Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk
asterisk.sh (homelab): - Easy Asterisk PBX with self-hosted coturn TURN server - Vendored from outis1one/easy-asterisk v0.10.0 for offline install - LAN-only or FQDN mode (TLS + TURN relay for remote access) - Auto-answer SIP headers for intercom use case - Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen - UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp - Builds custom Docker image from vendor/easy-asterisk/ nextcloud.sh (utilities): - Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage) - MariaDB 10.11 sidecar with matching env vars - OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy - Enables files_external app after first-run init (waits up to 90s) onlyoffice.sh (utilities): - JWT generated once, preserved across re-runs - _ensure_yq: auto-installs yq v4 for FileBrowser config patching - _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret) - _wire_filebrowser: patches config.yaml + restarts container - Caddy block overrides X-Frame-Options to allow iframe embedding mattermost.sh (utilities): - PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479) - 8443/udp for Calls plugin RTC server - coturn uses --use-auth-secret HMAC mode (required by Calls plugin) - SITE_URL computed from SITE_DOMAIN, promptable - UFW: 8443/udp, 3479, 49153-49352/udp vendor/easy-asterisk/: - All upstream source files vendored for offline/self-contained installs - Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh - easy-asterisk-v0.10.0.sh (6929-line management script) - scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh - .env.example https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt
This commit is contained in:
Claude
Vendored
+32
@@ -0,0 +1,32 @@
|
||||
# ================================================================
|
||||
# Easy Asterisk — Environment Configuration
|
||||
# Copy to .env and fill in your values.
|
||||
# ================================================================
|
||||
|
||||
# ── Domain (REQUIRED for remote/FQDN access) ──────────────────
|
||||
# Your FQDN pointing to this server's public IP.
|
||||
# Leave empty for LAN-only mode.
|
||||
DOMAIN_NAME=asterisk.example.com
|
||||
|
||||
# ── TURN/STUN ──────────────────────────────────────────────────
|
||||
# Generate a strong password: openssl rand -base64 18
|
||||
TURN_USERNAME=easyasterisk
|
||||
TURN_PASSWORD=changeme
|
||||
TURN_PORT=3478
|
||||
# Points to coturn. For LAN-only leave empty.
|
||||
TURN_SERVER=${DOMAIN_NAME}:${TURN_PORT}
|
||||
|
||||
# ── RTP port range ─────────────────────────────────────────────
|
||||
RTP_START=10000
|
||||
RTP_END=20000
|
||||
|
||||
# ── Web admin ──────────────────────────────────────────────────
|
||||
WEB_ADMIN_PORT=8080
|
||||
# Set to true if Authelia or another reverse proxy handles auth
|
||||
WEB_ADMIN_AUTH_DISABLED=false
|
||||
|
||||
# ── Public IP (optional — auto-detected if empty) ─────────────
|
||||
PUBLIC_IP=
|
||||
|
||||
# ── Local network CIDR (optional — auto-detected if empty) ────
|
||||
LOCAL_CIDR=
|
||||
Vendored
+60
@@ -0,0 +1,60 @@
|
||||
FROM ubuntu:24.04
|
||||
|
||||
ENV LANG=en_US.UTF-8 \
|
||||
LANGUAGE=en_US:en \
|
||||
LC_ALL=en_US.UTF-8 \
|
||||
DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
asterisk \
|
||||
asterisk-core-sounds-en \
|
||||
asterisk-core-sounds-en-wav \
|
||||
asterisk-moh-opsound-wav \
|
||||
tcpdump \
|
||||
sngrep \
|
||||
curl \
|
||||
dnsutils \
|
||||
iproute2 \
|
||||
net-tools \
|
||||
openssl \
|
||||
python3 \
|
||||
python3-pip \
|
||||
python3-bcrypt \
|
||||
locales \
|
||||
&& locale-gen en_US.UTF-8 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# NOTE: Opus transcoding (codec_opus.so) is NOT available on Ubuntu 24.04
|
||||
# due to a packaging bug. Opus pass-through still works via res_format_attr_opus.so.
|
||||
|
||||
RUN mkdir -p /etc/asterisk/certs \
|
||||
/var/lib/asterisk/static-http \
|
||||
/var/log/asterisk \
|
||||
/var/spool/asterisk \
|
||||
/var/run/asterisk \
|
||||
&& chown -R asterisk:asterisk \
|
||||
/etc/asterisk \
|
||||
/var/lib/asterisk \
|
||||
/var/log/asterisk \
|
||||
/var/spool/asterisk \
|
||||
/var/run/asterisk
|
||||
|
||||
# Management script and helpers
|
||||
COPY easy-asterisk-v0.10.0.sh /usr/local/bin/easy-asterisk
|
||||
COPY scripts/vpn-diagnostics.sh /usr/local/bin/vpn-diagnostics
|
||||
COPY scripts/dns-whitelist.sh /usr/local/bin/dns-whitelist
|
||||
COPY docker/entrypoint.sh /entrypoint.sh
|
||||
RUN chmod +x /usr/local/bin/easy-asterisk \
|
||||
/usr/local/bin/vpn-diagnostics \
|
||||
/usr/local/bin/dns-whitelist \
|
||||
/entrypoint.sh
|
||||
|
||||
EXPOSE 5060/udp 5060/tcp 5061/tcp
|
||||
EXPOSE 8080/tcp 8088/tcp 8089/tcp
|
||||
EXPOSE 3478/udp
|
||||
EXPOSE 10000-10100/udp
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
||||
CMD asterisk -rx "core show version" || exit 1
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
@@ -0,0 +1,24 @@
|
||||
#!/bin/bash
|
||||
# coturn-entrypoint.sh — robust wrapper for the coturn Docker image.
|
||||
#
|
||||
# The coturn image's default entrypoint uses:
|
||||
# exec $(eval "echo $@")
|
||||
# which fails when detect-external-ip returns empty — produces a blank token
|
||||
# and coturn logs "ERROR: CONFIG: Unknown argument:"
|
||||
#
|
||||
# This wrapper avoids eval word-splitting and only adds --external-ip when
|
||||
# an IP is actually obtained.
|
||||
|
||||
set -e
|
||||
|
||||
# Use explicitly set PUBLIC_IP, or try auto-detection
|
||||
ext_ip="${PUBLIC_IP:-}"
|
||||
if [[ -z "$ext_ip" ]] && command -v detect-external-ip &>/dev/null; then
|
||||
ext_ip=$(detect-external-ip 2>/dev/null || true)
|
||||
fi
|
||||
|
||||
if [[ -n "$ext_ip" ]]; then
|
||||
exec turnserver "$@" --external-ip="$ext_ip"
|
||||
else
|
||||
exec turnserver "$@"
|
||||
fi
|
||||
+449
@@ -0,0 +1,449 @@
|
||||
#!/bin/bash
|
||||
# ================================================================
|
||||
# Easy Asterisk Docker Entrypoint
|
||||
#
|
||||
# Fully automated:
|
||||
# - Detects public IP
|
||||
# - Generates TURN credentials if not provided
|
||||
# - Configures Asterisk with FQDN, TLS, ICE, STUN, TURN
|
||||
# - Starts web admin + Asterisk
|
||||
# ================================================================
|
||||
|
||||
set -e
|
||||
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
CYAN='\033[0;36m'
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m'
|
||||
|
||||
log_info() { echo -e "${GREEN}[entrypoint]${NC} $1"; }
|
||||
log_warn() { echo -e "${YELLOW}[entrypoint]${NC} $1"; }
|
||||
log_error() { echo -e "${RED}[entrypoint]${NC} $1"; }
|
||||
|
||||
CONFIG_DIR="/etc/easy-asterisk"
|
||||
CONFIG_FILE="${CONFIG_DIR}/config"
|
||||
WEB_ADMIN_SCRIPT="/usr/local/bin/easy-asterisk-webadmin"
|
||||
|
||||
# ── Helper: generate random password ─────────────────────────
|
||||
gen_password() {
|
||||
openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c 24
|
||||
}
|
||||
|
||||
# ── 1. Ensure asterisk user exists ───────────────────────────
|
||||
if ! id asterisk >/dev/null 2>&1; then
|
||||
useradd -r -s /bin/false -d /var/lib/asterisk asterisk 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# ── 2. Detect public IP ──────────────────────────────────────
|
||||
PUBLIC_IP="${PUBLIC_IP:-}"
|
||||
if [[ -z "$PUBLIC_IP" ]]; then
|
||||
log_info "Auto-detecting public IP..."
|
||||
PUBLIC_IP=$(curl -s -4 --connect-timeout 5 ifconfig.me 2>/dev/null || true)
|
||||
if [[ -z "$PUBLIC_IP" ]]; then
|
||||
PUBLIC_IP=$(curl -s -4 --connect-timeout 5 icanhazip.com 2>/dev/null || true)
|
||||
fi
|
||||
if [[ -z "$PUBLIC_IP" ]]; then
|
||||
PUBLIC_IP=$(curl -s -4 --connect-timeout 5 api.ipify.org 2>/dev/null || true)
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -n "$PUBLIC_IP" ]]; then
|
||||
log_info "Public IP: ${PUBLIC_IP}"
|
||||
else
|
||||
log_warn "Could not detect public IP. Set PUBLIC_IP in .env"
|
||||
fi
|
||||
|
||||
# ── 3. TURN credentials ─────────────────────────────────────────
|
||||
# The password MUST match what coturn was started with. In Docker, both
|
||||
# read from the same env-var / .env file, so we use the value as-is.
|
||||
# Auto-generating a different password here would create a mismatch
|
||||
# (coturn is already running with ITS copy of the env-var).
|
||||
TURN_USERNAME="${TURN_USERNAME:-easyasterisk}"
|
||||
TURN_PASSWORD="${TURN_PASSWORD:-changeme}"
|
||||
if [[ "${TURN_PASSWORD}" == "changeme" ]]; then
|
||||
log_warn "TURN password is the default 'changeme' — set TURN_PASSWORD in .env for better security"
|
||||
fi
|
||||
|
||||
# ── 4. Detect local network ──────────────────────────────────
|
||||
local_ip=$(hostname -I 2>/dev/null | awk '{print $1}')
|
||||
raw_cidr=$(ip -o -f inet addr show 2>/dev/null | awk '/scope global/ {print $4}' | head -1)
|
||||
default_cidr="$raw_cidr"
|
||||
if [[ "$raw_cidr" =~ \.([0-9]+)/([0-9]+)$ ]]; then
|
||||
default_cidr="${raw_cidr%.*}.0/${BASH_REMATCH[2]}"
|
||||
fi
|
||||
|
||||
# ── 5. Generate self-signed certs ──────────────────────────────
|
||||
# Regenerate if missing OR if existing cert lacks SANs (modern TLS clients require them)
|
||||
regen_cert=false
|
||||
if [[ ! -f /etc/asterisk/certs/server.crt ]]; then
|
||||
regen_cert=true
|
||||
elif ! openssl x509 -in /etc/asterisk/certs/server.crt -noout -ext subjectAltName 2>/dev/null | grep -q "DNS:"; then
|
||||
log_info "Existing TLS cert lacks SANs — regenerating for mobile phone compatibility"
|
||||
regen_cert=true
|
||||
fi
|
||||
|
||||
if $regen_cert; then
|
||||
log_info "Generating self-signed TLS certificate..."
|
||||
mkdir -p /etc/asterisk/certs
|
||||
cn="${DOMAIN_NAME:-asterisk-local}"
|
||||
# Include Subject Alternative Names — required by modern TLS clients (iOS/Android SIP apps)
|
||||
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
|
||||
-keyout /etc/asterisk/certs/server.key \
|
||||
-out /etc/asterisk/certs/server.crt \
|
||||
-subj "/CN=${cn}" \
|
||||
-addext "subjectAltName=DNS:${cn}${PUBLIC_IP:+,IP:${PUBLIC_IP}}" \
|
||||
2>/dev/null
|
||||
chown asterisk:asterisk /etc/asterisk/certs/server.*
|
||||
chmod 644 /etc/asterisk/certs/server.crt
|
||||
chmod 600 /etc/asterisk/certs/server.key
|
||||
fi
|
||||
|
||||
# ── 6. Write config file ─────────────────────────────────────
|
||||
mkdir -p "$CONFIG_DIR"
|
||||
|
||||
# Determine TURN/STUN server address
|
||||
turn_server="${TURN_SERVER:-${DOMAIN_NAME:-$local_ip}:${TURN_PORT:-3478}}"
|
||||
|
||||
cat > "$CONFIG_FILE" << EOF
|
||||
# Easy Asterisk Configuration (Docker) - $(date)
|
||||
KIOSK_USER=""
|
||||
KIOSK_UID=""
|
||||
KIOSK_EXTENSION=""
|
||||
KIOSK_NAME=""
|
||||
SIP_PASSWORD=""
|
||||
ASTERISK_HOST="${DOMAIN_NAME:-$local_ip}"
|
||||
DOMAIN_NAME="${DOMAIN_NAME:-}"
|
||||
ENABLE_TLS="${ENABLE_TLS:-y}"
|
||||
HAS_VLANS="${HAS_VLANS:-n}"
|
||||
VLAN_SUBNETS="${VLAN_SUBNETS:-}"
|
||||
CERT_PATH=""
|
||||
KEY_PATH=""
|
||||
INSTALLED_SERVER="y"
|
||||
INSTALLED_CLIENT="n"
|
||||
CURRENT_PUBLIC_IP="${PUBLIC_IP}"
|
||||
PTT_DEVICE=""
|
||||
PTT_KEYCODE=""
|
||||
LOCAL_CIDR="${LOCAL_CIDR:-$default_cidr}"
|
||||
WEB_ADMIN_PORT="${WEB_ADMIN_PORT:-8080}"
|
||||
WEB_ADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}"
|
||||
VPN_ICE_ENABLED="y"
|
||||
CUSTOM_STUN_SERVER="${turn_server}"
|
||||
TURN_ENABLED="y"
|
||||
TURN_SERVER="${turn_server}"
|
||||
TURN_USERNAME="${TURN_USERNAME}"
|
||||
TURN_PASSWORD="${TURN_PASSWORD}"
|
||||
EOF
|
||||
chmod 644 "$CONFIG_FILE"
|
||||
|
||||
# ── 7. Initialize categories & rooms if missing ──────────────
|
||||
CATEGORIES_FILE="${CONFIG_DIR}/categories.conf"
|
||||
if [[ ! -f "$CATEGORIES_FILE" ]]; then
|
||||
log_info "Creating default device categories..."
|
||||
cat > "$CATEGORIES_FILE" << 'EOF'
|
||||
kiosks|Kiosks|yes|Fixed wall-mount tablets & intercoms
|
||||
mobile|Mobile|no|Phones & tablets (ring normally)
|
||||
custom|Custom|no|Custom configuration
|
||||
EOF
|
||||
fi
|
||||
|
||||
ROOMS_FILE="${CONFIG_DIR}/rooms.conf"
|
||||
if [[ ! -f "$ROOMS_FILE" ]]; then
|
||||
cat > "$ROOMS_FILE" << 'EOF'
|
||||
# ext|name|members|timeout|type
|
||||
EOF
|
||||
fi
|
||||
|
||||
# ── 8. Generate Asterisk configs ─────────────────────────────
|
||||
|
||||
# Build local_net entries
|
||||
all_local_nets="local_net=${LOCAL_CIDR:-$default_cidr}"
|
||||
if [[ "${HAS_VLANS:-n}" == "y" && -n "${VLAN_SUBNETS:-}" ]]; then
|
||||
for subnet in $VLAN_SUBNETS; do
|
||||
all_local_nets="${all_local_nets}
|
||||
local_net=${subnet}"
|
||||
done
|
||||
fi
|
||||
|
||||
# NAT settings - always include external addresses for FQDN mode
|
||||
nat_settings=""
|
||||
if [[ -n "$PUBLIC_IP" ]]; then
|
||||
nat_settings="external_media_address=${PUBLIC_IP}
|
||||
external_signaling_address=${PUBLIC_IP}
|
||||
${all_local_nets}"
|
||||
else
|
||||
nat_settings="${all_local_nets}"
|
||||
fi
|
||||
|
||||
# ── pjsip.conf (only if empty/missing - preserves existing devices) ──
|
||||
if [[ ! -f /etc/asterisk/pjsip.conf ]] || [[ ! -s /etc/asterisk/pjsip.conf ]]; then
|
||||
log_info "Generating PJSIP configuration..."
|
||||
cat > /etc/asterisk/pjsip.conf << EOF
|
||||
; Easy Asterisk (Docker) - FQDN: ${DOMAIN_NAME:-none}
|
||||
[global]
|
||||
type=global
|
||||
user_agent=EasyAsterisk
|
||||
|
||||
[transport-udp]
|
||||
type=transport
|
||||
protocol=udp
|
||||
bind=0.0.0.0:5060
|
||||
; Server IP: ${local_ip} | Public IP: ${PUBLIC_IP:-unknown}
|
||||
${nat_settings}
|
||||
|
||||
[transport-tcp]
|
||||
type=transport
|
||||
protocol=tcp
|
||||
bind=0.0.0.0:5060
|
||||
; Server IP: ${local_ip} | Public IP: ${PUBLIC_IP:-unknown}
|
||||
${nat_settings}
|
||||
|
||||
[transport-tls]
|
||||
type=transport
|
||||
protocol=tls
|
||||
bind=0.0.0.0:5061
|
||||
; Server IP: ${local_ip} | Public IP: ${PUBLIC_IP:-unknown}
|
||||
cert_file=/etc/asterisk/certs/server.crt
|
||||
priv_key_file=/etc/asterisk/certs/server.key
|
||||
; ca_list_file not set — only needed for verify_client=yes (client cert auth)
|
||||
method=tlsv1_2
|
||||
${nat_settings}
|
||||
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/pjsip.conf
|
||||
else
|
||||
# Update NAT settings in existing pjsip.conf transports if public IP changed
|
||||
if [[ -n "$PUBLIC_IP" ]]; then
|
||||
current_ext=$(grep "^external_media_address=" /etc/asterisk/pjsip.conf 2>/dev/null | head -1 | cut -d= -f2)
|
||||
if [[ "$current_ext" != "$PUBLIC_IP" && -n "$current_ext" ]]; then
|
||||
log_info "Updating public IP in pjsip.conf: ${current_ext} -> ${PUBLIC_IP}"
|
||||
sed -i "s|external_media_address=.*|external_media_address=${PUBLIC_IP}|g" /etc/asterisk/pjsip.conf
|
||||
sed -i "s|external_signaling_address=.*|external_signaling_address=${PUBLIC_IP}|g" /etc/asterisk/pjsip.conf
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Sanitize pjsip.conf: remove endpoint-only options from aor sections ──
|
||||
if [[ -f /etc/asterisk/pjsip.conf ]]; then
|
||||
# Options that are only valid in [endpoint] sections, not in [aor] sections
|
||||
endpoint_only_opts="direct_media|rtp_symmetric|force_rport|rewrite_contact|rtp_keepalive|rtp_timeout|rtp_timeout_hold|ice_support|context|disallow|allow|auth|aors|callerid|media_encryption|transport"
|
||||
current_type=""
|
||||
needs_fix=false
|
||||
while IFS= read -r line; do
|
||||
if [[ "$line" =~ ^type=(.*) ]]; then
|
||||
current_type="${BASH_REMATCH[1]}"
|
||||
fi
|
||||
if [[ "$current_type" == "aor" ]] && echo "$line" | grep -qE "^(${endpoint_only_opts})="; then
|
||||
needs_fix=true
|
||||
break
|
||||
fi
|
||||
done < /etc/asterisk/pjsip.conf
|
||||
|
||||
if $needs_fix; then
|
||||
log_info "Sanitizing pjsip.conf (removing misplaced options from aor sections)..."
|
||||
awk -v opts="$endpoint_only_opts" '
|
||||
BEGIN { split(opts, arr, "|"); for (i in arr) bad[arr[i]]=1 }
|
||||
/^type=/ { current_type = substr($0, 6) }
|
||||
{
|
||||
if (current_type == "aor") {
|
||||
split($0, kv, "=")
|
||||
if (kv[1] in bad) next
|
||||
}
|
||||
print
|
||||
}
|
||||
' /etc/asterisk/pjsip.conf > /tmp/pjsip_sanitized.conf
|
||||
mv /tmp/pjsip_sanitized.conf /etc/asterisk/pjsip.conf
|
||||
chown asterisk:asterisk /etc/asterisk/pjsip.conf
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Ensure transport-tls exists in pjsip.conf (upgrade / migration path) ──
|
||||
# If pjsip.conf was preserved from a pre-TLS config or a non-Docker install it
|
||||
# will have no [transport-tls] section. Asterisk starts without TLS silently,
|
||||
# and mobile devices cannot register. Inject the section when it is absent.
|
||||
if [[ -f /etc/asterisk/pjsip.conf ]] && ! grep -q "^\[transport-tls\]" /etc/asterisk/pjsip.conf; then
|
||||
log_info "transport-tls missing from pjsip.conf — adding TLS transport (required for mobile registration)..."
|
||||
cat >> /etc/asterisk/pjsip.conf << EOF
|
||||
|
||||
[transport-tls]
|
||||
type=transport
|
||||
protocol=tls
|
||||
bind=0.0.0.0:5061
|
||||
cert_file=/etc/asterisk/certs/server.crt
|
||||
priv_key_file=/etc/asterisk/certs/server.key
|
||||
; ca_list_file not set — only needed for verify_client=yes (client cert auth)
|
||||
method=tlsv1_2
|
||||
${nat_settings}
|
||||
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/pjsip.conf
|
||||
fi
|
||||
|
||||
# ── rtp.conf (always regenerated) ──
|
||||
# ICE is enabled so Asterisk participates in ICE negotiation with clients.
|
||||
# stunaddr/turnaddr are NOT set here because:
|
||||
# - Asterisk already knows its public IP via external_media_address in pjsip.conf
|
||||
# - Its RTP ports are port-forwarded, so host candidates are sufficient
|
||||
# - Setting stunaddr/turnaddr causes STUN/TURN gather timeouts (~27s per call)
|
||||
# when the STUN/TURN server is unreachable or misconfigured
|
||||
# coturn is for SIP CLIENTS behind strict NAT — they configure TURN in their
|
||||
# own app settings, independently of Asterisk's rtp.conf.
|
||||
log_info "Configuring RTP with ICE support..."
|
||||
cat > /etc/asterisk/rtp.conf << EOF
|
||||
[general]
|
||||
rtpstart=${RTP_START:-10000}
|
||||
rtpend=${RTP_END:-20000}
|
||||
strictrtp=yes
|
||||
icesupport=yes
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/rtp.conf
|
||||
|
||||
# ── extensions.conf (only if missing) ──
|
||||
if [[ ! -f /etc/asterisk/extensions.conf ]] || [[ ! -s /etc/asterisk/extensions.conf ]]; then
|
||||
log_info "Generating dialplan..."
|
||||
cat > /etc/asterisk/extensions.conf << 'EOF'
|
||||
[general]
|
||||
static=yes
|
||||
writeprotect=no
|
||||
[default]
|
||||
exten => _X.,1,Hangup()
|
||||
[intercom]
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/extensions.conf
|
||||
fi
|
||||
|
||||
# ── Other core configs (only if missing) ──
|
||||
if [[ ! -f /etc/asterisk/asterisk.conf ]]; then
|
||||
cat > /etc/asterisk/asterisk.conf << 'EOF'
|
||||
[directories]
|
||||
[options]
|
||||
runuser = asterisk
|
||||
rungroup = asterisk
|
||||
EOF
|
||||
fi
|
||||
|
||||
# ── logger.conf (always regenerated - ensures security logging is on) ──
|
||||
cat > /etc/asterisk/logger.conf << 'EOF'
|
||||
[general]
|
||||
[logfiles]
|
||||
; security level captures TLS handshake failures and auth issues
|
||||
console => notice,warning,error,security
|
||||
EOF
|
||||
|
||||
# ── modules.conf (always regenerated - ensures chan_sip stays disabled) ──
|
||||
cat > /etc/asterisk/modules.conf << 'EOF'
|
||||
[modules]
|
||||
autoload=yes
|
||||
noload => chan_sip.so
|
||||
noload => chan_iax2.so
|
||||
; Opus transcoding unavailable on Ubuntu 24.04 (bug #2044135)
|
||||
; Opus pass-through still works via res_format_attr_opus.so
|
||||
noload => codec_opus.so
|
||||
noload => format_ogg_opus.so
|
||||
load => res_pjsip.so
|
||||
load => res_pjsip_session.so
|
||||
load => res_pjsip_logger.so
|
||||
load => chan_pjsip.so
|
||||
load => codec_ulaw.so
|
||||
load => codec_alaw.so
|
||||
load => codec_g722.so
|
||||
load => res_rtp_asterisk.so
|
||||
load => app_dial.so
|
||||
load => app_page.so
|
||||
load => pbx_config.so
|
||||
EOF
|
||||
|
||||
# ── Remove incompatible Digium codec_opus if present on volume ──
|
||||
# The Digium binary is ABI-incompatible with Ubuntu 24.04's Asterisk and crashes it
|
||||
MODULES_DIR=$(find /usr/lib -type d -name modules -path "*/asterisk/*" 2>/dev/null | head -1)
|
||||
if [[ -n "$MODULES_DIR" ]]; then
|
||||
for bad_module in codec_opus.so format_ogg_opus.so; do
|
||||
if [[ -f "$MODULES_DIR/$bad_module" ]] && ! dpkg -S "$MODULES_DIR/$bad_module" >/dev/null 2>&1; then
|
||||
log_warn "Removing incompatible $bad_module (not from Ubuntu package)"
|
||||
rm -f "$MODULES_DIR/$bad_module"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# ── 9. Fix permissions ───────────────────────────────────────
|
||||
chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk /var/run/asterisk 2>/dev/null || true
|
||||
|
||||
# ── 10. Start Web Admin in background ─────────────────────────
|
||||
# The web admin script is generated by the 'easy-asterisk' management tool.
|
||||
# On first run: docker exec -it easy-asterisk easy-asterisk → Web Admin menu → Start
|
||||
if [[ -f "$WEB_ADMIN_SCRIPT" ]]; then
|
||||
log_info "Starting Web Admin on port ${WEB_ADMIN_PORT:-8080}..."
|
||||
WEBADMIN_PORT="${WEB_ADMIN_PORT:-8080}" \
|
||||
WEBADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}" \
|
||||
python3 "$WEB_ADMIN_SCRIPT" &
|
||||
fi
|
||||
|
||||
# ── 11. Signal handling for clean shutdown ────────────────────
|
||||
cleanup() {
|
||||
log_info "Shutting down..."
|
||||
pkill -f "easy-asterisk-webadmin" 2>/dev/null || true
|
||||
asterisk -rx "core stop now" 2>/dev/null || true
|
||||
exit 0
|
||||
}
|
||||
trap cleanup SIGTERM SIGINT
|
||||
|
||||
# ── 12. Start Asterisk ───────────────────────────────────────
|
||||
log_info "Starting Asterisk PBX..."
|
||||
echo ""
|
||||
|
||||
# Start Asterisk in the background, then print management info once ready
|
||||
asterisk -f -U asterisk -G asterisk &
|
||||
ASTERISK_PID=$!
|
||||
|
||||
# Wait for Asterisk to be ready (up to 60 seconds)
|
||||
for i in $(seq 1 60); do
|
||||
if asterisk -rx "core show version" >/dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
# Verify PJSIP transports are listening
|
||||
tls_ok=false
|
||||
udp_ok=false
|
||||
if asterisk -rx "pjsip show transports" 2>/dev/null | grep -q "transport-tls"; then
|
||||
tls_ok=true
|
||||
fi
|
||||
if asterisk -rx "pjsip show transports" 2>/dev/null | grep -q "transport-udp"; then
|
||||
udp_ok=true
|
||||
fi
|
||||
|
||||
# Check if port 5061 is actually bound
|
||||
tls_listen=""
|
||||
if command -v ss &>/dev/null; then
|
||||
tls_listen=$(ss -tlnp 2>/dev/null | grep ":5061 " || true)
|
||||
elif command -v netstat &>/dev/null; then
|
||||
tls_listen=$(netstat -tlnp 2>/dev/null | grep ":5061 " || true)
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${CYAN}══════════════════════════════════════════════════════════════${NC}"
|
||||
echo -e "${CYAN} Easy Asterisk (Docker)${NC}"
|
||||
echo -e "${CYAN}══════════════════════════════════════════════════════════════${NC}"
|
||||
echo -e " FQDN: ${GREEN}${DOMAIN_NAME:-not set}${NC}"
|
||||
echo -e " Public IP: ${GREEN}${PUBLIC_IP:-unknown}${NC}"
|
||||
echo -e " TURN/STUN: ${GREEN}${turn_server}${NC}"
|
||||
if $tls_ok && [[ -n "$tls_listen" ]]; then
|
||||
echo -e " TLS: ${GREEN}Enabled (port 5061)${NC}"
|
||||
elif $tls_ok; then
|
||||
echo -e " TLS: ${YELLOW}Transport loaded but port 5061 not bound — check certs${NC}"
|
||||
else
|
||||
echo -e " TLS: ${RED}NOT LOADED — check Asterisk logs${NC}"
|
||||
fi
|
||||
echo -e " ICE: ${GREEN}Enabled${NC}"
|
||||
echo -e "${CYAN}──────────────────────────────────────────────────────────────${NC}"
|
||||
echo -e " SIP clients connect to: ${GREEN}${DOMAIN_NAME:-$local_ip}:5061${NC} (TLS)"
|
||||
echo -e " Web Admin: ${GREEN}http://${local_ip}:${WEB_ADMIN_PORT:-8080}/clients${NC}"
|
||||
echo -e "${CYAN}──────────────────────────────────────────────────────────────${NC}"
|
||||
echo -e " Management: ${YELLOW}docker exec -it easy-asterisk easy-asterisk${NC}"
|
||||
echo -e " Diagnostics: docker exec -it easy-asterisk vpn-diagnostics"
|
||||
echo -e "${CYAN}══════════════════════════════════════════════════════════════${NC}"
|
||||
echo ""
|
||||
|
||||
# Wait for Asterisk process (keeps container running)
|
||||
wait $ASTERISK_PID
|
||||
+6929
File diff suppressed because it is too large
Load Diff
+55
@@ -0,0 +1,55 @@
|
||||
#!/bin/bash
|
||||
# ================================================================
|
||||
# DNS Whitelist Checker for Easy Asterisk
|
||||
#
|
||||
# Checks which domains need to be whitelisted when DNS filtering
|
||||
# is active on the server, caller, or receiver networks.
|
||||
#
|
||||
# Usage: dns-whitelist [--check] [--sipnetic] [--linphone]
|
||||
# ================================================================
|
||||
|
||||
set -e
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
CYAN='\033[0;36m'
|
||||
BOLD='\033[1m'
|
||||
NC='\033[0m'
|
||||
|
||||
CONFIG_FILE="/etc/easy-asterisk/config"
|
||||
CHECK_MODE=false
|
||||
SHOW_SIPNETIC=false
|
||||
SHOW_LINPHONE=false
|
||||
SHOW_ALL=true
|
||||
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--check) CHECK_MODE=true; shift ;;
|
||||
--sipnetic) SHOW_SIPNETIC=true; SHOW_ALL=false; shift ;;
|
||||
--linphone) SHOW_LINPHONE=true; SHOW_ALL=false; shift ;;
|
||||
--help|-h)
|
||||
echo "Usage: dns-whitelist [OPTIONS]"
|
||||
echo " --check Test reachability of each domain"
|
||||
echo " --sipnetic Show Sipnetic-specific domains"
|
||||
echo " --linphone Show Linphone-specific domains"
|
||||
exit 0 ;;
|
||||
*) shift ;;
|
||||
esac
|
||||
done
|
||||
|
||||
source "$CONFIG_FILE" 2>/dev/null || true
|
||||
|
||||
echo ""
|
||||
echo -e "${CYAN}━━━ DNS Whitelist for Easy Asterisk ━━━${NC}"
|
||||
echo ""
|
||||
echo -e "${BOLD}Mode: ${NC}$( [[ -n "$DOMAIN_NAME" ]] && echo "FQDN ($DOMAIN_NAME)" || echo "LAN/VPN (no domain)" )"
|
||||
echo ""
|
||||
echo -e "${BOLD}Server DNS filter:${NC}"
|
||||
echo -e " ifconfig.me, icanhazip.com (public IP detection, FQDN mode only)"
|
||||
echo -e " acme-v02.api.letsencrypt.org (Let's Encrypt, if used)"
|
||||
echo ""
|
||||
echo -e "${BOLD}Client DNS filter (Sipnetic/Linphone):${NC}"
|
||||
echo -e " LAN/VPN mode: none (configure by IP)"
|
||||
echo -e " FQDN mode: your domain ($DOMAIN_NAME)"
|
||||
echo ""
|
||||
+40
@@ -0,0 +1,40 @@
|
||||
#!/bin/bash
|
||||
# ================================================================
|
||||
# VPN Diagnostics for Easy Asterisk
|
||||
# Validates PJSIP, TLS, ICE, RTP, and device configuration.
|
||||
# Usage: vpn-diagnostics [--auto] [--client-ip <ip>]
|
||||
# ================================================================
|
||||
|
||||
set -e
|
||||
|
||||
GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RED='\033[0;31m'; NC='\033[0m'
|
||||
|
||||
echo -e "${CYAN}━━━ Easy Asterisk VPN Diagnostics ━━━${NC}"
|
||||
echo ""
|
||||
|
||||
# Check Asterisk is running
|
||||
if ! asterisk -rx "core show version" &>/dev/null; then
|
||||
echo -e "${RED}✗ Asterisk is not running${NC}"; exit 1
|
||||
fi
|
||||
echo -e "${GREEN}✓ Asterisk running:${NC} $(asterisk -rx "core show version" 2>/dev/null)"
|
||||
|
||||
# Check transports
|
||||
echo ""
|
||||
echo -e "${CYAN}Transports:${NC}"
|
||||
asterisk -rx "pjsip show transports" 2>/dev/null || true
|
||||
|
||||
# Check registered endpoints
|
||||
echo ""
|
||||
echo -e "${CYAN}Endpoints:${NC}"
|
||||
asterisk -rx "pjsip show endpoints" 2>/dev/null || true
|
||||
|
||||
# Check TLS cert
|
||||
if [[ -f /etc/asterisk/certs/server.crt ]]; then
|
||||
exp=$(openssl x509 -in /etc/asterisk/certs/server.crt -noout -enddate 2>/dev/null | cut -d= -f2)
|
||||
echo -e "${GREEN}✓ TLS cert:${NC} expires $exp"
|
||||
openssl x509 -in /etc/asterisk/certs/server.crt -noout -ext subjectAltName 2>/dev/null | grep -q "DNS:" \
|
||||
&& echo -e "${GREEN}✓ SANs present (mobile-compatible)${NC}" \
|
||||
|| echo -e "${YELLOW}! No SANs — mobile clients may reject cert${NC}"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
Reference in New Issue
Block a user