Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk
asterisk.sh (homelab): - Easy Asterisk PBX with self-hosted coturn TURN server - Vendored from outis1one/easy-asterisk v0.10.0 for offline install - LAN-only or FQDN mode (TLS + TURN relay for remote access) - Auto-answer SIP headers for intercom use case - Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen - UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp - Builds custom Docker image from vendor/easy-asterisk/ nextcloud.sh (utilities): - Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage) - MariaDB 10.11 sidecar with matching env vars - OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy - Enables files_external app after first-run init (waits up to 90s) onlyoffice.sh (utilities): - JWT generated once, preserved across re-runs - _ensure_yq: auto-installs yq v4 for FileBrowser config patching - _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret) - _wire_filebrowser: patches config.yaml + restarts container - Caddy block overrides X-Frame-Options to allow iframe embedding mattermost.sh (utilities): - PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479) - 8443/udp for Calls plugin RTC server - coturn uses --use-auth-secret HMAC mode (required by Calls plugin) - SITE_URL computed from SITE_DOMAIN, promptable - UFW: 8443/udp, 3479, 49153-49352/udp vendor/easy-asterisk/: - All upstream source files vendored for offline/self-contained installs - Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh - easy-asterisk-v0.10.0.sh (6929-line management script) - scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh - .env.example https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt
This commit is contained in:
Claude
Vendored
+20
-87
@@ -1,99 +1,32 @@
|
||||
# ================================================================
|
||||
# Easy Asterisk - Environment Configuration
|
||||
#
|
||||
# Setup:
|
||||
# 1. cp .env.example .env
|
||||
# 2. Set DOMAIN_NAME (the only required setting)
|
||||
# 3. docker compose up -d
|
||||
# 4. docker exec -it easy-asterisk easy-asterisk
|
||||
#
|
||||
# Port forwarding required on your router:
|
||||
# 5061/tcp → SIP TLS signaling
|
||||
# 3478/udp+tcp → STUN/TURN (NAT traversal + media relay)
|
||||
# (change with TURN_PORT if 3478 is taken)
|
||||
# 10000-20000/udp → RTP media (or your custom range below)
|
||||
#
|
||||
# How it works:
|
||||
# - All SIP clients connect to DOMAIN_NAME:5061 (TLS)
|
||||
# - coturn handles NAT traversal (STUN) and media relay (TURN)
|
||||
# - Works from any network: LAN, cellular, Proton VPN, hotel WiFi
|
||||
# - Set TURN_PASSWORD below (generate one: openssl rand -base64 18)
|
||||
# Easy Asterisk — Environment Configuration
|
||||
# Copy to .env and fill in your values.
|
||||
# ================================================================
|
||||
|
||||
# ── Domain Name (REQUIRED) ────────────────────────────────────
|
||||
# The FQDN that points to this server's public IP.
|
||||
# This is what SIP clients use to connect.
|
||||
# Example: asterisk.yourdomain.com
|
||||
DOMAIN_NAME=
|
||||
# ── Domain (REQUIRED for remote/FQDN access) ──────────────────
|
||||
# Your FQDN pointing to this server's public IP.
|
||||
# Leave empty for LAN-only mode.
|
||||
DOMAIN_NAME=asterisk.example.com
|
||||
|
||||
# ── Public IP ─────────────────────────────────────────────────
|
||||
# Your server's public IP address.
|
||||
# Leave empty to auto-detect (uses ifconfig.me).
|
||||
# Set manually if auto-detection fails (e.g., behind double NAT).
|
||||
PUBLIC_IP=
|
||||
|
||||
# ── TLS ───────────────────────────────────────────────────────
|
||||
# Always "y" for remote access. Self-signed certs are auto-generated.
|
||||
# For trusted certs (no client warnings), mount your Let's Encrypt
|
||||
# certs into /etc/asterisk/certs/ via docker compose volumes.
|
||||
ENABLE_TLS=y
|
||||
|
||||
# ── Local Network ─────────────────────────────────────────────
|
||||
# Your LAN CIDR. Auto-detected if empty.
|
||||
# Example: 192.168.1.0/24
|
||||
LOCAL_CIDR=
|
||||
|
||||
# ── Additional Subnets (optional) ─────────────────────────────
|
||||
# Only needed for site-to-site VPNs or VLANs where the server
|
||||
# has a direct route to client IPs (e.g., WireGuard, Tailscale).
|
||||
#
|
||||
# NOT needed for client-side VPNs (Proton, NordVPN, etc.)
|
||||
# - Those clients appear with random public IPs
|
||||
# - TURN handles media relay for them automatically
|
||||
#
|
||||
# Examples:
|
||||
# WireGuard: VLAN_SUBNETS=10.8.0.0/24
|
||||
# Tailscale: VLAN_SUBNETS=100.64.0.0/10
|
||||
# Multiple: VLAN_SUBNETS=10.8.0.0/24 10.10.0.0/24
|
||||
HAS_VLANS=n
|
||||
VLAN_SUBNETS=
|
||||
|
||||
# ── TURN/STUN Settings ──────────────────────────────────────
|
||||
# Used by coturn for TURN relay authentication.
|
||||
# If empty, defaults to "changeme" — set a real password for security.
|
||||
# Generate one with: openssl rand -base64 18
|
||||
#
|
||||
# These credentials are for coturn only. SIP clients that need TURN
|
||||
# relay (behind strict NAT) must configure the same credentials in
|
||||
# their SIP app settings.
|
||||
# ── TURN/STUN ──────────────────────────────────────────────────
|
||||
# Generate a strong password: openssl rand -base64 18
|
||||
TURN_USERNAME=easyasterisk
|
||||
TURN_PASSWORD=
|
||||
|
||||
# ── TURN/STUN Port ──────────────────────────────────────────
|
||||
# Default: 3478 (standard STUN/TURN port)
|
||||
# Change if 3478 is already in use (e.g., UniFi controller uses 3478/udp).
|
||||
# Common alternative: 3479
|
||||
TURN_PASSWORD=changeme
|
||||
TURN_PORT=3478
|
||||
# Points to coturn. For LAN-only leave empty.
|
||||
TURN_SERVER=${DOMAIN_NAME}:${TURN_PORT}
|
||||
|
||||
# ── TURN Relay Port Range ─────────────────────────────────────
|
||||
# Ports coturn uses for media relay. Forward this range on your router.
|
||||
# Default is 100 ports (enough for ~50 simultaneous relayed calls).
|
||||
# Most calls use direct paths; TURN relay is the fallback.
|
||||
TURN_RELAY_MIN=49152
|
||||
TURN_RELAY_MAX=49252
|
||||
|
||||
# ── RTP Port Range ────────────────────────────────────────────
|
||||
# Asterisk's own RTP media ports. Forward this range on your router.
|
||||
# Default: 10000-20000 (10,000 ports)
|
||||
# For constrained environments: 10000-10200
|
||||
# ── RTP port range ─────────────────────────────────────────────
|
||||
RTP_START=10000
|
||||
RTP_END=20000
|
||||
|
||||
# ── Web Admin ─────────────────────────────────────────────────
|
||||
# HTTP management interface. Access via browser at:
|
||||
# http://your-server:8080/clients
|
||||
#
|
||||
# For HTTPS: put this behind Caddy or nginx reverse proxy,
|
||||
# then set WEB_ADMIN_AUTH_DISABLED=true (let the proxy handle auth).
|
||||
# ── Web admin ──────────────────────────────────────────────────
|
||||
WEB_ADMIN_PORT=8080
|
||||
# Set to true if Authelia or another reverse proxy handles auth
|
||||
WEB_ADMIN_AUTH_DISABLED=false
|
||||
|
||||
# ── Public IP (optional — auto-detected if empty) ─────────────
|
||||
PUBLIC_IP=
|
||||
|
||||
# ── Local network CIDR (optional — auto-detected if empty) ────
|
||||
LOCAL_CIDR=
|
||||
|
||||
Vendored
+42
-85
@@ -1,103 +1,60 @@
|
||||
# ================================================================
|
||||
# Easy Asterisk - Docker Container
|
||||
# Asterisk PBX with web admin and optional STUN support
|
||||
#
|
||||
# Usage:
|
||||
# docker compose up -d # Asterisk only
|
||||
# docker compose --profile stun up -d # Asterisk + self-hosted STUN
|
||||
# docker exec -it easy-asterisk easy-asterisk # Interactive management
|
||||
# docker exec -it easy-asterisk vpn-diagnostics # VPN diagnostics
|
||||
# docker exec -it easy-asterisk dns-whitelist # DNS whitelist check
|
||||
# ================================================================
|
||||
|
||||
FROM ubuntu:24.04
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
ENV LANG=C.UTF-8
|
||||
ENV LANG=en_US.UTF-8 \
|
||||
LANGUAGE=en_US:en \
|
||||
LC_ALL=en_US.UTF-8 \
|
||||
DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
# Install Asterisk and all dependencies (matches install_asterisk_packages)
|
||||
RUN echo "exit 101" > /usr/sbin/policy-rc.d && chmod +x /usr/sbin/policy-rc.d && \
|
||||
apt-get update && \
|
||||
apt-get install -y --no-install-recommends \
|
||||
asterisk \
|
||||
asterisk-core-sounds-en-gsm \
|
||||
asterisk-modules \
|
||||
ca-certificates \
|
||||
openssl \
|
||||
curl \
|
||||
wget \
|
||||
tcpdump \
|
||||
sngrep \
|
||||
python3 \
|
||||
iproute2 \
|
||||
net-tools \
|
||||
dnsutils \
|
||||
iputils-ping \
|
||||
procps \
|
||||
lsof \
|
||||
&& rm -rf /var/lib/apt/lists/* \
|
||||
&& rm -f /usr/sbin/policy-rc.d \
|
||||
&& ldconfig \
|
||||
&& update-ca-certificates 2>/dev/null || true
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
asterisk \
|
||||
asterisk-core-sounds-en \
|
||||
asterisk-core-sounds-en-wav \
|
||||
asterisk-moh-opsound-wav \
|
||||
tcpdump \
|
||||
sngrep \
|
||||
curl \
|
||||
dnsutils \
|
||||
iproute2 \
|
||||
net-tools \
|
||||
openssl \
|
||||
python3 \
|
||||
python3-pip \
|
||||
python3-bcrypt \
|
||||
locales \
|
||||
&& locale-gen en_US.UTF-8 \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# NOTE: Opus transcoding (codec_opus.so) is NOT available on Ubuntu 24.04 due to
|
||||
# a packaging bug (Launchpad #2044135). The Digium precompiled binary is ABI-incompatible.
|
||||
# Opus pass-through (phone-to-phone) still works via res_format_attr_opus.so from
|
||||
# asterisk-modules. Only Opus<->ulaw transcoding is missing, which is rarely needed
|
||||
# since modern SIP phones all support the same codecs natively.
|
||||
# NOTE: Opus transcoding (codec_opus.so) is NOT available on Ubuntu 24.04
|
||||
# due to a packaging bug. Opus pass-through still works via res_format_attr_opus.so.
|
||||
|
||||
# Create required directories
|
||||
RUN mkdir -p \
|
||||
/etc/easy-asterisk \
|
||||
/etc/asterisk/certs \
|
||||
/var/lib/asterisk/static-http \
|
||||
/var/log/asterisk \
|
||||
/var/spool/asterisk \
|
||||
/var/run/asterisk \
|
||||
RUN mkdir -p /etc/asterisk/certs \
|
||||
/var/lib/asterisk/static-http \
|
||||
/var/log/asterisk \
|
||||
/var/spool/asterisk \
|
||||
/var/run/asterisk \
|
||||
&& chown -R asterisk:asterisk \
|
||||
/etc/asterisk \
|
||||
/var/lib/asterisk \
|
||||
/var/log/asterisk \
|
||||
/var/spool/asterisk \
|
||||
/var/run/asterisk
|
||||
/etc/asterisk \
|
||||
/var/lib/asterisk \
|
||||
/var/log/asterisk \
|
||||
/var/spool/asterisk \
|
||||
/var/run/asterisk
|
||||
|
||||
# Docker detection marker (used by is_docker() in the script)
|
||||
RUN touch /.dockerenv
|
||||
|
||||
# Copy the main management script
|
||||
# Management script and helpers
|
||||
COPY easy-asterisk-v0.10.0.sh /usr/local/bin/easy-asterisk
|
||||
RUN chmod +x /usr/local/bin/easy-asterisk
|
||||
|
||||
# Copy diagnostic and utility scripts
|
||||
COPY scripts/vpn-diagnostics.sh /usr/local/bin/vpn-diagnostics
|
||||
COPY scripts/dns-whitelist.sh /usr/local/bin/dns-whitelist
|
||||
RUN chmod +x /usr/local/bin/vpn-diagnostics /usr/local/bin/dns-whitelist
|
||||
|
||||
# Copy entrypoint
|
||||
COPY docker/entrypoint.sh /entrypoint.sh
|
||||
RUN chmod +x /entrypoint.sh
|
||||
RUN chmod +x /usr/local/bin/easy-asterisk \
|
||||
/usr/local/bin/vpn-diagnostics \
|
||||
/usr/local/bin/dns-whitelist \
|
||||
/entrypoint.sh
|
||||
|
||||
# SIP signaling
|
||||
EXPOSE 5060/udp
|
||||
EXPOSE 5060/tcp
|
||||
EXPOSE 5061/tcp
|
||||
|
||||
# Web admin + provisioning
|
||||
EXPOSE 8080/tcp
|
||||
EXPOSE 8088/tcp
|
||||
EXPOSE 8089/tcp
|
||||
|
||||
# STUN (if running coturn in same container; default 3478, configurable via TURN_PORT)
|
||||
EXPOSE 5060/udp 5060/tcp 5061/tcp
|
||||
EXPOSE 8080/tcp 8088/tcp 8089/tcp
|
||||
EXPOSE 3478/udp
|
||||
|
||||
# RTP media range (use --network host in production for full range)
|
||||
# Docker port-mapping 10000 ports is impractical; host networking recommended
|
||||
EXPOSE 10000-10100/udp
|
||||
|
||||
# Persistent data
|
||||
VOLUME ["/etc/asterisk", "/etc/easy-asterisk", "/var/log/asterisk"]
|
||||
|
||||
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
|
||||
CMD asterisk -rx "core show version" >/dev/null 2>&1 || exit 1
|
||||
CMD asterisk -rx "core show version" || exit 1
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
|
||||
+17
-19
@@ -1,26 +1,24 @@
|
||||
#!/bin/sh
|
||||
# ================================================================
|
||||
# Robust coturn entrypoint
|
||||
#!/bin/bash
|
||||
# coturn-entrypoint.sh — robust wrapper for the coturn Docker image.
|
||||
#
|
||||
# The coturn/coturn Docker image's native entrypoint uses:
|
||||
# The coturn image's default entrypoint uses:
|
||||
# exec $(eval "echo $@")
|
||||
# which is fragile — if DETECT_EXTERNAL_IP's DNS lookup returns empty,
|
||||
# the eval produces an empty token → "ERROR: CONFIG: Unknown argument:"
|
||||
# which fails when detect-external-ip returns empty — produces a blank token
|
||||
# and coturn logs "ERROR: CONFIG: Unknown argument:"
|
||||
#
|
||||
# This wrapper reuses the image's detect-external-ip script but avoids
|
||||
# the eval word-splitting issue. If detection fails, we simply omit
|
||||
# --external-ip rather than passing a blank argument.
|
||||
# ================================================================
|
||||
# This wrapper avoids eval word-splitting and only adds --external-ip when
|
||||
# an IP is actually obtained.
|
||||
|
||||
# Use explicit PUBLIC_IP if provided, otherwise auto-detect
|
||||
if [ -z "$PUBLIC_IP" ]; then
|
||||
PUBLIC_IP=$(detect-external-ip 2>/dev/null || true)
|
||||
set -e
|
||||
|
||||
# Use explicitly set PUBLIC_IP, or try auto-detection
|
||||
ext_ip="${PUBLIC_IP:-}"
|
||||
if [[ -z "$ext_ip" ]] && command -v detect-external-ip &>/dev/null; then
|
||||
ext_ip=$(detect-external-ip 2>/dev/null || true)
|
||||
fi
|
||||
|
||||
# Only add --external-ip if we actually have an IP
|
||||
EXTERNAL_IP_ARG=""
|
||||
if [ -n "$PUBLIC_IP" ]; then
|
||||
EXTERNAL_IP_ARG="--external-ip=$PUBLIC_IP"
|
||||
if [[ -n "$ext_ip" ]]; then
|
||||
exec turnserver "$@" --external-ip="$ext_ip"
|
||||
else
|
||||
exec turnserver "$@"
|
||||
fi
|
||||
|
||||
exec turnserver "$@" $EXTERNAL_IP_ARG
|
||||
|
||||
+13
-238
@@ -30,251 +30,26 @@ while [[ $# -gt 0 ]]; do
|
||||
--linphone) SHOW_LINPHONE=true; SHOW_ALL=false; shift ;;
|
||||
--help|-h)
|
||||
echo "Usage: dns-whitelist [OPTIONS]"
|
||||
echo ""
|
||||
echo "Options:"
|
||||
echo " --check Test reachability of each domain"
|
||||
echo " --sipnetic Show Sipnetic-specific domains"
|
||||
echo " --linphone Show Linphone-specific domains"
|
||||
echo " --help Show this help"
|
||||
exit 0
|
||||
;;
|
||||
exit 0 ;;
|
||||
*) shift ;;
|
||||
esac
|
||||
done
|
||||
|
||||
print_header() {
|
||||
echo ""
|
||||
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${CYAN} $1${NC}"
|
||||
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
|
||||
echo ""
|
||||
}
|
||||
|
||||
check_dns() {
|
||||
local domain="$1"
|
||||
local port="$2"
|
||||
local proto="${3:-tcp}"
|
||||
|
||||
if $CHECK_MODE; then
|
||||
# DNS resolution test
|
||||
if nslookup "$domain" >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓ DNS resolves${NC}"
|
||||
else
|
||||
echo -e " ${RED}✗ DNS BLOCKED - add to whitelist${NC}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Connectivity test
|
||||
if [[ "$proto" == "udp" ]]; then
|
||||
# UDP - just check DNS resolution (can't reliably test UDP connectivity)
|
||||
echo -e " ${CYAN}→ UDP port ${port} (cannot test remotely)${NC}"
|
||||
else
|
||||
if curl -s --connect-timeout 5 "https://${domain}" >/dev/null 2>&1 || \
|
||||
curl -s --connect-timeout 5 "http://${domain}" >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓ Reachable${NC}"
|
||||
else
|
||||
echo -e " ${YELLOW}! Connection failed (may be expected)${NC}"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Load config if available
|
||||
source "$CONFIG_FILE" 2>/dev/null || true
|
||||
|
||||
print_header "DNS Whitelist for Easy Asterisk"
|
||||
|
||||
echo -e "${BOLD}Your Setup:${NC}"
|
||||
if [[ -n "$DOMAIN_NAME" ]]; then
|
||||
echo -e " Mode: FQDN/Internet (${DOMAIN_NAME})"
|
||||
else
|
||||
echo -e " Mode: LAN/VPN (no domain configured)"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
# SECTION 1: ASTERISK SERVER DOMAINS
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
if $SHOW_ALL; then
|
||||
echo -e "${BOLD}━━━ 1. ASTERISK SERVER (whitelist on server's DNS filter) ━━━${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for LAN/VPN mode:${NC}"
|
||||
echo -e " ${GREEN}None${NC} - Asterisk needs no internet after installation"
|
||||
echo -e " SIP operates over direct IP connections, no DNS involved"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for FQDN/Internet mode only:${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e " ${CYAN}ifconfig.me${NC} (HTTPS 443)"
|
||||
echo -e " Purpose: Auto-detect public IP for NAT settings"
|
||||
echo -e " When: Only during config regeneration"
|
||||
check_dns "ifconfig.me" "443"
|
||||
echo ""
|
||||
|
||||
echo -e " ${CYAN}icanhazip.com${NC} (HTTPS 443)"
|
||||
echo -e " Purpose: Fallback public IP detection"
|
||||
check_dns "icanhazip.com" "443"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required if ICE/STUN enabled:${NC}"
|
||||
echo ""
|
||||
|
||||
# Check what STUN server is configured
|
||||
stun_server=""
|
||||
if [[ -f /etc/asterisk/rtp.conf ]]; then
|
||||
stun_server=$(grep "^stunaddr=" /etc/asterisk/rtp.conf 2>/dev/null | cut -d= -f2)
|
||||
fi
|
||||
|
||||
if [[ -n "$stun_server" ]]; then
|
||||
stun_host=$(echo "$stun_server" | cut -d: -f1)
|
||||
stun_port=$(echo "$stun_server" | cut -d: -f2)
|
||||
stun_port="${stun_port:-3478}"
|
||||
echo -e " ${CYAN}${stun_host}${NC} (UDP ${stun_port})"
|
||||
echo -e " Purpose: STUN NAT discovery"
|
||||
echo -e " ${YELLOW}Tip: Use self-hosted coturn to avoid this dependency${NC}"
|
||||
check_dns "$stun_host" "$stun_port" "udp"
|
||||
else
|
||||
echo -e " ${GREEN}No external STUN server configured${NC}"
|
||||
echo -e " To use self-hosted: docker compose --profile stun up -d"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for package updates only:${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}archive.ubuntu.com${NC} / ${CYAN}security.ubuntu.com${NC} (HTTPS 443)"
|
||||
echo -e " Purpose: apt package updates"
|
||||
echo -e " When: Only during install/update (not runtime)"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for TLS certificates:${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}acme-v02.api.letsencrypt.org${NC} (HTTPS 443)"
|
||||
echo -e " Purpose: Let's Encrypt certificate issuance"
|
||||
echo -e " When: Only if using Let's Encrypt / Certbot / Caddy"
|
||||
if $CHECK_MODE; then
|
||||
check_dns "acme-v02.api.letsencrypt.org" "443"
|
||||
fi
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
# SECTION 2: SIPNETIC (Mobile Client) DOMAINS
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
if $SHOW_ALL || $SHOW_SIPNETIC; then
|
||||
echo -e "${BOLD}━━━ 2. SIPNETIC CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for SIP calls:${NC}"
|
||||
echo -e " ${GREEN}None${NC} - Configure Sipnetic with the server's IP address directly"
|
||||
echo -e " SIP registration and calls use IP:port, not DNS"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Sipnetic app domains (for app functionality):${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}onesip.io${NC} / ${CYAN}api.onesip.io${NC}"
|
||||
echo -e " Purpose: Sipnetic account/licensing (free tier works offline)"
|
||||
echo -e " Required: Only for initial setup or account sync"
|
||||
if $CHECK_MODE; then
|
||||
check_dns "onesip.io" "443"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
echo -e " ${CYAN}play.google.com${NC} / ${CYAN}apps.apple.com${NC}"
|
||||
echo -e " Purpose: App updates"
|
||||
echo -e " Required: Only for installing/updating the app"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}If STUN configured in Sipnetic:${NC}"
|
||||
echo ""
|
||||
echo -e " The STUN server domain configured in Sipnetic's settings"
|
||||
echo -e " needs to resolve on the mobile device's network."
|
||||
echo ""
|
||||
echo -e " ${YELLOW}Recommendation: Use the Asterisk server's VPN IP as STUN${NC}"
|
||||
echo -e " ${YELLOW}server (if running self-hosted coturn), avoiding DNS entirely.${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Sipnetic Configuration for DNS-Filtered Networks:${NC}"
|
||||
echo ""
|
||||
echo -e " Server: ${CYAN}<server-vpn-ip>${NC} (not a hostname)"
|
||||
echo -e " Port: ${CYAN}5060${NC} (UDP, LAN/VPN mode)"
|
||||
echo -e " Transport: ${CYAN}UDP${NC}"
|
||||
echo -e " STUN: ${CYAN}<server-vpn-ip>:3478${NC} (if self-hosted coturn)"
|
||||
echo -e " or leave blank if VPN provides direct routing"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
# SECTION 3: LINPHONE (Mobile Client) DOMAINS
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
if $SHOW_ALL || $SHOW_LINPHONE; then
|
||||
echo -e "${BOLD}━━━ 3. LINPHONE CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for SIP calls:${NC}"
|
||||
echo -e " ${GREEN}None${NC} - Same as Sipnetic, configure with server IP directly"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Linphone app domains:${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}linphone.org${NC} / ${CYAN}sip.linphone.org${NC}"
|
||||
echo -e " Purpose: Default Linphone SIP proxy (NOT needed for Easy Asterisk)"
|
||||
echo -e " Required: ${GREEN}No${NC} - We use our own Asterisk server"
|
||||
echo ""
|
||||
echo -e " ${CYAN}subscribe.linphone.org${NC}"
|
||||
echo -e " Purpose: Push notifications (may be needed for background calls)"
|
||||
echo -e " Required: Only if you need calls to ring when app is backgrounded"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}For remote provisioning:${NC}"
|
||||
echo ""
|
||||
echo -e " If using Easy Asterisk's HTTP provisioning:"
|
||||
echo -e " The phone must reach ${CYAN}http://<server-ip>:8088/static/linphone.xml${NC}"
|
||||
echo -e " This is an IP address, so no DNS whitelist needed."
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
# SECTION 4: SUMMARY
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
if $SHOW_ALL; then
|
||||
print_header "Quick Reference - Minimum DNS Whitelist"
|
||||
|
||||
echo -e "${BOLD}For LAN/VPN mode (no internet calling):${NC}"
|
||||
echo ""
|
||||
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
|
||||
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
|
||||
echo -e " (Configure everything by IP address)"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}For LAN/VPN + self-hosted STUN (coturn):${NC}"
|
||||
echo ""
|
||||
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
|
||||
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
|
||||
echo -e " (STUN server reached by VPN IP, not hostname)"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}For LAN/VPN + Google STUN:${NC}"
|
||||
echo ""
|
||||
echo -e " Server DNS filter: ${YELLOW}stun.l.google.com${NC}"
|
||||
echo -e " Client DNS filter: ${YELLOW}stun.l.google.com${NC} (if also set in Sipnetic)"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}For FQDN/Internet mode:${NC}"
|
||||
echo ""
|
||||
echo -e " Server DNS filter: ${YELLOW}ifconfig.me, icanhazip.com, stun.l.google.com${NC}"
|
||||
echo -e " ${YELLOW}acme-v02.api.letsencrypt.org${NC} (if using LE certs)"
|
||||
echo -e " Client DNS filter: ${YELLOW}Your domain name (${DOMAIN_NAME:-yourdomain.com})${NC}"
|
||||
echo ""
|
||||
|
||||
print_header "Recommendation for DNS-Filtered Environments"
|
||||
|
||||
echo -e " ${GREEN}Use LAN/VPN mode + self-hosted coturn (STUN-only)${NC}"
|
||||
echo -e " ${GREEN}= Zero external DNS dependencies${NC}"
|
||||
echo ""
|
||||
echo -e " Setup: docker compose --profile stun up -d"
|
||||
echo -e " Then configure STUN as your server's VPN IP:3478"
|
||||
echo -e " No hostnames, no DNS, everything by IP."
|
||||
echo ""
|
||||
fi
|
||||
echo -e "${CYAN}━━━ DNS Whitelist for Easy Asterisk ━━━${NC}"
|
||||
echo ""
|
||||
echo -e "${BOLD}Mode: ${NC}$( [[ -n "$DOMAIN_NAME" ]] && echo "FQDN ($DOMAIN_NAME)" || echo "LAN/VPN (no domain)" )"
|
||||
echo ""
|
||||
echo -e "${BOLD}Server DNS filter:${NC}"
|
||||
echo -e " ifconfig.me, icanhazip.com (public IP detection, FQDN mode only)"
|
||||
echo -e " acme-v02.api.letsencrypt.org (Let's Encrypt, if used)"
|
||||
echo ""
|
||||
echo -e "${BOLD}Client DNS filter (Sipnetic/Linphone):${NC}"
|
||||
echo -e " LAN/VPN mode: none (configure by IP)"
|
||||
echo -e " FQDN mode: your domain ($DOMAIN_NAME)"
|
||||
echo ""
|
||||
|
||||
+20
-346
@@ -1,366 +1,40 @@
|
||||
#!/bin/bash
|
||||
# ================================================================
|
||||
# VPN Diagnostics for Easy Asterisk
|
||||
#
|
||||
# Tests whether your third-party VPN setup needs STUN/TURN
|
||||
# and validates connectivity between Asterisk and VPN clients.
|
||||
#
|
||||
# Validates PJSIP, TLS, ICE, RTP, and device configuration.
|
||||
# Usage: vpn-diagnostics [--auto] [--client-ip <ip>]
|
||||
# ================================================================
|
||||
|
||||
set -e
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
CYAN='\033[0;36m'
|
||||
BOLD='\033[1m'
|
||||
NC='\033[0m'
|
||||
GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[0;36m'; RED='\033[0;31m'; NC='\033[0m'
|
||||
|
||||
CONFIG_FILE="/etc/easy-asterisk/config"
|
||||
RESULTS=()
|
||||
WARNINGS=()
|
||||
CLIENT_IP=""
|
||||
AUTO_MODE=false
|
||||
|
||||
# Parse arguments
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--auto) AUTO_MODE=true; shift ;;
|
||||
--client-ip) CLIENT_IP="$2"; shift 2 ;;
|
||||
--help|-h)
|
||||
echo "Usage: vpn-diagnostics [OPTIONS]"
|
||||
echo ""
|
||||
echo "Options:"
|
||||
echo " --auto Non-interactive mode"
|
||||
echo " --client-ip <ip> Test connectivity to specific VPN client"
|
||||
echo " --help Show this help"
|
||||
exit 0
|
||||
;;
|
||||
*) shift ;;
|
||||
esac
|
||||
done
|
||||
|
||||
print_header() {
|
||||
echo ""
|
||||
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${CYAN} $1${NC}"
|
||||
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
|
||||
echo ""
|
||||
}
|
||||
|
||||
pass() { echo -e " ${GREEN}✓${NC} $1"; RESULTS+=("PASS: $1"); }
|
||||
fail() { echo -e " ${RED}✗${NC} $1"; RESULTS+=("FAIL: $1"); }
|
||||
warn() { echo -e " ${YELLOW}!${NC} $1"; WARNINGS+=("$1"); }
|
||||
info() { echo -e " ${CYAN}→${NC} $1"; }
|
||||
|
||||
# ── Test 1: Detect network interfaces ────────────────────────
|
||||
print_header "VPN Diagnostics for Easy Asterisk"
|
||||
|
||||
echo -e "${BOLD}1. Network Interface Detection${NC}"
|
||||
echo -e "${CYAN}━━━ Easy Asterisk VPN Diagnostics ━━━${NC}"
|
||||
echo ""
|
||||
|
||||
# Detect primary LAN interface
|
||||
primary_ip=$(hostname -I | awk '{print $1}')
|
||||
info "Primary IP: ${primary_ip}"
|
||||
|
||||
# Detect VPN interfaces (tun, tap, wg, tailscale, utun, ppp)
|
||||
vpn_found=false
|
||||
vpn_ips=()
|
||||
vpn_ifaces=()
|
||||
|
||||
while IFS= read -r line; do
|
||||
iface=$(echo "$line" | awk '{print $2}' | tr -d ':')
|
||||
ip_addr=$(echo "$line" | awk '{print $4}' | cut -d'/' -f1)
|
||||
|
||||
# Check for VPN interface patterns
|
||||
if [[ "$iface" =~ ^(tun|tap|wg|tailscale|utun|ppp|nordlynx|proton|mullvad) ]] || \
|
||||
[[ "$ip_addr" =~ ^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|100\.64\.|100\.96\.|100\.100\.) ]]; then
|
||||
vpn_found=true
|
||||
vpn_ips+=("$ip_addr")
|
||||
vpn_ifaces+=("$iface")
|
||||
pass "VPN interface detected: ${iface} (${ip_addr})"
|
||||
fi
|
||||
done < <(ip -o -f inet addr show scope global 2>/dev/null)
|
||||
|
||||
if ! $vpn_found; then
|
||||
warn "No VPN interface detected on server"
|
||||
info "If your VPN runs on the router (not this server), that's expected"
|
||||
info "The VPN subnet should be added via VLAN/VPN subnet configuration"
|
||||
# Check Asterisk is running
|
||||
if ! asterisk -rx "core show version" &>/dev/null; then
|
||||
echo -e "${RED}✗ Asterisk is not running${NC}"; exit 1
|
||||
fi
|
||||
echo -e "${GREEN}✓ Asterisk running:${NC} $(asterisk -rx "core show version" 2>/dev/null)"
|
||||
|
||||
# ── Test 2: Check Asterisk PJSIP transport configuration ─────
|
||||
# Check transports
|
||||
echo ""
|
||||
echo -e "${BOLD}2. Asterisk Transport Configuration${NC}"
|
||||
echo -e "${CYAN}Transports:${NC}"
|
||||
asterisk -rx "pjsip show transports" 2>/dev/null || true
|
||||
|
||||
# Check registered endpoints
|
||||
echo ""
|
||||
|
||||
if [[ -f /etc/asterisk/pjsip.conf ]]; then
|
||||
# Check local_net entries
|
||||
local_nets=$(grep "^local_net=" /etc/asterisk/pjsip.conf 2>/dev/null | sort -u)
|
||||
if [[ -n "$local_nets" ]]; then
|
||||
while IFS= read -r net; do
|
||||
info "Transport local_net: ${net#local_net=}"
|
||||
done <<< "$local_nets"
|
||||
|
||||
# Check if VPN subnets are included
|
||||
for vpn_ip in "${vpn_ips[@]}"; do
|
||||
vpn_subnet=$(echo "$vpn_ip" | sed 's/\.[0-9]*$/.0\/24/')
|
||||
if echo "$local_nets" | grep -q "$vpn_subnet"; then
|
||||
pass "VPN subnet ${vpn_subnet} included in transport"
|
||||
else
|
||||
fail "VPN subnet ${vpn_subnet} NOT in transport local_net"
|
||||
warn "Add via: Server Settings → Configure VLAN/VPN Subnets"
|
||||
fi
|
||||
done
|
||||
else
|
||||
warn "No local_net entries found in transport (basic LAN mode)"
|
||||
fi
|
||||
|
||||
# Check transport types
|
||||
if grep -q "transport=transport-udp" /etc/asterisk/pjsip.conf; then
|
||||
pass "UDP transport configured for LAN/VPN devices"
|
||||
fi
|
||||
if grep -q "transport=transport-tls" /etc/asterisk/pjsip.conf; then
|
||||
pass "TLS transport configured for FQDN devices"
|
||||
fi
|
||||
else
|
||||
fail "pjsip.conf not found"
|
||||
fi
|
||||
|
||||
# ── Test 2b: TLS Certificate & Port Checks ────────────────────
|
||||
echo ""
|
||||
echo -e "${BOLD}2b. TLS / Certificate Status${NC}"
|
||||
echo ""
|
||||
|
||||
# Check if port 5061 is actually listening
|
||||
if command -v ss &>/dev/null; then
|
||||
tls_listen=$(ss -tlnp 2>/dev/null | grep ":5061 " || true)
|
||||
elif command -v netstat &>/dev/null; then
|
||||
tls_listen=$(netstat -tlnp 2>/dev/null | grep ":5061 " || true)
|
||||
else
|
||||
tls_listen=""
|
||||
fi
|
||||
|
||||
if [[ -n "$tls_listen" ]]; then
|
||||
pass "Port 5061 (TLS) is listening"
|
||||
else
|
||||
fail "Port 5061 (TLS) is NOT listening"
|
||||
warn "Asterisk TLS transport failed to start — check certs and logs"
|
||||
fi
|
||||
echo -e "${CYAN}Endpoints:${NC}"
|
||||
asterisk -rx "pjsip show endpoints" 2>/dev/null || true
|
||||
|
||||
# Check TLS cert
|
||||
cert_file="/etc/asterisk/certs/server.crt"
|
||||
if [[ -f "$cert_file" ]]; then
|
||||
pass "TLS certificate exists: $cert_file"
|
||||
|
||||
# Check cert CN/SAN
|
||||
cert_cn=$(openssl x509 -in "$cert_file" -noout -subject 2>/dev/null | sed 's/.*CN *= *//')
|
||||
cert_san=$(openssl x509 -in "$cert_file" -noout -ext subjectAltName 2>/dev/null | grep -oP 'DNS:\K[^,]+' || true)
|
||||
cert_expiry=$(openssl x509 -in "$cert_file" -noout -enddate 2>/dev/null | cut -d= -f2)
|
||||
|
||||
info "Cert CN: ${cert_cn:-unknown}"
|
||||
if [[ -n "$cert_san" ]]; then
|
||||
pass "Cert has SAN (Subject Alt Name): ${cert_san}"
|
||||
else
|
||||
fail "Cert has NO SAN — modern phones (iOS/Android) will reject it"
|
||||
warn "Delete /etc/asterisk/certs/server.crt and restart to regenerate with SANs"
|
||||
fi
|
||||
info "Cert expires: ${cert_expiry:-unknown}"
|
||||
|
||||
# Check if cert is self-signed
|
||||
issuer=$(openssl x509 -in "$cert_file" -noout -issuer 2>/dev/null | sed 's/.*CN *= *//')
|
||||
if [[ "$issuer" == "$cert_cn" ]]; then
|
||||
warn "Cert is SELF-SIGNED — phones must be set to accept self-signed certs"
|
||||
info "In your SIP app: disable TLS certificate verification / allow self-signed"
|
||||
fi
|
||||
|
||||
# Verify PJSIP transport loaded it
|
||||
if command -v asterisk &>/dev/null; then
|
||||
transport_status=$(asterisk -rx "pjsip show transports" 2>/dev/null || true)
|
||||
if echo "$transport_status" | grep -q "transport-tls"; then
|
||||
pass "PJSIP TLS transport is loaded"
|
||||
else
|
||||
fail "PJSIP TLS transport NOT loaded — cert may be invalid"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
fail "TLS certificate not found at $cert_file"
|
||||
fi
|
||||
|
||||
# ── Test 3: Check RTP and ICE/STUN configuration ─────────────
|
||||
echo ""
|
||||
echo -e "${BOLD}3. RTP / ICE / STUN Configuration${NC}"
|
||||
echo ""
|
||||
|
||||
if [[ -f /etc/asterisk/rtp.conf ]]; then
|
||||
rtp_start=$(grep "^rtpstart=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||
rtp_end=$(grep "^rtpend=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||
info "RTP port range: ${rtp_start:-10000}-${rtp_end:-20000}"
|
||||
|
||||
if grep -q "^icesupport=yes" /etc/asterisk/rtp.conf; then
|
||||
pass "ICE support enabled"
|
||||
stun_addr=$(grep "^stunaddr=" /etc/asterisk/rtp.conf | cut -d= -f2)
|
||||
if [[ -n "$stun_addr" ]]; then
|
||||
info "STUN server: ${stun_addr}"
|
||||
|
||||
# Test STUN server reachability
|
||||
stun_host=$(echo "$stun_addr" | cut -d: -f1)
|
||||
stun_port=$(echo "$stun_addr" | cut -d: -f2)
|
||||
stun_port="${stun_port:-3478}"
|
||||
|
||||
if command -v nslookup &>/dev/null && nslookup "$stun_host" >/dev/null 2>&1; then
|
||||
pass "STUN server DNS resolves: ${stun_host}"
|
||||
else
|
||||
fail "Cannot resolve STUN server: ${stun_host}"
|
||||
warn "Add ${stun_host} to DNS whitelist"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
info "ICE support disabled (standard for LAN/VPN mode)"
|
||||
warn "If audio fails over VPN, enable ICE via: Server Settings → VPN STUN/ICE"
|
||||
fi
|
||||
else
|
||||
warn "rtp.conf not found"
|
||||
fi
|
||||
|
||||
# ── Test 4: Check endpoint ICE settings ───────────────────────
|
||||
echo ""
|
||||
echo -e "${BOLD}4. Per-Device ICE Configuration${NC}"
|
||||
echo ""
|
||||
|
||||
if [[ -f /etc/asterisk/pjsip.conf ]]; then
|
||||
device_count=$(grep -c "^; === Device:" /etc/asterisk/pjsip.conf 2>/dev/null || echo 0)
|
||||
ice_device_count=$(grep -c "^ice_support=yes" /etc/asterisk/pjsip.conf 2>/dev/null || echo 0)
|
||||
info "Total devices: ${device_count}"
|
||||
info "Devices with ICE: ${ice_device_count}"
|
||||
|
||||
if [[ "$device_count" -gt 0 && "$ice_device_count" -eq 0 ]]; then
|
||||
warn "No devices have ICE enabled"
|
||||
info "For third-party VPNs with NAT, enable ICE via VPN STUN/ICE menu"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Test 5: VPN client connectivity ──────────────────────────
|
||||
echo ""
|
||||
echo -e "${BOLD}5. VPN Client Connectivity${NC}"
|
||||
echo ""
|
||||
|
||||
if [[ -z "$CLIENT_IP" ]] && ! $AUTO_MODE; then
|
||||
echo " Enter a VPN client IP to test connectivity (or press Enter to skip):"
|
||||
read -p " Client VPN IP: " CLIENT_IP
|
||||
fi
|
||||
|
||||
if [[ -n "$CLIENT_IP" ]]; then
|
||||
# Ping test
|
||||
if ping -c 2 -W 3 "$CLIENT_IP" >/dev/null 2>&1; then
|
||||
pass "Ping to ${CLIENT_IP} succeeded"
|
||||
else
|
||||
fail "Ping to ${CLIENT_IP} failed"
|
||||
warn "VPN routing issue - client may not be reachable"
|
||||
fi
|
||||
|
||||
# SIP port test (UDP 5060)
|
||||
if command -v nc &>/dev/null; then
|
||||
if nc -z -u -w 3 "$CLIENT_IP" 5060 2>/dev/null; then
|
||||
pass "UDP 5060 reachable on ${CLIENT_IP}"
|
||||
else
|
||||
info "UDP 5060 probe inconclusive (normal for filtered VPNs)"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
info "Skipping client connectivity test (no IP provided)"
|
||||
fi
|
||||
|
||||
# ── Test 6: NAT type detection ───────────────────────────────
|
||||
echo ""
|
||||
echo -e "${BOLD}6. NAT Type Analysis${NC}"
|
||||
echo ""
|
||||
|
||||
# Check if server is behind NAT
|
||||
if [[ -n "$primary_ip" ]]; then
|
||||
public_ip=$(curl -s -4 --connect-timeout 5 ifconfig.me 2>/dev/null || echo "")
|
||||
if [[ -n "$public_ip" ]]; then
|
||||
if [[ "$primary_ip" == "$public_ip" ]]; then
|
||||
pass "Server has public IP (no NAT)"
|
||||
else
|
||||
info "Server behind NAT: ${primary_ip} → ${public_ip}"
|
||||
info "This is normal for VPN setups where traffic stays on VPN"
|
||||
fi
|
||||
else
|
||||
info "Cannot detect public IP (DNS filtering or no internet)"
|
||||
info "Not needed for LAN/VPN mode"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Test 7: Asterisk registration status ─────────────────────
|
||||
echo ""
|
||||
echo -e "${BOLD}7. Asterisk Registration Status${NC}"
|
||||
echo ""
|
||||
|
||||
if command -v asterisk &>/dev/null; then
|
||||
reg_output=$(asterisk -rx "pjsip show endpoints" 2>/dev/null || echo "")
|
||||
if [[ -n "$reg_output" ]]; then
|
||||
online_count=$(echo "$reg_output" | grep -c "Avail" 2>/dev/null || echo 0)
|
||||
offline_count=$(echo "$reg_output" | grep -c "Unavail" 2>/dev/null || echo 0)
|
||||
info "Endpoints online: ${online_count}"
|
||||
info "Endpoints offline: ${offline_count}"
|
||||
|
||||
if [[ "$offline_count" -gt 0 ]]; then
|
||||
warn "Some endpoints are offline - check VPN connectivity"
|
||||
echo "$reg_output" | grep "Unavail" | while IFS= read -r line; do
|
||||
info " Offline: $line"
|
||||
done
|
||||
fi
|
||||
else
|
||||
info "Asterisk not running or no endpoints configured"
|
||||
fi
|
||||
else
|
||||
info "Asterisk CLI not available"
|
||||
fi
|
||||
|
||||
# ── Summary ──────────────────────────────────────────────────
|
||||
print_header "Diagnostic Summary"
|
||||
|
||||
fail_count=0
|
||||
pass_count=0
|
||||
for result in "${RESULTS[@]}"; do
|
||||
if [[ "$result" == FAIL* ]]; then
|
||||
((fail_count++))
|
||||
elif [[ "$result" == PASS* ]]; then
|
||||
((pass_count++))
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e " Passed: ${GREEN}${pass_count}${NC}"
|
||||
echo -e " Failed: ${RED}${fail_count}${NC}"
|
||||
echo -e " Warnings: ${YELLOW}${#WARNINGS[@]}${NC}"
|
||||
|
||||
if [[ ${#WARNINGS[@]} -gt 0 ]]; then
|
||||
echo ""
|
||||
echo -e "${BOLD}Recommendations:${NC}"
|
||||
for w in "${WARNINGS[@]}"; do
|
||||
echo -e " ${YELLOW}→${NC} $w"
|
||||
done
|
||||
fi
|
||||
|
||||
# ── STUN Recommendation ─────────────────────────────────────
|
||||
echo ""
|
||||
echo -e "${BOLD}Do you need STUN?${NC}"
|
||||
echo ""
|
||||
|
||||
if $vpn_found; then
|
||||
echo -e " VPN detected on this server."
|
||||
echo -e " ${GREEN}If your VPN provides direct routing (both sides get VPN IPs),${NC}"
|
||||
echo -e " ${GREEN}STUN is likely NOT needed.${NC}"
|
||||
echo ""
|
||||
echo -e " ${YELLOW}If audio works one-way or not at all, enable STUN:${NC}"
|
||||
echo -e " 1. docker compose --profile stun up -d (self-hosted STUN)"
|
||||
echo -e " 2. Or via easy-asterisk: Server Settings → VPN STUN/ICE"
|
||||
else
|
||||
echo -e " No VPN interface found on server."
|
||||
echo -e " ${YELLOW}If VPN runs on router/firewall:${NC}"
|
||||
echo -e " - Add VPN subnet via: Server Settings → VLAN/VPN Subnets"
|
||||
echo -e " - If audio still fails, enable STUN for NAT traversal"
|
||||
if [[ -f /etc/asterisk/certs/server.crt ]]; then
|
||||
exp=$(openssl x509 -in /etc/asterisk/certs/server.crt -noout -enddate 2>/dev/null | cut -d= -f2)
|
||||
echo -e "${GREEN}✓ TLS cert:${NC} expires $exp"
|
||||
openssl x509 -in /etc/asterisk/certs/server.crt -noout -ext subjectAltName 2>/dev/null | grep -q "DNS:" \
|
||||
&& echo -e "${GREEN}✓ SANs present (mobile-compatible)${NC}" \
|
||||
|| echo -e "${YELLOW}! No SANs — mobile clients may reject cert${NC}"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
||||
Reference in New Issue
Block a user