### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2026 年 4 月 19 日午前 8:10 UTC](https://forum.ficusonline.com/t/topic/555/2 "2026-04-19T08:10:39Z")
## 音声・ビデオ通話（グループ通話）対応
### MatrixRTC
> **[Matrix RTC (Element Call) - Tuwunel One](https://matrix-construct.github.io/tuwunel/calls/matrix_rtc.html)**
>
> Tuwunel, a high performance successor to Conduit and Conduwuit
* * *
### MatrixRTC Authorization Service
> **[GitHub - element-hq/lk-jwt-service: Minimal service to issue LiveKit JWTs for...](https://github.com/element-hq/lk-jwt-service)**
>
> Minimal service to issue LiveKit JWTs for MatrixRTC
-
##### JWT (JSON Web Token)
> **[RFC 7519: JSON Web Token (JWT)](https://datatracker.ietf.org/doc/html/rfc7519)**
>
> JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext...
* * *
### LiveKit
> **[GitHub - livekit/livekit: End-to-end realtime stack for connecting humans...](https://github.com/livekit/livekit)**
>
> End-to-end realtime stack for connecting humans and AI
-
##### ドキュメント
> **[About LiveKit | LiveKit Documentation](https://docs.livekit.io/intro/about/)**
>
> An overview of the LiveKit ecosystem.
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2026 年 4 月 22 日午前 4:05 UTC](https://forum.ficusonline.com/t/topic/555/3 "2026-04-22T04:05:35Z")
## Element : Matrixクライアント
Elementから提供されている以下のオープンソースMatrixクライアントで、音声・ビデオ通話、メッセージを送受信。
#### element x android
> **[GitHub - element-hq/element-x-android: Android Matrix messenger application using the...](https://github.com/element-hq/element-x-android)**
>
> Android Matrix messenger application using the Matrix Rust Sdk and Jetpack Compose
#### element x ios
> **[GitHub - element-hq/element-x-ios: Next generation Matrix client for iOS built with...](https://github.com/element-hq/element-x-ios)**
>
> Next generation Matrix client for iOS built with SwiftUI on top of matrix-rust-sdk.
#### element web
ウェブアプリ
> **[GitHub - element-hq/element-web: A glossy Matrix collaboration client for the web.](https://github.com/element-hq/element-web)**
>
> A glossy Matrix collaboration client for the web.
* * *
#### element-call
上記アプリの音声・ビデオ通話機能は、以下のelement-callが担っています。
> **[GitHub - element-hq/element-call: Group calls powered by Matrix](https://github.com/element-hq/element-call)**
>
> Group calls powered by Matrix
#### Self-Hosting Element Call
>
参考
> **[End-to-end encrypted voice and video for self-hosted community users](https://element.io/blog/end-to-end-encrypted-voice-and-video-for-self-hosted-community-users/)**
>
> Those self-hosting a homeserver outside of ESS will need to deploy their own MatrixRTC infrastructure.
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2026 年 4 月 22 日午前 7:03 UTC](https://forum.ficusonline.com/t/topic/555/4 "2026-04-22T07:03:03Z")
システム構成
構成ファイル
`docker-compose.yaml`
```yaml
services:
caddy:
image: lucaslorentz/caddy-docker-proxy:ci-alpine
container_name: caddy
ports:
- 80:80
- 443:443
environment:
- CADDY_INGRESS_NETWORKS=caddy
- CADDY_DOCKER_CADDYFILE_PATH=/config/caddy/Caddyfile
networks:
- caddy
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./data:/data
- ./Caddyfile:/config/caddy/Caddyfile
restart: unless-stopped
extra_hosts:
- "host.docker.internal:host-gateway"
homeserver:
image: jevolk/tuwunel:latest
container_name: tuwunel
restart: unless-stopped
volumes:
- ./db:/var/lib/tuwunel
- ./tuwunel.toml:/etc/tuwunel.toml
environment:
TUWUNEL_CONFIG: '/etc/tuwunel.toml'
networks:
- caddy
matrix-rtc-jwt:
image: ghcr.io/element-hq/lk-jwt-service:latest
container_name: jwt
environment:
- LIVEKIT_JWT_BIND=:8081
- LIVEKIT_URL=wss://matrix-rtc.example.com
- LIVEKIT_KEY=${MRTCKEY}
- LIVEKIT_SECRET=${MRTCSECRET}
- LIVEKIT_FULL_ACCESS_HOMESERVERS=matrix.example.com
restart: unless-stopped
networks:
- caddy
matrix-rtc-livekit:
image: livekit/livekit-server:latest
container_name: livekit
command: --config /etc/livekit.yaml
restart: unless-stopped
volumes:
- ./livekit.yaml:/etc/livekit.yaml:ro
network_mode: "host"
# Certbot just only for Coturn TLS
certbot:
image: certbot/dns-cloudflare
container_name: certbot
restart: unless-stopped
volumes:
- ./certbot/certs:/etc/letsencrypt
- ./certbot/cloudflare.ini:/etc/letsencrypt/cloudflare.ini:ro
- /var/run/docker.sock:/var/run/docker.sock
- ./certbot/deploy-hook.sh:/etc/letsencrypt/renewal-hooks/deploy/restart-coturn.sh:ro
entrypoint: /bin/sh -c
command: >
"certbot certonly
--dns-cloudflare
--dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini
--dns-cloudflare-propagation-seconds 30
-d turn.example.com
--email example@gmail.com
--agree-tos
--non-interactive
&& trap exit TERM;
while :; do
sleep 12h &
wait $${!};
certbot renew --quiet;
done"
coturn:
image: docker.io/coturn/coturn
container_name: coturn
restart: unless-stopped
network_mode: host
user: root
volumes:
- ./turnserver.conf:/etc/coturn/turnserver.conf
- ./certbot/certs:/etc/letsencrypt:ro
networks:
caddy:
external: true
```
> 注）
> - LIVEKIT\_KEY=${MRTCKEY} —\> “$ pwgen -s 20 1” で生成した文字列を.envに記載
> - LIVEKIT\_SECRET=${MRTCSECRET} ”$ pwgen -s 64 1”で生成した文字列を.envに記載
> - ヘルスチェック
> $ curl -v [https://matrix-rtc.example.com/healthz](https://matrix-rtc.example.com/healthz)
> - JWT serviceの動作確認
> $ curl -s -X POST “[https://matrix-rtc.example.com/sfu/get?roomName=test&deviceId=test](https://matrix-rtc.example.com/sfu/get?roomName=test&deviceId=test)” -H “Authorization: Bearer dummy” | python3 -m json.tool
`Caddyfile`
```json
matrix.example.com {
handle /.well-known/matrix/server {
header Content-Type "application/json"
respond `{"m.server":"matrix.example.com:443"}`
}
handle /.well-known/matrix/client {
header Access-Control-Allow-Origin "*"
header Content-Type "application/json"
respond `{"m.homeserver":{"base_url":"https://matrix.example.com"},"org.matrix.msc3575.proxy":{"url":"https://matrix.example.com"},"m.identity_server":{"base_url":"https://vector.im"},"org.matrix.msc4143.rtc_foci":[{"type":"livekit","livekit_service_url":"https://matrix-rtc.example.com"}]}`
}
reverse_proxy homeserver:6167
}
matrix-rtc.example.com {
@jwt_service {
path /sfu/get* /healthz* /get_token*
}
handle @jwt_service {
reverse_proxy matrix-rtc-jwt:8081
}
handle {
reverse_proxy host.docker.internal:7880 {
header_up Connection "upgrade"
header_up Upgrade {http.request.header.Upgrade}
}
}
}
```
> - Caddyfile構文チェック
> $ docker compose exec caddy caddy validate --config /config/caddy/Caddyfile
> - 証明書確認
> $ ls -la ./data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/
`tuwunel.toml`
```auto
[global]
server_name = "matrix.example.com"
database_path = "/var/lib/tuwunel"
address = ["0.0.0.0", "::"]
port = 6167
max_request_size = 20000000
allow_registration = true
registration_token = "xxxxxxxxxxxxxxxxxxxxx"
allow_federation = true
trusted_servers = ["matrix.org"]
turn_uris = ["turns:turn.example.com:5349?transport=tcp", "turns:turn.example.com:5349?transport=udp"]
turn_secret = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
[global.well_known]
client = "https://matrix.example.com"
server = "matrix.example.com:443"
livekit_url = "https://matrix-rtc.example.com"
```
> 注）registration\_tokenはhomeserverのドメイン：matrix.example.comでユーザ登録する際に必要。Caddyで.well-known/matrix/clientに"[https://matrix-rtc.example.com](https://matrix-rtc.example.com)"を指定していれば[global.well\_known]の項目は不要（全てコメントアウト）
> クローズドサーバの場合、allow\_federation=false
> - Matrix APIの確認
> $curl -s [https://matrix.example.com/\_matrix/client/versions](https://matrix.example.com/_matrix/client/versions) | python3 -m json.tool
> - .well-knownの確認
> $ curl -s [https://matrix.example.com/.well-known/matrix/client](https://matrix.example.com/.well-known/matrix/client) | python3 -m json.tool
> $ curl -s [https://matrix.example.com/.well-known/matrix/server](https://matrix.example.com/.well-known/matrix/server) | python3 -m json.tool
`livekit.yaml`
```auto
port: 7880
bind_addresses:
- "::"
rtc:
tcp_port: 7881
port_range_start: 50301
port_range_end: 50400
use_external_ip: true
enable_loopback_candidate: false
turn_servers:
- host: turn.example.com
port: 5349
protocol: tls
secret: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
keys:
xxxxxxxxxxxxxxxxx: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```
> 注）keys:には .env の MRTCKET: MRTCSECRET を記述。
`turnserver.conf`
```ini
listening-port=3478
tls-listening-port=5349
listening-ip=::
realm=turn.example.com
use-auth-secret
static-auth-secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
log-file=stdout
no-tcp-relay
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.88.99.0-192.88.99.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=240.0.0.0-255.255.255.255
denied-peer-ip=::1
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
allowed-peer-ip=2404:7a87:9140:1000:5054:ff:fe8e:4360
user-quota=12 # 4 streams per video call, so 12 streams = 3 simultaneous relayed calls per user.
total-quota=1200
cert=/etc/letsencrypt/live/turn.example.com/fullchain.pem
pkey=/etc/letsencrypt/live/turn.example.com/privkey.pem
external-ip=EXTERNAL_IPV6
min-port=50201
max-port=50300
```
> - TCP接続確認
> $ nc -zv [turn.example.com](http://turn.example.com) 5349
> - TLS証明書確認
> $ openssl s\_client -connect [turn.example.com:5349](http://turn.example.com:5349)
* * *
### 公開ポート
- `7880:7881/tcp ALLOW Anywhere`
- `80/tcp (v6) ALLOW Anywhere (v6)`
- `443/tcp (v6) ALLOW Anywhere (v6)`
- `3478 (v6) ALLOW Anywhere (v6)`
- `5349/tcp (v6) ALLOW Anywhere (v6)`
- `7880:7881/tcp (v6) ALLOW Anywhere (v6)`
- `50201:50400/udp (v6) ALLOW Anywhere (v6)`
LiveKit が `::` でバインドする際、OSの設定によって動作が変わります。このためIPv4の`7880:7881`もポート開放必要。
#### 原因
`/proc/sys/net/ipv6/bindv6only` の値を確認
```auto
$ cat /proc/sys/net/ipv6/bindv6only
```
- **`0`** → IPv6ソケットがIPv4も兼用（dual-stack）→ `*:7880` と表示される
- **`1`** → IPv6専用 → `:::7880` と表示される
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2026 年 4 月 23 日午後 12:58 UTC](https://forum.ficusonline.com/t/topic/555/5 "2026-04-23T12:58:06Z")
## Admin Roomでの操作
Matrixサーバ：Tuwunelで、ユーザの登録・作成などの各種操作はAdmin Roomで行います。
Admin RoomはデフォルトでTuwunel初回起動時に作成されます。
> name: [matrix.example.com](http://matrix.example.com) Admin Room
以下の設定により（デフォルト）、最初に登録したユーザーが自動でAdmin Roomに入ります。
`tuwunel.toml`
```auto
grant_admin_to_first_user = true
create_admin_room = true
```
* * *
このAdmin Roomでユーザ作成など各種操作をするには、メッセージ欄に
> `”!admin + コマンド"`
と入力します。
例）ヘルプ：コマンド一覧
> !admin help
```auto
> Usage: !admin
Commands:
appservices - Commands for managing appservices
users - Commands for managing local users
rooms - Commands for managing rooms
federation - Commands for managing federation
server - Commands for managing the server
media - Commands for managing media
debug - Commands for debugging things
query - Low-level queries for database getters and iterators
token - Commands for managing registration tokens
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
-V, --version Print version
```
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2026 年 4 月 23 日午後 1:09 UTC](https://forum.ficusonline.com/t/topic/555/6 "2026-04-23T13:09:25Z")
## Element-Web
Elementのウェブアプリを自前で用意する場合、以下のサービスをdocker-compose.ymlに追加。
`docker-compose.yaml`
```yml
element-web:
# https://hub.docker.com/r/vectorim/element-web
image: vectorim/element-web:latest
container_name: element-web
volumes:
- ./element-config.json:/app/config.json:ro
networks:
- caddy
```
設定ファイル
`element-config.json`
```json
{
"default_server_name": "example.com",
"default_server_config": {
"m.homeserver": {
"base_url": "https://matrix.example.com"
},
"m.identity_server": {
"base_url": "https://vector.im"
}
},
"brand": "Element",
"integrations_ui_url": "https://scalar.vector.im/",
"integrations_rest_url": "https://scalar.vector.im/api",
"integrations_widgets_urls": [
"https://scalar.vector.im/_matrix/integrations/v1",
"https://scalar.vector.im/api",
"https://scalar-staging.vector.im/_matrix/integrations/v1",
"https://scalar-staging.vector.im/api"
],
"show_labs_settings": true,
"room_directory": {
"servers": ["matrix.example.com", "matrix.org"]
},
"enable_presence_by_hs_url": {
"https://matrix.example.com": true
},
"map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=fU3vlMsMn4Jb6dnEIFsx",
"setting_defaults": {
"RustCrypto.staged_rollout_percent": 60
},
"features": {
"feature_video_rooms": true,
"feature_group_calls": true,
"feature_element_call_video_rooms": true
},
"element_call": {
"url": "https://call.element.io",
"use_exclusively": false
}
}
```
Caddyプロキシには以下を追加。
`Caddyfile`
```auto
chat.example.com {
handle /.well-known/matrix/client {
header Content-Type application/json
header Access-Control-Allow-Origin *
respond `{
"m.homeserver": {
"base_url": "https://matrix.example.com"
},
"m.identity_server": {
"base_url": "https://vector.im"
}
}` 200
}
reverse_proxy element-web:80
}
```
アプリで直接ユーザ登録を行うには、`registration_token`が必要。
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2026 年 4 月 27 日午前 8:38 UTC](https://forum.ficusonline.com/t/topic/555/8 "2026-04-27T08:38:16Z")
## Element-Web
- ルームの作成
- ルームへ招待
- ルームでチャット
- ビデオ通話
- グループビデオ
## Element X
- チャットルーム
- チャット
- ルームへの招待を承諾
- 通話に参加
- グループビデオ
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2026 年 4 月 30 日午後 2:12 UTC](https://forum.ficusonline.com/t/topic/555/9 "2026-04-30T14:12:25Z")
## 補足説明
### フェデレーション：
federationという設定項目がありますが、これは他のMatrixサーバと連携するための設定です。クローズドサーバの場合、`allow_federation = false` として下さい。
`tuwunel.toml`
```auto
# Controls whether federation is allowed or not. It is not recommended to
# disable this after installation due to potential federation breakage but
# this is technically not a permanent setting.
#
allow_federation = false
# Sets the default `m.federate` property for newly created rooms when the
# client does not request one. If `allow_federation` is set to false at
# the same this value is set to false it then always overrides the client
# requested `m.federate` value to false.
#
# Rooms are fixed to the setting at the time of their creation and can
# never be changed; changing this value only affects new rooms.
#
federate_created_rooms = false
```
### Element-Webのスレッド
チャット画面の内部にスレッドという吹出しアイコンがありますが、これは特定のチャットメッセージを枝分かれさせるためのものです。
### ユーザアドレス
ユーザアドレスの表記ルール（@ユーザ名:サーバドメイン）
> @user001:matrix.example.com
### Tumunel Dockerイメージについて
Tuwunelはdistrolessイメージで、これはGoogleが開発するアプリケーションの実行に必要な最小限の依存関係（ランタイム）のみを含んだコンテナイメージ。コンテナ内でシェルコマンドは使用できません。
> **[GitHub - GoogleContainerTools/distroless: 🥑 Language focused docker images, minus the...](https://github.com/googlecontainertools/distroless)**
>
> 🥑 Language focused docker images, minus the operating system.
### APIエンドポイント
サーバとクライアントのエンドポイントは以下を参照して下さい。
> **[Server-Server API](https://spec.matrix.org/latest/server-server-api/)**
>
> Matrix homeservers use the Federation APIs (also known as server-server APIs)
> to communicate with each other. Homeservers use these APIs to push messages in
> real-time, retrieve historic messages, and query profile or presence
> information about users...
> **[Client-Server API](https://spec.matrix.org/latest/client-server-api/)**
>
> The client-server API allows clients to send messages, control rooms and
> synchronise conversation history. It is designed to support both lightweight
> clients which store no state and lazy-load data from the server as required,
> as well as heavyweight...
---
### Author:  [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2026 年 5 月 2 日午後 2:15 UTC](https://forum.ficusonline.com/t/topic/555/10 "2026-05-02T14:15:30Z")
## クライアント：Elementの特徴（Matrix準拠）
> **[Element features](https://element.io/features)**
>
> From an open network with federation to data sovereignty and ownership, discover the messaging and collaboration features that make Element unique.
#### 暗号化
ダブルラチェットプロトコルによる暗号化。
> **[End-to-end encryption (E2EE) | Collaboration and messaging](https://element.io/features/end-to-end-encryption)**
>
> Element is secure collaboration and messaging app designed to protect users and their privacy by using the highest grade end-to-end encryption by default. Messages can only be decrypted by participants in the conversation.
クロスサイン認証：ユーザーを認証すると、その信頼はそのユーザーが持つ全デバイスに自動的に引き継がれます。デバイスごとに個別に認証する手間が省けます。
> **[Cross-signed device verification | Secure messaging](https://element.io/features/device-verification)**
>
> Element uses cross-signed device verification to enhance its secure messaging. It helps ensure the identity of conversation participants and their devices, with minimal manual effort.
#### フェデレーション
他のネットワークとの連携。メールサーバのように他のドメインに所属するユーザアドレス同士のコミュニケーションが可能。
> **[Closed federation | Open federation](https://element.io/features/closed-federation-and-open-federation)**
>
> Federation enables multiple networks to work together. Element offers closed, ecosystem and open federation. Element enables even the most complex of organisations to balance security, ecosystem connectivity and usability.
### データ所有権
データは登録したドメインのサーバのみが所有・管理できるが、データそのものは暗号化されているためユーザ以外では解読不可能。
> **[Data sovereignty | Collaboration and messaging](https://element.io/features/data-sovereignty)**
>
> Data sovereignty means keeping ownership and control of your data, so it remains subject to your governance structure. Element delivers data sovereignty whether it's deployed on-premise, self-hosted in a private cloud or through our fully managed...
### 分散型ネットワーク
分散型サーバで完全に独立した運営が可能。
> **[Decentralised Matrix network | Decentralised chat](https://element.io/features/decentralised-matrix-network)**
>
> Element takes full advantage of the Matrix open standard. Decentralisation enables data sovereignty, delivering data ownership and control for both on-premise and cloud deployments.