Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk

asterisk.sh (homelab):
- Easy Asterisk PBX with self-hosted coturn TURN server
- Vendored from outis1one/easy-asterisk v0.10.0 for offline install
- LAN-only or FQDN mode (TLS + TURN relay for remote access)
- Auto-answer SIP headers for intercom use case
- Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen
- UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp
- Builds custom Docker image from vendor/easy-asterisk/

nextcloud.sh (utilities):
- Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage)
- MariaDB 10.11 sidecar with matching env vars
- OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy
- Enables files_external app after first-run init (waits up to 90s)

onlyoffice.sh (utilities):
- JWT generated once, preserved across re-runs
- _ensure_yq: auto-installs yq v4 for FileBrowser config patching
- _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret)
- _wire_filebrowser: patches config.yaml + restarts container
- Caddy block overrides X-Frame-Options to allow iframe embedding

mattermost.sh (utilities):
- PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479)
- 8443/udp for Calls plugin RTC server
- coturn uses --use-auth-secret HMAC mode (required by Calls plugin)
- SITE_URL computed from SITE_DOMAIN, promptable
- UFW: 8443/udp, 3479, 49153-49352/udp

vendor/easy-asterisk/:
- All upstream source files vendored for offline/self-contained installs
- Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh
- easy-asterisk-v0.10.0.sh (6929-line management script)
- scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh
- .env.example

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

vendor/easy-asterisk/.env.example

@@ -0,0 +1,32 @@
+# ================================================================
+# Easy Asterisk — Environment Configuration
+# Copy to .env and fill in your values.
+# ================================================================
+
+# ── Domain (REQUIRED for remote/FQDN access) ──────────────────
+# Your FQDN pointing to this server's public IP.
+# Leave empty for LAN-only mode.
+DOMAIN_NAME=asterisk.example.com
+
+# ── TURN/STUN ──────────────────────────────────────────────────
+# Generate a strong password: openssl rand -base64 18
+TURN_USERNAME=easyasterisk
+TURN_PASSWORD=changeme
+TURN_PORT=3478
+# Points to coturn. For LAN-only leave empty.
+TURN_SERVER=${DOMAIN_NAME}:${TURN_PORT}
+
+# ── RTP port range ─────────────────────────────────────────────
+RTP_START=10000
+RTP_END=20000
+
+# ── Web admin ──────────────────────────────────────────────────
+WEB_ADMIN_PORT=8080
+# Set to true if Authelia or another reverse proxy handles auth
+WEB_ADMIN_AUTH_DISABLED=false
+
+# ── Public IP (optional — auto-detected if empty) ─────────────
+PUBLIC_IP=
+
+# ── Local network CIDR (optional — auto-detected if empty) ────
+LOCAL_CIDR=