Fold asterisk-digital-ocean into asterisk with droplet auto-detection

services/asterisk-digital-ocean.sh was a near-verbatim copy of
services/asterisk.sh — same vendor refresh, compose template, messaging
dialplan, presence alerts, UFW rules and dashboard/trunk chaining, with the
helper functions renamed _asterisk_do_*. Two copies meant every fix had to
land twice, and several never did.

There is now one `asterisk` service. It reads the DigitalOcean metadata
service and asks either way (so a droplet with metadata blocked, or another
provider's public VM, can still opt in), then gates the genuinely
droplet-specific behaviour on that one answer: swapfile for low-RAM plans,
public-FQDN-only setup with no LAN/VLAN prompts, a Caddy site block pinned
to that FQDN, the remote-Authelia option, and the doctl Cloud Firewall.

Two things that were droplet-only for no real reason now apply everywhere:
the entrypoint patch that writes security-level events to logs/full, and
the logrotate config for that file. Without them the Security Dashboard's
Security Log tab and CrowdSec's Asterisk acquisition were silently empty on
every home/LAN install; crowdsec.sh now detects either install directory.

Existing droplets are left alone: an install at ~/docker/asterisk-digital-ocean
keeps its directory and easy-asterisk-do container names, since its Caddyfile
block, UFW rules, Cloud Firewall, CrowdSec acquisition and PSTN trunk all
name those exactly. New installs use ~/docker/asterisk / easy-asterisk.
`sudo ./setup.sh asterisk-digital-ocean` still works via a new SERVICE_ALIAS
map in setup.sh, without a second menu entry.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NAddJGE1G6eGaPzmScG5Vh

docs/anveo-direct-setup-guide.md

@@ -1,8 +1,8 @@
 # Anveo Direct + Easy Asterisk — confirmed working setup guide
 
 This is the exact sequence that got a real Anveo Direct DID working end to
-end (both outbound and inbound) with `asterisk-digital-ocean.sh` +
-`pstn-trunk.sh`, confirmed live on a real droplet.
+end (both outbound and inbound) with `asterisk.sh` + `pstn-trunk.sh`,
+confirmed live on a real droplet.
 
 **Steps 1, 3 and 4 are one-time account setup** — the outbound Service
 Trunk (step 3) and the inbound SIP Trunk (step 4) each cover every DID on
@@ -13,8 +13,8 @@ in the dashboard, and test.
 
 ## 0. Prerequisites
 
-- `asterisk-digital-ocean.sh` (or `asterisk.sh` for a LAN box) already
-  installed and running, with at least one extension configured.
+- `asterisk.sh` already installed and running (droplet or home/LAN — the
+  installer detects which), with at least one extension configured.
 - This box's public IP address (`curl -4 ifconfig.me`).
 
 ## 1. Anveo Direct account (one-time)
@@ -194,7 +194,9 @@ In the Security Dashboard's PSTN Trunk tab:
   answers or 20 seconds pass.
 - Watch the live console while testing either direction:
   ```
-  docker exec -it easy-asterisk-do asterisk -rvvv
+  docker exec -it easy-asterisk asterisk -rvvv
+  # on a droplet set up before the two Asterisk services were merged, the
+  # container is named easy-asterisk-do instead
   ```
 
 ## Bugs hit and fixed along the way (informational — already fixed)

docs/pstn-calling-voipms-plan.md

@@ -10,9 +10,8 @@ file** — this doc is the design/decision log; that one is the clean
 how-to.
 
 **Implemented** — see `services/pstn-trunk.sh` (run `sudo ./setup.sh
-pstn-trunk` after `asterisk-digital-ocean` **or** `asterisk` (home/LAN) is
-installed — both are supported, see the file for the static-IP caveat on the
-LAN variant). Generic SIP trunk add-on that defaults to VoIP.ms but isn't
+pstn-trunk` after `asterisk` is installed — droplet or home/LAN, both are
+supported; see the file for the static-IP caveat on the LAN variant). Generic SIP trunk add-on that defaults to VoIP.ms but isn't
 hardcoded to it — any provider supporting IP authentication works. Covers:
 
 - IP-authenticated trunk, US/NANP-only outbound dialplan, no catch-all.
@@ -65,7 +64,7 @@ file.
 - **Provider: VoIP.ms.** Chosen for its prepaid-balance model: turn off
   auto-recharge in the account's Finances settings and outbound calls simply
   fail once the balance hits $0 — that's the toll-fraud backstop if the
-  droplet's Asterisk (`asterisk-digital-ocean`) is ever compromised.
+  droplet's Asterisk is ever compromised.
 
   **Update — read VoIP.ms's actual ToS (not just the wiki) on this.** The
   wiki says plainly "only accounts with a balance over $0 are able to send
@@ -173,7 +172,7 @@ estimated spend crosses a threshold, and every hour that call volume in the
 last hour looks like a burst. Denied/rejected calls alert immediately,
 separately from that hourly check.
 
-## What it takes technically (asterisk-digital-ocean)
+## What it takes technically (asterisk, droplet mode)
 - A PJSIP trunk: `endpoint` / `aor` / `identify` sections in the pjsip
   config. **Implemented with IP authentication** (no `auth` section, no SIP
   password stored anywhere) — see `services/pstn-trunk.sh`. Provider name,
@@ -357,9 +356,9 @@ generator output. Fixed by quoting every value in that heredoc.
    model (internal/restricted/full) managed live via
    `pstn-permissions.conf` + the Security Dashboard web UI, no reinstall
    needed to change. ~~Generic Asterisk target~~ Done —
-   `services/pstn-trunk.sh` now supports either `asterisk-digital-ocean` or
-   the home/LAN `asterisk` install (the latter with a static-IP caveat for
-   the provider's IP authentication). Still unresolved: pick pay-per-minute
+   `services/pstn-trunk.sh` supports the `asterisk` install in either mode,
+   droplet or home/LAN (the latter with a static-IP caveat for the
+   provider's IP authentication). Still unresolved: pick pay-per-minute
    vs. unlimited DID plan on VoIP.ms's side based on real expected volume,
    and decide on E911 (see cost estimate).
 5. ~~Concurrent-call cap~~ Done — both directions now (inbound was a real
@@ -444,7 +443,7 @@ generator output. Fixed by quoting every value in that heredoc.
     `exten => <ext>,1,...` per device, freshly regenerated by Easy
     Asterisk's own `rebuild_dialplan()` on every dialplan rebuild — exactly
     the collision this doc worried about. Solved by NOT sharing
-    `[intercom]`: `services/asterisk-digital-ocean.sh` now explicitly sets
+    `[intercom]`: `services/asterisk.sh` now explicitly sets
     `message_context=sip-messaging` on every endpoint (patched into both of
     Easy Asterisk's device-creation code paths — the CLI menu's bash
     heredoc and the web admin's Python `add_device()` — so new devices pick