root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #187 from outis1one/claude/asterisk-digital-ocean-w22kk8

Browse Source 
Claude/asterisk digital ocean w22kk8
This commit is contained in:
Outis
2026-07-20 14:16:19 -04:00
committed by GitHub
parent 1d4998889d fe7129c974
commit 41298c7ac3
3 changed files with 207 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/asterisk-digital-ocean.sh
+85 -67
View File
@@ -543,78 +543,20 @@ WEB_ADMIN_AUTH_DISABLED=false
ENV
chmod 600 .env
# ── UFW firewall rules (host-level) ───────────────────────────────────────
if command -v ufw &>/dev/null; then
log_info "Opening UFW ports for Asterisk + coturn..."
ufw allow 5060/udp
ufw allow 5060/tcp
ufw allow 5061/tcp
ufw allow "${WEB_ADMIN_PORT_VAL}/tcp"
ufw allow 8088/tcp
ufw allow 8089/tcp
ufw allow 3478/udp
ufw allow 3478/tcp
ufw allow 10000:20000/udp
ufw allow 49152:49252/udp
fi
if command -v ufw &>/dev/null; then
log_success "UFW rules added."
fi
# ── DigitalOcean Cloud Firewall (network edge, in front of the droplet) ───
local DO_FW_RULES=(
"protocol:tcp,ports:22,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:5060,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:5060,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:5061,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:${WEB_ADMIN_PORT_VAL},address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:8088-8089,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:3478,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:3478,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:10000-20000,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:49152-49252,address:0.0.0.0/0,address:::/0"
)
echo ""
if [[ -n "$DROPLET_ID" ]] && command -v doctl &>/dev/null && doctl account get &>/dev/null; then
local EXISTING_FW
EXISTING_FW="$(doctl compute firewall list --format ID,DropletIDs --no-header 2>/dev/null \
| grep -E "(^|[, ])${DROPLET_ID}([, ]|\$)" | awk '{print $1}' | head -1)"
if [[ -n "$EXISTING_FW" ]]; then
log_warning "A Cloud Firewall (id $EXISTING_FW) is already attached to this droplet — not touching it."
log_warning "Add these inbound rules to it yourself (Networking → Firewalls in the DO console):"
printf ' %s\n' "${DO_FW_RULES[@]}"
else
local DO_FW=""
prompt_yn "Create a DigitalOcean Cloud Firewall for this droplet via doctl now? (y/n):" "y" DO_FW
if [[ "$DO_FW" =~ ^[Yy]$ ]]; then
if doctl compute firewall create \
--name "asterisk-digital-ocean" \
--droplet-ids "$DROPLET_ID" \
--inbound-rules "$(IFS=' '; echo "${DO_FW_RULES[*]}")" \
--outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0,address:::/0 protocol:udp,ports:all,address:0.0.0.0/0,address:::/0 protocol:icmp,ports:0,address:0.0.0.0/0,address:::/0" \
&>/dev/null; then
log_success "Cloud Firewall 'asterisk-digital-ocean' created and attached (SSH/22 included so you don't get locked out)."
log_info "Verify it in the DO console — adjust the SSH rule if you use a non-default SSH port."
else
log_warning "doctl firewall create failed — add the rules manually (see README)."
fi
fi
fi
else
log_info "doctl not installed/authenticated — configure a DigitalOcean Cloud Firewall manually:"
log_info "Control Panel → Networking → Firewalls → create, attach to this droplet, allow:"
printf ' %s\n' "${DO_FW_RULES[@]}"
fi
# ── Caddy: reverse-proxy the web admin on the SAME FQDN used for SIP ──────
# Caddy only holds a cert for domains it's actively serving. If the web
# admin were proxied on a different "admin" subdomain, Caddy would obtain
# a cert for THAT domain instead — the sync earlier would never find one
# matching $DOMAIN_NAME, and SIP TLS would silently stay self-signed. So
# there's no separate domain prompt: this always targets $DOMAIN_NAME.
#
# Decided before the firewall rules below so they can be scoped
# correctly: if Caddy ends up fronting the web admin locally, there's no
# reason to also expose it directly to the internet — Caddy already
# reaches it over the host's internal network (host.docker.internal),
# and leaving the bare IP:port open would let anyone bypass Caddy/
# Authelia entirely.
local WEB_ADMIN_PUBLIC_ACCESS_NEEDED=true
if [[ -z "$DOMAIN_NAME" ]]; then
log_info "No FQDN set — web admin stays on http://${PUBLIC_IP:-localhost}:${WEB_ADMIN_PORT_VAL} (nothing for Caddy to do)."
elif [[ ! -d "$DOCKER_DIR/caddy" ]] && [[ -z "${CADDY_REMOTE_HOST:-}" ]]; then
@@ -705,6 +647,9 @@ CADDY_BLOCK
)"
if [[ "$_CADDY_MODE" == "local" ]]; then
# Caddy reaches this over the host's internal network — no
# need to keep the port open to the public internet.
WEB_ADMIN_PUBLIC_ACCESS_NEEDED=false
local _CADDYFILE="$DOCKER_DIR/caddy/Caddyfile"
local _CADDY_BACKUP="$_CADDYFILE.backup.$(date +%Y%m%d-%H%M%S)"
if [[ -f "$_CADDYFILE" ]]; then
@@ -739,10 +684,83 @@ CADDY_BLOCK
chown "$ACTUAL_USER:$ACTUAL_USER" "$_SNIPPET_DIR/asterisk-digital-ocean.caddy" 2>/dev/null || true
log_success "Snippet saved: $_SNIPPET_DIR/asterisk-digital-ocean.caddy"
log_info "Copy to your Caddy machine: scp $_SNIPPET_DIR/asterisk-digital-ocean.caddy caddy-host:~/caddy-snippets/"
log_info "Remote Caddy reaches this droplet over its public IP, so the web admin port stays open below."
fi
fi
fi
# ── UFW firewall rules (host-level) ───────────────────────────────────────
if command -v ufw &>/dev/null; then
log_info "Opening UFW ports for Asterisk + coturn..."
ufw allow 5060/udp
ufw allow 5060/tcp
ufw allow 5061/tcp
if [[ "$WEB_ADMIN_PUBLIC_ACCESS_NEEDED" == true ]]; then
ufw allow "${WEB_ADMIN_PORT_VAL}/tcp"
else
ufw delete allow "${WEB_ADMIN_PORT_VAL}/tcp" 2>/dev/null || true
log_info "Web admin port ${WEB_ADMIN_PORT_VAL} kept closed to the internet — Caddy fronts it locally."
fi
ufw allow 8088/tcp
ufw allow 8089/tcp
ufw allow 3478/udp
ufw allow 3478/tcp
ufw allow 10000:20000/udp
ufw allow 49152:49252/udp
log_success "UFW rules added."
fi
# ── DigitalOcean Cloud Firewall (network edge, in front of the droplet) ───
local DO_FW_RULES=(
"protocol:tcp,ports:22,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:5060,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:5060,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:5061,address:0.0.0.0/0,address:::/0"
)
if [[ "$WEB_ADMIN_PUBLIC_ACCESS_NEEDED" == true ]]; then
DO_FW_RULES+=("protocol:tcp,ports:${WEB_ADMIN_PORT_VAL},address:0.0.0.0/0,address:::/0")
fi
DO_FW_RULES+=(
"protocol:tcp,ports:8088-8089,address:0.0.0.0/0,address:::/0"
"protocol:tcp,ports:3478,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:3478,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:10000-20000,address:0.0.0.0/0,address:::/0"
"protocol:udp,ports:49152-49252,address:0.0.0.0/0,address:::/0"
)
echo ""
if [[ -n "$DROPLET_ID" ]] && command -v doctl &>/dev/null && doctl account get &>/dev/null; then
local EXISTING_FW
EXISTING_FW="$(doctl compute firewall list --format ID,DropletIDs --no-header 2>/dev/null \
| grep -E "(^|[, ])${DROPLET_ID}([, ]|\$)" | awk '{print $1}' | head -1)"
if [[ -n "$EXISTING_FW" ]]; then
log_warning "A Cloud Firewall (id $EXISTING_FW) is already attached to this droplet — not touching it."
log_warning "Add these inbound rules to it yourself (Networking → Firewalls in the DO console):"
printf ' %s\n' "${DO_FW_RULES[@]}"
else
local DO_FW=""
prompt_yn "Create a DigitalOcean Cloud Firewall for this droplet via doctl now? (y/n):" "y" DO_FW
if [[ "$DO_FW" =~ ^[Yy]$ ]]; then
if doctl compute firewall create \
--name "asterisk-digital-ocean" \
--droplet-ids "$DROPLET_ID" \
--inbound-rules "$(IFS=' '; echo "${DO_FW_RULES[*]}")" \
--outbound-rules "protocol:tcp,ports:all,address:0.0.0.0/0,address:::/0 protocol:udp,ports:all,address:0.0.0.0/0,address:::/0 protocol:icmp,ports:0,address:0.0.0.0/0,address:::/0" \
&>/dev/null; then
log_success "Cloud Firewall 'asterisk-digital-ocean' created and attached (SSH/22 included so you don't get locked out)."
log_info "Verify it in the DO console — adjust the SSH rule if you use a non-default SSH port."
else
log_warning "doctl firewall create failed — add the rules manually (see README)."
fi
fi
fi
else
log_info "doctl not installed/authenticated — configure a DigitalOcean Cloud Firewall manually:"
log_info "Control Panel → Networking → Firewalls → create, attach to this droplet, allow:"
printf ' %s\n' "${DO_FW_RULES[@]}"
fi
# ── CrowdSec note ──────────────────────────────────────────────────────────
# Not installed here — select it separately from the whiptail menu, or
# `sudo ./setup.sh crowdsec`. Its own installer (services/crowdsec.sh)
@@ -833,7 +851,7 @@ plan for the admin panel.
| 22 | TCP | SSH (keep this open or you're locked out) |
| 5060 | UDP/TCP | SIP signalling (unencrypted) |
| 5061 | TCP | SIP over TLS |
| ${WEB_ADMIN_PORT_VAL} | TCP | Easy Asterisk web admin (auto-picked — see \`.env\`) |
| ${WEB_ADMIN_PORT_VAL} | TCP | Easy Asterisk web admin (auto-picked — see \`.env\`). Only opened publicly if Caddy isn't fronting it locally — otherwise it's reachable only via \`https://${DOMAIN_NAME:-your-domain}/\`, not the bare IP:port. |
| 8088/8089 | TCP | Asterisk HTTP/WS (ARI/AMI) |
| 3478 | UDP/TCP | TURN/STUN (coturn) |
| 10000–20000 | UDP | RTP media streams |
vendor/easy-asterisk/docker/entrypoint.sh
Vendored
+9 -2
View File
@@ -431,8 +431,15 @@ fi
chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/log/asterisk /var/spool/asterisk /var/run/asterisk 2>/dev/null || true
# ── 10. Start Web Admin in background ─────────────────────────
# The web admin script is generated by the 'easy-asterisk' management tool.
# On first run: docker exec -it easy-asterisk easy-asterisk → Web Admin menu → Start
# The web admin script is generated by the 'easy-asterisk' management tool,
# but it only lives in the container's writable layer (not baked into the
# image or bind-mounted), so it's gone every time the container is
# recreated. Regenerate it unconditionally instead of only starting it if
# it happens to already exist — otherwise the web admin never comes back
# on its own after a restart, requiring a manual CLI trip every time.
if [[ -x /usr/local/bin/easy-asterisk ]]; then
/usr/local/bin/easy-asterisk --write-web-admin-script >/dev/null 2>&1 || true
fi
if [[ -f "$WEB_ADMIN_SCRIPT" ]]; then
log_info "Starting Web Admin on port ${WEB_ADMIN_PORT:-8080}..."
WEBADMIN_PORT="${WEB_ADMIN_PORT:-8080}" \
vendor/easy-asterisk/easy-asterisk-v0.10.0.sh
Vendored
+113 -17
View File
@@ -4779,7 +4779,13 @@ qualify_frequency=30
subprocess.run(['chown', 'asterisk:asterisk', PJSIP_CONF], capture_output=True)
subprocess.run(['/usr/local/bin/easy-asterisk', '--rebuild-dialplan'], capture_output=True)
return True, {'extension': extension, 'password': password, 'name': name}
return True, {
'extension': extension,
'password': password,
'name': name,
'transport': 'tls' if conn_type == 'fqdn' else 'udp',
'port': 5061 if conn_type == 'fqdn' else 5060,
}
def get_server_info():
"""Get server configuration info including TURN/STUN details"""
@@ -5099,7 +5105,9 @@ HTML_TEMPLATE = '''<!DOCTYPE html>
<p>Save these credentials - the password cannot be retrieved later</p>
</div>
<div class="credentials" id="credentials-display"></div>
<div style="margin-top: 20px; text-align: right;">
<div style="margin-top: 20px; display: flex; gap: 10px; justify-content: flex-end;">
<button class="btn" onclick="copyDevicePassword()" style="background: #e2e8f0;">Copy Password</button>
<button class="btn" onclick="copyAllCredentials()" style="background: #e2e8f0;">Copy All</button>
<button class="btn btn-primary" onclick="closeCredentialsModal()">Done</button>
</div>
</div>
@@ -5702,24 +5710,49 @@ HTML_TEMPLATE = '''<!DOCTYPE html>
if (result.success) {
closeModal();
let credHtml = `
<p><strong>Extension:</strong> ${result.data.extension}</p>
<p><strong>Password:</strong> ${result.data.password}</p>
<p><strong>Name:</strong> ${result.data.name}</p>
`;
// Fetch server info to show TURN details
const d = result.data;
const transportLabel = d.transport === 'tls' ? 'TLS' : 'UDP';
// Fetch server info for the domain and TURN details
let srv = {};
try {
const srvRes = await fetch(API_BASE + '/server');
const srv = await srvRes.json();
if (srv.turn_enabled && srv.turn_server) {
credHtml += `<hr style="margin:12px 0;border-color:#e2e8f0">
<p style="font-size:13px;color:#64748b;margin-bottom:6px">STUN/TURN (configure in app Network settings)</p>
<p><strong>STUN/TURN server:</strong> ${srv.turn_server}</p>
<p><strong>TURN username:</strong> ${srv.turn_username}</p>
<p><strong>TURN password:</strong> ${srv.turn_password}</p>
`;
}
srv = await srvRes.json();
} catch(e) {}
const server = srv.domain || srv.server_ip || '';
// Everything a SIP client (e.g. Sipnetic) needs, kept in one
// object so both the display and the copy buttons read from
// the same source instead of re-parsing rendered HTML.
lastDeviceCreds = {
name: d.name,
server: server,
port: d.port,
transport: transportLabel,
username: d.extension,
password: d.password,
turnEnabled: !!(srv.turn_enabled && srv.turn_server),
turnServer: srv.turn_server || '',
turnUsername: srv.turn_username || '',
turnPassword: srv.turn_password || ''
};
let credHtml = `
<p><strong>Display Name:</strong> ${lastDeviceCreds.name}</p>
<p><strong>Server:</strong> ${lastDeviceCreds.server}</p>
<p><strong>Port:</strong> ${lastDeviceCreds.port}</p>
<p><strong>Transport:</strong> ${lastDeviceCreds.transport}</p>
<p><strong>Username:</strong> ${lastDeviceCreds.username}</p>
<p><strong>Password:</strong> ${lastDeviceCreds.password}</p>
`;
if (lastDeviceCreds.turnEnabled) {
credHtml += `<hr style="margin:12px 0;border-color:#e2e8f0">
<p style="font-size:13px;color:#64748b;margin-bottom:6px">STUN/TURN (configure in app Network settings)</p>
<p><strong>STUN/TURN server:</strong> ${lastDeviceCreds.turnServer}</p>
<p><strong>TURN username:</strong> ${lastDeviceCreds.turnUsername}</p>
<p><strong>TURN password:</strong> ${lastDeviceCreds.turnPassword}</p>
`;
}
document.getElementById('credentials-display').innerHTML = credHtml;
document.getElementById('credentials-modal').classList.add('active');
} else {
@@ -5730,6 +5763,57 @@ HTML_TEMPLATE = '''<!DOCTYPE html>
}
}
// Holds the most recently created device's credentials so the
// Copy All / Copy Password buttons don't need to re-parse the DOM.
let lastDeviceCreds = null;
function copyToClipboard(text) {
if (navigator.clipboard && window.isSecureContext) {
return navigator.clipboard.writeText(text);
}
// Fallback for non-HTTPS/non-secure contexts where the Clipboard
// API is unavailable (e.g. plain-HTTP self-signed-cert access).
const ta = document.createElement('textarea');
ta.value = text;
ta.style.position = 'fixed';
ta.style.opacity = '0';
document.body.appendChild(ta);
ta.focus();
ta.select();
try {
document.execCommand('copy');
} finally {
document.body.removeChild(ta);
}
return Promise.resolve();
}
function copyAllCredentials() {
if (!lastDeviceCreds) return;
const c = lastDeviceCreds;
let text = `Display Name: ${c.name}\n` +
`Server: ${c.server}\n` +
`Port: ${c.port}\n` +
`Transport: ${c.transport}\n` +
`Username: ${c.username}\n` +
`Password: ${c.password}\n`;
if (c.turnEnabled) {
text += `STUN/TURN server: ${c.turnServer}\n` +
`TURN username: ${c.turnUsername}\n` +
`TURN password: ${c.turnPassword}\n`;
}
copyToClipboard(text)
.then(() => showAlert('All settings copied to clipboard', 'success'))
.catch(() => showAlert('Copy failed — select and copy manually', 'error'));
}
function copyDevicePassword() {
if (!lastDeviceCreds) return;
copyToClipboard(lastDeviceCreds.password)
.then(() => showAlert('Password copied to clipboard', 'success'))
.catch(() => showAlert('Copy failed — select and copy manually', 'error'));
}
async function deleteDevice(ext, name) {
if (!confirm(`Delete device ${ext} (${name})?`)) return;
@@ -6940,4 +7024,16 @@ if [[ "${1:-}" == "--rebuild-dialplan" ]]; then
exit 0
fi
# Non-interactive entry point used by the container entrypoint on every
# start. create_web_admin_script() writes /usr/local/bin/easy-asterisk-
# webadmin, but that file lives only in the container's writable layer —
# it isn't baked into the image or bind-mounted anywhere — so it's wiped
# on every recreate. Without regenerating it here, the web admin only
# ever starts after someone manually runs it once from the interactive
# CLI menu, which defeats the point of it auto-starting at all.
if [[ "${1:-}" == "--write-web-admin-script" ]]; then
create_web_admin_script
exit 0
fi
main "$@"