Major user-focused improvements addressing the 90% use case:
1. **QUICK LOCAL SETUP (New #1 Installation Option)**
- One-click installation for local networks
- Automatically configures:
* PTT with mute-by-default
* Auto-answer for kiosks
* Audio ducking
* No COTURN/certificates needed
- Perfect for intercoms, warehouses, offices, security stations
- Detects VPN and offers to use it
- Prompts for PTT button configuration
- Shows server IP and credentials at end
- This is now the RECOMMENDED path for most users
2. **VPN INTERFACE DETECTION**
- New detect_vpn_interface() function
- Auto-detects: Tailscale, WireGuard, OpenVPN (tun/tap)
- Shows detected interfaces with IPs
- Explains VPN benefits vs COTURN
- Offers to bind Asterisk to VPN IP
- Stores config: USE_VPN, VPN_INTERFACE, VPN_IP
- Called in both Quick Setup and Full Install
- Makes VPN the easy choice instead of complex COTURN
3. **SIMPLIFIED COTURN GUIDANCE**
- New "Do you ACTUALLY need COTURN?" screen
- Clear examples of when you DON'T need it:
* Local network only
* Using VPN
* Server with public IP + simple port forwarding
- Clear examples of when you DO need it:
* Symmetric NAT / strict firewall
* VLAN isolation
* Corporate network with limited ports
- Lists COTURN requirements (FQDN, static/DDNS, port forwarding)
- Changed prompt from [Y/n] to [y/N] (opt-in not opt-out)
4. **TURN DOMAIN IMPROVEMENTS**
- TURN_DOMAIN now defaults to DOMAIN_NAME (same domain is fine!)
- Improved prompt explains single vs separate domain options
- Shows info message when using same domain
- Warns about cert coverage when using separate domains
- Makes setup simpler for most users
5. **INSTALLATION MENU UPDATES**
- Quick Local Setup is now option #1 (BOLD, Recommended)
- Full/Server/Client moved to "Advanced Options"
- Clear description: "Local network, PTT, auto-answer - No internet needed"
- Guides users to the right choice
ANSWERS USER'S KEY QUESTIONS:
✓ "Can Asterisk be set up on local network?" → YES, Quick Setup!
✓ "Does it have PTT/auto-answer/mute/ducking?" → YES, all automatic!
✓ "Should I just VPN everything?" → YES, script detects and suggests it!
✓ "Do I need separate FQDN for COTURN?" → NO, same domain works fine!
✓ "Do I really need COTURN?" → Clear guidance shows when you do/don't!
All features maintain full automation - zero manual editing required.
Major enhancements addressing user feedback:
1. **SEPARATE SIP AND TURN DOMAINS**
- Added support for turn.example.com separate from sip.example.com
- Updated Caddy cert sync to search for certs covering both domains
- Supports wildcard certs (*.example.com) or multi-SAN certs
- Caddy snippet generator now shows both domains when different
- Config variables: DOMAIN_NAME (SIP) and TURN_DOMAIN (TURN)
2. **STATIC vs DYNAMIC IP DETECTION**
- New check_ip_type_and_dns() function asks user about IP type
- Detects static vs dynamic public IP configuration
- For dynamic IPs, checks if user has DDNS configured
- **STOPPING POINT** for users without DDNS:
* Guides to popular DNS providers (Cloudflare, Namecheap, etc.)
* Explains router built-in DDNS options
* Lists dedicated DDNS services (No-IP, DynDNS)
- **VPN ALTERNATIVE** strongly recommended:
* Suggests Tailscale with installation instructions
* Explains benefits: no port forwarding, no COTURN, no IP issues
* More secure than exposing services
- Called automatically during COTURN installation
3. **GOOGLE STUN MADE OPTIONAL**
- No longer automatically falls back to Google STUN
- Asks user during setup_internet_access()
- New config: USE_GOOGLE_STUN (y/n)
- rtp.conf generates three modes:
* COTURN configured: uses local TURN server
* Google STUN enabled: uses stun.l.google.com
* Neither: direct connections only (for VPN setups)
- Clearly explains pros/cons of each option
4. **ENHANCED CADDY CERT SYNC**
- Searches for certs covering BOTH SIP and TURN domains
- Validates cert coverage for each domain separately
- Provides helpful hints if cert not found (wildcard or multi-SAN)
- Handles same-domain scenario (TURN = SIP) efficiently
- Displays which domains were covered in success message
5. **CONFIGURATION VARIABLES ADDED**
- USE_GOOGLE_STUN: Enable/disable Google STUN fallback
- IP_TYPE: "static" or "dynamic"
- HAS_DYNAMIC_DNS: "y" or "n"
- All saved to config file for persistence
ADDRESSES USER CONCERNS:
- "Do I need turn.example.com?" → Yes, supported now
- "What about dynamic IP?" → Guided through DDNS or VPN setup
- "Google as fallback optional?" → Yes, user chooses
- "VPN automation?" → Kept simple, just suggestions (too fragile)
All changes maintain full automation - no manual file editing required.
Major improvements:
1. COMPREHENSIVE OPNsense/pfSense Guide
- Complete network topology (LAN 192.168.1.0/24 + VLANs 20/30/40)
- Step-by-step firewall rules for VLAN isolation
- Detailed port forwarding tables (WAN → COTURN/Asterisk)
- Visual flow diagrams for cross-VLAN communication
- Testing procedures for TURN/COTURN validation
- All rules properly ordered (Allow specific → Block general)
2. Enhanced COTURN Configuration
- Auto-detects and binds to local IP (listening-ip/relay-ip)
- Configured for OPNsense/VLAN environments
- Added TLS support on port 5349
- Proper relay port range (49152-65535)
- Optimized for NAT traversal
3. Asterisk Auto-Configuration
- Added ice_support=yes to all transports (UDP/TCP/TLS)
- rtp.conf auto-configures with COTURN when enabled
- Automatic TURN credentials injection
- Falls back to Google STUN when COTURN not configured
- No manual editing required
4. Baresip Auto-Configuration
- Automatically injects TURN server configuration
- Uses COTURN credentials when available
- Zero manual configuration needed
AUTOMATION: All configurations now handle themselves automatically.
Nothing requires manual editing/configuration/starting by hand.
Fixes foggy instructions, replaces with crystal-clear OPNsense guide.
Claude