tini → ① init-postgres.sh（initdb + prisma migrate deploy，仅 START_INTERNAL_DB=true）
     → ② pg_ctl start -D /var/lib/postgresql/data
     → ③ npx prisma@6.12.0 migrate deploy --schema=/service/schema.prisma（幂等）
     → ④ node ./dist/runner
          ├─ messageDispatcher（0.0.0.0:51901）
          ├─ connectProcessor（0.0.0.0:51904）
          ├─ locationService（0.0.0.0:51902，cache 默认 MEMORY）
          ├─ pgDataService（0.0.0.0:51907 + 外部口 51908）
          └─ spawn /service/edgeport.sh → java io.routr.Launcher（5060–5063）

kind: EdgePort
apiVersion: v2beta1
ref: default                      # routr-one 固定为 default；模块化部署按实例命名（如 edgeport-01）
metadata:
  region: default                 # 多 EdgePort 场景的区域标签
spec:
  unknownMethodAction: Discard    # 收到不在 methods 白名单里的 SIP 方法时的动作：Discard 丢弃
  processor:
    addr: localhost:51901         # 转发目标：Message Dispatcher（routr-one 写死 localhost）
  securityContext:
    client:
      authType: DisabledAll       # 对客户端 TLS 客户端证书的校验策略（默认全禁用）
    keyStorePassword: changeme    # ★ 入口脚本由 $PKCS12_PASSWORD sed 注入，生产必改
    trustStorePassword: changeme  # ★ 同上
    keyStore: "/etc/routr/certs/signaling.p12"
    trustStore: "/etc/routr/certs/signaling.p12"
    keyStoreType: pkcs12
  methods:                        # SIP 方法白名单
    - REGISTER
    - MESSAGE
    - INVITE
    - ACK
    - BYE
    - CANCEL
    - REFER
    - NOTIFY
  transport:                      # 监听传输与端口
    - protocol: tcp
      port: 5060
    - protocol: udp
      port: 5060
    - protocol: tls
      port: 5061
    - protocol: ws
      port: 5062
    - protocol: wss
      port: 5063

spec:
  externalAddrs:            # 对外通告地址，写入 Via/Contact/Record-Route
    - 10.111.220.2
    - sip01.edgeport.net
  localnets:                # 本地网段：命中则通告内网地址
    - 127.0.0.1/8
    - 10.111.221.2/24

kind: MessageDispatcher
apiVersion: v2beta1
ref: message-dispatcher
spec:
  bindAddr: 0.0.0.0:51901
  processors:                     # 按序匹配，第一个 matchFunc 命中即接管
    - ref: connect-processor
      addr: connect:51904
      matchFunc: req => true      # JS 谓词：可按方法/头部写路由条件
      methods: [REGISTER, MESSAGE, INVITE, ACK, BYE, CANCEL, REFER, NOTIFY]

  recording:
    enabled: true
    path: /var/routr/traces
    mode: all                     # all=全录；flagged=只录标记会话（枚举见 5.7）
    redact: false
    lint:
      profiles: [sip, sip-connect]

kind: Location
apiVersion: v2beta1
metadata:
  region: default
spec:
  bindAddr: 0.0.0.0:51902
  cache:
    provider: memory    # memory（单实例，重启即失）或 redis（多实例共享）

kind: Registry
apiVersion: v2beta1
spec:
  requesterAddr: requester:51909   # 借道 EdgePort 发 SIP
  apiAddr: apiserver:51907         # 读 Trunk 资源
  registerInterval: 20             # 周期重注册（秒）
  cache:
    provider: memory
  methods: [INVITE, MESSAGE]       # 允许经 Trunk 出去的方法
  edgePorts:                       # 用哪些 EdgePort 出局
    - address: sip01.edgeport.net:5060
      region: us-east1
    - address: sip02.edgeport.net:6060

kind: RTPRelay
apiVersion: v2beta1
spec:
  # bindAddr: 0.0.0.0:51903
  # rtpengine:
  #   host: rtpengine
  #   port: 22222
  profiles:
    phone-to-secure-phone:
      SDES:
        - only-AES_CM_128_HMAC_SHA1_80

(edgeport) GRPCSipListener.java starting edgeport ref = 8e6607060fc0 version = 2.25.1 at 0.0.0.0
(edgeport) GRPCSipListener.java localnets list [10.89.57.2/24,127.0.0.1/8]
(edgeport) GRPCSipListener.java external hosts list [10.89.57.11]

$ docker exec <容器> openssl s_client -connect localhost:51908
subject=CN=localhost
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Verify return code: 21 (unable to verify the first certificate)   ← 自签 CA，符合预期

[error]: errno: -13, code: 'EACCES', syscall: 'mkdir', path: '/var/routr/traces'
[INFO  tini (1)] Main child exited normally (with status '1')      ← 容器直接退出

(dispatcher) message recording enabled {"path":"/tmp/routr-traces","mode":"all","redact":true,"lint":"off"}