# docker-compose.yml
version: "3.8"
services:
  mediamtx:
    image: bluenviron/mediamtx:v1.11.0
    ports:
      - "8888:8888"   # HTTP API / WHIP / WHEP
      - "8889:8889"   # WebRTC ICE/UDP
      - "1935:1935"   # RTMP
      - "8554:8554"   # RTSP
    volumes:
      - ./mediamtx.yml:/mediamtx.yml
    restart: unless-stopped

# mediamtx.yml 关键片段
whip: yes
whep: yes
api: yes
apiAddress: :8888

# 可选：启用鉴权
# authentication:
#   whip: [user:pass]
#   whep: [user:pass]

# ICE 候选配置（公网 IP + TURN）
iceHostNAT1To1IPs:
  - "YOUR_PUBLIC_IP"
iceUDPPortRange: "30000-30100"

server {
    listen 443 ssl http2;
    server_name rtc.example.com;

    ssl_certificate /etc/letsencrypt/live/rtc.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/rtc.example.com/privkey.pem;

    # WHIP/WHEP 信令转发
    location / {
        proxy_pass http://127.0.0.1:8888;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    # ICE UDP 透传（需 stream 模块）
    # 另需在 nginx.conf stream {} 块配置 udp proxy 至 8889
}

// whip-publish.js
class WhipPublisher {
  constructor(endpoint, streamKey, authToken) {
    this.endpoint = `${endpoint}/${streamKey}`;
    this.authToken = authToken;
    this.pc = new RTCPeerConnection({ iceServers: [{ urls: 'stun:stun.l.google.com:19302' }] });
  }

  async start(videoTrack, audioTrack) {
    // 1. 添加本地轨道
    videoTrack && this.pc.addTrack(videoTrack);
    audioTrack && this.pc.addTrack(audioTrack);

    // 2. 创建 Offer
    const offer = await this.pc.createOffer({ offerToReceiveAudio: false, offerToReceiveVideo: false });
    await this.pc.setLocalDescription(offer);

    // 3. HTTP POST 发送 Offer（WHIP 核心流程）
    const resp = await fetch(this.endpoint, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/sdp',
        'Authorization': `Bearer ${this.authToken}` // 可选
      },
      body: offer.sdp
    });

    if (!resp.ok) throw new Error(`WHIP POST failed: ${resp.status}`);

    // 4. 处理 Answer
    const answerSdp = await resp.text();
    await this.pc.setRemoteDescription({ type: 'answer', sdp: answerSdp });

    // 5. ICE 候选收集（Trickle ICE）
    this.pc.onicecandidate = e => {
      if (e.candidate) {
        fetch(this.endpoint, {
          method: 'PATCH',
          headers: { 'Content-Type': 'application/trickle-ice-sdpfrag' },
          body: `a=${e.candidate.candidate}rn`
        });
      }
    };

    // 6. 会话保活（可选）
    this.keepAliveTimer = setInterval(() => fetch(this.endpoint, { method: 'PATCH' }), 5000);
  }

  stop() {
    clearInterval(this.keepAliveTimer);
    fetch(this.endpoint, { method: 'DELETE' }); // 结束会话
    this.pc.close();
  }
}

// 使用示例
const stream = await navigator.mediaDevices.getUserMedia({ video: true, audio: true });
const publisher = new WhipPublisher('https://rtc.example.com', 'live/stream1', 'token123');
await publisher.start(stream.getVideoTracks()[0], stream.getAudioTracks()[0]);

// whep-play.js
class WhepPlayer {
  constructor(endpoint, streamKey) {
    this.endpoint = `${endpoint}/${streamKey}/whep`;
    this.pc = new RTCPeerConnection({ iceServers: [{ urls: 'stun:stun.l.google.com:19302' }] });
    this.pc.ontrack = e => this.onTrack(e.streams[0]);
  }

  async play(videoElement) {
    // 1. 创建 Offer（仅接收）
    const offer = await this.pc.createOffer({ offerToReceiveAudio: true, offerToReceiveVideo: true });
    await this.pc.setLocalDescription(offer);

    // 2. HTTP POST 获取 Answer
    const resp = await fetch(this.endpoint, {
      method: 'POST',
      headers: { 'Content-Type': 'application/sdp' },
      body: offer.sdp
    });
    const answerSdp = await resp.text();
    await this.pc.setRemoteDescription({ type: 'answer', sdp: answerSdp });

    // 3. ICE 候选
    this.pc.onicecandidate = e => {
      if (e.candidate) {
        fetch(this.endpoint, {
          method: 'PATCH',
          headers: { 'Content-Type': 'application/trickle-ice-sdpfrag' },
          body: `a=${e.candidate.candidate}rn`
        });
      }
    };

    // 4. 渲染
    this.videoEl = videoElement;
  }

  onTrack(stream) {
    this.videoEl.srcObject = stream;
    this.videoEl.play().catch(console.warn);
  }

  stop() {
    fetch(this.endpoint, { method: 'DELETE' });
    this.pc.close();
  }
}

# FFmpeg WHIP 推流（H.264 + Opus）
ffmpeg -re -i input.mp4 
  -c:v libx264 -preset veryfast -tune zerolatency -f mp4 
  -c:a libopus -b:a 128k 
  -f whip -whip_endpoint "https://rtc.example.com/live/stream1" 
  -headers "Authorization: Bearer token123" 
  -ice_servers "[{"urls":"stun:stun.l.google.com:19302"}]"

graph TB
    Client[推/拉流客户端] --> LB[L4/L7 负载均衡<br/>Nginx/HAProxy/AWS ALB]
    LB --> Ingress[Ingress 集群<br/>MediaMTX/SRS 无状态节点]
    Ingress --> Redis[(Redis Cluster<br/>Session/Token/ICE 共享)]
    Ingress --> Etcd[(etcd<br/>配置/服务发现)]
    Ingress --> ObjectStore[(S3/MinIO<br/>录制/截图归档)]
    Ingress --> Prometheus[Prometheus + Grafana<br/>监控告警]

# values.yaml 片段
replicaCount: 3
autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 50
  targetCPUUtilizationPercentage: 60
  targetMemoryUtilizationPercentage: 70

# 亲和性调度：媒体节点分散部署，避免单机柜故障
affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values: [mediamtx]
          topologyKey: topology.kubernetes.io/zone

# UDP 端口范围通过 HostPort 或 CNI (如 Cilium/Calico) 直通
hostNetwork: false  # 建议 false + CNI 直通，保留网络隔离
dnsPolicy: ClusterFirst

# 启动探针：等待 ICE 端口就绪
readinessProbe:
  httpGet:
    path: /api/v3/server
    port: 8888
  initialDelaySeconds: 5
  periodSeconds: 3

# mediamtx.yml
api: yes
apiAddress: :8888
apiTLSCertificate: /certs/server.pem
apiTLSKey: /certs/server.key
apiTLSClientCA: /certs/ca.pem  # 启用客户端证书校验

{
  "iss": "rtc-auth-service",
  "sub": "user_12345",
  "aud": ["whip-publish", "whep-play"],
  "stream": "live/stream_abc",      // 绑定流路径
  "action": "publish",              // publish / play
  "ip": "203.0.113.45",             // 可选：绑定客户端 IP
  "ua": "Mozilla/5.0...",           // 可选：绑定 User-Agent
  "exp": 1700000000,                // 短时效：推流 5-10min，拉流 30-60min
  "iat": 1699999900,
  "nbf": 1699999900,
  "jti": "uuid-v4"                  // 防重放
}

-- auth.lua
function auth_hook(method, path, query, headers, body)
  local token = headers["Authorization"]:gsub("Bearer ", "")
  local res = http.request("POST", "http://auth-svc:8080/validate", {
    headers = { ["Content-Type"] = "application/json" },
    body = json.encode({ token = token, method = method, path = path })
  })
  if res.status == 200 then
    return true, json.decode(res.body).stream_key  -- 返回实际流名，支持路径重写
  end
  return false, "401 Unauthorized"
end

# mediamtx.yml
hooks:
  onConnect: "lua:auth.lua:auth_hook"

// 定时上报 getStats 关键指标至后端分析系统
setInterval(async () => {
  const stats = await pc.getStats();
  const report = {};
  stats.forEach(r => {
    if (r.type === 'inbound-rtp' && r.kind === 'video') {
      report.framesDecoded = r.framesDecoded;
      report.framesDropped = r.framesDropped;
      report.jitter = r.jitter;
      report.packetsLost = r.packetsLost;
      report.bitrate = (r.bytesReceived * 8 / 1000).toFixed(0); // kbps
      report.resolution = `${r.frameWidth}x${r.frameHeight}`;
    }
    if (r.type === 'candidate-pair' && r.state === 'succeeded') {
      report.rtt = r.currentRoundTripTime * 1000; // ms
      report.localCandidateType = r.localCandidateType; // host/srflx/relay
    }
  });
  await fetch('/api/qoe/report', { method: 'POST', body: JSON.stringify({ sessionId, ...report }) });
}, 5000);

# .gitlab-ci.yml / GitHub Actions 片段
stages:
  - lint
  - build
  - canary
  - stress
  - promote

canary_deploy:
  stage: canary
  script:
    - helm upgrade --install mediamtx-canary ./chart --namespace rtc-canary --set image.tag=$CI_COMMIT_SHA --set replicaCount=1
    - sleep 30
    - |
      # 自动化冒烟测试
      python3 tests/smoke_test.py --endpoint https://canary.rtc.example.com --stream test/$CI_COMMIT_SHA
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

stress_test:
  stage: stress
  needs: [canary_deploy]
  script:
    - |
      # 使用 k6 模拟 500 并发推拉流 10 分钟
      k6 run --vus 500 --duration 10m tests/load_test.js 
        -e ENDPOINT=https://canary.rtc.example.com 
        -e TOKEN=$TEST_TOKEN
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

promote_prod:
  stage: promote
  script:
    - helm upgrade --install mediamtx-prod ./chart --namespace rtc-prod --set image.tag=$CI_COMMIT_SHA
  when: manual
  environment: production

# KEDA ScaledObject 基于自定义指标扩缩容
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: mediamtx-keda
spec:
  scaleTargetRef:
    name: mediamtx
  pollingInterval: 15
  cooldownPeriod: 300
  minReplicaCount: 3
  maxReplicaCount: 100
  triggers:
    - type: prometheus
      metadata:
        serverAddress: http://prometheus:9090
        metricName: mediamtx_sessions_per_node
        query: |
          sum(mediamtx_sessions_active) by (pod) / count(mediamtx_sessions_active) by (pod)
        threshold: "150"  # 单节点 150 路触发扩容
        authModes: "none"