root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix web admin/CrowdSec port collision: default WEB_ADMIN_PORT to 8081

Browse Source 
Real-world failure: CrowdSec's Local API listens on 127.0.0.1:8080 by
default (confirmed against its actual upstream config.yaml), and Easy
Asterisk's web admin also defaults to 8080. Both services in this repo
run with network_mode: host / directly on the host, so whichever one
starts second gets "OSError: [Errno 98] Address already in use" — in
this case CrowdSec (started earlier via the auto-install chain) had
already claimed the port before the web admin tried to start.

Moved the web admin's default to 8081 in both asterisk-do.sh and
asterisk.sh — WEB_ADMIN_PORT in .env, the UFW rule, the DO Cloud
Firewall rule, the Caddy reverse_proxy target, and every doc/summary
reference. 8081 doesn't collide with anything else in either stack
(5060/5061/8088/8089/3478/10000-20000/49152-49252) or with CrowdSec's
LAPI (8080) or Prometheus metrics (6060, localhost-only either way).

Left the vendor files' own internal fallback (WEB_ADMIN_PORT:-8080)
untouched — .env's explicit value overrides it at runtime regardless,
and vendor/ stays pristine per this repo's convention.

Verified: no stray 8080 in any generated .env/docker-compose.yml for
either service after a full install run; the vendor files' own
internal 8080 fallback (never applies here, since .env always sets it
explicitly) is the only remaining occurrence anywhere.
This commit is contained in:
Claude
2026-07-19 16:51:50 +00:00
parent edf9c7ee25
commit 2483365141
2 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/asterisk-do.sh
+11 -11
View File
@@ -210,7 +210,7 @@ install_asterisk-do() {
echo "[DRY-RUN] Would create $EA_DIR with Dockerfile, docker-compose.yml, .env" echo "[DRY-RUN] Would create $EA_DIR with Dockerfile, docker-compose.yml, .env"
echo "[DRY-RUN] Would copy/download vendor files from easy-asterisk" echo "[DRY-RUN] Would copy/download vendor files from easy-asterisk"
echo "[DRY-RUN] Would detect droplet public IP via DO metadata service" echo "[DRY-RUN] Would detect droplet public IP via DO metadata service"
echo "[DRY-RUN] Would open UFW ports: 5060, 5061, 8080, 8088, 8089, 3478, 10000-20000, 49152-49252" echo "[DRY-RUN] Would open UFW ports: 5060, 5061, 8081, 8088, 8089, 3478, 10000-20000, 49152-49252"
echo "[DRY-RUN] Would open 51820/udp (not 51821) if wg-easy was selected" echo "[DRY-RUN] Would open 51820/udp (not 51821) if wg-easy was selected"
echo "[DRY-RUN] Would offer to create a DigitalOcean Cloud Firewall via doctl" echo "[DRY-RUN] Would offer to create a DigitalOcean Cloud Firewall via doctl"
echo "[DRY-RUN] Would reverse-proxy the web admin on the SAME FQDN used for SIP (needed for cert sync)" echo "[DRY-RUN] Would reverse-proxy the web admin on the SAME FQDN used for SIP (needed for cert sync)"
@@ -512,7 +512,7 @@ HAS_VLANS=n
VLAN_SUBNETS= VLAN_SUBNETS=
# ── Web admin ───────────────────────────────────────────────── # ── Web admin ─────────────────────────────────────────────────
WEB_ADMIN_PORT=8080 WEB_ADMIN_PORT=8081
WEB_ADMIN_AUTH_DISABLED=false WEB_ADMIN_AUTH_DISABLED=false
ENV ENV
chmod 600 .env chmod 600 .env
@@ -523,7 +523,7 @@ ENV
ufw allow 5060/udp ufw allow 5060/udp
ufw allow 5060/tcp ufw allow 5060/tcp
ufw allow 5061/tcp ufw allow 5061/tcp
ufw allow 8080/tcp ufw allow 8081/tcp
ufw allow 8088/tcp ufw allow 8088/tcp
ufw allow 8089/tcp ufw allow 8089/tcp
ufw allow 3478/udp ufw allow 3478/udp
@@ -555,7 +555,7 @@ ENV
"protocol:tcp,ports:5060,address:0.0.0.0/0,address:::/0" "protocol:tcp,ports:5060,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:5060,address:0.0.0.0/0,address:::/0" "protocol:udp,ports:5060,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:5061,address:0.0.0.0/0,address:::/0" "protocol:tcp,ports:5061,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:8080,address:0.0.0.0/0,address:::/0" "protocol:tcp,ports:8081,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:8088-8089,address:0.0.0.0/0,address:::/0" "protocol:tcp,ports:8088-8089,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:3478,address:0.0.0.0/0,address:::/0" "protocol:tcp,ports:3478,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:3478,address:0.0.0.0/0,address:::/0" "protocol:udp,ports:3478,address:0.0.0.0/0,address:::/0"
@@ -604,9 +604,9 @@ ENV
# matching $DOMAIN_NAME, and SIP TLS would silently stay self-signed. So # matching $DOMAIN_NAME, and SIP TLS would silently stay self-signed. So
# there's no separate domain prompt: this always targets $DOMAIN_NAME. # there's no separate domain prompt: this always targets $DOMAIN_NAME.
if [[ -z "$DOMAIN_NAME" ]]; then if [[ -z "$DOMAIN_NAME" ]]; then
log_info "No FQDN set — web admin stays on http://${PUBLIC_IP:-localhost}:8080 (nothing for Caddy to do)." log_info "No FQDN set — web admin stays on http://${PUBLIC_IP:-localhost}:8081 (nothing for Caddy to do)."
elif [[ ! -d "$DOCKER_DIR/caddy" ]] && [[ -z "${CADDY_REMOTE_HOST:-}" ]]; then elif [[ ! -d "$DOCKER_DIR/caddy" ]] && [[ -z "${CADDY_REMOTE_HOST:-}" ]]; then
log_info "Caddy not installed — web admin stays on http://${PUBLIC_IP:-localhost}:8080, SIP TLS stays self-signed." log_info "Caddy not installed — web admin stays on http://${PUBLIC_IP:-localhost}:8081, SIP TLS stays self-signed."
else else
local EXTRA_BLOCK="" local EXTRA_BLOCK=""
if [ -d "$DOCKER_DIR/authelia" ]; then if [ -d "$DOCKER_DIR/authelia" ]; then
@@ -665,7 +665,7 @@ ENV
# Asterisk Web Admin # Asterisk Web Admin
${DOMAIN_NAME} { ${DOMAIN_NAME} {
reverse_proxy localhost:8080 reverse_proxy localhost:8081
header { header {
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
@@ -847,7 +847,7 @@ plan for the admin panel.
| 22 | TCP | SSH (keep this open or you're locked out) | | 22 | TCP | SSH (keep this open or you're locked out) |
| 5060 | UDP/TCP | SIP signalling (unencrypted) | | 5060 | UDP/TCP | SIP signalling (unencrypted) |
| 5061 | TCP | SIP over TLS | | 5061 | TCP | SIP over TLS |
| 8080 | TCP | Easy Asterisk web admin | | 8081 | TCP | Easy Asterisk web admin |
| 8088/8089 | TCP | Asterisk HTTP/WS (ARI/AMI) | | 8088/8089 | TCP | Asterisk HTTP/WS (ARI/AMI) |
| 3478 | UDP/TCP | TURN/STUN (coturn) | | 3478 | UDP/TCP | TURN/STUN (coturn) |
| 10000–20000 | UDP | RTP media streams | | 10000–20000 | UDP | RTP media streams |
@@ -881,7 +881,7 @@ be added later by running \`sudo ./setup.sh <name>\` from the repo.
the public firewall; the web UI (51821) is deliberately **not** exposed — the public firewall; the web UI (51821) is deliberately **not** exposed —
reach it via SSH tunnel: \`ssh -L 51821:localhost:51821 user@<droplet-ip>\`, reach it via SSH tunnel: \`ssh -L 51821:localhost:51821 user@<droplet-ip>\`,
then browse \`http://localhost:51821\`. A natural next step once it's then browse \`http://localhost:51821\`. A natural next step once it's
installed: restrict the web admin (8080) to the VPN subnet only, on both installed: restrict the web admin (8081) to the VPN subnet only, on both
firewall layers, so reconfiguring the PBX requires being on the VPN — firewall layers, so reconfiguring the PBX requires being on the VPN —
done manually, not automatically, since a firewall mistake there can lock done manually, not automatically, since a firewall mistake there can lock
you out. you out.
@@ -965,7 +965,7 @@ accept it manually).
## Web admin ## Web admin
Access the Easy Asterisk web interface at http://<droplet-ip>:8080 Access the Easy Asterisk web interface at http://<droplet-ip>:8081
or via your configured reverse-proxy domain. or via your configured reverse-proxy domain.
## Data directories (all inside ~/docker/asterisk-do/, included in backup) ## Data directories (all inside ~/docker/asterisk-do/, included in backup)
@@ -1001,7 +1001,7 @@ MD
fi fi
echo " Public IP: ${PUBLIC_IP:-unknown}" echo " Public IP: ${PUBLIC_IP:-unknown}"
echo " SIP port: 5061 (TLS) / 5060 (UDP)" echo " SIP port: 5061 (TLS) / 5060 (UDP)"
echo " Web admin: http://${PUBLIC_IP:-localhost}:8080" echo " Web admin: http://${PUBLIC_IP:-localhost}:8081"
echo " Manage: docker compose -f $EA_DIR/docker-compose.yml <up|down|logs>" echo " Manage: docker compose -f $EA_DIR/docker-compose.yml <up|down|logs>"
echo " Script: docker exec -it easy-asterisk-do easy-asterisk --help" echo " Script: docker exec -it easy-asterisk-do easy-asterisk --help"
if [[ -n "$DOMAIN_NAME" ]] && [[ -d "$DOCKER_DIR/caddy" ]]; then if [[ -n "$DOMAIN_NAME" ]] && [[ -d "$DOCKER_DIR/caddy" ]]; then
services/asterisk.sh
+7 -7
View File
@@ -204,7 +204,7 @@ install_asterisk() {
if [ "$DRY_RUN" = true ]; then if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $EA_DIR with Dockerfile, docker-compose.yml, .env" echo "[DRY-RUN] Would create $EA_DIR with Dockerfile, docker-compose.yml, .env"
echo "[DRY-RUN] Would copy/download vendor files from easy-asterisk" echo "[DRY-RUN] Would copy/download vendor files from easy-asterisk"
echo "[DRY-RUN] Would open UFW ports: 5060, 5061, 8080, 8088, 8089, 3478, 10000-20000, 49152-49252" echo "[DRY-RUN] Would open UFW ports: 5060, 5061, 8081, 8088, 8089, 3478, 10000-20000, 49152-49252"
return 0 return 0
fi fi
@@ -383,7 +383,7 @@ HAS_VLANS=${HAS_VLANS_VAL}
VLAN_SUBNETS=${VLAN_SUBNETS_VAL} VLAN_SUBNETS=${VLAN_SUBNETS_VAL}
# ── Web admin ───────────────────────────────────────────────── # ── Web admin ─────────────────────────────────────────────────
WEB_ADMIN_PORT=8080 WEB_ADMIN_PORT=8081
WEB_ADMIN_AUTH_DISABLED=false WEB_ADMIN_AUTH_DISABLED=false
ENV ENV
chmod 600 .env chmod 600 .env
@@ -394,7 +394,7 @@ ENV
ufw allow 5060/udp ufw allow 5060/udp
ufw allow 5060/tcp ufw allow 5060/tcp
ufw allow 5061/tcp ufw allow 5061/tcp
ufw allow 8080/tcp ufw allow 8081/tcp
ufw allow 8088/tcp ufw allow 8088/tcp
ufw allow 8089/tcp ufw allow 8089/tcp
ufw allow 3478/udp ufw allow 3478/udp
@@ -415,7 +415,7 @@ ENV
sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env
fi fi
fi fi
configure_caddy_for_service "Asterisk Web Admin" "8080" "asterisk" "$EXTRA_BLOCK" configure_caddy_for_service "Asterisk Web Admin" "8081" "asterisk" "$EXTRA_BLOCK"
# ── README ──────────────────────────────────────────────────────────────── # ── README ────────────────────────────────────────────────────────────────
write_readme "$EA_DIR" << 'MD' write_readme "$EA_DIR" << 'MD'
@@ -483,7 +483,7 @@ to accept it).
## Web admin ## Web admin
Access the Easy Asterisk web interface at http://<host-ip>:8080 Access the Easy Asterisk web interface at http://<host-ip>:8081
or via your configured reverse-proxy domain. or via your configured reverse-proxy domain.
## Data directories (all inside ~/docker/asterisk/, included in backup) ## Data directories (all inside ~/docker/asterisk/, included in backup)
@@ -502,7 +502,7 @@ or via your configured reverse-proxy domain.
|---------------|----------|----------------------------------| |---------------|----------|----------------------------------|
| 5060 | UDP/TCP | SIP signalling (unencrypted) | | 5060 | UDP/TCP | SIP signalling (unencrypted) |
| 5061 | TCP | SIP over TLS | | 5061 | TCP | SIP over TLS |
| 8080 | TCP | Easy Asterisk web admin | | 8081 | TCP | Easy Asterisk web admin |
| 8088/8089 | TCP | Asterisk HTTP/WS (ARI/AMI) | | 8088/8089 | TCP | Asterisk HTTP/WS (ARI/AMI) |
| 3478 | UDP/TCP | TURN/STUN (coturn) | | 3478 | UDP/TCP | TURN/STUN (coturn) |
| 10000–20000 | UDP | RTP media streams | | 10000–20000 | UDP | RTP media streams |
@@ -530,7 +530,7 @@ MD
echo " TURN server: (none — LAN/VPN only)" echo " TURN server: (none — LAN/VPN only)"
fi fi
echo " SIP port: 5061 (TLS) / 5060 (UDP)" echo " SIP port: 5061 (TLS) / 5060 (UDP)"
echo " Web admin: http://$(hostname -I 2>/dev/null | awk '{print $1}' || echo localhost):8080" echo " Web admin: http://$(hostname -I 2>/dev/null | awk '{print $1}' || echo localhost):8081"
echo " Manage: docker compose -f $EA_DIR/docker-compose.yml <up|down|logs>" echo " Manage: docker compose -f $EA_DIR/docker-compose.yml <up|down|logs>"
echo " Script: docker exec -it easy-asterisk easy-asterisk --help" echo " Script: docker exec -it easy-asterisk easy-asterisk --help"
echo "" echo ""