┌─────────────────────────────────────┐
│           客户端接入层               │  (App/Web SDK、H5 Player)
├─────────────────────────────────────┤
│           边缘接入层 (Edge POP)      │  ← 核心部署层
│  ┌──────────┐  ┌──────────┐         │
│  │ 媒体代理 │  │ 边缘缓存 │         │
│  │  集群    │  │  集群    │         │
│  └──────────┘  └──────────┘         │
├─────────────────────────────────────┤
│           区域汇聚层                 │  (Region Hub、转码集群)
├─────────────────────────────────────┤
│           源站/对象存储层             │  (Origin、S3、NAS)
└─────────────────────────────────────┘

Internet → [L4 LB: LVS/IPVS] → [Edge Gateway: Nginx/Envoy]
                                    │
                    ┌───────────────┼───────────────┐
                    ▼               ▼               ▼
             [Proxy Pod xN]    [Proxy Pod xN]    [Proxy Pod xN]
             (CPU绑核/巨页)    (CPU绑核/巨页)    (CPU绑核/巨页)
                    │               │               │
                    └───────────────┼───────────────┘
                                    ▼
                         [Edge Cache Cluster: ATS/Varnish]
                                    │
                         ┌──────────┴──────────┐
                         ▼                     ▼
                  [Local NVMe Cache]    [Remote Region Hub]

flowchart LR
    Client[客户端] -->|HTTP-FLV / WebRTC / HLS| EdgeProxy[边缘代理]
    EdgeProxy -->|Cache Hit| Cache[(边缘缓存)]
    EdgeProxy -->|Cache Miss| RegionHub[区域汇聚]
    RegionHub -->|RTMP / SRT| Origin[源站/转码集群]

# nginx.conf 核心片段
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 1000000;

events {
    use epoll;
    worker_connections 65535;
    multi_accept on;
}

http {
    # 零拷贝发送
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    
    # 连接复用
    keepalive_timeout 65;
    keepalive_requests 10000;
    
    # 缓冲区调优（视频大包）
    client_body_buffer_size 256k;
    proxy_buffers 8 256k;
    proxy_buffer_size 128k;
    
    # FLV/WebRTC 专用模块
    flv_live on;
    flv_buffer_size 128k;
    
    # 缓存键精细化：按码率/分辨率分桶
    proxy_cache_key "$scheme$host$request_uri$arg_bitrate$arg_resolution";
    
    # 熔断与限流
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=500r/s;
    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
}

def preheat_edge_nodes(content_id, bitrates, edge_ips):
    for ip in edge_ips:
        for br in bitrates:
            url = f"http://{ip}/preheat/{content_id}?bitrate={br}"
            # 异步并发，限流 50 QPS/节点
            async_post(url, timeout=5)
    # 回调确认预热完成率 > 95% 才放行发布

# Sentinel / Resilience4j 规则示例
rules:
  - resource: edge_proxy_cluster
    grade: RT        # 统计维度：平均响应时间
    threshold: 800   # 超过 800ms 触发熔断
    count: 10        # 连续 10 次
    strategy: chain  # 链路熔断
    fallback: redirect_to_region_hub
  - resource: edge_cache
    grade: EXCEPTION # 异常比例
    threshold: 0.3   # 30% 错误率
    fallback: serve_stale_cache

# 1. 隔离 CPU 核心给数据平面（假设 32 核，核 2-31 给代理，核 0-1 给控制面/中断）
GRUB_CMDLINE_LINUX_DEFAULT="isolcpus=2-31 nohz_full=2-31 rcu_nocbs=2-31 intel_pstate=disable processor.max_cstate=1 idle=poll default_hugepagesz=1G hugepagesz=1G hugepages=64"

# 2. 开启 XDP/BPF 支持
# 3. 关闭透明大页（防止内存抖动），改用显式大页
transparent_hugepage=never

# 1. 关闭 irqbalance，手工绑定
systemctl stop irqbalance && systemctl disable irqbalance

# 2. 为每个 RX/TX 队列绑定专属核心（示例：eth0 有 16 个队列，绑核 2-17）
for i in {0..15}; do
    echo $((2 + i)) > /proc/irq/$(grep "eth0-TxRx-$i" /proc/interrupts | awk '{print $1}' | sed 's/://')/smp_affinity_list
done

# 3. 开启 RPS/RFS（内核软中断分发），配合 XPS（发包队列选择）
# 接收端：将流哈希到对应核的 backlog
echo ffffff > /sys/class/net/eth0/queues/rx-0/rps_cpus
echo 32768 > /proc/sys/net/core/rps_sock_flow_entries
echo 2048 > /sys/class/net/eth0/queues/rx-0/rps_flow_cnt

# 发送端：XPS 将发包队列映射到核心
for i in {0..15}; do
    echo $((2 + i)) > /sys/class/net/eth0/queues/tx-$i/xps_cpus
done

# 连接建立加速
net.ipv4.tcp_fastopen = 3                    # TFO 开启（客户端+服务端）
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 2                 # 快速失败重试
net.ipv4.tcp_synack_retries = 2

# 拥塞控制：BBRv3 (Kernel 6.2+) 或 BBRv2
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq                  # BBR 必配 fq qdisc

# 缓冲区自动调优（关键：允许缓冲区动态增长至 BDP）
net.ipv4.tcp_rmem = 4096 87380 67108864      # min/default/max (64MB)
net.ipv4.tcp_wmem = 4096 65536 67108864
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.core.netdev_max_backlog = 250000         # 网卡队列长度
net.core.somaxconn = 65535                   # listen backlog

# TIME_WAIT 复用（高并发短连接场景必开）
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

# 显式拥塞通知 (ECN) + SACK
net.ipv4.tcp_ecn = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_dsack = 1

# 内存压力保护
net.ipv4.tcp_mem = 786432 1048576 1572864    # 单位：页 (约 6GB/8GB/12GB)
vm.min_free_kbytes = 1048576                 # 预留 1GB 免内存回收抖动

[RTMP Pull] → [Ring Buffer (Shared Mem, 64MB)] → [JIT Remux Worker] → [FLV/TS/HLS Chunk] → [Local Cache / Push CDN]
      │                                                                                      ▲
      └──────────────────────── [GOP Cache / IDR Index] ────────────────────────────────────┘

// 共享内存环形缓冲区，避免 CGO/Channel 拷贝
type RingBuffer struct {
    // 头尾指针使用原子操作，Cache Line 对齐防伪共享
    head uint64 `align:"64"`
    tail uint64 `align:"64"`
    // 预分配 4096 个 Slot，每 Slot 最大 16KB (AAC/IDR 头)
    slots [4096]Slot
}

type Slot struct {
    pts       uint64      // Presentation Timestamp (90kHz)
    dts       uint64      // Decode Timestamp
    flags     uint8       // KEY_FRAME | AUDIO | SEQ_HDR
    codec_id  uint8       // H264=7, H265=12, AAC=10
    payload   []byte      // 指向大页内存池的切片 (zero-copy)
    refcnt    uint32      // 引用计数，多消费者(FLV/HLS/WebRTC)共享
}

func (w *JITWorker) Run(ctx context.Context) {
    for {
        select {
        case <-ctx.Done(): return
        case slot := <-w.inputCh: // 从 Ring Buffer 取帧
            // 1. 更新 GOP 缓存（仅缓存最近 2 个 GOP，约 4-8s）
            w.gopCache.Push(slot)

            // 2. FLV Tag 产出：仅加 FLV Header/PrevTagSize，极简
            if w.flvWriter != nil {
                w.flvWriter.WriteTag(slot.toFLVTag())
            }

            // 3. LL-HLS 切片：按 IDR 对齐，生成 Partial Segment
            if slot.flags&KEY_FRAME != 0 {
                w.hlsSegmenter.OnIDR(slot.pts)
            }
            w.hlsSegmenter.Feed(slot)

            // 4. WebRTC (SRS/MediaMTX 接管)：推送到内部 Track
            if w.webrtcTrack != nil {
                w.webrtcTrack.WriteSample(slot.toRTPPacket())
            }
        }
    }
}

sequenceDiagram
    Client->>Edge: 请求 License (Challenge)
    Edge->>Edge: 检查 Key Cache (Key ID + Policy)
    alt Cache Hit
        Edge-->>Client: 返回 License (加密 Content Key)
    else Cache Miss
        Edge->>KMS: 转发 Challenge (mTLS)
        KMS-->>Edge: 返回 License
        Edge->>Edge: 缓存 Content Key (TTL=24h, 加密存储)
        Edge-->>Client: 返回 License
    end

# OpenResty Lua 伪代码：按 UserID 最后一位选择水印分支
local uid = ngx.var.arg_uid
local bit = tonumber(string.sub(uid, -1)) % 2
local watermark_path = (bit == 0) and "/watermark/A/" or "/watermark/B/"

-- 重写 m3u8 请求内部 URI
ngx.req.set_uri("/internal/manifest" .. watermark_path .. ngx.var.uri, false)

apiVersion: media.edge.io/v1alpha1
kind: EdgeMediaProxy
metadata:
  name: proxy-beijing-cmcc-01
  namespace: edge-media
spec:
  # 节点亲和性：精准调度到特定 POP/机架
  nodeAffinity:
    required:
      - key: topology.kubernetes.io/zone
        operator: In
        values: ["beijing-cmcc-pop-01"]
      - key: node.kubernetes.io/instance-type
        operator: In
        values: ["baremetal-32c-128g-2x100g"]
  
  # 代理规格
  proxySpec:
    replicas: 16                    # 绑核实例数 = 物理核心数 - 2
    resources:
      limits:
        cpu: "30"                   # 独占 30 核
        memory: "64Gi"
        hugepages-1Gi: "8Gi"        # 大页内存池
        nvidia.com/gpu: "0"         # 如需转码则配 GPU
    runtimeClassName: "kata-qemu"   # 安全容器隔离 (可选)
  
  # 网络直通
  network:
    hostNetwork: true
    dnsPolicy: ClusterFirstWithHostNet
    interfaces:
      - name: eth0-data
        mac: "aa:bb:cc:dd:ee:01"
        vlan: 100
      - name: eth1-mgmt
        mac: "aa:bb:cc:dd:ee:02"
  
  # 业务配置 (通过 ConfigMap 热更)
  config:
    configMapRef: "proxy-config-bj-cmcc"
    hotReload: true
  
  # 服务暴露
  service:
    type: LoadBalancer
    loadBalancerClass: "metallb"
    annotations:
      metallb.universe.tf/address-pool: "bj-cmcc-eip-pool"
    ports:
      - name: http-flv
        port: 80
        targetPort: 8080
      - name: webrtc
        port: 443
        targetPort: 8443
      - name: metrics
        port: 9090
        targetPort: 9090

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: edge-proxy-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: media-proxy
  minReplicas: 8
  maxReplicas: 32
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 60          # 核心指标：CPU 60% 扩容
  - type: Pods
    pods:
      metric:
        name: proxy_concurrent_streams  # 自定义指标：单 Pod 并发流数
      target:
        type: AverageValue
        averageValue: "40"              # 单 Pod 40 路 1080p 触发扩容
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 600   # 缩容冷却 10 分钟，防抖
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 30    # 扩容快速响应 30 秒
      policies:
      - type: Percent
        value: 50
        periodSeconds: 15
      - type: Pods
        value: 4
        periodSeconds: 15
      selectPolicy: Max

# 根据实时带宽成本、用户热力图动态调整副本分布
apiVersion: policy.karmada.io/v1alpha1
kind: PropagationPolicy
metadata:
  name: media-proxy-propagation
spec:
  resourceSelectors:
    - apiVersion: apps/v1
      kind: Deployment
      name: media-proxy
  placement:
    placementType: Dynamic
    dynamicPlacement:
      # 自定义调度器插件：输入 = 用户热力图 + 带宽单价 + 节点负载
      schedulerName: "edge-cost-aware-scheduler"
      replicaScheduling: Weighted
      replicaSchedulingType: Divided
---
# 覆盖策略：针对不同运营商 POP 注入差异化配置
apiVersion: policy.karmada.io/v1alpha1
kind: OverridePolicy
metadata:
  name: proxy-config-override-cmcc
spec:
  resourceSelectors:
    - apiVersion: v1
      kind: ConfigMap
      name: proxy-config
  overriders:
    plaintext:
      - path: "/nginx.conf"
        operator: replace
        value: |
          # CMCC 专用：开启 TCP_FastOpen、调整 keepalive
          tcp_fastopen on;
          keepalive_timeout 90;
    - path: "/upstream.conf"
        operator: replace
        value: |
          upstream origin_cmcc {
            server origin-cmcc.internal:1935 weight=10;
            server origin-backup.internal:1935 weight=1 backup;
          }

graph LR
    A[新内容发布] --> B{热度预测模型}
    B -- Top 5% 头部 --> C[L1: 内存 热缓存<br/>TTL 24h]
    B -- 腰部 20% --> D[L2: 本地 NVMe 温缓存<br/>TTL 7d]
    B -- 长尾 75% --> E[L3: 对象存储 (IA/Archive)<br/>按需回源]
    
    C --> F[用户请求]
    D --> F
    E -->|Cache Miss| G[回源/预热] --> C

# .github/workflows/chaos-drill.yaml
name: Weekly Chaos Drill
on:
  schedule: ['0 2 * * 1'] # 每周一凌晨 2 点
jobs:
  inject-network-latency:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4
      - name: Select Target POPs (Top 10 by Traffic)
        id: target
        run: |
          # 查询 Prometheus 获取 TOP 10 POP
          echo "pop_list=$(curl -s 'http://prometheus/api/v1/query?query=topk(10, sum by (pop) (rate(edge_requests_total[1h])))' | jq -r '.data.result[].metric.pop' | tr 'n' ',')" >> $GITHUB_OUTPUT
      - name: Inject Latency (Chaos Mesh)
        run: |
          for pop in ${{ steps.target.outputs.pop_list }}; do
            kubectl --context $pop apply -f - <<EOF
            apiVersion: chaos-mesh.org/v1alpha1
            kind: NetworkChaos
            metadata:
              name: weekly-latency-${pop}-$(date +%s)
            spec:
              action: delay
              mode: one
              selector:
                namespaces: ["edge-media"]
                labelSelector: "app=media-proxy"
              delay:
                latency: "200ms"
                correlation: "25"
                jitter: "50ms"
              duration: "10m"
              scheduler:
                cron: "@once"
            EOF
          done
      - name: Verify SLO (Prometheus Query)
        run: |
          sleep 120 # 等待故障生效
          # 检查首屏 P99、错误率、切换成功率
          python3 verify_slo.py --pop-list "${{ steps.target.outputs.pop_list }}"
      - name: Cleanup & Report
        if: always()
        run: |
          # 删除 Chaos 资源、生成演练报告推送飞书/钉钉
          python3 generate_report.py

{
  "event": "first_frame_rendered",
  "timestamp": 1715000000123,
  "trace_id": "a1b2c3d4e5f6...",
  "client": {
    "sdk_version": "3.2.1",
    "os": "iOS 17.4",
    "device": "iPhone15,2",
    "network": {"type": "5G", "rtt_ms": 45, "bandwidth_mbps": 120, "carrier": "CMCC"}
  },
  "session": {
    "content_id": "vid_abc123",
    "bitrate": 4500,
    "protocol": "LL-HLS",
    "edge_node": "bj-cmcc-pop-01-03",
    "dns_mode": "HTTPDNS",
    "preconnect": true,
    "prefetch_manifest": true,
    "prefetch_first_segment": true
  },
  "metrics": {
    "dns_ms": 12,
    "tcp_connect_ms": 18,
    "tls_handshake_ms": 0,  // 0-RTT
    "first_byte_ms": 85,
    "first_frame_decode_ms": 210,
    "total_startup_ms": 325,
    "rebuffer_count": 0,
    "rebuffer_duration_ms": 0
  }
}

flowchart TD
    A[用户请求] --> B{边缘缓存命中?}
    B -- Hit --> C[读取切片元数据]
    B -- Miss --> D[回源获取元数据]
    C --> E[AI 审核引擎 (本地推理)]
    D --> E
    E -- 通过 --> F[正常分发]
    E -- 疑似/违规 --> G[同步阻断 + 标记]
    G --> H[下发拦截清单给调度网关]
    H --> I[全网 5s 内生效 Purge]
    G --> J[回调内容安全平台人工复核]