asterisk.sh: same port-exposure fix and UFW enable as the DO edition

Mirrors the fixes just made in asterisk-digital-ocean.sh:

- Reordered so the Caddy reverse-proxy decision happens before the
  UFW rules are built, using the new CADDY_SERVICE_CONFIGURED/
  CADDY_SERVICE_MODE signal from configure_caddy_for_service() to
  skip opening the web admin port on the LAN when a local Caddy is
  already fronting it (still opens it for a remote Caddy machine,
  which needs LAN access to reach this host directly).
- Calls the new ensure_ufw_enabled() so UFW actually enforces the
  rules this script adds, instead of leaving them queued but inert.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015X1jRGHwrvovz2qkhKfDZi

services/asterisk.sh

@@ -503,23 +503,11 @@ WEB_ADMIN_AUTH_DISABLED=false
 ENV
     chmod 600 .env
 
-    # ── UFW firewall rules ────────────────────────────────────────────────────
-    if command -v ufw &>/dev/null; then
-        log_info "Opening UFW ports for Asterisk + coturn..."
-        ufw allow 5060/udp
-        ufw allow 5060/tcp
-        ufw allow 5061/tcp
-        ufw allow "${WEB_ADMIN_PORT_VAL}/tcp"
-        ufw allow 8088/tcp
-        ufw allow 8089/tcp
-        ufw allow 3478/udp
-        ufw allow 3478/tcp
-        ufw allow 10000:20000/udp
-        ufw allow 49152:49252/udp
-        log_success "UFW rules added."
-    fi
-
     # ── Caddy reverse proxy for web admin ─────────────────────────────────────
+    # Decided before the firewall rules below so they can be scoped
+    # correctly: if a local Caddy ends up fronting the web admin, there's no
+    # reason to also expose it on the LAN — Caddy already reaches it over
+    # the host's internal network (host.docker.internal).
     local EXTRA_BLOCK=""
     if [ -d "$DOCKER_DIR/authelia" ]; then
         local _use_auth=""
@@ -532,6 +520,28 @@ ENV
     fi
     configure_caddy_for_service "Asterisk Web Admin" "${WEB_ADMIN_PORT_VAL}" "asterisk" "$EXTRA_BLOCK"
 
+    # ── UFW firewall rules ────────────────────────────────────────────────────
+    if command -v ufw &>/dev/null; then
+        log_info "Opening UFW ports for Asterisk + coturn..."
+        ufw allow 5060/udp
+        ufw allow 5060/tcp
+        ufw allow 5061/tcp
+        if [[ "$CADDY_SERVICE_CONFIGURED" == true && "$CADDY_SERVICE_MODE" == "local" ]]; then
+            ufw delete allow "${WEB_ADMIN_PORT_VAL}/tcp" 2>/dev/null || true
+            log_info "Web admin port ${WEB_ADMIN_PORT_VAL} kept off the LAN — Caddy fronts it locally."
+        else
+            ufw allow "${WEB_ADMIN_PORT_VAL}/tcp"
+        fi
+        ufw allow 8088/tcp
+        ufw allow 8089/tcp
+        ufw allow 3478/udp
+        ufw allow 3478/tcp
+        ufw allow 10000:20000/udp
+        ufw allow 49152:49252/udp
+        ensure_ufw_enabled
+        log_success "UFW rules added."
+    fi
+
     # ── README ────────────────────────────────────────────────────────────────
     write_readme "$EA_DIR" << 'MD'
 # Easy Asterisk PBX + coturn