From 998cfcef05a94da7626aaacdb16338f938191f07 Mon Sep 17 00:00:00 2001 From: outis1one Date: Thu, 4 Dec 2025 09:14:14 -0500 Subject: [PATCH] Add files via upload --- easy-asterisk-interactive-v1.36.sh | 2206 ++++++++++++++++++++++++++++ 1 file changed, 2206 insertions(+) create mode 100644 easy-asterisk-interactive-v1.36.sh diff --git a/easy-asterisk-interactive-v1.36.sh b/easy-asterisk-interactive-v1.36.sh new file mode 100644 index 0000000..174af65 --- /dev/null +++ b/easy-asterisk-interactive-v1.36.sh @@ -0,0 +1,2206 @@ +#!/bin/bash +# ================================================================ +# Easy Asterisk - Interactive Installer v1.30 +# +# MAJOR UPDATES in v1.30: +# - SIMPLIFIED: Two client types - LAN/VPN (IP) or FQDN (domain) +# - ADDED: Per-device connection type selection +# - ADDED: Clear setup wizard for FQDN access +# - FIXED: Cross-VLAN clients properly handled as FQDN clients +# - IMPROVED: Cleaner network configuration flow +# +# CLIENT TYPES: +# LAN/VPN - Connect via server IP, UDP/5060, no encryption needed +# FQDN - Connect via domain name, TLS/5061, requires port forward +# (This includes cross-VLAN clients using hairpin NAT) +# +# RETAINED from v1.29: +# - Kiosk client fixes (DBUS, PipeWire deps) +# - PTT button fixes +# - Smart user detection +# - Comprehensive logging +# ================================================================ + +set +e + +# Colors +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +CYAN='\033[0;36m' +BOLD='\033[1m' +NC='\033[0m' + +# Defaults +DEFAULT_SIP_PORT="5060" +DEFAULT_SIPS_PORT="5061" +DEFAULT_TURN_PORT="3478" +CONFIG_DIR="/etc/easy-asterisk" +CONFIG_FILE="${CONFIG_DIR}/config" +PTT_CONFIG_FILE="${CONFIG_DIR}/ptt-device" +CATEGORIES_FILE="${CONFIG_DIR}/categories.conf" +ROOMS_FILE="${CONFIG_DIR}/rooms.conf" +COTURN_CONFIG="/etc/turnserver.conf" +SCRIPT_VERSION="1.30" + +# ================================================================ +# 1. CORE HELPER FUNCTIONS +# ================================================================ + +print_header() { + echo -e "\n${CYAN}╔══════════════════════════════════════════════════════════╗${NC}" + echo -e "${CYAN} $1${NC}" + echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}\n" +} + +print_info() { echo -e "${GREEN}[INFO]${NC} $1"; } +print_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; } +print_error() { echo -e "${RED}[ERROR]${NC} $1"; } +print_success() { echo -e "${GREEN}[OK]${NC} $1"; } + +check_root() { + if [[ $EUID -ne 0 ]]; then + print_error "This script must be run as root (use sudo)" + exit 1 + fi +} + +generate_password() { + tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 16 +} + +select_server_ip() { + # Returns selected IP in SELECTED_IP variable + # Filters out docker, virtual bridges, loopback + + local -a ips=() + local -a ifaces=() + local -a labels=() + local count=0 + + while IFS= read -r line; do + local iface=$(echo "$line" | awk '{print $2}' | tr -d ':') + local ip=$(echo "$line" | awk '{print $4}' | cut -d'/' -f1) + + # Skip unwanted interfaces + [[ "$iface" =~ ^(lo|docker|br-|veth|virbr|lxc|lxd) ]] && continue + [[ "$iface" == "lo" ]] && continue + [[ -z "$ip" ]] && continue + + # Determine label + local label="LAN" + if [[ "$iface" =~ ^tailscale ]]; then + label="VPN-Tailscale" + elif [[ "$iface" =~ ^(wg[0-9]) ]]; then + label="VPN-WireGuard" + elif [[ "$iface" =~ ^(wt[0-9]|utun) ]]; then + label="VPN-Netbird" + elif [[ "$iface" =~ ^tun ]]; then + label="VPN-OpenVPN" + elif [[ "$iface" =~ ^zt ]]; then + label="VPN-ZeroTier" + elif [[ "$iface" =~ ^nordlynx ]]; then + label="VPN-NordVPN" + elif [[ "$iface" =~ ^proton ]]; then + label="VPN-Proton" + elif [[ "$iface" =~ ^mullvad ]]; then + label="VPN-Mullvad" + fi + + ((count++)) + ips+=("$ip") + ifaces+=("$iface") + labels+=("$label") + + done < <(ip -o -4 addr show 2>/dev/null) + + if [[ $count -eq 0 ]]; then + SELECTED_IP=$(hostname -I | awk '{print $1}') + return + fi + + echo "" + echo " Available server IPs:" + for i in "${!ips[@]}"; do + printf " %d) %-15s (%s - %s)\n" "$((i+1))" "${ips[$i]}" "${ifaces[$i]}" "${labels[$i]}" + done + echo " $((count+1))) Enter manually" + echo "" + + read -p " Select [1]: " ip_choice + ip_choice="${ip_choice:-1}" + + if [[ "$ip_choice" == "$((count+1))" ]]; then + read -p " Enter IP: " SELECTED_IP + elif [[ "$ip_choice" -ge 1 && "$ip_choice" -le "$count" ]]; then + SELECTED_IP="${ips[$((ip_choice-1))]}" + else + SELECTED_IP="${ips[0]}" + fi +} + +select_user() { + local -a users=() + local -a user_ids=() + local count=0 + + echo "Scanning for users..." + echo "" + + while IFS=: read -r username _ uid _ _ homedir shell; do + if [[ $uid -ge 1000 && -d "$homedir" && "$shell" != "/usr/sbin/nologin" && "$shell" != "/bin/false" ]]; then + ((count++)) + users+=("$username") + user_ids+=("$uid") + echo " ${count}) ${username} (UID: ${uid}, Home: ${homedir})" + fi + done < /etc/passwd + + ((count++)) + echo " ${count}) Enter username manually" + echo "" + + local default_choice="" + local default_user="${SUDO_USER:-}" + if [[ -z "$default_user" ]]; then + default_user="${users[0]:-}" + default_choice="1" + else + for i in "${!users[@]}"; do + if [[ "${users[$i]}" == "$default_user" ]]; then + default_choice=$((i + 1)) + break + fi + done + fi + + if [[ -n "$default_choice" ]]; then + read -p "Select user [${default_choice}]: " choice + choice="${choice:-$default_choice}" + else + read -p "Select user: " choice + fi + + if [[ "$choice" =~ ^[0-9]+$ && "$choice" -le "${#users[@]}" && "$choice" -gt 0 ]]; then + local idx=$((choice - 1)) + KIOSK_USER="${users[$idx]}" + KIOSK_UID="${user_ids[$idx]}" + echo "" + print_success "Selected user: $KIOSK_USER (UID: $KIOSK_UID)" + return 0 + elif [[ "$choice" == "$count" ]]; then + echo "" + read -p "Enter username: " KIOSK_USER + if id "$KIOSK_USER" >/dev/null 2>&1; then + KIOSK_UID=$(id -u "$KIOSK_USER") + print_success "Selected user: $KIOSK_USER (UID: $KIOSK_UID)" + return 0 + else + print_error "User '$KIOSK_USER' not found" + return 1 + fi + else + print_error "Invalid selection" + return 1 + fi +} + +load_config() { + if [[ -f "$CONFIG_FILE" ]]; then + source "$CONFIG_FILE" 2>/dev/null || true + fi + INSTALLED_SERVER="${INSTALLED_SERVER:-n}" + INSTALLED_CLIENT="${INSTALLED_CLIENT:-n}" + INSTALLED_COTURN="${INSTALLED_COTURN:-n}" + KIOSK_USER="${KIOSK_USER:-}" + KIOSK_UID="${KIOSK_UID:-}" + USE_COTURN="${USE_COTURN:-n}" + TURN_SECRET="${TURN_SECRET:-}" + TURN_USER="${TURN_USER:-kioskuser}" + TURN_PASS="${TURN_PASS:-}" + TURN_DOMAIN="${TURN_DOMAIN:-}" + FQDN_ENABLED="${FQDN_ENABLED:-n}" + return 0 +} + +backup_config() { + local file=$1 + if [[ -f "$file" ]]; then + cp "$file" "${file}.backup-$(date +%s)" + ls -tp "${file}.backup-"* 2>/dev/null | tail -n +6 | xargs -I {} rm -- {} 2>/dev/null + fi +} + +save_config() { + mkdir -p "$CONFIG_DIR" + chmod 755 "$CONFIG_DIR" + + cat > "$CONFIG_FILE" << EOF +# Easy Asterisk Configuration - $(date) +KIOSK_USER="$KIOSK_USER" +KIOSK_UID="$KIOSK_UID" +KIOSK_EXTENSION="$KIOSK_EXTENSION" +KIOSK_NAME="$KIOSK_NAME" +SIP_PASSWORD="$SIP_PASSWORD" +ASTERISK_HOST="$ASTERISK_HOST" +DOMAIN_NAME="$DOMAIN_NAME" +TURN_DOMAIN="$TURN_DOMAIN" +FQDN_ENABLED="$FQDN_ENABLED" +CERT_PATH="$CERT_PATH" +KEY_PATH="$KEY_PATH" +INSTALLED_SERVER="$INSTALLED_SERVER" +INSTALLED_CLIENT="$INSTALLED_CLIENT" +INSTALLED_COTURN="$INSTALLED_COTURN" +USE_COTURN="$USE_COTURN" +TURN_SECRET="$TURN_SECRET" +TURN_USER="$TURN_USER" +TURN_PASS="$TURN_PASS" +CURRENT_PUBLIC_IP="$CURRENT_PUBLIC_IP" +PTT_DEVICE="$PTT_DEVICE" +PTT_KEYCODE="$PTT_KEYCODE" +LOCAL_CIDR="$LOCAL_CIDR" +SERVER_LAN_IP="$SERVER_LAN_IP" +EOF + chmod 644 "$CONFIG_FILE" + + if [[ -n "$PTT_DEVICE" ]]; then + cat > "$PTT_CONFIG_FILE" << EOF +PTT_DEVICE="$PTT_DEVICE" +PTT_KEYCODE="$PTT_KEYCODE" +EOF + chmod 644 "$PTT_CONFIG_FILE" + fi +} + +open_firewall_ports() { + print_info "Configuring firewall ports..." + if command -v ufw &>/dev/null; then + if ufw status 2>/dev/null | grep -q "Status: active"; then + ufw allow 5060/udp comment "SIP UDP" 2>/dev/null || true + ufw allow 5061/tcp comment "SIP TLS" 2>/dev/null || true + ufw allow 10000:20000/udp comment "RTP Media" 2>/dev/null || true + if [[ "$USE_COTURN" == "y" ]]; then + ufw allow ${DEFAULT_TURN_PORT}/udp comment "TURN UDP" 2>/dev/null || true + ufw allow ${DEFAULT_TURN_PORT}/tcp comment "TURN TCP" 2>/dev/null || true + ufw allow 49152:65535/udp comment "TURN Relay" 2>/dev/null || true + fi + ufw reload 2>/dev/null || true + print_success "UFW firewall ports opened" + fi + fi +} + +# ================================================================ +# 2. FQDN ACCESS SETUP +# ================================================================ + +setup_fqdn_access() { + print_header "Setup FQDN Access" + + echo "This configures your server for clients connecting via domain name." + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo " WHO NEEDS FQDN ACCESS?" + echo "═══════════════════════════════════════════════════════════════" + echo "" + echo " • Internet clients (remote locations, mobile phones)" + echo " • Cross-VLAN clients (different VLAN using hairpin NAT)" + echo "" + echo " These clients connect through your router's WAN interface," + echo " so they need the same setup: FQDN + port forwarding." + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo "" + + load_config + + read -p "Domain name (e.g., sip.example.com): " domain + if [[ -z "$domain" ]]; then + print_error "Domain name required" + return 1 + fi + DOMAIN_NAME="$domain" + + # Detect IPs + local detected_lan_ip=$(hostname -I | awk '{print $1}') + local detected_public_ip=$(get_public_ip) + + echo "" + echo "Detected IPs:" + echo " LAN IP: ${detected_lan_ip:-not detected}" + echo " Public IP: ${detected_public_ip:-not detected}" + echo "" + + SERVER_LAN_IP="${SERVER_LAN_IP:-$detected_lan_ip}" + CURRENT_PUBLIC_IP="$detected_public_ip" + + # CIDR for NAT + local raw_cidr=$(ip -o -f inet addr show | awk '/scope global/ {print $4}' | head -1) + local default_cidr="$raw_cidr" + if [[ "$raw_cidr" =~ \.([0-9]+)/24$ ]]; then + default_cidr="${raw_cidr%.*}.0/24" + fi + read -p "Local network CIDR [$default_cidr]: " local_net + LOCAL_CIDR="${local_net:-$default_cidr}" + + FQDN_ENABLED="y" + save_config + + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo " CERTIFICATE SETUP" + echo "═══════════════════════════════════════════════════════════════" + echo "" + setup_certificates + + # Regenerate configs + if [[ "$INSTALLED_SERVER" == "y" ]]; then + generate_pjsip_conf + restart_asterisk_safe + fi + + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo " ROUTER PORT FORWARDING REQUIRED" + echo "═══════════════════════════════════════════════════════════════" + echo "" + echo " On your OPNsense router, create these WAN port forwards:" + echo "" + echo " ┌──────────────────┬──────────┬─────────────────────────────┐" + echo " │ WAN Port │ Protocol │ Forward To │" + echo " ├──────────────────┼──────────┼─────────────────────────────┤" + echo " │ 5061 │ TCP │ ${SERVER_LAN_IP}:5061 │" + echo " │ 10000-20000 │ UDP │ ${SERVER_LAN_IP}:10000-20000│" + echo " └──────────────────┴──────────┴─────────────────────────────┘" + echo "" + echo " Path: Firewall → NAT → Port Forward" + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo "" + print_success "FQDN access configured" +} + +setup_certificates() { + echo "Select Certificate Source:" + echo " 1) Auto-Sync from Caddy" + echo " 2) Certbot (requires port 80 open)" + echo " 3) Self-Signed (testing only)" + echo " 4) Manual path" + echo " 0) Skip" + read -p "Select [1]: " cert_opt + cert_opt="${cert_opt:-1}" + + [[ "$cert_opt" == "0" ]] && return + + case "$cert_opt" in + 1) setup_caddy_cert_sync "auto" ;; + 2) + print_info "Installing Certbot..." + apt install -y certbot + certbot certonly --standalone -d "$DOMAIN_NAME" --non-interactive --agree-tos --register-unsafely-without-email + if [[ -f "/etc/letsencrypt/live/$DOMAIN_NAME/fullchain.pem" ]]; then + mkdir -p /etc/asterisk/certs + cat "/etc/letsencrypt/live/$DOMAIN_NAME/fullchain.pem" > /etc/asterisk/certs/server.crt + cat "/etc/letsencrypt/live/$DOMAIN_NAME/privkey.pem" > /etc/asterisk/certs/server.key + chown asterisk:asterisk /etc/asterisk/certs/server.* 2>/dev/null + chmod 644 /etc/asterisk/certs/server.crt + chmod 600 /etc/asterisk/certs/server.key + print_success "Certbot success" + else + print_error "Certbot failed" + fi + ;; + 3) + mkdir -p /etc/asterisk/certs + openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \ + -keyout /etc/asterisk/certs/server.key \ + -out /etc/asterisk/certs/server.crt \ + -subj "/CN=$DOMAIN_NAME" 2>/dev/null + chown asterisk:asterisk /etc/asterisk/certs/server.* 2>/dev/null + chmod 644 /etc/asterisk/certs/server.crt + chmod 600 /etc/asterisk/certs/server.key + print_success "Self-signed certificate generated" + print_warn "Clients must trust this certificate" + ;; + 4) + read -p "Certificate path: " cp + read -p "Private key path: " kp + if [[ -f "$cp" && -f "$kp" ]]; then + mkdir -p /etc/asterisk/certs + cat "$cp" > /etc/asterisk/certs/server.crt + cat "$kp" > /etc/asterisk/certs/server.key + chown asterisk:asterisk /etc/asterisk/certs/server.* 2>/dev/null + chmod 644 /etc/asterisk/certs/server.crt + chmod 600 /etc/asterisk/certs/server.key + print_success "Certificates installed" + else + print_error "Files not found" + fi + ;; + esac +} + +get_public_ip() { + curl -s -4 --connect-timeout 5 ifconfig.me 2>/dev/null || \ + curl -s -4 --connect-timeout 5 icanhazip.com 2>/dev/null || echo "" +} + +# ================================================================ +# 3. COTURN SETUP +# ================================================================ + +install_coturn() { + print_header "Installing COTURN" + apt update + apt install -y coturn + + [[ -z "$TURN_PASS" ]] && TURN_PASS=$(generate_password) + + local public_ip=$(get_public_ip) + CURRENT_PUBLIC_IP="$public_ip" + + if [[ -z "$public_ip" ]]; then + print_error "Could not detect public IP" + return 1 + fi + + print_info "Public IP: $public_ip" + + sed -i 's/#TURNSERVER_ENABLED=1/TURNSERVER_ENABLED=1/' /etc/default/coturn 2>/dev/null || true + + backup_config "$COTURN_CONFIG" + cat > "$COTURN_CONFIG" << EOF +listening-port=${DEFAULT_TURN_PORT} +fingerprint +lt-cred-mech +realm=${TURN_DOMAIN:-${DOMAIN_NAME:-turn.local}} +total-quota=100 +stale-nonce=600 +cert=/etc/asterisk/certs/server.crt +pkey=/etc/asterisk/certs/server.key +no-tlsv1 +no-tlsv1_1 +cipher-list="ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512" +dh2066 +no-stdout-log +log-file=/var/log/turnserver.log +simple-log +external-ip=${public_ip} +min-port=49152 +max-port=65535 +user-quota=12 +no-multicast-peers +no-cli +user=${TURN_USER}:${TURN_PASS} +EOF + + chmod 600 "$COTURN_CONFIG" + + systemctl enable coturn + systemctl restart coturn + + if systemctl is-active coturn >/dev/null; then + print_success "COTURN installed and running" + INSTALLED_COTURN="y" + USE_COTURN="y" + save_config + return 0 + else + print_error "COTURN failed to start" + journalctl -u coturn -n 20 --no-pager + return 1 + fi +} + +configure_coturn_menu() { + print_header "Configure COTURN" + + if [[ "$INSTALLED_COTURN" == "y" ]]; then + echo -e "Status: ${GREEN}Installed${NC}" + echo "User: ${TURN_USER}" + echo "Pass: ${TURN_PASS}" + echo "" + echo " 1) Update Credentials" + echo " 2) Reinstall" + echo " 3) Update IP" + echo " 4) Show config" + echo " 5) Uninstall" + echo " 0) Back" + read -p "Select: " choice + case $choice in + 1) + read -p "Username [${TURN_USER}]: " t_user + TURN_USER="${t_user:-$TURN_USER}" + read -p "Password [generate]: " t_pass + TURN_PASS="${t_pass:-$(generate_password)}" + sed -i '/^user=/d' "$COTURN_CONFIG" + echo "user=${TURN_USER}:${TURN_PASS}" >> "$COTURN_CONFIG" + systemctl restart coturn + save_config + print_success "Credentials updated" + ;; + 2) install_coturn ;; + 3) + local new_ip=$(get_public_ip) + if [[ -n "$new_ip" ]]; then + sed -i "s/^external-ip=.*/external-ip=${new_ip}/" "$COTURN_CONFIG" + systemctl restart coturn + CURRENT_PUBLIC_IP="$new_ip" + save_config + print_success "IP updated to $new_ip" + fi + ;; + 4) + echo "Status: $(systemctl is-active coturn)" + echo "IP: $CURRENT_PUBLIC_IP" + echo "Credentials: ${TURN_USER}:${TURN_PASS}" + ;; + 5) + systemctl stop coturn 2>/dev/null + systemctl disable coturn 2>/dev/null + apt purge -y coturn 2>/dev/null + INSTALLED_COTURN="n" + USE_COTURN="n" + save_config + print_success "COTURN uninstalled" + ;; + esac + else + echo "COTURN is not installed." + read -p "Install now? [Y/n]: " install + [[ ! "$install" =~ ^[Nn]$ ]] && install_coturn + fi +} + +# ================================================================ +# 4. DEVICE MANAGEMENT +# ================================================================ + +initialize_default_categories() { + mkdir -p "$CONFIG_DIR" + if [[ ! -f "$CATEGORIES_FILE" ]]; then + cat > "$CATEGORIES_FILE" << 'EOF' +# Format: id|name|auto_answer(yes/no)|description +kiosk|Kiosks|yes|Fixed auto-answer intercoms +mobile|Mobile Devices|no|Phones and mobile devices +EOF + chmod 600 "$CATEGORIES_FILE" + fi + if [[ ! -f "$ROOMS_FILE" ]]; then + cat > "$ROOMS_FILE" << 'EOF' +# Format: ext|name|members|timeout|type(ring/page) +199|All Kiosks|101,102,103,104,105|60|page +299|All Mobile|201,202,203,204,205|60|ring +EOF + chmod 600 "$ROOMS_FILE" + fi +} + +list_categories() { + initialize_default_categories + local index=1 + while IFS='|' read -r cat_id cat_name auto_answer description; do + [[ "$cat_id" =~ ^# ]] && continue + [[ -z "$cat_id" ]] && continue + local auto_text="${RED}Ring${NC}" + [[ "$auto_answer" == "yes" ]] && auto_text="${GREEN}Auto-answer${NC}" + echo -e " ${CYAN}$index)${NC} ${BOLD}$cat_name${NC} ($cat_id) - $auto_text" + ((index++)) + done < "$CATEGORIES_FILE" +} + +get_category_by_index() { + local target_index=$1 + local index=1 + while IFS='|' read -r cat_id cat_name auto_answer description; do + [[ "$cat_id" =~ ^# ]] && continue + [[ -z "$cat_id" ]] && continue + if [[ $index -eq $target_index ]]; then + echo "$cat_id|$cat_name|$auto_answer" + return 0 + fi + ((index++)) + done < "$CATEGORIES_FILE" +} + +manage_categories() { + print_header "Manage Categories" + list_categories + echo "" + echo " 1) Add Category" + echo " 2) Delete Category" + echo " 0) Back" + read -p "Select: " choice + case $choice in + 1) + read -p "ID (lowercase): " cid + read -p "Display Name: " cname + read -p "Auto Answer? [y/N]: " ca + local ans="no" + [[ "$ca" =~ ^[Yy]$ ]] && ans="yes" + echo "${cid}|${cname}|${ans}|Custom category" >> "$CATEGORIES_FILE" + print_success "Category added" + rebuild_dialplan + ;; + 2) + read -p "Number to delete: " num + local data=$(get_category_by_index "$num") + local cid=$(echo "$data" | cut -d'|' -f1) + [[ -n "$cid" ]] && sed -i "/^${cid}|/d" "$CATEGORIES_FILE" + print_success "Deleted" + rebuild_dialplan + ;; + esac +} + +manage_rooms() { + print_header "Manage Rooms" + initialize_default_categories + echo "Current Rooms:" + local index=1 + while IFS='|' read -r rext rname rmem rtime rtype; do + [[ "$rext" =~ ^# ]] && continue + [[ -z "$rext" ]] && continue + local type_text="Ring Group" + [[ "$rtype" == "page" ]] && type_text="PAGE" + echo -e " ${CYAN}$index)${NC} ${BOLD}$rname${NC} ($rext) - $type_text" + echo " Members: $rmem" + ((index++)) + done < "$ROOMS_FILE" + echo "" + echo " 1) Add Room" + echo " 2) Edit Room" + echo " 3) Delete Room" + echo " 0) Back" + read -p "Select: " choice + case $choice in + 1) + read -p "Extension: " new_ext + read -p "Name: " new_name + echo " 1) Ring Group" + echo " 2) Page/Intercom" + read -p "Type [1]: " type_sel + local rtype="ring" + [[ "$type_sel" == "2" ]] && rtype="page" + read -p "Members (e.g. 101,102): " members + echo "${new_ext}|${new_name}|${members}|60|${rtype}" >> "$ROOMS_FILE" + rebuild_dialplan + print_success "Room created" + ;; + 2) + read -p "Room #: " rnum + local count=0 + while IFS='|' read -r rext rname rmem rtime rtype; do + [[ "$rext" =~ ^# ]] && continue + [[ -z "$rext" ]] && continue + ((count++)) + if [[ $count -eq $rnum ]]; then + echo "Current members: $rmem" + read -p "New members: " new_mem + sed -i "/^${rext}|/d" "$ROOMS_FILE" + echo "${rext}|${rname}|${new_mem}|${rtime}|${rtype}" >> "$ROOMS_FILE" + rebuild_dialplan + print_success "Room updated" + break + fi + done < "$ROOMS_FILE" + ;; + 3) + read -p "Room #: " rnum + local count=0 + while IFS='|' read -r rext rrest; do + [[ "$rext" =~ ^# ]] && continue + [[ -z "$rext" ]] && continue + ((count++)) + if [[ $count -eq $rnum ]]; then + sed -i "/^${rext}|/d" "$ROOMS_FILE" + rebuild_dialplan + print_success "Room deleted" + break + fi + done < "$ROOMS_FILE" + ;; + esac +} + +add_device_menu() { + print_header "Add Device" + load_config + + list_categories + read -p "Category number: " cat_num + local cat_data=$(get_category_by_index "$cat_num") + if [[ -z "$cat_data" ]]; then print_error "Invalid"; return; fi + local cat_id=$(echo "$cat_data" | cut -d'|' -f1) + local cat_name=$(echo "$cat_data" | cut -d'|' -f2) + local auto_answer=$(echo "$cat_data" | cut -d'|' -f3) + + local start_range=101 end_range=199 + case "$cat_id" in + kiosk) start_range=101; end_range=199 ;; + mobile) start_range=201; end_range=299 ;; + *) start_range=301; end_range=399 ;; + esac + + local suggested_ext="" + for ext in $(seq $start_range $end_range); do + if ! grep -q "^\[${ext}\]" /etc/asterisk/pjsip.conf 2>/dev/null; then + suggested_ext=$ext; break + fi + done + + read -p "Extension [$suggested_ext]: " ext + ext="${ext:-$suggested_ext}" + + if grep -q "^\[${ext}\]" /etc/asterisk/pjsip.conf 2>/dev/null; then + print_error "Extension exists!" + return + fi + + read -p "Name: " name + name="${name:-Device $ext}" + local pass=$(generate_password) + + # CONNECTION TYPE SELECTION + local conn_type="lan" + local transport_block="" + local encryption_block="" + local ice_block="" + local display_server="" + local display_port="5060" + local display_transport="UDP" + local display_encryption="None" + + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo -e " HOW WILL THIS DEVICE CONNECT?" + echo "═══════════════════════════════════════════════════════════════" + echo "" + echo -e " 1) ${GREEN}LAN/VPN${NC} - Same network or VPN tunnel (UDP)" + if [[ "$FQDN_ENABLED" == "y" && -n "$DOMAIN_NAME" ]]; then + echo -e " 2) ${CYAN}FQDN${NC} - Internet or cross-VLAN via ${DOMAIN_NAME} (TLS)" + else + echo -e " 2) ${YELLOW}FQDN${NC} - Not configured (run 'Setup FQDN Access' first)" + fi + echo "" + read -p " Select [1]: " conn_choice + conn_choice="${conn_choice:-1}" + + if [[ "$conn_choice" == "1" ]]; then + # LAN/VPN - let user pick which IP + select_server_ip + display_server="$SELECTED_IP" + display_port="5060" + display_transport="UDP" + display_encryption="None" + elif [[ "$conn_choice" == "2" ]]; then + if [[ "$FQDN_ENABLED" != "y" || -z "$DOMAIN_NAME" ]]; then + print_error "FQDN access not configured. Run 'Setup FQDN Access' first." + return + fi + conn_type="fqdn" + transport_block="transport=transport-tls" + encryption_block="media_encryption=sdes" + ice_block="ice_support=yes" + display_server="$DOMAIN_NAME" + display_port="5061" + display_transport="TLS" + display_encryption="SRTP (SDES)" + fi + + # Auto-answer override + local override_tag="" + if [[ "$auto_answer" == "no" ]]; then + read -p "Force AUTO-ANSWER? [y/N]: " force_aa + [[ "$force_aa" =~ ^[Yy]$ ]] && override_tag="[AA:yes]" && auto_answer="yes" + elif [[ "$auto_answer" == "yes" ]]; then + read -p "Force RING? [y/N]: " force_ring + [[ "$force_ring" =~ ^[Yy]$ ]] && override_tag="[AA:no]" && auto_answer="no" + fi + + backup_config "/etc/asterisk/pjsip.conf" + + # Build endpoint config + local endpoint_extras="" + if [[ "$conn_type" == "fqdn" ]]; then + endpoint_extras="${encryption_block} +${transport_block} +${ice_block}" + fi + + cat >> /etc/asterisk/pjsip.conf << EOF + +; === Device: $name ($cat_id) [CONN:${conn_type}] $override_tag === +[${ext}] +type=endpoint +context=intercom +disallow=all +allow=opus +allow=ulaw +allow=alaw +allow=g722 +direct_media=no +rtp_symmetric=yes +force_rport=yes +rewrite_contact=yes +auth=${ext} +aors=${ext} +callerid="${name}" <${ext}> +${endpoint_extras} + +[${ext}] +type=auth +auth_type=userpass +username=${ext} +password=${pass} + +[${ext}] +type=aor +max_contacts=5 +remove_existing=yes +qualify_frequency=60 +EOF + + chown -R asterisk:asterisk /etc/asterisk + asterisk -rx "pjsip reload" >/dev/null 2>&1 + rebuild_dialplan + + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo " DEVICE ADDED" + echo "═══════════════════════════════════════════════════════════════" + echo "" + echo " ${BOLD}Client Configuration:${NC}" + echo " Server: ${display_server}" + echo " Port: ${display_port}" + echo " Transport: ${display_transport}" + echo " Extension: ${ext}" + echo " Password: ${pass}" + echo " Encryption: ${display_encryption}" + echo "" + echo "═══════════════════════════════════════════════════════════════" +} + +remove_device() { + print_header "Remove Device" + declare -A REMOVE_MAP + local count=1 + echo "Select device to remove:" + echo "" + local dev_name="" + while IFS= read -r line; do + if [[ "$line" == *"; === Device:"* ]]; then + local temp="${line#*; === Device: }" + temp="${temp% ===}" + temp=$(echo "$temp" | sed 's/ \[CONN:[^]]*\]//' | sed 's/ \[AA:[^]]*\]//') + dev_name="${temp% (*)}" + fi + if [[ "$line" =~ ^\[([0-9]+)\] ]]; then + local ext="${BASH_REMATCH[1]}" + if [[ -n "$dev_name" ]]; then + echo " ${count}) Ext ${ext} - ${dev_name}" + REMOVE_MAP[$count]=$ext + ((count++)) + dev_name="" + fi + fi + done < /etc/asterisk/pjsip.conf + echo "" + echo " 98) DELETE ALL" + echo " 0) Cancel" + echo "" + read -p "Select: " choice + + if [[ "$choice" == "98" ]]; then + read -p "Type 'DELETE ALL' to confirm: " confirm + if [[ "$confirm" == "DELETE ALL" ]]; then + backup_config "/etc/asterisk/pjsip.conf" + sed -i '/^; === Device:/,/^$/d' /etc/asterisk/pjsip.conf + sed -i '/^\[[0-9]\{3\}\]/,/^$/d' /etc/asterisk/pjsip.conf + asterisk -rx "pjsip reload" 2>/dev/null + rebuild_dialplan + print_success "All devices deleted" + fi + return + fi + + [[ "$choice" == "0" || -z "${REMOVE_MAP[$choice]}" ]] && return + + local ext="${REMOVE_MAP[$choice]}" + read -p "Remove $ext? [y/N]: " confirm + if [[ "$confirm" =~ ^[Yy]$ ]]; then + backup_config "/etc/asterisk/pjsip.conf" + sed -i "/^; === Device:.*${ext}.*/,/^$/d" /etc/asterisk/pjsip.conf + sed -i "/^\[${ext}\]/,/^$/d" /etc/asterisk/pjsip.conf + asterisk -rx "pjsip reload" 2>/dev/null + rebuild_dialplan + print_success "Removed" + fi +} + +show_registered_devices() { + print_header "Device Status" + load_config + + printf "${CYAN}%-6s %-18s %-10s %-8s %-10s %-12s${NC}\n" "Ext" "Name" "Category" "Type" "Status" "Password" + echo "────────────────────────────────────────────────────────────────────────────" + local dev_name="" dev_cat="" dev_conn="" + while IFS= read -r line; do + if [[ "$line" == *"; === Device:"* ]]; then + local temp="${line#*; === Device: }" + temp="${temp% ===}" + # Extract connection type + if [[ "$temp" == *"[CONN:fqdn]"* ]]; then + dev_conn="FQDN" + else + dev_conn="LAN" + fi + temp=$(echo "$temp" | sed 's/ \[CONN:[^]]*\]//' | sed 's/ \[AA:[^]]*\]//') + dev_cat="${temp##* (}"; dev_cat="${dev_cat%)}" + dev_name="${temp% (*)}" + fi + if [[ "$line" =~ ^\[([0-9]+)\] ]]; then + local ext="${BASH_REMATCH[1]}" + if [[ -n "$dev_name" ]]; then + local status="Offline" + local status_color="${RED}" + local avail=$(asterisk -rx "pjsip show endpoint ${ext}" 2>/dev/null | grep -E "Contact:.*(Avail|NonQual)" || true) + if [[ -n "$avail" ]]; then + status="Online" + status_color="${GREEN}" + fi + local password=$(grep -A 10 "^\[$ext\]" /etc/asterisk/pjsip.conf | grep "password=" | head -1 | cut -d= -f2) + local conn_color="${GREEN}" + [[ "$dev_conn" == "FQDN" ]] && conn_color="${CYAN}" + printf "%-6s %-18s %-10s ${conn_color}%-8s${NC} ${status_color}%-10s${NC} %-12s\n" "$ext" "${dev_name:0:16}" "$dev_cat" "$dev_conn" "$status" "$password" + dev_name="" + fi + fi + done < /etc/asterisk/pjsip.conf + echo "" + echo "Connection Info:" + echo " LAN/VPN: Use server IP + port 5060 (UDP)" + if [[ "$FQDN_ENABLED" == "y" && -n "$DOMAIN_NAME" ]]; then + echo " FQDN: ${DOMAIN_NAME}:5061 (TLS)" + fi +} + +# ================================================================ +# 5. PTT HANDLER +# ================================================================ + +configure_ptt_menu() { + print_header "Configure PTT Button" + + if ! command -v evtest &>/dev/null; then + apt install -y evtest >/dev/null 2>&1 + fi + + [[ -n "$KIOSK_USER" ]] && usermod -aG input "$KIOSK_USER" 2>/dev/null || true + + print_info "Scanning input devices..." + echo "" + + declare -a SUGGESTED_DEVICES SUGGESTED_NAMES OTHER_DEVICES OTHER_NAMES + + for dev in /dev/input/event*; do + [[ -e "$dev" ]] || continue + local name=$(cat "/sys/class/input/$(basename $dev)/device/name" 2>/dev/null || echo "Unknown") + local lname=$(echo "$name" | tr '[:upper:]' '[:lower:]') + + # Skip system devices + if [[ "$lname" =~ (power.button|sleep.button|lid.switch|virtual|video.bus|hdmi|dp,pcm|hotkey|touchpad|touchscreen) ]]; then + continue + # Prioritize keyboards, USB HID devices, pedals + elif [[ "$lname" =~ (keyboard|sayo.*nano$|pedal|foot|^hid|usb) ]]; then + SUGGESTED_DEVICES+=("$dev") + SUGGESTED_NAMES+=("$name") + else + OTHER_DEVICES+=("$dev") + OTHER_NAMES+=("$name") + fi + done + + # Display suggested devices first + if [[ ${#SUGGESTED_DEVICES[@]} -gt 0 ]]; then + echo -e "${GREEN}Recommended (keyboards/USB buttons):${NC}" + for i in "${!SUGGESTED_DEVICES[@]}"; do + printf " ${CYAN}%2d)${NC} %s - %s\n" "$((i+1))" "$(basename ${SUGGESTED_DEVICES[$i]})" "${SUGGESTED_NAMES[$i]}" + done + echo "" + fi + + # Display other devices + if [[ ${#OTHER_DEVICES[@]} -gt 0 ]]; then + echo -e "${YELLOW}Other devices:${NC}" + local offset=${#SUGGESTED_DEVICES[@]} + for i in "${!OTHER_DEVICES[@]}"; do + printf " ${CYAN}%2d)${NC} %s - %s\n" "$((offset+i+1))" "$(basename ${OTHER_DEVICES[$i]})" "${OTHER_NAMES[$i]}" + done + echo "" + fi + + local ALL_DEVICES=("${SUGGESTED_DEVICES[@]}" "${OTHER_DEVICES[@]}") + local ALL_NAMES=("${SUGGESTED_NAMES[@]}" "${OTHER_NAMES[@]}") + local total=${#ALL_DEVICES[@]} + + if [[ $total -eq 0 ]]; then + print_error "No input devices found" + return 1 + fi + + echo " 0) Back" + echo "" + read -p "Select device [1]: " selection + selection="${selection:-1}" + + [[ "$selection" == "0" ]] && return 0 + [[ "$selection" -lt 1 || "$selection" -gt "$total" ]] && { print_error "Invalid selection"; return 1; } + + PTT_DEVICE="${ALL_DEVICES[$((selection-1))]}" + local dev_name="${ALL_NAMES[$((selection-1))]}" + echo "" + print_success "Selected: $dev_name" + echo " ($PTT_DEVICE)" + echo "" + + # Key detection loop + while true; do + echo -e "${YELLOW}═══════════════════════════════════════════════════${NC}" + echo -e "${YELLOW} DO NOT PRESS YET - wait for countdown${NC}" + echo -e "${YELLOW}═══════════════════════════════════════════════════${NC}" + + for i in 5 4 3 2 1; do + echo -ne "\r Waiting... $i " + sleep 1 + done + echo "" + echo "" + echo -e "${GREEN}>>> NOW PRESS YOUR PTT BUTTON <<<${NC}" + echo "" + + local detected_code=$(timeout 10 evtest "$PTT_DEVICE" 2>/dev/null | grep -m1 "value 1$" | grep -oP 'code \K[0-9]+' || echo "") + + if [[ -n "$detected_code" && "$detected_code" -gt 0 ]]; then + # Map common key codes to friendly names + local key_name="Key $detected_code" + case "$detected_code" in + 1) key_name="Escape" ;; + 28) key_name="Enter" ;; + 57) key_name="Spacebar" ;; + 69) key_name="Num Lock" ;; + 113) key_name="Mute" ;; + 114) key_name="Volume Down" ;; + 115) key_name="Volume Up" ;; + 116) key_name="Power" ;; + 142) key_name="Sleep" ;; + 272) key_name="Left Click" ;; + 273) key_name="Right Click" ;; + esac + + print_success "Detected: $key_name (code $detected_code)" + echo "" + read -p "Use this key? [Y/n]: " use_key + + if [[ ! "$use_key" =~ ^[Nn]$ ]]; then + PTT_KEYCODE="$detected_code" + PTT_KEYNAME="$key_name" + break + fi + else + print_warn "No button press detected" + fi + + echo "" + echo " 1) Try again" + echo " 2) Enter key code manually" + echo " 3) Cancel" + read -p "Select [1]: " retry + + case "${retry:-1}" in + 2) + read -p "Enter key code: " PTT_KEYCODE + PTT_KEYNAME="Manual" + break + ;; + 3) + return 1 + ;; + esac + done + + # Ensure input group + if [[ -n "$KIOSK_USER" ]]; then + if ! id -nG "$KIOSK_USER" | grep -qw "input"; then + print_info "Adding $KIOSK_USER to input group..." + usermod -aG input "$KIOSK_USER" + echo "" + print_warn "User added to 'input' group - LOG OUT AND BACK IN for PTT to work!" + read -p "Press Enter to acknowledge..." + fi + fi + + save_config + + print_success "PTT configured: $PTT_KEYNAME on $(basename $PTT_DEVICE)" + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo " PTT Configuration Complete" + echo "═══════════════════════════════════════════════════════════════" + echo " Device: $PTT_DEVICE" + echo " Button: $PTT_KEYNAME (code $PTT_KEYCODE)" + echo " User: ${KIOSK_USER:-not set}" + echo "" + echo " To test: journalctl -t kiosk-ptt -f" + echo "═══════════════════════════════════════════════════════════════" + + # Restart PTT service + if [[ "$INSTALLED_CLIENT" == "y" && -n "$KIOSK_USER" && -n "$KIOSK_UID" ]]; then + local user_dbus="XDG_RUNTIME_DIR=/run/user/${KIOSK_UID}" + print_info "Restarting PTT service..." + sudo -u "$KIOSK_USER" $user_dbus systemctl --user daemon-reload 2>/dev/null + sudo -u "$KIOSK_USER" $user_dbus systemctl --user enable kiosk-ptt 2>/dev/null + sudo -u "$KIOSK_USER" $user_dbus systemctl --user restart kiosk-ptt 2>/dev/null || true + sleep 2 + journalctl -t kiosk-ptt -n 3 --no-pager 2>/dev/null || true + fi + + return 0 +} + +create_ptt_handler() { + cat > /usr/local/bin/kiosk-ptt << 'PTTSCRIPT' +#!/bin/bash +CONFIG="/etc/easy-asterisk/config" +PTT_CONFIG="/etc/easy-asterisk/ptt-device" +[[ -f "$CONFIG" ]] && source "$CONFIG" +[[ -f "$PTT_CONFIG" ]] && source "$PTT_CONFIG" + +[[ -z "$PTT_DEVICE" ]] && exit 0 + +[[ -z "$XDG_RUNTIME_DIR" ]] && export XDG_RUNTIME_DIR="/run/user/${KIOSK_UID:-$(id -u)}" + +# Wait for audio +for i in {1..30}; do + pactl info >/dev/null 2>&1 && pactl list sources short | grep -q . && break + sleep 1 +done + +# Mute on start +pactl set-source-mute @DEFAULT_SOURCE@ 1 2>/dev/null +logger -t kiosk-ptt "PTT started, mic muted" + +evtest --grab "$PTT_DEVICE" 2>/dev/null | while read -r line; do + if [[ "$line" =~ "value 1" ]]; then + pactl set-source-mute @DEFAULT_SOURCE@ 0 2>/dev/null + logger -t kiosk-ptt "PTT pressed - unmuted" + fi + if [[ "$line" =~ "value 0" ]]; then + pactl set-source-mute @DEFAULT_SOURCE@ 1 2>/dev/null + logger -t kiosk-ptt "PTT released - muted" + fi +done +PTTSCRIPT + chmod +x /usr/local/bin/kiosk-ptt +} + +# ================================================================ +# 6. AUDIO HELPERS +# ================================================================ + +configure_audio_ducking() { + [[ -z "$KIOSK_USER" ]] && return + local wp_dir="/home/${KIOSK_USER}/.config/wireplumber/wireplumber.conf.d" + mkdir -p "$wp_dir" + cat > "${wp_dir}/50-intercom-ducking.conf" << 'EOF' +wireplumber.settings = { linking.allow-moving-streams = true } +EOF + chown -R ${KIOSK_USER}:${KIOSK_USER} "/home/${KIOSK_USER}/.config" +} + +ensure_audio_unmuted() { + [[ -z "$KIOSK_USER" || -z "$KIOSK_UID" ]] && return + [[ -f /etc/easy-asterisk/ptt-device ]] && return # PTT manages muting + + local user_dbus="XDG_RUNTIME_DIR=/run/user/${KIOSK_UID}" + sleep 2 + sudo -u "$KIOSK_USER" $user_dbus pactl set-source-mute @DEFAULT_SOURCE@ 0 2>/dev/null || true + sudo -u "$KIOSK_USER" $user_dbus pactl set-sink-mute @DEFAULT_SINK@ 0 2>/dev/null || true +} + +fix_audio_manually() { + print_header "Fix Audio" + load_config + local t_user="${KIOSK_USER:-$SUDO_USER}" + local t_uid=$(id -u "$t_user" 2>/dev/null) + local user_dbus="XDG_RUNTIME_DIR=/run/user/$t_uid" + + echo "Fixing audio for: $t_user" + sudo -u "$t_user" $user_dbus systemctl --user restart pipewire pipewire-pulse 2>/dev/null || true + sleep 2 + sudo -u "$t_user" $user_dbus pactl set-source-mute @DEFAULT_SOURCE@ 0 2>/dev/null + sudo -u "$t_user" $user_dbus pactl set-sink-mute @DEFAULT_SINK@ 0 2>/dev/null + sudo -u "$t_user" $user_dbus pactl set-source-volume @DEFAULT_SOURCE@ 75% 2>/dev/null + sudo -u "$t_user" $user_dbus pactl set-sink-volume @DEFAULT_SINK@ 75% 2>/dev/null + sudo -u "$t_user" $user_dbus systemctl --user restart baresip 2>/dev/null + print_success "Audio fixed" +} + +# ================================================================ +# 7. DIAGNOSTICS +# ================================================================ + +show_port_requirements() { + print_header "Port Requirements" + echo "═══════════════════════════════════════════════════════════════" + echo " LAN/VPN CLIENTS - No port forwarding needed" + echo "═══════════════════════════════════════════════════════════════" + echo " │ 5060/UDP │ SIP Signaling │" + echo " │ 10000-20000/UDP│ RTP Audio │" + echo "" + echo "═══════════════════════════════════════════════════════════════" + echo " FQDN CLIENTS - Forward these on WAN" + echo "═══════════════════════════════════════════════════════════════" + echo " │ 5061/TCP │ SIP-TLS Signaling │" + echo " │ 10000-20000/UDP│ RTP Audio │" + echo "" +} + +test_sip_connectivity() { + print_header "SIP Test" + if systemctl is-active asterisk >/dev/null; then + print_success "Asterisk running" + else + print_error "Asterisk stopped" + fi + echo "" + echo "Listening:" + ss -ulnp | grep 5060 || echo " 5060/UDP: Not listening" + ss -tlnp | grep 5061 || echo " 5061/TCP: Not listening" +} + +run_client_diagnostics() { + print_header "Client Diagnostics" + load_config + local t_user="${KIOSK_USER:-$SUDO_USER}" + local t_uid=$(id -u "$t_user" 2>/dev/null) + local user_dbus="XDG_RUNTIME_DIR=/run/user/$t_uid" + + echo "User: $t_user" + echo "" + + echo "Services:" + sudo -u "$t_user" $user_dbus systemctl --user is-active baresip >/dev/null 2>&1 && print_success "Baresip running" || print_error "Baresip stopped" + sudo -u "$t_user" $user_dbus systemctl --user is-active pipewire >/dev/null 2>&1 && print_success "PipeWire running" || print_error "PipeWire stopped" + + echo "" + echo "Audio:" + local src_mute=$(sudo -u "$t_user" $user_dbus pactl get-source-mute @DEFAULT_SOURCE@ 2>/dev/null | awk '{print $2}') + echo " Microphone muted: ${src_mute:-unknown}" + + echo "" + echo "Account:" + cat "/home/$t_user/.baresip/accounts" 2>/dev/null | sed 's/auth_pass=[^;]*/auth_pass=***/' || echo " Not found" +} + +# ================================================================ +# 8. ASTERISK CONFIG +# ================================================================ + +fix_asterisk_systemd() { + mkdir -p /etc/systemd/system/asterisk.service.d/ + cat > /etc/systemd/system/asterisk.service.d/override.conf << 'EOF' +[Unit] +After=network-online.target +Wants=network-online.target + +[Service] +ExecStart= +ExecStart=/usr/sbin/asterisk -f -U asterisk -G asterisk +Restart=always +RestartSec=10 +EOF + systemctl daemon-reload +} + +repair_core_configs() { + mkdir -p /etc/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk /var/run/asterisk + + if [[ -d "/usr/lib/x86_64-linux-gnu/asterisk/modules" ]]; then + mkdir -p /usr/lib/asterisk/modules + cp -rn /usr/lib/x86_64-linux-gnu/asterisk/modules/* /usr/lib/asterisk/modules/ 2>/dev/null || true + fi + + cat > /etc/asterisk/asterisk.conf << EOF +[directories] +astetcdir => /etc/asterisk +astmoddir => /usr/lib/asterisk/modules +astvarlibdir => /var/lib/asterisk +astdbdir => /var/lib/asterisk +astkeydir => /var/lib/asterisk +astdatadir => /var/lib/asterisk +astagidir => /var/lib/asterisk/agi-bin +astspooldir => /var/spool/asterisk +astrundir => /var/run/asterisk +astlogdir => /var/log/asterisk +EOF + + cat > /etc/asterisk/modules.conf << EOF +[modules] +autoload=yes +noload => chan_sip.so +noload => chan_iax2.so +load => res_pjsip.so +load => res_pjsip_session.so +load => chan_pjsip.so +load => codec_ulaw.so +load => codec_alaw.so +load => codec_g722.so +load => codec_opus.so +load => res_rtp_asterisk.so +load => app_dial.so +load => app_page.so +load => pbx_config.so +EOF + + for conf in stasis ari http manager geolocation; do + echo -e "[general]\nenabled = no" > "/etc/asterisk/${conf}.conf" + done + + load_config + local ice_config="# ICE disabled - LAN only" + if [[ "$FQDN_ENABLED" == "y" ]]; then + ice_config="icesupport=yes +stunaddr=stun.l.google.com:19302" + fi + + cat > /etc/asterisk/rtp.conf << EOF +[general] +rtpstart=10000 +rtpend=20000 +strictrtp=yes +${ice_config} +EOF + + cat > /etc/asterisk/logger.conf << EOF +[general] +[logfiles] +console => notice,warning,error +EOF + + chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk 2>/dev/null || true +} + +generate_pjsip_conf() { + print_info "Generating PJSIP config..." + load_config + local conf_file="/etc/asterisk/pjsip.conf" + backup_config "$conf_file" + + # NAT settings only for FQDN mode + local nat_settings="" + if [[ "$FQDN_ENABLED" == "y" && -n "$CURRENT_PUBLIC_IP" ]]; then + local local_net="${LOCAL_CIDR:-$(ip -o -f inet addr show | awk '/scope global/ {print $4}' | head -1)}" + nat_settings="external_media_address=$CURRENT_PUBLIC_IP +external_signaling_address=$CURRENT_PUBLIC_IP +local_net=$local_net" + fi + + cat > "$conf_file" << EOF +; Easy Asterisk v${SCRIPT_VERSION} +[global] +type=global +user_agent=EasyAsterisk + +[transport-udp] +type=transport +protocol=udp +bind=0.0.0.0:${DEFAULT_SIP_PORT} +${nat_settings} + +[transport-tls] +type=transport +protocol=tls +bind=0.0.0.0:${DEFAULT_SIPS_PORT} +cert_file=/etc/asterisk/certs/server.crt +priv_key_file=/etc/asterisk/certs/server.key +ca_list_file=/etc/ssl/certs/ca-certificates.crt +method=tlsv1_2 +${nat_settings} + +EOF + + # Restore devices from backup + local backup_file=$(ls -t "${conf_file}.backup-"* 2>/dev/null | head -1) + if [[ -f "$backup_file" ]]; then + awk '/^; === Device:/{flag=1} flag' "$backup_file" >> "$conf_file" + fi + chown asterisk:asterisk "$conf_file" +} + +rebuild_dialplan() { + local conf_file="/etc/asterisk/extensions.conf" + backup_config "$conf_file" + + cat > "$conf_file" << EOF +[general] +static=yes +writeprotect=no +[default] +exten => _X.,1,Hangup() +[intercom] +EOF + + local dev_name="" dev_auto="" + while IFS= read -r line; do + if [[ "$line" == *"; === Device:"* ]]; then + local temp="${line#*; === Device: }" + temp="${temp% ===}" + local aa_override="" + [[ "$temp" == *"[AA:yes]"* ]] && aa_override="yes" + [[ "$temp" == *"[AA:no]"* ]] && aa_override="no" + temp=$(echo "$temp" | sed 's/ \[CONN:[^]]*\]//' | sed 's/ \[AA:[^]]*\]//') + local dev_cat="${temp##* (}"; dev_cat="${dev_cat%)}" + dev_name="${temp% (*)}" + dev_auto="no" + local cat_data=$(grep "^${dev_cat}|" "$CATEGORIES_FILE" 2>/dev/null || true) + [[ -n "$cat_data" && "$(echo "$cat_data" | cut -d'|' -f3)" == "yes" ]] && dev_auto="yes" + [[ "$aa_override" == "yes" ]] && dev_auto="yes" + [[ "$aa_override" == "no" ]] && dev_auto="no" + fi + if [[ "$line" =~ ^\[([0-9]+)\] && -n "$dev_name" ]]; then + local ext="${BASH_REMATCH[1]}" + if [[ "$dev_auto" == "yes" ]]; then + cat >> "$conf_file" << EOF +exten => ${ext},1,NoOp(Auto-Answer ${ext}) + same => n,Set(PJSIP_HEADER(add,Call-Info)=\;answer-after=0) + same => n,Set(PJSIP_HEADER(add,Alert-Info)=auto-answer) + same => n,Dial(PJSIP/${ext},60) + same => n,Hangup() + +EOF + else + cat >> "$conf_file" << EOF +exten => ${ext},1,NoOp(Call ${ext}) + same => n,Dial(PJSIP/${ext},60) + same => n,Hangup() + +EOF + fi + dev_name="" + fi + done < /etc/asterisk/pjsip.conf + + # Add rooms + if [[ -f "$ROOMS_FILE" ]]; then + while IFS='|' read -r rext rname rmem rtime rtype; do + [[ "$rext" =~ ^# || -z "$rext" ]] && continue + local dial_list="" + IFS=',' read -ra EXTS <<< "$rmem" + for e in "${EXTS[@]}"; do + e=$(echo "$e" | tr -d ' ') + [[ -n "$dial_list" ]] && dial_list="${dial_list}&" + dial_list="${dial_list}PJSIP/${e}" + done + if [[ "$rtype" == "page" ]]; then + cat >> "$conf_file" << EOF +exten => ${rext},1,NoOp(Page ${rname}) + same => n,Set(PJSIP_HEADER(add,Call-Info)=\;answer-after=0) + same => n,Page(${dial_list},i,${rtime}) + same => n,Hangup() + +EOF + else + cat >> "$conf_file" << EOF +exten => ${rext},1,NoOp(Ring ${rname}) + same => n,Dial(${dial_list},${rtime}) + same => n,Hangup() + +EOF + fi + done < "$ROOMS_FILE" + fi + + chown -R asterisk:asterisk /etc/asterisk + asterisk -rx "dialplan reload" &>/dev/null || true +} + +configure_asterisk() { + id asterisk >/dev/null 2>&1 || useradd -r -s /bin/false -d /var/lib/asterisk asterisk 2>/dev/null + + fix_asterisk_systemd + initialize_default_categories + repair_core_configs + + # Create default cert if none exists + mkdir -p /etc/asterisk/certs + if [[ ! -f /etc/asterisk/certs/server.crt ]]; then + openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \ + -keyout /etc/asterisk/certs/server.key \ + -out /etc/asterisk/certs/server.crt \ + -subj "/CN=asterisk-local" 2>/dev/null + chown asterisk:asterisk /etc/asterisk/certs/server.* + chmod 644 /etc/asterisk/certs/server.crt + chmod 600 /etc/asterisk/certs/server.key + fi + + generate_pjsip_conf + rebuild_dialplan + restart_asterisk_safe + systemctl enable asterisk +} + +restart_asterisk_safe() { + print_info "Restarting Asterisk..." + systemctl stop asterisk 2>/dev/null || true + sleep 2 + pkill -9 -x asterisk 2>/dev/null || true + rm -f /var/run/asterisk/asterisk.pid 2>/dev/null + systemctl start asterisk + sleep 3 + + if systemctl is-active asterisk >/dev/null; then + print_success "Asterisk running" + else + print_error "Asterisk failed" + journalctl -u asterisk -n 10 --no-pager + fi +} + +# ================================================================ +# 9. CLIENT CONFIG +# ================================================================ + +configure_baresip() { + local baresip_dir="/home/${KIOSK_USER}/.baresip" + mkdir -p "$baresip_dir" + + local found_iface="" + for target in 8.8.8.8 1.1.1.1; do + found_iface=$(ip route get "$target" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev") print $(i+1)}' | head -1) + [[ -n "$found_iface" ]] && break + done + + cat > "${baresip_dir}/config" << EOF +poll_method epoll +audio_player pulse +audio_source pulse +audio_alert pulse +sip_autoanswer yes +sip_cafile /etc/ssl/certs/ca-certificates.crt +rtp_timeout 0 +net_af ipv4 +module_path /usr/lib/baresip/modules +module srtp.so +module stdio.so +module pulse.so +module g711.so +module opus.so +module account.so +module stun.so +module ice.so +module turn.so +EOF + + [[ -n "$found_iface" ]] && echo "net_interface $found_iface" >> "${baresip_dir}/config" + + local transport="udp" + local mediaenc="" + # Check if connecting to FQDN (contains letters) + if [[ "$ASTERISK_HOST" =~ [a-zA-Z] ]]; then + transport="tls" + mediaenc=";mediaenc=srtp" + fi + + local amode="${CLIENT_ANSWERMODE:-auto}" + + cat > "${baresip_dir}/accounts" << EOF +;auth_pass=${SIP_PASSWORD};answermode=${amode}${mediaenc} +EOF + chown -R ${KIOSK_USER}:${KIOSK_USER} "$baresip_dir" + chmod 700 "$baresip_dir" + + configure_audio_ducking + create_ptt_handler + create_baresip_launcher +} + +create_baresip_launcher() { + cat > /usr/local/bin/easy-asterisk-launcher << LAUNCHER +#!/bin/bash +logger -t baresip-launcher "Starting" +for i in {1..6}; do + IFACE=\$(ip route get 8.8.8.8 2>/dev/null | awk '{for(i=1;i<=NF;i++) if(\$i=="dev") print \$(i+1)}' | head -1) + [[ -n "\$IFACE" ]] && break + sleep 5 +done +exec /usr/bin/baresip -f "/home/${KIOSK_USER}/.baresip" +LAUNCHER + chmod +x /usr/local/bin/easy-asterisk-launcher +} + +enable_client_services() { + local systemd_dir="/home/${KIOSK_USER}/.config/systemd/user" + mkdir -p "$systemd_dir" + + usermod -aG audio "$KIOSK_USER" 2>/dev/null || true + usermod -aG input "$KIOSK_USER" 2>/dev/null || true + + cat > "${systemd_dir}/baresip.service" << EOF +[Unit] +Description=Baresip SIP Client +After=pipewire-pulse.service +Requires=pipewire-pulse.service + +[Service] +ExecStartPre=/bin/sleep 5 +ExecStart=/usr/local/bin/easy-asterisk-launcher +Restart=always +RestartSec=10 +Environment=XDG_RUNTIME_DIR=/run/user/${KIOSK_UID} +Environment=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${KIOSK_UID}/bus + +[Install] +WantedBy=default.target +EOF + + cat > "${systemd_dir}/kiosk-ptt.service" << EOF +[Unit] +Description=PTT Handler +After=baresip.service +ConditionPathExists=/etc/easy-asterisk/ptt-device + +[Service] +ExecStartPre=/bin/sleep 8 +ExecStart=/usr/local/bin/kiosk-ptt +Restart=always +RestartSec=10 +Environment=XDG_RUNTIME_DIR=/run/user/${KIOSK_UID} +Environment=KIOSK_UID=${KIOSK_UID} + +[Install] +WantedBy=default.target +EOF + + chown -R ${KIOSK_USER}:${KIOSK_USER} "/home/${KIOSK_USER}/.config" + + loginctl enable-linger $KIOSK_USER 2>/dev/null || true + local user_dbus="XDG_RUNTIME_DIR=/run/user/${KIOSK_UID}" + + sudo -u "$KIOSK_USER" $user_dbus systemctl --user daemon-reload + sudo -u "$KIOSK_USER" $user_dbus systemctl --user enable pipewire pipewire-pulse baresip 2>/dev/null || true + sudo -u "$KIOSK_USER" $user_dbus systemctl --user restart pipewire pipewire-pulse 2>/dev/null || true + sleep 2 + sudo -u "$KIOSK_USER" $user_dbus systemctl --user restart baresip 2>/dev/null || true + + [[ -f /etc/easy-asterisk/ptt-device ]] && sudo -u "$KIOSK_USER" $user_dbus systemctl --user enable kiosk-ptt 2>/dev/null + + ensure_audio_unmuted +} + +configure_local_client() { + print_header "Configure Local Client" + load_config + + if [[ -n "$KIOSK_USER" ]]; then + echo "Current user: $KIOSK_USER" + read -p "Change? [y/N]: " change + [[ "$change" =~ ^[Yy]$ ]] && KIOSK_USER="" && KIOSK_UID="" + fi + + if [[ -z "$KIOSK_USER" ]]; then + select_user || return 1 + else + KIOSK_UID=$(id -u "$KIOSK_USER" 2>/dev/null) + fi + + if [[ ! -d "/home/${KIOSK_USER}/.baresip" ]]; then + read -p "Baresip not installed. Install now? [Y/n]: " install_it + if [[ ! "$install_it" =~ ^[Nn]$ ]]; then + install_baresip_packages + INSTALLED_CLIENT="y" + else + return + fi + fi + + echo "" + echo " How will this client connect?" + echo " 1) LAN/VPN (via IP)" + echo " 2) FQDN (via domain)" + read -p " Select [1]: " conn_type + + local server="" + if [[ "$conn_type" == "2" ]]; then + read -p " Domain: " server + else + read -p " Server IP (LAN or VPN IP of server): " server + fi + + read -p "Extension: " ext + read -p "Password: " pass + + echo "Answer mode: 1) Manual 2) Auto" + read -p "Select [2]: " amode + local answermode="auto" + [[ "$amode" == "1" ]] && answermode="manual" + + ASTERISK_HOST="$server" + KIOSK_EXTENSION="$ext" + SIP_PASSWORD="$pass" + CLIENT_ANSWERMODE="$answermode" + + configure_baresip + enable_client_services + save_config + + print_success "Client configured" +} + +# ================================================================ +# 10. CERTIFICATE SYNC +# ================================================================ + +check_cert_coverage() { + local cert_file=$1 target_domain=$2 base_domain=$3 + [[ ! -f "$cert_file" ]] && return 1 + local sans=$(openssl x509 -in "$cert_file" -text -noout 2>/dev/null | grep -A1 "Subject Alternative Name" | tail -1) + echo "$sans" | grep -q "DNS:${target_domain}" && return 0 + echo "$sans" | grep -q "DNS:\*.${base_domain}" && return 0 + return 1 +} + +setup_caddy_cert_sync() { + local mode=$1 + load_config + local domain=${DOMAIN_NAME:-sip.example.com} + + if [[ "$mode" == "force" ]]; then + print_header "Caddy Cert Sync" + read -p "Domain [$domain]: " input_domain + domain="${input_domain:-$domain}" + fi + + local actual_user="${SUDO_USER:-$USER}" + local actual_home=$(eval echo ~"$actual_user") + local base_domain=$(echo "$domain" | awk -F. '{print $(NF-1)"."$NF}') + + local search_paths=( + "${actual_home}/docker/caddy/ssl" + "${actual_home}/docker/caddy/caddy_data" + "${actual_home}/docker/caddy/caddy_data/caddy/certificates/acme-v02.api.letsencrypt.org-directory" + "/var/lib/caddy" + "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory" + ) + local caddy_cert="" caddy_key="" + + for base_path in "${search_paths[@]}"; do + sudo test -d "$base_path" 2>/dev/null || continue + + local candidates=$(sudo find "$base_path" -maxdepth 5 -type f \( -name "fullchain.pem" -o -name "*.crt" \) 2>/dev/null) + + for cert in $candidates; do + sudo cp "$cert" /tmp/cert_check.pem 2>/dev/null || continue + if check_cert_coverage "/tmp/cert_check.pem" "$domain" "$base_domain"; then + caddy_cert="$cert" + local dir=$(dirname "$cert") + local name=$(basename "$cert") + [[ "$name" == "fullchain.pem" ]] && caddy_key="${dir}/privkey.pem" || caddy_key=$(echo "$cert" | sed 's/\.crt/\.key/') + sudo test -f "$caddy_key" && rm -f /tmp/cert_check.pem && break 2 + fi + rm -f /tmp/cert_check.pem + done + done + + if [[ -n "$caddy_cert" && -n "$caddy_key" ]]; then + mkdir -p /etc/asterisk/certs + sudo cat "$caddy_cert" > /etc/asterisk/certs/server.crt + sudo cat "$caddy_key" > /etc/asterisk/certs/server.key + chown asterisk:asterisk /etc/asterisk/certs/server.* + chmod 644 /etc/asterisk/certs/server.crt + chmod 600 /etc/asterisk/certs/server.key + + DOMAIN_NAME="$domain" + FQDN_ENABLED="y" + save_config + + [[ "$INSTALLED_SERVER" == "y" ]] && generate_pjsip_conf && restart_asterisk_safe + + print_success "Certificates installed for $domain" + return 0 + else + [[ "$mode" == "force" ]] && print_warn "No matching certificates found" + return 1 + fi +} + +# ================================================================ +# 11. INSTALLATION +# ================================================================ + +install_full() { + print_header "Full Installation" + + local default_user="${SUDO_USER:-$USER}" + read -p "Client User [$default_user]: " target_user + KIOSK_USER="${target_user:-$default_user}" + KIOSK_UID=$(id -u "$KIOSK_USER") + + SIP_PASSWORD=$(generate_password) + read -p "Extension [101]: " KIOSK_EXTENSION + KIOSK_EXTENSION="${KIOSK_EXTENSION:-101}" + KIOSK_NAME="kiosk-${KIOSK_EXTENSION}" + + SERVER_LAN_IP=$(hostname -I | awk '{print $1}') + ASTERISK_HOST="$SERVER_LAN_IP" + FQDN_ENABLED="n" + + install_asterisk_packages + install_baresip_packages + + INSTALLED_SERVER="y" + INSTALLED_CLIENT="y" + + configure_asterisk + configure_baresip + enable_client_services + open_firewall_ports + save_config + + echo "" + echo "═══════════════════════════════════════════════════════════════" + print_success "Installation complete" + echo "" + echo " Server: ${SERVER_LAN_IP}:5060 (UDP)" + echo " Extension: ${KIOSK_EXTENSION}" + echo " Password: ${SIP_PASSWORD}" + echo "" + echo " LAN/VPN clients can connect now." + echo "═══════════════════════════════════════════════════════════════" + echo "" + read -p "Will any clients connect via FQDN (internet/cross-VLAN)? [y/N]: " setup_fqdn + [[ "$setup_fqdn" =~ ^[Yy]$ ]] && setup_fqdn_access +} + +install_server_only() { + print_header "Server Installation" + + SERVER_LAN_IP=$(hostname -I | awk '{print $1}') + ASTERISK_HOST="$SERVER_LAN_IP" + FQDN_ENABLED="n" + + install_asterisk_packages + configure_asterisk + open_firewall_ports + + INSTALLED_SERVER="y" + save_config + + echo "" + print_success "Server installed: ${SERVER_LAN_IP}:5060" + echo "" + read -p "Will any clients connect via FQDN? [y/N]: " setup_fqdn + [[ "$setup_fqdn" =~ ^[Yy]$ ]] && setup_fqdn_access +} + +install_client_only() { + print_header "Client Installation" + + select_user || return 1 + + echo "" + echo " How will this client connect?" + echo " 1) LAN/VPN (via IP)" + echo " 2) FQDN (via domain)" + read -p " Select [1]: " conn_type + + if [[ "$conn_type" == "2" ]]; then + read -p " Server Domain: " ASTERISK_HOST + else + read -p " Server IP (LAN or VPN IP of server): " ASTERISK_HOST + fi + + read -p " Extension [101]: " KIOSK_EXTENSION + KIOSK_EXTENSION="${KIOSK_EXTENSION:-101}" + read -p " Password: " SIP_PASSWORD + + echo " Answer mode: 1) Auto 2) Manual" + read -p " Select [1]: " aa_sel + CLIENT_ANSWERMODE="auto" + [[ "$aa_sel" == "2" ]] && CLIENT_ANSWERMODE="manual" + + install_baresip_packages + INSTALLED_CLIENT="y" + configure_baresip + enable_client_services + save_config + + print_success "Client installed" +} + +install_asterisk_packages() { + echo "exit 101" > /usr/sbin/policy-rc.d + chmod +x /usr/sbin/policy-rc.d + apt update + apt install -y asterisk asterisk-core-sounds-en-gsm asterisk-modules openssl curl tcpdump || true + rm -f /usr/sbin/policy-rc.d + fix_asterisk_systemd +} + +install_baresip_packages() { + apt update + apt install -y baresip baresip-core pipewire pipewire-alsa pipewire-pulse wireplumber alsa-utils evtest || true +} + +uninstall_menu() { + print_header "Uninstall" + echo " 1) Remove Everything" + echo " 2) Asterisk Only" + echo " 3) Baresip Only" + echo " 0) Cancel" + read -p "Select: " ch + case $ch in + 1) + systemctl stop asterisk 2>/dev/null + apt purge -y asterisk* baresip baresip-core 2>/dev/null + rm -rf /etc/asterisk /var/lib/asterisk /etc/easy-asterisk + [[ -n "$KIOSK_USER" ]] && rm -rf "/home/${KIOSK_USER}/.baresip" + systemctl daemon-reload + print_success "Removed all" + ;; + 2) + systemctl stop asterisk 2>/dev/null + apt purge -y asterisk* 2>/dev/null + rm -rf /etc/asterisk /var/lib/asterisk + INSTALLED_SERVER="n" + save_config + print_success "Removed Asterisk" + ;; + 3) + apt purge -y baresip baresip-core 2>/dev/null + [[ -n "$KIOSK_USER" ]] && rm -rf "/home/${KIOSK_USER}/.baresip" + INSTALLED_CLIENT="n" + save_config + print_success "Removed Baresip" + ;; + esac +} + +# ================================================================ +# 12. MENU SYSTEM +# ================================================================ + +show_main_menu() { + clear + print_header "Easy Asterisk v${SCRIPT_VERSION}" + + load_config + echo " Status:" + if [[ "$INSTALLED_SERVER" == "y" ]]; then + echo -e " Server: ${GREEN}Installed${NC}" + echo " LAN/VPN: (use server IP):5060" + if [[ "$FQDN_ENABLED" == "y" ]]; then + echo -e " FQDN: ${GREEN}${DOMAIN_NAME}:5061${NC}" + else + echo -e " FQDN: ${YELLOW}Not configured${NC}" + fi + else + echo -e " Server: ${YELLOW}Not installed${NC}" + fi + if [[ "$INSTALLED_CLIENT" == "y" ]]; then + echo -e " Client: ${GREEN}Installed${NC}" + else + echo -e " Client: ${YELLOW}Not installed${NC}" + fi + echo "" + + local count=1 + declare -A menu_map + + echo " ${count}) Install"; menu_map[$count]="submenu_install"; ((count++)) + if [[ "$INSTALLED_SERVER" == "y" ]]; then + echo " ${count}) Setup FQDN Access"; menu_map[$count]="setup_fqdn_access"; ((count++)) + echo " ${count}) Device Management"; menu_map[$count]="submenu_devices"; ((count++)) + echo " ${count}) Server Tools"; menu_map[$count]="submenu_server"; ((count++)) + fi + if [[ "$INSTALLED_CLIENT" == "y" ]]; then + echo " ${count}) Client Settings"; menu_map[$count]="submenu_client"; ((count++)) + fi + echo " 0) Exit" + echo "" + + read -p " Select: " choice + [[ "$choice" == "0" ]] && exit 0 + local action=${menu_map[$choice]} + [[ -n "$action" ]] && $action + show_main_menu +} + +submenu_install() { + clear + print_header "Install" + echo " 1) Full (server + client)" + echo " 2) Server only" + echo " 3) Client only" + echo " 4) Uninstall" + echo " 0) Back" + read -p " Select: " choice + case $choice in + 1) install_full; read -p "Press Enter..." ;; + 2) install_server_only; read -p "Press Enter..." ;; + 3) install_client_only; read -p "Press Enter..." ;; + 4) uninstall_menu; read -p "Press Enter..." ;; + esac +} + +submenu_devices() { + clear + print_header "Device Management" + echo " 1) Add device" + echo " 2) Remove device" + echo " 3) List devices" + echo " 4) Manage categories" + echo " 5) Manage rooms" + echo " 0) Back" + read -p " Select: " choice + case $choice in + 1) add_device_menu ;; + 2) remove_device ;; + 3) show_registered_devices ;; + 4) manage_categories ;; + 5) manage_rooms ;; + 0) return ;; + esac + [[ "$choice" != "0" ]] && read -p "Press Enter..." + [[ "$choice" != "0" ]] && submenu_devices +} + +submenu_server() { + clear + print_header "Server Tools" + echo " 1) Sync Caddy certs" + echo " 2) Port requirements" + echo " 3) Test connectivity" + echo " 4) Show registrations (live)" + echo " 5) Configure COTURN" + echo " 6) Restart Asterisk" + echo " 7) Watch SIP traffic" + echo " 0) Back" + read -p " Select: " choice + case $choice in + 1) setup_caddy_cert_sync "force" ;; + 2) show_port_requirements ;; + 3) test_sip_connectivity ;; + 4) show_registrations ;; + 5) configure_coturn_menu ;; + 6) restart_asterisk_safe ;; + 7) watch_sip_traffic ;; + 0) return ;; + esac + [[ "$choice" != "0" ]] && read -p "Press Enter..." + [[ "$choice" != "0" ]] && submenu_server +} + +show_registrations() { + print_header "SIP Registrations" + + echo "═══════════════════════════════════════════════════════════════" + echo " REGISTERED CONTACTS" + echo "═══════════════════════════════════════════════════════════════" + asterisk -rx "pjsip show contacts" 2>/dev/null || echo " Unable to query Asterisk" + echo "" + + echo "═══════════════════════════════════════════════════════════════" + echo " ENDPOINT STATUS" + echo "═══════════════════════════════════════════════════════════════" + asterisk -rx "pjsip show endpoints" 2>/dev/null | grep -E "^(Endpoint|Contact|[0-9])" || echo " No endpoints" + echo "" + + echo "═══════════════════════════════════════════════════════════════" + echo " SERVER IPs (clients should connect to one of these)" + echo "═══════════════════════════════════════════════════════════════" + while IFS= read -r line; do + local iface=$(echo "$line" | awk '{print $2}' | tr -d ':') + local ip=$(echo "$line" | awk '{print $4}' | cut -d'/' -f1) + [[ "$iface" =~ ^(lo|docker|br-|veth|virbr) ]] && continue + [[ -z "$ip" ]] && continue + local label="LAN" + [[ "$iface" =~ ^tailscale ]] && label="VPN-Tailscale" + [[ "$iface" =~ ^(wg[0-9]) ]] && label="VPN-WireGuard" + [[ "$iface" =~ ^(wt[0-9]|utun) ]] && label="VPN-Netbird" + [[ "$iface" =~ ^tun ]] && label="VPN-OpenVPN" + [[ "$iface" =~ ^zt ]] && label="VPN-ZeroTier" + printf " %-15s %-18s (%s)\n" "$iface" "$ip" "$label" + done < <(ip -o -4 addr show 2>/dev/null) +} + +watch_sip_traffic() { + print_header "SIP Traffic Monitor" + echo "This will show live SIP packets. Press Ctrl+C to stop." + echo "" + + if command -v sngrep &>/dev/null; then + echo "Starting sngrep (visual SIP analyzer)..." + sngrep -c + elif command -v tcpdump &>/dev/null; then + echo "Starting tcpdump on ports 5060/5061..." + tcpdump -i any -n "port 5060 or port 5061" -v + else + print_error "Neither sngrep nor tcpdump installed" + echo "Install with: apt install sngrep" + fi +} + +submenu_client() { + clear + print_header "Client Settings" + echo " 1) Configure client" + echo " 2) Configure PTT button" + echo " 3) Diagnostics (logs, restart, status)" + echo " 4) Fix audio (unmute & set volume)" + echo " 5) Restart Baresip now" + echo " 0) Back" + read -p " Select: " choice + case $choice in + 1) configure_local_client ;; + 2) configure_ptt_menu ;; + 3) run_client_diagnostics ;; + 4) fix_audio_manually ;; + 5) restart_baresip_now ;; + 0) return ;; + esac + [[ "$choice" != "0" ]] && read -p "Press Enter..." + [[ "$choice" != "0" ]] && submenu_client +} + +restart_baresip_now() { + load_config + local t_user="${KIOSK_USER:-$SUDO_USER}" + t_user="${t_user:-$USER}" + local t_uid=$(id -u "$t_user" 2>/dev/null) + local user_dbus="XDG_RUNTIME_DIR=/run/user/$t_uid" + + print_info "Restarting Baresip for $t_user..." + sudo -u "$t_user" $user_dbus systemctl --user restart baresip 2>/dev/null + sleep 3 + + if sudo -u "$t_user" $user_dbus systemctl --user is-active baresip >/dev/null 2>&1; then + print_success "Baresip running" + echo "" + echo "Recent log:" + sudo -u "$t_user" $user_dbus journalctl --user -u baresip -n 5 --no-pager 2>/dev/null + else + print_error "Baresip failed to start" + echo "" + echo "Error log:" + sudo -u "$t_user" $user_dbus journalctl --user -u baresip -n 15 --no-pager 2>/dev/null + fi +} + +main() { + check_root + load_config + show_main_menu +} + +main "$@" \ No newline at end of file