Vendor easy-asterisk source files; fix asterisk.sh and onlyoffice.sh
vendor/easy-asterisk/: All source files from outis1one/easy-asterisk v0.10.0 vendored so the repo is self-contained — no internet required at install time. Includes the real Dockerfile (FROM ubuntu:24.04 + full Asterisk stack), entrypoint.sh (IP detection, TLS cert gen, pjsip/rtp config, web admin), coturn-entrypoint.sh (robust IP detection wrapper), and the management script + diagnostic utilities. services/asterisk.sh: Rewritten to copy from vendor/ instead of downloading at runtime. Uses the upstream Dockerfile verbatim. Symlinks easy-asterisk-v0.10.0.sh → easy-asterisk.sh for build context compatibility. services/onlyoffice.sh: Complete rewrite with correct standalone bootstrap. _ensure_yq() installs yq v4 automatically (arch-aware). JWT secret is preserved across re-runs so rotating is explicit. _wire_nextcloud() and _wire_filebrowser() run on every install invocation (idempotent), skipping gracefully when containers aren't running rather than failing. https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt
This commit is contained in:
Claude
+130
-132
@@ -3,6 +3,7 @@
|
|||||||
# Part of the modular post-install system (sourced by setup.sh).
|
# Part of the modular post-install system (sourced by setup.sh).
|
||||||
#
|
#
|
||||||
# Based on https://github.com/outis1one/easy-asterisk
|
# Based on https://github.com/outis1one/easy-asterisk
|
||||||
|
# Source files vendored in vendor/easy-asterisk/
|
||||||
# Personal/home-lab use only. Not for commercial or emergency services.
|
# Personal/home-lab use only. Not for commercial or emergency services.
|
||||||
#
|
#
|
||||||
# Can also be run standalone on any machine:
|
# Can also be run standalone on any machine:
|
||||||
@@ -153,46 +154,64 @@ install_asterisk() {
|
|||||||
log_info "Installing Easy Asterisk PBX..."
|
log_info "Installing Easy Asterisk PBX..."
|
||||||
|
|
||||||
local EA_DIR="$DOCKER_DIR/asterisk"
|
local EA_DIR="$DOCKER_DIR/asterisk"
|
||||||
local EA_REPO="https://github.com/outis1one/easy-asterisk"
|
|
||||||
local EA_SCRIPT_URL="https://raw.githubusercontent.com/outis1one/easy-asterisk/main/easy-asterisk-v0.10.0.sh"
|
# Locate vendored source files (works when sourced by setup.sh or run standalone)
|
||||||
local EA_COTURN_URL="https://raw.githubusercontent.com/outis1one/easy-asterisk/main/docker/coturn-entrypoint.sh"
|
local _script_dir
|
||||||
|
_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)" \
|
||||||
|
|| _script_dir="$(dirname "$(realpath "$0" 2>/dev/null || echo "$0")")"
|
||||||
|
local VENDOR_DIR="$_script_dir/../vendor/easy-asterisk"
|
||||||
|
VENDOR_DIR="$(cd "$VENDOR_DIR" 2>/dev/null && pwd)" || VENDOR_DIR=""
|
||||||
|
|
||||||
|
if [[ -z "$VENDOR_DIR" || ! -f "$VENDOR_DIR/easy-asterisk-v0.10.0.sh" ]]; then
|
||||||
|
log_warning "Vendored easy-asterisk files not found at $VENDOR_DIR"
|
||||||
|
log_warning "Expected: vendor/easy-asterisk/ alongside services/ directory"
|
||||||
|
log_error "Cannot install — run from the ubuntu-post-install repo root."
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
if [ "$DRY_RUN" = true ]; then
|
if [ "$DRY_RUN" = true ]; then
|
||||||
echo "[DRY-RUN] Would create $EA_DIR"
|
echo "[DRY-RUN] Would create $EA_DIR"
|
||||||
echo "[DRY-RUN] Would download management script and coturn entrypoint"
|
echo "[DRY-RUN] Would copy vendored easy-asterisk files (Dockerfile, scripts, entrypoints)"
|
||||||
echo "[DRY-RUN] Would write docker-compose.yml, .env, Dockerfile"
|
echo "[DRY-RUN] Would write docker-compose.yml, .env"
|
||||||
echo "[DRY-RUN] Would open UFW ports for SIP/RTP/TURN"
|
echo "[DRY-RUN] Would open UFW ports for SIP/RTP/TURN"
|
||||||
return 0
|
return 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
mkdir -p "$EA_DIR/docker"
|
mkdir -p "$EA_DIR/docker" "$EA_DIR/scripts"
|
||||||
ensure_docker_dir_ownership "$EA_DIR"
|
ensure_docker_dir_ownership "$EA_DIR"
|
||||||
cd "$EA_DIR" || return 1
|
cd "$EA_DIR" || return 1
|
||||||
|
|
||||||
# ── Download management script ────────────────────────────────────────────
|
# ── Copy vendored source files ────────────────────────────────────────────
|
||||||
log_info "Downloading Easy Asterisk management script..."
|
log_info "Copying Easy Asterisk source files from vendor/..."
|
||||||
if curl -fsSL "$EA_SCRIPT_URL" -o "$EA_DIR/easy-asterisk.sh"; then
|
|
||||||
chmod 750 "$EA_DIR/easy-asterisk.sh"
|
|
||||||
chown "$ACTUAL_USER:$ACTUAL_USER" "$EA_DIR/easy-asterisk.sh"
|
|
||||||
log_success "Management script saved to $EA_DIR/easy-asterisk.sh"
|
|
||||||
else
|
|
||||||
log_warning "Could not download management script — check network or fetch manually from $EA_REPO"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# ── Download coturn custom entrypoint ─────────────────────────────────────
|
cp "$VENDOR_DIR/easy-asterisk-v0.10.0.sh" "$EA_DIR/easy-asterisk.sh"
|
||||||
if curl -fsSL "$EA_COTURN_URL" -o "$EA_DIR/docker/coturn-entrypoint.sh"; then
|
cp "$VENDOR_DIR/Dockerfile" "$EA_DIR/Dockerfile"
|
||||||
chmod 755 "$EA_DIR/docker/coturn-entrypoint.sh"
|
cp "$VENDOR_DIR/docker/entrypoint.sh" "$EA_DIR/docker/entrypoint.sh"
|
||||||
else
|
cp "$VENDOR_DIR/docker/coturn-entrypoint.sh" "$EA_DIR/docker/coturn-entrypoint.sh"
|
||||||
log_warning "Could not download coturn-entrypoint.sh — coturn may fail to start"
|
cp "$VENDOR_DIR/scripts/vpn-diagnostics.sh" "$EA_DIR/scripts/vpn-diagnostics.sh"
|
||||||
fi
|
cp "$VENDOR_DIR/scripts/dns-whitelist.sh" "$EA_DIR/scripts/dns-whitelist.sh"
|
||||||
|
|
||||||
|
chmod 750 "$EA_DIR/easy-asterisk.sh"
|
||||||
|
chmod 755 "$EA_DIR/docker/entrypoint.sh" "$EA_DIR/docker/coturn-entrypoint.sh"
|
||||||
|
chmod 755 "$EA_DIR/scripts/vpn-diagnostics.sh" "$EA_DIR/scripts/dns-whitelist.sh"
|
||||||
|
|
||||||
|
log_success "Source files copied"
|
||||||
|
|
||||||
|
# ── The Dockerfile expects these paths inside the build context ───────────
|
||||||
|
# vendor Dockerfile: COPY easy-asterisk-v0.10.0.sh → /usr/local/bin/easy-asterisk
|
||||||
|
# We copy as easy-asterisk.sh locally, so symlink the expected filename for the build
|
||||||
|
ln -sf easy-asterisk.sh "$EA_DIR/easy-asterisk-v0.10.0.sh"
|
||||||
|
|
||||||
# ── FQDN setup ────────────────────────────────────────────────────────────
|
# ── FQDN setup ────────────────────────────────────────────────────────────
|
||||||
echo ""
|
echo ""
|
||||||
echo " Easy Asterisk requires a domain name (FQDN) that points to this"
|
echo " Easy Asterisk can run in two modes:"
|
||||||
echo " server's public IP. SIP clients connect to this domain over TLS."
|
|
||||||
echo ""
|
echo ""
|
||||||
echo " For LAN-only use without a domain, leave this blank."
|
echo " LAN/VPN — UDP transport, no TLS, no TURN."
|
||||||
echo " (LAN mode uses UDP — no TLS, no coturn needed.)"
|
echo " Simple setup for devices on your local network or WireGuard/Tailscale."
|
||||||
|
echo ""
|
||||||
|
echo " FQDN — TLS + SRTP + coturn TURN relay."
|
||||||
|
echo " Works from anywhere: LAN, cellular, hotel WiFi, Proton VPN."
|
||||||
|
echo " Requires a domain name pointing to this server's public IP."
|
||||||
echo ""
|
echo ""
|
||||||
|
|
||||||
local DOMAIN_NAME=""
|
local DOMAIN_NAME=""
|
||||||
@@ -206,64 +225,35 @@ install_asterisk() {
|
|||||||
log_info "FQDN mode: $DOMAIN_NAME"
|
log_info "FQDN mode: $DOMAIN_NAME"
|
||||||
echo ""
|
echo ""
|
||||||
echo " Required router port forwards:"
|
echo " Required router port forwards:"
|
||||||
echo " 5061/tcp → SIP TLS signaling"
|
printf " %-22s %s\n" "5061/tcp" "SIP TLS signaling"
|
||||||
echo " 3478/udp+tcp → STUN/TURN (NAT traversal)"
|
printf " %-22s %s\n" "3478/udp+tcp" "STUN/TURN (NAT traversal)"
|
||||||
echo " 10000-20000/udp → RTP media"
|
printf " %-22s %s\n" "10000-20000/udp" "RTP media (Asterisk)"
|
||||||
echo " 49152-49252/udp → TURN relay range"
|
printf " %-22s %s\n" "49152-49252/udp" "TURN relay range (coturn)"
|
||||||
echo ""
|
echo ""
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# ── Generate passwords ────────────────────────────────────────────────────
|
# ── Generate TURN password ────────────────────────────────────────────────
|
||||||
local TURN_PASSWORD
|
local TURN_PASSWORD
|
||||||
TURN_PASSWORD="$(openssl rand -base64 18 2>/dev/null || tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)"
|
TURN_PASSWORD="$(openssl rand -base64 18 2>/dev/null | tr -dc 'a-zA-Z0-9' | head -c 24 \
|
||||||
|
|| tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)"
|
||||||
# ── Dockerfile ────────────────────────────────────────────────────────────
|
|
||||||
cat > Dockerfile << 'DOCKERFILE'
|
|
||||||
FROM ubuntu:24.04
|
|
||||||
|
|
||||||
ENV DEBIAN_FRONTEND=noninteractive
|
|
||||||
|
|
||||||
RUN apt-get update && apt-get install -y \
|
|
||||||
asterisk \
|
|
||||||
asterisk-core-sounds-en-gsm \
|
|
||||||
asterisk-modules \
|
|
||||||
ca-certificates \
|
|
||||||
openssl \
|
|
||||||
curl \
|
|
||||||
wget \
|
|
||||||
tcpdump \
|
|
||||||
sngrep \
|
|
||||||
net-tools \
|
|
||||||
iproute2 \
|
|
||||||
iputils-ping \
|
|
||||||
python3 \
|
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
|
||||||
|
|
||||||
# Management scripts (bind-mounted at runtime from host)
|
|
||||||
COPY easy-asterisk.sh /usr/local/bin/easy-asterisk
|
|
||||||
RUN chmod +x /usr/local/bin/easy-asterisk
|
|
||||||
|
|
||||||
EXPOSE 5060/udp 5060/tcp 5061/tcp
|
|
||||||
EXPOSE 8080/tcp 8088/tcp 8089/tcp
|
|
||||||
EXPOSE 3478/udp
|
|
||||||
EXPOSE 10000-10100/udp
|
|
||||||
|
|
||||||
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
|
||||||
CMD asterisk -rx "core show version" 2>/dev/null | grep -q "Asterisk" || exit 1
|
|
||||||
DOCKERFILE
|
|
||||||
|
|
||||||
# ── docker-compose.yml ────────────────────────────────────────────────────
|
# ── docker-compose.yml ────────────────────────────────────────────────────
|
||||||
cat > docker-compose.yml << COMPOSE
|
# Uses the real upstream Dockerfile (FROM ubuntu:24.04 + full Asterisk install)
|
||||||
# Easy Asterisk — generated by ubuntu-post-install
|
# with host networking for RTP/NAT, and the custom coturn entrypoint.
|
||||||
|
cat > docker-compose.yml << 'COMPOSE_EOF'
|
||||||
|
# Easy Asterisk — managed by ubuntu-post-install
|
||||||
# Manage: docker exec -it easy-asterisk easy-asterisk
|
# Manage: docker exec -it easy-asterisk easy-asterisk
|
||||||
# Source: $EA_REPO
|
# Source: https://github.com/outis1one/easy-asterisk
|
||||||
|
|
||||||
services:
|
services:
|
||||||
|
|
||||||
asterisk:
|
asterisk:
|
||||||
build: .
|
build:
|
||||||
|
context: .
|
||||||
|
dockerfile: Dockerfile
|
||||||
container_name: easy-asterisk
|
container_name: easy-asterisk
|
||||||
# Host networking: required for RTP (10000-20000/udp) and proper NAT detection
|
# Host networking: required for RTP (10000-20000/udp) and proper NAT detection.
|
||||||
|
# SIP clients connect directly to the host IP; Caddy is only used for the web admin.
|
||||||
network_mode: host
|
network_mode: host
|
||||||
depends_on:
|
depends_on:
|
||||||
coturn:
|
coturn:
|
||||||
@@ -274,23 +264,27 @@ services:
|
|||||||
- asterisk-logs:/var/log/asterisk
|
- asterisk-logs:/var/log/asterisk
|
||||||
- asterisk-spool:/var/spool/asterisk
|
- asterisk-spool:/var/spool/asterisk
|
||||||
- asterisk-lib:/var/lib/asterisk
|
- asterisk-lib:/var/lib/asterisk
|
||||||
- ./easy-asterisk.sh:/usr/local/bin/easy-asterisk:ro
|
|
||||||
environment:
|
environment:
|
||||||
- DOMAIN_NAME=\${DOMAIN_NAME}
|
- DOMAIN_NAME=${DOMAIN_NAME}
|
||||||
- ENABLE_TLS=\${ENABLE_TLS:-y}
|
- ENABLE_TLS=${ENABLE_TLS:-y}
|
||||||
- PUBLIC_IP=\${PUBLIC_IP:-}
|
- PUBLIC_IP=${PUBLIC_IP:-}
|
||||||
- LOCAL_CIDR=\${LOCAL_CIDR:-}
|
- LOCAL_CIDR=${LOCAL_CIDR:-}
|
||||||
- HAS_VLANS=\${HAS_VLANS:-n}
|
- HAS_VLANS=${HAS_VLANS:-n}
|
||||||
- VLAN_SUBNETS=\${VLAN_SUBNETS:-}
|
- VLAN_SUBNETS=${VLAN_SUBNETS:-}
|
||||||
- TURN_ENABLED=\${TURN_ENABLED:-y}
|
- TURN_ENABLED=${TURN_ENABLED:-y}
|
||||||
- TURN_SERVER=\${DOMAIN_NAME}:\${TURN_PORT:-3478}
|
- TURN_SERVER=${DOMAIN_NAME}:${TURN_PORT:-3478}
|
||||||
- TURN_USERNAME=\${TURN_USERNAME:-easyasterisk}
|
- TURN_USERNAME=${TURN_USERNAME:-easyasterisk}
|
||||||
- TURN_PASSWORD=\${TURN_PASSWORD}
|
- TURN_PASSWORD=${TURN_PASSWORD}
|
||||||
- RTP_START=\${RTP_START:-10000}
|
- RTP_START=${RTP_START:-10000}
|
||||||
- RTP_END=\${RTP_END:-20000}
|
- RTP_END=${RTP_END:-20000}
|
||||||
- WEB_ADMIN_PORT=\${WEB_ADMIN_PORT:-8080}
|
- WEB_ADMIN_PORT=${WEB_ADMIN_PORT:-8080}
|
||||||
- WEB_ADMIN_AUTH_DISABLED=\${WEB_ADMIN_AUTH_DISABLED:-false}
|
- WEB_ADMIN_AUTH_DISABLED=${WEB_ADMIN_AUTH_DISABLED:-false}
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "asterisk", "-rx", "core show version"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 3
|
||||||
|
|
||||||
coturn:
|
coturn:
|
||||||
image: coturn/coturn:latest
|
image: coturn/coturn:latest
|
||||||
@@ -301,17 +295,17 @@ services:
|
|||||||
volumes:
|
volumes:
|
||||||
- ./docker/coturn-entrypoint.sh:/coturn-entrypoint.sh:ro
|
- ./docker/coturn-entrypoint.sh:/coturn-entrypoint.sh:ro
|
||||||
environment:
|
environment:
|
||||||
- PUBLIC_IP=\${PUBLIC_IP:-}
|
- PUBLIC_IP=${PUBLIC_IP:-}
|
||||||
command:
|
command:
|
||||||
- -n
|
- -n
|
||||||
- --listening-port=\${TURN_PORT:-3478}
|
- --listening-port=${TURN_PORT:-3478}
|
||||||
- --listening-ip=0.0.0.0
|
- --listening-ip=0.0.0.0
|
||||||
- --fingerprint
|
- --fingerprint
|
||||||
- --lt-cred-mech
|
- --lt-cred-mech
|
||||||
- --user=\${TURN_USERNAME:-easyasterisk}:\${TURN_PASSWORD}
|
- --user=${TURN_USERNAME:-easyasterisk}:${TURN_PASSWORD}
|
||||||
- --realm=\${DOMAIN_NAME:-localhost}
|
- --realm=${DOMAIN_NAME:-localhost}
|
||||||
- --min-port=\${TURN_RELAY_MIN:-49152}
|
- --min-port=${TURN_RELAY_MIN:-49152}
|
||||||
- --max-port=\${TURN_RELAY_MAX:-49252}
|
- --max-port=${TURN_RELAY_MAX:-49252}
|
||||||
- --no-tls
|
- --no-tls
|
||||||
- --no-dtls
|
- --no-dtls
|
||||||
- --no-cli
|
- --no-cli
|
||||||
@@ -325,7 +319,7 @@ volumes:
|
|||||||
asterisk-logs:
|
asterisk-logs:
|
||||||
asterisk-spool:
|
asterisk-spool:
|
||||||
asterisk-lib:
|
asterisk-lib:
|
||||||
COMPOSE
|
COMPOSE_EOF
|
||||||
|
|
||||||
# ── .env ─────────────────────────────────────────────────────────────────
|
# ── .env ─────────────────────────────────────────────────────────────────
|
||||||
cat > .env << ENV
|
cat > .env << ENV
|
||||||
@@ -338,34 +332,33 @@ DOMAIN_NAME=$DOMAIN_NAME
|
|||||||
# Public IP — leave empty to auto-detect
|
# Public IP — leave empty to auto-detect
|
||||||
PUBLIC_IP=
|
PUBLIC_IP=
|
||||||
|
|
||||||
# TLS — set to 'n' for LAN-only mode
|
# TLS — always 'y' for remote access, 'n' for LAN-only
|
||||||
ENABLE_TLS=$( [[ "$LAN_ONLY" == "true" ]] && echo "n" || echo "y" )
|
ENABLE_TLS=$( [[ "$LAN_ONLY" == "true" ]] && echo "n" || echo "y" )
|
||||||
|
|
||||||
# Local network CIDR — auto-detected if empty
|
# Local network CIDR — auto-detected if empty
|
||||||
LOCAL_CIDR=
|
LOCAL_CIDR=
|
||||||
|
|
||||||
# Additional subnets for site-to-site VPNs (WireGuard, Tailscale mesh)
|
# Additional subnets for site-to-site VPNs (WireGuard/Tailscale mesh, NOT client-side)
|
||||||
# NOT needed for client-side VPNs (Proton, NordVPN) — TURN handles those
|
|
||||||
HAS_VLANS=n
|
HAS_VLANS=n
|
||||||
VLAN_SUBNETS=
|
VLAN_SUBNETS=
|
||||||
|
|
||||||
# TURN/STUN credentials (coturn)
|
# TURN/STUN credentials — must match in both Asterisk and coturn
|
||||||
# Generate new password: openssl rand -base64 18
|
# Regenerate: openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c 24
|
||||||
TURN_USERNAME=easyasterisk
|
TURN_USERNAME=easyasterisk
|
||||||
TURN_PASSWORD=$TURN_PASSWORD
|
TURN_PASSWORD=$TURN_PASSWORD
|
||||||
|
|
||||||
# TURN port (default 3478 — change if conflicting with UniFi controller)
|
# TURN port (change to 3479 if 3478 conflicts with UniFi controller or Mattermost)
|
||||||
TURN_PORT=3478
|
TURN_PORT=3478
|
||||||
|
|
||||||
# TURN relay port range (forward this range on your router)
|
# TURN relay port range — forward this range on your router
|
||||||
TURN_RELAY_MIN=49152
|
TURN_RELAY_MIN=49152
|
||||||
TURN_RELAY_MAX=49252
|
TURN_RELAY_MAX=49252
|
||||||
|
|
||||||
# RTP media port range
|
# RTP media port range — forward this range on your router
|
||||||
RTP_START=10000
|
RTP_START=10000
|
||||||
RTP_END=20000
|
RTP_END=20000
|
||||||
|
|
||||||
# Web admin interface port
|
# Web admin interface
|
||||||
WEB_ADMIN_PORT=8080
|
WEB_ADMIN_PORT=8080
|
||||||
WEB_ADMIN_AUTH_DISABLED=false
|
WEB_ADMIN_AUTH_DISABLED=false
|
||||||
ENV
|
ENV
|
||||||
@@ -376,18 +369,19 @@ ENV
|
|||||||
# ── UFW firewall rules ────────────────────────────────────────────────────
|
# ── UFW firewall rules ────────────────────────────────────────────────────
|
||||||
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
|
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
|
||||||
log_info "Opening UFW ports for Asterisk..."
|
log_info "Opening UFW ports for Asterisk..."
|
||||||
ufw allow 5060/udp comment "Asterisk SIP UDP"
|
ufw allow 5060/udp comment "Asterisk SIP UDP" >/dev/null
|
||||||
ufw allow 5060/tcp comment "Asterisk SIP TCP"
|
ufw allow 5060/tcp comment "Asterisk SIP TCP" >/dev/null
|
||||||
ufw allow 5061/tcp comment "Asterisk SIP TLS"
|
ufw allow 5061/tcp comment "Asterisk SIP TLS" >/dev/null
|
||||||
ufw allow 8080/tcp comment "Asterisk web admin"
|
ufw allow 8080/tcp comment "Asterisk web admin" >/dev/null
|
||||||
ufw allow 3478/udp comment "coturn STUN/TURN"
|
ufw allow 3478/udp comment "coturn STUN/TURN UDP" >/dev/null
|
||||||
ufw allow 3478/tcp comment "coturn STUN/TURN TCP"
|
ufw allow 3478/tcp comment "coturn STUN/TURN TCP" >/dev/null
|
||||||
ufw allow 10000:20000/udp comment "Asterisk RTP media"
|
ufw allow 10000:20000/udp comment "Asterisk RTP media" >/dev/null
|
||||||
ufw allow 49152:49252/udp comment "coturn TURN relay"
|
ufw allow 49152:49252/udp comment "coturn TURN relay" >/dev/null
|
||||||
log_success "UFW rules added"
|
log_success "UFW rules added"
|
||||||
else
|
else
|
||||||
log_info "UFW not active — open these ports manually if needed:"
|
log_info "UFW not active — open these ports manually if needed:"
|
||||||
log_info " 5060/udp+tcp, 5061/tcp, 3478/udp+tcp, 10000-20000/udp, 49152-49252/udp"
|
log_info " 5060/udp+tcp, 5061/tcp, 8080/tcp, 3478/udp+tcp"
|
||||||
|
log_info " 10000-20000/udp (RTP), 49152-49252/udp (TURN relay)"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$EA_DIR"
|
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$EA_DIR"
|
||||||
@@ -400,28 +394,32 @@ ENV
|
|||||||
# Easy Asterisk PBX
|
# Easy Asterisk PBX
|
||||||
|
|
||||||
Home intercom / VoIP system built on Asterisk with self-hosted coturn TURN server.
|
Home intercom / VoIP system built on Asterisk with self-hosted coturn TURN server.
|
||||||
Personal/home-lab use only. Source: $EA_REPO
|
Personal/home-lab use only. Source: https://github.com/outis1one/easy-asterisk
|
||||||
|
|
||||||
## Access
|
## Access
|
||||||
- Web admin: http://localhost:8080/clients
|
- Web admin: http://localhost:8080/clients
|
||||||
- FQDN mode: $( [[ -n "$DOMAIN_NAME" ]] && echo "$DOMAIN_NAME" || echo "(LAN-only — no domain configured)" )
|
- FQDN: $( [[ -n "$DOMAIN_NAME" ]] && echo "$DOMAIN_NAME" || echo "(LAN-only — no domain)" )
|
||||||
|
|
||||||
## Quick start
|
## Management
|
||||||
\`\`\`bash
|
\`\`\`bash
|
||||||
# Interactive management menu
|
# Interactive management menu (add devices, provisioning, diagnostics)
|
||||||
docker exec -it easy-asterisk easy-asterisk
|
docker exec -it easy-asterisk easy-asterisk
|
||||||
|
|
||||||
# Or run the script directly (requires the container to be running)
|
# VPN diagnostics
|
||||||
sudo bash $EA_DIR/easy-asterisk.sh
|
docker exec -it easy-asterisk vpn-diagnostics
|
||||||
|
|
||||||
|
# DNS whitelist check
|
||||||
|
docker exec -it easy-asterisk dns-whitelist
|
||||||
\`\`\`
|
\`\`\`
|
||||||
|
|
||||||
## Adding devices
|
## Adding devices
|
||||||
Run the management menu and choose "Device Management → Add device".
|
Run the management menu → Device Management → Add device.
|
||||||
Each device gets a SIP extension, password, and setup instructions for Linphone or Baresip.
|
Each device gets a SIP extension, password, and setup instructions
|
||||||
|
for Linphone (remote provisioning) or Baresip (manual).
|
||||||
|
|
||||||
## Connection types
|
## Connection modes
|
||||||
- **LAN/VPN**: UDP, no encryption — for devices on the local network or WireGuard/Tailscale
|
- **LAN/VPN**: UDP, no encryption — local network or WireGuard/Tailscale
|
||||||
- **FQDN**: TLS + SRTP — for devices anywhere on the internet
|
- **FQDN**: TLS + SRTP + coturn TURN relay — works from anywhere
|
||||||
|
|
||||||
## Router port forwards (FQDN mode)
|
## Router port forwards (FQDN mode)
|
||||||
| Port | Protocol | Service |
|
| Port | Protocol | Service |
|
||||||
@@ -431,18 +429,19 @@ Each device gets a SIP extension, password, and setup instructions for Linphone
|
|||||||
| 10000-20000 | UDP | RTP media |
|
| 10000-20000 | UDP | RTP media |
|
||||||
| 49152-49252 | UDP | TURN relay |
|
| 49152-49252 | UDP | TURN relay |
|
||||||
|
|
||||||
## TURN credentials
|
## TURN credentials (for SIP clients behind strict NAT)
|
||||||
Username: easyasterisk
|
- Server: \${DOMAIN_NAME}:3478
|
||||||
Password: (see .env)
|
- Username: easyasterisk
|
||||||
|
- Password: (see .env → TURN_PASSWORD)
|
||||||
|
|
||||||
## Manage
|
## Manage
|
||||||
\`\`\`bash
|
\`\`\`bash
|
||||||
cd $EA_DIR
|
cd $EA_DIR
|
||||||
docker compose up -d # start
|
docker compose up -d # start
|
||||||
docker compose down # stop
|
docker compose down # stop
|
||||||
docker compose logs -f # logs
|
docker compose logs -f # logs
|
||||||
docker compose pull && docker compose up -d # update coturn image
|
docker compose pull # update coturn image
|
||||||
docker compose build --pull && docker compose up -d # rebuild Asterisk image
|
docker compose build --pull && docker compose up -d # rebuild Asterisk image
|
||||||
\`\`\`
|
\`\`\`
|
||||||
MD
|
MD
|
||||||
|
|
||||||
@@ -459,8 +458,7 @@ MD
|
|||||||
echo " Web admin: http://localhost:8080/clients"
|
echo " Web admin: http://localhost:8080/clients"
|
||||||
echo " Management: docker exec -it easy-asterisk easy-asterisk"
|
echo " Management: docker exec -it easy-asterisk easy-asterisk"
|
||||||
echo ""
|
echo ""
|
||||||
log_info "Run the management script to add your first device:"
|
log_info "Next: add your first device via the management menu."
|
||||||
log_info " docker exec -it easy-asterisk easy-asterisk"
|
|
||||||
else
|
else
|
||||||
log_warning "Start failed — check: docker compose logs"
|
log_warning "Start failed — check: docker compose logs"
|
||||||
fi
|
fi
|
||||||
|
|||||||
+268
-80
@@ -1,32 +1,267 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
# services/onlyoffice.sh — Self-hosted OnlyOffice Document Server for Nextcloud/FileBrowser.
|
# services/onlyoffice.sh — Self-hosted OnlyOffice Document Server.
|
||||||
# Part of the modular post-install system (sourced by setup.sh).
|
# Part of the modular post-install system (sourced by setup.sh).
|
||||||
#
|
#
|
||||||
# OnlyOffice Document Server provides collaborative editing for Nextcloud and
|
# Can also be run standalone on any machine:
|
||||||
# other platforms. JWT is enabled to secure the API endpoint.
|
# sudo bash onlyoffice.sh
|
||||||
|
# (Docker must already be installed when run standalone)
|
||||||
|
|
||||||
register_service onlyoffice utilities "Self-hosted OnlyOffice Document Server for Nextcloud/FileBrowser" 8082
|
# ── Standalone bootstrap ──────────────────────────────────────────────────────
|
||||||
|
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||||||
|
[[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
|
||||||
|
|
||||||
|
_SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
_COMMON="$_SELF_DIR/../lib/common.sh"
|
||||||
|
|
||||||
|
if [[ -f "$_COMMON" ]]; then
|
||||||
|
# shellcheck source=../lib/common.sh
|
||||||
|
source "$_COMMON"
|
||||||
|
else
|
||||||
|
log_info() { echo -e "\033[0;34m[INFO]\033[0m $*"; }
|
||||||
|
log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
|
||||||
|
log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
|
||||||
|
log_error() { echo -e "\033[0;31m[ERROR]\033[0m $*" >&2; }
|
||||||
|
|
||||||
|
require_docker() {
|
||||||
|
command -v docker &>/dev/null || {
|
||||||
|
log_error "Docker not found. Install it first:"
|
||||||
|
log_error " curl -fsSL https://get.docker.com | sudo sh"
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
docker compose version &>/dev/null || {
|
||||||
|
log_error "Docker Compose plugin missing:"
|
||||||
|
log_error " sudo apt-get install -y docker-compose-plugin"
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
ensure_docker_dir_ownership() {
|
||||||
|
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
|
||||||
|
}
|
||||||
|
|
||||||
|
prompt_text() {
|
||||||
|
local _q="$1" _def="$2" _var="$3" _r
|
||||||
|
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
|
||||||
|
read -r -p " $_q " _r
|
||||||
|
eval "$_var='${_r:-$_def}'"
|
||||||
|
}
|
||||||
|
|
||||||
|
prompt_yn() {
|
||||||
|
local _q="$1" _def="$2" _var="$3" _r
|
||||||
|
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
|
||||||
|
read -r -p " $_q " _r
|
||||||
|
eval "$_var='${_r:-$_def}'"
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_caddy_for_service() {
|
||||||
|
local _name="$1" _upstream="$2" _subdomain="$3" _extra="${4:-}"
|
||||||
|
local _caddy_dir="$DOCKER_DIR/caddy"
|
||||||
|
local _caddyfile="$_caddy_dir/Caddyfile"
|
||||||
|
|
||||||
|
if [[ ! -d "$_caddy_dir" ]]; then
|
||||||
|
log_info "Access $_name directly on port ${_upstream##*:}."
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
local _do_caddy=""
|
||||||
|
read -r -p " Configure Caddy reverse proxy for $_name? [y/N]: " _do_caddy
|
||||||
|
[[ "${_do_caddy,,}" == "y" ]] || {
|
||||||
|
log_info "Skipping — access at: http://localhost:${_upstream##*:}"
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
local _domain=""
|
||||||
|
read -r -p " Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
|
||||||
|
[[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
|
||||||
|
|
||||||
|
if [[ -f "$_caddyfile" ]]; then
|
||||||
|
local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
|
||||||
|
cp "$_caddyfile" "$_bk"
|
||||||
|
log_info "Backed up Caddyfile to $(basename "$_bk")"
|
||||||
|
else
|
||||||
|
touch "$_caddyfile"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
|
||||||
|
log_warning "$_domain already in Caddyfile"
|
||||||
|
local _ow=""
|
||||||
|
read -r -p " Overwrite? [y/N]: " _ow
|
||||||
|
[[ "${_ow,,}" == "y" ]] || { log_info "Keeping existing entry."; return 0; }
|
||||||
|
sed -i "/^${_domain}/,/^}/d" "$_caddyfile"
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat >> "$_caddyfile" << CBLOCK
|
||||||
|
|
||||||
|
# $_name
|
||||||
|
$_domain {
|
||||||
|
reverse_proxy $_upstream
|
||||||
|
|
||||||
|
header {
|
||||||
|
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
||||||
|
X-Content-Type-Options "nosniff"
|
||||||
|
X-Frame-Options "SAMEORIGIN"
|
||||||
|
Referrer-Policy "strict-origin-when-cross-origin"
|
||||||
|
}
|
||||||
|
|
||||||
|
log {
|
||||||
|
output file /var/log/caddy/${_domain}.log
|
||||||
|
format json
|
||||||
|
}
|
||||||
|
${_extra}
|
||||||
|
}
|
||||||
|
CBLOCK
|
||||||
|
|
||||||
|
log_success "Added $_domain to Caddyfile"
|
||||||
|
docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
|
||||||
|
if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
|
||||||
|
log_success "$_name accessible at: https://$_domain"
|
||||||
|
else
|
||||||
|
log_warning "Reload failed — check: docker logs caddy"
|
||||||
|
log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
write_readme() {
|
||||||
|
local _dir="$1"; shift
|
||||||
|
mkdir -p "$_dir"
|
||||||
|
cat > "$_dir/README.md"
|
||||||
|
}
|
||||||
|
|
||||||
|
generate_password() {
|
||||||
|
local len="${1:-32}"
|
||||||
|
tr -dc 'A-Za-z0-9' </dev/urandom | head -c "$len"
|
||||||
|
}
|
||||||
|
fi
|
||||||
|
|
||||||
|
ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
|
||||||
|
ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
|
||||||
|
DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
|
||||||
|
DRY_RUN="${DRY_RUN:-false}"
|
||||||
|
UNATTENDED="${UNATTENDED:-false}"
|
||||||
|
SITE_TZ="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
|
||||||
|
SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
|
||||||
|
SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
|
||||||
|
|
||||||
|
register_service() { :; }
|
||||||
|
_RUN_STANDALONE=1
|
||||||
|
fi
|
||||||
|
# ─────────────────────────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
register_service onlyoffice utilities "Self-hosted OnlyOffice Document Server (Nextcloud/FileBrowser)" 8082
|
||||||
|
|
||||||
|
# ── Ensure yq v4 is installed ─────────────────────────────────────────────────
|
||||||
|
_ensure_yq() {
|
||||||
|
if command -v yq &>/dev/null; then
|
||||||
|
local major
|
||||||
|
major=$(yq --version 2>&1 | grep -oP '(?<=v)\d+' | head -1 || echo 0)
|
||||||
|
[[ "$major" -ge 4 ]] && return 0
|
||||||
|
log_info "yq found but version < 4 — reinstalling..."
|
||||||
|
else
|
||||||
|
log_info "yq not found — installing..."
|
||||||
|
fi
|
||||||
|
local arch
|
||||||
|
arch=$(uname -m)
|
||||||
|
local yq_bin="yq_linux_amd64"
|
||||||
|
[[ "$arch" == "aarch64" || "$arch" == "arm64" ]] && yq_bin="yq_linux_arm64"
|
||||||
|
if wget -qO /usr/local/bin/yq \
|
||||||
|
"https://github.com/mikefarah/yq/releases/latest/download/${yq_bin}" \
|
||||||
|
&& chmod +x /usr/local/bin/yq; then
|
||||||
|
log_success "yq installed ($(yq --version 2>&1 | head -1))"
|
||||||
|
else
|
||||||
|
log_warning "Could not install yq — FileBrowser config.yaml will need manual update"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Wire OnlyOffice into Nextcloud ────────────────────────────────────────────
|
||||||
|
_wire_nextcloud() {
|
||||||
|
local jwt_secret="$1"
|
||||||
|
local nc_dir="$DOCKER_DIR/nextcloud"
|
||||||
|
|
||||||
|
[[ -d "$nc_dir" ]] || return 0
|
||||||
|
|
||||||
|
log_info "Nextcloud detected — wiring OnlyOffice integration..."
|
||||||
|
|
||||||
|
if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^nextcloud$"; then
|
||||||
|
log_warning "Nextcloud container not running — skipping occ wiring."
|
||||||
|
log_info " Start Nextcloud and re-run: sudo bash $0"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
docker exec --user www-data nextcloud php occ app:enable onlyoffice \
|
||||||
|
&& log_success "OnlyOffice app enabled in Nextcloud" \
|
||||||
|
|| log_warning "app:enable failed — may already be enabled"
|
||||||
|
docker exec --user www-data nextcloud php occ \
|
||||||
|
config:app:set onlyoffice DocumentServerUrl \
|
||||||
|
--value "http://onlyoffice:80/" \
|
||||||
|
&& log_success "DocumentServerUrl → http://onlyoffice:80/" \
|
||||||
|
|| log_warning "Could not set DocumentServerUrl"
|
||||||
|
docker exec --user www-data nextcloud php occ \
|
||||||
|
config:app:set onlyoffice jwt_secret \
|
||||||
|
--value "$jwt_secret" \
|
||||||
|
&& log_success "jwt_secret set" \
|
||||||
|
|| log_warning "Could not set jwt_secret"
|
||||||
|
docker exec --user www-data nextcloud php occ \
|
||||||
|
config:app:set onlyoffice jwt_header \
|
||||||
|
--value "AuthorizationJwt" \
|
||||||
|
&& log_success "jwt_header set" \
|
||||||
|
|| log_warning "Could not set jwt_header"
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Wire OnlyOffice into FileBrowser Quantum ──────────────────────────────────
|
||||||
|
_wire_filebrowser() {
|
||||||
|
local fb_config="$DOCKER_DIR/filebrowser/data/config.yaml"
|
||||||
|
|
||||||
|
[[ -f "$fb_config" ]] || return 0
|
||||||
|
|
||||||
|
log_info "FileBrowser Quantum detected — updating config.yaml..."
|
||||||
|
|
||||||
|
if ! _ensure_yq; then
|
||||||
|
log_info "Set officeServer manually in $fb_config:"
|
||||||
|
log_info " officeServer: \"http://onlyoffice:80/\""
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
yq e -i '.officeServer = "http://onlyoffice:80/"' "$fb_config" \
|
||||||
|
&& log_success "FileBrowser config.yaml: officeServer → http://onlyoffice:80/" \
|
||||||
|
|| log_warning "yq failed — set officeServer manually in $fb_config"
|
||||||
|
|
||||||
|
if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^filebrowser$"; then
|
||||||
|
docker restart filebrowser >/dev/null 2>&1 \
|
||||||
|
&& log_info "FileBrowser restarted to pick up config change" \
|
||||||
|
|| log_warning "Could not restart FileBrowser container"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
install_onlyoffice() {
|
install_onlyoffice() {
|
||||||
require_docker || return 1
|
require_docker || return 1
|
||||||
log_info "Installing OnlyOffice Document Server..."
|
log_info "Installing OnlyOffice Document Server..."
|
||||||
|
|
||||||
local DIR="$DOCKER_DIR/onlyoffice"
|
local DIR="$DOCKER_DIR/onlyoffice"
|
||||||
|
|
||||||
if [ "$DRY_RUN" = true ]; then
|
if [ "$DRY_RUN" = true ]; then
|
||||||
echo "[DRY-RUN] Would create $DIR with docker-compose.yml and .env"
|
echo "[DRY-RUN] Would create $DIR with docker-compose.yml and .env"
|
||||||
echo "[DRY-RUN] Would deploy onlyoffice/documentserver:latest on port 8082"
|
echo "[DRY-RUN] Would deploy onlyoffice/documentserver:latest on port 8082"
|
||||||
echo "[DRY-RUN] Would generate JWT secret"
|
echo "[DRY-RUN] Would install yq if missing"
|
||||||
echo "[DRY-RUN] Would configure Nextcloud via occ (if $DOCKER_DIR/nextcloud exists)"
|
echo "[DRY-RUN] Would wire OnlyOffice into Nextcloud (if running)"
|
||||||
echo "[DRY-RUN] Would configure FileBrowser config.yaml (if present)"
|
echo "[DRY-RUN] Would wire OnlyOffice into FileBrowser Quantum (if present)"
|
||||||
return 0
|
return 0
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# Always install yq — needed for FBQ config patching
|
||||||
|
_ensure_yq || true
|
||||||
|
|
||||||
mkdir -p "$DIR"
|
mkdir -p "$DIR"
|
||||||
ensure_docker_dir_ownership "$DIR"
|
ensure_docker_dir_ownership "$DIR"
|
||||||
cd "$DIR" || return 1
|
cd "$DIR" || return 1
|
||||||
|
|
||||||
local JWT_SECRET
|
# Generate JWT secret (or read existing one so re-runs don't rotate it)
|
||||||
JWT_SECRET=$(generate_password 32)
|
local JWT_SECRET=""
|
||||||
|
if [[ -f "$DIR/.env" ]]; then
|
||||||
|
JWT_SECRET=$(grep "^JWT_SECRET=" "$DIR/.env" 2>/dev/null | cut -d= -f2-)
|
||||||
|
fi
|
||||||
|
[[ -z "$JWT_SECRET" ]] && JWT_SECRET="$(generate_password 32)"
|
||||||
|
|
||||||
cat > docker-compose.yml << 'OO_COMPOSE'
|
cat > docker-compose.yml << 'OO_COMPOSE'
|
||||||
name: onlyoffice
|
name: onlyoffice
|
||||||
@@ -50,10 +285,12 @@ networks:
|
|||||||
OO_COMPOSE
|
OO_COMPOSE
|
||||||
|
|
||||||
cat > .env << OO_ENV
|
cat > .env << OO_ENV
|
||||||
# ── OnlyOffice Document Server ────────────────────────────────────────────────
|
# OnlyOffice Document Server — environment
|
||||||
CADDY_NET=$SITE_CADDY_NET
|
CADDY_NET=$SITE_CADDY_NET
|
||||||
|
|
||||||
# JWT authentication — keep JWT_SECRET secret; used by Nextcloud integration
|
# JWT authentication — keep JWT_SECRET private
|
||||||
|
# If you rotate it, update Nextcloud (occ config:app:set onlyoffice jwt_secret)
|
||||||
|
# and any other integration that uses this server
|
||||||
JWT_ENABLED=true
|
JWT_ENABLED=true
|
||||||
JWT_SECRET=$JWT_SECRET
|
JWT_SECRET=$JWT_SECRET
|
||||||
JWT_HEADER=AuthorizationJwt
|
JWT_HEADER=AuthorizationJwt
|
||||||
@@ -61,82 +298,43 @@ OO_ENV
|
|||||||
|
|
||||||
chmod 600 .env
|
chmod 600 .env
|
||||||
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DIR"
|
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DIR"
|
||||||
log_success "OnlyOffice configured at $DIR"
|
|
||||||
|
|
||||||
configure_caddy_for_service "OnlyOffice" "onlyoffice:80" "office"
|
configure_caddy_for_service "OnlyOffice" "onlyoffice:80" "office"
|
||||||
|
|
||||||
# ── Start container ────────────────────────────────────────────────────────
|
|
||||||
local START=""
|
local START=""
|
||||||
prompt_yn "Start OnlyOffice now? (y/n):" "y" START
|
prompt_yn "Start OnlyOffice now? (y/n):" "y" START
|
||||||
if [ "$START" = "y" ] || [ "$START" = "Y" ]; then
|
if [[ "$START" =~ ^[Yy]$ ]]; then
|
||||||
docker compose up -d \
|
docker compose up -d \
|
||||||
&& log_success "OnlyOffice started" \
|
&& log_success "OnlyOffice started" \
|
||||||
|| log_warning "Start failed — check: docker compose logs"
|
|| log_warning "Start failed — check: docker compose logs"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# ── Nextcloud integration ──────────────────────────────────────────────────
|
# Wire into integrations every run (idempotent)
|
||||||
if [ -d "$DOCKER_DIR/nextcloud" ]; then
|
echo ""
|
||||||
log_info "Nextcloud detected — configuring OnlyOffice integration via occ..."
|
_wire_nextcloud "$JWT_SECRET"
|
||||||
docker exec --user www-data nextcloud php occ app:enable onlyoffice \
|
_wire_filebrowser
|
||||||
&& log_success "OnlyOffice app enabled in Nextcloud" \
|
|
||||||
|| log_warning "Could not enable OnlyOffice app — run manually: docker exec --user www-data nextcloud php occ app:enable onlyoffice"
|
|
||||||
docker exec --user www-data nextcloud php occ config:app:set onlyoffice DocumentServerUrl --value "http://onlyoffice:80/" \
|
|
||||||
&& log_success "Nextcloud DocumentServerUrl set" \
|
|
||||||
|| log_warning "Could not set DocumentServerUrl"
|
|
||||||
docker exec --user www-data nextcloud php occ config:app:set onlyoffice jwt_secret --value "$JWT_SECRET" \
|
|
||||||
&& log_success "Nextcloud jwt_secret set" \
|
|
||||||
|| log_warning "Could not set jwt_secret"
|
|
||||||
docker exec --user www-data nextcloud php occ config:app:set onlyoffice jwt_header --value "AuthorizationJwt" \
|
|
||||||
&& log_success "Nextcloud jwt_header set" \
|
|
||||||
|| log_warning "Could not set jwt_header"
|
|
||||||
else
|
|
||||||
echo ""
|
|
||||||
echo " Nextcloud not found. To integrate OnlyOffice with Nextcloud manually:"
|
|
||||||
echo " 1. Install the OnlyOffice app in Nextcloud (Apps > Office & Text)"
|
|
||||||
echo " 2. Go to Settings > OnlyOffice and set:"
|
|
||||||
echo " Document Server URL: http://onlyoffice:80/"
|
|
||||||
echo " JWT Secret: $JWT_SECRET"
|
|
||||||
echo " JWT Header: AuthorizationJwt"
|
|
||||||
echo ""
|
|
||||||
fi
|
|
||||||
|
|
||||||
# ── FileBrowser integration ────────────────────────────────────────────────
|
|
||||||
local FB_CONFIG="$DOCKER_DIR/filebrowser/data/config.yaml"
|
|
||||||
if [ -f "$FB_CONFIG" ]; then
|
|
||||||
if command -v yq >/dev/null 2>&1; then
|
|
||||||
yq e -i '.officeServer = "http://onlyoffice:80/"' "$FB_CONFIG" \
|
|
||||||
&& log_success "FileBrowser config.yaml updated with officeServer" \
|
|
||||||
|| log_warning "yq failed to update $FB_CONFIG — set officeServer manually"
|
|
||||||
else
|
|
||||||
log_info "yq not found. To enable OnlyOffice in FileBrowser, add to $FB_CONFIG:"
|
|
||||||
log_info " officeServer: \"http://onlyoffice:80/\""
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
write_readme "$DIR" << MD
|
write_readme "$DIR" << MD
|
||||||
# OnlyOffice Document Server
|
# OnlyOffice Document Server
|
||||||
|
|
||||||
Self-hosted document editing server. Integrates with Nextcloud and FileBrowser
|
Self-hosted collaborative editing for DOCX, XLSX, PPTX, and ODT files.
|
||||||
to provide collaborative editing of ODT, DOCX, XLSX, and PPTX files.
|
Integrates with Nextcloud and FileBrowser Quantum.
|
||||||
|
Port: 8082 (internal 80)
|
||||||
|
|
||||||
## JWT Secret
|
## JWT Secret
|
||||||
The JWT secret is stored in \`.env\` (chmod 600). If you rotate it, update:
|
Stored in \`.env\` (chmod 600). If you rotate it:
|
||||||
- Nextcloud: Settings > OnlyOffice > JWT Secret
|
1. Update \`JWT_SECRET\` in \`.env\`
|
||||||
- Any other integrations using this server
|
2. Re-run the installer to re-wire all integrations: \`sudo bash services/onlyoffice.sh\`
|
||||||
|
|
||||||
JWT Secret (at install time): see \`JWT_SECRET\` in .env
|
## Verify integrations
|
||||||
|
|
||||||
## Nextcloud Integration
|
|
||||||
If Nextcloud was running at install time, the OnlyOffice app was auto-configured.
|
|
||||||
To reconfigure or verify:
|
|
||||||
\`\`\`bash
|
\`\`\`bash
|
||||||
|
# Nextcloud
|
||||||
docker exec --user www-data nextcloud php occ config:app:get onlyoffice DocumentServerUrl
|
docker exec --user www-data nextcloud php occ config:app:get onlyoffice DocumentServerUrl
|
||||||
docker exec --user www-data nextcloud php occ config:app:get onlyoffice jwt_secret
|
docker exec --user www-data nextcloud php occ config:app:get onlyoffice jwt_secret
|
||||||
\`\`\`
|
|
||||||
|
|
||||||
## FileBrowser Integration
|
# FileBrowser Quantum
|
||||||
Set \`officeServer: "http://onlyoffice:80/"\` in FileBrowser's config.yaml, then
|
grep officeServer ~/docker/filebrowser/data/config.yaml
|
||||||
restart FileBrowser.
|
\`\`\`
|
||||||
|
|
||||||
## Manage
|
## Manage
|
||||||
\`\`\`bash
|
\`\`\`bash
|
||||||
@@ -148,23 +346,13 @@ docker compose pull && docker compose up -d # update
|
|||||||
\`\`\`
|
\`\`\`
|
||||||
MD
|
MD
|
||||||
|
|
||||||
|
log_success "OnlyOffice installed at $DIR"
|
||||||
echo ""
|
echo ""
|
||||||
echo " OnlyOffice Document Server"
|
echo " Port: http://localhost:8082"
|
||||||
echo " Directory: $DIR"
|
|
||||||
echo " Port: 8082 (internal: 80)"
|
|
||||||
echo " JWT Secret: $JWT_SECRET"
|
echo " JWT Secret: $JWT_SECRET"
|
||||||
echo " (Secret also saved to $DIR/.env)"
|
echo " (Secret also saved to $DIR/.env)"
|
||||||
echo ""
|
echo ""
|
||||||
}
|
}
|
||||||
|
|
||||||
# ── Standalone bootstrap ───────────────────────────────────────────────────────
|
# Run immediately when executed directly (deferred until after function definition)
|
||||||
# Run this file directly to install OnlyOffice without the full setup.sh wizard:
|
[[ "${_RUN_STANDALONE:-0}" == 1 ]] && install_onlyoffice
|
||||||
# sudo _RUN_STANDALONE=1 bash services/onlyoffice.sh
|
|
||||||
if [[ "${_RUN_STANDALONE:-0}" == 1 ]]; then
|
|
||||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
||||||
# shellcheck source=../lib/common.sh
|
|
||||||
source "$SCRIPT_DIR/../lib/common.sh"
|
|
||||||
require_root
|
|
||||||
load_site_config 2>/dev/null || true
|
|
||||||
install_onlyoffice
|
|
||||||
fi
|
|
||||||
|
|||||||
Vendored
+99
@@ -0,0 +1,99 @@
|
|||||||
|
# ================================================================
|
||||||
|
# Easy Asterisk - Environment Configuration
|
||||||
|
#
|
||||||
|
# Setup:
|
||||||
|
# 1. cp .env.example .env
|
||||||
|
# 2. Set DOMAIN_NAME (the only required setting)
|
||||||
|
# 3. docker compose up -d
|
||||||
|
# 4. docker exec -it easy-asterisk easy-asterisk
|
||||||
|
#
|
||||||
|
# Port forwarding required on your router:
|
||||||
|
# 5061/tcp → SIP TLS signaling
|
||||||
|
# 3478/udp+tcp → STUN/TURN (NAT traversal + media relay)
|
||||||
|
# (change with TURN_PORT if 3478 is taken)
|
||||||
|
# 10000-20000/udp → RTP media (or your custom range below)
|
||||||
|
#
|
||||||
|
# How it works:
|
||||||
|
# - All SIP clients connect to DOMAIN_NAME:5061 (TLS)
|
||||||
|
# - coturn handles NAT traversal (STUN) and media relay (TURN)
|
||||||
|
# - Works from any network: LAN, cellular, Proton VPN, hotel WiFi
|
||||||
|
# - Set TURN_PASSWORD below (generate one: openssl rand -base64 18)
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
# ── Domain Name (REQUIRED) ────────────────────────────────────
|
||||||
|
# The FQDN that points to this server's public IP.
|
||||||
|
# This is what SIP clients use to connect.
|
||||||
|
# Example: asterisk.yourdomain.com
|
||||||
|
DOMAIN_NAME=
|
||||||
|
|
||||||
|
# ── Public IP ─────────────────────────────────────────────────
|
||||||
|
# Your server's public IP address.
|
||||||
|
# Leave empty to auto-detect (uses ifconfig.me).
|
||||||
|
# Set manually if auto-detection fails (e.g., behind double NAT).
|
||||||
|
PUBLIC_IP=
|
||||||
|
|
||||||
|
# ── TLS ───────────────────────────────────────────────────────
|
||||||
|
# Always "y" for remote access. Self-signed certs are auto-generated.
|
||||||
|
# For trusted certs (no client warnings), mount your Let's Encrypt
|
||||||
|
# certs into /etc/asterisk/certs/ via docker compose volumes.
|
||||||
|
ENABLE_TLS=y
|
||||||
|
|
||||||
|
# ── Local Network ─────────────────────────────────────────────
|
||||||
|
# Your LAN CIDR. Auto-detected if empty.
|
||||||
|
# Example: 192.168.1.0/24
|
||||||
|
LOCAL_CIDR=
|
||||||
|
|
||||||
|
# ── Additional Subnets (optional) ─────────────────────────────
|
||||||
|
# Only needed for site-to-site VPNs or VLANs where the server
|
||||||
|
# has a direct route to client IPs (e.g., WireGuard, Tailscale).
|
||||||
|
#
|
||||||
|
# NOT needed for client-side VPNs (Proton, NordVPN, etc.)
|
||||||
|
# - Those clients appear with random public IPs
|
||||||
|
# - TURN handles media relay for them automatically
|
||||||
|
#
|
||||||
|
# Examples:
|
||||||
|
# WireGuard: VLAN_SUBNETS=10.8.0.0/24
|
||||||
|
# Tailscale: VLAN_SUBNETS=100.64.0.0/10
|
||||||
|
# Multiple: VLAN_SUBNETS=10.8.0.0/24 10.10.0.0/24
|
||||||
|
HAS_VLANS=n
|
||||||
|
VLAN_SUBNETS=
|
||||||
|
|
||||||
|
# ── TURN/STUN Settings ──────────────────────────────────────
|
||||||
|
# Used by coturn for TURN relay authentication.
|
||||||
|
# If empty, defaults to "changeme" — set a real password for security.
|
||||||
|
# Generate one with: openssl rand -base64 18
|
||||||
|
#
|
||||||
|
# These credentials are for coturn only. SIP clients that need TURN
|
||||||
|
# relay (behind strict NAT) must configure the same credentials in
|
||||||
|
# their SIP app settings.
|
||||||
|
TURN_USERNAME=easyasterisk
|
||||||
|
TURN_PASSWORD=
|
||||||
|
|
||||||
|
# ── TURN/STUN Port ──────────────────────────────────────────
|
||||||
|
# Default: 3478 (standard STUN/TURN port)
|
||||||
|
# Change if 3478 is already in use (e.g., UniFi controller uses 3478/udp).
|
||||||
|
# Common alternative: 3479
|
||||||
|
TURN_PORT=3478
|
||||||
|
|
||||||
|
# ── TURN Relay Port Range ─────────────────────────────────────
|
||||||
|
# Ports coturn uses for media relay. Forward this range on your router.
|
||||||
|
# Default is 100 ports (enough for ~50 simultaneous relayed calls).
|
||||||
|
# Most calls use direct paths; TURN relay is the fallback.
|
||||||
|
TURN_RELAY_MIN=49152
|
||||||
|
TURN_RELAY_MAX=49252
|
||||||
|
|
||||||
|
# ── RTP Port Range ────────────────────────────────────────────
|
||||||
|
# Asterisk's own RTP media ports. Forward this range on your router.
|
||||||
|
# Default: 10000-20000 (10,000 ports)
|
||||||
|
# For constrained environments: 10000-10200
|
||||||
|
RTP_START=10000
|
||||||
|
RTP_END=20000
|
||||||
|
|
||||||
|
# ── Web Admin ─────────────────────────────────────────────────
|
||||||
|
# HTTP management interface. Access via browser at:
|
||||||
|
# http://your-server:8080/clients
|
||||||
|
#
|
||||||
|
# For HTTPS: put this behind Caddy or nginx reverse proxy,
|
||||||
|
# then set WEB_ADMIN_AUTH_DISABLED=true (let the proxy handle auth).
|
||||||
|
WEB_ADMIN_PORT=8080
|
||||||
|
WEB_ADMIN_AUTH_DISABLED=false
|
||||||
Vendored
+103
@@ -0,0 +1,103 @@
|
|||||||
|
# ================================================================
|
||||||
|
# Easy Asterisk - Docker Container
|
||||||
|
# Asterisk PBX with web admin and optional STUN support
|
||||||
|
#
|
||||||
|
# Usage:
|
||||||
|
# docker compose up -d # Asterisk only
|
||||||
|
# docker compose --profile stun up -d # Asterisk + self-hosted STUN
|
||||||
|
# docker exec -it easy-asterisk easy-asterisk # Interactive management
|
||||||
|
# docker exec -it easy-asterisk vpn-diagnostics # VPN diagnostics
|
||||||
|
# docker exec -it easy-asterisk dns-whitelist # DNS whitelist check
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
FROM ubuntu:24.04
|
||||||
|
|
||||||
|
ENV DEBIAN_FRONTEND=noninteractive
|
||||||
|
ENV LANG=C.UTF-8
|
||||||
|
|
||||||
|
# Install Asterisk and all dependencies (matches install_asterisk_packages)
|
||||||
|
RUN echo "exit 101" > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d && \
|
||||||
|
apt-get update && \
|
||||||
|
apt-get install -y --no-install-recommends \
|
||||||
|
asterisk \
|
||||||
|
asterisk-core-sounds-en-gsm \
|
||||||
|
asterisk-modules \
|
||||||
|
ca-certificates \
|
||||||
|
openssl \
|
||||||
|
curl \
|
||||||
|
wget \
|
||||||
|
tcpdump \
|
||||||
|
sngrep \
|
||||||
|
python3 \
|
||||||
|
iproute2 \
|
||||||
|
net-tools \
|
||||||
|
dnsutils \
|
||||||
|
iputils-ping \
|
||||||
|
procps \
|
||||||
|
lsof \
|
||||||
|
&& rm -rf /var/lib/apt/lists/* \
|
||||||
|
&& rm -f /usr/sbin/policy-rc.d \
|
||||||
|
&& ldconfig \
|
||||||
|
&& update-ca-certificates 2>/dev/null || true
|
||||||
|
|
||||||
|
# NOTE: Opus transcoding (codec_opus.so) is NOT available on Ubuntu 24.04 due to
|
||||||
|
# a packaging bug (Launchpad #2044135). The Digium precompiled binary is ABI-incompatible.
|
||||||
|
# Opus pass-through (phone-to-phone) still works via res_format_attr_opus.so from
|
||||||
|
# asterisk-modules. Only Opus<->ulaw transcoding is missing, which is rarely needed
|
||||||
|
# since modern SIP phones all support the same codecs natively.
|
||||||
|
|
||||||
|
# Create required directories
|
||||||
|
RUN mkdir -p \
|
||||||
|
/etc/easy-asterisk \
|
||||||
|
/etc/asterisk/certs \
|
||||||
|
/var/lib/asterisk/static-http \
|
||||||
|
/var/log/asterisk \
|
||||||
|
/var/spool/asterisk \
|
||||||
|
/var/run/asterisk \
|
||||||
|
&& chown -R asterisk:asterisk \
|
||||||
|
/etc/asterisk \
|
||||||
|
/var/lib/asterisk \
|
||||||
|
/var/log/asterisk \
|
||||||
|
/var/spool/asterisk \
|
||||||
|
/var/run/asterisk
|
||||||
|
|
||||||
|
# Docker detection marker (used by is_docker() in the script)
|
||||||
|
RUN touch /.dockerenv
|
||||||
|
|
||||||
|
# Copy the main management script
|
||||||
|
COPY easy-asterisk-v0.10.0.sh /usr/local/bin/easy-asterisk
|
||||||
|
RUN chmod +x /usr/local/bin/easy-asterisk
|
||||||
|
|
||||||
|
# Copy diagnostic and utility scripts
|
||||||
|
COPY scripts/vpn-diagnostics.sh /usr/local/bin/vpn-diagnostics
|
||||||
|
COPY scripts/dns-whitelist.sh /usr/local/bin/dns-whitelist
|
||||||
|
RUN chmod +x /usr/local/bin/vpn-diagnostics /usr/local/bin/dns-whitelist
|
||||||
|
|
||||||
|
# Copy entrypoint
|
||||||
|
COPY docker/entrypoint.sh /entrypoint.sh
|
||||||
|
RUN chmod +x /entrypoint.sh
|
||||||
|
|
||||||
|
# SIP signaling
|
||||||
|
EXPOSE 5060/udp
|
||||||
|
EXPOSE 5060/tcp
|
||||||
|
EXPOSE 5061/tcp
|
||||||
|
|
||||||
|
# Web admin + provisioning
|
||||||
|
EXPOSE 8080/tcp
|
||||||
|
EXPOSE 8088/tcp
|
||||||
|
EXPOSE 8089/tcp
|
||||||
|
|
||||||
|
# STUN (if running coturn in same container; default 3478, configurable via TURN_PORT)
|
||||||
|
EXPOSE 3478/udp
|
||||||
|
|
||||||
|
# RTP media range (use --network host in production for full range)
|
||||||
|
# Docker port-mapping 10000 ports is impractical; host networking recommended
|
||||||
|
EXPOSE 10000-10100/udp
|
||||||
|
|
||||||
|
# Persistent data
|
||||||
|
VOLUME ["/etc/asterisk", "/etc/easy-asterisk", "/var/log/asterisk"]
|
||||||
|
|
||||||
|
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
||||||
|
CMD asterisk -rx "core show version" >/dev/null 2>&1 || exit 1
|
||||||
|
|
||||||
|
ENTRYPOINT ["/entrypoint.sh"]
|
||||||
@@ -0,0 +1,26 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
# ================================================================
|
||||||
|
# Robust coturn entrypoint
|
||||||
|
#
|
||||||
|
# The coturn/coturn Docker image's native entrypoint uses:
|
||||||
|
# exec $(eval "echo $@")
|
||||||
|
# which is fragile — if DETECT_EXTERNAL_IP's DNS lookup returns empty,
|
||||||
|
# the eval produces an empty token → "ERROR: CONFIG: Unknown argument:"
|
||||||
|
#
|
||||||
|
# This wrapper reuses the image's detect-external-ip script but avoids
|
||||||
|
# the eval word-splitting issue. If detection fails, we simply omit
|
||||||
|
# --external-ip rather than passing a blank argument.
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
# Use explicit PUBLIC_IP if provided, otherwise auto-detect
|
||||||
|
if [ -z "$PUBLIC_IP" ]; then
|
||||||
|
PUBLIC_IP=$(detect-external-ip 2>/dev/null || true)
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Only add --external-ip if we actually have an IP
|
||||||
|
EXTERNAL_IP_ARG=""
|
||||||
|
if [ -n "$PUBLIC_IP" ]; then
|
||||||
|
EXTERNAL_IP_ARG="--external-ip=$PUBLIC_IP"
|
||||||
|
fi
|
||||||
|
|
||||||
|
exec turnserver "$@" $EXTERNAL_IP_ARG
|
||||||
+449
@@ -0,0 +1,449 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# ================================================================
|
||||||
|
# Easy Asterisk Docker Entrypoint
|
||||||
|
#
|
||||||
|
# Fully automated:
|
||||||
|
# - Detects public IP
|
||||||
|
# - Generates TURN credentials if not provided
|
||||||
|
# - Configures Asterisk with FQDN, TLS, ICE, STUN, TURN
|
||||||
|
# - Starts web admin + Asterisk
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
RED='\033[0;31m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
log_info() { echo -e "${GREEN}[entrypoint]${NC} $1"; }
|
||||||
|
log_warn() { echo -e "${YELLOW}[entrypoint]${NC} $1"; }
|
||||||
|
log_error() { echo -e "${RED}[entrypoint]${NC} $1"; }
|
||||||
|
|
||||||
|
CONFIG_DIR="/etc/easy-asterisk"
|
||||||
|
CONFIG_FILE="${CONFIG_DIR}/config"
|
||||||
|
WEB_ADMIN_SCRIPT="/usr/local/bin/easy-asterisk-webadmin"
|
||||||
|
|
||||||
|
# ── Helper: generate random password ─────────────────────────
|
||||||
|
gen_password() {
|
||||||
|
openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c 24
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── 1. Ensure asterisk user exists ───────────────────────────
|
||||||
|
if ! id asterisk >/dev/null 2>&1; then
|
||||||
|
useradd -r -s /bin/false -d /var/lib/asterisk asterisk 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 2. Detect public IP ──────────────────────────────────────
|
||||||
|
PUBLIC_IP="${PUBLIC_IP:-}"
|
||||||
|
if [[ -z "$PUBLIC_IP" ]]; then
|
||||||
|
log_info "Auto-detecting public IP..."
|
||||||
|
PUBLIC_IP=$(curl -s -4 --connect-timeout 5 ifconfig.me 2>/dev/null || true)
|
||||||
|
if [[ -z "$PUBLIC_IP" ]]; then
|
||||||
|
PUBLIC_IP=$(curl -s -4 --connect-timeout 5 icanhazip.com 2>/dev/null || true)
|
||||||
|
fi
|
||||||
|
if [[ -z "$PUBLIC_IP" ]]; then
|
||||||
|
PUBLIC_IP=$(curl -s -4 --connect-timeout 5 api.ipify.org 2>/dev/null || true)
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -n "$PUBLIC_IP" ]]; then
|
||||||
|
log_info "Public IP: ${PUBLIC_IP}"
|
||||||
|
else
|
||||||
|
log_warn "Could not detect public IP. Set PUBLIC_IP in .env"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 3. TURN credentials ─────────────────────────────────────────
|
||||||
|
# The password MUST match what coturn was started with. In Docker, both
|
||||||
|
# read from the same env-var / .env file, so we use the value as-is.
|
||||||
|
# Auto-generating a different password here would create a mismatch
|
||||||
|
# (coturn is already running with ITS copy of the env-var).
|
||||||
|
TURN_USERNAME="${TURN_USERNAME:-easyasterisk}"
|
||||||
|
TURN_PASSWORD="${TURN_PASSWORD:-changeme}"
|
||||||
|
if [[ "${TURN_PASSWORD}" == "changeme" ]]; then
|
||||||
|
log_warn "TURN password is the default 'changeme' — set TURN_PASSWORD in .env for better security"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 4. Detect local network ──────────────────────────────────
|
||||||
|
local_ip=$(hostname -I 2>/dev/null | awk '{print $1}')
|
||||||
|
raw_cidr=$(ip -o -f inet addr show 2>/dev/null | awk '/scope global/ {print $4}' | head -1)
|
||||||
|
default_cidr="$raw_cidr"
|
||||||
|
if [[ "$raw_cidr" =~ \.([0-9]+)/([0-9]+)$ ]]; then
|
||||||
|
default_cidr="${raw_cidr%.*}.0/${BASH_REMATCH[2]}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 5. Generate self-signed certs ──────────────────────────────
|
||||||
|
# Regenerate if missing OR if existing cert lacks SANs (modern TLS clients require them)
|
||||||
|
regen_cert=false
|
||||||
|
if [[ ! -f /etc/asterisk/certs/server.crt ]]; then
|
||||||
|
regen_cert=true
|
||||||
|
elif ! openssl x509 -in /etc/asterisk/certs/server.crt -noout -ext subjectAltName 2>/dev/null | grep -q "DNS:"; then
|
||||||
|
log_info "Existing TLS cert lacks SANs — regenerating for mobile phone compatibility"
|
||||||
|
regen_cert=true
|
||||||
|
fi
|
||||||
|
|
||||||
|
if $regen_cert; then
|
||||||
|
log_info "Generating self-signed TLS certificate..."
|
||||||
|
mkdir -p /etc/asterisk/certs
|
||||||
|
cn="${DOMAIN_NAME:-asterisk-local}"
|
||||||
|
# Include Subject Alternative Names — required by modern TLS clients (iOS/Android SIP apps)
|
||||||
|
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
|
||||||
|
-keyout /etc/asterisk/certs/server.key \
|
||||||
|
-out /etc/asterisk/certs/server.crt \
|
||||||
|
-subj "/CN=${cn}" \
|
||||||
|
-addext "subjectAltName=DNS:${cn}${PUBLIC_IP:+,IP:${PUBLIC_IP}}" \
|
||||||
|
2>/dev/null
|
||||||
|
chown asterisk:asterisk /etc/asterisk/certs/server.*
|
||||||
|
chmod 644 /etc/asterisk/certs/server.crt
|
||||||
|
chmod 600 /etc/asterisk/certs/server.key
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 6. Write config file ─────────────────────────────────────
|
||||||
|
mkdir -p "$CONFIG_DIR"
|
||||||
|
|
||||||
|
# Determine TURN/STUN server address
|
||||||
|
turn_server="${TURN_SERVER:-${DOMAIN_NAME:-$local_ip}:${TURN_PORT:-3478}}"
|
||||||
|
|
||||||
|
cat > "$CONFIG_FILE" << EOF
|
||||||
|
# Easy Asterisk Configuration (Docker) - $(date)
|
||||||
|
KIOSK_USER=""
|
||||||
|
KIOSK_UID=""
|
||||||
|
KIOSK_EXTENSION=""
|
||||||
|
KIOSK_NAME=""
|
||||||
|
SIP_PASSWORD=""
|
||||||
|
ASTERISK_HOST="${DOMAIN_NAME:-$local_ip}"
|
||||||
|
DOMAIN_NAME="${DOMAIN_NAME:-}"
|
||||||
|
ENABLE_TLS="${ENABLE_TLS:-y}"
|
||||||
|
HAS_VLANS="${HAS_VLANS:-n}"
|
||||||
|
VLAN_SUBNETS="${VLAN_SUBNETS:-}"
|
||||||
|
CERT_PATH=""
|
||||||
|
KEY_PATH=""
|
||||||
|
INSTALLED_SERVER="y"
|
||||||
|
INSTALLED_CLIENT="n"
|
||||||
|
CURRENT_PUBLIC_IP="${PUBLIC_IP}"
|
||||||
|
PTT_DEVICE=""
|
||||||
|
PTT_KEYCODE=""
|
||||||
|
LOCAL_CIDR="${LOCAL_CIDR:-$default_cidr}"
|
||||||
|
WEB_ADMIN_PORT="${WEB_ADMIN_PORT:-8080}"
|
||||||
|
WEB_ADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}"
|
||||||
|
VPN_ICE_ENABLED="y"
|
||||||
|
CUSTOM_STUN_SERVER="${turn_server}"
|
||||||
|
TURN_ENABLED="y"
|
||||||
|
TURN_SERVER="${turn_server}"
|
||||||
|
TURN_USERNAME="${TURN_USERNAME}"
|
||||||
|
TURN_PASSWORD="${TURN_PASSWORD}"
|
||||||
|
EOF
|
||||||
|
chmod 644 "$CONFIG_FILE"
|
||||||
|
|
||||||
|
# ── 7. Initialize categories & rooms if missing ──────────────
|
||||||
|
CATEGORIES_FILE="${CONFIG_DIR}/categories.conf"
|
||||||
|
if [[ ! -f "$CATEGORIES_FILE" ]]; then
|
||||||
|
log_info "Creating default device categories..."
|
||||||
|
cat > "$CATEGORIES_FILE" << 'EOF'
|
||||||
|
kiosks|Kiosks|yes|Fixed wall-mount tablets & intercoms
|
||||||
|
mobile|Mobile|no|Phones & tablets (ring normally)
|
||||||
|
custom|Custom|no|Custom configuration
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
ROOMS_FILE="${CONFIG_DIR}/rooms.conf"
|
||||||
|
if [[ ! -f "$ROOMS_FILE" ]]; then
|
||||||
|
cat > "$ROOMS_FILE" << 'EOF'
|
||||||
|
# ext|name|members|timeout|type
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 8. Generate Asterisk configs ─────────────────────────────
|
||||||
|
|
||||||
|
# Build local_net entries
|
||||||
|
all_local_nets="local_net=${LOCAL_CIDR:-$default_cidr}"
|
||||||
|
if [[ "${HAS_VLANS:-n}" == "y" && -n "${VLAN_SUBNETS:-}" ]]; then
|
||||||
|
for subnet in $VLAN_SUBNETS; do
|
||||||
|
all_local_nets="${all_local_nets}
|
||||||
|
local_net=${subnet}"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
# NAT settings - always include external addresses for FQDN mode
|
||||||
|
nat_settings=""
|
||||||
|
if [[ -n "$PUBLIC_IP" ]]; then
|
||||||
|
nat_settings="external_media_address=${PUBLIC_IP}
|
||||||
|
external_signaling_address=${PUBLIC_IP}
|
||||||
|
${all_local_nets}"
|
||||||
|
else
|
||||||
|
nat_settings="${all_local_nets}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── pjsip.conf (only if empty/missing - preserves existing devices) ──
|
||||||
|
if [[ ! -f /etc/asterisk/pjsip.conf ]] || [[ ! -s /etc/asterisk/pjsip.conf ]]; then
|
||||||
|
log_info "Generating PJSIP configuration..."
|
||||||
|
cat > /etc/asterisk/pjsip.conf << EOF
|
||||||
|
; Easy Asterisk (Docker) - FQDN: ${DOMAIN_NAME:-none}
|
||||||
|
[global]
|
||||||
|
type=global
|
||||||
|
user_agent=EasyAsterisk
|
||||||
|
|
||||||
|
[transport-udp]
|
||||||
|
type=transport
|
||||||
|
protocol=udp
|
||||||
|
bind=0.0.0.0:5060
|
||||||
|
; Server IP: ${local_ip} | Public IP: ${PUBLIC_IP:-unknown}
|
||||||
|
${nat_settings}
|
||||||
|
|
||||||
|
[transport-tcp]
|
||||||
|
type=transport
|
||||||
|
protocol=tcp
|
||||||
|
bind=0.0.0.0:5060
|
||||||
|
; Server IP: ${local_ip} | Public IP: ${PUBLIC_IP:-unknown}
|
||||||
|
${nat_settings}
|
||||||
|
|
||||||
|
[transport-tls]
|
||||||
|
type=transport
|
||||||
|
protocol=tls
|
||||||
|
bind=0.0.0.0:5061
|
||||||
|
; Server IP: ${local_ip} | Public IP: ${PUBLIC_IP:-unknown}
|
||||||
|
cert_file=/etc/asterisk/certs/server.crt
|
||||||
|
priv_key_file=/etc/asterisk/certs/server.key
|
||||||
|
; ca_list_file not set — only needed for verify_client=yes (client cert auth)
|
||||||
|
method=tlsv1_2
|
||||||
|
${nat_settings}
|
||||||
|
|
||||||
|
EOF
|
||||||
|
chown asterisk:asterisk /etc/asterisk/pjsip.conf
|
||||||
|
else
|
||||||
|
# Update NAT settings in existing pjsip.conf transports if public IP changed
|
||||||
|
if [[ -n "$PUBLIC_IP" ]]; then
|
||||||
|
current_ext=$(grep "^external_media_address=" /etc/asterisk/pjsip.conf 2>/dev/null | head -1 | cut -d= -f2)
|
||||||
|
if [[ "$current_ext" != "$PUBLIC_IP" && -n "$current_ext" ]]; then
|
||||||
|
log_info "Updating public IP in pjsip.conf: ${current_ext} -> ${PUBLIC_IP}"
|
||||||
|
sed -i "s|external_media_address=.*|external_media_address=${PUBLIC_IP}|g" /etc/asterisk/pjsip.conf
|
||||||
|
sed -i "s|external_signaling_address=.*|external_signaling_address=${PUBLIC_IP}|g" /etc/asterisk/pjsip.conf
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Sanitize pjsip.conf: remove endpoint-only options from aor sections ──
|
||||||
|
if [[ -f /etc/asterisk/pjsip.conf ]]; then
|
||||||
|
# Options that are only valid in [endpoint] sections, not in [aor] sections
|
||||||
|
endpoint_only_opts="direct_media|rtp_symmetric|force_rport|rewrite_contact|rtp_keepalive|rtp_timeout|rtp_timeout_hold|ice_support|context|disallow|allow|auth|aors|callerid|media_encryption|transport"
|
||||||
|
current_type=""
|
||||||
|
needs_fix=false
|
||||||
|
while IFS= read -r line; do
|
||||||
|
if [[ "$line" =~ ^type=(.*) ]]; then
|
||||||
|
current_type="${BASH_REMATCH[1]}"
|
||||||
|
fi
|
||||||
|
if [[ "$current_type" == "aor" ]] && echo "$line" | grep -qE "^(${endpoint_only_opts})="; then
|
||||||
|
needs_fix=true
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done < /etc/asterisk/pjsip.conf
|
||||||
|
|
||||||
|
if $needs_fix; then
|
||||||
|
log_info "Sanitizing pjsip.conf (removing misplaced options from aor sections)..."
|
||||||
|
awk -v opts="$endpoint_only_opts" '
|
||||||
|
BEGIN { split(opts, arr, "|"); for (i in arr) bad[arr[i]]=1 }
|
||||||
|
/^type=/ { current_type = substr($0, 6) }
|
||||||
|
{
|
||||||
|
if (current_type == "aor") {
|
||||||
|
split($0, kv, "=")
|
||||||
|
if (kv[1] in bad) next
|
||||||
|
}
|
||||||
|
print
|
||||||
|
}
|
||||||
|
' /etc/asterisk/pjsip.conf > /tmp/pjsip_sanitized.conf
|
||||||
|
mv /tmp/pjsip_sanitized.conf /etc/asterisk/pjsip.conf
|
||||||
|
chown asterisk:asterisk /etc/asterisk/pjsip.conf
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Ensure transport-tls exists in pjsip.conf (upgrade / migration path) ──
|
||||||
|
# If pjsip.conf was preserved from a pre-TLS config or a non-Docker install it
|
||||||
|
# will have no [transport-tls] section. Asterisk starts without TLS silently,
|
||||||
|
# and mobile devices cannot register. Inject the section when it is absent.
|
||||||
|
if [[ -f /etc/asterisk/pjsip.conf ]] && ! grep -q "^\[transport-tls\]" /etc/asterisk/pjsip.conf; then
|
||||||
|
log_info "transport-tls missing from pjsip.conf — adding TLS transport (required for mobile registration)..."
|
||||||
|
cat >> /etc/asterisk/pjsip.conf << EOF
|
||||||
|
|
||||||
|
[transport-tls]
|
||||||
|
type=transport
|
||||||
|
protocol=tls
|
||||||
|
bind=0.0.0.0:5061
|
||||||
|
cert_file=/etc/asterisk/certs/server.crt
|
||||||
|
priv_key_file=/etc/asterisk/certs/server.key
|
||||||
|
; ca_list_file not set — only needed for verify_client=yes (client cert auth)
|
||||||
|
method=tlsv1_2
|
||||||
|
${nat_settings}
|
||||||
|
|
||||||
|
EOF
|
||||||
|
chown asterisk:asterisk /etc/asterisk/pjsip.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── rtp.conf (always regenerated) ──
|
||||||
|
# ICE is enabled so Asterisk participates in ICE negotiation with clients.
|
||||||
|
# stunaddr/turnaddr are NOT set here because:
|
||||||
|
# - Asterisk already knows its public IP via external_media_address in pjsip.conf
|
||||||
|
# - Its RTP ports are port-forwarded, so host candidates are sufficient
|
||||||
|
# - Setting stunaddr/turnaddr causes STUN/TURN gather timeouts (~27s per call)
|
||||||
|
# when the STUN/TURN server is unreachable or misconfigured
|
||||||
|
# coturn is for SIP CLIENTS behind strict NAT — they configure TURN in their
|
||||||
|
# own app settings, independently of Asterisk's rtp.conf.
|
||||||
|
log_info "Configuring RTP with ICE support..."
|
||||||
|
cat > /etc/asterisk/rtp.conf << EOF
|
||||||
|
[general]
|
||||||
|
rtpstart=${RTP_START:-10000}
|
||||||
|
rtpend=${RTP_END:-20000}
|
||||||
|
strictrtp=yes
|
||||||
|
icesupport=yes
|
||||||
|
EOF
|
||||||
|
chown asterisk:asterisk /etc/asterisk/rtp.conf
|
||||||
|
|
||||||
|
# ── extensions.conf (only if missing) ──
|
||||||
|
if [[ ! -f /etc/asterisk/extensions.conf ]] || [[ ! -s /etc/asterisk/extensions.conf ]]; then
|
||||||
|
log_info "Generating dialplan..."
|
||||||
|
cat > /etc/asterisk/extensions.conf << 'EOF'
|
||||||
|
[general]
|
||||||
|
static=yes
|
||||||
|
writeprotect=no
|
||||||
|
[default]
|
||||||
|
exten => _X.,1,Hangup()
|
||||||
|
[intercom]
|
||||||
|
EOF
|
||||||
|
chown asterisk:asterisk /etc/asterisk/extensions.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Other core configs (only if missing) ──
|
||||||
|
if [[ ! -f /etc/asterisk/asterisk.conf ]]; then
|
||||||
|
cat > /etc/asterisk/asterisk.conf << 'EOF'
|
||||||
|
[directories]
|
||||||
|
[options]
|
||||||
|
runuser = asterisk
|
||||||
|
rungroup = asterisk
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── logger.conf (always regenerated - ensures security logging is on) ──
|
||||||
|
cat > /etc/asterisk/logger.conf << 'EOF'
|
||||||
|
[general]
|
||||||
|
[logfiles]
|
||||||
|
; security level captures TLS handshake failures and auth issues
|
||||||
|
console => notice,warning,error,security
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# ── modules.conf (always regenerated - ensures chan_sip stays disabled) ──
|
||||||
|
cat > /etc/asterisk/modules.conf << 'EOF'
|
||||||
|
[modules]
|
||||||
|
autoload=yes
|
||||||
|
noload => chan_sip.so
|
||||||
|
noload => chan_iax2.so
|
||||||
|
; Opus transcoding unavailable on Ubuntu 24.04 (bug #2044135)
|
||||||
|
; Opus pass-through still works via res_format_attr_opus.so
|
||||||
|
noload => codec_opus.so
|
||||||
|
noload => format_ogg_opus.so
|
||||||
|
load => res_pjsip.so
|
||||||
|
load => res_pjsip_session.so
|
||||||
|
load => res_pjsip_logger.so
|
||||||
|
load => chan_pjsip.so
|
||||||
|
load => codec_ulaw.so
|
||||||
|
load => codec_alaw.so
|
||||||
|
load => codec_g722.so
|
||||||
|
load => res_rtp_asterisk.so
|
||||||
|
load => app_dial.so
|
||||||
|
load => app_page.so
|
||||||
|
load => pbx_config.so
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# ── Remove incompatible Digium codec_opus if present on volume ──
|
||||||
|
# The Digium binary is ABI-incompatible with Ubuntu 24.04's Asterisk and crashes it
|
||||||
|
MODULES_DIR=$(find /usr/lib -type d -name modules -path "*/asterisk/*" 2>/dev/null | head -1)
|
||||||
|
if [[ -n "$MODULES_DIR" ]]; then
|
||||||
|
for bad_module in codec_opus.so format_ogg_opus.so; do
|
||||||
|
if [[ -f "$MODULES_DIR/$bad_module" ]] && ! dpkg -S "$MODULES_DIR/$bad_module" >/dev/null 2>&1; then
|
||||||
|
log_warn "Removing incompatible $bad_module (not from Ubuntu package)"
|
||||||
|
rm -f "$MODULES_DIR/$bad_module"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 9. Fix permissions ───────────────────────────────────────
|
||||||
|
chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk /var/run/asterisk 2>/dev/null || true
|
||||||
|
|
||||||
|
# ── 10. Start Web Admin in background ─────────────────────────
|
||||||
|
# The web admin script is generated by the 'easy-asterisk' management tool.
|
||||||
|
# On first run: docker exec -it easy-asterisk easy-asterisk → Web Admin menu → Start
|
||||||
|
if [[ -f "$WEB_ADMIN_SCRIPT" ]]; then
|
||||||
|
log_info "Starting Web Admin on port ${WEB_ADMIN_PORT:-8080}..."
|
||||||
|
WEBADMIN_PORT="${WEB_ADMIN_PORT:-8080}" \
|
||||||
|
WEBADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}" \
|
||||||
|
python3 "$WEB_ADMIN_SCRIPT" &
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── 11. Signal handling for clean shutdown ────────────────────
|
||||||
|
cleanup() {
|
||||||
|
log_info "Shutting down..."
|
||||||
|
pkill -f "easy-asterisk-webadmin" 2>/dev/null || true
|
||||||
|
asterisk -rx "core stop now" 2>/dev/null || true
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
trap cleanup SIGTERM SIGINT
|
||||||
|
|
||||||
|
# ── 12. Start Asterisk ───────────────────────────────────────
|
||||||
|
log_info "Starting Asterisk PBX..."
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Start Asterisk in the background, then print management info once ready
|
||||||
|
asterisk -f -U asterisk -G asterisk &
|
||||||
|
ASTERISK_PID=$!
|
||||||
|
|
||||||
|
# Wait for Asterisk to be ready (up to 60 seconds)
|
||||||
|
for i in $(seq 1 60); do
|
||||||
|
if asterisk -rx "core show version" >/dev/null 2>&1; then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
sleep 1
|
||||||
|
done
|
||||||
|
|
||||||
|
# Verify PJSIP transports are listening
|
||||||
|
tls_ok=false
|
||||||
|
udp_ok=false
|
||||||
|
if asterisk -rx "pjsip show transports" 2>/dev/null | grep -q "transport-tls"; then
|
||||||
|
tls_ok=true
|
||||||
|
fi
|
||||||
|
if asterisk -rx "pjsip show transports" 2>/dev/null | grep -q "transport-udp"; then
|
||||||
|
udp_ok=true
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if port 5061 is actually bound
|
||||||
|
tls_listen=""
|
||||||
|
if command -v ss &>/dev/null; then
|
||||||
|
tls_listen=$(ss -tlnp 2>/dev/null | grep ":5061 " || true)
|
||||||
|
elif command -v netstat &>/dev/null; then
|
||||||
|
tls_listen=$(netstat -tlnp 2>/dev/null | grep ":5061 " || true)
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}══════════════════════════════════════════════════════════════${NC}"
|
||||||
|
echo -e "${CYAN} Easy Asterisk (Docker)${NC}"
|
||||||
|
echo -e "${CYAN}══════════════════════════════════════════════════════════════${NC}"
|
||||||
|
echo -e " FQDN: ${GREEN}${DOMAIN_NAME:-not set}${NC}"
|
||||||
|
echo -e " Public IP: ${GREEN}${PUBLIC_IP:-unknown}${NC}"
|
||||||
|
echo -e " TURN/STUN: ${GREEN}${turn_server}${NC}"
|
||||||
|
if $tls_ok && [[ -n "$tls_listen" ]]; then
|
||||||
|
echo -e " TLS: ${GREEN}Enabled (port 5061)${NC}"
|
||||||
|
elif $tls_ok; then
|
||||||
|
echo -e " TLS: ${YELLOW}Transport loaded but port 5061 not bound — check certs${NC}"
|
||||||
|
else
|
||||||
|
echo -e " TLS: ${RED}NOT LOADED — check Asterisk logs${NC}"
|
||||||
|
fi
|
||||||
|
echo -e " ICE: ${GREEN}Enabled${NC}"
|
||||||
|
echo -e "${CYAN}──────────────────────────────────────────────────────────────${NC}"
|
||||||
|
echo -e " SIP clients connect to: ${GREEN}${DOMAIN_NAME:-$local_ip}:5061${NC} (TLS)"
|
||||||
|
echo -e " Web Admin: ${GREEN}http://${local_ip}:${WEB_ADMIN_PORT:-8080}/clients${NC}"
|
||||||
|
echo -e "${CYAN}──────────────────────────────────────────────────────────────${NC}"
|
||||||
|
echo -e " Management: ${YELLOW}docker exec -it easy-asterisk easy-asterisk${NC}"
|
||||||
|
echo -e " Diagnostics: docker exec -it easy-asterisk vpn-diagnostics"
|
||||||
|
echo -e "${CYAN}══════════════════════════════════════════════════════════════${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Wait for Asterisk process (keeps container running)
|
||||||
|
wait $ASTERISK_PID
|
||||||
+6929
File diff suppressed because it is too large
Load Diff
+280
@@ -0,0 +1,280 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# ================================================================
|
||||||
|
# DNS Whitelist Checker for Easy Asterisk
|
||||||
|
#
|
||||||
|
# Checks which domains need to be whitelisted when DNS filtering
|
||||||
|
# is active on the server, caller, or receiver networks.
|
||||||
|
#
|
||||||
|
# Usage: dns-whitelist [--check] [--sipnetic] [--linphone]
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
BOLD='\033[1m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
CONFIG_FILE="/etc/easy-asterisk/config"
|
||||||
|
CHECK_MODE=false
|
||||||
|
SHOW_SIPNETIC=false
|
||||||
|
SHOW_LINPHONE=false
|
||||||
|
SHOW_ALL=true
|
||||||
|
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
--check) CHECK_MODE=true; shift ;;
|
||||||
|
--sipnetic) SHOW_SIPNETIC=true; SHOW_ALL=false; shift ;;
|
||||||
|
--linphone) SHOW_LINPHONE=true; SHOW_ALL=false; shift ;;
|
||||||
|
--help|-h)
|
||||||
|
echo "Usage: dns-whitelist [OPTIONS]"
|
||||||
|
echo ""
|
||||||
|
echo "Options:"
|
||||||
|
echo " --check Test reachability of each domain"
|
||||||
|
echo " --sipnetic Show Sipnetic-specific domains"
|
||||||
|
echo " --linphone Show Linphone-specific domains"
|
||||||
|
echo " --help Show this help"
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*) shift ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
print_header() {
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${CYAN} $1${NC}"
|
||||||
|
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo ""
|
||||||
|
}
|
||||||
|
|
||||||
|
check_dns() {
|
||||||
|
local domain="$1"
|
||||||
|
local port="$2"
|
||||||
|
local proto="${3:-tcp}"
|
||||||
|
|
||||||
|
if $CHECK_MODE; then
|
||||||
|
# DNS resolution test
|
||||||
|
if nslookup "$domain" >/dev/null 2>&1; then
|
||||||
|
echo -e " ${GREEN}✓ DNS resolves${NC}"
|
||||||
|
else
|
||||||
|
echo -e " ${RED}✗ DNS BLOCKED - add to whitelist${NC}"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Connectivity test
|
||||||
|
if [[ "$proto" == "udp" ]]; then
|
||||||
|
# UDP - just check DNS resolution (can't reliably test UDP connectivity)
|
||||||
|
echo -e " ${CYAN}→ UDP port ${port} (cannot test remotely)${NC}"
|
||||||
|
else
|
||||||
|
if curl -s --connect-timeout 5 "https://${domain}" >/dev/null 2>&1 || \
|
||||||
|
curl -s --connect-timeout 5 "http://${domain}" >/dev/null 2>&1; then
|
||||||
|
echo -e " ${GREEN}✓ Reachable${NC}"
|
||||||
|
else
|
||||||
|
echo -e " ${YELLOW}! Connection failed (may be expected)${NC}"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Load config if available
|
||||||
|
source "$CONFIG_FILE" 2>/dev/null || true
|
||||||
|
|
||||||
|
print_header "DNS Whitelist for Easy Asterisk"
|
||||||
|
|
||||||
|
echo -e "${BOLD}Your Setup:${NC}"
|
||||||
|
if [[ -n "$DOMAIN_NAME" ]]; then
|
||||||
|
echo -e " Mode: FQDN/Internet (${DOMAIN_NAME})"
|
||||||
|
else
|
||||||
|
echo -e " Mode: LAN/VPN (no domain configured)"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
# SECTION 1: ASTERISK SERVER DOMAINS
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
if $SHOW_ALL; then
|
||||||
|
echo -e "${BOLD}━━━ 1. ASTERISK SERVER (whitelist on server's DNS filter) ━━━${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for LAN/VPN mode:${NC}"
|
||||||
|
echo -e " ${GREEN}None${NC} - Asterisk needs no internet after installation"
|
||||||
|
echo -e " SIP operates over direct IP connections, no DNS involved"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for FQDN/Internet mode only:${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e " ${CYAN}ifconfig.me${NC} (HTTPS 443)"
|
||||||
|
echo -e " Purpose: Auto-detect public IP for NAT settings"
|
||||||
|
echo -e " When: Only during config regeneration"
|
||||||
|
check_dns "ifconfig.me" "443"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e " ${CYAN}icanhazip.com${NC} (HTTPS 443)"
|
||||||
|
echo -e " Purpose: Fallback public IP detection"
|
||||||
|
check_dns "icanhazip.com" "443"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required if ICE/STUN enabled:${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Check what STUN server is configured
|
||||||
|
stun_server=""
|
||||||
|
if [[ -f /etc/asterisk/rtp.conf ]]; then
|
||||||
|
stun_server=$(grep "^stunaddr=" /etc/asterisk/rtp.conf 2>/dev/null | cut -d= -f2)
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -n "$stun_server" ]]; then
|
||||||
|
stun_host=$(echo "$stun_server" | cut -d: -f1)
|
||||||
|
stun_port=$(echo "$stun_server" | cut -d: -f2)
|
||||||
|
stun_port="${stun_port:-3478}"
|
||||||
|
echo -e " ${CYAN}${stun_host}${NC} (UDP ${stun_port})"
|
||||||
|
echo -e " Purpose: STUN NAT discovery"
|
||||||
|
echo -e " ${YELLOW}Tip: Use self-hosted coturn to avoid this dependency${NC}"
|
||||||
|
check_dns "$stun_host" "$stun_port" "udp"
|
||||||
|
else
|
||||||
|
echo -e " ${GREEN}No external STUN server configured${NC}"
|
||||||
|
echo -e " To use self-hosted: docker compose --profile stun up -d"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for package updates only:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}archive.ubuntu.com${NC} / ${CYAN}security.ubuntu.com${NC} (HTTPS 443)"
|
||||||
|
echo -e " Purpose: apt package updates"
|
||||||
|
echo -e " When: Only during install/update (not runtime)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for TLS certificates:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}acme-v02.api.letsencrypt.org${NC} (HTTPS 443)"
|
||||||
|
echo -e " Purpose: Let's Encrypt certificate issuance"
|
||||||
|
echo -e " When: Only if using Let's Encrypt / Certbot / Caddy"
|
||||||
|
if $CHECK_MODE; then
|
||||||
|
check_dns "acme-v02.api.letsencrypt.org" "443"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
# SECTION 2: SIPNETIC (Mobile Client) DOMAINS
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
if $SHOW_ALL || $SHOW_SIPNETIC; then
|
||||||
|
echo -e "${BOLD}━━━ 2. SIPNETIC CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for SIP calls:${NC}"
|
||||||
|
echo -e " ${GREEN}None${NC} - Configure Sipnetic with the server's IP address directly"
|
||||||
|
echo -e " SIP registration and calls use IP:port, not DNS"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Sipnetic app domains (for app functionality):${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}onesip.io${NC} / ${CYAN}api.onesip.io${NC}"
|
||||||
|
echo -e " Purpose: Sipnetic account/licensing (free tier works offline)"
|
||||||
|
echo -e " Required: Only for initial setup or account sync"
|
||||||
|
if $CHECK_MODE; then
|
||||||
|
check_dns "onesip.io" "443"
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e " ${CYAN}play.google.com${NC} / ${CYAN}apps.apple.com${NC}"
|
||||||
|
echo -e " Purpose: App updates"
|
||||||
|
echo -e " Required: Only for installing/updating the app"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}If STUN configured in Sipnetic:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " The STUN server domain configured in Sipnetic's settings"
|
||||||
|
echo -e " needs to resolve on the mobile device's network."
|
||||||
|
echo ""
|
||||||
|
echo -e " ${YELLOW}Recommendation: Use the Asterisk server's VPN IP as STUN${NC}"
|
||||||
|
echo -e " ${YELLOW}server (if running self-hosted coturn), avoiding DNS entirely.${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Sipnetic Configuration for DNS-Filtered Networks:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server: ${CYAN}<server-vpn-ip>${NC} (not a hostname)"
|
||||||
|
echo -e " Port: ${CYAN}5060${NC} (UDP, LAN/VPN mode)"
|
||||||
|
echo -e " Transport: ${CYAN}UDP${NC}"
|
||||||
|
echo -e " STUN: ${CYAN}<server-vpn-ip>:3478${NC} (if self-hosted coturn)"
|
||||||
|
echo -e " or leave blank if VPN provides direct routing"
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
# SECTION 3: LINPHONE (Mobile Client) DOMAINS
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
if $SHOW_ALL || $SHOW_LINPHONE; then
|
||||||
|
echo -e "${BOLD}━━━ 3. LINPHONE CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Required for SIP calls:${NC}"
|
||||||
|
echo -e " ${GREEN}None${NC} - Same as Sipnetic, configure with server IP directly"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}Linphone app domains:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}linphone.org${NC} / ${CYAN}sip.linphone.org${NC}"
|
||||||
|
echo -e " Purpose: Default Linphone SIP proxy (NOT needed for Easy Asterisk)"
|
||||||
|
echo -e " Required: ${GREEN}No${NC} - We use our own Asterisk server"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${CYAN}subscribe.linphone.org${NC}"
|
||||||
|
echo -e " Purpose: Push notifications (may be needed for background calls)"
|
||||||
|
echo -e " Required: Only if you need calls to ring when app is backgrounded"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}For remote provisioning:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " If using Easy Asterisk's HTTP provisioning:"
|
||||||
|
echo -e " The phone must reach ${CYAN}http://<server-ip>:8088/static/linphone.xml${NC}"
|
||||||
|
echo -e " This is an IP address, so no DNS whitelist needed."
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
# SECTION 4: SUMMARY
|
||||||
|
# ══════════════════════════════════════════════════════════════
|
||||||
|
if $SHOW_ALL; then
|
||||||
|
print_header "Quick Reference - Minimum DNS Whitelist"
|
||||||
|
|
||||||
|
echo -e "${BOLD}For LAN/VPN mode (no internet calling):${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
|
||||||
|
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
|
||||||
|
echo -e " (Configure everything by IP address)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}For LAN/VPN + self-hosted STUN (coturn):${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
|
||||||
|
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
|
||||||
|
echo -e " (STUN server reached by VPN IP, not hostname)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}For LAN/VPN + Google STUN:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server DNS filter: ${YELLOW}stun.l.google.com${NC}"
|
||||||
|
echo -e " Client DNS filter: ${YELLOW}stun.l.google.com${NC} (if also set in Sipnetic)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo -e "${BOLD}For FQDN/Internet mode:${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Server DNS filter: ${YELLOW}ifconfig.me, icanhazip.com, stun.l.google.com${NC}"
|
||||||
|
echo -e " ${YELLOW}acme-v02.api.letsencrypt.org${NC} (if using LE certs)"
|
||||||
|
echo -e " Client DNS filter: ${YELLOW}Your domain name (${DOMAIN_NAME:-yourdomain.com})${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
print_header "Recommendation for DNS-Filtered Environments"
|
||||||
|
|
||||||
|
echo -e " ${GREEN}Use LAN/VPN mode + self-hosted coturn (STUN-only)${NC}"
|
||||||
|
echo -e " ${GREEN}= Zero external DNS dependencies${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " Setup: docker compose --profile stun up -d"
|
||||||
|
echo -e " Then configure STUN as your server's VPN IP:3478"
|
||||||
|
echo -e " No hostnames, no DNS, everything by IP."
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
+366
@@ -0,0 +1,366 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# ================================================================
|
||||||
|
# VPN Diagnostics for Easy Asterisk
|
||||||
|
#
|
||||||
|
# Tests whether your third-party VPN setup needs STUN/TURN
|
||||||
|
# and validates connectivity between Asterisk and VPN clients.
|
||||||
|
#
|
||||||
|
# Usage: vpn-diagnostics [--auto] [--client-ip <ip>]
|
||||||
|
# ================================================================
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
CYAN='\033[0;36m'
|
||||||
|
BOLD='\033[1m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
CONFIG_FILE="/etc/easy-asterisk/config"
|
||||||
|
RESULTS=()
|
||||||
|
WARNINGS=()
|
||||||
|
CLIENT_IP=""
|
||||||
|
AUTO_MODE=false
|
||||||
|
|
||||||
|
# Parse arguments
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
--auto) AUTO_MODE=true; shift ;;
|
||||||
|
--client-ip) CLIENT_IP="$2"; shift 2 ;;
|
||||||
|
--help|-h)
|
||||||
|
echo "Usage: vpn-diagnostics [OPTIONS]"
|
||||||
|
echo ""
|
||||||
|
echo "Options:"
|
||||||
|
echo " --auto Non-interactive mode"
|
||||||
|
echo " --client-ip <ip> Test connectivity to specific VPN client"
|
||||||
|
echo " --help Show this help"
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*) shift ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
print_header() {
|
||||||
|
echo ""
|
||||||
|
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
|
||||||
|
echo -e "${CYAN} $1${NC}"
|
||||||
|
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
|
||||||
|
echo ""
|
||||||
|
}
|
||||||
|
|
||||||
|
pass() { echo -e " ${GREEN}✓${NC} $1"; RESULTS+=("PASS: $1"); }
|
||||||
|
fail() { echo -e " ${RED}✗${NC} $1"; RESULTS+=("FAIL: $1"); }
|
||||||
|
warn() { echo -e " ${YELLOW}!${NC} $1"; WARNINGS+=("$1"); }
|
||||||
|
info() { echo -e " ${CYAN}→${NC} $1"; }
|
||||||
|
|
||||||
|
# ── Test 1: Detect network interfaces ────────────────────────
|
||||||
|
print_header "VPN Diagnostics for Easy Asterisk"
|
||||||
|
|
||||||
|
echo -e "${BOLD}1. Network Interface Detection${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Detect primary LAN interface
|
||||||
|
primary_ip=$(hostname -I | awk '{print $1}')
|
||||||
|
info "Primary IP: ${primary_ip}"
|
||||||
|
|
||||||
|
# Detect VPN interfaces (tun, tap, wg, tailscale, utun, ppp)
|
||||||
|
vpn_found=false
|
||||||
|
vpn_ips=()
|
||||||
|
vpn_ifaces=()
|
||||||
|
|
||||||
|
while IFS= read -r line; do
|
||||||
|
iface=$(echo "$line" | awk '{print $2}' | tr -d ':')
|
||||||
|
ip_addr=$(echo "$line" | awk '{print $4}' | cut -d'/' -f1)
|
||||||
|
|
||||||
|
# Check for VPN interface patterns
|
||||||
|
if [[ "$iface" =~ ^(tun|tap|wg|tailscale|utun|ppp|nordlynx|proton|mullvad) ]] || \
|
||||||
|
[[ "$ip_addr" =~ ^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|100\.64\.|100\.96\.|100\.100\.) ]]; then
|
||||||
|
vpn_found=true
|
||||||
|
vpn_ips+=("$ip_addr")
|
||||||
|
vpn_ifaces+=("$iface")
|
||||||
|
pass "VPN interface detected: ${iface} (${ip_addr})"
|
||||||
|
fi
|
||||||
|
done < <(ip -o -f inet addr show scope global 2>/dev/null)
|
||||||
|
|
||||||
|
if ! $vpn_found; then
|
||||||
|
warn "No VPN interface detected on server"
|
||||||
|
info "If your VPN runs on the router (not this server), that's expected"
|
||||||
|
info "The VPN subnet should be added via VLAN/VPN subnet configuration"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 2: Check Asterisk PJSIP transport configuration ─────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}2. Asterisk Transport Configuration${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [[ -f /etc/asterisk/pjsip.conf ]]; then
|
||||||
|
# Check local_net entries
|
||||||
|
local_nets=$(grep "^local_net=" /etc/asterisk/pjsip.conf 2>/dev/null | sort -u)
|
||||||
|
if [[ -n "$local_nets" ]]; then
|
||||||
|
while IFS= read -r net; do
|
||||||
|
info "Transport local_net: ${net#local_net=}"
|
||||||
|
done <<< "$local_nets"
|
||||||
|
|
||||||
|
# Check if VPN subnets are included
|
||||||
|
for vpn_ip in "${vpn_ips[@]}"; do
|
||||||
|
vpn_subnet=$(echo "$vpn_ip" | sed 's/\.[0-9]*$/.0\/24/')
|
||||||
|
if echo "$local_nets" | grep -q "$vpn_subnet"; then
|
||||||
|
pass "VPN subnet ${vpn_subnet} included in transport"
|
||||||
|
else
|
||||||
|
fail "VPN subnet ${vpn_subnet} NOT in transport local_net"
|
||||||
|
warn "Add via: Server Settings → Configure VLAN/VPN Subnets"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
else
|
||||||
|
warn "No local_net entries found in transport (basic LAN mode)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check transport types
|
||||||
|
if grep -q "transport=transport-udp" /etc/asterisk/pjsip.conf; then
|
||||||
|
pass "UDP transport configured for LAN/VPN devices"
|
||||||
|
fi
|
||||||
|
if grep -q "transport=transport-tls" /etc/asterisk/pjsip.conf; then
|
||||||
|
pass "TLS transport configured for FQDN devices"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
fail "pjsip.conf not found"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 2b: TLS Certificate & Port Checks ────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}2b. TLS / Certificate Status${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Check if port 5061 is actually listening
|
||||||
|
if command -v ss &>/dev/null; then
|
||||||
|
tls_listen=$(ss -tlnp 2>/dev/null | grep ":5061 " || true)
|
||||||
|
elif command -v netstat &>/dev/null; then
|
||||||
|
tls_listen=$(netstat -tlnp 2>/dev/null | grep ":5061 " || true)
|
||||||
|
else
|
||||||
|
tls_listen=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -n "$tls_listen" ]]; then
|
||||||
|
pass "Port 5061 (TLS) is listening"
|
||||||
|
else
|
||||||
|
fail "Port 5061 (TLS) is NOT listening"
|
||||||
|
warn "Asterisk TLS transport failed to start — check certs and logs"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check TLS cert
|
||||||
|
cert_file="/etc/asterisk/certs/server.crt"
|
||||||
|
if [[ -f "$cert_file" ]]; then
|
||||||
|
pass "TLS certificate exists: $cert_file"
|
||||||
|
|
||||||
|
# Check cert CN/SAN
|
||||||
|
cert_cn=$(openssl x509 -in "$cert_file" -noout -subject 2>/dev/null | sed 's/.*CN *= *//')
|
||||||
|
cert_san=$(openssl x509 -in "$cert_file" -noout -ext subjectAltName 2>/dev/null | grep -oP 'DNS:\K[^,]+' || true)
|
||||||
|
cert_expiry=$(openssl x509 -in "$cert_file" -noout -enddate 2>/dev/null | cut -d= -f2)
|
||||||
|
|
||||||
|
info "Cert CN: ${cert_cn:-unknown}"
|
||||||
|
if [[ -n "$cert_san" ]]; then
|
||||||
|
pass "Cert has SAN (Subject Alt Name): ${cert_san}"
|
||||||
|
else
|
||||||
|
fail "Cert has NO SAN — modern phones (iOS/Android) will reject it"
|
||||||
|
warn "Delete /etc/asterisk/certs/server.crt and restart to regenerate with SANs"
|
||||||
|
fi
|
||||||
|
info "Cert expires: ${cert_expiry:-unknown}"
|
||||||
|
|
||||||
|
# Check if cert is self-signed
|
||||||
|
issuer=$(openssl x509 -in "$cert_file" -noout -issuer 2>/dev/null | sed 's/.*CN *= *//')
|
||||||
|
if [[ "$issuer" == "$cert_cn" ]]; then
|
||||||
|
warn "Cert is SELF-SIGNED — phones must be set to accept self-signed certs"
|
||||||
|
info "In your SIP app: disable TLS certificate verification / allow self-signed"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Verify PJSIP transport loaded it
|
||||||
|
if command -v asterisk &>/dev/null; then
|
||||||
|
transport_status=$(asterisk -rx "pjsip show transports" 2>/dev/null || true)
|
||||||
|
if echo "$transport_status" | grep -q "transport-tls"; then
|
||||||
|
pass "PJSIP TLS transport is loaded"
|
||||||
|
else
|
||||||
|
fail "PJSIP TLS transport NOT loaded — cert may be invalid"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
fail "TLS certificate not found at $cert_file"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 3: Check RTP and ICE/STUN configuration ─────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}3. RTP / ICE / STUN Configuration${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [[ -f /etc/asterisk/rtp.conf ]]; then
|
||||||
|
rtp_start=$(grep "^rtpstart=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||||
|
rtp_end=$(grep "^rtpend=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||||
|
info "RTP port range: ${rtp_start:-10000}-${rtp_end:-20000}"
|
||||||
|
|
||||||
|
if grep -q "^icesupport=yes" /etc/asterisk/rtp.conf; then
|
||||||
|
pass "ICE support enabled"
|
||||||
|
stun_addr=$(grep "^stunaddr=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||||
|
if [[ -n "$stun_addr" ]]; then
|
||||||
|
info "STUN server: ${stun_addr}"
|
||||||
|
|
||||||
|
# Test STUN server reachability
|
||||||
|
stun_host=$(echo "$stun_addr" | cut -d: -f1)
|
||||||
|
stun_port=$(echo "$stun_addr" | cut -d: -f2)
|
||||||
|
stun_port="${stun_port:-3478}"
|
||||||
|
|
||||||
|
if command -v nslookup &>/dev/null && nslookup "$stun_host" >/dev/null 2>&1; then
|
||||||
|
pass "STUN server DNS resolves: ${stun_host}"
|
||||||
|
else
|
||||||
|
fail "Cannot resolve STUN server: ${stun_host}"
|
||||||
|
warn "Add ${stun_host} to DNS whitelist"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "ICE support disabled (standard for LAN/VPN mode)"
|
||||||
|
warn "If audio fails over VPN, enable ICE via: Server Settings → VPN STUN/ICE"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
warn "rtp.conf not found"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 4: Check endpoint ICE settings ───────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}4. Per-Device ICE Configuration${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [[ -f /etc/asterisk/pjsip.conf ]]; then
|
||||||
|
device_count=$(grep -c "^; === Device:" /etc/asterisk/pjsip.conf 2>/dev/null || echo 0)
|
||||||
|
ice_device_count=$(grep -c "^ice_support=yes" /etc/asterisk/pjsip.conf 2>/dev/null || echo 0)
|
||||||
|
info "Total devices: ${device_count}"
|
||||||
|
info "Devices with ICE: ${ice_device_count}"
|
||||||
|
|
||||||
|
if [[ "$device_count" -gt 0 && "$ice_device_count" -eq 0 ]]; then
|
||||||
|
warn "No devices have ICE enabled"
|
||||||
|
info "For third-party VPNs with NAT, enable ICE via VPN STUN/ICE menu"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 5: VPN client connectivity ──────────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}5. VPN Client Connectivity${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [[ -z "$CLIENT_IP" ]] && ! $AUTO_MODE; then
|
||||||
|
echo " Enter a VPN client IP to test connectivity (or press Enter to skip):"
|
||||||
|
read -p " Client VPN IP: " CLIENT_IP
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -n "$CLIENT_IP" ]]; then
|
||||||
|
# Ping test
|
||||||
|
if ping -c 2 -W 3 "$CLIENT_IP" >/dev/null 2>&1; then
|
||||||
|
pass "Ping to ${CLIENT_IP} succeeded"
|
||||||
|
else
|
||||||
|
fail "Ping to ${CLIENT_IP} failed"
|
||||||
|
warn "VPN routing issue - client may not be reachable"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# SIP port test (UDP 5060)
|
||||||
|
if command -v nc &>/dev/null; then
|
||||||
|
if nc -z -u -w 3 "$CLIENT_IP" 5060 2>/dev/null; then
|
||||||
|
pass "UDP 5060 reachable on ${CLIENT_IP}"
|
||||||
|
else
|
||||||
|
info "UDP 5060 probe inconclusive (normal for filtered VPNs)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "Skipping client connectivity test (no IP provided)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 6: NAT type detection ───────────────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}6. NAT Type Analysis${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Check if server is behind NAT
|
||||||
|
if [[ -n "$primary_ip" ]]; then
|
||||||
|
public_ip=$(curl -s -4 --connect-timeout 5 ifconfig.me 2>/dev/null || echo "")
|
||||||
|
if [[ -n "$public_ip" ]]; then
|
||||||
|
if [[ "$primary_ip" == "$public_ip" ]]; then
|
||||||
|
pass "Server has public IP (no NAT)"
|
||||||
|
else
|
||||||
|
info "Server behind NAT: ${primary_ip} → ${public_ip}"
|
||||||
|
info "This is normal for VPN setups where traffic stays on VPN"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "Cannot detect public IP (DNS filtering or no internet)"
|
||||||
|
info "Not needed for LAN/VPN mode"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Test 7: Asterisk registration status ─────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}7. Asterisk Registration Status${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if command -v asterisk &>/dev/null; then
|
||||||
|
reg_output=$(asterisk -rx "pjsip show endpoints" 2>/dev/null || echo "")
|
||||||
|
if [[ -n "$reg_output" ]]; then
|
||||||
|
online_count=$(echo "$reg_output" | grep -c "Avail" 2>/dev/null || echo 0)
|
||||||
|
offline_count=$(echo "$reg_output" | grep -c "Unavail" 2>/dev/null || echo 0)
|
||||||
|
info "Endpoints online: ${online_count}"
|
||||||
|
info "Endpoints offline: ${offline_count}"
|
||||||
|
|
||||||
|
if [[ "$offline_count" -gt 0 ]]; then
|
||||||
|
warn "Some endpoints are offline - check VPN connectivity"
|
||||||
|
echo "$reg_output" | grep "Unavail" | while IFS= read -r line; do
|
||||||
|
info " Offline: $line"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "Asterisk not running or no endpoints configured"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
info "Asterisk CLI not available"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Summary ──────────────────────────────────────────────────
|
||||||
|
print_header "Diagnostic Summary"
|
||||||
|
|
||||||
|
fail_count=0
|
||||||
|
pass_count=0
|
||||||
|
for result in "${RESULTS[@]}"; do
|
||||||
|
if [[ "$result" == FAIL* ]]; then
|
||||||
|
((fail_count++))
|
||||||
|
elif [[ "$result" == PASS* ]]; then
|
||||||
|
((pass_count++))
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo -e " Passed: ${GREEN}${pass_count}${NC}"
|
||||||
|
echo -e " Failed: ${RED}${fail_count}${NC}"
|
||||||
|
echo -e " Warnings: ${YELLOW}${#WARNINGS[@]}${NC}"
|
||||||
|
|
||||||
|
if [[ ${#WARNINGS[@]} -gt 0 ]]; then
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}Recommendations:${NC}"
|
||||||
|
for w in "${WARNINGS[@]}"; do
|
||||||
|
echo -e " ${YELLOW}→${NC} $w"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── STUN Recommendation ─────────────────────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${BOLD}Do you need STUN?${NC}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if $vpn_found; then
|
||||||
|
echo -e " VPN detected on this server."
|
||||||
|
echo -e " ${GREEN}If your VPN provides direct routing (both sides get VPN IPs),${NC}"
|
||||||
|
echo -e " ${GREEN}STUN is likely NOT needed.${NC}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${YELLOW}If audio works one-way or not at all, enable STUN:${NC}"
|
||||||
|
echo -e " 1. docker compose --profile stun up -d (self-hosted STUN)"
|
||||||
|
echo -e " 2. Or via easy-asterisk: Server Settings → VPN STUN/ICE"
|
||||||
|
else
|
||||||
|
echo -e " No VPN interface found on server."
|
||||||
|
echo -e " ${YELLOW}If VPN runs on router/firewall:${NC}"
|
||||||
|
echo -e " - Add VPN subnet via: Server Settings → VLAN/VPN Subnets"
|
||||||
|
echo -e " - If audio still fails, enable STUN for NAT traversal"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
Reference in New Issue
Block a user