# 校验版本
docker version
docker compose version

video-conference-deploy/
├── .env                    # 全局环境变量（版本号、公共密钥）
├── docker-compose.yml      # 基础编排模板（含通用服务定义）
├── docker-compose.override.yml # 本地开发覆盖（Git 忽略）
├── environments/           # 环境差异化配置目录
│   ├── dev/
│   │   ├── .env.dev
│   │   └── docker-compose.dev.yml
│   ├── staging/
│   │   ├── .env.staging
│   │   └── docker-compose.staging.yml
│   └── prod/
│       ├── .env.prod
│       └── docker-compose.prod.yml
├── configs/                # 统一配置文件挂载源
│   ├── nginx/
│   ├── jvb/                # Jitsi Videobridge 配置
│   └── prosody/
├── scripts/                # 运维辅助脚本 (backup.sh, healthcheck.sh)
└── data/                   # 本地持久化数据目录 (生产环境建议挂载 NAS/云盘)
    ├── postgres/
    ├── redis/
    └── recordings/

version: '3.8'

services:
  # 1. 反向代理与 SSL 终结
  proxy:
    image: nginx:alpine
    container_name: ${PROJECT_NAME}-proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./configs/nginx:/etc/nginx/conf.d:ro
      - ./certs:/etc/ssl/certs:ro
      - proxy_logs:/var/log/nginx
    depends_on:
      - web
      - jvb
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M

  # 2. 前端静态资源服务
  web:
    image: ${WEB_IMAGE}:${WEB_TAG}
    container_name: ${PROJECT_NAME}-web
    volumes:
      - ./configs/web/config.js:/usr/share/nginx/html/config.js:ro
    # 无需暴露端口，仅供 proxy 反代

  # 3. 信令服务
  prosody:
    image: ${PROSODY_IMAGE}:${PROSODY_TAG}
    container_name: ${PROJECT_NAME}-prosody
    environment:
      - XMPP_DOMAIN=${XMPP_DOMAIN}
      - AUTH_TYPE=internal
      - ENABLE_LOBBY=true
    volumes:
      - prosody_data:/var/lib/prosody
      - ./configs/prosody:/config:ro
    healthcheck:
      test: ["CMD-SHELL", "prosodyctl status | grep -q 'running'"]
      interval: 30s

  # 4. 视频转发单元 (SFU) - 核心计算节点
  jvb:
    image: ${JVB_IMAGE}:${JVB_TAG}
    container_name: ${PROJECT_NAME}-jvb
    environment:
      - XMPP_SERVER=prosody
      - XMPP_DOMAIN=${XMPP_DOMAIN}
      - JVB_AUTH_USER=jvb
      - JVB_AUTH_PASSWORD=${JVB_SECRET}
      - DOCKER_HOST_ADDRESS=${PUBLIC_IP} # 关键：NAT 穿透需配置公网 IP
    # 生产环境建议 host 网络模式以获得最佳 UDP 性能，开发环境用 bridge
    network_mode: "bridge" 
    ports:
      - "${JVB_PORT:-10000}:10000/udp" # 媒体端口
      - "${JVB_TCP_PORT:-4443}:4443/tcp" # 备用 TCP
    volumes:
      - ./configs/jvb:/config:ro
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M

  # 5. 数据库与缓存
  db:
    image: postgres:15-alpine
    container_name: ${PROJECT_NAME}-db
    environment:
      - POSTGRES_DB=${DB_NAME}
      - POSTGRES_USER=${DB_USER}
      - POSTGRES_PASSWORD=${DB_PASS}
    volumes:
      - db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER}"]
      interval: 10s

  redis:
    image: redis:7-alpine
    container_name: ${PROJECT_NAME}-redis
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes:
      - redis_data:/data

volumes:
  prosody_data:
  db_data:
  redis_data:
  proxy_logs:

# 镜像版本锁定（生产严禁 latest）
WEB_TAG=v2.1.5
JVB_TAG=stable-8942
PROSODY_TAG=1.2.0

# 资源强隔离
JVB_CPU_LIMIT=4.0
JVB_MEM_LIMIT=8G
DB_MEM_LIMIT=2G

# 安全加固
JVB_SECRET=Str0ngR@nd0mP@ssw0rdPr0d
DB_PASS=An0therStr0ngP@ssPr0d
PUBLIC_IP=203.0.113.10
ENABLE_TLS=true

WEB_TAG=dev-latest
JVB_TAG=dev-latest
JVB_CPU_LIMIT=1.0
JVB_MEM_LIMIT=1G
PUBLIC_IP=127.0.0.1 # 本地回环
ENABLE_TLS=false

services:
  jvb:
    network_mode: "host" # 生产用 Host 网络
    ports: []            # 移除端口映射
    deploy:
      resources:
        limits:
          cpus: '${JVB_CPU_LIMIT}'
          memory: ${JVB_MEM_LIMIT}
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"

  db:
    deploy:
      resources:
        limits:
          memory: ${DB_MEM_LIMIT}
    command: ["postgres", "-c", "max_connections=500", "-c", "shared_buffers=512MB"]

  proxy:
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "10"

# 查看 JVB 容器内存限制
docker inspect ${PROJECT_NAME}-jvb | grep -A 5 "Memory"

# 进入容器压测验证 OOM Kill 行为
docker exec -it ${PROJECT_NAME}-jvb stress --vm 2 --vm-bytes 1G --timeout 60s

#!/bin/bash
set -euo pipefail

ENV=${1:-dev}
PROJECT_NAME="vc-meeting"

case $ENV in
  dev)
    COMPOSE_FILES="-f docker-compose.yml -f environments/dev/docker-compose.dev.yml"
    ENV_FILE="environments/dev/.env.dev"
    ;;
  staging)
    COMPOSE_FILES="-f docker-compose.yml -f environments/staging/docker-compose.staging.yml"
    ENV_FILE="environments/staging/.env.staging"
    ;;
  prod)
    COMPOSE_FILES="-f docker-compose.yml -f environments/prod/docker-compose.prod.yml"
    ENV_FILE="environments/prod/.env.prod"
    ;;
  *)
    echo "Usage: $0 {dev|staging|prod}"
    exit 1
    ;;
esac

echo ">>> Deploying [$ENV] environment..."
docker compose --env-file $ENV_FILE $COMPOSE_FILES pull        # 拉取指定版本镜像
docker compose --env-file $ENV_FILE $COMPOSE_FILES up -d --remove-orphans # 滚动更新
docker compose --env-file $ENV_FILE $COMPOSE_FILES ps           # 状态确认

                    ┌─────────────────────┐
                    │   用户接入层 (DNS)   │
                    └──────────┬──────────┘
                               │
              ┌────────────────┼────────────────┐
              ▼                ▼                ▼
        ┌──────────┐    ┌──────────┐    ┌──────────┐
        │  Node-1  │    │  Node-2  │    │  Node-N  │  (Keepalived VIP 漂移)
        │ (Master) │◄──►│ (Backup) │    │ (Worker) │
        └────┬─────┘    └────┬─────┘    └────┬─────┘
             │               │               │
     ┌───────┴───────┐ ┌─────┴─────┐ ┌──────┴──────┐
     │ 共享存储      │ │ 外部数据库 │ │  对象存储   │
     │ (NFS/Ceph/    │ │ (PostgreSQL│ │ (MinIO/S3/  │
     │  云盘)        │ │  主从/集群)│ │  云厂商)    │
     └───────────────┘ └───────────┘ └─────────────┘

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.1.100/24 dev eth0 label eth0:vip
    }
    # 监控 Nginx 进程健康，挂了自动降权触发漂移
    track_script {
        chk_nginx
    }
}

vrrp_script chk_nginx {
    script "/usr/local/bin/check_nginx.sh"
    interval 2
    weight -20
    fall 3
    rise 2
}

#!/bin/bash
# 检查核心容器是否健康
if ! docker inspect --format='{{.State.Health.Status}}' vc-meeting-proxy 2>/dev/null | grep -q "healthy"; then
    exit 1
fi
exit 0

# 1. 网络栈扩容 - 核心：解决高并发 UDP 丢包
net.core.netdev_max_backlog = 65535
net.core.somaxconn = 65535
net.core.rmem_max = 67108864      # 64MB 接收缓冲
net.core.wmem_max = 67108864      # 64MB 发送缓冲
net.ipv4.udp_mem = 65536 131072 262144
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384

# 2. 连接追踪优化 - 防止 nf_conntrack 表满导致丢包
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 60

# 3. TCP 优化 (信令/HTTP/录制走 TCP)
net.ipv4.tcp_fastopen = 3
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_max_syn_backlog = 8192

# 4. 虚拟内存 - 减少 Swap 干扰实时性
vm.swappiness = 1
vm.dirty_ratio = 10
vm.dirty_background_ratio = 5

# 5. 文件句柄
fs.file-max = 2097152
fs.nr_open = 1048576

{
  "default-ulimits": {
    "nofile": { "Name": "nofile", "Hard": 1048576, "Soft": 1048576 },
    "memlock": { "Name": "memlock", "Hard": -1, "Soft": -1 }
  },
  "log-driver": "json-file",
  "log-opts": { "max-size": "100m", "max-file": "5" },
  "default-shm-size": "2g"  # 关键：WebRTC/Chrome 录制需要大量共享内存
}

services:
  jvb:
    environment:
      # 1. 基础堆内存 (建议物理内存 50%-60%，留 30% 给 Direct Memory/OS/Off-heap)
      - JAVA_SYS_PROPS=-Xms4g -Xmx4g -XX:+UseG1GC -XX:MaxGCPauseMillis=50 -XX:+ParallelRefProcEnabled
      # 2. 直接内存 - 关键！Netty/ICE/UDP 缓冲区大量使用堆外内存，必须显式设置 >= Heap
      - XX:MaxDirectMemorySize=6g
      # 3. GC 日志与诊断
      - -Xlog:gc*:file=/var/log/jvb/gc-%t.log:time,uptime,level,tags:filecount=5,filesize=100m
      # 4. 网络栈优化 - 启用 Linux 原生传输 (epoll) 减少 JNI 开销
      - -Dio.netty.transport.noNative=true  # 若宿主机内核<4.19 或 Alpine 无法加载 netty-tcnative 时设为 true
      - -Djdk.net.useFastTcp=true
      # 5. ICE/STUN/TURN 优化
      - -Dorg.ice4j.ice.harvest.ALL_INTERFACES=true
      - -Dorg.ice4j.ice.harvest.DISABLE_DOCKER_HOST=true # 避免绑定 docker0 网桥 IP
    ulimits:
      nofile:
        soft: 1048576
        hard: 1048576
      memlock:
        soft: -1
        hard: -1
    # 6. CPU 亲和性绑定 (物理机多核场景，减少上下文切换)
    cpuset: "0-7"  # 绑定到物理核心 0-7

worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 1048576;

events {
    use epoll;
    worker_connections 65535;
    multi_accept on;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    keepalive_requests 10000;
    reset_timedout_connection on;
    client_body_buffer_size 128k;

    # WebSocket 长连接优化 (信令/Colibri)
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
    
    # 启用 Brotli 压缩 (比 gzip 更伂)
    brotli on;
    brotli_types text/plain application/javascript application/json text/css application/xml;
}

main (生产环境镜像 Tag 固定)
  │
  ├── release/v2.1.x (预发布/Staging 验证)
  │
  └── feature/* / hotfix/* (开发分支 -> Dev 环境自动部署)

stages:
  - validate      # 语法检查、安全扫描
  - build         # 构建多架构镜像
  - test          # 单元/集成/契约测试
  - deploy-dev    # 自动部署开发环境
  - deploy-staging# 手动触发预发布
  - deploy-prod   # 手动触发生产 (需审批)

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"
  REGISTRY: registry.example.com/vc-meeting

# 1. 语法与安全扫描 (每次 MR 触发)
compose_lint:
  stage: validate
  image: docker/compose:latest
  script:
    - docker compose -f docker-compose.yml config -q  # 语法校验
    - docker run --rm -v $(pwd):/project aquasec/trivy config --severity HIGH,CRITICAL /project # IaC 扫描
    - docker run --rm -v $(pwd):/project hadolint/hadolint hadolint /project/Dockerfile* # Dockerfile 规范

# 2. 多架构构建并推送 (BuildKit)
build_images:
  stage: build
  image: docker:24-cli
  services:
    - docker:24-dind
  script:
    - docker buildx create --use --name multiarch --driver docker-container
    - |
      for SVC in web prosody jvb; do
        docker buildx build 
          --platform linux/amd64,linux/arm64 
          --tag ${REGISTRY}/${SVC}:${CI_COMMIT_SHA} 
          --tag ${REGISTRY}/${SVC}:${CI_COMMIT_REF_SLUG} 
          --push ./services/${SVC};
      done
  only:
    - branches
    - tags

# 3. 开发环境自动部署
deploy_dev:
  stage: deploy-dev
  image: alpine:latest
  before_script:
    - apk add --no-cache openssh-client bash
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY_DEV" | ssh-add -
    - mkdir -p ~/.ssh && ssh-keyscan $DEV_HOST >> ~/.ssh/known_hosts
  script:
    - |
      ssh $DEV_USER@$DEV_HOST << 'EOF'
        cd /opt/vc-meeting-deploy
        git pull origin main
        # 使用开发环境专用配置拉起
        ./scripts/deploy.sh dev
      EOF
  environment:
    name: development
    url: https://dev.meeting.example.com
  only: [main, develop]

# 4. 生产环境蓝绿部署 (手动触发 + 审批)
deploy_prod:
  stage: deploy-prod
  image: alpine:latest
  when: manual
  environment:
    name: production
    url: https://meeting.example.com
  script:
    - |
      ssh $PROD_USER@$PROD_HOST << 'EOF'
        cd /opt/vc-meeting-deploy
        git pull origin main
        # 1. 修改 .env.prod 镜像 Tag 为本次 Pipeline Tag
        sed -i "s/^JVB_TAG=.*/JVB_TAG=${CI_COMMIT_TAG}/" environments/prod/.env.prod
        sed -i "s/^WEB_TAG=.*/WEB_TAG=${CI_COMMIT_TAG}/" environments/prod/.env.prod
        # 2. 滚动更新 (零停机)
        ./scripts/deploy.sh prod
        # 3. 冒烟测试
        sleep 30
        curl -f https://meeting.example.com/health || exit 1
      EOF
  only: [tags]

#!/bin/bash
set -euo pipefail
BACKUP_DIR="/backup/postgres/$(date +%Y%m%d)"
mkdir -p "$BACKUP_DIR"

# 使用 pg_dump (逻辑备份，适合中小库) 或 pg_basebackup (物理备份，大库首选)
# 此处演示逻辑备份 + 压缩 + 加密上传 S3
docker exec vc-meeting-db pg_dump -U ${DB_USER} -d ${DB_NAME} --no-owner --no-acl | 
  gzip -c | 
  openssl enc -aes-256-cbc -pbkdf2 -pass pass:"${BACKUP_ENC_KEY}" 
  > "${BACKUP_DIR}/${DB_NAME}_$(date +%H%M).sql.gz.enc"

# 上传至 MinIO/S3 (需安装 mc 客户端)
mc cp "${BACKUP_DIR}/*.enc" minio/vc-meeting-backup/postgres/

# 清理本地 7 天前数据
find /backup/postgres -type f -mtime +7 -delete

# 1. 构建阶段 - 使用国产 JDK (如龙井 JDK 17)
FROM registry.cn-hangzhou.aliyuncs.com/dragonwell/dragonwell:17-anolis AS builder
WORKDIR /build
COPY . .
RUN ./gradlew shadowJar --no-daemon

# 2. 运行阶段 - 基础镜像选国产 OS (如 openAnolis/Anolis OS 8)
FROM registry.cn-hangzhou.aliyuncs.com/openanolis/anolisos:8.8
# 安装依赖: tzdata, fontconfig, libstdc++, iproute, procps-ng
RUN dnf install -y tzdata fontconfig libstdc++ iproute procps-ng && dnf clean all

# 创建非 root 用户
RUN groupadd -r jvb --gid=1000 && useradd -r -g jvb --uid=1000 -m -s /bin/bash jvb

COPY --from=builder /build/jvb/target/jvb-all.jar /opt/jvb/jvb.jar
COPY docker-entrypoint.sh /opt/jvb/
RUN chown -R jvb:jvb /opt/jvb

USER 1000
EXPOSE 10000/udp 4443/tcp
ENTRYPOINT ["/opt/jvb/docker-entrypoint.sh"]

docker buildx build 
  --platform linux/amd64,linux/arm64 
  --tag registry.intranet.example.com/vc-meeting/jvb:v2.1.5-kylin 
  --push .