From 1a3d409d50a9f348c99bc606d6e33e3132bf4456 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 24 Feb 2026 21:00:46 +0000
Subject: [PATCH] Fix mobile registration: inject transport-tls when missing
 from pjsip.conf
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pjsip.conf is intentionally preserved across container restarts to protect
device configurations.  When the file was created by an older version of the
setup script, or by the non-Docker bare-metal installer, it has no
[transport-tls] section.  Asterisk then starts without a TLS transport,
silently, which means nothing listens on port 5061 — causing every mobile
client configured for TLS to fail registration while the server appears
otherwise healthy.

The entrypoint now checks for the presence of [transport-tls] in an existing
pjsip.conf and injects the section (with current NAT/cert settings) if it is
absent.  A fresh install is unaffected because pjsip.conf is generated from
scratch with the TLS transport included.

https://claude.ai/code/session_01PTzYWkePEG3tDCMSLfWrXE
---
 docker/entrypoint.sh | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index ed7cf73..7079e32 100644
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -259,6 +259,28 @@ if [[ -f /etc/asterisk/pjsip.conf ]]; then
     fi
 fi
 
+# ── Ensure transport-tls exists in pjsip.conf (upgrade / migration path) ──
+# If pjsip.conf was preserved from a pre-TLS config or a non-Docker install it
+# will have no [transport-tls] section.  Asterisk starts without TLS silently,
+# and mobile devices cannot register.  Inject the section when it is absent.
+if [[ -f /etc/asterisk/pjsip.conf ]] && ! grep -q "^\[transport-tls\]" /etc/asterisk/pjsip.conf; then
+    log_info "transport-tls missing from pjsip.conf — adding TLS transport (required for mobile registration)..."
+    cat >> /etc/asterisk/pjsip.conf << EOF
+
+[transport-tls]
+type=transport
+protocol=tls
+bind=0.0.0.0:5061
+cert_file=/etc/asterisk/certs/server.crt
+priv_key_file=/etc/asterisk/certs/server.key
+ca_list_file=/etc/ssl/certs/ca-certificates.crt
+method=tlsv1_2
+${nat_settings}
+
+EOF
+    chown asterisk:asterisk /etc/asterisk/pjsip.conf
+fi
+
 # ── rtp.conf (always regenerated - includes TURN credentials) ──
 log_info "Configuring RTP with ICE + STUN + TURN..."
 cat > /etc/asterisk/rtp.conf << EOF