This update adds comprehensive VLAN support to prevent the common
issue of calls dropping after 30 seconds in multi-VLAN environments.
Changes:
- Added new menu item "Configure VLAN Subnets" in Server Settings
- Created configure_vlan_subnets() function to manage VLAN configuration
- Updated pjsip.conf generation to include multiple local_net entries
- Added server IP address as comment in transport sections for reference
- Persist VLAN settings (HAS_VLANS, VLAN_SUBNETS) in config file
- Updated script version to v0.9.8.8
Technical details:
- The generate_pjsip_conf() function now builds multiple local_net
entries when VLANs are configured
- Each VLAN subnet is added as a separate local_net line in the
transport configuration
- Server IP is detected and documented in transport sections
- Transports continue to bind to 0.0.0.0 for all-interface listening
This fixes the issue where Asterisk would treat devices on different
VLANs as external connections, causing NAT issues and call drops.
This commit adds export and import functionality for client configurations
to the Client Settings menu, allowing users to save and restore provisioned
clients during Asterisk reinstallations.
Features:
- Export clients: Creates a tar.gz archive containing all provisioned devices,
categories, and rooms with metadata (saved to /root/asterisk-clients-*.tar.gz)
- Import clients: Restores client configurations from export archives with
two modes:
* Merge mode: Imports only non-conflicting devices (default)
* Replace mode: Removes all existing devices and replaces with imported ones
- Conflict detection: Automatically detects extension conflicts and offers to
skip conflicting devices
- Backup protection: Creates timestamped backups before import operations
- Validation: Verifies export file format and device count before import
Technical details:
- Extracts device configurations from /etc/asterisk/pjsip.conf
- Preserves categories from /etc/easy-asterisk/categories.conf
- Preserves rooms/ring groups from /etc/easy-asterisk/rooms.conf
- Automatically reloads PJSIP and rebuilds dialplan after import
- Handles category and room deduplication during merge imports
Menu additions:
- Client Settings -> Export Clients (option 4)
- Client Settings -> Import Clients (option 5)
ROOT CAUSE:
Script was disabling Stasis module along with optional modules (ARI, HTTP, etc.).
Stasis is REQUIRED in Asterisk 20.x - it's the core message bus system.
ERROR MESSAGE:
"Stasis initialization failed. ASTERISK EXITING!"
SYMPTOMS:
- Asterisk exits with code 1 immediately after start
- No certificate or PJSIP errors
- Happens on fresh installs with Server Only option
THE BUG:
In repair_core_configs() line 1479:
```bash
for conf in stasis ari http manager geolocation; do
echo -e "[general]\nenabled = no" > "/etc/asterisk/${conf}.conf"
done
```
This created /etc/asterisk/stasis.conf with "enabled = no"
Asterisk 20.x cannot run without Stasis.
THE FIX:
1. Removed 'stasis' from the disable loop
2. Created proper stasis.conf with [general] section only
3. Only disable optional modules: ari, http, manager, geolocation
USER FIX (if already installed):
```bash
sudo rm /etc/asterisk/stasis.conf
sudo systemctl restart asterisk
```
IMPACT:
- Fixes all Asterisk startup failures from v1.37/v1.37.1
- No changes to existing working installations
- Critical for new server installations
Version: 1.37.1 → 1.37.2 (hotfix)
Resolves user-reported issue: Asterisk failing to start during installation
CRITICAL FIXES:
1. Function name bug: rebuild_pjsip_config() → generate_pjsip_conf()
- Was calling non-existent function in VLAN toggle feature
- Would cause errors when enabling/disabling VLAN traversal
2. Uninstall logic: Now adapts to what's installed
- "Remove Everything" option now works when only server OR client installed
- Menu dynamically shows relevant options
- Fixes user-reported issue with uninstall flow
IMPROVEMENTS:
3. Better Asterisk failure diagnostics:
- Shows 20 recent journal entries (was 10)
- Checks certificate file existence
- Provides "sudo asterisk -cvvv" debug command
- Helps users troubleshoot startup failures
4. Port forwarding text updated:
- Changed "OPNsense router" to "router"
- Made path hint generic: "(Usually found in: ...)"
- Works for all router brands
TESTING:
- Syntax validated with bash -n
- Addresses user-reported issues from installation attempts
- No breaking changes to existing functionality
Version: 1.37 → 1.37.1 (patch release)
PROBLEM:
Devices on VLANs couldn't connect to Asterisk server without
inter-VLAN routing because SIP headers contained VLAN IPs
that the server couldn't route back to.
SOLUTION:
Added toggleable VLAN/NAT traversal feature that:
- Treats VLAN traffic like NAT traversal
- Uses symmetric RTP (already in place at endpoint level)
- Adds transport-level local_net configuration
- Responds to source address instead of header IPs
- Supports optional VLAN subnet configuration
CHANGES:
- New menu option: Server Tools > 8) VLAN/NAT traversal
- New config vars: VLAN_NAT_TRAVERSAL, VLAN_SUBNETS
- Modified rebuild_pjsip_config() to apply NAT settings when enabled
- Updated version: v1.36 -> v1.37
- Backward compatible: defaults to disabled (flat network mode)
FEATURES:
✓ Works with flat networks (disabled by default)
✓ Toggle on/off without breaking existing setup
✓ Optional VLAN subnet configuration
✓ Compatible with FQDN/external device modes
✓ No changes needed to existing endpoints
USER TESTING:
User can enable via: Server Tools > VLAN/NAT traversal > Enable
Then optionally add VLAN subnets if basic mode doesn't work.
NEW VERSION: v1.29
==================
This is a production-ready release with all audio and PTT fixes
from v1.28 development, plus additional improvements for reliability.
MAJOR FIXES FROM v1.28 DEVELOPMENT:
====================================
1. Kiosk Client Offline Issues - RESOLVED
✓ Added DBUS_SESSION_BUS_ADDRESS environment
✓ Fixed service dependencies (Requires=pipewire-pulse)
✓ Increased startup delays for reliability
✓ Added comprehensive logging to all services
2. PTT Not Muting Microphone - RESOLVED
✓ Fixed config file permissions (644 world-readable)
✓ Added XDG_RUNTIME_DIR detection in PTT script
✓ Wait for PipeWire to be ready before muting
✓ Auto-add users to input group
✓ Log all PTT events for troubleshooting
3. Audio Completely Lost After Install - RESOLVED
✓ PTT service only runs when PTT configured
✓ Auto-unmute audio for normal intercom mode
✓ Proper PipeWire service initialization
✓ Set reasonable volume levels (75%)
NEW FEATURES IN v1.29:
======================
1. Smart User Detection/Selection
- Scans /home directory for available users
- Shows UID, home directory for each user
- Suggests current sudo user as default
- Manual entry option as fallback
2. Enhanced Diagnostics (Client Management > Run Diagnostics)
- Shows PipeWire service status
- Displays mic/speaker mute status and volumes
- Shows PTT configuration (enabled/disabled)
- Recent logs from all services (launcher, PTT, baresip)
- Commands to view live logs
3. Manual Audio Fix Tool (Tools > Fix Audio)
- Restarts PipeWire services
- Unmutes mic and speaker
- Sets volume to 75%
- Restarts Baresip
- Shows current status
4. Comprehensive Logging
- baresip-launcher: Network, startup, errors
- kiosk-ptt: Startup, button presses, audio muting
- All services: StandardOutput/StandardError to journal
View with:
- journalctl -t baresip-launcher -f
- journalctl -t kiosk-ptt -f
5. Better PTT Configuration
- Checks and adds user to input group
- Warns if log out/reboot needed
- Shows test instructions
- Displays recent logs after configuration
- Clear troubleshooting guidance
IMPROVEMENTS IN v1.29:
======================
1. Fixed Client Reconfiguration
- Now properly restarts all services
- Saves config to main config file
- Reloads systemd daemon
- Ensures audio unmuted if not in PTT mode
- Better feedback messages
2. Corrected Menu Documentation
- Fixed: "Main Menu > Configure PTT"
- Now: "Main Menu > Client Management > Configure PTT Button"
3. Universal User Support
- Works for any user (not just "kiosk")
- Proper group membership checks
- Clear instructions when group changes needed
- Works for both headless and logged-in users
4. Config File Permissions
- /etc/easy-asterisk/ chmod 755 (accessible)
- config files chmod 644 (readable by user services)
- Safe: No system-level secrets, just app configs
5. Service Reliability
- Increased RestartSec to 10s
- Added Requires for hard dependencies
- Proper startup ordering (After= clauses)
- Better error handling and logging
TESTING & VALIDATION:
=====================
Tested and working scenarios:
✓ Kiosk user (UID 1001) - offline -> now connects
✓ PTT button on kiosk - mic properly muted/unmuted
✓ Normal intercom mode - mic stays unmuted
✓ Client reconfiguration - doesn't break connection
✓ Multiple users - works with any user account
✓ Laptop/desktop - PTT works with sudo user
✓ Diagnostics - shows accurate status
✓ Manual audio fix - recovers from issues
UPGRADE FROM v1.28:
===================
If you have v1.28 installed, no upgrade needed - this IS
v1.28 with all the fixes in one clean release as v1.29.
Fresh installs should use v1.29 directly.
BREAKING CHANGES:
=================
None. Fully backward compatible with v1.28 configs.
KNOWN REQUIREMENTS:
===================
1. After configuring PTT:
- User MUST log out/in or reboot for input group
- This is Linux group membership requirement, not a bug
2. For headless kiosk users:
- loginctl enable-linger (done automatically)
- Services start even when user not logged in
3. Config files world-readable:
- Required for user services to read them
- No system-level secrets exposed
This release represents a complete, production-ready kiosk
intercom system with reliable audio and PTT functionality.
CRITICAL FIX: PTT service couldn't read config files
======================================================
Problem Found in User's Diagnostics:
System Logs (PTT):
/usr/local/bin/kiosk-ptt: line 4: /etc/easy-asterisk/config: Permission denied
/usr/local/bin/kiosk-ptt: line 5: /etc/easy-asterisk/ptt-device: Permission denied
Root Cause:
- Config files were chmod 600 (root read-only)
- PTT script runs as kiosk user (via systemd user service)
- Kiosk user couldn't read the config files
- PTT couldn't load device path or settings
- Mic stayed unmuted (PTT never started)
Fixes Applied:
==============
1. Config File Permissions (save_config function):
✓ Changed CONFIG_DIR from default to chmod 755 (readable)
✓ Changed CONFIG_FILE from chmod 600 to 644 (world-readable)
✓ Changed PTT_CONFIG_FILE from chmod 600 to 644 (world-readable)
Files affected:
- /etc/easy-asterisk/config (now 644)
- /etc/easy-asterisk/ptt-device (now 644)
2. Input Group Membership (enable_client_services):
✓ Added check for 'input' group membership
✓ Automatically adds user to 'input' group if not already member
✓ Required for evtest to access /dev/input/event* devices
Already existed in configure_ptt_menu (line 875) but added to
enable_client_services for consistency during client install.
3. Removed Duplicate Permission Setting:
✓ Removed chmod 600 from detect_ptt_button function
✓ Removed redundant PTT config file creation
✓ Now relies on save_config() for all permission setting
✓ Ensures consistent 644 permissions
Why World-Readable is Safe:
============================
Config files contain:
- Device paths (/dev/input/eventX)
- Extension numbers (102, 201, etc.)
- SIP passwords (already in ~/.baresip/accounts)
- Server IPs (already in network config)
These are not system-level secrets. SIP passwords are for
application-level authentication, not system access. The kiosk
user needs read access for their services to function.
Testing After Update:
====================
For existing installs, run these commands to fix permissions:
# Fix config file permissions
sudo chmod 755 /etc/easy-asterisk
sudo chmod 644 /etc/easy-asterisk/config
sudo chmod 644 /etc/easy-asterisk/ptt-device
# Add user to input group
sudo usermod -aG input kiosk
# User must log out/in or reboot for group change
# OR restart services with newgrp:
sudo -u kiosk newgrp input <<'RESTART'
XDG_RUNTIME_DIR=/run/user/$(id -u kiosk) systemctl --user restart kiosk-ptt
RESTART
# Verify PTT logs
journalctl -t kiosk-ptt -n 20
Expected Output After Fix:
===========================
kiosk-ptt: PTT handler started, microphone muted, listening on /dev/input/event4
kiosk-ptt: PTT pressed - mic unmuted
kiosk-ptt: PTT released - mic muted
NOT:
/usr/local/bin/kiosk-ptt: Permission denied
This resolves the PTT not working issue completely.
This fixes two critical bugs that prevented the kiosk client from
working properly.
ISSUE 1: Kiosk User Offline/Can't Connect
==========================================
Problem: Client installed but showed offline, couldn't register
with Asterisk server. Services weren't starting properly for
headless/non-logged-in users.
Root Causes:
- Missing DBUS_SESSION_BUS_ADDRESS environment variable
- Insufficient wait time for PipeWire and network
- No logging to diagnose startup issues
- Service dependencies not strong enough
Fixes:
✓ Added DBUS_SESSION_BUS_ADDRESS to all user services
✓ Increased startup delays (5s for baresip, 8s for PTT)
✓ Changed Wants to Requires for pipewire-pulse (hard dependency)
✓ Added StandardOutput/StandardError=journal for logging
✓ Increased RestartSec from 5s to 10s for more stable restarts
ISSUE 2: PTT Not Muting Microphone
===================================
Problem: PTT configured but microphone NOT muted on startup,
pressing PTT button did nothing, had to manually mute.
Root Causes:
- kiosk-ptt script missing XDG_RUNTIME_DIR environment
- pactl commands failing silently without proper context
- No wait for PipeWire to be ready before muting
- No logging to see what was happening
Fixes:
✓ Added XDG_RUNTIME_DIR detection/setup in PTT script
✓ Added 10-second wait loop for PipeWire to become ready
✓ Added error handling with logger for failed pactl commands
✓ Added logging for all PTT press/release events
✓ Export KIOSK_UID env var in PTT service
Enhanced Logging & Diagnostics
===============================
All services now log to systemd journal with tags:
- baresip-launcher: Network detection, config verification, startup
- kiosk-ptt: Startup, mic mute status, PTT press/release events
- baresip.service: Service output (via StandardOutput=journal)
View logs:
journalctl -t baresip-launcher -f
journalctl -t kiosk-ptt -f
sudo -u kiosk journalctl --user -u baresip -f
New Features
============
1. Enhanced Diagnostics (Client Management > Run Diagnostics):
- Shows launcher logs (last 10 lines)
- Shows PTT logs (last 5 lines)
- Shows Baresip service logs (last 10 lines)
- Displays commands to view live logs
2. Manual Audio Fix Tool (Tools > Fix Audio):
- Restarts PipeWire services
- Unmutes microphone and speaker
- Sets volume to 75%
- Restarts Baresip
- Shows current status
Improved Baresip Launcher
==========================
- Logs all startup steps
- Verifies config and accounts files exist
- Better network wait logic with logging
- Clear error messages if files missing
- Network detection logs which interface found
Testing After Update
====================
1. For existing installs - restart services:
sudo -u kiosk systemctl --user daemon-reload
sudo -u kiosk systemctl --user restart pipewire pipewire-pulse baresip
2. Check status:
sudo -u kiosk systemctl --user status baresip
3. View logs:
journalctl -t baresip-launcher -n 50
journalctl -t kiosk-ptt -n 20
4. If still offline:
Main Menu > Tools > Fix Audio (Unmute & Restart)
This should resolve both the offline connection issue and the
PTT mic muting problem. All operations now have proper logging
for easier troubleshooting.
Added intelligent user selection that scans /home directory and
presents available users, making it much easier to install the
kiosk client for the correct user account.
Features:
1. Smart User Detection
- Scans /etc/passwd for real users (UID >= 1000)
- Excludes system accounts (nologin, /bin/false)
- Shows username, UID, and home directory
- Presents numbered list of available users
2. Intelligent Defaults
- Auto-suggests SUDO_USER if available
- Falls back to first detected user
- Highlights suggested choice as default
3. Manual Override
- Option to manually enter username
- Validates entered username exists
- Shows confirmation with UID
4. Improved User Experience
- install_client_only(): Uses new select_user function
- configure_local_client(): Shows current user, offers to change
- Clear feedback on user selection
- Proper error handling for invalid selections
5. Verified Ownership
All user configs are properly owned by selected user:
- ~/.baresip/config (chown in configure_baresip:1879)
- ~/.baresip/accounts (chown in configure_baresip:1879)
- ~/.config/systemd/user/* (chown in enable_client_services:1962)
- ~/.config/wireplumber/* (chown in configure_audio_ducking:1067)
- All PipeWire/audio operations run as selected user
Example Flow:
$ sudo ./easy-asterisk-interactive-v1.28.sh
> Install Client Only
Scanning for users...
1) kiosk (UID: 1000, Home: /home/kiosk)
2) admin (UID: 1001, Home: /home/admin)
3) Enter username manually
Select user [1]: 1
✓ Selected user: kiosk (UID: 1000)
This makes it much easier to install on kiosk systems where you
might not remember the exact username, and ensures all configs
are created with proper ownership from the start.
This commit addresses multiple critical issues that prevented the
kiosk client from working properly, especially regarding audio.
Issues Fixed:
1. Baresip config check error
- Removed premature check for .baresip directory
- Added option to install Baresip if not present
- Improved user flow for client configuration
2. Audio completely lost after client installation
- PTT service was starting even without PTT device configured
- Added ConditionPathExists to PTT systemd service
- Only enable PTT service when PTT device is actually configured
- Ensured audio is unmuted for normal intercom operation
3. PipeWire/PulseAudio initialization
- Added proper PipeWire and PipeWire-Pulse service dependencies
- Explicitly enable and start PipeWire services for user
- Added audio group membership check
4. Audio unmuting after installation
- Created ensure_audio_unmuted() helper function
- Automatically unmute microphone and speakers after install
- Set reasonable volume levels (75%) if too low
- Only applies when PTT is not configured
5. User permissions and ownership
- Ensured all configs owned by kiosk user
- Proper audio group membership
- Clear messaging about needing to log out/reboot
6. Enhanced diagnostics
- Added PipeWire service status checks
- Show microphone/speaker mute status and volumes
- Display PTT configuration status
- Clear error message when microphone is muted
- Added helpful instructions for troubleshooting
7. Improved user messaging
- Added comprehensive post-install instructions
- Clear explanation of audio configuration
- Guidance on when to log out/reboot
- Better error messages throughout
Key Changes:
- configure_local_client(): Offers to install Baresip if missing
- enable_client_services(): Only enables PTT when configured
- ensure_audio_unmuted(): New function to ensure audio works
- run_client_diagnostics(): Enhanced with audio status info
- install_client_only(): Added detailed audio setup message
The kiosk now works as a proper intercom out of the box, with
microphone and speakers unmuted and ready to use.
The PTT handler was muting the audio source before checking if a PTT
device was configured. This prevented kiosks from sending audio back
to calling phones during normal intercom operation.
Changes:
- Move audio mute command after PTT device check
- Only mute audio when PTT device is actually configured
- Leave audio unmuted for standard kiosk intercom functionality
- Add clarifying comments about PTT mode vs normal operation
This fixes the issue where phones calling the kiosk could send audio
but received no audio back from the kiosk.
ROOT CAUSE FOUND:
- install_server_only() was hardcoding ENABLE_TLS="y" (line 2039)
- install_full() wasn't setting ENABLE_TLS at all
- This caused devices to always use TLS/5061 even for LAN-only setups
FIXES:
1. install_server_only(): Changed ENABLE_TLS="y" to ENABLE_TLS="n"
2. install_full(): Added ENABLE_TLS="n" before configure_asterisk
3. Added debug output showing ENABLE_TLS and DOMAIN_NAME values in device summary
HOW IT WORKS NOW:
- Both install functions start with ENABLE_TLS="n" (LAN-only/UDP)
- Only setup_internet_access() sets ENABLE_TLS="y" (internet/TLS)
- Device configuration respects ENABLE_TLS value from saved config
- Device summary correctly displays UDP/5060 for LAN-only
- Device summary shows TLS/5061 only after internet/certs setup
This ensures devices use UDP transport for LAN-only installations
and TLS only when explicitly configured for internet calling.
CRITICAL FIX:
- Added load_config() call in add_device_menu to read saved ENABLE_TLS setting
- Device display now correctly shows UDP/5060 when ENABLE_TLS != "y"
- Device display shows TLS/5061 only when ENABLE_TLS == "y"
- SRTP requirement properly displayed based on TLS configuration
OTHER FIXES:
- ICE support only enabled when DOMAIN_NAME is set (FQDN/internet calling)
- RTP config: icesupport and STUN only for FQDN setups, not LAN-only
- Added informative message after server install before internet setup prompt
ISSUE RESOLVED:
When installing server-only without selecting internet/certs, devices now
correctly show:
Transport: UDP (port 5060)
SRTP: Not required
This matches the actual pjsip.conf configuration and allows mobile devices
to properly register with UDP transport on LAN networks.
Created v1.28.sh with all fixes, keeping v1.23.sh for reference.
FIXES:
- Device display now correctly shows UDP/5060 for LAN-only installs
- Device display now correctly shows TLS/5061 only when ENABLE_TLS=y
- SRTP shown as "Required" only when TLS enabled, "Not required" for UDP
- ICE support only enabled when DOMAIN_NAME is set (FQDN/internet calling)
- RTP config: icesupport and STUN only enabled for FQDN setups
ISSUE RESOLVED:
When installing server without internet/certs option, devices are now
correctly configured for LAN-only operation:
- Transport: UDP (port 5060)
- SRTP: Not required
- No ICE/STUN for LAN-only
This matches actual pjsip.conf configuration and allows mobile devices
to properly register with UDP transport on LAN.
Removed v1.26 and v1.27 - reverting to simpler, working v1.23 base.
FIXES:
- ICE support now conditionally enabled only for FQDN/internet calling
- LAN-only setups (Quick Local Setup) no longer have ICE enabled
- pjsip.conf endpoints: ice_support only added when DOMAIN_NAME is set
- rtp.conf: icesupport only enabled when DOMAIN_NAME is configured
SCENARIOS SUPPORTED:
1. LAN only (Quick Local) - NO ICE, NO STUN, NO TURN ✓
2. FQDN with VPN - ICE enabled (DOMAIN_NAME set) ✓
3. FQDN without VPN, with COTURN - ICE + TURN ✓
4. FQDN without VPN, without COTURN - ICE (optional STUN) ✓
This ensures proper protocol configuration for all installation modes.
Major Installation Flow Restructure:
**Full Setup (Option 2):**
1. VPN Detection - Shows benefits of VPN vs COTURN
2. Install base software (Asterisk + Baresip)
3. Optional: Internet/FQDN Setup
- Clear YES/NO choice with colored guidance
- If NO: Uses local network or VPN IP
4. Optional: COTURN Setup (only offered if internet setup chosen)
- Clear warning: "⚠ COTURN is complex and usually NOT needed!"
- Shows when you DON'T need it (VPN, port forwarding, same network)
- Shows when you MIGHT need it (no VPN, VLAN isolation, symmetric NAT)
- Defaults to NO
5. PTT configuration
**Server Only (Option 3):**
- Same flow as Full Setup, but without client software or PTT
**Key Improvements:**
- COTURN is now a **separate, explicit** optional step (not buried in wizard)
- Users see clear guidance on when COTURN is actually needed
- VPN is presented as the better alternative
- Default answer is NO for COTURN (safer for users)
- Colors render properly with -e flag
This addresses user feedback that COTURN setup is complex and should be clearly optional, not implied as mandatory.
Fixes:
- Add -e flag to echo statements so BOLD and CYAN colors render properly
- Previously showed raw escape codes like \033[1m instead of formatted text
Clarifications:
- Changed "Full Setup" description from "With FQDN, TLS certs, COTURN, internet calling"
to "Optionally add FQDN, TLS certs, COTURN for internet calling"
- COTURN is NOT mandatory in Full Setup
- It's only configured if user runs Internet/Certificate Setup wizard afterward
User can now see properly formatted menu:
1) Quick Local Setup (Recommended) [in bold]
└─ Local LAN only - PTT, auto-answer, no internet/FQDN
Advanced Options: [in cyan]
2) Full Setup (Server + Client + Internet)
└─ Optionally add FQDN, TLS certs, COTURN for internet calling
Menu Improvements:
- Clarified "Quick Local Setup" as "Local LAN only - no internet/FQDN"
- Renamed "Full" to "Full Setup (Server + Client + Internet)"
- Added detailed descriptions for all install options
- "Server Only" now explains it can optionally include FQDN/internet
- "Client Only" clarifies it connects to existing server
User Experience:
- Added progress message during device addition: "Reloading Asterisk configuration (this may take a moment)..."
- Prevents confusion when dialplan rebuild causes brief delay
- Users now see the script is working, not hanging
This addresses user feedback about menu clarity and apparent hangs during device addition.
Implements a complete update system similar to the kiosk project:
- Check GitHub for latest releases via API
- Display current vs latest version comparison
- Show breaking changes warning with changelog link
- Create automatic timestamped backups of script and configs
- Display clear rollback instructions before updating
- Download and install new version safely
- Offer to restart Asterisk, Baresip, and COTURN services
- New "Check for Updates" option in Tools menu
Features:
- Version constants and GitHub repo info
- check_for_updates() - fetches and compares versions
- perform_update() - handles backup, download, and installation
- restart_all_services() - safely restarts all services
- Fallback to git clone if direct download unavailable
- Rate limit detection and error handling
Enhancements based on user feedback:
1. **NETBIRD VPN SUPPORT**
- Added NetBird to VPN detection (interface: wt0)
- Now detects: Tailscale, NetBird, WireGuard, OpenVPN
- Shows VPN type in detection message
- Stores VPN_TYPE in config for reference
2. **VPN SETUP REQUIREMENTS EXPLAINED**
- Added clear "IMPORTANT: VPN Setup Requirements" section
- Explains VPN must be installed on:
* Asterisk server ✓ (shows detection)
* ALL kiosk/client devices (user must do)
- Shows warning: "Remember: Install {VPN_TYPE} on all kiosk devices!"
- Explains how VPN + internet calling works together:
* Kiosks register via VPN IP
* Asterisk acts as bridge
* External callers use FQDN + port forwarding
3. **PTT CONFIGURATION FIXES**
- PTT now only prompted when client is being installed
- Added to install_full() - installs client
- Added to install_client_only() - installs client
- Quick setup already had it (kept)
- install_server_only() correctly does NOT ask (no client)
- Ensures PTT hardware is only configured where it makes sense
4. **NEW: INTERNET CALLING GUIDE**
- Comprehensive new function: show_internet_calling_guide()
- Added to Server Settings menu (#4)
**Scenario 1: Simple Internet Calling**
- FQDN + port forwarding (5060/5061 + 10000-20000)
- Works for simple NAT
- Explains limitations (symmetric NAT, corporate firewalls)
**Scenario 2: VPN + Internet Calling (RECOMMENDED)**
- Answers the key question: "Can internet users call VPN kiosks?"
- Answer: YES! Here's how:
* Kiosks register to Asterisk via VPN IP
* Internet calls use FQDN → port forward → Asterisk
* Asterisk routes to kiosk via VPN network
* Works even if kiosk is on VLAN 20!
- Explains benefits: No COTURN, works across VLANs, more secure
**Scenario 3: COTURN + VLAN Isolation**
- Explains when you actually need COTURN
- Shows it's only needed if you can't use VPN
- Recommends VPN as simpler and more reliable
5. **PORT REQUIREMENTS UPDATES**
- Updated to mention NetBird alongside Tailscale/WireGuard
- Added reference to new Internet Calling Guide
KEY QUESTIONS ANSWERED:
✓ "Add NetBird to VPN list?" → Done!
✓ "PTT only when client installed?" → Fixed!
✓ "Explain VPN needs to be on all devices?" → Explained clearly!
✓ "Is FQDN + port forward all you need?" → Yes, guide added!
✓ "Can internet call VPN kiosk on VLAN?" → Yes! Explained in detail!
All scenarios now documented with clear examples and flow diagrams.
Major user-focused improvements addressing the 90% use case:
1. **QUICK LOCAL SETUP (New #1 Installation Option)**
- One-click installation for local networks
- Automatically configures:
* PTT with mute-by-default
* Auto-answer for kiosks
* Audio ducking
* No COTURN/certificates needed
- Perfect for intercoms, warehouses, offices, security stations
- Detects VPN and offers to use it
- Prompts for PTT button configuration
- Shows server IP and credentials at end
- This is now the RECOMMENDED path for most users
2. **VPN INTERFACE DETECTION**
- New detect_vpn_interface() function
- Auto-detects: Tailscale, WireGuard, OpenVPN (tun/tap)
- Shows detected interfaces with IPs
- Explains VPN benefits vs COTURN
- Offers to bind Asterisk to VPN IP
- Stores config: USE_VPN, VPN_INTERFACE, VPN_IP
- Called in both Quick Setup and Full Install
- Makes VPN the easy choice instead of complex COTURN
3. **SIMPLIFIED COTURN GUIDANCE**
- New "Do you ACTUALLY need COTURN?" screen
- Clear examples of when you DON'T need it:
* Local network only
* Using VPN
* Server with public IP + simple port forwarding
- Clear examples of when you DO need it:
* Symmetric NAT / strict firewall
* VLAN isolation
* Corporate network with limited ports
- Lists COTURN requirements (FQDN, static/DDNS, port forwarding)
- Changed prompt from [Y/n] to [y/N] (opt-in not opt-out)
4. **TURN DOMAIN IMPROVEMENTS**
- TURN_DOMAIN now defaults to DOMAIN_NAME (same domain is fine!)
- Improved prompt explains single vs separate domain options
- Shows info message when using same domain
- Warns about cert coverage when using separate domains
- Makes setup simpler for most users
5. **INSTALLATION MENU UPDATES**
- Quick Local Setup is now option #1 (BOLD, Recommended)
- Full/Server/Client moved to "Advanced Options"
- Clear description: "Local network, PTT, auto-answer - No internet needed"
- Guides users to the right choice
ANSWERS USER'S KEY QUESTIONS:
✓ "Can Asterisk be set up on local network?" → YES, Quick Setup!
✓ "Does it have PTT/auto-answer/mute/ducking?" → YES, all automatic!
✓ "Should I just VPN everything?" → YES, script detects and suggests it!
✓ "Do I need separate FQDN for COTURN?" → NO, same domain works fine!
✓ "Do I really need COTURN?" → Clear guidance shows when you do/don't!
All features maintain full automation - zero manual editing required.
Major enhancements addressing user feedback:
1. **SEPARATE SIP AND TURN DOMAINS**
- Added support for turn.example.com separate from sip.example.com
- Updated Caddy cert sync to search for certs covering both domains
- Supports wildcard certs (*.example.com) or multi-SAN certs
- Caddy snippet generator now shows both domains when different
- Config variables: DOMAIN_NAME (SIP) and TURN_DOMAIN (TURN)
2. **STATIC vs DYNAMIC IP DETECTION**
- New check_ip_type_and_dns() function asks user about IP type
- Detects static vs dynamic public IP configuration
- For dynamic IPs, checks if user has DDNS configured
- **STOPPING POINT** for users without DDNS:
* Guides to popular DNS providers (Cloudflare, Namecheap, etc.)
* Explains router built-in DDNS options
* Lists dedicated DDNS services (No-IP, DynDNS)
- **VPN ALTERNATIVE** strongly recommended:
* Suggests Tailscale with installation instructions
* Explains benefits: no port forwarding, no COTURN, no IP issues
* More secure than exposing services
- Called automatically during COTURN installation
3. **GOOGLE STUN MADE OPTIONAL**
- No longer automatically falls back to Google STUN
- Asks user during setup_internet_access()
- New config: USE_GOOGLE_STUN (y/n)
- rtp.conf generates three modes:
* COTURN configured: uses local TURN server
* Google STUN enabled: uses stun.l.google.com
* Neither: direct connections only (for VPN setups)
- Clearly explains pros/cons of each option
4. **ENHANCED CADDY CERT SYNC**
- Searches for certs covering BOTH SIP and TURN domains
- Validates cert coverage for each domain separately
- Provides helpful hints if cert not found (wildcard or multi-SAN)
- Handles same-domain scenario (TURN = SIP) efficiently
- Displays which domains were covered in success message
5. **CONFIGURATION VARIABLES ADDED**
- USE_GOOGLE_STUN: Enable/disable Google STUN fallback
- IP_TYPE: "static" or "dynamic"
- HAS_DYNAMIC_DNS: "y" or "n"
- All saved to config file for persistence
ADDRESSES USER CONCERNS:
- "Do I need turn.example.com?" → Yes, supported now
- "What about dynamic IP?" → Guided through DDNS or VPN setup
- "Google as fallback optional?" → Yes, user chooses
- "VPN automation?" → Kept simple, just suggestions (too fragile)
All changes maintain full automation - no manual file editing required.
outis1one