From 16a4985e048f485f669ad1a84c31c8095fb4c841 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 19 Jul 2026 13:58:10 +0000
Subject: [PATCH] asterisk-do: offer to run base setup first if not already
 done
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Naming a service directly (sudo ./setup.sh asterisk-do) bypasses
setup.sh's own first-run base step entirely — essential packages, SSH
key import, disabling password auth. Docker still gets installed
either way (asterisk-do's own require_docker handles that), but the
SSH-hardening part of this setup's security story was silently
skipped on a genuinely fresh droplet unless the user knew to run
`base` separately first.

Checks the same marker setup.sh itself uses for "is base installed"
(command -v ncdu) and offers to run install_base directly if not —
same cross-service-call pattern already used for Caddy/CrowdSec/etc.
Verified end-to-end in a real sandbox run: base actually installed
packages, and execution correctly continued through the rest of the
asterisk-do flow afterward.
---
 services/asterisk-do.sh | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/services/asterisk-do.sh b/services/asterisk-do.sh
index 193a4f3..7675dca 100755
--- a/services/asterisk-do.sh
+++ b/services/asterisk-do.sh
@@ -216,9 +216,28 @@ install_asterisk-do() {
         echo "[DRY-RUN] Would reverse-proxy the web admin on the SAME FQDN used for SIP (needed for cert sync)"
         echo "[DRY-RUN] Would offer local OR remote Authelia to protect the web admin"
         echo "[DRY-RUN] Would offer to install CrowdSec if not already present (full repo only)"
+        echo "[DRY-RUN] Would offer to run base setup first if not already done (full repo only)"
         return 0
     fi
 
+    # ── Bring in base first, if this is a genuinely fresh box ─────────────────
+    # Naming a service directly (sudo ./setup.sh asterisk-do) skips setup.sh's
+    # own first-run base step — essential packages, SSH key import, disabling
+    # password auth. That's a real gap on a fresh droplet: everything below
+    # still works without it, but the SSH-hardening part of this setup's
+    # security story wouldn't actually have happened. Same marker setup.sh
+    # itself uses to detect base (command -v ncdu).
+    if ! command -v ncdu &>/dev/null; then
+        if declare -F install_base &>/dev/null; then
+            local WANT_BASE=""
+            prompt_yn "Base setup not detected (essential packages, SSH hardening) — run it first? (y/n):" "y" WANT_BASE
+            [[ "$WANT_BASE" =~ ^[Yy]$ ]] && install_base
+        else
+            log_warning "Base setup not detected, and this looks like a standalone copy of asterisk-do.sh."
+            log_warning "Run services/base.sh yourself first, or grab the full repo."
+        fi
+    fi
+
     # ── Swap file (insurance for low-RAM droplets, e.g. the $4/mo 512MB plan) ──
     # DigitalOcean doesn't provision swap by default. Docker + Asterisk + coturn
     # fit in 512MB-1GB at idle with little headroom; a swapfile absorbs spikes