# SFU Dockerfile
FROM ubuntu:22.04

# 避免交互式提示
ENV DEBIAN_FRONTEND=noninteractive

# 安装依赖
RUN apt-get update && apt-get install -y \
    build-essential \
    cmake \
    libssl-dev \
    libavcodec-dev \
    libavformat-dev \
    libavutil-dev \
    && rm -rf /var/lib/apt/lists/*

# 创建应用目录
WORKDIR /app

# 复制源码
COPY src/ ./src/
COPY CMakeLists.txt .

# 编译
RUN mkdir build && cd build \
    && cmake .. -DCMAKE_BUILD_TYPE=Release \
    && make -j$(nproc)

# 运行时阶段（多阶段构建，减小镜像）
FROM ubuntu:22.04

RUN apt-get update && apt-get install -y \
    libssl3 \
    libavcodec58 \
    libavformat58 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# 从构建阶段复制二进制
COPY --from=0 /app/build/sfu_server .
COPY --from=0 /app/build/config.yaml ./config/

# 暴露端口
EXPOSE 8080/tcp  # HTTP API
EXPOSE 3478/tcp  # TURN TCP
EXPOSE 3478/udp  # TURN UDP
EXPOSE 10000-20000/udp  # RTP端口范围

# 健康检查
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1

# 运行
ENTRYPOINT ["./sfu_server"]
CMD ["-c", "config/config.yaml"]

# 构建镜像
docker build -t your-registry/sfu-server:v1.0.0 .

# 本地测试运行
docker run -d \
  --name sfu \
  -p 8080:8080 \
  -p 3478:3478/tcp \
  -p 3478:3478/udp \
  -p 10000-10100:10000-10100/udp \
  your-registry/sfu-server:v1.0.0

# 推送镜像到仓库
docker login your-registry.com
docker push your-registry/sfu-server:v1.0.0

# 每条指令创建一个新层
FROM ubuntu:20.04              # Layer 0: 基础镜像

RUN apt-get update && \        # Layer 1
    apt-get install -y python3 # 系统依赖

WORKDIR /app                   # 元数据层（通常不计入）

COPY requirements.txt .        # Layer 2: 依赖列表
RUN pip install -r ...         # Layer 3: Python依赖

COPY src/ .                    # Layer 4: 应用代码

CMD ["python", "app.py"]       # 元数据层

# 优化前（缓存效率低）
FROM ubuntu:20.04
COPY . /app           # 代码变更会 invalidated 所有后续层
RUN apt-get update && apt-get install -y python3
RUN pip install -r /app/requirements.txt
RUN apt-get install -y ffmpeg

# 优化后（缓存效率高）
FROM ubuntu:20.04
# 1. 系统依赖（很少变化）
RUN apt-get update && apt-get install -y \
    python3 python3-pip ffmpeg \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# 2. Python依赖（偶尔变化）
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# 3. 应用代码（频繁变化）
COPY src/ ./src/

CMD ["python", "-m", "src.main"]

# 构建阶段（包含编译工具，体积大）
FROM gcc:11 AS builder
WORKDIR /build
COPY src/ ./
RUN make -j$(nproc)  # 编译

# 运行阶段（仅包含运行时依赖，体积小）
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y \
    libssl3 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# 只复制编译结果
COPY --from=builder /build/sfu_server .
COPY config.yaml ./

EXPOSE 8080 3478/udp
CMD ["./sfu_server"]

# 使用更小的基础镜像
FROM alpine:3.18 AS runtime

# Alpine使用musl libc，体积更小
RUN apk add --no-cache \
    libstdc++ \
    openssl \
    ca-certificates

# 或者使用distroless（Google维护的最小镜像）
FROM gcr.io/distroless/cc-debian11

# distroless没有shell，更安全
COPY --from=builder /app/sfu_server /
ENTRYPOINT ["/sfu_server"]

# 多服务统一部署
FROM ubuntu:22.04

WORKDIR /app

# 复制所有服务
COPY sfu/sfu_server ./
COPY mcu/mcu_server ./
COPY signaling/signaling_server ./
COPY dashboard/dashboard ./

# 复制启动脚本
COPY scripts/start.sh ./
RUN chmod +x start.sh

# 环境变量指定启动哪个服务
ENV SERVICE_TYPE=sfu

EXPOSE 8080 8081 8082 3000

ENTRYPOINT ["./start.sh"]

# start.sh
#!/bin/bash

case $SERVICE_TYPE in
    sfu)
        exec ./sfu_server "$@"
        ;;
    mcu)
        exec ./mcu_server "$@"
        ;;
    signaling)
        exec ./signaling_server "$@"
        ;;
    dashboard)
        exec ./dashboard "$@"
        ;;
    *)
        echo "Unknown service type: $SERVICE_TYPE"
        exit 1
        ;;
esac

# 方案1: Bridge + 端口映射（一般场景）
docker run -d \
  --name sfu \
  --network bridge \
  -p 8080:8080 \
  -p 3478:3478/tcp \
  -p 3478:3478/udp \
  -p 10000-11000:10000-11000/udp \
  sfu-server

# 方案2: Host网络（高性能场景，避免NAT开销）
docker run -d \
  --name sfu \
  --network host \
  sfu-server

# 方案3: 自定义网络（容器间通信）
docker network create live-network
docker run -d --network live-network --name sfu sfu-server
docker run -d --network live-network --name signaling signaling-server
# 容器间可通过容器名直接通信: http://signaling:8082

# 创建自定义网络
docker network create \
  --driver bridge \
  --subnet=172.20.0.0/16 \
  --gateway=172.20.0.1 \
  live-network

# 查看网络配置
docker network inspect live-network

# 运行容器并指定固定IP
docker run -d \
  --name sfu \
  --network live-network \
  --ip 172.20.0.10 \
  sfu-server

# docker-compose中的存储配置
version: '3.8'
services:
  sfu:
    image: sfu-server
    volumes:
      # Named Volume - 生产推荐
      - sfu-logs:/app/logs
      - sfu-data:/app/data
      
      # Bind Mount - 开发调试
      - ./config/sfu.yaml:/app/config.yaml:ro
      - /etc/localtime:/etc/localtime:ro
      
      # tmpfs - 临时缓存，容器重启清空
      - type: tmpfs
        target: /app/cache
        tmpfs:
          size: 100M

volumes:
  sfu-logs:
    driver: local
  sfu-data:
    driver: local

version: '3.8'
services:
  sfu:
    volumes:
      # 配置文件 - 只读绑定
      - ./config/sfu.yaml:/app/config/config.yaml:ro
      
      # 日志文件 - 持久化Volume
      - sfu-logs:/app/logs
      
      # 录制文件（如SFU支持录制）- 大容量Volume
      - type: bind
        source: /data/recordings
        target: /app/recordings
  
  recorder:
    volumes:
      # 录制服务 - 大容量存储
      - recordings:/recordings
      
      # 临时转码文件 - tmpfs加速
      - type: tmpfs
        target: /tmp/transcode
        tmpfs:
          size: 2G
  
  redis:
    volumes:
      # 缓存数据 - 需要持久化
      - redis-data:/data

volumes:
  # 日志（定期清理）
  sfu-logs:
    driver: local
  
  # 录制文件（大容量，可能使用外部存储）
  recordings:
    driver: local
    driver_opts:
      type: nfs
      o: addr=nfs-server,rw
      device: ":/exports/recordings"
  
  # Redis数据
  redis-data:
    driver: local

# 性能测试: Bind Mount vs Volume
docker run --rm -v /tmp/data:/data alpine sh -c "time dd if=/dev/zero of=/data/test bs=1M count=100"
docker run --rm -v test-volume:/data alpine sh -c "time dd if=/dev/zero of=/data/test bs=1M count=100"

version: '3.8'

services:
  # SFU服务
  sfu:
    build:
      context: ./sfu
      dockerfile: Dockerfile
    image: live-system/sfu:latest
    container_name: live-sfu
    restart: unless-stopped
    ports:
      - "8080:8080"      # HTTP API
      - "3478:3478/tcp"  # TURN TCP
      - "3478:3478/udp"  # TURN UDP
      - "10000-10100:10000-10100/udp"  # RTP
    environment:
      - SERVICE_TYPE=sfu
      - LOG_LEVEL=info
      - TURN_REALM=live.example.com
      - TURN_SHARED_SECRET=${TURN_SECRET}
    volumes:
      - ./config/sfu.yaml:/app/config/config.yaml:ro
      - sfu-logs:/app/logs
    networks:
      - live-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 4G
        reservations:
          cpus: '2.0'
          memory: 2G

  # MCU服务
  mcu:
    build:
      context: ./mcu
      dockerfile: Dockerfile
    image: live-system/mcu:latest
    container_name: live-mcu
    restart: unless-stopped
    ports:
      - "8081:8081"
    environment:
      - SERVICE_TYPE=mcu
      - GPU_ENABLED=true
    volumes:
      - ./config/mcu.yaml:/app/config/config.yaml:ro
      - mcu-logs:/app/logs
    networks:
      - live-net
    # GPU支持（需要nvidia-docker）
    runtime: nvidia
    environment:
      - NVIDIA_VISIBLE_DEVICES=all
    deploy:
      resources:
        limits:
          cpus: '8.0'
          memory: 16G

  # 信令服务
  signaling:
    build:
      context: ./signaling
      dockerfile: Dockerfile
    image: live-system/signaling:latest
    container_name: live-signaling
    restart: unless-stopped
    ports:
      - "8082:8082"
    environment:
      - SERVICE_TYPE=signaling
      - REDIS_URL=redis://redis:6379
      - DATABASE_URL=postgres://postgres:${DB_PASSWORD}@postgres:5432/live
    depends_on:
      - redis
      - postgres
    volumes:
      - ./config/signaling.yaml:/app/config/config.yaml:ro
    networks:
      - live-net

  # 录制服务
  recorder:
    build:
      context: ./recorder
      dockerfile: Dockerfile
    image: live-system/recorder:latest
    container_name: live-recorder
    restart: unless-stopped
    environment:
      - SERVICE_TYPE=recorder
      - STORAGE_PATH=/recordings
    volumes:
      - ./recordings:/recordings
      - ./config/recorder.yaml:/app/config/config.yaml:ro
    networks:
      - live-net

  # Redis缓存
  redis:
    image: redis:7-alpine
    container_name: live-redis
    restart: unless-stopped
    volumes:
      - redis-data:/data
    networks:
      - live-net

  # PostgreSQL数据库
  postgres:
    image: postgres:15-alpine
    container_name: live-postgres
    restart: unless-stopped
    environment:
      - POSTGRES_DB=live
      - POSTGRES_USER=postgres
      - POSTGRES_PASSWORD=${DB_PASSWORD}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - live-net

  # Nginx反向代理
  nginx:
    image: nginx:alpine
    container_name: live-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - ./nginx/html:/usr/share/nginx/html:ro
    depends_on:
      - sfu
      - signaling
    networks:
      - live-net

volumes:
  sfu-logs:
  mcu-logs:
  redis-data:
  postgres-data:

networks:
  live-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

# .env文件
TURN_SECRET=your-turn-secret-key-here
DB_PASSWORD=your-database-password
REDIS_PASSWORD=your-redis-password

# Let's Encrypt证书
SSL_CERT_PATH=/etc/letsencrypt/live/your-domain.com/fullchain.pem
SSL_KEY_PATH=/etc/letsencrypt/live/your-domain.com/privkey.pem

# 启动所有服务
docker-compose up -d

# 查看日志
docker-compose logs -f sfu

# 重启服务
docker-compose restart sfu

# 停止所有服务
docker-compose down

# 完全清理（包括数据卷）
docker-compose down -v

# 扩展SFU实例
docker-compose up -d --scale sfu=3

# 更新镜像并重启
docker-compose pull
docker-compose up -d

# docker-compose.logging.yml
version: '3.8'

services:
  # Fluentd日志收集
  fluentd:
    build: ./fluentd
    volumes:
      - ./fluentd/conf:/fluentd/etc
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
    ports:
      - "24224:24224"
      - "24224:24224/udp"
    networks:
      - live-net

  # Elasticsearch
  elasticsearch:
    image: elasticsearch:8.5.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
    volumes:
      - es-data:/usr/share/elasticsearch/data
    networks:
      - live-net

  # Kibana可视化
  kibana:
    image: kibana:8.5.0
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch
    networks:
      - live-net

# 添加Prometheus监控
  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    ports:
      - "9090:9090"
    networks:
      - live-net

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
    networks:
      - live-net

#!/bin/bash
# deploy.sh - 自动部署脚本

set -e

# 拉取最新代码
git pull origin master

# 重新构建镜像
docker-compose build

# 滚动更新（零停机）
docker-compose up -d --no-deps --scale sfu=2 sfu
docker-compose up -d --no-deps --scale sfu=1 sfu
docker-compose up -d

# 健康检查
sleep 10
if ! curl -f http://localhost:8080/health; then
    echo "Health check failed! Rolling back..."
    git revert HEAD
    docker-compose up -d
    exit 1
fi

echo "Deployment successful!"