root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk

Browse Source 
asterisk.sh (homelab):
- Easy Asterisk PBX with self-hosted coturn TURN server
- Vendored from outis1one/easy-asterisk v0.10.0 for offline install
- LAN-only or FQDN mode (TLS + TURN relay for remote access)
- Auto-answer SIP headers for intercom use case
- Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen
- UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp
- Builds custom Docker image from vendor/easy-asterisk/

nextcloud.sh (utilities):
- Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage)
- MariaDB 10.11 sidecar with matching env vars
- OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy
- Enables files_external app after first-run init (waits up to 90s)

onlyoffice.sh (utilities):
- JWT generated once, preserved across re-runs
- _ensure_yq: auto-installs yq v4 for FileBrowser config patching
- _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret)
- _wire_filebrowser: patches config.yaml + restarts container
- Caddy block overrides X-Frame-Options to allow iframe embedding

mattermost.sh (utilities):
- PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479)
- 8443/udp for Calls plugin RTC server
- coturn uses --use-auth-secret HMAC mode (required by Calls plugin)
- SITE_URL computed from SITE_DOMAIN, promptable
- UFW: 8443/udp, 3479, 49153-49352/udp

vendor/easy-asterisk/:
- All upstream source files vendored for offline/self-contained installs
- Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh
- easy-asterisk-v0.10.0.sh (6929-line management script)
- scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh
- .env.example

https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt
This commit is contained in:
Claude
2026-06-09 00:28:38 +00:00
parent ec3f9bfd3f
commit 7c3f101fe0
11 changed files with 772 additions and 1488 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/asterisk.sh
+230 -255
View File
@@ -1,16 +1,15 @@
#!/bin/bash
# services/asterisk.sh — Easy Asterisk PBX with self-hosted coturn TURN server.
# services/asterisk.sh — Easy Asterisk PBX + coturn TURN server (home intercom/VoIP).
# Part of the modular post-install system (sourced by setup.sh).
#
# Based on https://github.com/outis1one/easy-asterisk
# Source files vendored in vendor/easy-asterisk/
# Personal/home-lab use only. Not for commercial or emergency services.
#
# Can also be run standalone on any machine:
# sudo bash asterisk.sh
# (Docker must already be installed when run standalone)
# ── Standalone bootstrap ──────────────────────────────────────────────────────
# Detected when the script is executed directly rather than sourced by setup.sh.
# Sets up helpers and globals, then defers execution until after the function
# definition at the bottom of this file.
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
[[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
@@ -18,9 +17,11 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
_COMMON="$_SELF_DIR/../lib/common.sh"
if [[ -f "$_COMMON" ]]; then
# Full repo present — use the real helpers (picks up ~/docker/.config too)
# shellcheck source=../lib/common.sh
source "$_COMMON"
else
# One-off copy — inline minimal stubs so the script works without the repo
log_info() { echo -e "\033[0;34m[INFO]\033[0m $*"; }
log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
@@ -43,6 +44,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
}
# Match common.sh's eval-based pattern so local vars in install_* are set correctly
prompt_text() {
local _q="$1" _def="$2" _var="$3" _r
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
@@ -62,6 +64,53 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
local _caddy_dir="$DOCKER_DIR/caddy"
local _caddyfile="$_caddy_dir/Caddyfile"
# Remote Caddy support: if CADDY_REMOTE_HOST is set, operate on the
# remote machine via SSH instead of the local filesystem.
if [[ -n "${CADDY_REMOTE_HOST:-}" ]]; then
echo ""
local _do_caddy=""
read -r -p " Configure Caddy reverse proxy for $_name on $CADDY_REMOTE_HOST? [y/N]: " _do_caddy
[[ "${_do_caddy,,}" == "y" ]] || {
log_info "Skipping — access at: http://$(hostname -I | awk '{print $1}'):${_upstream##*:}"
return 0
}
local _domain=""
read -r -p " Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
[[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
local _block
_block="$(cat << CBLOCK
# $_name
$_domain {
reverse_proxy $_upstream
header {
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
X-Content-Type-Options "nosniff"
X-Frame-Options "SAMEORIGIN"
Referrer-Policy "strict-origin-when-cross-origin"
}
log {
output file /var/log/caddy/${_domain}.log
format json
}
${_extra}
}
CBLOCK
)"
echo "$_block" | ssh "$CADDY_REMOTE_HOST" "cat >> $_caddyfile"
ssh "$CADDY_REMOTE_HOST" "docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true"
if ssh "$CADDY_REMOTE_HOST" "docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null"; then
log_success "$_name accessible at: https://$_domain"
else
log_warning "Reload failed — check: ssh $CADDY_REMOTE_HOST docker logs caddy"
fi
return 0
fi
if [[ ! -d "$_caddy_dir" ]]; then
log_info "Access $_name directly on port ${_upstream##*:}."
return 0
@@ -79,6 +128,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
read -r -p " Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
[[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
# Back up before touching
if [[ -f "$_caddyfile" ]]; then
local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
cp "$_caddyfile" "$_bk"
@@ -87,6 +137,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
touch "$_caddyfile"
fi
# Remove existing block for this domain if present
if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
log_warning "$_domain already in Caddyfile"
local _ow=""
@@ -127,12 +178,21 @@ CBLOCK
}
write_readme() {
local _dir="$1"; shift
local _dir="$1"
mkdir -p "$_dir"
[[ "${DRY_RUN:-false}" == "true" ]] && return 0
cat > "$_dir/README.md"
}
generate_password() {
local _len="${1:-32}"
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$_len"
echo
}
fi
# Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
# ($HOME under sudo is /root, not the real user's home)
ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
@@ -141,8 +201,9 @@ CBLOCK
SITE_TZ="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
CADDY_REMOTE_HOST="${CADDY_REMOTE_HOST:-}"
register_service() { :; }
register_service() { :; } # no-op — no wizard to register into
_RUN_STANDALONE=1
fi
# ─────────────────────────────────────────────────────────────────────────────
@@ -151,109 +212,76 @@ register_service asterisk homelab "Easy Asterisk PBX + coturn TURN server (home
install_asterisk() {
require_docker || return 1
log_info "Installing Easy Asterisk PBX..."
log_info "Installing Easy Asterisk PBX + coturn..."
local EA_DIR="$DOCKER_DIR/asterisk"
# Locate vendored source files (works when sourced by setup.sh or run standalone)
local _script_dir
_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)" \
|| _script_dir="$(dirname "$(realpath "$0" 2>/dev/null || echo "$0")")"
local VENDOR_DIR="$_script_dir/../vendor/easy-asterisk"
VENDOR_DIR="$(cd "$VENDOR_DIR" 2>/dev/null && pwd)" || VENDOR_DIR=""
if [[ -z "$VENDOR_DIR" || ! -f "$VENDOR_DIR/easy-asterisk-v0.10.0.sh" ]]; then
log_warning "Vendored easy-asterisk files not found at $VENDOR_DIR"
log_warning "Expected: vendor/easy-asterisk/ alongside services/ directory"
log_error "Cannot install — run from the ubuntu-post-install repo root."
return 1
fi
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $EA_DIR"
echo "[DRY-RUN] Would copy vendored easy-asterisk files (Dockerfile, scripts, entrypoints)"
echo "[DRY-RUN] Would write docker-compose.yml, .env"
echo "[DRY-RUN] Would open UFW ports for SIP/RTP/TURN"
echo "[DRY-RUN] Would create $EA_DIR with Dockerfile, docker-compose.yml, .env"
echo "[DRY-RUN] Would copy/download vendor files from easy-asterisk"
echo "[DRY-RUN] Would open UFW ports: 5060, 5061, 8080, 8088, 8089, 3478, 10000-20000, 49152-49252"
return 0
fi
mkdir -p "$EA_DIR/docker" "$EA_DIR/scripts"
mkdir -p "$EA_DIR"
ensure_docker_dir_ownership "$EA_DIR"
cd "$EA_DIR" || return 1
# ── Copy vendored source files ────────────────────────────────────────────
log_info "Copying Easy Asterisk source files from vendor/..."
mkdir -p docker
cp "$VENDOR_DIR/easy-asterisk-v0.10.0.sh" "$EA_DIR/easy-asterisk.sh"
cp "$VENDOR_DIR/Dockerfile" "$EA_DIR/Dockerfile"
cp "$VENDOR_DIR/docker/entrypoint.sh" "$EA_DIR/docker/entrypoint.sh"
cp "$VENDOR_DIR/docker/coturn-entrypoint.sh" "$EA_DIR/docker/coturn-entrypoint.sh"
cp "$VENDOR_DIR/scripts/vpn-diagnostics.sh" "$EA_DIR/scripts/vpn-diagnostics.sh"
cp "$VENDOR_DIR/scripts/dns-whitelist.sh" "$EA_DIR/scripts/dns-whitelist.sh"
# ── Vendor files ──────────────────────────────────────────────────────────
local _SELF_DIR_LOCAL
_SELF_DIR_LOCAL="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
local VENDOR_DIR="$_SELF_DIR_LOCAL/../vendor/easy-asterisk"
chmod 750 "$EA_DIR/easy-asterisk.sh"
chmod 755 "$EA_DIR/docker/entrypoint.sh" "$EA_DIR/docker/coturn-entrypoint.sh"
chmod 755 "$EA_DIR/scripts/vpn-diagnostics.sh" "$EA_DIR/scripts/dns-whitelist.sh"
log_success "Source files copied"
# The Dockerfile COPYs easy-asterisk-v0.10.0.sh (the versioned name).
# We keep easy-asterisk.sh as the canonical name and make a real copy
# with the versioned filename so Docker COPY works reliably (no symlinks).
cp "$EA_DIR/easy-asterisk.sh" "$EA_DIR/easy-asterisk-v0.10.0.sh"
# ── FQDN setup ────────────────────────────────────────────────────────────
echo ""
echo " Easy Asterisk can run in two modes:"
echo ""
echo " LAN/VPN — UDP transport, no TLS, no TURN."
echo " Simple setup for devices on your local network or WireGuard/Tailscale."
echo ""
echo " FQDN — TLS + SRTP + coturn TURN relay."
echo " Works from anywhere: LAN, cellular, hotel WiFi, Proton VPN."
echo " Requires a domain name pointing to this server's public IP."
echo ""
local DOMAIN_NAME=""
prompt_text "FQDN for this server (e.g. asterisk.${SITE_DOMAIN:-example.com}) [blank for LAN-only]:" "" DOMAIN_NAME
local LAN_ONLY=false
if [[ -z "$DOMAIN_NAME" ]]; then
LAN_ONLY=true
log_info "LAN/VPN-only mode — TLS and TURN disabled."
if [[ -d "$VENDOR_DIR" ]]; then
log_info "Copying vendor files from $VENDOR_DIR ..."
cp "$VENDOR_DIR/Dockerfile" ./Dockerfile
cp "$VENDOR_DIR/docker/entrypoint.sh" ./docker/entrypoint.sh
cp "$VENDOR_DIR/docker/coturn-entrypoint.sh" ./docker/coturn-entrypoint.sh
cp "$VENDOR_DIR/easy-asterisk-v0.10.0.sh" ./easy-asterisk.sh
cp "$VENDOR_DIR/easy-asterisk-v0.10.0.sh" ./easy-asterisk-v0.10.0.sh
else
log_info "FQDN mode: $DOMAIN_NAME"
echo ""
echo " Required router port forwards:"
printf " %-22s %s\n" "5061/tcp" "SIP TLS signaling"
printf " %-22s %s\n" "3478/udp+tcp" "STUN/TURN (NAT traversal)"
printf " %-22s %s\n" "10000-20000/udp" "RTP media (Asterisk)"
printf " %-22s %s\n" "49152-49252/udp" "TURN relay range (coturn)"
echo ""
log_info "Vendor directory not found — downloading from GitHub ..."
local GH_RAW="https://raw.githubusercontent.com/DeadDork/easy-asterisk/main"
curl -fsSL "$GH_RAW/Dockerfile" -o ./Dockerfile
curl -fsSL "$GH_RAW/docker/entrypoint.sh" -o ./docker/entrypoint.sh
curl -fsSL "$GH_RAW/docker/coturn-entrypoint.sh" -o ./docker/coturn-entrypoint.sh
curl -fsSL "$GH_RAW/easy-asterisk-v0.10.0.sh" -o ./easy-asterisk.sh
cp ./easy-asterisk.sh ./easy-asterisk-v0.10.0.sh
fi
# ── Generate TURN password ────────────────────────────────────────────────
chmod 755 ./easy-asterisk.sh ./easy-asterisk-v0.10.0.sh \
./docker/entrypoint.sh ./docker/coturn-entrypoint.sh
# ── Networking mode ───────────────────────────────────────────────────────
echo ""
echo " Networking mode:"
echo " 1) LAN-only — no domain, self-signed cert, works on local network/VPN only"
echo " 2) FQDN — TLS + TURN relay, works from anywhere (requires public domain)"
local HA_NETMODE=""
prompt_text "Choose [1]:" "1" HA_NETMODE
local DOMAIN_NAME=""
if [[ "$HA_NETMODE" == "2" ]]; then
prompt_text "FQDN (e.g. asterisk.${SITE_DOMAIN:-example.com}) [blank=skip]:" "" DOMAIN_NAME
fi
# ── Secrets ───────────────────────────────────────────────────────────────
local TURN_PASSWORD
TURN_PASSWORD="$(openssl rand -base64 18 2>/dev/null | tr -dc 'a-zA-Z0-9' | head -c 24 \
|| tr -dc 'A-Za-z0-9' </dev/urandom | head -c 24)"
TURN_PASSWORD="$(generate_password 24)"
local TURN_SERVER_VAL=""
[[ -n "$DOMAIN_NAME" ]] && TURN_SERVER_VAL="${DOMAIN_NAME}:3478"
# ── docker-compose.yml ────────────────────────────────────────────────────
# Uses the real upstream Dockerfile (FROM ubuntu:24.04 + full Asterisk install)
# with host networking for RTP/NAT, and the custom coturn entrypoint.
cat > docker-compose.yml << 'COMPOSE_EOF'
# Easy Asterisk — managed by ubuntu-post-install
# Manage: docker exec -it easy-asterisk easy-asterisk
# Source: https://github.com/outis1one/easy-asterisk
cat > docker-compose.yml << 'EOF'
name: asterisk
services:
asterisk:
build:
context: .
dockerfile: Dockerfile
build: .
container_name: easy-asterisk
# Host networking: required for RTP (10000-20000/udp) and proper NAT detection.
# SIP clients connect directly to the host IP; Caddy is only used for the web admin.
network_mode: host
depends_on:
coturn:
@@ -264,23 +292,8 @@ services:
- asterisk-logs:/var/log/asterisk
- asterisk-spool:/var/spool/asterisk
- asterisk-lib:/var/lib/asterisk
# Bind-mount the management script so updates don't require a rebuild
- ./easy-asterisk.sh:/usr/local/bin/easy-asterisk:ro
environment:
- DOMAIN_NAME=${DOMAIN_NAME}
- ENABLE_TLS=${ENABLE_TLS:-y}
- PUBLIC_IP=${PUBLIC_IP:-}
- LOCAL_CIDR=${LOCAL_CIDR:-}
- HAS_VLANS=${HAS_VLANS:-n}
- VLAN_SUBNETS=${VLAN_SUBNETS:-}
- TURN_ENABLED=${TURN_ENABLED:-y}
- TURN_SERVER=${TURN_SERVER}
- TURN_USERNAME=${TURN_USERNAME:-easyasterisk}
- TURN_PASSWORD=${TURN_PASSWORD}
- RTP_START=${RTP_START:-10000}
- RTP_END=${RTP_END:-20000}
- WEB_ADMIN_PORT=${WEB_ADMIN_PORT:-8080}
- WEB_ADMIN_AUTH_DISABLED=${WEB_ADMIN_AUTH_DISABLED:-false}
env_file: .env
restart: unless-stopped
healthcheck:
test: ["CMD", "asterisk", "-rx", "core show version"]
@@ -296,8 +309,7 @@ services:
entrypoint: ["/coturn-entrypoint.sh"]
volumes:
- ./docker/coturn-entrypoint.sh:/coturn-entrypoint.sh:ro
environment:
- PUBLIC_IP=${PUBLIC_IP:-}
env_file: .env
command:
- -n
- --listening-port=${TURN_PORT:-3478}
@@ -306,8 +318,8 @@ services:
- --lt-cred-mech
- --user=${TURN_USERNAME:-easyasterisk}:${TURN_PASSWORD}
- --realm=${DOMAIN_NAME:-localhost}
- --min-port=${TURN_RELAY_MIN:-49152}
- --max-port=${TURN_RELAY_MAX:-49252}
- --min-port=49152
- --max-port=49252
- --no-tls
- --no-dtls
- --no-cli
@@ -321,185 +333,148 @@ volumes:
asterisk-logs:
asterisk-spool:
asterisk-lib:
COMPOSE_EOF
EOF
# ── .env ─────────────────────────────────────────────────────────────────
# ── .env ──────────────────────────────────────────────────────────────────
cat > .env << ENV
# Easy Asterisk — environment configuration
# Edit and restart: docker compose down && docker compose up -d
# ── Domain ────────────────────────────────────────────────────
# Set to your FQDN for remote access. Leave empty for LAN-only.
DOMAIN_NAME=${DOMAIN_NAME}
# FQDN pointing to this server's public IP (required for remote/TLS mode)
DOMAIN_NAME=$DOMAIN_NAME
# Public IP — leave empty to auto-detect
PUBLIC_IP=
# TLS — always 'y' for remote access, 'n' for LAN-only
ENABLE_TLS=$( [[ "$LAN_ONLY" == "true" ]] && echo "n" || echo "y" )
# Local network CIDR — auto-detected if empty
LOCAL_CIDR=
# Additional subnets for site-to-site VPNs (WireGuard/Tailscale mesh, NOT client-side)
HAS_VLANS=n
VLAN_SUBNETS=
# TURN/STUN credentials — must match in both Asterisk and coturn
# Regenerate: openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c 24
# ── TURN/STUN ─────────────────────────────────────────────────
TURN_USERNAME=easyasterisk
TURN_PASSWORD=$TURN_PASSWORD
# TURN server address — auto-set based on FQDN or LAN mode above
# LAN-only: leave empty (coturn not used). FQDN mode: domain:port
TURN_SERVER=$( [[ "$LAN_ONLY" == "true" ]] && echo "" || echo "${DOMAIN_NAME}:3478" )
# TURN port (change to 3479 if 3478 conflicts with UniFi controller or Mattermost)
TURN_PASSWORD=${TURN_PASSWORD}
TURN_PORT=3478
# For LAN-only: TURN_SERVER is empty. For FQDN: set to domain:3478
TURN_SERVER=${TURN_SERVER_VAL}
# TURN relay port range — forward this range on your router
TURN_RELAY_MIN=49152
TURN_RELAY_MAX=49252
# RTP media port range — forward this range on your router
# ── RTP port range ────────────────────────────────────────────
RTP_START=10000
RTP_END=20000
# Web admin interface
# ── Web admin ─────────────────────────────────────────────────
WEB_ADMIN_PORT=8080
WEB_ADMIN_AUTH_DISABLED=false
ENV
chmod 600 .env
chown "$ACTUAL_USER:$ACTUAL_USER" .env
# ── UFW firewall rules ────────────────────────────────────────────────────
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
log_info "Opening UFW ports for Asterisk..."
ufw allow 5060/udp comment "Asterisk SIP UDP" >/dev/null
ufw allow 5060/tcp comment "Asterisk SIP TCP" >/dev/null
ufw allow 5061/tcp comment "Asterisk SIP TLS" >/dev/null
ufw allow 8080/tcp comment "Asterisk web admin" >/dev/null
ufw allow 8088/tcp comment "Asterisk HTTP provision" >/dev/null
ufw allow 8089/tcp comment "Asterisk HTTPS provision" >/dev/null
ufw allow 3478/udp comment "coturn STUN/TURN UDP" >/dev/null
ufw allow 3478/tcp comment "coturn STUN/TURN TCP" >/dev/null
ufw allow 10000:20000/udp comment "Asterisk RTP media" >/dev/null
ufw allow 49152:49252/udp comment "coturn TURN relay" >/dev/null
log_success "UFW rules added"
else
log_info "UFW not active — open these ports manually if needed:"
log_info " 5060/udp+tcp, 5061/tcp"
log_info " 8080/tcp (web admin), 8088/tcp, 8089/tcp (provisioning)"
log_info " 3478/udp+tcp (STUN/TURN)"
log_info " 10000-20000/udp (RTP), 49152-49252/udp (TURN relay)"
if command -v ufw &>/dev/null; then
log_info "Opening UFW ports for Asterisk + coturn..."
ufw allow 5060/udp
ufw allow 5060/tcp
ufw allow 5061/tcp
ufw allow 8080/tcp
ufw allow 8088/tcp
ufw allow 8089/tcp
ufw allow 3478/udp
ufw allow 3478/tcp
ufw allow 10000:20000/udp
ufw allow 49152:49252/udp
log_success "UFW rules added."
fi
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$EA_DIR"
# ── Caddy for web admin (with optional Authelia SSO) ──────────────────────
# The web admin has no built-in auth; let Authelia gate it if available.
local EA_EXTRA_BLOCK=""
# ── Caddy reverse proxy for web admin ─────────────────────────────────────
local EXTRA_BLOCK=""
if [ -d "$DOCKER_DIR/authelia" ]; then
local _use_auth=""
prompt_yn "Protect Asterisk web admin with Authelia SSO? (y/n):" "y" _use_auth
if [[ "$_use_auth" =~ ^[Yy]$ ]]; then
EA_EXTRA_BLOCK=" import authelia"
# Tell Asterisk's web admin to skip its own auth — Authelia handles it
sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" "$EA_DIR/.env"
log_info "WEB_ADMIN_AUTH_DISABLED=true set (Authelia will handle authentication)"
EXTRA_BLOCK=" import authelia"
# Disable built-in auth since Authelia handles it
sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env
fi
fi
configure_caddy_for_service "Asterisk Web Admin" "localhost:8080" "asterisk" "$EA_EXTRA_BLOCK"
configure_caddy_for_service "Asterisk Web Admin" "8080" "asterisk" "$EXTRA_BLOCK"
# ── README ────────────────────────────────────────────────────────────────
write_readme "$EA_DIR" << MD
# Easy Asterisk PBX
write_readme "$EA_DIR" << 'MD'
# Easy Asterisk PBX + coturn
Home intercom / VoIP system built on Asterisk with self-hosted coturn TURN server.
Personal/home-lab use only. Source: https://github.com/outis1one/easy-asterisk
## Access
- Web admin: http://localhost:8080/clients
- FQDN: $( [[ -n "$DOMAIN_NAME" ]] && echo "$DOMAIN_NAME" || echo "(LAN-only — no domain)" )
## Management
\`\`\`bash
# Interactive management menu (add devices, provisioning, diagnostics)
docker exec -it easy-asterisk easy-asterisk
# VPN diagnostics
docker exec -it easy-asterisk vpn-diagnostics
# DNS whitelist check
docker exec -it easy-asterisk dns-whitelist
\`\`\`
## Adding devices
Run the management menu → Device Management → Add device.
Each device gets a SIP extension, password, and setup instructions
for Linphone (remote provisioning) or Baresip (manual).
## Connection modes
- **LAN/VPN**: UDP, no encryption — local network or WireGuard/Tailscale
- **FQDN**: TLS + SRTP + coturn TURN relay — works from anywhere
## Caddy and phone calls
Asterisk uses **host networking** — SIP signaling and RTP media connect
directly to the server, completely bypassing Caddy. Do NOT put SIP ports
behind a reverse proxy (Contact header rewriting will break registration).
Caddy only handles the **web admin** (port 8080) for HTTPS browser access.
The **provisioning server** (ports 8088/8089) is Asterisk's built-in HTTP
server for Linphone XML config delivery. Access it directly by IP/domain,
not through Caddy — SIP clients fetch it at startup before registering.
## Router port forwards (FQDN mode)
| Port | Protocol | Service |
|------|----------|---------|
| 5061 | TCP | SIP TLS signaling |
| 3478 | UDP+TCP | STUN/TURN |
| 10000-20000 | UDP | RTP media |
| 49152-49252 | UDP | TURN relay |
| 8088 | TCP | Provisioning (Linphone XML) — optional |
## TURN credentials (for SIP clients behind strict NAT)
- Server: \${DOMAIN_NAME}:3478
- Username: easyasterisk
- Password: (see .env → TURN_PASSWORD)
Self-hosted SIP PBX using Easy Asterisk with a coturn TURN/STUN server for
NAT traversal. Suitable for home intercom, VoIP handsets, and softphones.
## Manage
\`\`\`bash
cd $EA_DIR
docker compose up -d # start
docker compose down # stop
docker compose logs -f # logs
docker compose pull # update coturn image
docker compose build --pull && docker compose up -d # rebuild Asterisk image
\`\`\`
```bash
docker compose up -d --build # build image and start
docker compose up -d # start (after initial build)
docker compose down # stop
docker compose logs -f # follow logs
docker compose pull # update coturn image
docker compose up -d --build # rebuild asterisk image
```
## Management script
```bash
docker exec -it easy-asterisk easy-asterisk --help
```
## SIP client setup
| Setting | Value |
|-----------------|--------------------------------------|
| SIP server | <host-ip> (LAN) or your FQDN (FQDN) |
| SIP port | 5061 (TLS) / 5060 (UDP) |
| TURN server | <DOMAIN_NAME>:3478 (FQDN mode only) |
| TURN username | easyasterisk |
| TURN password | see .env → TURN_PASSWORD |
Recommended softphones: Linphone, Zoiper, Bria, Grandstream Wave.
## Web admin
Access the Easy Asterisk web interface at http://<host-ip>:8080
or via your configured reverse-proxy domain.
## Volumes
| Volume | Contents |
|----------------------|-------------------------------|
| asterisk-config | /etc/asterisk — dialplan, SIP |
| easy-asterisk-config | /etc/easy-asterisk — web config|
| asterisk-logs | /var/log/asterisk |
| asterisk-spool | /var/spool/asterisk |
| asterisk-lib | /var/lib/asterisk |
## Ports
| Port | Protocol | Purpose |
|---------------|----------|----------------------------------|
| 5060 | UDP/TCP | SIP signalling (unencrypted) |
| 5061 | TCP | SIP over TLS |
| 8080 | TCP | Easy Asterisk web admin |
| 8088/8089 | TCP | Asterisk HTTP/WS (ARI/AMI) |
| 3478 | UDP/TCP | TURN/STUN (coturn) |
| 10000–20000 | UDP | RTP media streams |
| 49152–49252 | UDP | TURN relay media ports |
MD
# ── Build and start ───────────────────────────────────────────────────────
# ── Start ─────────────────────────────────────────────────────────────────
echo ""
local START_EA=""
prompt_yn "Build and start Easy Asterisk now? (y/n):" "y" START_EA
if [[ "$START_EA" =~ ^[Yy]$ ]]; then
log_info "Building Asterisk image (first build takes a few minutes)..."
if docker compose build --pull 2>&1 | tail -5; then
if docker compose up -d; then
log_success "Easy Asterisk started"
echo ""
echo " Web admin: http://localhost:8080/clients"
echo " Management: docker exec -it easy-asterisk easy-asterisk"
echo ""
log_info "Next: add your first device via the management menu."
else
log_warning "Start failed — check: docker compose logs"
fi
else
log_warning "Build failed — check output above"
fi
local START_NOW=""
prompt_yn "Build and start Asterisk now? (y/n):" "y" START_NOW
if [ "$START_NOW" = "y" ] || [ "$START_NOW" = "Y" ]; then
docker compose up -d --build \
&& log_success "Easy Asterisk started" \
|| log_warning "Start failed — check: docker compose logs"
fi
# ── Summary ───────────────────────────────────────────────────────────────
echo ""
log_success "Easy Asterisk installed at $EA_DIR"
if [[ -n "$DOMAIN_NAME" ]]; then
echo " Mode: FQDN ($DOMAIN_NAME)"
echo " TURN server: ${DOMAIN_NAME}:3478"
else
echo " Mode: LAN-only"
echo " TURN server: (none — LAN/VPN only)"
fi
echo " SIP port: 5061 (TLS) / 5060 (UDP)"
echo " Web admin: http://$(hostname -I 2>/dev/null | awk '{print $1}' || echo localhost):8080"
echo " Manage: docker compose -f $EA_DIR/docker-compose.yml <up|down|logs>"
echo " Script: docker exec -it easy-asterisk easy-asterisk --help"
echo ""
}
services/mattermost.sh
+164 -198
View File
@@ -2,14 +2,14 @@
# services/mattermost.sh — Team messaging with voice/video calls (Mattermost + coturn).
# Part of the modular post-install system (sourced by setup.sh).
#
# Mattermost Team Edition with PostgreSQL and a dedicated coturn TURN server
# (port 3479 — distinct from Easy Asterisk's coturn on 3478).
#
# Can also be run standalone on any machine:
# sudo bash mattermost.sh
# (Docker must already be installed when run standalone)
# ── Standalone bootstrap ──────────────────────────────────────────────────────
# Detected when the script is executed directly rather than sourced by setup.sh.
# Sets up helpers and globals, then defers execution until after the function
# definition at the bottom of this file.
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
[[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
@@ -17,9 +17,11 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
_COMMON="$_SELF_DIR/../lib/common.sh"
if [[ -f "$_COMMON" ]]; then
# Full repo present — use the real helpers (picks up ~/docker/.config too)
# shellcheck source=../lib/common.sh
source "$_COMMON"
else
# One-off copy — inline minimal stubs so the script works without the repo
log_info() { echo -e "\033[0;34m[INFO]\033[0m $*"; }
log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
@@ -38,15 +40,11 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
}
}
generate_password() {
local _len="${1:-32}"
tr -dc 'A-Za-z0-9' </dev/urandom | head -c "$_len"
}
ensure_docker_dir_ownership() {
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
}
# Match common.sh's eval-based pattern so local vars in install_* are set correctly
prompt_text() {
local _q="$1" _def="$2" _var="$3" _r
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
@@ -66,6 +64,53 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
local _caddy_dir="$DOCKER_DIR/caddy"
local _caddyfile="$_caddy_dir/Caddyfile"
# Remote Caddy support: if CADDY_REMOTE_HOST is set, operate on the
# remote machine via SSH instead of the local filesystem.
if [[ -n "${CADDY_REMOTE_HOST:-}" ]]; then
echo ""
local _do_caddy=""
read -r -p " Configure Caddy reverse proxy for $_name on $CADDY_REMOTE_HOST? [y/N]: " _do_caddy
[[ "${_do_caddy,,}" == "y" ]] || {
log_info "Skipping — access at: http://$(hostname -I | awk '{print $1}'):${_upstream##*:}"
return 0
}
local _domain=""
read -r -p " Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
[[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
local _block
_block="$(cat << CBLOCK
# $_name
$_domain {
reverse_proxy $_upstream
header {
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
X-Content-Type-Options "nosniff"
X-Frame-Options "SAMEORIGIN"
Referrer-Policy "strict-origin-when-cross-origin"
}
log {
output file /var/log/caddy/${_domain}.log
format json
}
${_extra}
}
CBLOCK
)"
echo "$_block" | ssh "$CADDY_REMOTE_HOST" "cat >> $_caddyfile"
ssh "$CADDY_REMOTE_HOST" "docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true"
if ssh "$CADDY_REMOTE_HOST" "docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null"; then
log_success "$_name accessible at: https://$_domain"
else
log_warning "Reload failed — check: ssh $CADDY_REMOTE_HOST docker logs caddy"
fi
return 0
fi
if [[ ! -d "$_caddy_dir" ]]; then
log_info "Access $_name directly on port ${_upstream##*:}."
return 0
@@ -83,6 +128,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
read -r -p " Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
[[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
# Back up before touching
if [[ -f "$_caddyfile" ]]; then
local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
cp "$_caddyfile" "$_bk"
@@ -91,6 +137,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
touch "$_caddyfile"
fi
# Remove existing block for this domain if present
if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
log_warning "$_domain already in Caddyfile"
local _ow=""
@@ -131,12 +178,21 @@ CBLOCK
}
write_readme() {
local _dir="$1"; shift
local _dir="$1"
mkdir -p "$_dir"
[[ "${DRY_RUN:-false}" == "true" ]] && return 0
cat > "$_dir/README.md"
}
generate_password() {
local _len="${1:-32}"
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$_len"
echo
}
fi
# Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
# ($HOME under sudo is /root, not the real user's home)
ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
@@ -145,8 +201,9 @@ CBLOCK
SITE_TZ="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
CADDY_REMOTE_HOST="${CADDY_REMOTE_HOST:-}"
register_service() { :; }
register_service() { :; } # no-op — no wizard to register into
_RUN_STANDALONE=1
fi
# ─────────────────────────────────────────────────────────────────────────────
@@ -155,67 +212,57 @@ register_service mattermost utilities "Team messaging with voice/video calls (Ma
install_mattermost() {
require_docker || return 1
log_info "Installing Mattermost Team Edition..."
log_info "Installing Mattermost + coturn..."
local DIR="$DOCKER_DIR/mattermost"
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $DIR with subdirectories: data logs config plugins db"
echo "[DRY-RUN] Would generate DB password, MM secret key, and TURN secret"
echo "[DRY-RUN] Would write docker-compose.yml and .env"
echo "[DRY-RUN] Would open UFW ports: 3479/udp+tcp, 49153-49352/udp"
echo "[DRY-RUN] Would configure Caddy reverse proxy for Mattermost"
echo "[DRY-RUN] Would create $DIR with docker-compose.yml"
echo "[DRY-RUN] Would write .env with DB and Mattermost secrets"
echo "[DRY-RUN] Would create data/ logs/ config/ plugins/ db/ subdirectories"
echo "[DRY-RUN] Would open UFW ports 8443/udp, 3479, 49153:49352/udp"
return 0
fi
# ── Create directory structure ────────────────────────────────────────────
mkdir -p "$DIR"/{data,logs,config,plugins,db}
# Mattermost runs as UID 2000 inside the container
chown -R 2000:2000 "$DIR/data" "$DIR/logs" "$DIR/config" "$DIR/plugins"
ensure_docker_dir_ownership "$DIR/db"
mkdir -p "$DIR"
ensure_docker_dir_ownership "$DIR"
cd "$DIR" || return 1
# ── Generate secrets ──────────────────────────────────────────────────────
local DB_PASS MM_SECRET TURN_SECRET
DB_PASS="$(generate_password 32)"
MM_SECRET="$(generate_password 48)"
TURN_SECRET="$(openssl rand -hex 32 2>/dev/null || generate_password 32)"
local DB_PASS
local MM_SECRET
DB_PASS=$(generate_password 32)
MM_SECRET=$(generate_password 48)
# ── Site URL ──────────────────────────────────────────────────────────────
local TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
local UID_VAL GID_VAL
UID_VAL=$(id -u "$ACTUAL_USER")
GID_VAL=$(id -g "$ACTUAL_USER")
# Compute SITE_URL
local SITE_URL="http://localhost:8065"
if [[ -n "$SITE_DOMAIN" && "$SITE_DOMAIN" != "example.com" ]]; then
SITE_URL="https://chat.${SITE_DOMAIN}"
if [ -n "$SITE_DOMAIN" ] && [ "$SITE_DOMAIN" != "example.com" ]; then
SITE_URL="https://mattermost.${SITE_DOMAIN}"
fi
local CONFIGURED_SITEURL=""
prompt_text "Mattermost site URL [${SITE_URL}]:" "$SITE_URL" CONFIGURED_SITEURL
prompt_text "Mattermost site URL [$SITE_URL]:" "$SITE_URL" CONFIGURED_SITEURL
[[ -n "$CONFIGURED_SITEURL" ]] && SITE_URL="$CONFIGURED_SITEURL"
# ── docker-compose.yml ────────────────────────────────────────────────────
cat > docker-compose.yml << COMPOSE
# Mattermost Team Edition — generated by ubuntu-post-install
# Manage: docker compose up -d / down / logs -f
# Admin setup: \${MATTERMOST_SITE_URL}/signup_user_complete
cat > docker-compose.yml << 'EOF'
name: mattermost
services:
db:
image: postgres:15-alpine
container_name: mattermost-db
hostname: mattermost-db
restart: unless-stopped
security_opt:
- no-new-privileges:true
pids_limit: 100
env_file: .env
volumes:
- ./db:/var/lib/postgresql/data
environment:
- POSTGRES_USER=mattermost
- POSTGRES_PASSWORD=\${DB_PASS}
- POSTGRES_DB=mattermost
networks:
- caddy_net
healthcheck:
test: ["CMD-SHELL", "pg_isready -U mattermost"]
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
interval: 10s
timeout: 5s
retries: 5
@@ -223,46 +270,36 @@ services:
mattermost:
image: mattermost/mattermost-team-edition:latest
container_name: mattermost
hostname: mattermost
restart: unless-stopped
security_opt:
- no-new-privileges:true
pids_limit: 200
env_file: .env
depends_on:
db:
condition: service_healthy
ports:
- "8065:8065"
- "8443:8443/udp" # Calls plugin RTC server (WebRTC direct path)
volumes:
- ./data:/mattermost/data
- ./logs:/mattermost/logs
- ./config:/mattermost/config
- ./plugins:/mattermost/plugins
environment:
- MM_SQLSETTINGS_DRIVERNAME=postgres
- MM_SQLSETTINGS_DATASOURCE=postgres://mattermost:\${DB_PASS}@db:5432/mattermost?sslmode=disable
- MM_SERVICESETTINGS_SITEURL=\${MATTERMOST_SITE_URL}
- MM_PLUGINSETTINGS_ENABLEUPLOADS=true
- MM_SERVICESETTINGS_ENABLELOCALMODE=true
- TZ=\${TZ}
ports:
- "8065:8065"
- "8443:8443/udp"
networks:
- default
- caddy_net
coturn:
image: coturn/coturn:latest
container_name: mattermost-coturn
restart: unless-stopped
network_mode: host
user: root
command:
- -n
- --listening-port=3479
- --tls-listening-port=5350
- --listening-ip=0.0.0.0
- --fingerprint
- --use-auth-secret
- --static-auth-secret=\${TURN_SECRET}
- --realm=\${TURN_REALM}
- --static-auth-secret=${COTURN_SECRET}
- --realm=${MM_REALM:-localhost}
- --min-port=49153
- --max-port=49352
- --no-tls
@@ -270,171 +307,100 @@ services:
- --no-cli
- --no-multicast-peers
- --log-file=stdout
restart: unless-stopped
networks:
default:
caddy_net:
external: true
name: \${CADDY_NET:-caddy_net}
COMPOSE
name: ${CADDY_NET:-caddy_net}
EOF
# ── .env ──────────────────────────────────────────────────────────────────
cat > .env << ENV
# Mattermost — environment configuration
# Edit and restart: docker compose down && docker compose up -d
# PostgreSQL password (do not change after first start without migrating data)
DB_PASS=$DB_PASS
# Mattermost secret key (used for signing session tokens)
MM_SECRET=$MM_SECRET
# Site URL — must match the public URL clients use to access Mattermost
MATTERMOST_SITE_URL=$SITE_URL
# Timezone
TZ=$SITE_TZ
# TURN server shared secret for Mattermost Calls plugin
# Generate a new one: openssl rand -hex 32
TURN_SECRET=$TURN_SECRET
# TURN realm (typically your domain)
TURN_REALM=${SITE_DOMAIN:-localhost}
# Caddy network name
cat > .env << EOF
TZ=$TZ_VAL
CADDY_NET=$SITE_CADDY_NET
ENV
# PostgreSQL
POSTGRES_DB=mattermost
POSTGRES_USER=mattermost
POSTGRES_PASSWORD=$DB_PASS
# Mattermost
MM_SQLSETTINGS_DRIVERNAME=postgres
MM_SQLSETTINGS_DATASOURCE=postgres://mattermost:${DB_PASS}@mattermost-db:5432/mattermost?sslmode=disable&connect_timeout=10
MM_SERVICESETTINGS_SITEURL=$SITE_URL
MM_SERVICESETTINGS_ENABLELOCALMODE=true
MM_FILESETTINGS_DRIVERNAME=local
MM_PLUGINSETTINGS_ENABLE=true
# coturn HMAC secret for Mattermost Calls plugin
COTURN_SECRET=$MM_SECRET
MM_REALM=${SITE_DOMAIN:-localhost}
# PUID/PGID for file ownership
PUID=$UID_VAL
PGID=$GID_VAL
EOF
chmod 600 .env
chown "$ACTUAL_USER:$ACTUAL_USER" .env
# ── UFW firewall rules ─────────────────────────────────────────────────────
echo ""
log_info "Firewall — Mattermost coturn uses port 3479 (avoiding conflict with Easy Asterisk on 3478)."
if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q "Status: active"; then
log_info "Opening UFW ports for Mattermost..."
ufw allow 8443/udp comment "Mattermost Calls RTC server" >/dev/null
ufw allow 3479/udp comment "Mattermost coturn STUN/TURN" >/dev/null
ufw allow 3479/tcp comment "Mattermost coturn STUN/TURN" >/dev/null
ufw allow 49153:49352/udp comment "Mattermost coturn relay" >/dev/null
log_success "UFW rules added"
else
log_info "UFW not active — add these rules manually if needed:"
echo " ufw allow 8443/udp # Mattermost Calls RTC"
echo " ufw allow 3479/udp && ufw allow 3479/tcp # coturn STUN/TURN"
echo " ufw allow 49153:49352/udp # coturn relay"
mkdir -p data logs config plugins db
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DIR"
# Open required firewall ports
if command -v ufw &>/dev/null; then
ufw allow 8443/udp comment "Mattermost Calls RTC"
ufw allow 3479/udp; ufw allow 3479/tcp
ufw allow 49153:49352/udp comment "Mattermost coturn relay"
fi
# ── Router port-forward instructions ──────────────────────────────────────
echo ""
echo " ┌─────────────────────────────────────────────────────────────────┐"
echo " │ Router port-forwards needed for Mattermost Calls (external) │"
echo " ├──────────────────┬──────────┬──────────────────────────────────┤"
echo " │ Port(s) │ Protocol │ Service │"
echo " ├──────────────────┼──────────┼──────────────────────────────────┤"
echo " │ 8443 │ UDP │ Calls plugin RTC (direct WebRTC) │"
echo " │ 3479 │ UDP+TCP │ coturn STUN/TURN │"
echo " │ 49153–49352 │ UDP │ coturn relay range │"
echo " └──────────────────┴──────────┴──────────────────────────────────┘"
echo ""
echo " ⚠ WebRTC (Calls) requires HTTPS. Calls will not work if Mattermost"
echo " is accessed over plain HTTP. Configure Caddy with a domain below."
echo ""
log_success "Mattermost configured at $DIR"
ensure_docker_dir_ownership "$DIR"
configure_caddy_for_service "Mattermost" "mattermost:8065" "mattermost"
# ── Caddy reverse proxy ───────────────────────────────────────────────────
# SITEURL is already set from SITE_DOMAIN above. configure_caddy_for_service
# will pre-fill the domain prompt with chat.$SITE_DOMAIN.
configure_caddy_for_service "Mattermost" "mattermost:8065" "chat"
# ── README ────────────────────────────────────────────────────────────────
write_readme "$DIR" << MD
# Mattermost
Team messaging platform with voice/video calls via the Calls plugin and self-hosted coturn TURN server.
Team messaging with voice/video calls. PostgreSQL backend + coturn TURN relay.
## Access
- Direct: http://localhost:8065
- Via Caddy: see your configured domain (e.g. https://chat.${SITE_DOMAIN:-example.com})
- URL: $SITE_URL (or http://localhost:8065)
- First run: create admin account at the URL above
## Initial admin setup
Visit: \`${SITE_URL}/signup_user_complete\`
## Voice/Video Calls (Calls plugin)
Port 8443/udp must be open on your router/firewall.
coturn relay runs on port 3479 (HMAC secret in .env).
The first user to sign up becomes the System Admin.
## Calls plugin (voice/video)
The Mattermost Calls plugin provides voice/video channels.
**WebRTC requires HTTPS** — calls will not work over plain HTTP.
### Enable the plugin
1. Go to **System Console → Plugins → Plugin Management**
2. Enable the **Calls** plugin (pre-installed in Team Edition)
### Configure ICE / TURN server
1. Go to **System Console → Plugins → Calls**
2. Set **RTC Server Address**: your server's public IP or domain
3. Set **TURN server URL**: \`turn:<your-server-or-ip>:3479\`
4. Set **TURN credentials type**: Static credentials (auth secret)
5. Set **TURN static auth secret**: (see \`TURN_SECRET\` in \`$DIR/.env\`)
6. Save and test a call in a channel
Direct WebRTC (port 8443/UDP) is tried first; coturn relay is the fallback
for clients behind strict NAT (cellular, hotel WiFi, Proton VPN, etc.).
## Router port-forwards (for external calls)
| Port(s) | Protocol | Service |
|--------------|-----------|---------------------------------|
| 8443 | UDP | Calls plugin RTC (direct path) |
| 3479 | UDP+TCP | coturn STUN/TURN |
| 49153–49352 | UDP | coturn relay range |
Configure in Mattermost: System Console → Plugins → Calls:
- TURN Server URI: turn:YOUR_DOMAIN_OR_IP:3479?transport=udp
- TURN Credentials: use static-auth-secret (see .env COTURN_SECRET)
## Manage
\`\`\`bash
cd $DIR
docker compose up -d # start
docker compose down # stop
docker compose logs -f # all logs
docker compose logs -f mattermost # app logs only
docker compose logs -f coturn # TURN server logs
docker compose pull && docker compose up -d # update images
docker compose up -d
docker compose down
docker compose logs -f
docker compose pull && docker compose up -d
\`\`\`
## Backup
Important paths to back up:
- \`$DIR/data/\` — uploaded files and attachments
- \`$DIR/config/\` — server configuration
- \`$DIR/plugins/\` — installed plugins
- \`$DIR/db/\` — PostgreSQL data directory
- \`$DIR/.env\` — secrets and configuration
## Configuration
Main config file: \`$DIR/config/config.json\` (created on first start).
Environment variables in \`.env\` override config.json values.
After editing .env: \`docker compose down && docker compose up -d\`
MD
# ── Start ──────────────────────────────────────────────────────────────────
echo ""
if [[ "$SITE_URL" == http://* ]]; then
log_warning "WebRTC (voice/video calls) requires HTTPS. Configure Caddy and update SITE_URL."
fi
local START=""
prompt_yn "Start Mattermost now? (y/n):" "y" START
if [[ "$START" =~ ^[Yy]$ ]]; then
log_info "Pulling images and starting Mattermost (first start may take a minute)..."
if docker compose pull 2>&1 | tail -3 && docker compose up -d; then
log_success "Mattermost started"
echo ""
echo " App: http://localhost:8065"
echo " Admin setup: ${SITE_URL}/signup_user_complete"
echo ""
log_info "Enable the Calls plugin and configure TURN at:"
log_info " System Console → Plugins → Calls"
log_info " TURN URL: turn:<your-public-ip>:3479"
log_info " TURN secret: (see $DIR/.env → TURN_SECRET)"
else
log_warning "Start failed — check: docker compose logs"
fi
if [ "$START" = "y" ] || [ "$START" = "Y" ]; then
docker compose up -d \
&& log_success "Mattermost started" \
|| log_warning "Start failed — check: docker compose logs"
fi
echo ""
echo " Access at: $SITE_URL"
echo " First run: open the URL above and create your admin account."
echo " Calls plugin: System Console → Plugins → Calls to configure coturn."
echo " TURN URI: turn:${SITE_DOMAIN:-YOUR_IP}:3479?transport=udp"
echo " Auth secret: see COTURN_SECRET in $DIR/.env"
echo ""
}
services/nextcloud.sh
+109 -121
View File
@@ -2,10 +2,6 @@
# services/nextcloud.sh — Self-hosted cloud storage with SMB/local file access (Nextcloud).
# Part of the modular post-install system (sourced by setup.sh).
#
# Uses a custom Dockerfile (nextcloud:apache + smbclient) so SMB external storage
# works without AIO. All data uses bind mounts under ~/docker/nextcloud/ so that
# Kopia/Borg backup scripts cover everything automatically.
#
# Can also be run standalone on any machine:
# sudo bash nextcloud.sh
# (Docker must already be installed when run standalone)
@@ -25,7 +21,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
# shellcheck source=../lib/common.sh
source "$_COMMON"
else
# One-off copy — inline minimal stubs
# One-off copy — inline minimal stubs so the script works without the repo
log_info() { echo -e "\033[0;34m[INFO]\033[0m $*"; }
log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
@@ -53,6 +49,13 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$_len"
}
write_readme() {
local _dir="$1"; shift
[[ "${DRY_RUN:-false}" == "true" ]] && return 0
mkdir -p "$_dir"
cat > "$_dir/README.md"
}
# Match common.sh's eval-based pattern so local vars in install_* are set correctly
prompt_text() {
local _q="$1" _def="$2" _var="$3" _r
@@ -73,8 +76,23 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
local _caddy_dir="$DOCKER_DIR/caddy"
local _caddyfile="$_caddy_dir/Caddyfile"
# Support remote Caddy host via CADDY_REMOTE_HOST
if [[ -n "${CADDY_REMOTE_HOST:-}" ]]; then
log_info "Remote Caddy detected at $CADDY_REMOTE_HOST — printing block to add manually."
echo ""
echo " Add the following to your Caddyfile on $CADDY_REMOTE_HOST:"
echo " ──────────────────────────────────────────────────────────"
echo " # $_name"
echo " ${_subdomain}.${SITE_DOMAIN:-example.com} {"
echo " reverse_proxy $_upstream"
[[ -n "$_extra" ]] && echo "$_extra"
echo " }"
echo " ──────────────────────────────────────────────────────────"
return 0
fi
if [[ ! -d "$_caddy_dir" ]]; then
log_info "Access $_name directly on port 8080."
log_info "Access $_name directly on port ${_upstream##*:}."
return 0
fi
@@ -82,7 +100,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
local _do_caddy=""
read -r -p " Configure Caddy reverse proxy for $_name? [y/N]: " _do_caddy
[[ "${_do_caddy,,}" == "y" ]] || {
log_info "Skipping — access at: http://localhost:8080"
log_info "Skipping — access at: http://localhost:${_upstream##*:}"
return 0
}
@@ -138,12 +156,6 @@ CBLOCK
log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
fi
}
write_readme() {
local _dir="$1"; shift
mkdir -p "$_dir"
cat > "$_dir/README.md"
}
fi
# Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
@@ -170,38 +182,32 @@ install_nextcloud() {
local DIR="$DOCKER_DIR/nextcloud"
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $DIR with:"
echo "[DRY-RUN] Dockerfile (nextcloud:apache + smbclient)"
echo "[DRY-RUN] docker-compose.yml (nextcloud + mariadb:10.11)"
echo "[DRY-RUN] .env with generated DB and admin passwords"
echo "[DRY-RUN] Bind-mount directories: html/ db/ config/ custom_apps/"
echo "[DRY-RUN] Would expose Nextcloud on port 8080"
echo "[DRY-RUN] Would enable files_external app via occ after deploy"
echo "[DRY-RUN] Would create $DIR with Dockerfile, docker-compose.yml, .env"
return 0
fi
mkdir -p "$DIR/html" "$DIR/db" "$DIR/config" "$DIR/custom_apps"
mkdir -p "$DIR"
ensure_docker_dir_ownership "$DIR"
cd "$DIR" || return 1
local DB_PASS NC_ADMIN_PASS TZ_VAL
local DB_PASS
DB_PASS=$(generate_password 32)
NC_ADMIN_PASS=$(generate_password 24)
TZ_VAL="${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}"
local NC_ADMIN_PASS
NC_ADMIN_PASS=$(generate_password 16)
local TZ_VAL="${SITE_TZ:-UTC}"
# ── Dockerfile — adds SMB support to the official apache image ────────────
cat > Dockerfile << 'DOCKERFILE'
# ── Dockerfile ──────────────────────────────────────────────────────────
cat > Dockerfile << 'NCDF'
FROM nextcloud:apache
RUN apt-get update \
&& apt-get install -y --no-install-recommends procps smbclient \
&& rm -rf /var/lib/apt/lists/*
DOCKERFILE
NCDF
# ── docker-compose.yml — single-quoted EOF prevents variable expansion ────
cat > docker-compose.yml << 'EOF'
# ── docker-compose.yml ──────────────────────────────────────────────────
cat > docker-compose.yml << 'NCCOMPOSE'
name: nextcloud
services:
nextcloud:
build: .
@@ -235,132 +241,114 @@ networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
EOF
NCCOMPOSE
# ── .env — actual variable values (NOT inside the compose heredoc) ────────
cat > .env << NC_ENV
# ── Timezone & network ────────────────────────────────────────────────────────
# ── .env ────────────────────────────────────────────────────────────────
cat > .env << NCENV
TZ=$TZ_VAL
CADDY_NET=$SITE_CADDY_NET
# ── MariaDB ───────────────────────────────────────────────────────────────────
# MariaDB
MYSQL_ROOT_PASSWORD=$DB_PASS
MYSQL_DATABASE=nextcloud
MYSQL_USER=nextcloud
MYSQL_PASSWORD=$DB_PASS
MARIADB_AUTO_UPGRADE=1
# ── Nextcloud bootstrap ───────────────────────────────────────────────────────
# These are used only on the very first startup to create the admin account
# and wire up the database. They are ignored on subsequent startups.
# Nextcloud bootstrap (first run only)
NEXTCLOUD_ADMIN_USER=admin
NEXTCLOUD_ADMIN_PASSWORD=$NC_ADMIN_PASS
NEXTCLOUD_DB_TYPE=mysql
MYSQL_HOST=db
# ── Reverse proxy trust (required when behind Caddy) ─────────────────────────
# Without these, share links use http:// and internal redirects may break.
# Reverse proxy (required for correct share links and redirects behind Caddy)
OVERWRITEPROTOCOL=https
OVERWRITECLIURL=https://cloud.${SITE_DOMAIN:-example.com}
TRUSTED_PROXIES=172.16.0.0/12
NC_ENV
NCENV
chmod 600 .env
# ── Subdirectories ──────────────────────────────────────────────────────
mkdir -p html config custom_apps db
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DIR"
echo ""
log_success "Nextcloud configured at $DIR"
configure_caddy_for_service "Nextcloud" "nextcloud:80" "cloud"
write_readme "$DIR" << MD
# Nextcloud
Self-hosted cloud storage — files, contacts, calendar, notes, and more.
SMB/local external storage is enabled via a custom Docker image (nextcloud:apache + smbclient).
## Access
- URL: http://localhost:8080
- Admin user: \`admin\`
- Admin password: see \`NEXTCLOUD_ADMIN_PASSWORD\` in \`.env\`
## Directory layout (all bind-mounted — covered by Kopia/Borg backups)
\`\`\`
$DIR/
html/ # Nextcloud web root (PHP app + uploaded files)
config/ # config.php and other Nextcloud config files
custom_apps/ # manually installed apps not shipped with Nextcloud
db/ # MariaDB data directory
Dockerfile # custom image definition (adds smbclient)
docker-compose.yml
.env # secrets — chmod 600
\`\`\`
## External Storage (SMB / local paths)
The \`files_external\` app is enabled automatically during setup.
Add mounts in the Nextcloud web UI:
**Admin → Administration → External Storage**
Supported backends: Local, SMB/CIFS, FTP, S3, WebDAV, and more.
## Manage
\`\`\`bash
cd $DIR
docker compose up -d # start
docker compose down # stop
docker compose logs -f # logs
docker compose build --pull && docker compose up -d # rebuild image + update
docker exec --user www-data nextcloud php occ list # occ CLI
\`\`\`
## Backup note
All data lives under \`$DIR/\` as bind mounts.
Include this directory in your Kopia/Borg backup policy.
Run \`docker compose down\` before a cold backup of \`db/\` for consistency,
or use \`mysqldump\` for a hot backup:
\`\`\`bash
docker exec nextcloud-db mysqldump -u nextcloud -p\$MYSQL_PASSWORD nextcloud > nextcloud_db.sql
\`\`\`
MD
# ── Prompt to start ─────────────────────────────────────────────────────
local START_NC=""
prompt_yn "Start Nextcloud now? (y/n):" "y" START_NC
if [ "$START_NC" = "y" ] || [ "$START_NC" = "Y" ]; then
docker compose up -d \
&& log_success "Nextcloud started — first boot may take 1-2 minutes" \
docker compose up -d --build \
&& log_success "Nextcloud started" \
|| { log_warning "Start failed — check: docker compose logs"; return 1; }
# Wait for Nextcloud to finish first-boot initialisation before running occ
log_info "Waiting for Nextcloud to finish initialising (up to 90 s)..."
local _waited=0
until docker exec --user www-data nextcloud php occ status --output=json 2>/dev/null \
| grep -q '"installed":true'; do
sleep 5
_waited=$(( _waited + 5 ))
if (( _waited >= 90 )); then
log_warning "Nextcloud did not finish initialising within 90 s."
log_warning "Run the occ command manually once the container is ready:"
log_warning " docker exec --user www-data nextcloud php occ app:enable files_external"
break
fi
# ── Wait for occ and enable files_external ──────────────────────────
log_info "Waiting for Nextcloud to initialize (up to 90s)..."
local _wait=0
until docker exec nextcloud php occ status 2>/dev/null | grep -q "installed: true"; do
sleep 5; _wait=$((_wait+5))
[ $_wait -ge 90 ] && { log_warning "Nextcloud not ready after 90s — enable files_external manually"; break; }
done
if (( _waited < 90 )); then
if docker exec --user www-data nextcloud php occ app:enable files_external; then
log_success "External Storage app enabled"
else
log_warning "Could not enable files_external — run manually:"
log_warning " docker exec --user www-data nextcloud php occ app:enable files_external"
fi
if docker exec nextcloud php occ app:enable files_external 2>/dev/null; then
log_success "files_external app enabled (SMB/local external storage)"
fi
fi
# ── README ───────────────────────────────────────────────────────────────
write_readme "$DIR" << NCREADME
# Nextcloud
Self-hosted cloud storage with SMB/local file access.
## Access
- URL: https://cloud.${SITE_DOMAIN:-example.com} (or http://localhost:8080)
- Admin: admin
- Password: see \`NEXTCLOUD_ADMIN_PASSWORD\` in \`$DIR/.env\`
## Manage
\`\`\`bash
docker compose up -d --build # start / rebuild
docker compose down # stop
docker compose logs -f # follow logs
docker compose pull && docker compose up -d --build # update
\`\`\`
## Run occ commands
\`\`\`bash
docker exec -u www-data nextcloud php occ <command>
\`\`\`
## Enable external storage (SMB / local)
\`\`\`bash
docker exec -u www-data nextcloud php occ app:enable files_external
\`\`\`
Then configure mounts in Nextcloud → Settings → External Storages.
## Backup
Back up these directories:
- \`$DIR/html\` — Nextcloud application files
- \`$DIR/config\` — configuration
- \`$DIR/custom_apps\` — third-party apps
- \`$DIR/db\` — MariaDB data
- \`$DIR/.env\` — credentials (permissions 600)
NCREADME
echo ""
echo " URL: http://localhost:8080"
echo " Admin user: admin"
echo " Admin password: $NC_ADMIN_PASS"
echo " (Credentials also saved to $DIR/.env)"
echo " Access URL: http://localhost:8080"
echo " Admin user: admin"
echo " Admin pass: $NC_ADMIN_PASS"
echo " Config dir: $DIR"
echo ""
echo " To add SMB or local external storage:"
echo " Nextcloud → Admin → Administration → External Storage"
echo " Note: First startup may take 1-2 minutes while Nextcloud initialises."
echo ""
}
services/onlyoffice.sh
+157 -139
View File
@@ -1,5 +1,5 @@
#!/bin/bash
# services/onlyoffice.sh — Self-hosted OnlyOffice Document Server.
# services/onlyoffice.sh — Self-hosted OnlyOffice Document Server (Nextcloud/FileBrowser).
# Part of the modular post-install system (sourced by setup.sh).
#
# Can also be run standalone on any machine:
@@ -7,6 +7,9 @@
# (Docker must already be installed when run standalone)
# ── Standalone bootstrap ──────────────────────────────────────────────────────
# Detected when the script is executed directly rather than sourced by setup.sh.
# Sets up helpers and globals, then defers execution until after the function
# definition at the bottom of this file.
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
[[ "$(id -u)" == "0" ]] || { echo "Run with sudo: sudo bash $0"; exit 1; }
@@ -14,9 +17,11 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
_COMMON="$_SELF_DIR/../lib/common.sh"
if [[ -f "$_COMMON" ]]; then
# Full repo present — use the real helpers (picks up ~/docker/.config too)
# shellcheck source=../lib/common.sh
source "$_COMMON"
else
# One-off copy — inline minimal stubs so the script works without the repo
log_info() { echo -e "\033[0;34m[INFO]\033[0m $*"; }
log_success() { echo -e "\033[0;32m[OK]\033[0m $*"; }
log_warning() { echo -e "\033[1;33m[WARN]\033[0m $*"; }
@@ -39,6 +44,19 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$@" 2>/dev/null || true
}
generate_password() {
local _len="${1:-32}"
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$_len"
}
write_readme() {
local _dir="$1"; shift
[[ "${DRY_RUN:-false}" == "true" ]] && return 0
mkdir -p "$_dir"
cat > "$_dir/README.md"
}
# Match common.sh's eval-based pattern so local vars in install_* are set correctly
prompt_text() {
local _q="$1" _def="$2" _var="$3" _r
[[ "${UNATTENDED:-false}" == "true" ]] && { eval "$_var='$_def'"; return; }
@@ -58,6 +76,21 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
local _caddy_dir="$DOCKER_DIR/caddy"
local _caddyfile="$_caddy_dir/Caddyfile"
# Support remote Caddy host via CADDY_REMOTE_HOST
if [[ -n "${CADDY_REMOTE_HOST:-}" ]]; then
log_info "Remote Caddy detected at $CADDY_REMOTE_HOST — printing block to add manually."
echo ""
echo " Add the following to your Caddyfile on $CADDY_REMOTE_HOST:"
echo " ──────────────────────────────────────────────────────────"
echo " # $_name"
echo " ${_subdomain}.${SITE_DOMAIN:-example.com} {"
echo " reverse_proxy $_upstream"
[[ -n "$_extra" ]] && echo "$_extra"
echo " }"
echo " ──────────────────────────────────────────────────────────"
return 0
fi
if [[ ! -d "$_caddy_dir" ]]; then
log_info "Access $_name directly on port ${_upstream##*:}."
return 0
@@ -75,6 +108,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
read -r -p " Domain (e.g. ${_subdomain}.${SITE_DOMAIN:-example.com}): " _domain
[[ -n "$_domain" ]] || { log_warning "No domain entered — skipping Caddy."; return 0; }
# Back up before touching
if [[ -f "$_caddyfile" ]]; then
local _bk="$_caddy_dir/Caddyfile.backup.$(date +%Y%m%d-%H%M%S)"
cp "$_caddyfile" "$_bk"
@@ -83,6 +117,7 @@ if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
touch "$_caddyfile"
fi
# Remove existing block for this domain if present
if grep -q "^${_domain}" "$_caddyfile" 2>/dev/null; then
log_warning "$_domain already in Caddyfile"
local _ow=""
@@ -121,19 +156,10 @@ CBLOCK
log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
fi
}
write_readme() {
local _dir="$1"; shift
mkdir -p "$_dir"
cat > "$_dir/README.md"
}
generate_password() {
local len="${1:-32}"
tr -dc 'A-Za-z0-9' </dev/urandom | head -c "$len"
}
fi
# Globals — ACTUAL_USER/ACTUAL_HOME must come before DOCKER_DIR
# ($HOME under sudo is /root, not the real user's home)
ACTUAL_USER="${ACTUAL_USER:-${SUDO_USER:-$USER}}"
ACTUAL_HOME="$(getent passwd "$ACTUAL_USER" 2>/dev/null | cut -d: -f6 || echo "${HOME:-/root}")"
DOCKER_DIR="${DOCKER_DIR:-$ACTUAL_HOME/docker}"
@@ -143,129 +169,83 @@ CBLOCK
SITE_DOMAIN="${SITE_DOMAIN:-example.com}"
SITE_CADDY_NET="${SITE_CADDY_NET:-caddy_net}"
register_service() { :; }
register_service() { :; } # no-op — no wizard to register into
_RUN_STANDALONE=1
fi
# ─────────────────────────────────────────────────────────────────────────────
register_service onlyoffice utilities "Self-hosted OnlyOffice Document Server (Nextcloud/FileBrowser)" 8082
# ── Ensure yq v4 is installed ─────────────────────────────────────────────────
# ── Helper: install yq v4 if absent ──────────────────────────────────────────
_ensure_yq() {
if command -v yq &>/dev/null; then
local major
major=$(yq --version 2>&1 | grep -oP '(?<=v)\d+' | head -1 || echo 0)
[[ "$major" -ge 4 ]] && return 0
log_info "yq found but version < 4 — reinstalling..."
else
log_info "yq not found — installing..."
fi
local arch
arch=$(uname -m)
local yq_bin="yq_linux_amd64"
[[ "$arch" == "aarch64" || "$arch" == "arm64" ]] && yq_bin="yq_linux_arm64"
if wget -qO /usr/local/bin/yq \
"https://github.com/mikefarah/yq/releases/latest/download/${yq_bin}" \
&& chmod +x /usr/local/bin/yq; then
log_success "yq installed ($(yq --version 2>&1 | head -1))"
else
log_warning "Could not install yq — FileBrowser config.yaml will need manual update"
return 1
fi
command -v yq &>/dev/null && return 0
log_info "Installing yq (required for FileBrowser config patching)..."
local _arch; _arch=$(uname -m)
local _binary="yq_linux_amd64"
[[ "$_arch" == "aarch64" || "$_arch" == "arm64" ]] && _binary="yq_linux_arm64"
curl -fsSL "https://github.com/mikefarah/yq/releases/latest/download/${_binary}" \
-o /usr/local/bin/yq && chmod +x /usr/local/bin/yq \
&& log_success "yq installed" || log_warning "yq install failed — FileBrowser wiring skipped"
}
# ── Wire OnlyOffice into Nextcloud ────────────────────────────────────────────
# ── Helper: wire OnlyOffice into Nextcloud (idempotent) ───────────────────────
_wire_nextcloud() {
local jwt_secret="$1"
local nc_dir="$DOCKER_DIR/nextcloud"
[[ -d "$nc_dir" ]] || return 0
log_info "Nextcloud detected — wiring OnlyOffice integration..."
if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^nextcloud$"; then
log_warning "Nextcloud container not running — skipping occ wiring."
log_info " Start Nextcloud and re-run: sudo bash $0"
local _jwt="$1"
local _nc_container="nextcloud"
docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_nc_container}$" || {
log_info "Nextcloud container not running — skipping Nextcloud wiring"
return 0
fi
docker exec --user www-data nextcloud php occ app:enable onlyoffice \
&& log_success "OnlyOffice app enabled in Nextcloud" \
|| log_warning "app:enable failed — may already be enabled"
docker exec --user www-data nextcloud php occ \
config:app:set onlyoffice DocumentServerUrl \
--value "http://onlyoffice:80/" \
&& log_success "DocumentServerUrl → http://onlyoffice:80/" \
|| log_warning "Could not set DocumentServerUrl"
docker exec --user www-data nextcloud php occ \
config:app:set onlyoffice jwt_secret \
--value "$jwt_secret" \
&& log_success "jwt_secret set" \
|| log_warning "Could not set jwt_secret"
docker exec --user www-data nextcloud php occ \
config:app:set onlyoffice jwt_header \
--value "AuthorizationJwt" \
&& log_success "jwt_header set" \
|| log_warning "Could not set jwt_header"
}
log_info "Wiring OnlyOffice into Nextcloud..."
docker exec "$_nc_container" php occ app:enable onlyoffice 2>/dev/null || true
docker exec "$_nc_container" php occ config:system:set onlyoffice DocumentServerUrl \
--value="https://office.${SITE_DOMAIN:-example.com}/" 2>/dev/null \
&& log_success "DocumentServerUrl set" || log_warning "Could not set DocumentServerUrl"
docker exec "$_nc_container" php occ config:system:set onlyoffice jwt_secret \
--value="$_jwt" 2>/dev/null \
&& log_success "jwt_secret set" || log_warning "Could not set jwt_secret"
docker exec "$_nc_container" php occ config:system:set onlyoffice jwt_header \
--value="AuthorizationJwt" 2>/dev/null \
&& log_success "jwt_header set" || log_warning "Could not set jwt_header"
}
# ── Wire OnlyOffice into FileBrowser Quantum ──────────────────────────────────
# ── Helper: patch FileBrowser Quantum config.yaml with OnlyOffice endpoint ───
_wire_filebrowser() {
local fb_config="$DOCKER_DIR/filebrowser/data/config.yaml"
[[ -f "$fb_config" ]] || return 0
log_info "FileBrowser Quantum detected — updating config.yaml..."
if ! _ensure_yq; then
log_info "Set officeServer manually in $fb_config:"
log_info " officeServer: \"http://onlyoffice:80/\""
return 0
fi
yq e -i '.officeServer = "http://onlyoffice:80/"' "$fb_config" \
&& log_success "FileBrowser config.yaml: officeServer → http://onlyoffice:80/" \
|| log_warning "yq failed — set officeServer manually in $fb_config"
if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^filebrowser$"; then
docker restart filebrowser >/dev/null 2>&1 \
&& log_info "FileBrowser restarted to pick up config change" \
|| log_warning "Could not restart FileBrowser container"
fi
local _fbq_config="$DOCKER_DIR/filebrowser/config.yaml"
[[ -f "$_fbq_config" ]] || { log_info "FileBrowser config not found — skipping"; return 0; }
command -v yq &>/dev/null || { log_info "yq not found — skipping FileBrowser wiring"; return 0; }
log_info "Wiring OnlyOffice into FileBrowser Quantum..."
yq e '.officeServer = "http://onlyoffice:80/"' -i "$_fbq_config" \
&& log_success "FileBrowser officeServer set" || log_warning "Could not patch FileBrowser config"
docker restart filebrowser 2>/dev/null && log_success "FileBrowser restarted" || true
}
install_onlyoffice() {
require_docker || return 1
log_info "Installing OnlyOffice Document Server..."
_ensure_yq
log_info "Installing OnlyOffice Document Server..."
local DIR="$DOCKER_DIR/onlyoffice"
if [ "$DRY_RUN" = true ]; then
echo "[DRY-RUN] Would create $DIR with docker-compose.yml and .env"
echo "[DRY-RUN] Would deploy onlyoffice/documentserver:latest on port 8082"
echo "[DRY-RUN] Would install yq if missing"
echo "[DRY-RUN] Would wire OnlyOffice into Nextcloud (if running)"
echo "[DRY-RUN] Would wire OnlyOffice into FileBrowser Quantum (if present)"
echo "[DRY-RUN] Would create $DIR with docker-compose.yml, .env"
return 0
fi
# Always install yq — needed for FBQ config patching
_ensure_yq || true
mkdir -p "$DIR"
ensure_docker_dir_ownership "$DIR"
cd "$DIR" || return 1
# Generate JWT secret (or read existing one so re-runs don't rotate it)
# ── Preserve JWT secret across re-runs ──────────────────────────────────
local JWT_SECRET=""
if [[ -f "$DIR/.env" ]]; then
JWT_SECRET=$(grep "^JWT_SECRET=" "$DIR/.env" 2>/dev/null | cut -d= -f2-)
fi
[[ -z "$JWT_SECRET" ]] && JWT_SECRET="$(generate_password 32)"
cat > docker-compose.yml << 'OO_COMPOSE'
# ── docker-compose.yml ──────────────────────────────────────────────────
cat > docker-compose.yml << 'OOCOMPOSE'
name: onlyoffice
services:
onlyoffice:
image: onlyoffice/documentserver:latest
@@ -273,6 +253,10 @@ services:
hostname: onlyoffice
restart: unless-stopped
env_file: .env
volumes:
- ./logs:/var/log/onlyoffice
- ./data:/var/www/onlyoffice/Data
- ./fonts:/usr/share/fonts/truetype/custom
ports:
- "8082:80"
networks:
@@ -282,81 +266,115 @@ networks:
caddy_net:
external: true
name: ${CADDY_NET:-caddy_net}
OO_COMPOSE
OOCOMPOSE
cat > .env << OO_ENV
# OnlyOffice Document Server — environment
# ── .env ────────────────────────────────────────────────────────────────
cat > .env << OOENV
CADDY_NET=$SITE_CADDY_NET
# JWT authentication — keep JWT_SECRET private
# If you rotate it, update Nextcloud (occ config:app:set onlyoffice jwt_secret)
# and any other integration that uses this server
JWT_ENABLED=true
JWT_SECRET=$JWT_SECRET
JWT_HEADER=AuthorizationJwt
OO_ENV
OOENV
chmod 600 .env
# ── Subdirectories ──────────────────────────────────────────────────────
mkdir -p logs data fonts
chown -R "$ACTUAL_USER:$ACTUAL_USER" "$DIR"
# OnlyOffice must be embeddable as an iframe in Nextcloud/FileBrowser.
# Override X-Frame-Options to allow same-site embedding (remove SAMEORIGIN restriction).
echo ""
log_success "OnlyOffice configured at $DIR"
# OnlyOffice must be embeddable as an iframe (Nextcloud / FileBrowser open
# documents in a frame). Override the default X-Frame-Options header that
# Caddy would otherwise set to SAMEORIGIN.
local OO_EXTRA_BLOCK=' header {
-X-Frame-Options
Content-Security-Policy "frame-ancestors '\''self'\'' *"
}'
configure_caddy_for_service "OnlyOffice" "onlyoffice:80" "office" "$OO_EXTRA_BLOCK"
local START=""
prompt_yn "Start OnlyOffice now? (y/n):" "y" START
if [[ "$START" =~ ^[Yy]$ ]]; then
# ── Prompt to start ─────────────────────────────────────────────────────
local START_OO=""
prompt_yn "Start OnlyOffice now? (y/n):" "y" START_OO
if [ "$START_OO" = "y" ] || [ "$START_OO" = "Y" ]; then
docker compose up -d \
&& log_success "OnlyOffice started" \
|| log_warning "Start failed — check: docker compose logs"
fi
# Wire into integrations every run (idempotent)
# ── Wire integrations (runs every install/re-install) ───────────────────
echo ""
_wire_nextcloud "$JWT_SECRET"
_wire_filebrowser
write_readme "$DIR" << MD
# ── README ───────────────────────────────────────────────────────────────
write_readme "$DIR" << OOREAD
# OnlyOffice Document Server
Self-hosted collaborative editing for DOCX, XLSX, PPTX, and ODT files.
Integrates with Nextcloud and FileBrowser Quantum.
Port: 8082 (internal 80)
Self-hosted document editing server, integrated with Nextcloud and FileBrowser Quantum.
## JWT Secret
Stored in \`.env\` (chmod 600). If you rotate it:
1. Update \`JWT_SECRET\` in \`.env\`
2. Re-run the installer to re-wire all integrations: \`sudo bash services/onlyoffice.sh\`
## Access
## Verify integrations
\`\`\`bash
# Nextcloud
docker exec --user www-data nextcloud php occ config:app:get onlyoffice DocumentServerUrl
docker exec --user www-data nextcloud php occ config:app:get onlyoffice jwt_secret
# FileBrowser Quantum
grep officeServer ~/docker/filebrowser/data/config.yaml
\`\`\`
- URL: https://office.${SITE_DOMAIN:-example.com} (or http://localhost:8082)
- The document server itself has no user-facing login page — it is accessed
through Nextcloud or FileBrowser Quantum.
## Manage
\`\`\`bash
cd $DIR
docker compose up -d # start
docker compose down # stop
docker compose logs -f # logs
docker compose up -d # start
docker compose down # stop
docker compose logs -f # follow logs
docker compose pull && docker compose up -d # update
\`\`\`
MD
log_success "OnlyOffice installed at $DIR"
## JWT secret rotation
1. Generate a new secret:
\`\`\`bash
openssl rand -hex 24
\`\`\`
2. Update \`JWT_SECRET\` in \`$DIR/.env\`
3. Restart OnlyOffice:
\`\`\`bash
docker compose restart
\`\`\`
4. Update Nextcloud's stored secret:
\`\`\`bash
docker exec nextcloud php occ config:system:set onlyoffice jwt_secret --value="<new-secret>"
\`\`\`
## Verify Nextcloud integration
\`\`\`bash
docker exec nextcloud php occ config:system:get onlyoffice
\`\`\`
## Verify FileBrowser integration
\`\`\`bash
grep officeServer $DOCKER_DIR/filebrowser/config.yaml
\`\`\`
## Add custom fonts
Copy \`.ttf\` / \`.otf\` font files into \`$DIR/fonts/\`, then restart the container.
OOREAD
echo ""
echo " Port: http://localhost:8082"
echo " JWT Secret: $JWT_SECRET"
echo " (Secret also saved to $DIR/.env)"
echo " OnlyOffice Document Server"
echo " Access URL: http://localhost:8082"
echo " JWT secret: $JWT_SECRET"
echo " Config dir: $DIR"
echo ""
echo " Integration status:"
docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^nextcloud$" \
&& echo " Nextcloud: wired (onlyoffice app + JWT configured)" \
|| echo " Nextcloud: not running — wire manually after starting Nextcloud"
[[ -f "$DOCKER_DIR/filebrowser/config.yaml" ]] \
&& echo " FileBrowser: config.yaml patched" \
|| echo " FileBrowser: config not found — will wire on next onlyoffice install"
echo ""
}
vendor/easy-asterisk/.env.example
Vendored
+20 -87
View File
@@ -1,99 +1,32 @@
# ================================================================
# Easy Asterisk - Environment Configuration
#
# Setup:
# 1. cp .env.example .env
# 2. Set DOMAIN_NAME (the only required setting)
# 3. docker compose up -d
# 4. docker exec -it easy-asterisk easy-asterisk
#
# Port forwarding required on your router:
# 5061/tcp → SIP TLS signaling
# 3478/udp+tcp → STUN/TURN (NAT traversal + media relay)
# (change with TURN_PORT if 3478 is taken)
# 10000-20000/udp → RTP media (or your custom range below)
#
# How it works:
# - All SIP clients connect to DOMAIN_NAME:5061 (TLS)
# - coturn handles NAT traversal (STUN) and media relay (TURN)
# - Works from any network: LAN, cellular, Proton VPN, hotel WiFi
# - Set TURN_PASSWORD below (generate one: openssl rand -base64 18)
# Easy Asterisk — Environment Configuration
# Copy to .env and fill in your values.
# ================================================================
# ── Domain Name (REQUIRED) ────────────────────────────────────
# The FQDN that points to this server's public IP.
# This is what SIP clients use to connect.
# Example: asterisk.yourdomain.com
DOMAIN_NAME=
# ── Domain (REQUIRED for remote/FQDN access) ──────────────────
# Your FQDN pointing to this server's public IP.
# Leave empty for LAN-only mode.
DOMAIN_NAME=asterisk.example.com
# ── Public IP ─────────────────────────────────────────────────
# Your server's public IP address.
# Leave empty to auto-detect (uses ifconfig.me).
# Set manually if auto-detection fails (e.g., behind double NAT).
PUBLIC_IP=
# ── TLS ───────────────────────────────────────────────────────
# Always "y" for remote access. Self-signed certs are auto-generated.
# For trusted certs (no client warnings), mount your Let's Encrypt
# certs into /etc/asterisk/certs/ via docker compose volumes.
ENABLE_TLS=y
# ── Local Network ─────────────────────────────────────────────
# Your LAN CIDR. Auto-detected if empty.
# Example: 192.168.1.0/24
LOCAL_CIDR=
# ── Additional Subnets (optional) ─────────────────────────────
# Only needed for site-to-site VPNs or VLANs where the server
# has a direct route to client IPs (e.g., WireGuard, Tailscale).
#
# NOT needed for client-side VPNs (Proton, NordVPN, etc.)
# - Those clients appear with random public IPs
# - TURN handles media relay for them automatically
#
# Examples:
# WireGuard: VLAN_SUBNETS=10.8.0.0/24
# Tailscale: VLAN_SUBNETS=100.64.0.0/10
# Multiple: VLAN_SUBNETS=10.8.0.0/24 10.10.0.0/24
HAS_VLANS=n
VLAN_SUBNETS=
# ── TURN/STUN Settings ──────────────────────────────────────
# Used by coturn for TURN relay authentication.
# If empty, defaults to "changeme" — set a real password for security.
# Generate one with: openssl rand -base64 18
#
# These credentials are for coturn only. SIP clients that need TURN
# relay (behind strict NAT) must configure the same credentials in
# their SIP app settings.
# ── TURN/STUN ──────────────────────────────────────────────────
# Generate a strong password: openssl rand -base64 18
TURN_USERNAME=easyasterisk
TURN_PASSWORD=
# ── TURN/STUN Port ──────────────────────────────────────────
# Default: 3478 (standard STUN/TURN port)
# Change if 3478 is already in use (e.g., UniFi controller uses 3478/udp).
# Common alternative: 3479
TURN_PASSWORD=changeme
TURN_PORT=3478
# Points to coturn. For LAN-only leave empty.
TURN_SERVER=${DOMAIN_NAME}:${TURN_PORT}
# ── TURN Relay Port Range ─────────────────────────────────────
# Ports coturn uses for media relay. Forward this range on your router.
# Default is 100 ports (enough for ~50 simultaneous relayed calls).
# Most calls use direct paths; TURN relay is the fallback.
TURN_RELAY_MIN=49152
TURN_RELAY_MAX=49252
# ── RTP Port Range ────────────────────────────────────────────
# Asterisk's own RTP media ports. Forward this range on your router.
# Default: 10000-20000 (10,000 ports)
# For constrained environments: 10000-10200
# ── RTP port range ─────────────────────────────────────────────
RTP_START=10000
RTP_END=20000
# ── Web Admin ─────────────────────────────────────────────────
# HTTP management interface. Access via browser at:
# http://your-server:8080/clients
#
# For HTTPS: put this behind Caddy or nginx reverse proxy,
# then set WEB_ADMIN_AUTH_DISABLED=true (let the proxy handle auth).
# ── Web admin ──────────────────────────────────────────────────
WEB_ADMIN_PORT=8080
# Set to true if Authelia or another reverse proxy handles auth
WEB_ADMIN_AUTH_DISABLED=false
# ── Public IP (optional — auto-detected if empty) ─────────────
PUBLIC_IP=
# ── Local network CIDR (optional — auto-detected if empty) ────
LOCAL_CIDR=
vendor/easy-asterisk/Dockerfile
Vendored
+42 -85
View File
@@ -1,103 +1,60 @@
# ================================================================
# Easy Asterisk - Docker Container
# Asterisk PBX with web admin and optional STUN support
#
# Usage:
# docker compose up -d # Asterisk only
# docker compose --profile stun up -d # Asterisk + self-hosted STUN
# docker exec -it easy-asterisk easy-asterisk # Interactive management
# docker exec -it easy-asterisk vpn-diagnostics # VPN diagnostics
# docker exec -it easy-asterisk dns-whitelist # DNS whitelist check
# ================================================================
FROM ubuntu:24.04
ENV DEBIAN_FRONTEND=noninteractive
ENV LANG=C.UTF-8
ENV LANG=en_US.UTF-8 \
LANGUAGE=en_US:en \
LC_ALL=en_US.UTF-8 \
DEBIAN_FRONTEND=noninteractive
# Install Asterisk and all dependencies (matches install_asterisk_packages)
RUN echo "exit 101" > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d && \
apt-get update && \
apt-get install -y --no-install-recommends \
asterisk \
asterisk-core-sounds-en-gsm \
asterisk-modules \
ca-certificates \
openssl \
curl \
wget \
tcpdump \
sngrep \
python3 \
iproute2 \
net-tools \
dnsutils \
iputils-ping \
procps \
lsof \
&& rm -rf /var/lib/apt/lists/* \
&& rm -f /usr/sbin/policy-rc.d \
&& ldconfig \
&& update-ca-certificates 2>/dev/null || true
RUN apt-get update && apt-get install -y --no-install-recommends \
asterisk \
asterisk-core-sounds-en \
asterisk-core-sounds-en-wav \
asterisk-moh-opsound-wav \
tcpdump \
sngrep \
curl \
dnsutils \
iproute2 \
net-tools \
openssl \
python3 \
python3-pip \
python3-bcrypt \
locales \
&& locale-gen en_US.UTF-8 \
&& rm -rf /var/lib/apt/lists/*
# NOTE: Opus transcoding (codec_opus.so) is NOT available on Ubuntu 24.04 due to
# a packaging bug (Launchpad #2044135). The Digium precompiled binary is ABI-incompatible.
# Opus pass-through (phone-to-phone) still works via res_format_attr_opus.so from
# asterisk-modules. Only Opus<->ulaw transcoding is missing, which is rarely needed
# since modern SIP phones all support the same codecs natively.
# NOTE: Opus transcoding (codec_opus.so) is NOT available on Ubuntu 24.04
# due to a packaging bug. Opus pass-through still works via res_format_attr_opus.so.
# Create required directories
RUN mkdir -p \
/etc/easy-asterisk \
/etc/asterisk/certs \
/var/lib/asterisk/static-http \
/var/log/asterisk \
/var/spool/asterisk \
/var/run/asterisk \
RUN mkdir -p /etc/asterisk/certs \
/var/lib/asterisk/static-http \
/var/log/asterisk \
/var/spool/asterisk \
/var/run/asterisk \
&& chown -R asterisk:asterisk \
/etc/asterisk \
/var/lib/asterisk \
/var/log/asterisk \
/var/spool/asterisk \
/var/run/asterisk
/etc/asterisk \
/var/lib/asterisk \
/var/log/asterisk \
/var/spool/asterisk \
/var/run/asterisk
# Docker detection marker (used by is_docker() in the script)
RUN touch /.dockerenv
# Copy the main management script
# Management script and helpers
COPY easy-asterisk-v0.10.0.sh /usr/local/bin/easy-asterisk
RUN chmod +x /usr/local/bin/easy-asterisk
# Copy diagnostic and utility scripts
COPY scripts/vpn-diagnostics.sh /usr/local/bin/vpn-diagnostics
COPY scripts/dns-whitelist.sh /usr/local/bin/dns-whitelist
RUN chmod +x /usr/local/bin/vpn-diagnostics /usr/local/bin/dns-whitelist
# Copy entrypoint
COPY docker/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
RUN chmod +x /usr/local/bin/easy-asterisk \
/usr/local/bin/vpn-diagnostics \
/usr/local/bin/dns-whitelist \
/entrypoint.sh
# SIP signaling
EXPOSE 5060/udp
EXPOSE 5060/tcp
EXPOSE 5061/tcp
# Web admin + provisioning
EXPOSE 8080/tcp
EXPOSE 8088/tcp
EXPOSE 8089/tcp
# STUN (if running coturn in same container; default 3478, configurable via TURN_PORT)
EXPOSE 5060/udp 5060/tcp 5061/tcp
EXPOSE 8080/tcp 8088/tcp 8089/tcp
EXPOSE 3478/udp
# RTP media range (use --network host in production for full range)
# Docker port-mapping 10000 ports is impractical; host networking recommended
EXPOSE 10000-10100/udp
# Persistent data
VOLUME ["/etc/asterisk", "/etc/easy-asterisk", "/var/log/asterisk"]
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
CMD asterisk -rx "core show version" >/dev/null 2>&1 || exit 1
CMD asterisk -rx "core show version" || exit 1
ENTRYPOINT ["/entrypoint.sh"]
vendor/easy-asterisk/docker/coturn-entrypoint.sh
Vendored
+17 -19
View File
@@ -1,26 +1,24 @@
#!/bin/sh
# ================================================================
# Robust coturn entrypoint
#!/bin/bash
# coturn-entrypoint.sh — robust wrapper for the coturn Docker image.
#
# The coturn/coturn Docker image's native entrypoint uses:
# The coturn image's default entrypoint uses:
# exec $(eval "echo $@")
# which is fragile — if DETECT_EXTERNAL_IP's DNS lookup returns empty,
# the eval produces an empty token → "ERROR: CONFIG: Unknown argument:"
# which fails when detect-external-ip returns empty — produces a blank token
# and coturn logs "ERROR: CONFIG: Unknown argument:"
#
# This wrapper reuses the image's detect-external-ip script but avoids
# the eval word-splitting issue. If detection fails, we simply omit
# --external-ip rather than passing a blank argument.
# ================================================================
# This wrapper avoids eval word-splitting and only adds --external-ip when
# an IP is actually obtained.
# Use explicit PUBLIC_IP if provided, otherwise auto-detect
if [ -z "$PUBLIC_IP" ]; then
PUBLIC_IP=$(detect-external-ip 2>/dev/null || true)
set -e
# Use explicitly set PUBLIC_IP, or try auto-detection
ext_ip="${PUBLIC_IP:-}"
if [[ -z "$ext_ip" ]] && command -v detect-external-ip &>/dev/null; then
ext_ip=$(detect-external-ip 2>/dev/null || true)
fi
# Only add --external-ip if we actually have an IP
EXTERNAL_IP_ARG=""
if [ -n "$PUBLIC_IP" ]; then
EXTERNAL_IP_ARG="--external-ip=$PUBLIC_IP"
if [[ -n "$ext_ip" ]]; then
exec turnserver "$@" --external-ip="$ext_ip"
else
exec turnserver "$@"
fi
exec turnserver "$@" $EXTERNAL_IP_ARG
vendor/easy-asterisk/docker/entrypoint.sh
Vendored Regular → Executable
View File
vendor/easy-asterisk/easy-asterisk-v0.10.0.sh
Vendored Regular → Executable
View File
vendor/easy-asterisk/scripts/dns-whitelist.sh
Vendored Regular → Executable
+13 -238
View File
@@ -30,251 +30,26 @@ while [[ $# -gt 0 ]]; do
--linphone) SHOW_LINPHONE=true; SHOW_ALL=false; shift ;;
--help|-h)
echo "Usage: dns-whitelist [OPTIONS]"
echo ""
echo "Options:"
echo " --check Test reachability of each domain"
echo " --sipnetic Show Sipnetic-specific domains"
echo " --linphone Show Linphone-specific domains"
echo " --help Show this help"
exit 0
;;
exit 0 ;;
*) shift ;;
esac
done
print_header() {
echo ""
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
echo -e "${CYAN} $1${NC}"
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
echo ""
}
check_dns() {
local domain="$1"
local port="$2"
local proto="${3:-tcp}"
if $CHECK_MODE; then
# DNS resolution test
if nslookup "$domain" >/dev/null 2>&1; then
echo -e " ${GREEN}✓ DNS resolves${NC}"
else
echo -e " ${RED}✗ DNS BLOCKED - add to whitelist${NC}"
return 1
fi
# Connectivity test
if [[ "$proto" == "udp" ]]; then
# UDP - just check DNS resolution (can't reliably test UDP connectivity)
echo -e " ${CYAN}→ UDP port ${port} (cannot test remotely)${NC}"
else
if curl -s --connect-timeout 5 "https://${domain}" >/dev/null 2>&1 || \
curl -s --connect-timeout 5 "http://${domain}" >/dev/null 2>&1; then
echo -e " ${GREEN}✓ Reachable${NC}"
else
echo -e " ${YELLOW}! Connection failed (may be expected)${NC}"
fi
fi
fi
}
# Load config if available
source "$CONFIG_FILE" 2>/dev/null || true
print_header "DNS Whitelist for Easy Asterisk"
echo -e "${BOLD}Your Setup:${NC}"
if [[ -n "$DOMAIN_NAME" ]]; then
echo -e " Mode: FQDN/Internet (${DOMAIN_NAME})"
else
echo -e " Mode: LAN/VPN (no domain configured)"
fi
echo ""
# ══════════════════════════════════════════════════════════════
# SECTION 1: ASTERISK SERVER DOMAINS
# ══════════════════════════════════════════════════════════════
if $SHOW_ALL; then
echo -e "${BOLD}━━━ 1. ASTERISK SERVER (whitelist on server's DNS filter) ━━━${NC}"
echo ""
echo -e "${BOLD}Required for LAN/VPN mode:${NC}"
echo -e " ${GREEN}None${NC} - Asterisk needs no internet after installation"
echo -e " SIP operates over direct IP connections, no DNS involved"
echo ""
echo -e "${BOLD}Required for FQDN/Internet mode only:${NC}"
echo ""
echo -e " ${CYAN}ifconfig.me${NC} (HTTPS 443)"
echo -e " Purpose: Auto-detect public IP for NAT settings"
echo -e " When: Only during config regeneration"
check_dns "ifconfig.me" "443"
echo ""
echo -e " ${CYAN}icanhazip.com${NC} (HTTPS 443)"
echo -e " Purpose: Fallback public IP detection"
check_dns "icanhazip.com" "443"
echo ""
echo -e "${BOLD}Required if ICE/STUN enabled:${NC}"
echo ""
# Check what STUN server is configured
stun_server=""
if [[ -f /etc/asterisk/rtp.conf ]]; then
stun_server=$(grep "^stunaddr=" /etc/asterisk/rtp.conf 2>/dev/null | cut -d= -f2)
fi
if [[ -n "$stun_server" ]]; then
stun_host=$(echo "$stun_server" | cut -d: -f1)
stun_port=$(echo "$stun_server" | cut -d: -f2)
stun_port="${stun_port:-3478}"
echo -e " ${CYAN}${stun_host}${NC} (UDP ${stun_port})"
echo -e " Purpose: STUN NAT discovery"
echo -e " ${YELLOW}Tip: Use self-hosted coturn to avoid this dependency${NC}"
check_dns "$stun_host" "$stun_port" "udp"
else
echo -e " ${GREEN}No external STUN server configured${NC}"
echo -e " To use self-hosted: docker compose --profile stun up -d"
fi
echo ""
echo -e "${BOLD}Required for package updates only:${NC}"
echo ""
echo -e " ${CYAN}archive.ubuntu.com${NC} / ${CYAN}security.ubuntu.com${NC} (HTTPS 443)"
echo -e " Purpose: apt package updates"
echo -e " When: Only during install/update (not runtime)"
echo ""
echo -e "${BOLD}Required for TLS certificates:${NC}"
echo ""
echo -e " ${CYAN}acme-v02.api.letsencrypt.org${NC} (HTTPS 443)"
echo -e " Purpose: Let's Encrypt certificate issuance"
echo -e " When: Only if using Let's Encrypt / Certbot / Caddy"
if $CHECK_MODE; then
check_dns "acme-v02.api.letsencrypt.org" "443"
fi
echo ""
fi
# ══════════════════════════════════════════════════════════════
# SECTION 2: SIPNETIC (Mobile Client) DOMAINS
# ══════════════════════════════════════════════════════════════
if $SHOW_ALL || $SHOW_SIPNETIC; then
echo -e "${BOLD}━━━ 2. SIPNETIC CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
echo ""
echo -e "${BOLD}Required for SIP calls:${NC}"
echo -e " ${GREEN}None${NC} - Configure Sipnetic with the server's IP address directly"
echo -e " SIP registration and calls use IP:port, not DNS"
echo ""
echo -e "${BOLD}Sipnetic app domains (for app functionality):${NC}"
echo ""
echo -e " ${CYAN}onesip.io${NC} / ${CYAN}api.onesip.io${NC}"
echo -e " Purpose: Sipnetic account/licensing (free tier works offline)"
echo -e " Required: Only for initial setup or account sync"
if $CHECK_MODE; then
check_dns "onesip.io" "443"
fi
echo ""
echo -e " ${CYAN}play.google.com${NC} / ${CYAN}apps.apple.com${NC}"
echo -e " Purpose: App updates"
echo -e " Required: Only for installing/updating the app"
echo ""
echo -e "${BOLD}If STUN configured in Sipnetic:${NC}"
echo ""
echo -e " The STUN server domain configured in Sipnetic's settings"
echo -e " needs to resolve on the mobile device's network."
echo ""
echo -e " ${YELLOW}Recommendation: Use the Asterisk server's VPN IP as STUN${NC}"
echo -e " ${YELLOW}server (if running self-hosted coturn), avoiding DNS entirely.${NC}"
echo ""
echo -e "${BOLD}Sipnetic Configuration for DNS-Filtered Networks:${NC}"
echo ""
echo -e " Server: ${CYAN}<server-vpn-ip>${NC} (not a hostname)"
echo -e " Port: ${CYAN}5060${NC} (UDP, LAN/VPN mode)"
echo -e " Transport: ${CYAN}UDP${NC}"
echo -e " STUN: ${CYAN}<server-vpn-ip>:3478${NC} (if self-hosted coturn)"
echo -e " or leave blank if VPN provides direct routing"
echo ""
fi
# ══════════════════════════════════════════════════════════════
# SECTION 3: LINPHONE (Mobile Client) DOMAINS
# ══════════════════════════════════════════════════════════════
if $SHOW_ALL || $SHOW_LINPHONE; then
echo -e "${BOLD}━━━ 3. LINPHONE CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
echo ""
echo -e "${BOLD}Required for SIP calls:${NC}"
echo -e " ${GREEN}None${NC} - Same as Sipnetic, configure with server IP directly"
echo ""
echo -e "${BOLD}Linphone app domains:${NC}"
echo ""
echo -e " ${CYAN}linphone.org${NC} / ${CYAN}sip.linphone.org${NC}"
echo -e " Purpose: Default Linphone SIP proxy (NOT needed for Easy Asterisk)"
echo -e " Required: ${GREEN}No${NC} - We use our own Asterisk server"
echo ""
echo -e " ${CYAN}subscribe.linphone.org${NC}"
echo -e " Purpose: Push notifications (may be needed for background calls)"
echo -e " Required: Only if you need calls to ring when app is backgrounded"
echo ""
echo -e "${BOLD}For remote provisioning:${NC}"
echo ""
echo -e " If using Easy Asterisk's HTTP provisioning:"
echo -e " The phone must reach ${CYAN}http://<server-ip>:8088/static/linphone.xml${NC}"
echo -e " This is an IP address, so no DNS whitelist needed."
echo ""
fi
# ══════════════════════════════════════════════════════════════
# SECTION 4: SUMMARY
# ══════════════════════════════════════════════════════════════
if $SHOW_ALL; then
print_header "Quick Reference - Minimum DNS Whitelist"
echo -e "${BOLD}For LAN/VPN mode (no internet calling):${NC}"
echo ""
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
echo -e " (Configure everything by IP address)"
echo ""
echo -e "${BOLD}For LAN/VPN + self-hosted STUN (coturn):${NC}"
echo ""
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
echo -e " (STUN server reached by VPN IP, not hostname)"
echo ""
echo -e "${BOLD}For LAN/VPN + Google STUN:${NC}"
echo ""
echo -e " Server DNS filter: ${YELLOW}stun.l.google.com${NC}"
echo -e " Client DNS filter: ${YELLOW}stun.l.google.com${NC} (if also set in Sipnetic)"
echo ""
echo -e "${BOLD}For FQDN/Internet mode:${NC}"
echo ""
echo -e " Server DNS filter: ${YELLOW}ifconfig.me, icanhazip.com, stun.l.google.com${NC}"
echo -e " ${YELLOW}acme-v02.api.letsencrypt.org${NC} (if using LE certs)"
echo -e " Client DNS filter: ${YELLOW}Your domain name (${DOMAIN_NAME:-yourdomain.com})${NC}"
echo ""
print_header "Recommendation for DNS-Filtered Environments"
echo -e " ${GREEN}Use LAN/VPN mode + self-hosted coturn (STUN-only)${NC}"
echo -e " ${GREEN}= Zero external DNS dependencies${NC}"
echo ""
echo -e " Setup: docker compose --profile stun up -d"
echo -e " Then configure STUN as your server's VPN IP:3478"
echo -e " No hostnames, no DNS, everything by IP."
echo ""
fi
echo -e "${CYAN}━━━ DNS Whitelist for Easy Asterisk ━━━${NC}"
echo ""
echo -e "${BOLD}Mode: ${NC}$( [[ -n "$DOMAIN_NAME" ]] && echo "FQDN ($DOMAIN_NAME)" || echo "LAN/VPN (no domain)" )"
echo ""
echo -e "${BOLD}Server DNS filter:${NC}"
echo -e " ifconfig.me, icanhazip.com (public IP detection, FQDN mode only)"
echo -e " acme-v02.api.letsencrypt.org (Let's Encrypt, if used)"
echo ""
echo -e "${BOLD}Client DNS filter (Sipnetic/Linphone):${NC}"
echo -e " LAN/VPN mode: none (configure by IP)"
echo -e " FQDN mode: your domain ($DOMAIN_NAME)"
echo ""
vendor/easy-asterisk/scripts/vpn-diagnostics.sh
Vendored Regular → Executable
+20 -346
View File
@@ -1,366 +1,40 @@
#!/bin/bash
# ================================================================
# VPN Diagnostics for Easy Asterisk
#
# Tests whether your third-party VPN setup needs STUN/TURN
# and validates connectivity between Asterisk and VPN clients.
#
# Validates PJSIP, TLS, ICE, RTP, and device configuration.
# Usage: vpn-diagnostics [--auto] [--client-ip <ip>]
# ================================================================
set -e
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
CYAN='\033[0;36m'
BOLD='\033[1m'
NC='\033[0m'
GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RED='\033[0;31m'; NC='\033[0m'
CONFIG_FILE="/etc/easy-asterisk/config"
RESULTS=()
WARNINGS=()
CLIENT_IP=""
AUTO_MODE=false
# Parse arguments
while [[ $# -gt 0 ]]; do
case "$1" in
--auto) AUTO_MODE=true; shift ;;
--client-ip) CLIENT_IP="$2"; shift 2 ;;
--help|-h)
echo "Usage: vpn-diagnostics [OPTIONS]"
echo ""
echo "Options:"
echo " --auto Non-interactive mode"
echo " --client-ip <ip> Test connectivity to specific VPN client"
echo " --help Show this help"
exit 0
;;
*) shift ;;
esac
done
print_header() {
echo ""
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
echo -e "${CYAN} $1${NC}"
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
echo ""
}
pass() { echo -e " ${GREEN}✓${NC} $1"; RESULTS+=("PASS: $1"); }
fail() { echo -e " ${RED}✗${NC} $1"; RESULTS+=("FAIL: $1"); }
warn() { echo -e " ${YELLOW}!${NC} $1"; WARNINGS+=("$1"); }
info() { echo -e " ${CYAN}→${NC} $1"; }
# ── Test 1: Detect network interfaces ────────────────────────
print_header "VPN Diagnostics for Easy Asterisk"
echo -e "${BOLD}1. Network Interface Detection${NC}"
echo -e "${CYAN}━━━ Easy Asterisk VPN Diagnostics ━━━${NC}"
echo ""
# Detect primary LAN interface
primary_ip=$(hostname -I | awk '{print $1}')
info "Primary IP: ${primary_ip}"
# Detect VPN interfaces (tun, tap, wg, tailscale, utun, ppp)
vpn_found=false
vpn_ips=()
vpn_ifaces=()
while IFS= read -r line; do
iface=$(echo "$line" | awk '{print $2}' | tr -d ':')
ip_addr=$(echo "$line" | awk '{print $4}' | cut -d'/' -f1)
# Check for VPN interface patterns
if [[ "$iface" =~ ^(tun|tap|wg|tailscale|utun|ppp|nordlynx|proton|mullvad) ]] || \
[[ "$ip_addr" =~ ^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|100\.64\.|100\.96\.|100\.100\.) ]]; then
vpn_found=true
vpn_ips+=("$ip_addr")
vpn_ifaces+=("$iface")
pass "VPN interface detected: ${iface} (${ip_addr})"
fi
done < <(ip -o -f inet addr show scope global 2>/dev/null)
if ! $vpn_found; then
warn "No VPN interface detected on server"
info "If your VPN runs on the router (not this server), that's expected"
info "The VPN subnet should be added via VLAN/VPN subnet configuration"
# Check Asterisk is running
if ! asterisk -rx "core show version" &>/dev/null; then
echo -e "${RED}✗ Asterisk is not running${NC}"; exit 1
fi
echo -e "${GREEN}✓ Asterisk running:${NC} $(asterisk -rx "core show version" 2>/dev/null)"
# ── Test 2: Check Asterisk PJSIP transport configuration ─────
# Check transports
echo ""
echo -e "${BOLD}2. Asterisk Transport Configuration${NC}"
echo -e "${CYAN}Transports:${NC}"
asterisk -rx "pjsip show transports" 2>/dev/null || true
# Check registered endpoints
echo ""
if [[ -f /etc/asterisk/pjsip.conf ]]; then
# Check local_net entries
local_nets=$(grep "^local_net=" /etc/asterisk/pjsip.conf 2>/dev/null | sort -u)
if [[ -n "$local_nets" ]]; then
while IFS= read -r net; do
info "Transport local_net: ${net#local_net=}"
done <<< "$local_nets"
# Check if VPN subnets are included
for vpn_ip in "${vpn_ips[@]}"; do
vpn_subnet=$(echo "$vpn_ip" | sed 's/\.[0-9]*$/.0\/24/')
if echo "$local_nets" | grep -q "$vpn_subnet"; then
pass "VPN subnet ${vpn_subnet} included in transport"
else
fail "VPN subnet ${vpn_subnet} NOT in transport local_net"
warn "Add via: Server Settings → Configure VLAN/VPN Subnets"
fi
done
else
warn "No local_net entries found in transport (basic LAN mode)"
fi
# Check transport types
if grep -q "transport=transport-udp" /etc/asterisk/pjsip.conf; then
pass "UDP transport configured for LAN/VPN devices"
fi
if grep -q "transport=transport-tls" /etc/asterisk/pjsip.conf; then
pass "TLS transport configured for FQDN devices"
fi
else
fail "pjsip.conf not found"
fi
# ── Test 2b: TLS Certificate & Port Checks ────────────────────
echo ""
echo -e "${BOLD}2b. TLS / Certificate Status${NC}"
echo ""
# Check if port 5061 is actually listening
if command -v ss &>/dev/null; then
tls_listen=$(ss -tlnp 2>/dev/null | grep ":5061 " || true)
elif command -v netstat &>/dev/null; then
tls_listen=$(netstat -tlnp 2>/dev/null | grep ":5061 " || true)
else
tls_listen=""
fi
if [[ -n "$tls_listen" ]]; then
pass "Port 5061 (TLS) is listening"
else
fail "Port 5061 (TLS) is NOT listening"
warn "Asterisk TLS transport failed to start — check certs and logs"
fi
echo -e "${CYAN}Endpoints:${NC}"
asterisk -rx "pjsip show endpoints" 2>/dev/null || true
# Check TLS cert
cert_file="/etc/asterisk/certs/server.crt"
if [[ -f "$cert_file" ]]; then
pass "TLS certificate exists: $cert_file"
# Check cert CN/SAN
cert_cn=$(openssl x509 -in "$cert_file" -noout -subject 2>/dev/null | sed 's/.*CN *= *//')
cert_san=$(openssl x509 -in "$cert_file" -noout -ext subjectAltName 2>/dev/null | grep -oP 'DNS:\K[^,]+' || true)
cert_expiry=$(openssl x509 -in "$cert_file" -noout -enddate 2>/dev/null | cut -d= -f2)
info "Cert CN: ${cert_cn:-unknown}"
if [[ -n "$cert_san" ]]; then
pass "Cert has SAN (Subject Alt Name): ${cert_san}"
else
fail "Cert has NO SAN — modern phones (iOS/Android) will reject it"
warn "Delete /etc/asterisk/certs/server.crt and restart to regenerate with SANs"
fi
info "Cert expires: ${cert_expiry:-unknown}"
# Check if cert is self-signed
issuer=$(openssl x509 -in "$cert_file" -noout -issuer 2>/dev/null | sed 's/.*CN *= *//')
if [[ "$issuer" == "$cert_cn" ]]; then
warn "Cert is SELF-SIGNED — phones must be set to accept self-signed certs"
info "In your SIP app: disable TLS certificate verification / allow self-signed"
fi
# Verify PJSIP transport loaded it
if command -v asterisk &>/dev/null; then
transport_status=$(asterisk -rx "pjsip show transports" 2>/dev/null || true)
if echo "$transport_status" | grep -q "transport-tls"; then
pass "PJSIP TLS transport is loaded"
else
fail "PJSIP TLS transport NOT loaded — cert may be invalid"
fi
fi
else
fail "TLS certificate not found at $cert_file"
fi
# ── Test 3: Check RTP and ICE/STUN configuration ─────────────
echo ""
echo -e "${BOLD}3. RTP / ICE / STUN Configuration${NC}"
echo ""
if [[ -f /etc/asterisk/rtp.conf ]]; then
rtp_start=$(grep "^rtpstart=" /etc/asterisk/rtp.conf | cut -d= -f2)
rtp_end=$(grep "^rtpend=" /etc/asterisk/rtp.conf | cut -d= -f2)
info "RTP port range: ${rtp_start:-10000}-${rtp_end:-20000}"
if grep -q "^icesupport=yes" /etc/asterisk/rtp.conf; then
pass "ICE support enabled"
stun_addr=$(grep "^stunaddr=" /etc/asterisk/rtp.conf | cut -d= -f2)
if [[ -n "$stun_addr" ]]; then
info "STUN server: ${stun_addr}"
# Test STUN server reachability
stun_host=$(echo "$stun_addr" | cut -d: -f1)
stun_port=$(echo "$stun_addr" | cut -d: -f2)
stun_port="${stun_port:-3478}"
if command -v nslookup &>/dev/null && nslookup "$stun_host" >/dev/null 2>&1; then
pass "STUN server DNS resolves: ${stun_host}"
else
fail "Cannot resolve STUN server: ${stun_host}"
warn "Add ${stun_host} to DNS whitelist"
fi
fi
else
info "ICE support disabled (standard for LAN/VPN mode)"
warn "If audio fails over VPN, enable ICE via: Server Settings → VPN STUN/ICE"
fi
else
warn "rtp.conf not found"
fi
# ── Test 4: Check endpoint ICE settings ───────────────────────
echo ""
echo -e "${BOLD}4. Per-Device ICE Configuration${NC}"
echo ""
if [[ -f /etc/asterisk/pjsip.conf ]]; then
device_count=$(grep -c "^; === Device:" /etc/asterisk/pjsip.conf 2>/dev/null || echo 0)
ice_device_count=$(grep -c "^ice_support=yes" /etc/asterisk/pjsip.conf 2>/dev/null || echo 0)
info "Total devices: ${device_count}"
info "Devices with ICE: ${ice_device_count}"
if [[ "$device_count" -gt 0 && "$ice_device_count" -eq 0 ]]; then
warn "No devices have ICE enabled"
info "For third-party VPNs with NAT, enable ICE via VPN STUN/ICE menu"
fi
fi
# ── Test 5: VPN client connectivity ──────────────────────────
echo ""
echo -e "${BOLD}5. VPN Client Connectivity${NC}"
echo ""
if [[ -z "$CLIENT_IP" ]] && ! $AUTO_MODE; then
echo " Enter a VPN client IP to test connectivity (or press Enter to skip):"
read -p " Client VPN IP: " CLIENT_IP
fi
if [[ -n "$CLIENT_IP" ]]; then
# Ping test
if ping -c 2 -W 3 "$CLIENT_IP" >/dev/null 2>&1; then
pass "Ping to ${CLIENT_IP} succeeded"
else
fail "Ping to ${CLIENT_IP} failed"
warn "VPN routing issue - client may not be reachable"
fi
# SIP port test (UDP 5060)
if command -v nc &>/dev/null; then
if nc -z -u -w 3 "$CLIENT_IP" 5060 2>/dev/null; then
pass "UDP 5060 reachable on ${CLIENT_IP}"
else
info "UDP 5060 probe inconclusive (normal for filtered VPNs)"
fi
fi
else
info "Skipping client connectivity test (no IP provided)"
fi
# ── Test 6: NAT type detection ───────────────────────────────
echo ""
echo -e "${BOLD}6. NAT Type Analysis${NC}"
echo ""
# Check if server is behind NAT
if [[ -n "$primary_ip" ]]; then
public_ip=$(curl -s -4 --connect-timeout 5 ifconfig.me 2>/dev/null || echo "")
if [[ -n "$public_ip" ]]; then
if [[ "$primary_ip" == "$public_ip" ]]; then
pass "Server has public IP (no NAT)"
else
info "Server behind NAT: ${primary_ip} → ${public_ip}"
info "This is normal for VPN setups where traffic stays on VPN"
fi
else
info "Cannot detect public IP (DNS filtering or no internet)"
info "Not needed for LAN/VPN mode"
fi
fi
# ── Test 7: Asterisk registration status ─────────────────────
echo ""
echo -e "${BOLD}7. Asterisk Registration Status${NC}"
echo ""
if command -v asterisk &>/dev/null; then
reg_output=$(asterisk -rx "pjsip show endpoints" 2>/dev/null || echo "")
if [[ -n "$reg_output" ]]; then
online_count=$(echo "$reg_output" | grep -c "Avail" 2>/dev/null || echo 0)
offline_count=$(echo "$reg_output" | grep -c "Unavail" 2>/dev/null || echo 0)
info "Endpoints online: ${online_count}"
info "Endpoints offline: ${offline_count}"
if [[ "$offline_count" -gt 0 ]]; then
warn "Some endpoints are offline - check VPN connectivity"
echo "$reg_output" | grep "Unavail" | while IFS= read -r line; do
info " Offline: $line"
done
fi
else
info "Asterisk not running or no endpoints configured"
fi
else
info "Asterisk CLI not available"
fi
# ── Summary ──────────────────────────────────────────────────
print_header "Diagnostic Summary"
fail_count=0
pass_count=0
for result in "${RESULTS[@]}"; do
if [[ "$result" == FAIL* ]]; then
((fail_count++))
elif [[ "$result" == PASS* ]]; then
((pass_count++))
fi
done
echo -e " Passed: ${GREEN}${pass_count}${NC}"
echo -e " Failed: ${RED}${fail_count}${NC}"
echo -e " Warnings: ${YELLOW}${#WARNINGS[@]}${NC}"
if [[ ${#WARNINGS[@]} -gt 0 ]]; then
echo ""
echo -e "${BOLD}Recommendations:${NC}"
for w in "${WARNINGS[@]}"; do
echo -e " ${YELLOW}→${NC} $w"
done
fi
# ── STUN Recommendation ─────────────────────────────────────
echo ""
echo -e "${BOLD}Do you need STUN?${NC}"
echo ""
if $vpn_found; then
echo -e " VPN detected on this server."
echo -e " ${GREEN}If your VPN provides direct routing (both sides get VPN IPs),${NC}"
echo -e " ${GREEN}STUN is likely NOT needed.${NC}"
echo ""
echo -e " ${YELLOW}If audio works one-way or not at all, enable STUN:${NC}"
echo -e " 1. docker compose --profile stun up -d (self-hosted STUN)"
echo -e " 2. Or via easy-asterisk: Server Settings → VPN STUN/ICE"
else
echo -e " No VPN interface found on server."
echo -e " ${YELLOW}If VPN runs on router/firewall:${NC}"
echo -e " - Add VPN subnet via: Server Settings → VLAN/VPN Subnets"
echo -e " - If audio still fails, enable STUN for NAT traversal"
if [[ -f /etc/asterisk/certs/server.crt ]]; then
exp=$(openssl x509 -in /etc/asterisk/certs/server.crt -noout -enddate 2>/dev/null | cut -d= -f2)
echo -e "${GREEN}✓ TLS cert:${NC} expires $exp"
openssl x509 -in /etc/asterisk/certs/server.crt -noout -ext subjectAltName 2>/dev/null | grep -q "DNS:" \
&& echo -e "${GREEN}✓ SANs present (mobile-compatible)${NC}" \
|| echo -e "${YELLOW}! No SANs — mobile clients may reject cert${NC}"
fi
echo ""