root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace Caddy path-proxy with a fully native Asterisk Admin tab

Browse Source 
Supersedes the previous commit's reverse-proxy approach entirely: instead
of Caddy routing to Easy Asterisk's own separate vendored web admin
process, the dashboard now reimplements that admin's functionality
natively - one process, one page, real tab-switching, no separate app to
proxy, patch, or embed. Reverts asterisk.sh/asterisk-digital-ocean.sh's
WEBADMIN_BASE_PATH vendor patching and Caddy-skip logic back to their
pre-proxy state (confirmed identical via diff) since neither is needed
anymore.

security-dashboard.sh additions:
- ea_* functions covering full device/category/room parity with
  vendor/easy-asterisk/easy-asterisk-v0.10.0.sh's own web admin: list/add/
  delete/rename/change-category for devices, list/create/delete/rename for
  categories, list/create/delete/rename/add-member/remove-member for
  rooms, plus live registered/unregistered status. Reads go straight
  through the host-side bind-mounted config files (same as the existing
  list_extensions() already does for pjsip.conf); writes go through
  `docker exec -i <container> tee <path>` instead of a direct host-side
  write, since Easy Asterisk's container writes these files as its own
  internal user and a host-side write would just be fighting that
  ownership again on the next container restart.
- Found and fixed a real bug (inherited from the vendored admin's own
  template, not introduced here): a plain non-mobile LAN device leaves
  both the keepalive and ice template lines empty, producing two
  consecutive blank lines inside the endpoint's pjsip.conf stanza instead
  of one - which broke the delete/rename/category-change parsers' "blank
  line ends this device's block" boundary detection, leaving an orphaned
  tail of config behind on delete. Fixed by building the endpoint block
  from a filtered line list instead of positional template blanks.
  Confirmed via a full synthetic add/rename/category-change/delete cycle
  against realistic pjsip.conf/categories.conf/rooms.conf fixtures (with
  docker exec mocked to a local file) - round-trips back to the original
  fixture correctly.
- New plumbing: _secdash_grant_asterisk_access grants read-only access to
  categories.conf/rooms.conf's directory (separate from pjsip.conf's,
  confirmed against the vendored source - /etc/easy-asterisk/*, not
  /etc/asterisk/*); _secdash_write_sudoers adds six exact (no wildcards)
  docker-exec sudoers entries scoped to the one Asterisk container
  actually installed, validated live with visudo -c; _secdash_write_systemd_unit
  passes the new ASTERISK_EA_CONFIG_DIR/ASTERISK_EA_CONTAINER env vars and
  adds the config dir to ReadOnlyPaths, validated live with
  systemd-analyze verify.
- New UI: Asterisk Admin tab with Devices/Categories/Rooms cards, sortable
  tables matching the existing style, inline category-reassignment
  dropdowns, and per-room member chips with an inline add-member picker.
  Nav button visibility now checks live container reachability
  (/api/ea-status) instead of just Asterisk-install detection.

Still unverified: the actual `docker exec` calls (module reload, dialplan
rebuild, live status) against a real running Easy Asterisk container -
only the file-parsing/transformation logic itself has been exercised, via
mocked writes, not the real container plumbing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ho9mZgAkVpdz7S5wJkg8Nf
This commit is contained in:
Claude
2026-07-24 12:14:27 +00:00
parent d449586dde
commit 6f5ed30469
3 changed files with 1228 additions and 372 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/asterisk-digital-ocean.sh
-104
View File
@@ -469,75 +469,6 @@ _asterisk_do_patch_messaging_vendor_files() {
log_success "Vendor generator functions patched for internal SIP messaging."
}
# ── Shared: sub-path-aware web admin (for native Caddy path-proxying) ──────
# See services/asterisk.sh's own copy of this pair of functions for the full
# rationale (verified against the real vendored file: the admin's only
# absolute-path reference anywhere is `const API_BASE = '/api';`, no other
# hrefs/redirects, plain HTTP Basic Auth instead of a login-page flow) —
# identical here since both services vendor the exact same easy-asterisk
# source, just under this service's own `_asterisk_do_` naming.
_asterisk_do_patch_webadmin_base_path() {
local EA_DIR="$1"
local EASY1="$EA_DIR/easy-asterisk.sh"
local EASY2
EASY2="$(find "$EA_DIR" -maxdepth 1 -name 'easy-asterisk-v*.sh' | head -1)"
[[ -z "$EASY2" ]] && EASY2="$EA_DIR/easy-asterisk-v0.10.0.sh"
local BASE_PATH_LINE="BASE_PATH = os.environ.get('WEBADMIN_BASE_PATH', '').rstrip('/')"
local REPLACE_LINE
REPLACE_LINE=$(cat <<'PYLINE'
HTML_TEMPLATE = HTML_TEMPLATE.replace("const API_BASE = '/api';", "const API_BASE = '" + BASE_PATH + "/api';")
PYLINE
)
local f TMP_FILE
for f in "$EASY1" "$EASY2"; do
[[ -f "$f" ]] || continue
grep -q "WEBADMIN_BASE_PATH" "$f" && continue # already patched
if ! grep -qF "PORT = int(os.environ.get('WEBADMIN_PORT', 8080))" "$f"; then
log_warning "$(basename "$f"): WEBADMIN_PORT anchor not found — vendor template changed upstream."
log_warning " Sub-path proxying for the web admin won't work correctly until this is patched by hand."
continue
fi
if ! grep -qF "class WebAdminHandler(http.server.BaseHTTPRequestHandler):" "$f"; then
log_warning "$(basename "$f"): WebAdminHandler anchor not found — vendor template changed upstream."
log_warning " Sub-path proxying for the web admin won't work correctly until this is patched by hand."
continue
fi
TMP_FILE="$(mktemp)"
awk -v base_line="$BASE_PATH_LINE" -v replace_line="$REPLACE_LINE" '
index($0, "PORT = int(os.environ.get(") == 1 {
print
print base_line
next
}
index($0, "class WebAdminHandler(http.server.BaseHTTPRequestHandler):") == 1 {
print replace_line
print ""
}
{ print }
' "$f" > "$TMP_FILE" && mv "$TMP_FILE" "$f"
done
log_success "Vendor web admin script patched for sub-path proxying support."
}
_asterisk_do_patch_webadmin_entrypoint_env() {
local EA_DIR="$1"
local ENTRYPOINT="$EA_DIR/docker/entrypoint.sh"
[[ -f "$ENTRYPOINT" ]] || return 0
grep -q "WEBADMIN_BASE_PATH=" "$ENTRYPOINT" && return 0 # already patched
if grep -qF 'WEBADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}" \' "$ENTRYPOINT"; then
sed -i 's|WEBADMIN_AUTH_DISABLED="\${WEB_ADMIN_AUTH_DISABLED:-false}" \\|WEBADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}" \\\n WEBADMIN_BASE_PATH="${WEB_ADMIN_BASE_PATH:-}" \\|' "$ENTRYPOINT"
log_success "Live entrypoint.sh patched to pass WEBADMIN_BASE_PATH through to the web admin."
else
log_warning "$(basename "$ENTRYPOINT"): WEBADMIN_AUTH_DISABLED anchor not found — vendor template changed upstream."
log_warning " Sub-path proxying for the web admin won't work correctly until this is patched by hand."
fi
}
# Confirmed live (2026-07-23, via a real pstn-trunk.sh failure that hit this
# same mechanism): the vendor-generator patch above only takes effect on a
# FUTURE regeneration, and Easy Asterisk's own entrypoint only regenerates
@@ -836,9 +767,6 @@ install_asterisk-digital-ocean() {
_asterisk_do_write_messaging_dialplan "$EA_DIR/config/asterisk/messaging-dialplan.conf"
_asterisk_do_ensure_live_messaging_include "$EA_DIR"
_asterisk_do_migrate_existing_devices_message_context "$EA_DIR/config/asterisk/pjsip.conf"
_asterisk_do_patch_webadmin_base_path "$EA_DIR"
_asterisk_do_patch_webadmin_entrypoint_env "$EA_DIR"
grep -q '^WEB_ADMIN_BASE_PATH=' .env || echo 'WEB_ADMIN_BASE_PATH=' >> .env
ensure_docker_dir_ownership "$EA_DIR/config/asterisk"
chmod 644 "$EA_DIR/config/asterisk/messaging-dialplan.conf"
@@ -915,8 +843,6 @@ install_asterisk-digital-ocean() {
_asterisk_do_patch_messaging_vendor_files "$EA_DIR"
_asterisk_do_write_messaging_dialplan "$EA_DIR/config/asterisk/messaging-dialplan.conf"
_asterisk_do_ensure_live_messaging_include "$EA_DIR"
_asterisk_do_patch_webadmin_base_path "$EA_DIR"
_asterisk_do_patch_webadmin_entrypoint_env "$EA_DIR"
ensure_docker_dir_ownership "$EA_DIR/config/asterisk"
chmod 644 "$EA_DIR/config/asterisk/messaging-dialplan.conf"
@@ -981,12 +907,6 @@ install_asterisk-digital-ocean() {
log_info "Port 8081 was already taken — web admin will use ${WEB_ADMIN_PORT_VAL} instead."
fi
# If the Security Dashboard is already installed, it's going to front
# this admin natively at /asterisk-admin/ (see services/security-dashboard.sh) —
# pre-set the base path now so it works immediately, no update cycle needed.
local WEB_ADMIN_BASE_PATH_VAL=""
[[ -d "$DOCKER_DIR/security-dashboard" ]] && WEB_ADMIN_BASE_PATH_VAL="/asterisk-admin"
# ── .env ──────────────────────────────────────────────────────────────────
cat > .env << ENV
# ── Domain ────────────────────────────────────────────────────
@@ -1018,9 +938,6 @@ VLAN_SUBNETS=
# both firewall layers to match.
WEB_ADMIN_PORT=${WEB_ADMIN_PORT_VAL}
WEB_ADMIN_AUTH_DISABLED=false
# Set to /asterisk-admin by the Security Dashboard when it fronts this admin
# natively via Caddy path-proxying (no iframe) — leave empty otherwise.
WEB_ADMIN_BASE_PATH=${WEB_ADMIN_BASE_PATH_VAL}
ENV
chmod 600 .env
@@ -1042,27 +959,6 @@ ENV
log_info "No FQDN set — web admin stays on http://${PUBLIC_IP:-localhost}:${WEB_ADMIN_PORT_VAL} (nothing for Caddy to do)."
elif [[ ! -d "$DOCKER_DIR/caddy" ]] && [[ -z "${CADDY_REMOTE_HOST:-}" ]]; then
log_info "Caddy not installed — web admin stays on http://${PUBLIC_IP:-localhost}:${WEB_ADMIN_PORT_VAL}, SIP TLS stays self-signed."
elif [[ -d "$DOCKER_DIR/security-dashboard" ]]; then
# The dashboard owns fronting this admin instead — natively, at
# https://<dashboard-domain>/asterisk-admin/, via Caddy path-proxying
# (see services/security-dashboard.sh's _secdash_configure_caddy)
# rather than a separate site block here. The SIP-TLS-cert-sync
# requirement above only needs SOME active Caddy site block for
# DOMAIN_NAME to exist — it doesn't require THIS service's own block
# specifically — and the dashboard's own domain prompt defaults to
# this exact DOMAIN_NAME when it detects this droplet, so the common
# case still ends up with Caddy serving DOMAIN_NAME (satisfying SIP
# TLS) with no separate admin domain needed at all.
log_info "Security Dashboard detected — it fronts the Asterisk web admin natively"
log_info "at https://<dashboard-domain>/asterisk-admin/ (no iframe, one URL for both)."
log_info "Its own domain prompt defaults to this droplet's DOMAIN_NAME (${DOMAIN_NAME}),"
log_info "so SIP TLS still gets a real cert as long as you accept that default."
log_info "Re-run 'sudo ./setup.sh security-dashboard' (update mode) to reconfigure that."
# Caddy (whichever domain the dashboard ends up using) reaches this
# over the host's internal network either way — no need to also keep
# the port open to the public internet, same as the local-Caddy case
# just below.
WEB_ADMIN_PUBLIC_ACCESS_NEEDED=false
else
local EXTRA_BLOCK=""
if [ -d "$DOCKER_DIR/authelia" ]; then
services/asterisk.sh
+8 -131
View File
@@ -433,96 +433,6 @@ _asterisk_patch_messaging_vendor_files() {
log_success "Vendor generator functions patched for internal SIP messaging."
}
# ── Shared: sub-path-aware web admin (for native Caddy path-proxying) ──────
# The vendored web admin's own JS hardcodes `const API_BASE = '/api';` —
# confirmed via grep against the actual vendored source: it's the ONLY
# absolute-path reference anywhere in the admin's HTML/JS (no other hrefs,
# no login-page redirect — it challenges with plain HTTP Basic Auth via a
# 401/WWW-Authenticate response instead of a redirect flow). That one
# hardcoded root path is what would break if this admin were ever reverse-
# proxied on a sub-path (e.g. Caddy's `handle_path /asterisk-admin/*`)
# instead of its own dedicated domain: the browser resolves each fetch()'s
# absolute path against the current origin's ROOT, not the sub-path it was
# actually served under, so every /api/... call 404s. This patches API_BASE
# to prefix itself with a WEBADMIN_BASE_PATH env var (empty string = today's
# behavior, completely unchanged) so a sub-path mount works correctly.
# Verified against the real vendored file: patched output is
# '/asterisk-admin/api' when the env var is set, and stays exactly '/api'
# when it's unset — both confirmed by executing the patched module's
# top-level code directly, not just eyeballing the diff.
#
# entrypoint.sh already regenerates this script UNCONDITIONALLY on every
# container start (`easy-asterisk --write-web-admin-script`, no
# `[[ ! -f ]]` guard unlike pjsip.conf/extensions.conf — confirmed in its
# own source), so patching only the generator source here is sufficient;
# no separate live-file patch is needed the way messaging needed one.
_asterisk_patch_webadmin_base_path() {
local EA_DIR="$1"
local EASY1="$EA_DIR/easy-asterisk.sh"
local EASY2
EASY2="$(find "$EA_DIR" -maxdepth 1 -name 'easy-asterisk-v*.sh' | head -1)"
[[ -z "$EASY2" ]] && EASY2="$EA_DIR/easy-asterisk-v0.10.0.sh"
local BASE_PATH_LINE="BASE_PATH = os.environ.get('WEBADMIN_BASE_PATH', '').rstrip('/')"
local REPLACE_LINE
REPLACE_LINE=$(cat <<'PYLINE'
HTML_TEMPLATE = HTML_TEMPLATE.replace("const API_BASE = '/api';", "const API_BASE = '" + BASE_PATH + "/api';")
PYLINE
)
local f TMP_FILE
for f in "$EASY1" "$EASY2"; do
[[ -f "$f" ]] || continue
grep -q "WEBADMIN_BASE_PATH" "$f" && continue # already patched
if ! grep -qF "PORT = int(os.environ.get('WEBADMIN_PORT', 8080))" "$f"; then
log_warning "$(basename "$f"): WEBADMIN_PORT anchor not found — vendor template changed upstream."
log_warning " Sub-path proxying for the web admin won't work correctly until this is patched by hand."
continue
fi
if ! grep -qF "class WebAdminHandler(http.server.BaseHTTPRequestHandler):" "$f"; then
log_warning "$(basename "$f"): WebAdminHandler anchor not found — vendor template changed upstream."
log_warning " Sub-path proxying for the web admin won't work correctly until this is patched by hand."
continue
fi
TMP_FILE="$(mktemp)"
awk -v base_line="$BASE_PATH_LINE" -v replace_line="$REPLACE_LINE" '
index($0, "PORT = int(os.environ.get(") == 1 {
print
print base_line
next
}
index($0, "class WebAdminHandler(http.server.BaseHTTPRequestHandler):") == 1 {
print replace_line
print ""
}
{ print }
' "$f" > "$TMP_FILE" && mv "$TMP_FILE" "$f"
done
log_success "Vendor web admin script patched for sub-path proxying support."
}
# Companion to the above: entrypoint.sh explicitly passes only WEBADMIN_PORT
# and WEBADMIN_AUTH_DISABLED as env vars to the web admin script (see its own
# "Start Web Admin in background" step) — WEBADMIN_BASE_PATH needs the same
# explicit pass-through, or the container's own WEB_ADMIN_BASE_PATH (from
# .env) never actually reaches the Python process reading it.
_asterisk_patch_webadmin_entrypoint_env() {
local EA_DIR="$1"
local ENTRYPOINT="$EA_DIR/docker/entrypoint.sh"
[[ -f "$ENTRYPOINT" ]] || return 0
grep -q "WEBADMIN_BASE_PATH=" "$ENTRYPOINT" && return 0 # already patched
if grep -qF 'WEBADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}" \' "$ENTRYPOINT"; then
sed -i 's|WEBADMIN_AUTH_DISABLED="\${WEB_ADMIN_AUTH_DISABLED:-false}" \\|WEBADMIN_AUTH_DISABLED="${WEB_ADMIN_AUTH_DISABLED:-false}" \\\n WEBADMIN_BASE_PATH="${WEB_ADMIN_BASE_PATH:-}" \\|' "$ENTRYPOINT"
log_success "Live entrypoint.sh patched to pass WEBADMIN_BASE_PATH through to the web admin."
else
log_warning "$(basename "$ENTRYPOINT"): WEBADMIN_AUTH_DISABLED anchor not found — vendor template changed upstream."
log_warning " Sub-path proxying for the web admin won't work correctly until this is patched by hand."
fi
}
# Confirmed live (2026-07-23, via a real pstn-trunk.sh failure that hit this
# same mechanism): the vendor-generator patch above only takes effect on a
# FUTURE regeneration, and Easy Asterisk's own entrypoint only regenerates
@@ -816,9 +726,6 @@ install_asterisk() {
_asterisk_write_messaging_dialplan "$EA_DIR/config/asterisk/messaging-dialplan.conf"
_asterisk_ensure_live_messaging_include "$EA_DIR"
_asterisk_migrate_existing_devices_message_context "$EA_DIR/config/asterisk/pjsip.conf"
_asterisk_patch_webadmin_base_path "$EA_DIR"
_asterisk_patch_webadmin_entrypoint_env "$EA_DIR"
grep -q '^WEB_ADMIN_BASE_PATH=' .env || echo 'WEB_ADMIN_BASE_PATH=' >> .env
ensure_docker_dir_ownership "$EA_DIR/config/asterisk"
chmod 644 "$EA_DIR/config/asterisk/messaging-dialplan.conf"
@@ -864,8 +771,6 @@ install_asterisk() {
_asterisk_refresh_vendor_files
_asterisk_patch_messaging_vendor_files "$EA_DIR"
_asterisk_write_messaging_dialplan "$EA_DIR/config/asterisk/messaging-dialplan.conf"
_asterisk_patch_webadmin_base_path "$EA_DIR"
_asterisk_patch_webadmin_entrypoint_env "$EA_DIR"
ensure_docker_dir_ownership "$EA_DIR/config/asterisk"
chmod 644 "$EA_DIR/config/asterisk/messaging-dialplan.conf"
@@ -936,12 +841,6 @@ install_asterisk() {
log_info "Port 8081 was already taken — web admin will use ${WEB_ADMIN_PORT_VAL} instead."
fi
# If the Security Dashboard is already installed, it's going to front
# this admin natively at /asterisk-admin/ (see services/security-dashboard.sh) —
# pre-set the base path now so it works immediately, no update cycle needed.
local WEB_ADMIN_BASE_PATH_VAL=""
[[ -d "$DOCKER_DIR/security-dashboard" ]] && WEB_ADMIN_BASE_PATH_VAL="/asterisk-admin"
# ── .env ──────────────────────────────────────────────────────────────────
cat > .env << ENV
# ── Domain ────────────────────────────────────────────────────
@@ -972,9 +871,6 @@ VLAN_SUBNETS=${VLAN_SUBNETS_VAL}
# any firewall rules to match.
WEB_ADMIN_PORT=${WEB_ADMIN_PORT_VAL}
WEB_ADMIN_AUTH_DISABLED=false
# Set to /asterisk-admin by the Security Dashboard when it fronts this admin
# natively via Caddy path-proxying (no iframe) — leave empty otherwise.
WEB_ADMIN_BASE_PATH=${WEB_ADMIN_BASE_PATH_VAL}
ENV
chmod 600 .env
@@ -983,36 +879,17 @@ ENV
# correctly: if a local Caddy ends up fronting the web admin, there's no
# reason to also expose it on the LAN — Caddy already reaches it over
# the host's internal network (host.docker.internal).
#
# If the Security Dashboard is already here, it owns fronting this admin
# instead — natively, at https://<dashboard-domain>/asterisk-admin/, via
# Caddy path-proxying (see services/security-dashboard.sh's
# _secdash_configure_caddy) rather than a separate dedicated domain. Two
# independent Caddy blocks both proxying the same port would just mean
# two working URLs instead of one, defeating the point — skip this
# service's own domain prompt entirely in that case. CADDY_SERVICE_MODE
# is still "local" either way (Caddy reaches it over host.docker.internal
# regardless of which Caddy block does the reaching), so the firewall
# scoping below stays correct without changes.
local EXTRA_BLOCK=""
if [[ -d "$DOCKER_DIR/security-dashboard" ]]; then
log_info "Security Dashboard detected — it fronts the Asterisk web admin natively"
log_info "at https://<dashboard-domain>/asterisk-admin/ (no iframe, one URL for both)."
log_info "Re-run 'sudo ./setup.sh security-dashboard' (update mode) to reconfigure that."
CADDY_SERVICE_CONFIGURED=true
CADDY_SERVICE_MODE=local
else
if [ -d "$DOCKER_DIR/authelia" ]; then
local _use_auth=""
prompt_yn "Protect Asterisk web admin with Authelia SSO? (y/n):" "y" _use_auth
if [[ "$_use_auth" =~ ^[Yy]$ ]]; then
EXTRA_BLOCK=" import authelia"
# Disable built-in auth since Authelia handles it
sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env
fi
if [ -d "$DOCKER_DIR/authelia" ]; then
local _use_auth=""
prompt_yn "Protect Asterisk web admin with Authelia SSO? (y/n):" "y" _use_auth
if [[ "$_use_auth" =~ ^[Yy]$ ]]; then
EXTRA_BLOCK=" import authelia"
# Disable built-in auth since Authelia handles it
sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env
fi
configure_caddy_for_service "Asterisk Web Admin" "${WEB_ADMIN_PORT_VAL}" "asterisk" "$EXTRA_BLOCK"
fi
configure_caddy_for_service "Asterisk Web Admin" "${WEB_ADMIN_PORT_VAL}" "asterisk" "$EXTRA_BLOCK"
# ── UFW firewall rules ────────────────────────────────────────────────────
if command -v ufw &>/dev/null; then
services/security-dashboard.sh
+1220 -137
View File
File diff suppressed because it is too large Load Diff