Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk

asterisk.sh (homelab):
- Easy Asterisk PBX with self-hosted coturn TURN server
- Vendored from outis1one/easy-asterisk v0.10.0 for offline install
- LAN-only or FQDN mode (TLS + TURN relay for remote access)
- Auto-answer SIP headers for intercom use case
- Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen
- UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp
- Builds custom Docker image from vendor/easy-asterisk/

nextcloud.sh (utilities):
- Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage)
- MariaDB 10.11 sidecar with matching env vars
- OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy
- Enables files_external app after first-run init (waits up to 90s)

onlyoffice.sh (utilities):
- JWT generated once, preserved across re-runs
- _ensure_yq: auto-installs yq v4 for FileBrowser config patching
- _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret)
- _wire_filebrowser: patches config.yaml + restarts container
- Caddy block overrides X-Frame-Options to allow iframe embedding

mattermost.sh (utilities):
- PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479)
- 8443/udp for Calls plugin RTC server
- coturn uses --use-auth-secret HMAC mode (required by Calls plugin)
- SITE_URL computed from SITE_DOMAIN, promptable
- UFW: 8443/udp, 3479, 49153-49352/udp

vendor/easy-asterisk/:
- All upstream source files vendored for offline/self-contained installs
- Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh
- easy-asterisk-v0.10.0.sh (6929-line management script)
- scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh
- .env.example

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

vendor/easy-asterisk/docker/coturn-entrypoint.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# coturn-entrypoint.sh — robust wrapper for the coturn Docker image.
+#
+# The coturn image's default entrypoint uses:
+#   exec $(eval "echo $@")
+# which fails when detect-external-ip returns empty — produces a blank token
+# and coturn logs "ERROR: CONFIG: Unknown argument:"
+#
+# This wrapper avoids eval word-splitting and only adds --external-ip when
+# an IP is actually obtained.
+
+set -e
+
+# Use explicitly set PUBLIC_IP, or try auto-detection
+ext_ip="${PUBLIC_IP:-}"
+if [[ -z "$ext_ip" ]] && command -v detect-external-ip &>/dev/null; then
+    ext_ip=$(detect-external-ip 2>/dev/null || true)
+fi
+
+if [[ -n "$ext_ip" ]]; then
+    exec turnserver "$@" --external-ip="$ext_ip"
+else
+    exec turnserver "$@"
+fi