Register GIS LiveKit as docker compose on webservers.

Same deploy path as abc_worker: host_apps on adama/starbuck/etc., NPM for wss://. UDP/7881 still forwarded to one upstream host.

IMPLEMENTATION.md

@@ -222,6 +222,7 @@ After Docker install, re-SSH so the `docker` group membership takes effect.
 | `abc_be` | django (docker) | all webservers | **beta only** | AI Benefits Coach API; no bundled Postgres; Ollama `http://10.0.0.128:11434`; shares DB `abc_be_beta` with `abc_worker` |
 | `abc_worker` | django-type compose (FastAPI) | all webservers | **beta only** | same Postgres as `abc_be`; `migrate_cmd: true`; WS on host port 8018 |
 | `abc_fe` | node-static (Vite) | all webservers | **beta only** | built to `/var/www/<env>.abc.aimloperations/html`; no prod `host_apps` row |
+| `livekit` | django-type compose (LiveKit SFU) | all webservers | **beta only** | Docker like `abc_worker`. Host network `:7880`. **Do not NPM-balance** until Redis — pick one upstream (adama). Router DNAT UDP 3478 + 50000–60000 and TCP 7881 to that host. Secrets `~/Documents/secrets/livekit/livekit_beta.env` |
 
 Django apps use a **shared external Postgres** (via `DATABASE_URL` in each host's
 env file) so active/active replicas share one database. Beta and prod never share
@@ -258,6 +259,7 @@ future beta replica.
 | chat_web_app (nginx) | 8083 | 8082 | all webservers |
 | abc_fe (nginx) | **8085** | 8084 (*not deployed*) | all webservers |
 | dta_blog (nginx) | **8087** | **8086** | all webservers |
+| livekit | **7880** | — | all webservers (signaling). UDP 3478 + 50000–60000 + TCP 7881 via router DNAT to the NPM upstream host |
 | SearxNG (LAN only) | — | **8088** | ai-server-4080 only (`searxng_stack`); not an NPM upstream |
 
 Host-local services on ai-server-4080 (not balanced by NPM):
@@ -331,6 +333,7 @@ point each domain at the backend(s):
 | abc_fe | `beta.abc.aimloperations.com` (beta only) | `adama:8085` + same on roslin / starbuck / apollo / ai-server-4080 |
 | abc_be | `beta.abc.be.aimloperations.com` (beta only) | `adama:8017` + same on roslin / starbuck / apollo / ai-server-4080 |
 | abc_worker | `beta.abc.worker.aimloperations.com` (beta only; HTTP + WebSocket upgrade) | `adama:8018` + same on roslin / starbuck / apollo / ai-server-4080 |
+| livekit | `LIVEKIT_DOMAIN` (e.g. `livekit.aimloperations.com`) — NPM Proxy Host, WebSocket, **single upstream** | `adama:7880` (do not balance until Redis) |
 
 ### Required changes IN each app repo (owned separately)
 
@@ -440,6 +443,22 @@ Companion workflows: [abc_be#22](https://git.aimloperations.com/GIS/abc_be/issue
 [abc_worker#27](https://git.aimloperations.com/GIS/abc_worker/issues/27),
 [abc_fe#27](https://git.aimloperations.com/GIS/abc_fe/issues/27).
 
+`livekit` (GIS org, SFU on webservers — [abc_worker#14](https://git.aimloperations.com/GIS/abc_worker/issues/14)–[#17](https://git.aimloperations.com/GIS/abc_worker/issues/17)):
+
+Control-node secret (never git, mode `600`):
+
+```text
+~/Documents/secrets/livekit/livekit_beta.env
+```
+
+Template: `GIS/livekit` `.env.beta.example`. Same `LIVEKIT_API_KEY` /
+`LIVEKIT_API_SECRET` pair as `abc_be` / `abc_worker`; worker `LIVEKIT_URL=wss://<LIVEKIT_DOMAIN>`.
+
+Deploy: `./scripts/deploy.sh --app livekit --env beta` (all webservers, like
+`abc_worker`). NPM: `LIVEKIT_DOMAIN` → **one** host `:7880` with WebSocket
+(adama). Router DNAT UDP 3478 + 50000–60000 and TCP 7881 to that same host.
+Do not active/active-balance LiveKit until Redis is in the compose.
+
 `dta_blog` ([#29](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/29)) —
 Python SSG, **no secrets file**. `npm run build:<env>` writes
 `/var/www/<env>.blog.realpath.app/html`. Prod (`:8086`) omits `demo: true` seed
@@ -535,7 +554,8 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
 | 10h | Register + deploy `college_craft` (django, ports 8006/8016) | Done ([#24](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/24)) |
 | 10i | Register + deploy ABC beta (`abc_be` 8017, `abc_worker` 8018, `abc_fe` 8085) | Done ([#26](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/26)) |
 | 10j | Register + deploy `print_forge` (django, ports 8007/8019) | Done ([#27](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/27)) |
-| 10k | Register + deploy `dta_blog` (node-static, ports 8086/8087) | This PR ([#29](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/29)) |
+| 10k | Register + deploy `dta_blog` (node-static, ports 8086/8087) | Done ([#29](https://git.aimloperations.com/ai_ml_operations/server-infra/issues/29)) |
+| 10l | Register GIS LiveKit SFU (`abc_worker`-style docker on webservers, port 7880) | This PR |
 | 11 | Gitea container registry (optional) | Future |
 
 ## Open Decisions