部署落地：HAProxy 统一入口(RTMPS/HTTP分流) + 8445拉流弹幕口 + hooks 公网化 + 部署文档

- conf/haproxy: 18443 TLS终结+SNI选证+首字节嗅探，RTMPS→1935，HTTP→8445 - conf/nginx: 8445 明文口承载 tsk 双域名 /live/ 与 /danmaku - conf/certs: pem 构建脚本（接入 acme.sh 续期钩子） - run.sh: 修正为当前部署相对路径 - srs.conf: http_hooks 恢复并指向 api.rrrosmontis.icu (bj live_monitor) - DEPLOYMENT.md: 完整部署记忆（架构/证书/通知链路/重建步骤/已知坑）
2026-09-03 11:24:33 +08:00
parent 41b5da7c7e
commit 359c1c6ead
7 changed files with 240 additions and 3 deletions
@@ -0,0 +1,12 @@
+#!/bin/bash
+# 重建 HAProxy 用的 pem（cert+key 合一），由 acme.sh 续期钩子调用
+set -e
+mkdir -p /etc/haproxy/certs
+cat /etc/nginx/cert/tsk.aeolianchi.me/fullchain.pem \
+    /etc/nginx/cert/tsk.aeolianchi.me/privkey.pem \
+    > /etc/haproxy/certs/tsk.aeolianchi.me.pem
+cat /home/server/cert/extra/rrrosmontis.icu/fullchain.pem \
+    /home/server/cert/extra/rrrosmontis.icu/key.pem \
+    > /etc/haproxy/certs/tsk.rrrosmontis.icu.pem
+chmod 600 /etc/haproxy/certs/*.pem
+echo "pems rebuilt: $(date)"
@@ -0,0 +1,41 @@
+# HAProxy — SRS 统一入口（HTTPS 隧道 443 -> 本机 18443）
+# TLS终结 + 首字节嗅探：
+#   RTMPS (解密后首字节 0x03) -> 127.0.0.1:1935  (SRS 推流)
+#   HTTP  (拉流 /danmaku)     -> 127.0.0.1:8445  (nginx 明文口)
+# 证书: /etc/haproxy/certs/*.pem (由 /home/srs/conf/certs/build-pems.sh 生成)
+
+global
+	log /dev/log	local0
+	log /dev/log	local1 notice
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin
+	stats timeout 30s
+	user haproxy
+	group haproxy
+	daemon
+
+defaults
+	log	global
+	mode	tcp
+	option	tcplog
+	option	dontlognull
+	timeout connect 5s
+	timeout client  3600s
+	timeout server  3600s
+
+frontend srs_18443
+	bind *:18443 ssl crt /etc/haproxy/certs/tsk.aeolianchi.me.pem crt /etc/haproxy/certs/tsk.rrrosmontis.icu.pem
+	tcp-request inspect-delay 5s
+	# RTMP C0 握手首字节固定 0x03
+	acl is_rtmp req.payload(0,1) -m bin 03
+	tcp-request content accept if is_rtmp
+	tcp-request content accept if HTTP
+	tcp-request content reject
+	use_backend srs_rtmp if is_rtmp
+	default_backend srs_http
+
+backend srs_rtmp
+	server srs 127.0.0.1:1935 maxconn 100
+
+backend srs_http
+	server nginx 127.0.0.1:8445 maxconn 1000
@@ -0,0 +1,70 @@
+# SRS 拉流 + 弹幕 HTTP 口（127.0.0.1:8445，TLS 已由 HAProxy 在 18443 终结）
+# 软链: /etc/nginx/sites-enabled/srs-https-8445.conf -> 本文件
+
+# tsk.aeolianchi.me
+server {
+    listen 127.0.0.1:8445;
+    server_name tsk.aeolianchi.me;
+
+    location /live/ {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+
+    location /danmaku {
+        proxy_pass http://127.0.0.1:55556;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}
+
+# tsk.rrrosmontis.icu
+server {
+    listen 127.0.0.1:8445;
+    server_name tsk.rrrosmontis.icu;
+
+    location /live/ {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+
+    location /danmaku {
+        proxy_pass http://127.0.0.1:55556;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}