openvidu-deployment: HA: expose RTMPS Ingress on port 1945 through the load balancer

With --external-load-balancer the installer advertises the RTMP Ingress URL as
rtmps://<domain>:1945/rtmp (CADDY_RTMPS_PUBLIC_PORT), but the load balancers only
listened on 1935, so the advertised URL never connected. Verified live on AWS HA:
:1945 timed out, and :1935 reached a target group on Media Node port 1945 where
nothing listens (ingress serves RTMP on 1935).

- AWS: NLB TLS listener 1945 -> Media Node ingress 1935 (target group and SG)
- Azure: LB frontend 1945 -> masters 1945, and the master NSG allows 1945
- GCP: forwarding rule 1945 (a passthrough NLB cannot translate ports)
- OCI: NLB listener, backend set, NSGs and master firewalld on 1945
- DigitalOcean: LB forwarding rule 1945 -> masters 1945

openvidu-deployment/pro/ha/aws/cf-openvidu-ha.yaml

@@ -3702,8 +3702,8 @@ Resources:
     Properties:
       GroupId: !Ref OpenViduMediaNodeSG
       IpProtocol: tcp
-      FromPort: 1945
+      FromPort: 1935
-      ToPort: 1945
+      ToPort: 1935
       SourceSecurityGroupId: !Ref OpenViduLoadBalancerSG
 
   OpenViduLoadBalancerToMediaNodeIngressHealthCheckSG:
@@ -3775,12 +3775,12 @@ Resources:
           ToPort: 443
           CidrIpv6: ::/0
         - IpProtocol: tcp
-          FromPort: 1935
+          FromPort: 1945
-          ToPort: 1935
+          ToPort: 1945
           CidrIp: 0.0.0.0/0
         - IpProtocol: tcp
-          FromPort: 1935
+          FromPort: 1945
-          ToPort: 1935
+          ToPort: 1945
           CidrIpv6: ::/0
 
   LoadBalancer:
@@ -3830,7 +3830,8 @@ Resources:
         - Type: forward
           TargetGroupArn: !Ref OpenViduMediaNodeRTMPTG
       LoadBalancerArn: !Ref LoadBalancer
-      Port: 1935
+      # RTMPS on 1945: the port OpenVidu advertises in the RTMP Ingress URL behind a load balancer
+      Port: 1945
       Protocol: TLS
       Certificates:
         - CertificateArn: !Ref OpenViduCertificateARN
@@ -3916,7 +3917,8 @@ Resources:
           - - OVRTMP-
             - !Select [4, !Split ['-', !Select [2, !Split ['/', !Ref AWS::StackId]]]]
       VpcId: !Ref OpenViduVPC
-      Port: 1945
+      # RTMP port of the ingress service on the Media Nodes
+      Port: 1935
       Protocol: TCP
       Matcher:
         HttpCode: '200'

openvidu-deployment/pro/ha/azure/cf-openvidu-ha.bicep

@@ -2152,7 +2152,7 @@ resource LoadBalancer 'Microsoft.Network/loadBalancers@2024-05-01' = {
           backendAddressPool: {
             id: resourceId('Microsoft.Network/loadBalancers/backendAddressPools', lbName, lbBackendPoolNameMasterNode)
           }
-          frontendPort: 1935
+          frontendPort: 1945
           backendPort: 1945
           enableFloatingIP: false
           protocol: 'Tcp'
@@ -2499,6 +2499,26 @@ resource loadBalancerToMasterIngress 'Microsoft.Network/networkSecurityGroups/se
   }
 }
 
+// RTMPS Ingress: the Load Balancer keeps the client IP, so the masters must accept 1945 from anywhere
+resource loadBalancerToMasterRtmpIngress 'Microsoft.Network/networkSecurityGroups/securityRules@2023-11-01' = {
+  parent: openviduMasterNodeNSG
+  name: 'loadBalancer_to_masterNode_RTMP_INGRESS'
+  properties: {
+    protocol: 'Tcp'
+    sourceAddressPrefix: '*'
+    sourcePortRange: '*'
+    destinationApplicationSecurityGroups: [
+      {
+        id: openviduMasterNodeASG.id
+      }
+    ]
+    destinationPortRange: '1945'
+    access: 'Allow'
+    priority: 111
+    direction: 'Inbound'
+  }
+}
+
 resource masterToMasterClusterIngress 'Microsoft.Network/networkSecurityGroups/securityRules@2023-11-01' = {
   parent: openviduMasterNodeNSG
   name: 'masterNode_to_masterNode_CLUSTER_INGRESS'

openvidu-deployment/pro/ha/azure/cf-openvidu-ha.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.46.1.21595",
-      "templateHash": "1339858443803788925"
+      "templateHash": "9885917927692102096"
     }
   },
   "parameters": {
@@ -858,7 +858,7 @@
               "backendAddressPool": {
                 "id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', variables('lbName'), variables('lbBackendPoolNameMasterNode'))]"
               },
-              "frontendPort": 1935,
+              "frontendPort": 1945,
               "backendPort": 1945,
               "enableFloatingIP": false,
               "protocol": "Tcp",
@@ -1248,6 +1248,29 @@
         "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-masterNodeNSG', parameters('stackName')))]"
       ]
     },
+    {
+      "type": "Microsoft.Network/networkSecurityGroups/securityRules",
+      "apiVersion": "2023-11-01",
+      "name": "[format('{0}/{1}', format('{0}-masterNodeNSG', parameters('stackName')), 'loadBalancer_to_masterNode_RTMP_INGRESS')]",
+      "properties": {
+        "protocol": "Tcp",
+        "sourceAddressPrefix": "*",
+        "sourcePortRange": "*",
+        "destinationApplicationSecurityGroups": [
+          {
+            "id": "[resourceId('Microsoft.Network/applicationSecurityGroups', format('{0}-masterNodeASG', parameters('stackName')))]"
+          }
+        ],
+        "destinationPortRange": "1945",
+        "access": "Allow",
+        "priority": 111,
+        "direction": "Inbound"
+      },
+      "dependsOn": [
+        "[resourceId('Microsoft.Network/applicationSecurityGroups', format('{0}-masterNodeASG', parameters('stackName')))]",
+        "[resourceId('Microsoft.Network/networkSecurityGroups', format('{0}-masterNodeNSG', parameters('stackName')))]"
+      ]
+    },
     {
       "type": "Microsoft.Network/networkSecurityGroups/securityRules",
       "apiVersion": "2023-11-01",

openvidu-deployment/pro/ha/gcp/tf-gpc-openvidu-ha.tf

@@ -286,13 +286,14 @@ resource "google_compute_forwarding_rule" "tcp_80" {
   ip_address            = local.nlb_ip_address
 }
 
-# Forwarding rule for TCP 1935
+# Forwarding rule for TCP 1945 (RTMPS: the port OpenVidu advertises in the RTMP Ingress URL
-resource "google_compute_forwarding_rule" "tcp_1935" {
+# behind a load balancer; a passthrough NLB cannot translate ports)
-  name                  = lower("${var.stackName}-tcp-1935-rule")
+resource "google_compute_forwarding_rule" "tcp_1945" {
+  name                  = lower("${var.stackName}-tcp-1945-rule")
   region                = var.region
   load_balancing_scheme = "EXTERNAL"
   backend_service       = google_compute_region_backend_service.tcp_backend.id
-  port_range            = "1935"
+  port_range            = "1945"
   ip_protocol           = "TCP"
   ip_address            = local.nlb_ip_address
 }