# ================================================================
# Easy Asterisk - Environment Configuration
#
# Setup:
#   1. cp .env.example .env
#   2. Set DOMAIN_NAME (the only required setting)
#   3. docker compose up -d
#   4. docker exec -it easy-asterisk easy-asterisk
#
# Port forwarding required on your router:
#   5061/tcp        → SIP TLS signaling
#   3478/udp+tcp    → STUN/TURN (NAT traversal + media relay)
#                     (change with TURN_PORT if 3478 is taken)
#   10000-20000/udp → RTP media (or your custom range below)
#
# How it works:
#   - All SIP clients connect to DOMAIN_NAME:5061 (TLS)
#   - coturn handles NAT traversal (STUN) and media relay (TURN)
#   - Works from any network: LAN, cellular, Proton VPN, hotel WiFi
#   - TURN credentials are auto-generated if TURN_PASSWORD is empty
# ================================================================

# ── Domain Name (REQUIRED) ────────────────────────────────────
# The FQDN that points to this server's public IP.
# This is what SIP clients use to connect.
# Example: asterisk.yourdomain.com
DOMAIN_NAME=

# ── Public IP ─────────────────────────────────────────────────
# Your server's public IP address.
# Leave empty to auto-detect (uses ifconfig.me).
# Set manually if auto-detection fails (e.g., behind double NAT).
PUBLIC_IP=

# ── TLS ───────────────────────────────────────────────────────
# Always "y" for remote access. Self-signed certs are auto-generated.
# For trusted certs (no client warnings), mount your Let's Encrypt
# certs into /etc/asterisk/certs/ via docker compose volumes.
ENABLE_TLS=y

# ── Local Network ─────────────────────────────────────────────
# Your LAN CIDR. Auto-detected if empty.
# Example: 192.168.1.0/24
LOCAL_CIDR=

# ── Additional Subnets (optional) ─────────────────────────────
# Only needed for site-to-site VPNs or VLANs where the server
# has a direct route to client IPs (e.g., WireGuard, Tailscale).
#
# NOT needed for client-side VPNs (Proton, NordVPN, etc.)
# - Those clients appear with random public IPs
# - TURN handles media relay for them automatically
#
# Examples:
#   WireGuard:    VLAN_SUBNETS=10.8.0.0/24
#   Tailscale:    VLAN_SUBNETS=100.64.0.0/10
#   Multiple:     VLAN_SUBNETS=10.8.0.0/24 10.10.0.0/24
HAS_VLANS=n
VLAN_SUBNETS=

# ── TURN/STUN Settings ──────────────────────────────────────
# Used by coturn for TURN relay authentication.
# If TURN_PASSWORD is empty, a random password is generated on
# first startup and saved to /etc/easy-asterisk/config.
#
# These credentials are shared between coturn and Asterisk.
# SIP clients do NOT need these - only the server uses them.
TURN_USERNAME=easyasterisk
TURN_PASSWORD=

# ── TURN/STUN Port ──────────────────────────────────────────
# Default: 3478 (standard STUN/TURN port)
# Change if 3478 is already in use (e.g., UniFi controller uses 3478/udp).
# Common alternative: 3479
TURN_PORT=3478

# ── TURN Relay Port Range ─────────────────────────────────────
# Ports coturn uses for media relay. Forward this range on your router.
# Default is 100 ports (enough for ~50 simultaneous relayed calls).
# Most calls use direct paths; TURN relay is the fallback.
TURN_RELAY_MIN=49152
TURN_RELAY_MAX=49252

# ── RTP Port Range ────────────────────────────────────────────
# Asterisk's own RTP media ports. Forward this range on your router.
# Default: 10000-20000 (10,000 ports)
# For constrained environments: 10000-10200
RTP_START=10000
RTP_END=20000

# ── Web Admin ─────────────────────────────────────────────────
# HTTP management interface. Access via browser at:
#   http://your-server:8080/clients
#
# For HTTPS: put this behind Caddy or nginx reverse proxy,
# then set WEB_ADMIN_AUTH_DISABLED=true (let the proxy handle auth).
WEB_ADMIN_PORT=8080
WEB_ADMIN_AUTH_DISABLED=false