Dawn Stream deployment

Ship a browser-reachable stream with WSS signaling, working ICE (usually TURN), and secrets kept out of images and git.

Topologies

Topology	Use
Standalone signaling + static frontend (CDN or separate host)	Production
Signaling `--serve-static` / `--serve-frontend`	Demos only
Embedded signaling in the engine	Local / Editor demos only
SFU (`Gems/DawnStream/SFU`, `--enable-sfu`)	Optional one-to-many fan-out—not required for MVP

Public checklist

Signaling on WSS with valid certificates (--tls-cert / --tls-key).
Configure STUN + TURN; enterprise and symmetric NAT almost always need TURN.
Inject streamer / viewer / admin tokens via env or a secret manager; keep viewer tickets short-lived; rotate regularly.
Plan NVENC concurrency: consumer GeForce cards often allow ~3 encode sessions; use professional GPUs or Video.EncoderGpuId for multi-instance hosts.
Open firewall paths (below). Prefer clamping WebRTC UDP with IcePortMin / IcePortMax when policy requires it.
Host the player over HTTPS (autoplay and secure context). Do not bake long-lived secrets into setreg or container layers.

TURN example

Signaling advertises ICE servers to clients:

node src/main.ts --port 443 `
 --tls-cert fullchain.pem --tls-key privkey.pem `
 --stun stun:stun.l.google.com:19302 `
 --turn turn:turn.example.com:3478 `
 --turn-username user --turn-password secret

Engine / project setreg can also set Network.TurnServer + username/password (and STUN list). Keep TURN credentials in secrets, not in committed setreg. Viewer URL forceTurn helps validate relay-only paths.

Firewall ports

Traffic	Typical ports	Notes
Signaling	TCP 443 (or custom)	WSS
Player / static	TCP 443	HTTPS
WebRTC media	UDP range	Optionally clamp with `IcePortMin`/`Max`
TURN	UDP/TCP 3478 (+ relay range per TURN server)	Vendor-specific

NVENC and multi-instance

One hardware encode session per streamer process is the common case for MVP (MaxViewers=1).
Scale out with more GPU hosts rather than oversubscribing a consumer card.
Bind a GPU with Video.EncoderGpuId when multiple adapters are present.
Keep ZeroCopyCapture=false unless you have measured reconnect memory behavior—see Building for real media.

Security hardening

Prefer env / secret manager over CLI token flags.
Separate streamer, viewer, and admin tokens; never reuse streamer secrets in player URLs beyond short TTL tickets.
Disable experimental remote console (Experimental.AllowConsoleCommands) unless triple-gated and allowlisted.
Restrict CORS; default same-origin is safer.
Monitor /healthz / /readyz and streamer ps_dumpStats / CSV in ops dashboards.

Next steps

Diagnostics — what to watch in production.
Reference — limits and API summary.
Configuration — Network / Signaling keys.