Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk

asterisk.sh (homelab):
- Easy Asterisk PBX with self-hosted coturn TURN server
- Vendored from outis1one/easy-asterisk v0.10.0 for offline install
- LAN-only or FQDN mode (TLS + TURN relay for remote access)
- Auto-answer SIP headers for intercom use case
- Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen
- UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp
- Builds custom Docker image from vendor/easy-asterisk/

nextcloud.sh (utilities):
- Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage)
- MariaDB 10.11 sidecar with matching env vars
- OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy
- Enables files_external app after first-run init (waits up to 90s)

onlyoffice.sh (utilities):
- JWT generated once, preserved across re-runs
- _ensure_yq: auto-installs yq v4 for FileBrowser config patching
- _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret)
- _wire_filebrowser: patches config.yaml + restarts container
- Caddy block overrides X-Frame-Options to allow iframe embedding

mattermost.sh (utilities):
- PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479)
- 8443/udp for Calls plugin RTC server
- coturn uses --use-auth-secret HMAC mode (required by Calls plugin)
- SITE_URL computed from SITE_DOMAIN, promptable
- UFW: 8443/udp, 3479, 49153-49352/udp

vendor/easy-asterisk/:
- All upstream source files vendored for offline/self-contained installs
- Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh
- easy-asterisk-v0.10.0.sh (6929-line management script)
- scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh
- .env.example

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

vendor/easy-asterisk/scripts/dns-whitelist.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# ================================================================
+# DNS Whitelist Checker for Easy Asterisk
+#
+# Checks which domains need to be whitelisted when DNS filtering
+# is active on the server, caller, or receiver networks.
+#
+# Usage: dns-whitelist [--check] [--sipnetic] [--linphone]
+# ================================================================
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+BOLD='\033[1m'
+NC='\033[0m'
+
+CONFIG_FILE="/etc/easy-asterisk/config"
+CHECK_MODE=false
+SHOW_SIPNETIC=false
+SHOW_LINPHONE=false
+SHOW_ALL=true
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --check) CHECK_MODE=true; shift ;;
+        --sipnetic) SHOW_SIPNETIC=true; SHOW_ALL=false; shift ;;
+        --linphone) SHOW_LINPHONE=true; SHOW_ALL=false; shift ;;
+        --help|-h)
+            echo "Usage: dns-whitelist [OPTIONS]"
+            echo "  --check       Test reachability of each domain"
+            echo "  --sipnetic    Show Sipnetic-specific domains"
+            echo "  --linphone    Show Linphone-specific domains"
+            exit 0 ;;
+        *) shift ;;
+    esac
+done
+
+source "$CONFIG_FILE" 2>/dev/null || true
+
+echo ""
+echo -e "${CYAN}━━━ DNS Whitelist for Easy Asterisk ━━━${NC}"
+echo ""
+echo -e "${BOLD}Mode: ${NC}$( [[ -n "$DOMAIN_NAME" ]] && echo "FQDN ($DOMAIN_NAME)" || echo "LAN/VPN (no domain)" )"
+echo ""
+echo -e "${BOLD}Server DNS filter:${NC}"
+echo -e "  ifconfig.me, icanhazip.com (public IP detection, FQDN mode only)"
+echo -e "  acme-v02.api.letsencrypt.org (Let's Encrypt, if used)"
+echo ""
+echo -e "${BOLD}Client DNS filter (Sipnetic/Linphone):${NC}"
+echo -e "  LAN/VPN mode: none (configure by IP)"
+echo -e "  FQDN mode: your domain ($DOMAIN_NAME)"
+echo ""

vendor/easy-asterisk/scripts/vpn-diagnostics.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# ================================================================
+# VPN Diagnostics for Easy Asterisk
+# Validates PJSIP, TLS, ICE, RTP, and device configuration.
+# Usage: vpn-diagnostics [--auto] [--client-ip <ip>]
+# ================================================================
+
+set -e
+
+GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RED='\033[0;31m'; NC='\033[0m'
+
+echo -e "${CYAN}━━━ Easy Asterisk VPN Diagnostics ━━━${NC}"
+echo ""
+
+# Check Asterisk is running
+if ! asterisk -rx "core show version" &>/dev/null; then
+    echo -e "${RED}✗ Asterisk is not running${NC}"; exit 1
+fi
+echo -e "${GREEN}✓ Asterisk running:${NC} $(asterisk -rx "core show version" 2>/dev/null)"
+
+# Check transports
+echo ""
+echo -e "${CYAN}Transports:${NC}"
+asterisk -rx "pjsip show transports" 2>/dev/null || true
+
+# Check registered endpoints
+echo ""
+echo -e "${CYAN}Endpoints:${NC}"
+asterisk -rx "pjsip show endpoints" 2>/dev/null || true
+
+# Check TLS cert
+if [[ -f /etc/asterisk/certs/server.crt ]]; then
+    exp=$(openssl x509 -in /etc/asterisk/certs/server.crt -noout -enddate 2>/dev/null | cut -d= -f2)
+    echo -e "${GREEN}✓ TLS cert:${NC} expires $exp"
+    openssl x509 -in /etc/asterisk/certs/server.crt -noout -ext subjectAltName 2>/dev/null | grep -q "DNS:" \
+        && echo -e "${GREEN}✓ SANs present (mobile-compatible)${NC}" \
+        || echo -e "${YELLOW}! No SANs — mobile clients may reject cert${NC}"
+fi
+
+echo ""