rs.
  • Restricted users cannot publish (can_publish).
  • In AS mode, the url must match LIVEKIT_URL (require_matching_lk_url).
  • The membership check depends on there being a single full-access homeserver (src/main.rs).
• Reverse proxy:
  • The nginx block is from the Element Call v0.28.0 self-hosting guide.
  • The Caddy block routes the whole /livekit/jwt/ prefix, because Element Call 0.28.0 calls /get_token (src/livekit/openIDSFU.ts). The guide's own Caddy and HAProxy examples miss that path.
• .well-known rtc_foci:
  • Element Call stopped reading it in v0.24.0 (checked in RtcTransportAutoDiscovery.ts at each tag).
  • Element Web 1.12.32 uses it only as a fallback (CallStore.ts).
  • The MDAD changelog entry of 2026-08-20 records the MISSING_MATRIX_RTC_TRANSPORT breakage.
• MSC status: labels on MSC4143, MSC4195, MSC4502 and MSC4512 were read through the GitHub API.
• Gate: tools/gate.sh reports 0. The unstable org.matrix.msc4143/rtc/transports curl example carries snippet:skip, with the reason given (it is not in spec v1.19 and was checked in the Synapse source).
• Build: tools/build.sh passes.

Links checked

Every external link returned 200 with curl -sIL -A 'Mozilla/5.0':

• Element Call guide and source at v0.28.0;
• lk-jwt-service README at v0.9.0;
• LiveKit config sample at v1.13.10, plus the LiveKit self-hosting and ports docs;
• Synapse v1.163 config manual and upgrade.md;
• MSC4143, MSC4195, MSC4502 and MSC4512;
• the MDAD changelog, ess-helm, testmatrix and sspaeth.de.

Internal links and anchors are checked by the build.