sequenceDiagram
    participant Client as 推流客户端
    participant Server as WHIP Endpoint
    Client->>Server: POST /whip/endpoint (SDP Offer)
    Server-->>Client: 201 Created + Location + SDP Answer
    Client->>Server: PATCH /resource (ICE Candidate / Re-Offer)
    Client->>Server: DELETE /resource (结束推流)

sequenceDiagram
    participant Player as 播放器/拉流端
    participant Server as WHEP Endpoint
    Player->>Server: POST /whep/endpoint (SDP Offer)
    Server-->>Player: 201 Created + Location + SDP Answer
    Player->>Server: PATCH /resource (ICE Candidate / Re-Offer)
    Player->>Server: DELETE /resource (停止拉流)

# Dockerfile.srs
FROM ossrs/srs:6
COPY srs.conf /usr/local/srs/conf/srs.conf
EXPOSE 1935 8080 8000 1985
CMD ["srs", "-c", "/usr/local/srs/conf/srs.conf"]

# srs.conf 关键片段
listen              8000;          # HTTP API / WHIP / WHEP
http_server {
    enabled         on;
    listen          8000;
    dir             ./objs/nginx/html;
}
vhost __defaultVhost__ {
    whip {
        enabled      on;
        endpoint     /api/v1/whip; # WHIP 入口
    }
    whep {
        enabled      on;
        endpoint     /api/v1/whep; # WHEP 入口
    }
    http_remux {
        enabled      on;
        mount        /live;        # 生成 HLS/FLV 备播
        hls          on;
        hls_path     ./objs/nginx/html/live;
    }
}

docker build -t srs-whip-whep -f Dockerfile.srs .
docker run -d -p 8000:8000 -p 1935:1935 --name srs srs-whip-whep
curl -X POST -H "Content-Type: application/sdp" 
     --data-binary @offer.sdp 
     http://localhost:8000/api/v1/whip
# 返回 201 + Location + Answer SDP 即成功

# mediamtx.yml
whip: yes
whipAddress: :8080
whipEndpoint: /whip
whep: yes
whepAddress: :8080
whepEndpoint: /whep

# TURN 内置
turn: yes
turnAddress: :3478
turnUsers:
  - user: publisher
    pass: "strong_password_123"
  - user: viewer
    pass: "strong_password_456"

# 鉴权插件（HTTP Hook）
hooks:
  onPublish: http://auth-gateway:8081/verify?type=whip
  onRead:    http://auth-gateway:8081/verify?type=whep

# 多实例集群（Redis 同步 Session）
cluster:
  redis: redis://redis-cluster:6379

docker run -d 
  --name mediamtx 
  -p 8080:8080 -p 3478:3478/udp 
  -v $(pwd)/mediamtx.yml:/mediamtx.yml 
  bluenviron/mediamtx:latest

// whip-publisher.ts
interface WhipConfig {
  endpoint: string;          // e.g. https://media.example.com/api/v1/whip
  turn?: RTCIceServer[];
  onStateChange?: (state: RTCPeerConnectionState) => void;
}

export class WhipPublisher {
  private pc: RTCPeerConnection;
  private resourceUrl: string = '';

  constructor(private cfg: WhipConfig) {
    this.pc = new RTCPeerConnection({ iceServers: cfg.turn });
    this.pc.onconnectionstatechange = () => cfg.onStateChange?.(this.pc.connectionState);
  }

  async publish(stream: MediaStream): Promise<string> {
    stream.getTracks().forEach(t => this.pc.addTrack(t, stream));
    const offer = await this.pc.createOffer();
    await this.pc.setLocalDescription(offer);

    const resp = await fetch(this.cfg.endpoint, {
      method: 'POST',
      headers: { 'Content-Type': 'application/sdp' },
      body: offer.sdp!
    });
    if (!resp.ok) throw new Error(`WHIP POST failed: ${resp.status}`);
    this.resourceUrl = resp.headers.get('Location')!;
    const answerSdp = await resp.text();
    await this.pc.setRemoteDescription({ type: 'answer', sdp: answerSdp });
    return this.resourceUrl;
  }

  async stop(): Promise<void> {
    if (this.resourceUrl) {
      await fetch(this.resourceUrl, { method: 'DELETE' });
    }
    this.pc.close();
  }
}

<!-- whep-player.html -->
<video id="player" controls autoplay playsinline></video>
<script type="module">
import { WhepPlayer } from './whep-player.js';

const player = new WhepPlayer({
  endpoint: 'https://media.example.com/api/v1/whep',
  videoEl: document.getElementById('player'),
  turn: [{ urls: 'turn:turn.example.com:3478', username: 'viewer', credential: 'xxx' }]
});

await player.play();
// 页面卸载时自动 DELETE 释放资源
window.addEventListener('beforeunload', () => player.stop());
</script>

// whep-player.js
export class WhepPlayer {
  #pc: RTCPeerConnection;
  #resourceUrl = '';
  #video: HTMLVideoElement;

  constructor({ endpoint, videoEl, turn }) {
    this.#video = videoEl;
    this.#pc = new RTCPeerConnection({ iceServers: turn });
    this.#pc.ontrack = e => this.#video.srcObject = e.streams[0];
    this.#endpoint = endpoint;
  }

  async play() {
    const offer = await this.#pc.createOffer();
    await this.#pc.setLocalDescription(offer);
    const resp = await fetch(this.#endpoint, {
      method: 'POST',
      headers: { 'Content-Type': 'application/sdp' },
      body: offer.sdp!
    });
    if (!resp.ok) throw new Error(`WHEP POST failed: ${resp.status}`);
    this.#resourceUrl = resp.headers.get('Location')!;
    const answer = await resp.text();
    await this.#pc.setRemoteDescription({ type: 'answer', sdp: answer });
  }

  async stop() {
    if (this.#resourceUrl) await fetch(this.#resourceUrl, { method: 'DELETE' });
    this.#pc.close();
  }
}

docker run -d --name coturn 
  -p 3478:3478 -p 3478:3478/udp -p 5349:5349 -p 5349:5349/udp 
  -e TURN_USER=pub:pass -e TURN_USER=sub:pass 
  -e REALM=media.example.com 
  -e TURN_PORT=3478 -e TLS_PORT=5349 
  instrumentisto/coturn:latest

# Nginx 网关片段
location /api/v1/whip {
    auth_request /_verify_token;
    auth_request_set $token_payload $upstream_http_x_token_payload;
    proxy_pass http://srs_cluster;
    # 透传 Location 头
    proxy_pass_request_headers on;
    proxy_hide_header Location;
    add_header Location $upstream_http_location always;
}

{
  "timestamp": "2025-07-15T12:34:56.789Z",
  "level": "INFO",
  "protocol": "WHIP",
  "stream_id": "live_abc123",
  "client_ip": "203.0.113.45",
  "user_agent": "OBS/30.0.2",
  "event": "session_created",
  "resource_url": "/api/v1/whip/live_abc123_xyz",
  "ice_candidates": 6,
  "turn_used": true,
  "duration_ms": 142
}

sequenceDiagram
    participant Client
    participant WHIP Server
    participant ICE Agent
    Client->>WHIP Server: POST Offer (含 gatherPolicy=all)
    WHIP Server->>ICE Agent: 开始全量采集
    WHIP Server-->>Client: 201 Answer (含初始 host/srflx 候选)
    loop Trickle 阶段
        ICE Agent-->>WHIP Server: 新候选
        WHIP Server->>Client: PATCH /resource (application/trickle-ice-sdpfrag)
        Client->>WHIP Server: 200 OK
    end
    ICE Agent-->>WHIP Server: nominated pair
    WHIP Server->>Client: PATCH (end-of-candidates)

vhost __defaultVhost__ {
    whip {
        enabled      on;
        # Trickle ICE 核心参数
        ice_gather_policy   all;        # all | no-host | relay-only
        ice_timeout         15s;        # 采集总超时
        trickle_ice         on;         # 开启增量交换
        candidate_pacing    50ms;       # 候选下发节流，防风暴
    }
}

POST /api/v1/whep HTTP/1.1
Content-Type: application/sdp

v=0...
o=- 123456 1 IN IP4 0.0.0.0
...

HTTP/1.1 302 Found
Location: https://edge-03.cdn.example.com/api/v1/whep/stream_abc
Link: <https://turn.example.com>; rel="ice-server"

# 客户端 Offer 片段
a=simulcast:recv r0;r1;r2
a=rid:r0 send pt=96;max-width=1920;max-height=1080;max-fps=30;max-bps=5000000
a=rid:r1 send pt=96;max-width=1280;max-height=720;max-fps=30;max-bps=2500000
a=rid:r2 send pt=96;max-width=640;max-height=360;max-fps=15;max-bps=800000

flowchart TD
    A[推流端 CN-Beijing] -->|WHIP POST| B[API Gateway Beijing]
    B --> C{调度器}
    C -->|选定入口节点| D[Media Edge Beijing]
    D -->|建立媒体流| E[(Redis Session: stream_123)]
    F[拉流端 US-SiliconValley] -->|WHEP POST| G[API Gateway US-West]
    G --> C
    C -->|查询 Session 发现源在 Beijing| H[跨区域拉流策略]
    H -->|策略A: 直接跨洋拉流| I[Media Edge US-West <--SRT/RIST--> Beijing]
    H -->|策略B: 全球转码分发| J[转码集群 Beijing --> CDN --> US-West Edge]
    H -->|策略C: WebRTC 级联| K[Media Edge US-West <--WHIP/WHEP--> Beijing]

# scheduler/policy.py 伪代码
def select_egress_edge(stream_id: str, viewer_ip: str) -> EdgeNode:
    session = redis.get(f"session:{stream_id}")
    source_region = session.ingress_region
    
    # 1. 候选边缘节点打分
    candidates = edge_registry.healthy_nodes()
    for node in candidates:
        # 延迟成本 (RTT * 权重)
        rtt = geoip.rtt(viewer_ip, node.region)
        latency_score = rtt * 0.6
        
        # 带宽成本 (单价 * 预估码率)
        bw_cost = node.bandwidth_price * session.estimated_bitrate
        cost_score = bw_cost * 0.3
        
        # 负载惩罚
        load_penalty = node.load_factor * 100
        
        # 亲和性加分 (同 ISP/同省)
        affinity_bonus = -50 if node.isp == geoip.isp(viewer_ip) else 0
        
        node.score = latency_score + cost_score + load_penalty + affinity_bonus
    
    # 2. 选择 Top-1，兜底 Top-3 随机
    return min(candidates, key=lambda n: n.score)

# /etc/sysctl.d/99-whip-whep.conf
# 连接队列与内存
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_syn_backlog = 65535

# UDP 缓冲区 (关键：WebRTC 走 UDP)
net.core.rmem_max = 67108864   # 64MB 接收缓冲
net.core.wmem_max = 67108864   # 64MB 发送缓冲
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384

# BBR 拥塞控制 (必须 5.10+ 内核)
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr

# 端口复用与 TIME_WAIT 优化
net.ipv4.tcp_tw_reuse = 1
net.ipv4.ip_local_port_range = 10240 65535

# 巨页内存 (媒体服务器零拷贝受益)
vm.nr_hugepages = 8192

# docker-compose.yml 片段
services:
  srs-edge:
    image: ossrs/srs:6
    deploy:
      resources:
        limits:
          cpus: '16'
          memory: 32G
    cpuset: "0-15"                    # 绑定物理核心
    mem_limit: 32g
    ulimits:
      nofile: 1048576
      memlock: -1                     # 允许锁定巨页内存
    cap_add:
      - SYS_NICE                      # 允许设置实时优先级
      - NET_ADMIN                     # 可选：XDP/eBPF 旁路
    environment:
      - GOMAXPROCS=16
      - GODEBUG=madvdontneed=1        # 及时归还内存给 OS

# srs.conf
pid            ./objs/srs.pid;
srs_log_tank   console;
srs_log_level  info;

# 绑定 CPU 亲和性 (需 root 或 CAP_SYS_NICE)
cpu_affinity   auto;   # 自动绑定每个 worker 到独立核心

# 网络 IO 模型
network_io     epoll;  # Linux 下首选 epoll

flowchart LR
    subgraph Legacy Sources
        A[OBS RTMP]
        B[硬件编码器 SRT]
        C[WebRTC SDK 私有信令]
        D[GB28181 国标级联]
    end
    
    subgraph PTG Cluster
        E[RTMP -> WHIP Transcoder]
        F[SRT -> WHIP Gateway]
        G[Private Signal -> WHIP Adapter]
        H[GB28181 -> WHIP Bridge]
    end
    
    subgraph Unified Core
        I[WHIP Ingress Cluster]
        J[Media Processing: Record/Transcode/AI]
        K[WHEP Egress Cluster]
    end
    
    A --> E --> I
    B --> F --> I
    C --> G --> I
    D --> H --> I
    I --> J --> K

# Nginx 镜像流量至新 WHIP 集群 (1% 样本)
location /api/v1/whip {
    mirror /mirror_whip_new;
    mirror_request_body on;
    proxy_pass http://whip_legacy_cluster;
}

location /mirror_whip_new {
    internal;
    proxy_pass http://whip_new_cluster$request_uri;
    proxy_set_header X-Shadow-Mirror "true";
    # 新集群仅消费流量，不返回响应给客户端
}

// 内部 SDP 解析器安全加固示例
func ParseOfferSafe(raw string) (*SessionDescription, error) {
    // 1. 长度限制
    if len(raw) > 16*1024 { return nil, ErrSDPTooLarge }
    
    // 2. 逐行解析，禁止递归下降导致栈溢出
    lines := strings.SplitSeq(raw, "rn")
    var sdp SessionDescription
    for line := range lines {
        if len(line) < 2 || line[1] != '=' { continue }
        switch line[0] {
        case 'v', 'o', 's', 't', 'c': parseOriginTiming(&sdp, line)
        case 'm': parseMediaSection(&sdp, line) // 限制 m= 行数 <= 10
        case 'a': parseAttribute(&sdp, line)    // 限制属性总数 <= 200
        }
    }
    
    // 3. 语义校验
    if !validateCodecs(sdp.Codecs, allowedCodecs) { return nil, ErrCodecNotAllowed }
    if !validateIceParams(sdp.ICE) { return nil, ErrInvalidICE }
    if !validateFingerprint(sdp.Fingerprint) { return nil, ErrWeakFingerprint }
    
    return &sdp, nil
}

# Prometheus 告警规则
groups:
- name: turn-abuse
  rules:
  - alert: TURNRelayTrafficAnomaly
    expr: |
      increase(turn_relay_bytes_total[5m]) > 100 * 1024 * 1024
      and on (username) increase(turn_allocate_requests_total[5m]) < 10
    for: 2m
    labels:
      severity: critical
    annotations:
      summary: "TURN 用户 {{ $labels.username }} 疑似被盗用作代理"
      runbook: "https://wiki.example.com/turn-abuse-response"

  - alert: TURNAllocationStorm
    expr: rate(turn_allocate_requests_total[1m]) > 1000
    for: 1m
    labels:
      severity: warning

# cost_model.py
class StreamCost:
    def __init__(self, bitrate_kbps=3000, duration_sec=3600, region='cn-hangzhou'):
        self.bitrate = bitrate_kbps / 8 * 1024  # KB/s
        self.duration = duration_sec
        self.region = region
    
    def bandwidth_cost(self) -> float:
        # 峰值带宽计费 vs 流量计费 取最优
        gb = self.bitrate * self.duration / 1024 / 1024
        price_per_gb = {'cn-hangzhou': 0.5, 'us-west': 0.08}[self.region]
        return gb * price_per_gb
    
    def transcode_cost(self, ladders=[(1080p,3000),(720p,1500),(360p,600)]) -> float:
        # 假设 CPU 转码单价 0.05 元/分钟/路
        return sum(d[1] for d in ladders) * 0.05 * (self.duration / 60)
    
    def storage_cost(self, retention_days=7, codec='h264') -> float:
        daily_gb = self.bitrate * 86400 / 1024 / 1024
        price = 0.012 if codec == 'h264' else 0.008  # H.265 省 30%
        return daily_gb * retention_days * price
    
    def total(self) -> dict:
        return {
            'bandwidth': round(self.bandwidth_cost(), 4),
            'transcode': round(self.transcode_cost(), 4),
            'storage': round(self.storage_cost(), 4),
            'total_per_stream_per_hour': round(
                self.bandwidth_cost() + self.transcode_cost() + self.storage_cost(), 4)
        }

# 示例：3Mbps 直播 1 小时
print(StreamCost(3000, 3600).total())
# {'bandwidth': 0.675, 'transcode': 0.255, 'storage': 0.003, 'total_per_stream_per_hour': 0.933}

# .github/workflows/whip-whep-compliance.yml
name: WHIP/WHEP Compliance Matrix
on: [push, pull_request, schedule]

jobs:
  interop-test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        server: [srs-6.0, mediamtx-1.8, l7mp-0.12, janus-1.2]
        client: [obs-30, ffmpeg-7, gstreamer-1.24, chrome-120, safari-17, whip-go-client, whep-js-player]
        include:
          - server: srs-6.0
            client: obs-30
            profile: "whip-publish-h264-opus"
          - server: mediamtx-1.8
            client: chrome-120
            profile: "whep-play-vp8"
    steps:
      - uses: actions/checkout@v4
      - name: Start Media Server
        run: docker compose -f docker/${{ matrix.server }}.yml up -d
      - name: Run Test Profile
        run: |
          python -m pytest tests/profiles/${{ matrix.profile }}.py 
            --server ${{ matrix.server }} 
            --client ${{ matrix.client }} 
            --junitxml=report-${{ matrix.server }}-${{ matrix.client }}.xml
      - name: Upload Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: compliance-${{ matrix.server }}-${{ matrix.client }}
          path: report-*.xml

timeline
    title 实时媒体传输演进路线
    2020 : WebRTC over UDP (DTLS/SRTP)
    2023 : WHIP/WHEP 标准化 HTTP 信令
    2024 : WebTransport (HTTP/3 + QUIC) 可用
    2025 : **WHIP/WHEP over WebTransport** 提案
    2026 : 统一传输平面：单连接承载信令+媒体+数据通道
    2027 : 原生浏览器支持、中间件零改造穿透

/rtc-knowledge-base
├── 01-protocol-specs/          # RFC/草案中文注译版
├── 02-architecture-decisions/  # ADR (Architecture Decision Records)
├── 03-incident-postmortems/    # 事故复盘库 (按 P0/P1 分级)
├── 04-performance-baselines/   # 压测报告、火焰图归档
├── 05-security-audits/         # 渗透测试报告、合规证据
├── 06-migration-playbooks/     # 迁移运行手册、回滚预案
└── 07-training-materials/      # 内部技术分享 PPT、实验视频