Claude
e6ef37b6bc
Asterisk doesn't need STUN/TURN in rtp.conf for this setup because: - It already knows its public IP via external_media_address in pjsip.conf - Its RTP ports are port-forwarded, so host ICE candidates are sufficient - stunaddr/turnaddr caused STUN gather timeouts (~27s) on every call, whether pointing at the FQDN (DNS TTL=0 bug) or localhost (UDP timeout) coturn is for SIP *clients* behind strict NAT — they configure TURN in their own app settings, independently of Asterisk's rtp.conf. ICE support remains enabled so Asterisk participates in ICE negotiation. https://claude.ai/code/session_01KWVtEt9MmZdywcu7WmgchX
100 lines
4.6 KiB
Bash
100 lines
4.6 KiB
Bash
# ================================================================
|
|
# Easy Asterisk - Environment Configuration
|
|
#
|
|
# Setup:
|
|
# 1. cp .env.example .env
|
|
# 2. Set DOMAIN_NAME (the only required setting)
|
|
# 3. docker compose up -d
|
|
# 4. docker exec -it easy-asterisk easy-asterisk
|
|
#
|
|
# Port forwarding required on your router:
|
|
# 5061/tcp → SIP TLS signaling
|
|
# 3478/udp+tcp → STUN/TURN (NAT traversal + media relay)
|
|
# (change with TURN_PORT if 3478 is taken)
|
|
# 10000-20000/udp → RTP media (or your custom range below)
|
|
#
|
|
# How it works:
|
|
# - All SIP clients connect to DOMAIN_NAME:5061 (TLS)
|
|
# - coturn handles NAT traversal (STUN) and media relay (TURN)
|
|
# - Works from any network: LAN, cellular, Proton VPN, hotel WiFi
|
|
# - Set TURN_PASSWORD below (generate one: openssl rand -base64 18)
|
|
# ================================================================
|
|
|
|
# ── Domain Name (REQUIRED) ────────────────────────────────────
|
|
# The FQDN that points to this server's public IP.
|
|
# This is what SIP clients use to connect.
|
|
# Example: asterisk.yourdomain.com
|
|
DOMAIN_NAME=
|
|
|
|
# ── Public IP ─────────────────────────────────────────────────
|
|
# Your server's public IP address.
|
|
# Leave empty to auto-detect (uses ifconfig.me).
|
|
# Set manually if auto-detection fails (e.g., behind double NAT).
|
|
PUBLIC_IP=
|
|
|
|
# ── TLS ───────────────────────────────────────────────────────
|
|
# Always "y" for remote access. Self-signed certs are auto-generated.
|
|
# For trusted certs (no client warnings), mount your Let's Encrypt
|
|
# certs into /etc/asterisk/certs/ via docker compose volumes.
|
|
ENABLE_TLS=y
|
|
|
|
# ── Local Network ─────────────────────────────────────────────
|
|
# Your LAN CIDR. Auto-detected if empty.
|
|
# Example: 192.168.1.0/24
|
|
LOCAL_CIDR=
|
|
|
|
# ── Additional Subnets (optional) ─────────────────────────────
|
|
# Only needed for site-to-site VPNs or VLANs where the server
|
|
# has a direct route to client IPs (e.g., WireGuard, Tailscale).
|
|
#
|
|
# NOT needed for client-side VPNs (Proton, NordVPN, etc.)
|
|
# - Those clients appear with random public IPs
|
|
# - TURN handles media relay for them automatically
|
|
#
|
|
# Examples:
|
|
# WireGuard: VLAN_SUBNETS=10.8.0.0/24
|
|
# Tailscale: VLAN_SUBNETS=100.64.0.0/10
|
|
# Multiple: VLAN_SUBNETS=10.8.0.0/24 10.10.0.0/24
|
|
HAS_VLANS=n
|
|
VLAN_SUBNETS=
|
|
|
|
# ── TURN/STUN Settings ──────────────────────────────────────
|
|
# Used by coturn for TURN relay authentication.
|
|
# If empty, defaults to "changeme" — set a real password for security.
|
|
# Generate one with: openssl rand -base64 18
|
|
#
|
|
# These credentials are for coturn only. SIP clients that need TURN
|
|
# relay (behind strict NAT) must configure the same credentials in
|
|
# their SIP app settings.
|
|
TURN_USERNAME=easyasterisk
|
|
TURN_PASSWORD=
|
|
|
|
# ── TURN/STUN Port ──────────────────────────────────────────
|
|
# Default: 3478 (standard STUN/TURN port)
|
|
# Change if 3478 is already in use (e.g., UniFi controller uses 3478/udp).
|
|
# Common alternative: 3479
|
|
TURN_PORT=3478
|
|
|
|
# ── TURN Relay Port Range ─────────────────────────────────────
|
|
# Ports coturn uses for media relay. Forward this range on your router.
|
|
# Default is 100 ports (enough for ~50 simultaneous relayed calls).
|
|
# Most calls use direct paths; TURN relay is the fallback.
|
|
TURN_RELAY_MIN=49152
|
|
TURN_RELAY_MAX=49252
|
|
|
|
# ── RTP Port Range ────────────────────────────────────────────
|
|
# Asterisk's own RTP media ports. Forward this range on your router.
|
|
# Default: 10000-20000 (10,000 ports)
|
|
# For constrained environments: 10000-10200
|
|
RTP_START=10000
|
|
RTP_END=20000
|
|
|
|
# ── Web Admin ─────────────────────────────────────────────────
|
|
# HTTP management interface. Access via browser at:
|
|
# http://your-server:8080/clients
|
|
#
|
|
# For HTTPS: put this behind Caddy or nginx reverse proxy,
|
|
# then set WEB_ADMIN_AUTH_DISABLED=true (let the proxy handle auth).
|
|
WEB_ADMIN_PORT=8080
|
|
WEB_ADMIN_AUTH_DISABLED=false
|