From 4ea95e37862c023fd7c864a105a434c27eaf6445 Mon Sep 17 00:00:00 2001 From: Meghdad Date: Fri, 15 May 2026 17:18:46 +0330 Subject: [PATCH] add domain configurations --- .gitignore | 1 + deploy/mediamtx.yml | 11 +++---- deploy/nginx/README.md | 42 ++++++++++++++++++++++++ deploy/nginx/nyone-app.conf | 65 +++++++++++++++++++++++++++++++++++++ deploy/nginx/nyone-hls.conf | 41 +++++++++++++++++++++++ 5 files changed, 154 insertions(+), 6 deletions(-) create mode 100644 deploy/nginx/README.md create mode 100644 deploy/nginx/nyone-app.conf create mode 100644 deploy/nginx/nyone-hls.conf diff --git a/.gitignore b/.gitignore index 74e10e4..7ecdee7 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ yarn-error.log /.nova /.vscode /.zed +deploy/mediamtx.home.yml diff --git a/deploy/mediamtx.yml b/deploy/mediamtx.yml index f3df484..69cae1e 100644 --- a/deploy/mediamtx.yml +++ b/deploy/mediamtx.yml @@ -1,5 +1,5 @@ authMethod: http -authHTTPAddress: http://127.0.0.1:8001/internal/mediamtx/auth?secret=change-this-secret +authHTTPAddress: https://nyone.net/internal/mediamtx/auth?secret=change-this-secret authHTTPExclude: - action: read - action: playback @@ -14,17 +14,16 @@ hls: yes hlsAddress: :19988 hlsVariant: mpegts hlsAllowOrigins: - - http://127.0.0.1:8001 - - http://localhost:8001 + - https://nyone.net record: yes recordPath: ./storage/app/private/recordings/%path/%Y-%m-%d_%H-%M-%S-%f pathDefaults: - runOnReady: curl -X POST "http://127.0.0.1:8001/internal/mediamtx/ready?secret=change-this-secret" --data-urlencode "path=$MTX_PATH" --data-urlencode "source_type=$MTX_SOURCE_TYPE" --data-urlencode "source_id=$MTX_SOURCE_ID" + runOnReady: curl -X POST "https://nyone.net/internal/mediamtx/ready?secret=change-this-secret" --data-urlencode "path=$MTX_PATH" --data-urlencode "source_type=$MTX_SOURCE_TYPE" --data-urlencode "source_id=$MTX_SOURCE_ID" runOnReadyRestart: no - runOnNotReady: curl -X POST "http://127.0.0.1:8001/internal/mediamtx/not-ready?secret=change-this-secret" --data-urlencode "path=$MTX_PATH" --data-urlencode "source_type=$MTX_SOURCE_TYPE" --data-urlencode "source_id=$MTX_SOURCE_ID" - runOnRecordSegmentComplete: curl -X POST "http://127.0.0.1:8001/internal/mediamtx/recording-complete?secret=change-this-secret" --data-urlencode "path=$MTX_PATH" --data-urlencode "segment_path=$MTX_SEGMENT_PATH" --data-urlencode "duration=$MTX_SEGMENT_DURATION" + runOnNotReady: curl -X POST "https://nyone.net/internal/mediamtx/not-ready?secret=change-this-secret" --data-urlencode "path=$MTX_PATH" --data-urlencode "source_type=$MTX_SOURCE_TYPE" --data-urlencode "source_id=$MTX_SOURCE_ID" + runOnRecordSegmentComplete: curl -X POST "https://nyone.net/internal/mediamtx/recording-complete?secret=change-this-secret" --data-urlencode "path=$MTX_PATH" --data-urlencode "segment_path=$MTX_SEGMENT_PATH" --data-urlencode "duration=$MTX_SEGMENT_DURATION" paths: all_others: diff --git a/deploy/nginx/README.md b/deploy/nginx/README.md new file mode 100644 index 0000000..3de8a53 --- /dev/null +++ b/deploy/nginx/README.md @@ -0,0 +1,42 @@ +# Nginx Deployment Notes + +These configs match the current project domains: + +- App: `https://nyone.net` +- HLS playback: `https://nyone-hls.net` +- OBS ingest: `rtmp://nyone.net:1935` + +MediaMTX stays private on local ports: + +- RTMP ingest: `127.0.0.1:1935` +- HLS: `127.0.0.1:1988` + +Install layout on Ubuntu/Debian: + +```bash +sudo cp deploy/nginx/nyone-app.conf /etc/nginx/sites-available/nyone-app.conf +sudo cp deploy/nginx/nyone-hls.conf /etc/nginx/sites-available/nyone-hls.conf +sudo ln -s /etc/nginx/sites-available/nyone-app.conf /etc/nginx/sites-enabled/nyone-app.conf +sudo ln -s /etc/nginx/sites-available/nyone-hls.conf /etc/nginx/sites-enabled/nyone-hls.conf +``` + +Check and reload: + +```bash +sudo nginx -t +sudo systemctl reload nginx +``` + +Make sure DNS points all three hostnames to the server: + +- `nyone.net` +- `nyone-hls.net` + +The Laravel `.env` should use: + +```env +APP_URL=https://nyone.net +STREAMING_RTMP_INGEST_URL=rtmp://nyone.net:1935 +STREAMING_HLS_PUBLIC_URL=https://nyone-hls.net +MEDIAMTX_SHARED_SECRET=change-this-secret +``` diff --git a/deploy/nginx/nyone-app.conf b/deploy/nginx/nyone-app.conf new file mode 100644 index 0000000..3a889b3 --- /dev/null +++ b/deploy/nginx/nyone-app.conf @@ -0,0 +1,65 @@ +# Laravel application vhost for nyone.net. +# Copy to /etc/nginx/sites-available/nyone-app.conf and symlink into sites-enabled. +# Adjust root and fastcgi_pass for your server. + +server { + listen 80; + listen [::]:80; + server_name nyone.net; + + return 301 https://$host$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name nyone.net; + + root /var/www/nyone/public; + index index.php; + + ssl_certificate /etc/letsencrypt/live/nyone.net/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/nyone.net/privkey.pem; + + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + + charset utf-8; + client_max_body_size 100M; + + location / { + try_files $uri $uri/ /index.php?$query_string; + } + + location = /favicon.ico { + access_log off; + log_not_found off; + } + + location = /robots.txt { + access_log off; + log_not_found off; + } + + location ~* \.(?:css|js|mjs|map|jpg|jpeg|gif|png|svg|ico|webp|avif|woff|woff2|ttf)$ { + expires 30d; + access_log off; + try_files $uri /index.php?$query_string; + } + + location ~ \.php$ { + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_pass unix:/run/php/php8.4-fpm.sock; + fastcgi_index index.php; + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name; + fastcgi_param DOCUMENT_ROOT $realpath_root; + fastcgi_param HTTPS on; + fastcgi_read_timeout 120s; + } + + location ~ /\.(?!well-known).* { + deny all; + } +} diff --git a/deploy/nginx/nyone-hls.conf b/deploy/nginx/nyone-hls.conf new file mode 100644 index 0000000..87c87c4 --- /dev/null +++ b/deploy/nginx/nyone-hls.conf @@ -0,0 +1,41 @@ +# HLS reverse proxy for MediaMTX. +# Browser origin is https://nyone.net, while playback URLs point here: +# https://nyone-hls.net//index.m3u8 + +server { + listen 80; + listen [::]:80; + server_name nyone-hls.net; + + return 301 https://$host$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name nyone-hls.net; + + ssl_certificate /etc/letsencrypt/live/nyone-hls.net/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/nyone-hls.net/privkey.pem; + include /etc/letsencrypt/options-ssl-nginx.conf; + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + + access_log /var/log/nginx/nyone-hls.access.log; + error_log /var/log/nginx/nyone-hls.error.log; + + location / { + proxy_pass http://127.0.0.1:19988; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto https; + + proxy_buffering off; + proxy_request_buffering off; + proxy_read_timeout 60s; + proxy_send_timeout 60s; + + add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate" always; + } +}