基于Docker Swarm快速部署视频会议系统的详细教程

[用户浏览器] <--HTTPS--> [Load Balancer / Nginx Proxy Manager] <--Overlay Network--> [Swarm Services]
                                                                       |-- Web (Replicas: 2)
                                                                       |-- Prosody (Replicas: 1, Global Mode)
                                                                       |-- Jicofo (Replicas: 1)
                                                                       `-- JVB (Replicas: N, 可横向扩展)

# 初始化集群 (若有多 Manager，后续节点用 join-token 加入)
docker swarm init --advertise-addr <MANAGER_内网IP>

# 标记 Worker 节点角色 (便于 JVB 定向调度)
docker node update --label-add jvb=true <WORKER_NODE_ID>

# 创建可加密的跨主机网络
docker network create --driver overlay --attachable --opt encrypted=true jitsi-net

# 生成强随机密码 (建议使用 openssl rand -base64 32)
echo "your_strong_prosody_password" | docker secret create jitsi_prosody_password -
echo "your_strong_jicofo_password" | docker secret create jitsi_jicofo_password -
echo "your_strong_jvb_password" | docker secret create jitsi_jvb_password -
echo "your_strong_admin_password" | docker secret create jitsi_admin_password -
# SSL 证书 (建议使用 Let's Encrypt 或企业证书，此处假设已有 fullchain.pem 和 privkey.pem)
docker secret create jitsi_ssl_cert ./fullchain.pem
docker secret create jitsi_ssl_key ./privkey.pem

version: "3.8"

services:
  # 1. Web 前端 + Nginx 反代
  web:
    image: jitsi/web:stable-8000  # 建议锁定具体版本标签，避免 latest 导致不可控升级
    networks: [jitsi-net]
    ports:
      - target: 80
        published: 80
        mode: host  # Host 模式便于获取真实客户端 IP
      - target: 443
        published: 443
        mode: host
    volumes:
      - ./custom-web:/config:ro  # 自定义 CSS/Logo/语言包
      - ./letsencrypt:/etc/letsencrypt:ro # 证书挂载 (若不用 Secrets 管理证书)
    secrets:
      - jitsi_ssl_cert
      - jitsi_ssl_key
    environment:
      - PUBLIC_URL=https://meet.example.com
      - ENABLE_AUTH=1               # 开启登录认证
      - AUTH_TYPE=internal          # 内部认证 (可对接 LDAP/OAuth)
      - XMPP_DOMAIN=meet.example.com
      - XMPP_AUTH_DOMAIN=auth.meet.example.com
      - JICOFO_AUTH_PASSWORD_FILE=/run/secrets/jitsi_jicofo_password
      - JVB_AUTH_PASSWORD_FILE=/run/secrets/jitsi_jvb_password
    deploy:
      replicas: 2
      placement:
        constraints: [node.role == manager] # Web 建议跑在 Manager 或固定入口节点
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3

  # 2. Prosody 信令服务 (有状态，建议 Global 模式或单副本 + 持久化)
  prosody:
    image: jitsi/prosody:stable-8000
    networks: [jitsi-net]
    volumes:
      - prosody-data:/config
      - prosody-prosody-plugins:/prosody-plugins
    secrets:
      - jitsi_prosody_password
      - jitsi_jicofo_password
      - jitsi_jvb_password
      - jitsi_admin_password
    environment:
      - XMPP_DOMAIN=meet.example.com
      - AUTH_TYPE=internal
      - ENABLE_AUTH=1
      - JICOFO_AUTH_PASSWORD_FILE=/run/secrets/jitsi_jicofo_password
      - JVB_AUTH_PASSWORD_FILE=/run/secrets/jitsi_jvb_password
      - ADMIN_PASSWORD_FILE=/run/secrets/jitsi_admin_password
      - PUBLIC_URL=https://meet.example.com
    deploy:
      mode: global  # 每个节点跑一个，或用 placement 固定单节点并做高可用
      placement:
        constraints: [node.role == manager]
      restart_policy:
        condition: any

  # 3. Jicofo 焦点组件 (无状态，单副本即可，依赖 Prosody)
  jicofo:
    image: jitsi/jicofo:stable-8000
    networks: [jitsi-net]
    secrets:
      - jitsi_jicofo_password
    environment:
      - XMPP_DOMAIN=meet.example.com
      - XMPP_AUTH_DOMAIN=auth.meet.example.com
      - JICOFO_AUTH_PASSWORD_FILE=/run/secrets/jitsi_jicofo_password
      - JICOFO_RESERVATION_REST_BASE_URL=https://meet.example.com/api
    deploy:
      replicas: 1
      placement:
        constraints: [node.role == manager]
      restart_policy:
        condition: on-failure

  # 4. JVB 视频桥 (核心扩展点，无状态，横向扩展)
  jvb:
    image: jitsi/jvb:stable-8000
    networks: [jitsi-net]
    # 关键：Host 网络模式 + UDP 端口映射，获得最佳媒体转发性能
    # 若宿主机防火墙已放行 UDP 10000-20000，推荐 network_mode: host
    # 此处演示 Overlay 网络下的端口发布模式 (性能稍有损耗，但网络隔离性更好)
    ports:
      - target: 10000
        published: 10000
        protocol: udp
        mode: host
      - target: 4443
        published: 4443
        protocol: tcp
        mode: host
    secrets:
      - jitsi_jvb_password
    environment:
      - XMPP_DOMAIN=meet.example.com
      - XMPP_AUTH_DOMAIN=auth.meet.example.com
      - JVB_AUTH_PASSWORD_FILE=/run/secrets/jitsi_jvb_password
      - JVB_BREWERY=jicofo  # 服务发现名称
      - JVB_PORT=10000
      - JVB_TCP_HARVESTER_PORT=4443
      - JVB_STUN_SERVERS=meet-jit-si-turnrelay.jitsi.net:443 # 建议配置企业自建 TURN
      - DOCKER_HOST_ADDRESS=<WORKER_NODE_公网IP> # 关键：告知 JVB 自身公网 IP 用于 ICE 候选
    deploy:
      replicas: 2  # 根据并发需求调整，建议 1 个 JVB 承载 150-200 并发流
      placement:
        constraints: [node.labels.jvb == true] # 仅调度到打标签的 Worker 节点
      resources:
        limits:
          cpus: '3.5'
          memory: 6G
        reservations:
          cpus: '2'
          memory: 4G
      restart_policy:
        condition: on-failure

networks:
  jitsi-net:
    external: true
    name: jitsi-net

volumes:
  prosody-data:
  prosody-prosody-plugins:

secrets:
  jitsi_prosody_password: { external: true }
  jitsi_jicofo_password: { external: true }
  jitsi_jvb_password: { external: true }
  jitsi_admin_password: { external: true }
  jitsi_ssl_cert: { external: true }
  jitsi_ssl_key: { external: true }

docker stack deploy -c docker-stack.yml jitsi

# 查看服务状态，等待 REPLICAS 达到预期
watch docker service ls

# 查看具体任务调度节点
docker service ps jitsi_web
docker service ps jitsi_jvb

# 实时查看关键日志 (排查启动失败)
docker service logs -f jitsi_jvb
docker service logs -f jitsi_prosody

# 手动扩容至 5 个 JVB 实例
docker service scale jitsi_jvb=5

# 结合监控实现自动扩容 (伪代码逻辑)
# IF (jvb_avg_cpu > 70% AND jvb_conferences_per_instance > 50) FOR 5m THEN scale +1
# IF (jvb_avg_cpu < 20% AND replicas > 2) FOR 30m THEN scale -1

services:
  coturn:
    image: coturn/coturn:latest
    network_mode: host  # TURN 必须工作在 Host 网络模式以获取真实公网 IP
    environment:
      - TURN_SERVER_NAME=turn.example.com
      - TURN_REALM=example.com
      - TURN_USERNAME=turnuser
      - TURN_PASSWORD_FILE=/run/secrets/turn_password  # 使用 Secret 管理
      - TURN_MIN_PORT=49152
      - TURN_MAX_PORT=65535
      - TURN_EXTERNAL_IP=<PUBLIC_IP>  # 关键：显式声明公网 IP
      - TURN_LISTENING_IP=0.0.0.0
      - TURN_LOG_LEVEL=2
    secrets:
      - turn_password
    deploy:
      mode: global  # 每个边缘节点部署一个，就近接入
      placement:
        constraints: [node.labels.edge == true]
      resources:
        limits:
          memory: 1G
    # 健康检查：验证 TURN 分配能力
    healthcheck:
      test: ["CMD-SHELL", "turnutils_uclient -u turnuser -w $(cat /run/secrets/turn_password) -p 3478 localhost || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3

// config.js 片段
p2p: {
  enabled: true,           // 启用 P2P，2人会议直连，减轻 JVB 压力
  stunServers: [
    { urls: 'stun:turn.example.com:3478' },
    { urls: 'stun:stun.l.google.com:19302' } // 保留一个公共兜底
  ],
  // 关键：限制 ICE 收集时间，防止弱网下长时间卡在 "Connecting"
  iceTransportPolicy: 'all', // 'relay' 可强制走 TURN，调试用
  // 针对移动网络优化：优先 IPv4，减少 IPv6 失败重试延迟
  preferIPv4: true 
},
// 强制开启 REMB (Receiver Estimated Maximum Bitrate) 估算带宽
// 需 JVB 版本支持，配合 Jicofo 策略动态调整编码层

# 扩大 UDP 接收/发送队列 (默认通常 212KB，远不够)
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.core.rmem_default = 33554432
net.core.wmem_default = 33554432
net.core.netdev_max_backlog = 10000
# 启用 BBR 拥塞控制 (内核 4.9+)，显著改善弱网吞吐
net.ipv4.tcp_congestion_control = bbr
net.core.default_qdisc = fq
# 连接追踪表扩容 (防止 nf_conntrack 满导致丢包)
net.netfilter.nf_conntrack_max = 1000000
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 60

# custom-web/nginx.conf 片段 (挂载覆盖默认配置)
ssl_protocols TLSv1.3;  # 仅允许 1.3
ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256';
ssl_prefer_server_ciphers on;
# HSTS 预加载 (需提交 hstspreload.org)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
# 安全响应头
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options DENY;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' wss: https:; media-src 'self' blob:; worker-src 'self' blob:;";

#!/bin/bash
# 每 30 秒执行一次：收集所有 JVB stress_level，标记节点 Label
for node in $(docker node ls --filter "label=jvb=true" -q); do
  # 通过 JVB REST API 获取压力值 (需 JVB 开启 REST API: JVB_REST_ENABLED=true)
  stress=$(curl -s "http://${node}:8080/colibri/stats" | jq -r '.stress_level // 0')
  # 将压力值映射为 Label (0.0-1.0 -> 0-100)
  label_val=$(echo "$stress * 100" | bc | awk '{printf "%.0f", $1}')
  docker node update --label-add "jvb_load=${label_val}" ${node}
done

# jvb 服务 deploy.placement.preferences
preferences:
  - spread: node.labels.jvb_load  # 优先调度到负载最低的节点

// config.js
channelLastN: 25, // 仅订阅最近发言的 25 路视频流 (大幅降低下行带宽)
lastNLimits: {
  5: 5,
  10: 10,
  20: 15,
  30: 20,
  50: 25,
  100: 25
},
// 服务端强制限制最大发送带宽 (bps) - 需 JVB 支持
// 结合业务后端根据账户套餐动态下发
constraints: {
  video: {
    maxFrameRate: 30,
    maxWidth: 1280,
    maxHeight: 720, // 限制 720p，除非购买 1080p 套餐
    // minFrameRate: 15, // 弱网兜底
  }
},
// 启用 Simulcast (分层编码) - 核心带宽自适应技术
// 发送端编码 3 层 (高/中/低)，接收端根据下行带宽订阅对应层
// 此为 JVB 默认开启，前端需确保不手动关闭
disableSimulcast: false

// useJitsiMeeting.ts
import { useEffect, useRef } from 'react';
import JitsiMeetExternalAPI from 'jitsi-meet-external-api';

interface MeetingConfig {
  roomName: string;
  jwtToken: string; // 后端生成的临时 Token
  userInfo: { displayName: string; email: string; avatarURL?: string };
  onMeetingEnd: () => void;
}

export const useJitsiMeeting = (containerId: string, config: MeetingConfig) => {
  const apiRef = useRef<JitsiMeetExternalAPI | null>(null);

  useEffect(() => {
    const domain = 'meet.example.com';
    const options = {
      roomName: config.roomName,
      width: '100%',
      height: '100%',
      parentNode: document.getElementById(containerId),
      configOverwrite: {
        startWithAudioMuted: true,
        startWithVideoMuted: true,
        prejoinPageEnabled: false, // 跳过预加入页，直接入会
        hideLobbyButton: true,
        // 白标定制：隐藏水印、Logo、设置菜单项
        disableDeepLinking: true,
        brandingRoomAlias: `会议室-${config.roomName}`,
      },
      interfaceConfigOverwrite: {
        TOOLBAR_BUTTONS: [
          'microphone', 'camera', 'closedcaptions', 'desktop', 
          'fullscreen', 'fodeviceselection', 'hangup', 
          'profile', 'chat', 'recording', 'livestreaming',
          'etherpad', 'sharedvideo', 'settings', 'raisehand',
          'videoquality', 'filmstrip', 'invite', 'feedback',
          'stats', 'shortcuts', 'tileview', 'videobackgroundblur',
          'download', 'help', 'mute-everyone', 'e2ee'
        ],
        // 隐藏不需要的按钮 (如直播、录制、设置)
        // TOOLBAR_BUTTONS: ['microphone', 'camera', 'hangup', 'chat', 'raisehand']
      },
      jwt: config.jwtToken,
      userInfo: config.userInfo,
      onload: () => console.log('Jitsi Loaded'),
    };

    apiRef.current = new JitsiMeetExternalAPI(domain, options);

    // 事件监听：同步会议状态到业务端
    apiRef.current.addEventListener('videoConferenceJoined', (data) => {
      // 通知后端：用户实际入会，开始计费/记录考勤
      notifyBackend('joined', { ...data, room: config.roomName });
    });
    apiRef.current.addEventListener('videoConferenceLeft', () => {
      config.onMeetingEnd();
      notifyBackend('left', { room: config.roomName });
    });
    // 监听被踢出、网络中断等异常
    apiRef.current.addEventListener('kickedOut', () => alert('您已被移出会议'));
    apiRef.current.addEventListener('connectionInterrupted', () => showToast('网络不稳定，正在重连...'));

    return () => {
      apiRef.current?.dispose(); // 组件卸载时销毁实例，释放媒体资源
    };
  }, [config.roomName, config.jwtToken]); // 依赖项变化时重建会议
};