# La Suite Meet — First-Time Setup

## Prerequisites

- DNS: `lasuite-meet.<domain_suffix>` must resolve to the server
- DNS: `livekit-meet.<domain_suffix>` must resolve to the server (LiveKit signaling)
- **Keycloak** must be deployed and running (dependency)
- Firewall must allow TCP 7881, UDP 7882 (WebRTC), and UDP 443 (TURN relay)

## Steps

1. **Create the app:**
   ```bash
   abra app new lasuite-meet --server <SERVER> --domain lasuite-meet.<DOMAIN_SUFFIX> --no-input
   ```

2. **Generate secrets:**
   ```bash
   abra app secret generate lasuite-meet.<DOMAIN_SUFFIX> --all -m --no-input
   ```
   Save output to `recipe-info/testsecrets/lasuite-meet.<DOMAIN_SUFFIX>`.

3. **Deploy:**
   ```bash
   abra app deploy lasuite-meet.<DOMAIN_SUFFIX> --chaos --force --no-input
   ```

4. **Keycloak SSO integration:**
   ```bash
   python3 recipe-info/lasuite-meet/setup_keycloak_integration.py
   ```
   This creates a `lasuite-meet` realm, OIDC client, and two test users in Keycloak. It also inserts the client secret and updates the env file.

5. **Redeploy with SSO config:**
   ```bash
   abra app deploy lasuite-meet.<DOMAIN_SUFFIX> --chaos --force --no-input
   ```

6. **Verify:** curl `https://lasuite-meet.<DOMAIN_SUFFIX>` returns HTTP 200.

## Notes

- lasuite-meet has no published versions yet — must use `--chaos` for all commands.
- Credentials are saved to `recipe-info/lasuite-meet/keycloak-test-credentials.<DOMAIN_SUFFIX>.toml`.
- OIDC test users: `testuser` / `testpass123` and `testuser2` / `testpass123`.
- TURN relay requires the server to have a direct public IP (not behind NAT). See test.md for details.