a01e973335
- deploy/docker-compose.dev.yml 新增 media-server 服务 + coturn(profiles:public),
全部服务参数改为 env 变量注入，go-service 依赖 media-server
- deploy/.env.example / .env.local.example / .env.public.example 三份模板,
公网模板用 _REPLACE_WITH_*_ 占位符防"示例值上生产"
- scripts/start.sh / stop.sh / status.sh 新增 full 子命令对接 docker compose --profile public
- scripts/deploy-public.sh 新建：env 校验 + 端口 checklist + Docker 自检 +
--profile public up -d --build + 健康检查闭环
- docs/deployment/meeting-mvp.md 新建：双态部署全流程 + 强密码生成 + 防火墙 + FAQ
- 双模式 docker compose config 校验通过；deploy-public.sh 三种错误场景按预期退出
同步更新 CURRENT_STATUS / implementation.plan / project-context
Task 0-14 ✅ / 剩余 Task 15-16
Made-with: Cursor
76 lines
3.0 KiB
Plaintext
76 lines
3.0 KiB
Plaintext
# ============================================================
|
||
# EchoChat 公网部署环境变量示例
|
||
# 用法：cp deploy/.env.public.example deploy/.env
|
||
# 然后修改下面的 MEDIASOUP_ANNOUNCED_IP / TURN_* / 所有密码
|
||
# 启动：scripts/deploy-public.sh（会校验关键参数 + 开 public profile）
|
||
# ============================================================
|
||
|
||
DEPLOY_MODE=public
|
||
|
||
# ============================================================
|
||
# 中间件（生产环境 MUST 修改密码）
|
||
# ============================================================
|
||
POSTGRES_DB=echochat
|
||
POSTGRES_USER=echochat
|
||
POSTGRES_PASSWORD=_REPLACE_WITH_STRONG_PG_PASSWORD_
|
||
|
||
REDIS_PASSWORD=_REPLACE_WITH_STRONG_REDIS_PASSWORD_
|
||
|
||
MINIO_ROOT_USER=echochat
|
||
MINIO_ROOT_PASSWORD=_REPLACE_WITH_STRONG_MINIO_PASSWORD_
|
||
|
||
# ============================================================
|
||
# Go backend
|
||
# ============================================================
|
||
GO_SERVICE_PORT=8085
|
||
# MUST 替换为随机 64 字符字符串；生产可用 openssl rand -hex 32
|
||
JWT_SECRET=_REPLACE_WITH_RANDOM_64_CHAR_SECRET_
|
||
|
||
# ============================================================
|
||
# mediasoup（关键：MEDIASOUP_ANNOUNCED_IP 必填）
|
||
# ============================================================
|
||
# Go ↔ Node 内部 token，必须与 media-server/.env 一致
|
||
MEDIA_INTERNAL_TOKEN=_REPLACE_WITH_SECURE_INTERNAL_TOKEN_
|
||
|
||
MEDIASOUP_LISTEN_IP=0.0.0.0
|
||
|
||
# ⚠️ 必填：填服务器的**公网 IP** 或解析到公网 IP 的域名 A 记录
|
||
# 示例：MEDIASOUP_ANNOUNCED_IP=203.0.113.42
|
||
# 留空会导致远端浏览器只能拿到局域网/回环地址，完全建不连
|
||
MEDIASOUP_ANNOUNCED_IP=
|
||
|
||
MEDIASOUP_RTC_MIN_PORT=40000
|
||
MEDIASOUP_RTC_MAX_PORT=40199
|
||
|
||
# ============================================================
|
||
# TURN 开启（公网对称 NAT fallback 必备）
|
||
# ============================================================
|
||
TURN_ENABLED=true
|
||
|
||
TURN_REALM=echochat
|
||
# MUST 改密码，否则 TURN 可能被互联网匿名中继流量滥用
|
||
TURN_USERNAME=_REPLACE_WITH_TURN_USERNAME_
|
||
TURN_PASSWORD=_REPLACE_WITH_STRONG_TURN_PASSWORD_
|
||
|
||
TURN_LISTEN_PORT=3478
|
||
TURN_TLS_PORT=5349
|
||
TURN_MIN_PORT=49160
|
||
TURN_MAX_PORT=49200
|
||
|
||
# ============================================================
|
||
# 公网部署 checklist（启动前必查）
|
||
# ------------------------------------------------------------
|
||
# 1. 所有 _REPLACE_WITH_*_ 占位符都已替换为真实强密码
|
||
# 2. MEDIASOUP_ANNOUNCED_IP 已设置为服务器公网 IP
|
||
# 3. 云安全组/iptables 放通以下端口：
|
||
# - TCP 8085 Go backend API
|
||
# - TCP 5173 前端用户端（如单独暴露）
|
||
# - UDP 40000-40199 mediasoup RTC 流量
|
||
# - TCP 40000-40199 mediasoup ICE-TCP fallback
|
||
# - UDP 3478 coturn STUN/TURN
|
||
# - TCP 3478 coturn
|
||
# - TCP 5349 coturn TLS
|
||
# - UDP 49160-49200 coturn 中继流量
|
||
# 4. scripts/deploy-public.sh 会自动进行一轮参数 + 端口校验
|
||
# ============================================================
|