From 65b7964411a8b75bb76308a814357d8f5dda7312 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 12 Aug 2026 22:11:36 +0000 Subject: [PATCH] asterisk: mount Caddy's cert store regardless of coturn mode The read-only bind mount that lets Asterisk's entrypoint auto-sync a real Let's Encrypt cert from Caddy (instead of falling back to self-signed) was gated on USE_EMBEDDED_COTURN == true. That condition conflated two unrelated things: Asterisk's own SIP transport-tls cert (what this mount is actually for) and coturn's separate TURNS capability (which the shared coturn service genuinely doesn't support, but is irrelevant here). Confirmed live: on a shared-coturn install with a real Caddy-issued cert already sitting on disk for DOMAIN_NAME, Asterisk kept generating a self-signed cert on every restart anyway, because /caddy-data was never mounted into the container -- sync_caddy_cert() had no cert store to find. Most SIP/TLS clients refuse a self-signed cert outright with no clear error, which was the actual cause of a "port's open, cert domain matches, registration still silently fails" case where every other layer (firewall, coturn reachability, DNS, cert CN/SAN) had already checked out clean. --- services/asterisk.sh | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/services/asterisk.sh b/services/asterisk.sh index d210cb1..f22749c 100644 --- a/services/asterisk.sh +++ b/services/asterisk.sh @@ -1084,10 +1084,24 @@ EOF # Share Caddy's cert store (read-only) so the entrypoint can auto-sync a # real Let's Encrypt cert for DOMAIN_NAME instead of falling back to - # self-signed. No-op if Caddy isn't installed on this box. Only relevant - # to the embedded coturn — the shared coturn service doesn't do TLS/TURNS - # at all (see services/coturn.sh's README for that tradeoff). - if [[ "$USE_EMBEDDED_COTURN" == true && -d "$DOCKER_DIR/caddy/data" ]]; then + # self-signed. No-op if Caddy isn't installed on this box. + # + # This is entirely about Asterisk's OWN SIP transport-tls cert (port + # 5061) -- it has nothing to do with coturn's separate, unrelated TURNS + # (TLS-wrapped TURN) capability, which the shared coturn service indeed + # doesn't support (see services/coturn.sh's README). A previous version + # of this check gated the mount on USE_EMBEDDED_COTURN == true, conflating + # the two. Confirmed live: on a shared-coturn install with a real Caddy + # cert already sitting on disk for DOMAIN_NAME, Asterisk silently kept + # generating (and re-generating) a self-signed cert forever, because + # /caddy-data was never mounted into the container at all -- sync_caddy_ + # cert() couldn't see a cert store that, from its own vantage point, + # simply didn't exist. Most SIP/TLS clients refuse a self-signed cert + # outright with no clear error, which was the actual cause of a + # "port's open, cert domain matches, registration still silently fails" + # case that every other layer (firewall, coturn reachability, DNS, cert + # CN/SAN) had already checked out clean on. + if [[ -d "$DOCKER_DIR/caddy/data" ]]; then sed -i "s#CADDY_VOLUME_PLACEHOLDER# - ${DOCKER_DIR}/caddy/data:/caddy-data:ro#" docker-compose.yml else sed -i "/CADDY_VOLUME_PLACEHOLDER/d" docker-compose.yml