Dawn Stream signaling
Signaling discovers streamers and viewers, authenticates them, and relays SDP/ICE. It does not carry media—WebRTC RTP goes peer-to-peer (or via TURN).
Standalone vs embedded
| Mode | When to use | How |
|---|---|---|
| Standalone (Node) | Local demos and production | Gems/DawnStream/Signaling → node src/main.ts |
| Embedded (in-engine) | Single-machine / Editor demos | Signaling.Embedded=true or Editor default (UseRemoteSignaling=false) |
Do not configure the same logical instance from both streamer setreg and Node flags as if they were two servers—pick one host process.
Standalone quick start
cd Gems/DawnStream/Signaling
$env:PS_STREAMER_TOKEN = "<streamer-token>"
$env:PS_VIEWER_TOKEN = "<viewer-token>"
node src/main.ts --port 8090
Streamer points Signaling.Url (or --dawnstream-signaling-url) at ws://127.0.0.1:8090 and sets DAWNSTREAM_AUTH_TOKEN to the same streamer token.
Embedded
Set in project setreg or CLI:
Signaling.Embedded/--dawnstream-embedded-signaling- Port is taken from
Signaling.Url(e.g.ws://127.0.0.1:8090→ listen 8090)
Editor defaults to embedded unless Editor.UseRemoteSignaling=true. Optional embedded extras (RestApi, ServeStatic, queue) live under the same Signaling.* setreg block—see
Configuration.
Auth model
| Role | Env (preferred) | CLI (avoid in production) |
|---|---|---|
| Streamer | PS_STREAMER_TOKEN (signaling) + DAWNSTREAM_AUTH_TOKEN (engine) | --streamer-token |
| Viewer | PS_VIEWER_TOKEN | --viewer-token |
| Admin | PS_ADMIN_TOKEN | --admin-token |
Engine side: empty Signaling.AuthToken reads Signaling.AuthTokenEnv (default DAWNSTREAM_AUTH_TOKEN). Admin token env default: DAWNSTREAM_ADMIN_TOKEN.
Never put long-lived tokens on the process command line, in setreg committed to git, or in image layers. Prefer short-lived viewer tickets in production.
Health and readiness
| Endpoint | Purpose |
|---|---|
GET /healthz | Liveness |
GET /readyz | Readiness |
Use these from load balancers and local smoke checks before blaming WebRTC.
Common server flags
node src/main.ts --port 8090 `
--stun stun:stun.l.google.com:19302 `
--turn turn:turn.example.com:3478 `
--turn-username user --turn-password secret `
--tls-cert fullchain.pem --tls-key privkey.pem
| Flag / env | Description |
|---|---|
--host / --port | Listen address (default 0.0.0.0:8090) |
PS_STREAMER_TOKEN / PS_VIEWER_TOKEN / PS_ADMIN_TOKEN | Auth tokens (preferred over CLI) |
--max-viewers | Viewers per streamer (MVP default 1) |
--max-player-count | Global participant cap (-1 = unlimited) |
--keepalive-secs / --idle-timeout-secs / --reserve-timeout-secs | Liveness / idle / reserve timeouts |
--stun / --turn + credentials | ICE servers advertised to clients |
--tls-cert / --tls-key | Enable wss:// (both required) |
--rest-api / --rest-api-token | Read-only monitoring under /api/* |
--serve-static / --serve-frontend / --http-root / --homepage | Host frontend files (demos) |
--cors / --cors-allowed-origins | Cross-origin (default same-origin only) |
--enable-queue / --max-queue-length | FIFO when at capacity (default hard reject) |
--enable-sfu / --sfu-streamer-id | Optional SFU routing (extension) |
--orchestrator … | Instance orchestration (none / stub / local / k8s)—roadmap / advanced |
Production should use WSS + short-lived tokens + TURN. Orchestrator / SFU flags are not required for the MVP single-viewer loop.
What signaling exchanges
High-level WebSocket JSON flow (names abbreviated):
- Client authenticates with role + token.
- Streamer registers; viewer joins / reserves a session.
- Peers exchange SDP offer/answer and ICE candidates through the hub.
- Keepalive via
signaling.ping/signaling.pong. - Close with application codes in
4000–4999(rejected / recycled / retryable).
Default negotiation: viewer creates the offer. Engine Video.OfferToReceive=true flips so the streamer offers (advanced).
Media and input never go through this hub.
Next steps
- Browser and input — connect the reference player.
- Deployment — WSS, TURN, firewall.
- Configuration — streamer-side
Signaling.*keys.