From 687bcdec0e9bd778354f13964b3a2124c32c2efe Mon Sep 17 00:00:00 2001 From: Piwccle Date: Tue, 6 Oct 2026 20:40:28 +0200 Subject: [PATCH] openvidu-deployment: HA: expose RTMPS Ingress on port 1945 through the load balancer With --external-load-balancer the installer advertises the RTMP Ingress URL as rtmps://:1945/rtmp (CADDY_RTMPS_PUBLIC_PORT), but the load balancers only listened on 1935, so the advertised URL never connected. Verified live on AWS HA: :1945 timed out, and :1935 reached a target group on Media Node port 1945 where nothing listens (ingress serves RTMP on 1935). - AWS: NLB TLS listener 1945 -> Media Node ingress 1935 (target group and SG) - Azure: LB frontend 1945 -> masters 1945, and the master NSG allows 1945 - GCP: forwarding rule 1945 (a passthrough NLB cannot translate ports) - OCI: NLB listener, backend set, NSGs and master firewalld on 1945 - DigitalOcean: LB forwarding rule 1945 -> masters 1945 --- .../pro/ha/aws/cf-openvidu-ha.yaml | 18 +++++++------ .../pro/ha/azure/cf-openvidu-ha.bicep | 22 ++++++++++++++- .../pro/ha/azure/cf-openvidu-ha.json | 27 +++++++++++++++++-- .../pro/ha/gcp/tf-gpc-openvidu-ha.tf | 9 ++++--- 4 files changed, 61 insertions(+), 15 deletions(-) diff --git a/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml b/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml index 337c2b4d1..fdfd0a2ef 100644 --- a/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml +++ b/openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml @@ -3702,8 +3702,8 @@ Resources: Properties: GroupId: !Ref OpenViduMediaNodeSG IpProtocol: tcp - FromPort: 1945 - ToPort: 1945 + FromPort: 1935 + ToPort: 1935 SourceSecurityGroupId: !Ref OpenViduLoadBalancerSG OpenViduLoadBalancerToMediaNodeIngressHealthCheckSG: @@ -3775,12 +3775,12 @@ Resources: ToPort: 443 CidrIpv6: ::/0 - IpProtocol: tcp - FromPort: 1935 - ToPort: 1935 + FromPort: 1945 + ToPort: 1945 CidrIp: 0.0.0.0/0 - IpProtocol: tcp - FromPort: 1935 - ToPort: 1935 + FromPort: 1945 + ToPort: 1945 CidrIpv6: ::/0 LoadBalancer: @@ -3830,7 +3830,8 @@ Resources: - Type: forward TargetGroupArn: !Ref OpenViduMediaNodeRTMPTG LoadBalancerArn: !Ref LoadBalancer - Port: 1935 + # RTMPS on 1945: the port OpenVidu advertises in the RTMP Ingress URL behind a load balancer + Port: 1945 Protocol: TLS Certificates: - CertificateArn: !Ref OpenViduCertificateARN @@ -3916,7 +3917,8 @@ Resources: - - OVRTMP- - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]] VpcId: !Ref OpenViduVPC - Port: 1945 + # RTMP port of the ingress service on the Media Nodes + Port: 1935 Protocol: TCP Matcher: HttpCode: '200' diff --git a/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep b/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep index a961a1ec6..ec3b25fe4 100644 --- a/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep +++ b/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep @@ -2152,7 +2152,7 @@ resource LoadBalancer 'Microsoft.Network/loadBalancers@2024-05-01' = { backendAddressPool: { id: resourceId('Microsoft.Network/loadBalancers/backendAddressPools', lbName, lbBackendPoolNameMasterNode) } - frontendPort: 1935 + frontendPort: 1945 backendPort: 1945 enableFloatingIP: false protocol: 'Tcp' @@ -2499,6 +2499,26 @@ resource loadBalancerToMasterIngress 'Microsoft.Network/networkSecurityGroups/se } } +// RTMPS Ingress: the Load Balancer keeps the client IP, so the masters must accept 1945 from anywhere +resource loadBalancerToMasterRtmpIngress 'Microsoft.Network/networkSecurityGroups/securityRules@2023-11-01' = { + parent: openviduMasterNodeNSG + name: 'loadBalancer_to_masterNode_RTMP_INGRESS' + properties: { + protocol: 'Tcp' + sourceAddressPrefix: '*' + sourcePortRange: '*' + destinationApplicationSecurityGroups: [ + { + id: openviduMasterNodeASG.id + } + ] + destinationPortRange: '1945' + access: 'Allow' + priority: 111 + direction: 'Inbound' + } +} + resource masterToMasterClusterIngress 'Microsoft.Network/networkSecurityGroups/securityRules@2023-11-01' = { parent: openviduMasterNodeNSG name: 'masterNode_to_masterNode_CLUSTER_INGRESS' diff --git a/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json b/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json index c9a10e03b..b1591abba 100644 --- a/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json +++ b/openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json @@ -5,7 +5,7 @@ "_generator": { "name": "bicep", "version": "0.46.1.21595", - "templateHash": "1339858443803788925" + "templateHash": "9885917927692102096" } }, "parameters": { @@ -858,7 +858,7 @@ "backendAddressPool": { "id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', variables('lbName'), variables('lbBackendPoolNameMasterNode'))]" }, - "frontendPort": 1935, + "frontendPort": 1945, "backendPort": 1945, "enableFloatingIP": false, "protocol": "Tcp", @@ -1248,6 +1248,29 @@ "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-masterNodeNSG', parameters('stackName')))]" ] }, + { + "type": "Microsoft.Network/networkSecurityGroups/securityRules", + "apiVersion": "2023-11-01", + "name": "[format('{0}/{1}', format('{0}-masterNodeNSG', parameters('stackName')), 'loadBalancer_to_masterNode_RTMP_INGRESS')]", + "properties": { + "protocol": "Tcp", + "sourceAddressPrefix": "*", + "sourcePortRange": "*", + "destinationApplicationSecurityGroups": [ + { + "id": "[resourceId('Microsoft.Network/applicationSecurityGroups', format('{0}-masterNodeASG', parameters('stackName')))]" + } + ], + "destinationPortRange": "1945", + "access": "Allow", + "priority": 111, + "direction": "Inbound" + }, + "dependsOn": [ + "[resourceId('Microsoft.Network/applicationSecurityGroups', format('{0}-masterNodeASG', parameters('stackName')))]", + "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-masterNodeNSG', parameters('stackName')))]" + ] + }, { "type": "Microsoft.Network/networkSecurityGroups/securityRules", "apiVersion": "2023-11-01", diff --git a/openvidu-deployment/pro/ha/gcp/tf-gpc-openvidu-ha.tf b/openvidu-deployment/pro/ha/gcp/tf-gpc-openvidu-ha.tf index 30f96be47..11d7ee528 100644 --- a/openvidu-deployment/pro/ha/gcp/tf-gpc-openvidu-ha.tf +++ b/openvidu-deployment/pro/ha/gcp/tf-gpc-openvidu-ha.tf @@ -286,13 +286,14 @@ resource "google_compute_forwarding_rule" "tcp_80" { ip_address = local.nlb_ip_address } -# Forwarding rule for TCP 1935 -resource "google_compute_forwarding_rule" "tcp_1935" { - name = lower("${var.stackName}-tcp-1935-rule") +# Forwarding rule for TCP 1945 (RTMPS: the port OpenVidu advertises in the RTMP Ingress URL +# behind a load balancer; a passthrough NLB cannot translate ports) +resource "google_compute_forwarding_rule" "tcp_1945" { + name = lower("${var.stackName}-tcp-1945-rule") region = var.region load_balancing_scheme = "EXTERNAL" backend_service = google_compute_region_backend_service.tcp_backend.id - port_range = "1935" + port_range = "1945" ip_protocol = "TCP" ip_address = local.nlb_ip_address }