Add asterisk, nextcloud, onlyoffice, mattermost services + vendor/easy-asterisk
asterisk.sh (homelab): - Easy Asterisk PBX with self-hosted coturn TURN server - Vendored from outis1one/easy-asterisk v0.10.0 for offline install - LAN-only or FQDN mode (TLS + TURN relay for remote access) - Auto-answer SIP headers for intercom use case - Authelia SSO for web admin; WEB_ADMIN_AUTH_DISABLED=true when chosen - UFW rules: 5060-5061, 8080, 8088-8089, 3478, 10000-20000/udp, 49152-49252/udp - Builds custom Docker image from vendor/easy-asterisk/ nextcloud.sh (utilities): - Custom Dockerfile: nextcloud:apache + smbclient (SMB external storage) - MariaDB 10.11 sidecar with matching env vars - OVERWRITEPROTOCOL/OVERWRITECLIURL/TRUSTED_PROXIES set for Caddy - Enables files_external app after first-run init (waits up to 90s) onlyoffice.sh (utilities): - JWT generated once, preserved across re-runs - _ensure_yq: auto-installs yq v4 for FileBrowser config patching - _wire_nextcloud: idempotent occ wiring (DocumentServerUrl, jwt_secret) - _wire_filebrowser: patches config.yaml + restarts container - Caddy block overrides X-Frame-Options to allow iframe embedding mattermost.sh (utilities): - PostgreSQL 15-alpine + Mattermost Team Edition + coturn (port 3479) - 8443/udp for Calls plugin RTC server - coturn uses --use-auth-secret HMAC mode (required by Calls plugin) - SITE_URL computed from SITE_DOMAIN, promptable - UFW: 8443/udp, 3479, 49153-49352/udp vendor/easy-asterisk/: - All upstream source files vendored for offline/self-contained installs - Dockerfile, docker/entrypoint.sh, docker/coturn-entrypoint.sh - easy-asterisk-v0.10.0.sh (6929-line management script) - scripts/vpn-diagnostics.sh, scripts/dns-whitelist.sh - .env.example https://claude.ai/code/session_014CCYqVwW6d6f5dw1qRokYt
This commit is contained in:
Claude
+13
-238
@@ -30,251 +30,26 @@ while [[ $# -gt 0 ]]; do
|
||||
--linphone) SHOW_LINPHONE=true; SHOW_ALL=false; shift ;;
|
||||
--help|-h)
|
||||
echo "Usage: dns-whitelist [OPTIONS]"
|
||||
echo ""
|
||||
echo "Options:"
|
||||
echo " --check Test reachability of each domain"
|
||||
echo " --sipnetic Show Sipnetic-specific domains"
|
||||
echo " --linphone Show Linphone-specific domains"
|
||||
echo " --help Show this help"
|
||||
exit 0
|
||||
;;
|
||||
exit 0 ;;
|
||||
*) shift ;;
|
||||
esac
|
||||
done
|
||||
|
||||
print_header() {
|
||||
echo ""
|
||||
echo -e "${CYAN}╔══════════════════════════════════════════════════════════╗${NC}"
|
||||
echo -e "${CYAN} $1${NC}"
|
||||
echo -e "${CYAN}╚══════════════════════════════════════════════════════════╝${NC}"
|
||||
echo ""
|
||||
}
|
||||
|
||||
check_dns() {
|
||||
local domain="$1"
|
||||
local port="$2"
|
||||
local proto="${3:-tcp}"
|
||||
|
||||
if $CHECK_MODE; then
|
||||
# DNS resolution test
|
||||
if nslookup "$domain" >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓ DNS resolves${NC}"
|
||||
else
|
||||
echo -e " ${RED}✗ DNS BLOCKED - add to whitelist${NC}"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Connectivity test
|
||||
if [[ "$proto" == "udp" ]]; then
|
||||
# UDP - just check DNS resolution (can't reliably test UDP connectivity)
|
||||
echo -e " ${CYAN}→ UDP port ${port} (cannot test remotely)${NC}"
|
||||
else
|
||||
if curl -s --connect-timeout 5 "https://${domain}" >/dev/null 2>&1 || \
|
||||
curl -s --connect-timeout 5 "http://${domain}" >/dev/null 2>&1; then
|
||||
echo -e " ${GREEN}✓ Reachable${NC}"
|
||||
else
|
||||
echo -e " ${YELLOW}! Connection failed (may be expected)${NC}"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Load config if available
|
||||
source "$CONFIG_FILE" 2>/dev/null || true
|
||||
|
||||
print_header "DNS Whitelist for Easy Asterisk"
|
||||
|
||||
echo -e "${BOLD}Your Setup:${NC}"
|
||||
if [[ -n "$DOMAIN_NAME" ]]; then
|
||||
echo -e " Mode: FQDN/Internet (${DOMAIN_NAME})"
|
||||
else
|
||||
echo -e " Mode: LAN/VPN (no domain configured)"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
# SECTION 1: ASTERISK SERVER DOMAINS
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
if $SHOW_ALL; then
|
||||
echo -e "${BOLD}━━━ 1. ASTERISK SERVER (whitelist on server's DNS filter) ━━━${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for LAN/VPN mode:${NC}"
|
||||
echo -e " ${GREEN}None${NC} - Asterisk needs no internet after installation"
|
||||
echo -e " SIP operates over direct IP connections, no DNS involved"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for FQDN/Internet mode only:${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e " ${CYAN}ifconfig.me${NC} (HTTPS 443)"
|
||||
echo -e " Purpose: Auto-detect public IP for NAT settings"
|
||||
echo -e " When: Only during config regeneration"
|
||||
check_dns "ifconfig.me" "443"
|
||||
echo ""
|
||||
|
||||
echo -e " ${CYAN}icanhazip.com${NC} (HTTPS 443)"
|
||||
echo -e " Purpose: Fallback public IP detection"
|
||||
check_dns "icanhazip.com" "443"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required if ICE/STUN enabled:${NC}"
|
||||
echo ""
|
||||
|
||||
# Check what STUN server is configured
|
||||
stun_server=""
|
||||
if [[ -f /etc/asterisk/rtp.conf ]]; then
|
||||
stun_server=$(grep "^stunaddr=" /etc/asterisk/rtp.conf 2>/dev/null | cut -d= -f2)
|
||||
fi
|
||||
|
||||
if [[ -n "$stun_server" ]]; then
|
||||
stun_host=$(echo "$stun_server" | cut -d: -f1)
|
||||
stun_port=$(echo "$stun_server" | cut -d: -f2)
|
||||
stun_port="${stun_port:-3478}"
|
||||
echo -e " ${CYAN}${stun_host}${NC} (UDP ${stun_port})"
|
||||
echo -e " Purpose: STUN NAT discovery"
|
||||
echo -e " ${YELLOW}Tip: Use self-hosted coturn to avoid this dependency${NC}"
|
||||
check_dns "$stun_host" "$stun_port" "udp"
|
||||
else
|
||||
echo -e " ${GREEN}No external STUN server configured${NC}"
|
||||
echo -e " To use self-hosted: docker compose --profile stun up -d"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for package updates only:${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}archive.ubuntu.com${NC} / ${CYAN}security.ubuntu.com${NC} (HTTPS 443)"
|
||||
echo -e " Purpose: apt package updates"
|
||||
echo -e " When: Only during install/update (not runtime)"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for TLS certificates:${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}acme-v02.api.letsencrypt.org${NC} (HTTPS 443)"
|
||||
echo -e " Purpose: Let's Encrypt certificate issuance"
|
||||
echo -e " When: Only if using Let's Encrypt / Certbot / Caddy"
|
||||
if $CHECK_MODE; then
|
||||
check_dns "acme-v02.api.letsencrypt.org" "443"
|
||||
fi
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
# SECTION 2: SIPNETIC (Mobile Client) DOMAINS
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
if $SHOW_ALL || $SHOW_SIPNETIC; then
|
||||
echo -e "${BOLD}━━━ 2. SIPNETIC CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for SIP calls:${NC}"
|
||||
echo -e " ${GREEN}None${NC} - Configure Sipnetic with the server's IP address directly"
|
||||
echo -e " SIP registration and calls use IP:port, not DNS"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Sipnetic app domains (for app functionality):${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}onesip.io${NC} / ${CYAN}api.onesip.io${NC}"
|
||||
echo -e " Purpose: Sipnetic account/licensing (free tier works offline)"
|
||||
echo -e " Required: Only for initial setup or account sync"
|
||||
if $CHECK_MODE; then
|
||||
check_dns "onesip.io" "443"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
echo -e " ${CYAN}play.google.com${NC} / ${CYAN}apps.apple.com${NC}"
|
||||
echo -e " Purpose: App updates"
|
||||
echo -e " Required: Only for installing/updating the app"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}If STUN configured in Sipnetic:${NC}"
|
||||
echo ""
|
||||
echo -e " The STUN server domain configured in Sipnetic's settings"
|
||||
echo -e " needs to resolve on the mobile device's network."
|
||||
echo ""
|
||||
echo -e " ${YELLOW}Recommendation: Use the Asterisk server's VPN IP as STUN${NC}"
|
||||
echo -e " ${YELLOW}server (if running self-hosted coturn), avoiding DNS entirely.${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Sipnetic Configuration for DNS-Filtered Networks:${NC}"
|
||||
echo ""
|
||||
echo -e " Server: ${CYAN}<server-vpn-ip>${NC} (not a hostname)"
|
||||
echo -e " Port: ${CYAN}5060${NC} (UDP, LAN/VPN mode)"
|
||||
echo -e " Transport: ${CYAN}UDP${NC}"
|
||||
echo -e " STUN: ${CYAN}<server-vpn-ip>:3478${NC} (if self-hosted coturn)"
|
||||
echo -e " or leave blank if VPN provides direct routing"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
# SECTION 3: LINPHONE (Mobile Client) DOMAINS
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
if $SHOW_ALL || $SHOW_LINPHONE; then
|
||||
echo -e "${BOLD}━━━ 3. LINPHONE CLIENT (whitelist on caller/receiver DNS) ━━━${NC}"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Required for SIP calls:${NC}"
|
||||
echo -e " ${GREEN}None${NC} - Same as Sipnetic, configure with server IP directly"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}Linphone app domains:${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}linphone.org${NC} / ${CYAN}sip.linphone.org${NC}"
|
||||
echo -e " Purpose: Default Linphone SIP proxy (NOT needed for Easy Asterisk)"
|
||||
echo -e " Required: ${GREEN}No${NC} - We use our own Asterisk server"
|
||||
echo ""
|
||||
echo -e " ${CYAN}subscribe.linphone.org${NC}"
|
||||
echo -e " Purpose: Push notifications (may be needed for background calls)"
|
||||
echo -e " Required: Only if you need calls to ring when app is backgrounded"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}For remote provisioning:${NC}"
|
||||
echo ""
|
||||
echo -e " If using Easy Asterisk's HTTP provisioning:"
|
||||
echo -e " The phone must reach ${CYAN}http://<server-ip>:8088/static/linphone.xml${NC}"
|
||||
echo -e " This is an IP address, so no DNS whitelist needed."
|
||||
echo ""
|
||||
fi
|
||||
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
# SECTION 4: SUMMARY
|
||||
# ══════════════════════════════════════════════════════════════
|
||||
if $SHOW_ALL; then
|
||||
print_header "Quick Reference - Minimum DNS Whitelist"
|
||||
|
||||
echo -e "${BOLD}For LAN/VPN mode (no internet calling):${NC}"
|
||||
echo ""
|
||||
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
|
||||
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
|
||||
echo -e " (Configure everything by IP address)"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}For LAN/VPN + self-hosted STUN (coturn):${NC}"
|
||||
echo ""
|
||||
echo -e " Server DNS filter: ${GREEN}No domains needed${NC}"
|
||||
echo -e " Client DNS filter: ${GREEN}No domains needed${NC}"
|
||||
echo -e " (STUN server reached by VPN IP, not hostname)"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}For LAN/VPN + Google STUN:${NC}"
|
||||
echo ""
|
||||
echo -e " Server DNS filter: ${YELLOW}stun.l.google.com${NC}"
|
||||
echo -e " Client DNS filter: ${YELLOW}stun.l.google.com${NC} (if also set in Sipnetic)"
|
||||
echo ""
|
||||
|
||||
echo -e "${BOLD}For FQDN/Internet mode:${NC}"
|
||||
echo ""
|
||||
echo -e " Server DNS filter: ${YELLOW}ifconfig.me, icanhazip.com, stun.l.google.com${NC}"
|
||||
echo -e " ${YELLOW}acme-v02.api.letsencrypt.org${NC} (if using LE certs)"
|
||||
echo -e " Client DNS filter: ${YELLOW}Your domain name (${DOMAIN_NAME:-yourdomain.com})${NC}"
|
||||
echo ""
|
||||
|
||||
print_header "Recommendation for DNS-Filtered Environments"
|
||||
|
||||
echo -e " ${GREEN}Use LAN/VPN mode + self-hosted coturn (STUN-only)${NC}"
|
||||
echo -e " ${GREEN}= Zero external DNS dependencies${NC}"
|
||||
echo ""
|
||||
echo -e " Setup: docker compose --profile stun up -d"
|
||||
echo -e " Then configure STUN as your server's VPN IP:3478"
|
||||
echo -e " No hostnames, no DNS, everything by IP."
|
||||
echo ""
|
||||
fi
|
||||
echo -e "${CYAN}━━━ DNS Whitelist for Easy Asterisk ━━━${NC}"
|
||||
echo ""
|
||||
echo -e "${BOLD}Mode: ${NC}$( [[ -n "$DOMAIN_NAME" ]] && echo "FQDN ($DOMAIN_NAME)" || echo "LAN/VPN (no domain)" )"
|
||||
echo ""
|
||||
echo -e "${BOLD}Server DNS filter:${NC}"
|
||||
echo -e " ifconfig.me, icanhazip.com (public IP detection, FQDN mode only)"
|
||||
echo -e " acme-v02.api.letsencrypt.org (Let's Encrypt, if used)"
|
||||
echo ""
|
||||
echo -e "${BOLD}Client DNS filter (Sipnetic/Linphone):${NC}"
|
||||
echo -e " LAN/VPN mode: none (configure by IP)"
|
||||
echo -e " FQDN mode: your domain ($DOMAIN_NAME)"
|
||||
echo ""
|
||||
|
||||
Reference in New Issue
Block a user