Major enhancements addressing user feedback:
1. **SEPARATE SIP AND TURN DOMAINS**
- Added support for turn.example.com separate from sip.example.com
- Updated Caddy cert sync to search for certs covering both domains
- Supports wildcard certs (*.example.com) or multi-SAN certs
- Caddy snippet generator now shows both domains when different
- Config variables: DOMAIN_NAME (SIP) and TURN_DOMAIN (TURN)
2. **STATIC vs DYNAMIC IP DETECTION**
- New check_ip_type_and_dns() function asks user about IP type
- Detects static vs dynamic public IP configuration
- For dynamic IPs, checks if user has DDNS configured
- **STOPPING POINT** for users without DDNS:
* Guides to popular DNS providers (Cloudflare, Namecheap, etc.)
* Explains router built-in DDNS options
* Lists dedicated DDNS services (No-IP, DynDNS)
- **VPN ALTERNATIVE** strongly recommended:
* Suggests Tailscale with installation instructions
* Explains benefits: no port forwarding, no COTURN, no IP issues
* More secure than exposing services
- Called automatically during COTURN installation
3. **GOOGLE STUN MADE OPTIONAL**
- No longer automatically falls back to Google STUN
- Asks user during setup_internet_access()
- New config: USE_GOOGLE_STUN (y/n)
- rtp.conf generates three modes:
* COTURN configured: uses local TURN server
* Google STUN enabled: uses stun.l.google.com
* Neither: direct connections only (for VPN setups)
- Clearly explains pros/cons of each option
4. **ENHANCED CADDY CERT SYNC**
- Searches for certs covering BOTH SIP and TURN domains
- Validates cert coverage for each domain separately
- Provides helpful hints if cert not found (wildcard or multi-SAN)
- Handles same-domain scenario (TURN = SIP) efficiently
- Displays which domains were covered in success message
5. **CONFIGURATION VARIABLES ADDED**
- USE_GOOGLE_STUN: Enable/disable Google STUN fallback
- IP_TYPE: "static" or "dynamic"
- HAS_DYNAMIC_DNS: "y" or "n"
- All saved to config file for persistence
ADDRESSES USER CONCERNS:
- "Do I need turn.example.com?" → Yes, supported now
- "What about dynamic IP?" → Guided through DDNS or VPN setup
- "Google as fallback optional?" → Yes, user chooses
- "VPN automation?" → Kept simple, just suggestions (too fragile)
All changes maintain full automation - no manual file editing required.
Major improvements:
1. COMPREHENSIVE OPNsense/pfSense Guide
- Complete network topology (LAN 192.168.1.0/24 + VLANs 20/30/40)
- Step-by-step firewall rules for VLAN isolation
- Detailed port forwarding tables (WAN → COTURN/Asterisk)
- Visual flow diagrams for cross-VLAN communication
- Testing procedures for TURN/COTURN validation
- All rules properly ordered (Allow specific → Block general)
2. Enhanced COTURN Configuration
- Auto-detects and binds to local IP (listening-ip/relay-ip)
- Configured for OPNsense/VLAN environments
- Added TLS support on port 5349
- Proper relay port range (49152-65535)
- Optimized for NAT traversal
3. Asterisk Auto-Configuration
- Added ice_support=yes to all transports (UDP/TCP/TLS)
- rtp.conf auto-configures with COTURN when enabled
- Automatic TURN credentials injection
- Falls back to Google STUN when COTURN not configured
- No manual editing required
4. Baresip Auto-Configuration
- Automatically injects TURN server configuration
- Uses COTURN credentials when available
- Zero manual configuration needed
AUTOMATION: All configurations now handle themselves automatically.
Nothing requires manual editing/configuration/starting by hand.
Fixes foggy instructions, replaces with crystal-clear OPNsense guide.
Claude