CRITICAL FIX:
- Added load_config() call in add_device_menu to read saved ENABLE_TLS setting
- Device display now correctly shows UDP/5060 when ENABLE_TLS != "y"
- Device display shows TLS/5061 only when ENABLE_TLS == "y"
- SRTP requirement properly displayed based on TLS configuration
OTHER FIXES:
- ICE support only enabled when DOMAIN_NAME is set (FQDN/internet calling)
- RTP config: icesupport and STUN only for FQDN setups, not LAN-only
- Added informative message after server install before internet setup prompt
ISSUE RESOLVED:
When installing server-only without selecting internet/certs, devices now
correctly show:
Transport: UDP (port 5060)
SRTP: Not required
This matches the actual pjsip.conf configuration and allows mobile devices
to properly register with UDP transport on LAN networks.
Created v1.28.sh with all fixes, keeping v1.23.sh for reference.
FIXES:
- Device display now correctly shows UDP/5060 for LAN-only installs
- Device display now correctly shows TLS/5061 only when ENABLE_TLS=y
- SRTP shown as "Required" only when TLS enabled, "Not required" for UDP
- ICE support only enabled when DOMAIN_NAME is set (FQDN/internet calling)
- RTP config: icesupport and STUN only enabled for FQDN setups
ISSUE RESOLVED:
When installing server without internet/certs option, devices are now
correctly configured for LAN-only operation:
- Transport: UDP (port 5060)
- SRTP: Not required
- No ICE/STUN for LAN-only
This matches actual pjsip.conf configuration and allows mobile devices
to properly register with UDP transport on LAN.
Removed v1.26 and v1.27 - reverting to simpler, working v1.23 base.
FIXES:
- ICE support now conditionally enabled only for FQDN/internet calling
- LAN-only setups (Quick Local Setup) no longer have ICE enabled
- pjsip.conf endpoints: ice_support only added when DOMAIN_NAME is set
- rtp.conf: icesupport only enabled when DOMAIN_NAME is configured
SCENARIOS SUPPORTED:
1. LAN only (Quick Local) - NO ICE, NO STUN, NO TURN ✓
2. FQDN with VPN - ICE enabled (DOMAIN_NAME set) ✓
3. FQDN without VPN, with COTURN - ICE + TURN ✓
4. FQDN without VPN, without COTURN - ICE (optional STUN) ✓
This ensures proper protocol configuration for all installation modes.
Major Installation Flow Restructure:
**Full Setup (Option 2):**
1. VPN Detection - Shows benefits of VPN vs COTURN
2. Install base software (Asterisk + Baresip)
3. Optional: Internet/FQDN Setup
- Clear YES/NO choice with colored guidance
- If NO: Uses local network or VPN IP
4. Optional: COTURN Setup (only offered if internet setup chosen)
- Clear warning: "⚠ COTURN is complex and usually NOT needed!"
- Shows when you DON'T need it (VPN, port forwarding, same network)
- Shows when you MIGHT need it (no VPN, VLAN isolation, symmetric NAT)
- Defaults to NO
5. PTT configuration
**Server Only (Option 3):**
- Same flow as Full Setup, but without client software or PTT
**Key Improvements:**
- COTURN is now a **separate, explicit** optional step (not buried in wizard)
- Users see clear guidance on when COTURN is actually needed
- VPN is presented as the better alternative
- Default answer is NO for COTURN (safer for users)
- Colors render properly with -e flag
This addresses user feedback that COTURN setup is complex and should be clearly optional, not implied as mandatory.
Fixes:
- Add -e flag to echo statements so BOLD and CYAN colors render properly
- Previously showed raw escape codes like \033[1m instead of formatted text
Clarifications:
- Changed "Full Setup" description from "With FQDN, TLS certs, COTURN, internet calling"
to "Optionally add FQDN, TLS certs, COTURN for internet calling"
- COTURN is NOT mandatory in Full Setup
- It's only configured if user runs Internet/Certificate Setup wizard afterward
User can now see properly formatted menu:
1) Quick Local Setup (Recommended) [in bold]
└─ Local LAN only - PTT, auto-answer, no internet/FQDN
Advanced Options: [in cyan]
2) Full Setup (Server + Client + Internet)
└─ Optionally add FQDN, TLS certs, COTURN for internet calling
Menu Improvements:
- Clarified "Quick Local Setup" as "Local LAN only - no internet/FQDN"
- Renamed "Full" to "Full Setup (Server + Client + Internet)"
- Added detailed descriptions for all install options
- "Server Only" now explains it can optionally include FQDN/internet
- "Client Only" clarifies it connects to existing server
User Experience:
- Added progress message during device addition: "Reloading Asterisk configuration (this may take a moment)..."
- Prevents confusion when dialplan rebuild causes brief delay
- Users now see the script is working, not hanging
This addresses user feedback about menu clarity and apparent hangs during device addition.
Implements a complete update system similar to the kiosk project:
- Check GitHub for latest releases via API
- Display current vs latest version comparison
- Show breaking changes warning with changelog link
- Create automatic timestamped backups of script and configs
- Display clear rollback instructions before updating
- Download and install new version safely
- Offer to restart Asterisk, Baresip, and COTURN services
- New "Check for Updates" option in Tools menu
Features:
- Version constants and GitHub repo info
- check_for_updates() - fetches and compares versions
- perform_update() - handles backup, download, and installation
- restart_all_services() - safely restarts all services
- Fallback to git clone if direct download unavailable
- Rate limit detection and error handling
Enhancements based on user feedback:
1. **NETBIRD VPN SUPPORT**
- Added NetBird to VPN detection (interface: wt0)
- Now detects: Tailscale, NetBird, WireGuard, OpenVPN
- Shows VPN type in detection message
- Stores VPN_TYPE in config for reference
2. **VPN SETUP REQUIREMENTS EXPLAINED**
- Added clear "IMPORTANT: VPN Setup Requirements" section
- Explains VPN must be installed on:
* Asterisk server ✓ (shows detection)
* ALL kiosk/client devices (user must do)
- Shows warning: "Remember: Install {VPN_TYPE} on all kiosk devices!"
- Explains how VPN + internet calling works together:
* Kiosks register via VPN IP
* Asterisk acts as bridge
* External callers use FQDN + port forwarding
3. **PTT CONFIGURATION FIXES**
- PTT now only prompted when client is being installed
- Added to install_full() - installs client
- Added to install_client_only() - installs client
- Quick setup already had it (kept)
- install_server_only() correctly does NOT ask (no client)
- Ensures PTT hardware is only configured where it makes sense
4. **NEW: INTERNET CALLING GUIDE**
- Comprehensive new function: show_internet_calling_guide()
- Added to Server Settings menu (#4)
**Scenario 1: Simple Internet Calling**
- FQDN + port forwarding (5060/5061 + 10000-20000)
- Works for simple NAT
- Explains limitations (symmetric NAT, corporate firewalls)
**Scenario 2: VPN + Internet Calling (RECOMMENDED)**
- Answers the key question: "Can internet users call VPN kiosks?"
- Answer: YES! Here's how:
* Kiosks register to Asterisk via VPN IP
* Internet calls use FQDN → port forward → Asterisk
* Asterisk routes to kiosk via VPN network
* Works even if kiosk is on VLAN 20!
- Explains benefits: No COTURN, works across VLANs, more secure
**Scenario 3: COTURN + VLAN Isolation**
- Explains when you actually need COTURN
- Shows it's only needed if you can't use VPN
- Recommends VPN as simpler and more reliable
5. **PORT REQUIREMENTS UPDATES**
- Updated to mention NetBird alongside Tailscale/WireGuard
- Added reference to new Internet Calling Guide
KEY QUESTIONS ANSWERED:
✓ "Add NetBird to VPN list?" → Done!
✓ "PTT only when client installed?" → Fixed!
✓ "Explain VPN needs to be on all devices?" → Explained clearly!
✓ "Is FQDN + port forward all you need?" → Yes, guide added!
✓ "Can internet call VPN kiosk on VLAN?" → Yes! Explained in detail!
All scenarios now documented with clear examples and flow diagrams.
Major user-focused improvements addressing the 90% use case:
1. **QUICK LOCAL SETUP (New #1 Installation Option)**
- One-click installation for local networks
- Automatically configures:
* PTT with mute-by-default
* Auto-answer for kiosks
* Audio ducking
* No COTURN/certificates needed
- Perfect for intercoms, warehouses, offices, security stations
- Detects VPN and offers to use it
- Prompts for PTT button configuration
- Shows server IP and credentials at end
- This is now the RECOMMENDED path for most users
2. **VPN INTERFACE DETECTION**
- New detect_vpn_interface() function
- Auto-detects: Tailscale, WireGuard, OpenVPN (tun/tap)
- Shows detected interfaces with IPs
- Explains VPN benefits vs COTURN
- Offers to bind Asterisk to VPN IP
- Stores config: USE_VPN, VPN_INTERFACE, VPN_IP
- Called in both Quick Setup and Full Install
- Makes VPN the easy choice instead of complex COTURN
3. **SIMPLIFIED COTURN GUIDANCE**
- New "Do you ACTUALLY need COTURN?" screen
- Clear examples of when you DON'T need it:
* Local network only
* Using VPN
* Server with public IP + simple port forwarding
- Clear examples of when you DO need it:
* Symmetric NAT / strict firewall
* VLAN isolation
* Corporate network with limited ports
- Lists COTURN requirements (FQDN, static/DDNS, port forwarding)
- Changed prompt from [Y/n] to [y/N] (opt-in not opt-out)
4. **TURN DOMAIN IMPROVEMENTS**
- TURN_DOMAIN now defaults to DOMAIN_NAME (same domain is fine!)
- Improved prompt explains single vs separate domain options
- Shows info message when using same domain
- Warns about cert coverage when using separate domains
- Makes setup simpler for most users
5. **INSTALLATION MENU UPDATES**
- Quick Local Setup is now option #1 (BOLD, Recommended)
- Full/Server/Client moved to "Advanced Options"
- Clear description: "Local network, PTT, auto-answer - No internet needed"
- Guides users to the right choice
ANSWERS USER'S KEY QUESTIONS:
✓ "Can Asterisk be set up on local network?" → YES, Quick Setup!
✓ "Does it have PTT/auto-answer/mute/ducking?" → YES, all automatic!
✓ "Should I just VPN everything?" → YES, script detects and suggests it!
✓ "Do I need separate FQDN for COTURN?" → NO, same domain works fine!
✓ "Do I really need COTURN?" → Clear guidance shows when you do/don't!
All features maintain full automation - zero manual editing required.
Major enhancements addressing user feedback:
1. **SEPARATE SIP AND TURN DOMAINS**
- Added support for turn.example.com separate from sip.example.com
- Updated Caddy cert sync to search for certs covering both domains
- Supports wildcard certs (*.example.com) or multi-SAN certs
- Caddy snippet generator now shows both domains when different
- Config variables: DOMAIN_NAME (SIP) and TURN_DOMAIN (TURN)
2. **STATIC vs DYNAMIC IP DETECTION**
- New check_ip_type_and_dns() function asks user about IP type
- Detects static vs dynamic public IP configuration
- For dynamic IPs, checks if user has DDNS configured
- **STOPPING POINT** for users without DDNS:
* Guides to popular DNS providers (Cloudflare, Namecheap, etc.)
* Explains router built-in DDNS options
* Lists dedicated DDNS services (No-IP, DynDNS)
- **VPN ALTERNATIVE** strongly recommended:
* Suggests Tailscale with installation instructions
* Explains benefits: no port forwarding, no COTURN, no IP issues
* More secure than exposing services
- Called automatically during COTURN installation
3. **GOOGLE STUN MADE OPTIONAL**
- No longer automatically falls back to Google STUN
- Asks user during setup_internet_access()
- New config: USE_GOOGLE_STUN (y/n)
- rtp.conf generates three modes:
* COTURN configured: uses local TURN server
* Google STUN enabled: uses stun.l.google.com
* Neither: direct connections only (for VPN setups)
- Clearly explains pros/cons of each option
4. **ENHANCED CADDY CERT SYNC**
- Searches for certs covering BOTH SIP and TURN domains
- Validates cert coverage for each domain separately
- Provides helpful hints if cert not found (wildcard or multi-SAN)
- Handles same-domain scenario (TURN = SIP) efficiently
- Displays which domains were covered in success message
5. **CONFIGURATION VARIABLES ADDED**
- USE_GOOGLE_STUN: Enable/disable Google STUN fallback
- IP_TYPE: "static" or "dynamic"
- HAS_DYNAMIC_DNS: "y" or "n"
- All saved to config file for persistence
ADDRESSES USER CONCERNS:
- "Do I need turn.example.com?" → Yes, supported now
- "What about dynamic IP?" → Guided through DDNS or VPN setup
- "Google as fallback optional?" → Yes, user chooses
- "VPN automation?" → Kept simple, just suggestions (too fragile)
All changes maintain full automation - no manual file editing required.
Major improvements:
1. COMPREHENSIVE OPNsense/pfSense Guide
- Complete network topology (LAN 192.168.1.0/24 + VLANs 20/30/40)
- Step-by-step firewall rules for VLAN isolation
- Detailed port forwarding tables (WAN → COTURN/Asterisk)
- Visual flow diagrams for cross-VLAN communication
- Testing procedures for TURN/COTURN validation
- All rules properly ordered (Allow specific → Block general)
2. Enhanced COTURN Configuration
- Auto-detects and binds to local IP (listening-ip/relay-ip)
- Configured for OPNsense/VLAN environments
- Added TLS support on port 5349
- Proper relay port range (49152-65535)
- Optimized for NAT traversal
3. Asterisk Auto-Configuration
- Added ice_support=yes to all transports (UDP/TCP/TLS)
- rtp.conf auto-configures with COTURN when enabled
- Automatic TURN credentials injection
- Falls back to Google STUN when COTURN not configured
- No manual editing required
4. Baresip Auto-Configuration
- Automatically injects TURN server configuration
- Uses COTURN credentials when available
- Zero manual configuration needed
AUTOMATION: All configurations now handle themselves automatically.
Nothing requires manual editing/configuration/starting by hand.
Fixes foggy instructions, replaces with crystal-clear OPNsense guide.
Claude