SyncTV 多人同步观影平台部署实战与多人语音中转

version: '3.3'
services:
  synctv:
    image: 'synctvorg/synctv:latest'
    container_name: synctv
    restart: unless-stopped
    ports:
      - '8080:8080/tcp'
      - '8080:8080/udp'
    volumes:
      - /opt/synctv:/root/.synctv
    environment:
      - PUID=0
      - PGID=0
      - UMASK=022
      - TZ=Asia/Shanghai

client_max_body_size 20m;
proxy_cache off;
proxy_buffering off;
proxy_http_version 1.1;

proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Protocol $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header REMOTE-HOST $remote_addr;

location = /api/room/ws {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "";
    proxy_set_header Range $http_range;
}

docker run -d \

  --name=coturn \

  --network=host \

  --restart=always \

  coturn/coturn \

  -n \

  --log-file=stdout \

  --listening-port=3478 \

  --min-port=49160 \

  --max-port=49200 \

  --external-ip=你的公网IP \

  --user=synctv:synctvpassword \

  --realm=synctv.local \

  --lt-cred-mech

version: '3'

services:
  coturn:
    image: coturn/coturn
    container_name: coturn
    restart: always
    # 🔥 核心：必须使用 Host 模式
    # 这样 Coturn 才能直接管理服务器的 UDP 端口，性能最高且不出错
    network_mode: host
    
    command:
      - -n                            # 不使用配置文件，全靠命令行参数
      - --log-file=stdout             # 日志输出到 Docker 控制台
      - --min-port=49160              # 语音数据端口起点
      - --max-port=49200              # 语音数据端口终点
      - --listening-port=3478         # 信令握手端口
      - --fingerprint                 # WebRTC 校验机制
      - --lt-cred-mech                # 启用长期凭证机制 (WebRTC 必须)
      
      # 👇 这里填你的公网 IP (必须和 Nginx 注入脚本里的一致)
      - --external-ip=
      
      # 👇 域名 (可以随便填，或者填你的 IP)
      - --realm=
      
      # 👇 账号密码 (必须和 Nginx 注入脚本里的一致)
      # 格式是 用户名:密码
      - --user=synctv:synctvpassword

3478 tcp/udp
49160-49200 udp

server {
    listen 443 ssl http2;
    server_name wto.abaishu.fun;
    
    # ... SSL 和日志配置 ...

    # 1. 优化 WebSocket (单独处理，不注入脚本)
    location = /api/room/ws {
        proxy_pass http://127.0.0.1:8210;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }

    # 2. 网页主入口 (注入脚本)
    location / {
        proxy_pass http://127.0.0.1:8210;
        
        # 基础 Header
        proxy_set_header Host $host;
        proxy_set_header Range $http_range;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "";

        # 🔥 核心：禁用压缩，否则无法替换内容
        proxy_set_header Accept-Encoding ""; 

        # 🔥 核心：注入 JS 脚本
        sub_filter_once on;
        sub_filter_types text/html;
        sub_filter '</head>' '
        <script>
        (function() {
            // Base64 解码配置 (c3luY3R2 -> synctv)
            const MY_TURN_CONFIG = {
                urls: "turn:你的公网IP:3478",
                username: atob("c3luY3R2"), 
                credential: atob("c3luY3R2cGFzc3dvcmQ=")
            };

            console.log("%c🔥 SyncTV 劫持补丁(安全版)已加载", "color: #00aa00; font-weight: bold;");

            const OriginalRTCPeerConnection = window.RTCPeerConnection || window.webkitRTCPeerConnection;
            if (!OriginalRTCPeerConnection) return;

            // 劫持构造函数
            window.RTCPeerConnection = function(config) {
                if (!config) config = {};
                // 强行覆盖为我们的 TURN
                config.iceServers = [MY_TURN_CONFIG];
                console.log("🔒 已注入混淆后的 TURN 凭证");
                return new OriginalRTCPeerConnection(config);
            };
            window.RTCPeerConnection.prototype = OriginalRTCPeerConnection.prototype;
        })();
        </script>
        </head>';
    }
}