iamdoubz
65e777ab41
Headers (08 §2.4) on every response: CSP (connect-src also allows
WEBRTC_WS_URL's origin when set), nosniff, Referrer-Policy,
Permissions-Policy. The dark-mode bootstrap moved from an inline
<script> to /theme.js so script-src stays 'self'.
Phone ACL (08 §2.2): with sip.restrictPhonesToLocalNets, every desk
extension endpoint gets deny 0.0.0.0/0 and permit for each local and
extra net. The spec's snippet was wrong: contact_acl names acl.conf
sections, a pjsip type=acl is the global ACL (it would filter trunks),
and Contact-header rules let a NATed remote phone through. Browser
endpoints come through the reverse proxy and aren't filtered. Golden
case phone-acl. Settings → Security holds it, with the provisioning
switches.
PIN rules for PINs changed from the phone's voicemail menu, which went
around the api: externpasscheck = sp-vm-pincheck (in the Asterisk
image, same rules as isTrivialPin, a unit test keeps them in step) and
minpassword = 4. Accepted PINs reach the api through AMI
VoicemailPasswordChange and are stored; before, the next config write
silently put the old PIN back.
e2e m11-t1: no CSP violations across admin pages; Asterisk refuses a
REGISTER ("Not match Endpoint ACL") until the network is listed; from
the phone, 1111 is refused by the check script and 7391 is stored and
survives a later config write.
Task: M11-T1
52 lines
2.8 KiB
Docker
52 lines
2.8 KiB
Docker
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
FROM debian:trixie-slim AS build
|
|
ARG ASTERISK_VERSION=24.0.0-rc2
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential ca-certificates curl wget pkg-config autoconf automake libtool \
|
|
libedit-dev libjansson-dev libxml2-dev uuid-dev libsqlite3-dev libssl-dev \
|
|
libsrtp2-dev libcurl4-openssl-dev libspeexdsp-dev libogg-dev libvorbis-dev \
|
|
libopus-dev subversion bzip2 patch python3 xmlstarlet
|
|
WORKDIR /usr/src
|
|
RUN curl -fsSLO https://downloads.asterisk.org/pub/telephony/asterisk/releases/asterisk-${ASTERISK_VERSION}.tar.gz \
|
|
&& curl -fsSLO https://downloads.asterisk.org/pub/telephony/asterisk/releases/asterisk-${ASTERISK_VERSION}.sha256 \
|
|
&& sha256sum -c asterisk-${ASTERISK_VERSION}.sha256 \
|
|
&& tar xzf asterisk-${ASTERISK_VERSION}.tar.gz
|
|
WORKDIR /usr/src/asterisk-${ASTERISK_VERSION}
|
|
# The mp3 decoder source (LGPL) must be fetched before configure so menuselect can enable format_mp3.
|
|
RUN contrib/scripts/get_mp3_source.sh || echo "mp3 source unavailable, format_mp3 skipped"
|
|
RUN ./configure --with-pjproject-bundled --with-jansson-bundled \
|
|
&& make menuselect.makeopts \
|
|
&& menuselect/menuselect \
|
|
--disable BUILD_NATIVE \
|
|
--enable format_mp3 \
|
|
--enable CORE-SOUNDS-EN-WAV --enable CORE-SOUNDS-EN-G722 \
|
|
--enable EXTRA-SOUNDS-EN-WAV --enable EXTRA-SOUNDS-EN-G722 \
|
|
--enable MOH-OPSOUND-WAV \
|
|
menuselect.makeopts \
|
|
&& make -j"$(nproc)" && make install DESTDIR=/out \
|
|
&& mkdir -p /out/usr/share/selfphoneng \
|
|
&& mv /out/var/lib/asterisk/moh /out/usr/share/selfphoneng/moh-opsound
|
|
# Debian's /var/run is a symlink to /run; a real directory here breaks the COPY below.
|
|
RUN rm -rf /out/var/run \
|
|
&& mkdir -p /out/etc/asterisk \
|
|
&& cp configs/samples/indications.conf.sample /out/etc/asterisk/indications.conf
|
|
|
|
FROM debian:trixie-slim
|
|
ARG ASTERISK_UID=1000
|
|
ARG ASTERISK_GID=1000
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
libedit2 libjansson4 libxml2 libuuid1 libsqlite3-0 libssl3t64 libsrtp2-1 \
|
|
libcurl4t64 libspeexdsp1 libogg0 libvorbis0a libvorbisenc2 libvorbisfile3 libopus0 \
|
|
gettext-base ca-certificates tzdata \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd -g ${ASTERISK_GID} asterisk && useradd -u ${ASTERISK_UID} -g asterisk -d /var/lib/asterisk -s /usr/sbin/nologin asterisk
|
|
COPY --from=build /out/ /
|
|
COPY conf/ /etc/asterisk/
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
COPY sp-vm-pincheck /usr/local/bin/sp-vm-pincheck
|
|
RUN chmod +x /entrypoint.sh /usr/local/bin/sp-vm-pincheck && mkdir -p /etc/asterisk/selfphoneng /var/lib/asterisk/db /var/lib/asterisk/moh /var/run/asterisk \
|
|
&& chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk /var/run/asterisk
|
|
ENTRYPOINT ["/entrypoint.sh"]
|