Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk
asterisk.sh (homelab): - Easy Asterisk PBX with self-hosted coturn TURN server - Vendored from outis1one/easy-asterisk v0.10.0 for offline install - LAN-only or FQDN mode (TLS + TURN relay for remote access) - Auto-answer SIP headers for intercom use case - Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen - UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp - Builds custom Docker image from vendor/easy-asterisk/ nextcloud.sh (utilities): - Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage) - MariaDB 10.11 sidecar with matching env vars - OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy - Enables files_external app after first-run init (waits up to 90s) onlyoffice.sh (utilities): - JWT generated once, preserved across re-runs - _ensure_yq: auto-installs yq v4 for FileBrowser config patching - _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret) - _wire_filebrowser: patches config.yaml + restarts container - Caddy block overrides X-Frame-Options to allow iframe embedding mattermost.sh (utilities): - PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479) - 8443/udp for Calls plugin RTC server - coturn uses --use-auth-secret HMAC mode (required by Calls plugin) - SITE_URL computed from SITE_DOMAIN, promptable - UFW: 8443/udp, 3479, 49153-49352/udp vendor/easy-asterisk/: - All upstream source files vendored for offline/self-contained installs - Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh - easy-asterisk-v0.10.0.sh (6929-line management script) - scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh - .env.example https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt
This commit is contained in:
Claude
Vendored
+20
-87
@@ -1,99 +1,32 @@
|
||||
# ================================================================
|
||||
# Easy Asterisk - Environment Configuration
|
||||
#
|
||||
# Setup:
|
||||
# 1. cp .env.example .env
|
||||
# 2. Set DOMAIN_NAME (the only required setting)
|
||||
# 3. docker compose up -d
|
||||
# 4. docker exec -it easy-asterisk easy-asterisk
|
||||
#
|
||||
# Port forwarding required on your router:
|
||||
# 5061/tcp → SIP TLS signaling
|
||||
# 3478/udp+tcp → STUN/TURN (NAT traversal + media relay)
|
||||
# (change with TURN_PORT if 3478 is taken)
|
||||
# 10000-20000/udp → RTP media (or your custom range below)
|
||||
#
|
||||
# How it works:
|
||||
# - All SIP clients connect to DOMAIN_NAME:5061 (TLS)
|
||||
# - coturn handles NAT traversal (STUN) and media relay (TURN)
|
||||
# - Works from any network: LAN, cellular, Proton VPN, hotel WiFi
|
||||
# - Set TURN_PASSWORD below (generate one: openssl rand -base64 18)
|
||||
# Easy Asterisk — Environment Configuration
|
||||
# Copy to .env and fill in your values.
|
||||
# ================================================================
|
||||
|
||||
# ── Domain Name (REQUIRED) ────────────────────────────────────
|
||||
# The FQDN that points to this server's public IP.
|
||||
# This is what SIP clients use to connect.
|
||||
# Example: asterisk.yourdomain.com
|
||||
DOMAIN_NAME=
|
||||
# ── Domain (REQUIRED for remote/FQDN access) ──────────────────
|
||||
# Your FQDN pointing to this server's public IP.
|
||||
# Leave empty for LAN-only mode.
|
||||
DOMAIN_NAME=asterisk.example.com
|
||||
|
||||
# ── Public IP ─────────────────────────────────────────────────
|
||||
# Your server's public IP address.
|
||||
# Leave empty to auto-detect (uses ifconfig.me).
|
||||
# Set manually if auto-detection fails (e.g., behind double NAT).
|
||||
PUBLIC_IP=
|
||||
|
||||
# ── TLS ───────────────────────────────────────────────────────
|
||||
# Always "y" for remote access. Self-signed certs are auto-generated.
|
||||
# For trusted certs (no client warnings), mount your Let's Encrypt
|
||||
# certs into /etc/asterisk/certs/ via docker compose volumes.
|
||||
ENABLE_TLS=y
|
||||
|
||||
# ── Local Network ─────────────────────────────────────────────
|
||||
# Your LAN CIDR. Auto-detected if empty.
|
||||
# Example: 192.168.1.0/24
|
||||
LOCAL_CIDR=
|
||||
|
||||
# ── Additional Subnets (optional) ─────────────────────────────
|
||||
# Only needed for site-to-site VPNs or VLANs where the server
|
||||
# has a direct route to client IPs (e.g., WireGuard, Tailscale).
|
||||
#
|
||||
# NOT needed for client-side VPNs (Proton, NordVPN, etc.)
|
||||
# - Those clients appear with random public IPs
|
||||
# - TURN handles media relay for them automatically
|
||||
#
|
||||
# Examples:
|
||||
# WireGuard: VLAN_SUBNETS=10.8.0.0/24
|
||||
# Tailscale: VLAN_SUBNETS=100.64.0.0/10
|
||||
# Multiple: VLAN_SUBNETS=10.8.0.0/24 10.10.0.0/24
|
||||
HAS_VLANS=n
|
||||
VLAN_SUBNETS=
|
||||
|
||||
# ── TURN/STUN Settings ──────────────────────────────────────
|
||||
# Used by coturn for TURN relay authentication.
|
||||
# If empty, defaults to "changeme" — set a real password for security.
|
||||
# Generate one with: openssl rand -base64 18
|
||||
#
|
||||
# These credentials are for coturn only. SIP clients that need TURN
|
||||
# relay (behind strict NAT) must configure the same credentials in
|
||||
# their SIP app settings.
|
||||
# ── TURN/STUN ──────────────────────────────────────────────────
|
||||
# Generate a strong password: openssl rand -base64 18
|
||||
TURN_USERNAME=easyasterisk
|
||||
TURN_PASSWORD=
|
||||
|
||||
# ── TURN/STUN Port ──────────────────────────────────────────
|
||||
# Default: 3478 (standard STUN/TURN port)
|
||||
# Change if 3478 is already in use (e.g., UniFi controller uses 3478/udp).
|
||||
# Common alternative: 3479
|
||||
TURN_PASSWORD=changeme
|
||||
TURN_PORT=3478
|
||||
# Points to coturn. For LAN-only leave empty.
|
||||
TURN_SERVER=${DOMAIN_NAME}:${TURN_PORT}
|
||||
|
||||
# ── TURN Relay Port Range ─────────────────────────────────────
|
||||
# Ports coturn uses for media relay. Forward this range on your router.
|
||||
# Default is 100 ports (enough for ~50 simultaneous relayed calls).
|
||||
# Most calls use direct paths; TURN relay is the fallback.
|
||||
TURN_RELAY_MIN=49152
|
||||
TURN_RELAY_MAX=49252
|
||||
|
||||
# ── RTP Port Range ────────────────────────────────────────────
|
||||
# Asterisk's own RTP media ports. Forward this range on your router.
|
||||
# Default: 10000-20000 (10,000 ports)
|
||||
# For constrained environments: 10000-10200
|
||||
# ── RTP port range ─────────────────────────────────────────────
|
||||
RTP_START=10000
|
||||
RTP_END=20000
|
||||
|
||||
# ── Web Admin ─────────────────────────────────────────────────
|
||||
# HTTP management interface. Access via browser at:
|
||||
# http://your-server:8080/clients
|
||||
#
|
||||
# For HTTPS: put this behind Caddy or nginx reverse proxy,
|
||||
# then set WEB_ADMIN_AUTH_DISABLED=true (let the proxy handle auth).
|
||||
# ── Web admin ──────────────────────────────────────────────────
|
||||
WEB_ADMIN_PORT=8080
|
||||
# Set to true if Authelia or another reverse proxy handles auth
|
||||
WEB_ADMIN_AUTH_DISABLED=false
|
||||
|
||||
# ── Public IP (optional — auto-detected if empty) ─────────────
|
||||
PUBLIC_IP=
|
||||
|
||||
# ── Local network CIDR (optional — auto-detected if empty) ────
|
||||
LOCAL_CIDR=
|
||||
|
||||
Reference in New Issue
Block a user