root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

asterisk.sh: same port-exposure fix and UFW enable as the DO edition

Browse Source 
Mirrors the fixes just made in asterisk-digital-ocean.sh:

- Reordered so the Caddy reverse-proxy decision happens before the
  UFW rules are built, using the new CADDY_SERVICE_CONFIGURED/
  CADDY_SERVICE_MODE signal from configure_caddy_for_service() to
  skip opening the web admin port on the LAN when a local Caddy is
  already fronting it (still opens it for a remote Caddy machine,
  which needs LAN access to reach this host directly).
- Calls the new ensure_ufw_enabled() so UFW actually enforces the
  rules this script adds, instead of leaving them queued but inert.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015X1jRGHwrvovz2qkhKfDZi
This commit is contained in:
Claude
2026-07-20 18:20:30 +00:00
parent 2330b47dd9
commit 516e0db66f
1 changed files with 26 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/asterisk.sh
+26 -16
View File
@@ -503,23 +503,11 @@ WEB_ADMIN_AUTH_DISABLED=false
ENV
chmod 600 .env
# ── UFW firewall rules ────────────────────────────────────────────────────
if command -v ufw &>/dev/null; then
log_info "Opening UFW ports for Asterisk + coturn..."
ufw allow 5060/udp
ufw allow 5060/tcp
ufw allow 5061/tcp
ufw allow "${WEB_ADMIN_PORT_VAL}/tcp"
ufw allow 8088/tcp
ufw allow 8089/tcp
ufw allow 3478/udp
ufw allow 3478/tcp
ufw allow 10000:20000/udp
ufw allow 49152:49252/udp
log_success "UFW rules added."
fi
# ── Caddy reverse proxy for web admin ─────────────────────────────────────
# Decided before the firewall rules below so they can be scoped
# correctly: if a local Caddy ends up fronting the web admin, there's no
# reason to also expose it on the LAN — Caddy already reaches it over
# the host's internal network (host.docker.internal).
local EXTRA_BLOCK=""
if [ -d "$DOCKER_DIR/authelia" ]; then
local _use_auth=""
@@ -532,6 +520,28 @@ ENV
fi
configure_caddy_for_service "Asterisk Web Admin" "${WEB_ADMIN_PORT_VAL}" "asterisk" "$EXTRA_BLOCK"
# ── UFW firewall rules ────────────────────────────────────────────────────
if command -v ufw &>/dev/null; then
log_info "Opening UFW ports for Asterisk + coturn..."
ufw allow 5060/udp
ufw allow 5060/tcp
ufw allow 5061/tcp
if [[ "$CADDY_SERVICE_CONFIGURED" == true && "$CADDY_SERVICE_MODE" == "local" ]]; then
ufw delete allow "${WEB_ADMIN_PORT_VAL}/tcp" 2>/dev/null || true
log_info "Web admin port ${WEB_ADMIN_PORT_VAL} kept off the LAN — Caddy fronts it locally."
else
ufw allow "${WEB_ADMIN_PORT_VAL}/tcp"
fi
ufw allow 8088/tcp
ufw allow 8089/tcp
ufw allow 3478/udp
ufw allow 3478/tcp
ufw allow 10000:20000/udp
ufw allow 49152:49252/udp
ensure_ufw_enabled
log_success "UFW rules added."
fi
# ── README ────────────────────────────────────────────────────────────────
write_readme "$EA_DIR" << 'MD'
# Easy Asterisk PBX + coturn