support CMD-SHELL healthchecks (turnutils_stunclient, PID file checks
both fail). Asterisk uses service_started since it doesn't connect to
coturn directly — SIP clients do.
https://claude.ai/code/session_01KWVtEt9MmZdywcu7WmgchX
turnutils_stunclient is not available in coturn/coturn:latest (v4.8.0),
causing the healthcheck to always fail and preventing the asterisk
container from starting. Switch to checking the PID file that coturn
creates on successful startup.
https://claude.ai/code/session_01KWVtEt9MmZdywcu7WmgchX
Replace the coturn image's fragile eval-based entrypoint with a robust
wrapper that handles external IP detection without word-splitting issues.
The image's `exec $(eval "echo $@")` produces empty tokens when
DETECT_EXTERNAL_IP's DNS lookup fails → "ERROR: CONFIG: Unknown argument:"
Also add --listening-ip=0.0.0.0 so coturn binds a single wildcard address
instead of enumerating every host interface (reduces log noise).
https://claude.ai/code/session_01KWVtEt9MmZdywcu7WmgchX
Two bugs caused ICE candidate gathering to fail and timeout (~27 seconds)
before falling back to direct media on every call:
1. TURN credential mismatch — when TURN_PASSWORD was empty in .env,
coturn defaulted to "changeme" but the entrypoint auto-generated a
different random password for Asterisk. Every TURN auth attempt failed
("check_stun_auth: user easyasterisk credentials are incorrect").
2. STUN DNS TTL=0 — using the FQDN as stunaddr caused DNS resolution
that returned TTL=0, making Asterisk cancel recurring STUN resolution
entirely. Since coturn runs on the same host (network_mode: host),
rtp.conf now uses 127.0.0.1 which needs no DNS at all.
Also documents the Android Call Integration audio issue (ConnectionService
routes audio through the native telephony path, breaking VoIP RTP).
https://claude.ai/code/session_01KWVtEt9MmZdywcu7WmgchX
UniFi controller uses UDP 3478 for STUN, preventing coturn from
binding. Add TURN_PORT variable (default 3478) so users can set
TURN_PORT=3479 in .env to avoid the conflict.
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
The coturn/coturn:latest image sets USER nobody:nogroup. On startup,
turnserver tries to create /var/run/turnserver.pid which nobody can't
write to, causing an immediate crash (the 2.2s "Error" in compose).
Fix: add user: root to the coturn service. Since we already use
network_mode: host, the container has broad host access anyway.
Also adds DETECT_EXTERNAL_IP=yes which is the image's native way
to auto-detect and set --external-ip, replacing our shell script.
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
The coturn/coturn image has its own docker-entrypoint.sh that handles
arg parsing. Overriding it with /bin/sh -c adds a failure point.
Now passing args as a clean list directly to the native entrypoint.
Also drops --external-ip for now (added back once coturn starts).
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
Three changes to fix coturn failing to start:
1. Use environment vars instead of mixing Compose interpolation
(${VAR}) with shell escaping ($$ARGS) in the command - the
old approach was fragile and could produce broken shell scripts
2. Remove --no-loopback-peers - since Asterisk runs on the same
host (network_mode: host), coturn must allow relay to localhost
otherwise it refuses to relay media to Asterisk
3. Health check: redirect output to /dev/null to avoid noise
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
The coturn/coturn Alpine image doesn't include ss or netstat.
Use turnutils_stunclient (included in the coturn image) which
actually verifies the STUN server is responding, not just that
a port is open. Also add start_period to avoid false failures
during startup.
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
The coturn/coturn Docker image is Alpine-based and doesn't include
iproute2 (which provides ss). This caused the healthcheck to fail
immediately, marking coturn as unhealthy and preventing the asterisk
container from starting due to its service_healthy dependency.
Alpine's busybox includes netstat, so use that instead.
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
Problem: Calls via FQDN work "sometimes" because STUN-only mode fails
behind strict NAT (cellular, Proton VPN, hotel WiFi, corporate firewalls).
STUN tells clients their public IP, but can't relay media when direct
UDP paths are blocked. TURN relays media as a fallback.
Changes:
coturn (docker-compose.yml):
- Upgraded from STUN-only to full STUN+TURN relay
- Uses long-term credential mechanism (--lt-cred-mech)
- Credentials shared between coturn and Asterisk automatically
- Relay port range 49152-49252 (configurable, ~50 concurrent relayed calls)
- Always-on (removed --profile stun gate)
- Conditional --external-ip (only set when PUBLIC_IP is provided)
Entrypoint (docker/entrypoint.sh):
- Auto-detects public IP (ifconfig.me → icanhazip.com → api.ipify.org)
- Auto-generates TURN password on first startup (saved to config)
- Configures rtp.conf with icesupport + stunaddr + turnaddr + credentials
- Updates pjsip.conf external_*_address if public IP changes
- Always enables ICE, STUN, and TURN for Docker deployments
Main script (easy-asterisk-v0.10.0.sh):
- Added TURN_ENABLED, TURN_SERVER, TURN_USERNAME, TURN_PASSWORD to
load_config/save_config
- repair_core_configs: rtp.conf now includes turnaddr/turnusername/turnpassword
when TURN is enabled
- Bash device creation: Docker mode defaults to FQDN (TLS) for all new devices
- Python device creation: reads TURN_ENABLED, auto-selects FQDN in Docker
- Main menu shows TURN status
.env.example:
- Comprehensive documentation for every setting
- DOMAIN_NAME is the only required setting
- Port forwarding requirements clearly listed
- TURN credentials and relay port range documented
The result: `docker compose up -d` gives you a fully working PBX where
any SIP client on any network can connect reliably via FQDN:5061.
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
- Dockerfile: Containerized Asterisk PBX with Ubuntu 24.04 base,
all dependencies pre-installed, health checks, and volume persistence
- docker-compose.yml: Asterisk service with host networking (required for
RTP port range) + optional self-hosted coturn STUN server via --profile stun
- docker/entrypoint.sh: Auto-generates configs, certs, and starts
Asterisk in foreground with web admin in background
- scripts/vpn-diagnostics.sh: Detects VPN interfaces, checks PJSIP
transport config, tests STUN reachability, analyzes NAT type, and
provides STUN/TURN recommendations for third-party VPNs
- scripts/dns-whitelist.sh: Documents all domains needed per network mode
(LAN/VPN vs FQDN), per component (server, Sipnetic, Linphone), with
--check mode to test DNS resolution and reachability
- easy-asterisk script: Added VPN STUN/ICE menu (option 12 in Server
Settings) with self-hosted coturn, Google STUN, or custom STUN server
options. LAN/VPN devices now get ice_support=yes when VPN ICE is
enabled. Web admin Python code also respects VPN_ICE_ENABLED config.
Self-hosted coturn in STUN-only mode eliminates all external DNS
dependencies - everything operates by IP address, ideal for
DNS-filtered environments.
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
Claude