Phones were not registering with zero log entries — two root causes:
1. Self-signed cert lacked Subject Alternative Names (SANs). Modern TLS
clients (iOS/Android SIP apps) require SANs and ignore CN-only certs,
causing silent TLS handshake rejection. Cert generation now includes
SANs (DNS + IP), and existing certs without SANs are auto-regenerated.
2. Logger only captured notice/warning/error — TLS handshake failures
are logged at the security level. Added security to console logging.
Also added:
- Startup check verifying port 5061 is actually bound
- TLS/cert diagnostics in vpn-diagnostics (SAN check, port check,
self-signed warning with guidance for phone configuration)
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
- Dockerfile: Containerized Asterisk PBX with Ubuntu 24.04 base,
all dependencies pre-installed, health checks, and volume persistence
- docker-compose.yml: Asterisk service with host networking (required for
RTP port range) + optional self-hosted coturn STUN server via --profile stun
- docker/entrypoint.sh: Auto-generates configs, certs, and starts
Asterisk in foreground with web admin in background
- scripts/vpn-diagnostics.sh: Detects VPN interfaces, checks PJSIP
transport config, tests STUN reachability, analyzes NAT type, and
provides STUN/TURN recommendations for third-party VPNs
- scripts/dns-whitelist.sh: Documents all domains needed per network mode
(LAN/VPN vs FQDN), per component (server, Sipnetic, Linphone), with
--check mode to test DNS resolution and reachability
- easy-asterisk script: Added VPN STUN/ICE menu (option 12 in Server
Settings) with self-hosted coturn, Google STUN, or custom STUN server
options. LAN/VPN devices now get ice_support=yes when VPN ICE is
enabled. Web admin Python code also respects VPN_ICE_ENABLED config.
Self-hosted coturn in STUN-only mode eliminates all external DNS
dependencies - everything operates by IP address, ideal for
DNS-filtered environments.
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
Claude