94 lines
2.2 KiB
Markdown
94 lines
2.2 KiB
Markdown
# 📄 deployment.md — Mesh Deployment (self-hosted)
|
||
|
||
## 1. Composants
|
||
- mesh-server (FastAPI + WS)
|
||
- coturn (TURN) — fallback NAT strict
|
||
- gotify (notifications)
|
||
- (optionnel) reverse proxy (Caddy/Nginx) + TLS
|
||
|
||
## 2. Variables d’environnement (exemple)
|
||
- MESH_PUBLIC_URL=https://mesh.example.com
|
||
- MESH_JWT_SECRET=...
|
||
- GOTIFY_URL=https://gotify.example.com
|
||
- GOTIFY_TOKEN=...
|
||
- TURN_HOST=turn.example.com
|
||
- TURN_PORT=3478
|
||
- TURN_USER=mesh
|
||
- TURN_PASS=...
|
||
|
||
## 3. docker-compose (exemple)
|
||
Placez ceci dans `infra/docker-compose.yml`.
|
||
|
||
services:
|
||
mesh-server:
|
||
build: ../server
|
||
environment:
|
||
- MESH_JWT_SECRET=${MESH_JWT_SECRET}
|
||
- GOTIFY_URL=${GOTIFY_URL}
|
||
- GOTIFY_TOKEN=${GOTIFY_TOKEN}
|
||
- TURN_URL=${TURN_URL}
|
||
- STUN_URL=${STUN_URL}
|
||
ports:
|
||
- "8000:8000"
|
||
restart: unless-stopped
|
||
|
||
coturn:
|
||
image: coturn/coturn:latest
|
||
command: >
|
||
-n
|
||
--log-file=stdout
|
||
--external-ip=${TURN_EXTERNAL_IP}
|
||
--realm=${TURN_REALM}
|
||
--user=${TURN_USER}:${TURN_PASS}
|
||
--listening-port=3478
|
||
--min-port=49160 --max-port=49200
|
||
--fingerprint
|
||
--lt-cred-mech
|
||
--no-multicast-peers
|
||
--no-cli
|
||
network_mode: "host"
|
||
restart: unless-stopped
|
||
|
||
gotify:
|
||
image: gotify/server:latest
|
||
environment:
|
||
- GOTIFY_DEFAULTUSER_NAME=admin
|
||
- GOTIFY_DEFAULTUSER_PASS=adminadmin
|
||
ports:
|
||
- "8080:80"
|
||
volumes:
|
||
- gotify_data:/app/data
|
||
restart: unless-stopped
|
||
|
||
volumes:
|
||
gotify_data:
|
||
|
||
## 4. Notes TURN
|
||
- TURN peut devenir “lourd” si beaucoup de pairs passent en relay.
|
||
- Prévoir monitoring trafic + quotas.
|
||
- Credentials temporaires (V1+) recommandé.
|
||
|
||
## 5. Reverse proxy + TLS (recommandé)
|
||
- Terminer TLS au proxy (Caddy/Nginx).
|
||
- Forward:
|
||
- /api → mesh-server
|
||
- /ws → mesh-server (upgrade websocket)
|
||
- TURN: idéalement domaine dédié (turn.example.com) + ports ouverts.
|
||
|
||
## 6. Ports réseau
|
||
- Mesh Server: 443 (TLS) / 80 (redirect)
|
||
- TURN: 3478 UDP/TCP + range UDP (ex 49160-49200)
|
||
- Gotify: 443/80 (si exposé), sinon LAN only
|
||
|
||
## 7. Checks de santé
|
||
- /health sur mesh-server
|
||
- gotify UI accessible
|
||
- test ICE: vérifier host/srflx/relay
|
||
|
||
## 8. Exploitation
|
||
- Sauvegarder:
|
||
- DB mesh (si sqlite/postgres)
|
||
- gotify_data
|
||
- Rotation logs
|
||
|