fixes lol

docker-compose.prod.yml

@@ -44,9 +44,8 @@ services:
     ports:
       - "1935:1935"           # RTMP
       - "9999:9999/udp"       # SRT
-      - "3333:3333"           # WebRTC Signaling
-      - "3334:3334"           # WebRTC Signaling TCP
-      - "3478:3478"           # STUN/TURN
+      # WebRTC Signaling (3333/3334) now proxied through nginx
+      - "3478:3478"           # STUN/TURN for NAT traversal
       - "10000-10009:10000-10009/udp" # WebRTC ICE Candidates
     volumes:
       - ./Server.xml:/opt/ovenmediaengine/bin/origin_conf/Server.xml

docker-compose.yml

@@ -37,9 +37,9 @@ services:
       - "9999:9999/udp"       # SRT
       # HLS/LLHLS now proxied through openresty (removed direct exposure)
       - "8081:8081"           # API (internal)
-      - "3333:3333"           # WebRTC Signaling
-      - "3478:3478"           # WebRTC ICE
-      - "10000-10009:10000-10009/udp" # WebRTC Candidates
+      # WebRTC Signaling (3333) now proxied through nginx
+      - "3478:3478"           # STUN/TURN for NAT traversal
+      - "10000-10009:10000-10009/udp" # WebRTC ICE Candidates
     volumes:
       - ./ovenmediaengine/Server.xml:/opt/ovenmediaengine/bin/origin_conf/Server.xml
       - ome_logs:/var/log/ovenmediaengine

frontend/src/routes/[realm]/live/+page.svelte

@@ -29,7 +29,6 @@
     }
     
     const STREAM_PORT = import.meta.env.VITE_STREAM_PORT || '8088';
-    const WEBRTC_PORT = import.meta.env.VITE_WEBRTC_PORT || '3333';
 
     // Helper functions for dynamic host/protocol detection
     function getStreamHost() {
@@ -333,7 +332,7 @@
                 },
                 {
                     type: 'webrtc',
-                    file: `${wsProto}://${host}:${WEBRTC_PORT}/app/${streamKey}`,
+                    file: `${wsProto}://${host}/webrtc/app/${streamKey}`,
                     label: 'WebRTC (Ultra Low Latency)'
                 }
             );
@@ -1047,6 +1046,10 @@
         .chat-section {
             min-height: 400px;
         }
+
+        .stream-info-section {
+            display: none;
+        }
     }
 
     /* Stream grid layout for multiple streams - Resizable */

openresty/nginx.conf

@@ -805,6 +805,27 @@ http {
             proxy_send_timeout 3600s;
         }
 
+        # WebRTC Signaling proxy for OvenMediaEngine
+        # Handles wss:// → ws:// translation so OME doesn't need TLS certificates
+        location /webrtc/ {
+            # Proxy to OvenMediaEngine WebRTC signaling port
+            proxy_pass http://ovenmediaengine:3333/;
+            proxy_http_version 1.1;
+            proxy_buffering off;
+
+            # WebSocket upgrade headers
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # WebRTC signaling needs long timeouts
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
         # Stream thumbnails - 3 second animated WebP generated on-demand via FFmpeg
         location ~ ^/thumb/([^/]+)\.webp$ {
             set $stream_key $1;
@@ -867,6 +888,22 @@ http {
 
         # Nakama Game Server WebSocket (nakama-js connects to /ws with query params)
         location = /ws {
+            # CORS headers for WebSocket upgrade request
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization, Upgrade, Connection" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+
+            if ($request_method = 'OPTIONS') {
+                add_header Access-Control-Allow-Origin $cors_origin always;
+                add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "Content-Type, Authorization, Upgrade, Connection" always;
+                add_header Access-Control-Allow-Credentials "true" always;
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
             # Runtime DNS resolution
             set $nakama_backend nakama:7350;
             # Must include $is_args$args when using variables - nginx won't auto-append query string

terraform/modules/app_server/cloud-init.yaml.tpl

@@ -85,10 +85,10 @@ write_files:
       # Inbound: Streaming ports
       ufw allow in 1935/tcp comment 'RTMP'
       ufw allow in 9999/udp comment 'SRT'
-      ufw allow in 3333/tcp comment 'WebRTC TCP'
-      ufw allow in 3333/udp comment 'WebRTC UDP'
-      ufw allow in 3334/tcp comment 'WebRTC TCP fallback'
       ufw allow in 8088/tcp comment 'HLS/LLHLS streaming'
+      # WebRTC signaling now proxied through nginx (443), only need media ports
+      ufw allow in 3478/udp comment 'WebRTC STUN/TURN'
+      ufw allow in 10000:10009/udp comment 'WebRTC ICE candidates'
 
       # Inbound: VPC traffic (includes system SSH)
       ufw allow in from ${vpc_ip_range} comment 'VPC internal'

terraform/modules/app_server/main.tf

@@ -71,23 +71,17 @@ resource "digitalocean_firewall" "app" {
     source_addresses = ["0.0.0.0/0", "::/0"]
   }
 
-  # WebRTC (ICE candidates)
-  inbound_rule {
-    protocol         = "tcp"
-    port_range       = "3333"
-    source_addresses = ["0.0.0.0/0", "::/0"]
-  }
-
+  # WebRTC STUN/TURN (NAT traversal)
   inbound_rule {
     protocol         = "udp"
-    port_range       = "3333"
+    port_range       = "3478"
     source_addresses = ["0.0.0.0/0", "::/0"]
   }
 
-  # WebRTC TCP (fallback)
+  # WebRTC ICE candidates (media transport)
   inbound_rule {
-    protocol         = "tcp"
-    port_range       = "3334"
+    protocol         = "udp"
+    port_range       = "10000-10009"
     source_addresses = ["0.0.0.0/0", "::/0"]
   }