Add Docker containerization, VPN STUN/ICE support, and DNS whitelist tools
- Dockerfile: Containerized Asterisk PBX with Ubuntu 24.04 base, all dependencies pre-installed, health checks, and volume persistence - docker-compose.yml: Asterisk service with host networking (required for RTP port range) + optional self-hosted coturn STUN server via --profile stun - docker/entrypoint.sh: Auto-generates configs, certs, and starts Asterisk in foreground with web admin in background - scripts/vpn-diagnostics.sh: Detects VPN interfaces, checks PJSIP transport config, tests STUN reachability, analyzes NAT type, and provides STUN/TURN recommendations for third-party VPNs - scripts/dns-whitelist.sh: Documents all domains needed per network mode (LAN/VPN vs FQDN), per component (server, Sipnetic, Linphone), with --check mode to test DNS resolution and reachability - easy-asterisk script: Added VPN STUN/ICE menu (option 12 in Server Settings) with self-hosted coturn, Google STUN, or custom STUN server options. LAN/VPN devices now get ice_support=yes when VPN ICE is enabled. Web admin Python code also respects VPN_ICE_ENABLED config. Self-hosted coturn in STUN-only mode eliminates all external DNS dependencies - everything operates by IP address, ideal for DNS-filtered environments. https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
This commit is contained in:
Claude
@@ -0,0 +1,209 @@
|
||||
#!/bin/bash
|
||||
# ================================================================
|
||||
# Easy Asterisk Docker Entrypoint
|
||||
#
|
||||
# Starts Asterisk + Web Admin, applies environment configuration
|
||||
# ================================================================
|
||||
|
||||
set -e
|
||||
|
||||
# Colors for output
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
CYAN='\033[0;36m'
|
||||
NC='\033[0m'
|
||||
|
||||
log_info() { echo -e "${GREEN}[entrypoint]${NC} $1"; }
|
||||
log_warn() { echo -e "${YELLOW}[entrypoint]${NC} $1"; }
|
||||
|
||||
# ── 1. Generate self-signed certs if missing ──────────────────
|
||||
if [[ ! -f /etc/asterisk/certs/server.crt ]]; then
|
||||
log_info "Generating self-signed TLS certificate..."
|
||||
mkdir -p /etc/asterisk/certs
|
||||
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
|
||||
-keyout /etc/asterisk/certs/server.key \
|
||||
-out /etc/asterisk/certs/server.crt \
|
||||
-subj "/CN=asterisk-local" 2>/dev/null
|
||||
chown asterisk:asterisk /etc/asterisk/certs/server.*
|
||||
chmod 644 /etc/asterisk/certs/server.crt
|
||||
chmod 600 /etc/asterisk/certs/server.key
|
||||
fi
|
||||
|
||||
# ── 2. Apply environment-based configuration ──────────────────
|
||||
CONFIG_DIR="/etc/easy-asterisk"
|
||||
CONFIG_FILE="${CONFIG_DIR}/config"
|
||||
mkdir -p "$CONFIG_DIR"
|
||||
|
||||
# If no config exists, create from environment variables
|
||||
if [[ ! -f "$CONFIG_FILE" ]]; then
|
||||
log_info "Creating initial configuration from environment..."
|
||||
cat > "$CONFIG_FILE" << EOF
|
||||
# Easy Asterisk Configuration (Docker)
|
||||
KIOSK_USER=""
|
||||
KIOSK_UID=""
|
||||
KIOSK_EXTENSION=""
|
||||
KIOSK_NAME=""
|
||||
SIP_PASSWORD=""
|
||||
ASTERISK_HOST="${ASTERISK_HOST:-}"
|
||||
DOMAIN_NAME="${DOMAIN_NAME:-}"
|
||||
ENABLE_TLS="${ENABLE_TLS:-n}"
|
||||
HAS_VLANS="${HAS_VLANS:-n}"
|
||||
VLAN_SUBNETS="${VLAN_SUBNETS:-}"
|
||||
CERT_PATH=""
|
||||
KEY_PATH=""
|
||||
INSTALLED_SERVER="y"
|
||||
INSTALLED_CLIENT="n"
|
||||
CURRENT_PUBLIC_IP=""
|
||||
PTT_DEVICE=""
|
||||
PTT_KEYCODE=""
|
||||
LOCAL_CIDR="${LOCAL_CIDR:-}"
|
||||
WEB_ADMIN_PORT="${WEB_ADMIN_PORT:-8080}"
|
||||
WEB_ADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}"
|
||||
VPN_ICE_ENABLED="${VPN_ICE_ENABLED:-n}"
|
||||
CUSTOM_STUN_SERVER="${CUSTOM_STUN_SERVER:-}"
|
||||
EOF
|
||||
chmod 644 "$CONFIG_FILE"
|
||||
fi
|
||||
|
||||
# ── 3. Configure STUN if self-hosted coturn is available ──────
|
||||
if [[ -n "$STUN_SERVER" ]]; then
|
||||
log_info "Using STUN server: ${STUN_SERVER}"
|
||||
source "$CONFIG_FILE" 2>/dev/null || true
|
||||
|
||||
# Update rtp.conf with custom STUN
|
||||
cat > /etc/asterisk/rtp.conf << EOF
|
||||
[general]
|
||||
rtpstart=${RTP_START:-10000}
|
||||
rtpend=${RTP_END:-20000}
|
||||
strictrtp=yes
|
||||
icesupport=yes
|
||||
stunaddr=${STUN_SERVER}
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/rtp.conf
|
||||
fi
|
||||
|
||||
# ── 4. Generate default Asterisk configs if missing ───────────
|
||||
if [[ ! -f /etc/asterisk/pjsip.conf ]] || [[ ! -s /etc/asterisk/pjsip.conf ]]; then
|
||||
log_info "Generating default PJSIP configuration..."
|
||||
local_ip=$(hostname -I | awk '{print $1}')
|
||||
raw_cidr=$(ip -o -f inet addr show | awk '/scope global/ {print $4}' | head -1)
|
||||
default_cidr="$raw_cidr"
|
||||
if [[ "$raw_cidr" =~ \.([0-9]+)/24$ ]]; then default_cidr="${raw_cidr%.*}.0/24"; fi
|
||||
|
||||
nat_settings=""
|
||||
source "$CONFIG_FILE" 2>/dev/null || true
|
||||
if [[ "$HAS_VLANS" == "y" && -n "$VLAN_SUBNETS" ]]; then
|
||||
nat_settings="local_net=${default_cidr}"
|
||||
for subnet in $VLAN_SUBNETS; do
|
||||
nat_settings="${nat_settings}
|
||||
local_net=${subnet}"
|
||||
done
|
||||
fi
|
||||
|
||||
cat > /etc/asterisk/pjsip.conf << EOF
|
||||
; Easy Asterisk (Docker)
|
||||
[global]
|
||||
type=global
|
||||
user_agent=EasyAsterisk
|
||||
|
||||
[transport-udp]
|
||||
type=transport
|
||||
protocol=udp
|
||||
bind=0.0.0.0:5060
|
||||
; Server IP: ${local_ip}
|
||||
${nat_settings}
|
||||
|
||||
[transport-tcp]
|
||||
type=transport
|
||||
protocol=tcp
|
||||
bind=0.0.0.0:5060
|
||||
; Server IP: ${local_ip}
|
||||
${nat_settings}
|
||||
|
||||
[transport-tls]
|
||||
type=transport
|
||||
protocol=tls
|
||||
bind=0.0.0.0:5061
|
||||
; Server IP: ${local_ip}
|
||||
cert_file=/etc/asterisk/certs/server.crt
|
||||
priv_key_file=/etc/asterisk/certs/server.key
|
||||
ca_list_file=/etc/ssl/certs/ca-certificates.crt
|
||||
method=tlsv1_2
|
||||
${nat_settings}
|
||||
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/pjsip.conf
|
||||
fi
|
||||
|
||||
if [[ ! -f /etc/asterisk/extensions.conf ]] || [[ ! -s /etc/asterisk/extensions.conf ]]; then
|
||||
log_info "Generating default dialplan..."
|
||||
cat > /etc/asterisk/extensions.conf << EOF
|
||||
[general]
|
||||
static=yes
|
||||
writeprotect=no
|
||||
[default]
|
||||
exten => _X.,1,Hangup()
|
||||
[intercom]
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/extensions.conf
|
||||
fi
|
||||
|
||||
if [[ ! -f /etc/asterisk/rtp.conf ]]; then
|
||||
log_info "Generating default RTP configuration..."
|
||||
cat > /etc/asterisk/rtp.conf << EOF
|
||||
[general]
|
||||
rtpstart=${RTP_START:-10000}
|
||||
rtpend=${RTP_END:-20000}
|
||||
strictrtp=yes
|
||||
# icesupport disabled - LAN only mode
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/rtp.conf
|
||||
fi
|
||||
|
||||
# Generate other required configs
|
||||
for conf in asterisk.conf logger.conf modules.conf; do
|
||||
if [[ ! -f "/etc/asterisk/$conf" ]]; then
|
||||
log_info "Generating /etc/asterisk/$conf..."
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ ! -f /etc/asterisk/asterisk.conf ]]; then
|
||||
cat > /etc/asterisk/asterisk.conf << EOF
|
||||
[directories]
|
||||
[options]
|
||||
runuser = asterisk
|
||||
rungroup = asterisk
|
||||
EOF
|
||||
fi
|
||||
|
||||
if [[ ! -f /etc/asterisk/logger.conf ]]; then
|
||||
cat > /etc/asterisk/logger.conf << EOF
|
||||
[general]
|
||||
[logfiles]
|
||||
console => notice,warning,error
|
||||
EOF
|
||||
fi
|
||||
|
||||
# ── 5. Fix permissions ───────────────────────────────────────
|
||||
chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk /var/run/asterisk 2>/dev/null || true
|
||||
|
||||
# ── 6. Start Web Admin in background (if script exists) ──────
|
||||
WEB_ADMIN_SCRIPT="/usr/local/bin/easy-asterisk-webadmin"
|
||||
if [[ -f "$WEB_ADMIN_SCRIPT" ]]; then
|
||||
source "$CONFIG_FILE" 2>/dev/null || true
|
||||
log_info "Starting Web Admin on port ${WEB_ADMIN_PORT:-8080}..."
|
||||
WEBADMIN_PORT="${WEB_ADMIN_PORT:-8080}" \
|
||||
WEBADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}" \
|
||||
python3 "$WEB_ADMIN_SCRIPT" &
|
||||
fi
|
||||
|
||||
# ── 7. Start Asterisk in foreground ──────────────────────────
|
||||
log_info "Starting Asterisk PBX..."
|
||||
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||
echo -e "${CYAN} Easy Asterisk (Docker)${NC}"
|
||||
echo -e "${CYAN} Management: docker exec -it easy-asterisk easy-asterisk${NC}"
|
||||
echo -e "${CYAN} Diagnostics: docker exec -it easy-asterisk vpn-diagnostics${NC}"
|
||||
echo -e "${CYAN} DNS Check: docker exec -it easy-asterisk dns-whitelist${NC}"
|
||||
echo -e "${CYAN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||
|
||||
exec asterisk -f -U asterisk -G asterisk
|
||||
Reference in New Issue
Block a user