Установка и запуск Slyber SFU Server в Docker

docker pull ghcr.io/slyber-app/slyber-sfu-server:latest
docker rm -f slyber-sfu-server 2>/dev/null || true

PUBLIC_IP=$(curl -fsSL4 --max-time 2 api.ipify.org 2>/dev/null || echo 127.0.0.1)
JWT_SECRET=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')
NODE_SECRET=$(head -c 24 /dev/urandom | od -An -tx1 | tr -d ' \n')

docker run -d \
  --name slyber-sfu-server \
  --restart unless-stopped \
  --network host \
  -e SFU_ENV="production" \
  -e PUBLIC_IP="${PUBLIC_IP}" \
  -e SFU_UDP_PORT="4443" \
  -e SFU_TCP_PORT="4443" \
  -e SFU_HTTP_PORT="8090" \
  -e AUTH_MODE="jwt" \
  -e JWT_SECRET="${JWT_SECRET}" \
  -e NODE_SECRET="${NODE_SECRET}" \
  ghcr.io/slyber-app/slyber-sfu-server:latest && \
  sleep 1 && \
  docker exec slyber-sfu-server slyber_sfu doctor && \
  echo "Public IP  : ${PUBLIC_IP}" && \
  echo "JWT Secret : ${JWT_SECRET}" && \
  echo "Node Secret: ${NODE_SECRET}" && \
  echo "Test Token : $(curl -fsS -H "X-Slyber-Node-Secret: ${NODE_SECRET}" "http://127.0.0.1:8090/auth/token?room=test-room&user=user-1")"

docker run -d \
  --name slyber_sfu_secret \
  -p 4443:4443/udp -p 4443:4443/tcp -p 8090:8090/tcp \
  -e PUBLIC_IP="127.0.0.1" \
  -e REALM="sfu.local" \
  -e SFU_UDP_PORT="4443" \
  -e SFU_TCP_PORT="4443" \
  -e SFU_HTTP_PORT="8090" \
  -e AUTH_MODE="secret" \
  -e TURN_SECRET="my-custom-sfu-turn-secret-2026" \
  -e JWT_SECRET="my-custom-sfu-jwt-secret-2026" \
  -e NODE_SECRET="my-custom-sfu-node-secret-2026" \
  ghcr.io/slyber-app/slyber-sfu-server:latest

# Выпускаем готовые токены через административный эндпоинт
curl -s -H "X-Slyber-Node-Secret: my-custom-sfu-node-secret-2026" \
  "http://127.0.0.1:8090/auth/token?room=test-room&user=erkin"

# 1. Создаем изолированную сеть Docker и запускаем Redis
docker network create slyber_sfu_net
docker run -d --name slyber_sfu_redis --network slyber_sfu_net redis:alpine

# 2. Записываем тестовую сессию со сроком жизни 3600 секунд
docker exec slyber_sfu_redis redis-cli SET "slyber:session:tok_777" "erkin" EX 3600

# 3. Запускаем Slyber SFU Server в режиме redis
docker run -d \
  --name slyber-sfu-server \
  --network slyber_sfu_net \
  -p 4443:4443/udp -p 4443:4443/tcp -p 8090:8090/tcp \
  -e PUBLIC_IP="127.0.0.1" \
  -e REALM="sfu.local" \
  -e SFU_UDP_PORT="4443" \
  -e SFU_TCP_PORT="4443" \
  -e SFU_HTTP_PORT="8090" \
  -e AUTH_MODE="redis" \
  -e REDIS_ADDR="slyber_sfu_redis:6379" \
  -e NODE_SECRET="my-custom-sfu-node-secret-2026" \
  ghcr.io/slyber-app/slyber-sfu-server:latest

# 4. Проверяем, что SFU сервер видит базу Redis и проходит диагностику
docker exec slyber-sfu-server slyber_sfu doctor

# Проверить версию бинарного файла внутри образа
docker run --rm ghcr.io/slyber-app/slyber-sfu-server:latest --version

# Запустить полную самодиагностику внутри работающего контейнера
docker exec slyber-sfu-server slyber_sfu doctor

# Посмотреть логи запуска и итоговую статистику пакетов
docker logs -f slyber-sfu-server

# Проверить HTTP эндпоинт здоровья сервера
curl -i http://127.0.0.1:8090/healthz

services:
  slyber-sfu:
    image: ghcr.io/slyber-app/slyber-sfu-server:latest
    container_name: slyber-sfu-server
    restart: unless-stopped
    network_mode: host
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    ulimits:
      nofile:
        soft: 65535
        hard: 65535
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "3"
    environment:
      SFU_ENV: "${SFU_ENV:-production}"
      SFU_NODE_ID: "${SFU_NODE_ID:-slyber-sfu-01}"
      PUBLIC_IP: "${PUBLIC_IP:?Set PUBLIC_IP in .env}"
      REALM: "${REALM:-slyber.com}"
      DEFAULT_ROOM_PROFILE: "${DEFAULT_ROOM_PROFILE:-conference}"
      SFU_UDP_PORT: "${SFU_UDP_PORT:-4443}"
      SFU_TCP_PORT: "${SFU_TCP_PORT:-4443}"
      SFU_HTTP_PORT: "${SFU_HTTP_PORT:-8090}"
      ENABLE_ICE_TCP: "${ENABLE_ICE_TCP:-true}"
      SOCKET_BUFFER_BYTES: "${SOCKET_BUFFER_BYTES:-8388608}"
      EXTERNAL_TURN_URLS: "${EXTERNAL_TURN_URLS:-}"
      AUTH_MODE: "${AUTH_MODE:-jwt}"
      JWT_SECRET: "${JWT_SECRET:?Set JWT_SECRET (min 24 chars) in .env}"
      NODE_SECRET: "${NODE_SECRET:?Set NODE_SECRET (min 24 chars) in .env}"
      TURN_SECRET: "${TURN_SECRET:-}"
      ALLOWED_ORIGINS: "${ALLOWED_ORIGINS:-https://slyber.com}"
      CREDENTIAL_TTL_SEC: "${CREDENTIAL_TTL_SEC:-3600}"
      REQUIRE_E2EE: "${REQUIRE_E2EE:-false}"
      REDIS_ADDR: "${REDIS_ADDR:-127.0.0.1:6379}"
      MAX_KBPS_PER_TRACK: "${MAX_KBPS_PER_TRACK:-3500}"
      MAX_KBPS_PER_SESSION: "${MAX_KBPS_PER_SESSION:-10000}"
      ENABLE_SIMULCAST: "${ENABLE_SIMULCAST:-true}"
      ENABLE_SVC: "${ENABLE_SVC:-true}"
      VIDEO_CODECS: "${VIDEO_CODECS:-VP9,AV1,H264,VP8}"
      NACK_BUFFER_SIZE: "${NACK_BUFFER_SIZE:-512}"
      LAST_N_VIDEO_LIMIT: "${LAST_N_VIDEO_LIMIT:-16}"
      DYNACAST_ENABLED: "${DYNACAST_ENABLED:-true}"
      ENABLE_WHIP_WHEP: "${ENABLE_WHIP_WHEP:-true}"
      ENABLE_MOQ_RELAY: "${ENABLE_MOQ_RELAY:-false}"
      ENABLE_AI_GATEWAY: "${ENABLE_AI_GATEWAY:-true}"
      ENABLE_CASCADE_PIPE: "${ENABLE_CASCADE_PIPE:-true}"
      ENABLE_INSPECTOR: "${ENABLE_INSPECTOR:-true}"