Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk

asterisk.sh (homelab):
- Easy Asterisk PBX with self-hosted coturn TURN server
- Vendored from outis1one/easy-asterisk v0.10.0 for offline install
- LAN-only or FQDN mode (TLS + TURN relay for remote access)
- Auto-answer SIP headers for intercom use case
- Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen
- UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp
- Builds custom Docker image from vendor/easy-asterisk/

nextcloud.sh (utilities):
- Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage)
- MariaDB 10.11 sidecar with matching env vars
- OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy
- Enables files_external app after first-run init (waits up to 90s)

onlyoffice.sh (utilities):
- JWT generated once, preserved across re-runs
- _ensure_yq: auto-installs yq v4 for FileBrowser config patching
- _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret)
- _wire_filebrowser: patches config.yaml + restarts container
- Caddy block overrides X-Frame-Options to allow iframe embedding

mattermost.sh (utilities):
- PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479)
- 8443/udp for Calls plugin RTC server
- coturn uses --use-auth-secret HMAC mode (required by Calls plugin)
- SITE_URL computed from SITE_DOMAIN, promptable
- UFW: 8443/udp, 3479, 49153-49352/udp

vendor/easy-asterisk/:
- All upstream source files vendored for offline/self-contained installs
- Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh
- easy-asterisk-v0.10.0.sh (6929-line management script)
- scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh
- .env.example

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt

vendor/easy-asterisk/scripts/vpn-diagnostics.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# ================================================================
+# VPN Diagnostics for Easy Asterisk
+# Validates PJSIP, TLS, ICE, RTP, and device configuration.
+# Usage: vpn-diagnostics [--auto] [--client-ip <ip>]
+# ================================================================
+
+set -e
+
+GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RED='\033[0;31m'; NC='\033[0m'
+
+echo -e "${CYAN}━━━ Easy Asterisk VPN Diagnostics ━━━${NC}"
+echo ""
+
+# Check Asterisk is running
+if ! asterisk -rx "core show version" &>/dev/null; then
+    echo -e "${RED}✗ Asterisk is not running${NC}"; exit 1
+fi
+echo -e "${GREEN}✓ Asterisk running:${NC} $(asterisk -rx "core show version" 2>/dev/null)"
+
+# Check transports
+echo ""
+echo -e "${CYAN}Transports:${NC}"
+asterisk -rx "pjsip show transports" 2>/dev/null || true
+
+# Check registered endpoints
+echo ""
+echo -e "${CYAN}Endpoints:${NC}"
+asterisk -rx "pjsip show endpoints" 2>/dev/null || true
+
+# Check TLS cert
+if [[ -f /etc/asterisk/certs/server.crt ]]; then
+    exp=$(openssl x509 -in /etc/asterisk/certs/server.crt -noout -enddate 2>/dev/null | cut -d= -f2)
+    echo -e "${GREEN}✓ TLS cert:${NC} expires $exp"
+    openssl x509 -in /etc/asterisk/certs/server.crt -noout -ext subjectAltName 2>/dev/null | grep -q "DNS:" \
+        && echo -e "${GREEN}✓ SANs present (mobile-compatible)${NC}" \
+        || echo -e "${YELLOW}! No SANs — mobile clients may reject cert${NC}"
+fi
+
+echo ""