┌─────────────────────────────────────────────────────────────────────┐
│                        Docker Compose Stack                         │
│                                                                     │
│  ┌─────────────┐    ┌──────────────┐    ┌─────────────────────┐    │
│  │   Nginx     │    │   Asterisk   │    │     MariaDB         │    │
│  │  (reverse   │◄──►│   21 LTS     │◄──►│  (CDR, realtime     │    │
│  │   proxy,    │    │              │    │   config, voicemail) │    │
│  │   TLS,      │    │  PJSIP       │    │                     │    │
│  │   WebSocket)│    │  ARI         │    └─────────────────────┘    │
│  └──────┬──────┘    │  ConfBridge  │                               │
│         │           │  Voicemail   │    ┌─────────────────────┐    │
│         │           │              │◄──►│      Redis          │    │
│  ┌──────┴──────┐    └──────┬───────┘    │  (ARI state,        │    │
│  │  Certbot    │           │            │   session cache)     │    │
│  │  (Let's     │    ┌──────┴───────┐    └─────────────────────┘    │
│  │   Encrypt)  │    │   Volumes    │                               │
│  └─────────────┘    │  recordings/ │    ┌─────────────────────┐    │
│                     │  voicemail/  │    │    Coturn            │    │
│                     │  logs/       │    │  (TURN/STUN for      │    │
│                     │  certs/      │    │   WebRTC NAT)        │    │
│                     └──────────────┘    └─────────────────────┘    │
└─────────────────────────────────────────────────────────────────────┘

External Traffic:
  ├── SIP/TLS (TCP 5061) ──────────────────► Asterisk PJSIP
  ├── SIP (UDP 5060) ─────────────────────► Asterisk PJSIP
  ├── RTP (UDP 10000-20000) ──────────────► Asterisk Media
  ├── HTTPS (TCP 443) ────────────────────► Nginx ──► ARI / WebRTC
  ├── HTTP (TCP 80) ──────────────────────► Nginx ──► Certbot / redirect
  └── TURN (UDP/TCP 3478, UDP 49152-65535) ► Coturn

asterisk-docker/
├── docker-compose.yml
├── .env
├── asterisk/
│   ├── Dockerfile
│   ├── entrypoint.sh
│   ├── configs/
│   │   ├── pjsip.conf.template
│   │   ├── extensions.conf.template
│   │   ├── modules.conf
│   │   ├── http.conf.template
│   │   ├── rtp.conf
│   │   ├── ari.conf.template
│   │   ├── cdr.conf
│   │   ├── cdr_adaptive_odbc.conf
│   │   ├── res_odbc.conf.template
│   │   ├── odbc.ini.template
│   │   └── voicemail.conf.template
│   └── sounds/
│       └── custom/
├── mariadb/
│   └── init/
│       └── 01-schema.sql
├── nginx/
│   ├── nginx.conf
│   └── conf.d/
│       └── asterisk.conf.template
├── coturn/
│   └── turnserver.conf.template
├── ari-app/
│   ├── requirements.txt
│   └── app.py
├── scripts/
│   ├── backup.sh
│   └── restore.sh
└── data/                    # Created by Docker volumes
    ├── mariadb/
    ├── redis/
    ├── recordings/
    ├── voicemail/
    ├── logs/
    └── certs/

# Remove old Docker packages
sudo apt-get remove -y docker docker-engine docker.io containerd runc 2>/dev/null

# Install prerequisites
sudo apt-get update
sudo apt-get install -y ca-certificates curl gnupg

# Add Docker GPG key
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

# Add Docker repository
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine + Compose plugin
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin

# Verify
docker --version          # Docker 24.x or newer
docker compose version    # v2.x

# SIP signaling
sudo ufw allow 5060/udp    # SIP over UDP
sudo ufw allow 5060/tcp    # SIP over TCP
sudo ufw allow 5061/tcp    # SIP over TLS

# RTP media
sudo ufw allow 10000:20000/udp

# Web (HTTPS, HTTP for ACME challenge)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# TURN server (for WebRTC)
sudo ufw allow 3478/udp
sudo ufw allow 3478/tcp
sudo ufw allow 49152:65535/udp

# Enable firewall
sudo ufw enable

mkdir -p /opt/asterisk-docker/{asterisk/{configs,sounds/custom},mariadb/init,nginx/conf.d,coturn,ari-app,scripts,data}
cd /opt/asterisk-docker

# =============================================================================
# Multi-stage Dockerfile for Asterisk 21 LTS
# Stage 1: Build Asterisk from source with selected modules
# Stage 2: Minimal runtime image with only what's needed
# =============================================================================

# -----------------------------------------------------------------------------
# Stage 1: Builder
# -----------------------------------------------------------------------------
FROM debian:bookworm-slim AS builder

ARG ASTERISK_VERSION=21.7.0
ARG OPUS_VERSION=1.5.2

# Avoid interactive prompts during build
ENV DEBIAN_FRONTEND=noninteractive

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    ca-certificates \
    curl \
    wget \
    git \
    pkg-config \
    autoconf \
    automake \
    libtool \
    # Asterisk core dependencies
    libjansson-dev \
    libxml2-dev \
    libncurses5-dev \
    libsqlite3-dev \
    uuid-dev \
    libssl-dev \
    # PJSIP dependencies
    libpjproject-dev \
    # Sound/codec dependencies
    libspeex-dev \
    libspeexdsp-dev \
    libopus-dev \
    libsndfile1-dev \
    libvorbis-dev \
    # Database/ODBC dependencies
    unixodbc-dev \
    libmariadb-dev \
    odbc-mariadb \
    # Lua for dialplan (optional)
    liblua5.4-dev \
    # HTTP/WebSocket dependencies (for ARI)
    libcurl4-openssl-dev \
    # SRTP for encrypted media
    libsrtp2-dev \
    # Editing/misc
    libedit-dev \
    libxslt1-dev \
    && rm -rf /var/lib/apt/lists/*

# Download and extract Asterisk source
WORKDIR /usr/src
RUN curl -fsSL "https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-${ASTERISK_VERSION}.tar.gz" \
    -o asterisk.tar.gz \
    && tar xzf asterisk.tar.gz \
    && mv asterisk-${ASTERISK_VERSION} asterisk \
    && rm asterisk.tar.gz

WORKDIR /usr/src/asterisk

# Install MP3 source (for mp3 playback support)
RUN contrib/scripts/get_mp3_source.sh || true

# Configure Asterisk
# --with-pjproject-bundled downloads and builds pjproject matched to Asterisk version
# If system libpjproject is sufficient, use --with-pjproject instead
RUN ./configure \
    --prefix=/usr \
    --sysconfdir=/etc \
    --localstatedir=/var \
    --with-crypto \
    --with-ssl \
    --with-srtp \
    --with-pjproject-bundled \
    --with-jansson-bundled \
    --with-opus \
    --without-dahdi \
    --without-pri \
    --without-radius \
    --without-postgres \
    --without-sdl \
    --without-gtk2 \
    --without-x11

# Select modules to build using menuselect
# Enable: PJSIP, ARI, ConfBridge, Opus, Voicemail ODBC, CDR adaptive ODBC
# Disable: chan_sip (deprecated), DAHDI, unnecessary resource hogs
RUN make menuselect.makeopts \
    # ---- Enable essential modules ----
    && menuselect/menuselect \
        --enable res_pjsip \
        --enable res_pjsip_session \
        --enable res_pjsip_authenticator_digest \
        --enable res_pjsip_caller_id \
        --enable res_pjsip_endpoint_identifier_ip \
        --enable res_pjsip_endpoint_identifier_user \
        --enable res_pjsip_header_funcs \
        --enable res_pjsip_nat \
        --enable res_pjsip_outbound_authenticator_digest \
        --enable res_pjsip_outbound_registration \
        --enable res_pjsip_registrar \
        --enable res_pjsip_sdp_rtp \
        --enable res_pjsip_transport_websocket \
        --enable res_pjsip_dtmf_info \
        # ARI and HTTP
        --enable res_ari \
        --enable res_ari_channels \
        --enable res_ari_bridges \
        --enable res_ari_endpoints \
        --enable res_ari_recordings \
        --enable res_ari_playbacks \
        --enable res_ari_sounds \
        --enable res_ari_events \
        --enable res_http_websocket \
        --enable res_stasis \
        --enable res_stasis_answer \
        --enable res_stasis_playback \
        --enable res_stasis_recording \
        --enable res_stasis_snoop \
        # Conferencing (ConfBridge, no DAHDI needed)
        --enable app_confbridge \
        --enable app_audiosocket \
        # Codecs
        --enable codec_opus \
        --enable codec_speex \
        --enable codec_resample \
        # Database / CDR
        --enable cdr_adaptive_odbc \
        --enable cdr_csv \
        --enable func_odbc \
        --enable res_odbc \
        --enable res_odbc_transaction \
        # Voicemail with ODBC storage
        --enable app_voicemail_odbc \
        # Timing (timerfd works without DAHDI)
        --enable res_timing_timerfd \
        # Format support
        --enable format_mp3 \
        --enable format_wav \
        --enable format_wav_gsm \
        --enable format_sln \
        --enable format_ogg_vorbis \
        # ---- Disable what we don't need ----
        --disable chan_sip \
        --disable chan_dahdi \
        --disable chan_skinny \
        --disable chan_mgcp \
        --disable chan_unistim \
        --disable app_meetme \
        --disable res_timing_dahdi \
        --disable cdr_pgsql \
        --disable cel_pgsql \
        menuselect.makeopts

# Build Asterisk (use all available cores)
RUN make -j$(nproc)

# Install to staging directory
RUN make install DESTDIR=/tmp/asterisk-install \
    && make samples DESTDIR=/tmp/asterisk-install

# Download standard English sound files (GSM + WAV formats)
RUN make progdocs || true

# Download core sound packs to staging
RUN mkdir -p /tmp/asterisk-install/var/lib/asterisk/sounds/en \
    && cd /tmp/asterisk-install/var/lib/asterisk/sounds/en \
    && for pack in core extra; do \
         for fmt in gsm wav; do \
           curl -fsSL "https://downloads.asterisk.org/pub/telephony/sounds/asterisk-${pack}-sounds-en-${fmt}-current.tar.gz" \
           | tar xz 2>/dev/null || true; \
         done; \
       done

# Download MOH files
RUN mkdir -p /tmp/asterisk-install/var/lib/asterisk/moh \
    && cd /tmp/asterisk-install/var/lib/asterisk/moh \
    && curl -fsSL "https://downloads.asterisk.org/pub/telephony/sounds/asterisk-moh-opsound-wav-current.tar.gz" \
    | tar xz 2>/dev/null || true


# -----------------------------------------------------------------------------
# Stage 2: Runtime
# -----------------------------------------------------------------------------
FROM debian:bookworm-slim AS runtime

LABEL maintainer="your-email@example.com"
LABEL description="Asterisk 21 LTS - Production Container"
LABEL version="1.0"

ENV DEBIAN_FRONTEND=noninteractive

# Install only runtime dependencies (no compilers, no -dev packages)
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    # Core runtime libs
    libjansson4 \
    libxml2 \
    libncurses6 \
    libsqlite3-0 \
    libuuid1 \
    libssl3 \
    # Codec runtime libs
    libspeex1 \
    libspeexdsp1 \
    libopus0 \
    libsndfile1 \
    libvorbis0a \
    libvorbisenc2 \
    # Database/ODBC runtime
    unixodbc \
    libmariadb3 \
    odbc-mariadb \
    # SRTP
    libsrtp2-1 \
    # HTTP
    libcurl4 \
    # Editing
    libedit2 \
    # Lua runtime
    liblua5.4-0 \
    # envsubst for config templating
    gettext-base \
    # Useful debugging tools (remove in ultra-minimal builds)
    sngrep \
    tcpdump \
    net-tools \
    iputils-ping \
    dnsutils \
    procps \
    && rm -rf /var/lib/apt/lists/*

# Create asterisk user and group
RUN groupadd -r asterisk && useradd -r -g asterisk -s /bin/false asterisk

# Copy compiled Asterisk from builder stage
COPY --from=builder /tmp/asterisk-install/ /

# Create required directories with proper ownership
RUN mkdir -p \
    /var/run/asterisk \
    /var/log/asterisk \
    /var/log/asterisk/cdr-csv \
    /var/spool/asterisk/monitor \
    /var/spool/asterisk/voicemail \
    /var/spool/asterisk/tmp \
    /var/lib/asterisk \
    /etc/asterisk \
    && chown -R asterisk:asterisk \
    /var/run/asterisk \
    /var/log/asterisk \
    /var/spool/asterisk \
    /var/lib/asterisk \
    /etc/asterisk

# Copy entrypoint script
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Health check - verify Asterisk is responding
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD asterisk -rx "core show version" || exit 1

# Expose ports
# 5060: SIP UDP/TCP
# 5061: SIP TLS
# 8088: HTTP/ARI/WebSocket
# 8089: HTTPS/ARI/WebSocket
# 5038: AMI
# 10000-20000: RTP media
EXPOSE 5060/udp 5060/tcp 5061/tcp 8088/tcp 8089/tcp 5038/tcp
EXPOSE 10000-20000/udp

# Run as root initially (entrypoint drops privileges)
ENTRYPOINT ["/entrypoint.sh"]
CMD ["asterisk", "-fp"]

#!/bin/bash
set -e

# =============================================================================
# Asterisk Container Entrypoint
# - Processes config templates (envsubst)
# - Sets up ODBC configuration
# - Fixes permissions
# - Starts Asterisk with proper flags
# =============================================================================

echo "=== Asterisk Container Starting ==="
echo "Hostname: $(hostname)"
echo "Date: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"

# ---- Step 1: Process configuration templates ----
# Any file ending in .template gets processed with envsubst
# Environment variables like ${PJSIP_EXTERNAL_IP} are replaced with values
echo "Processing configuration templates..."

TEMPLATE_DIR="/etc/asterisk/templates"
CONFIG_DIR="/etc/asterisk"

if [ -d "$TEMPLATE_DIR" ]; then
    for template in "$TEMPLATE_DIR"/*.template; do
        [ -f "$template" ] || continue
        filename=$(basename "$template" .template)
        echo "  Rendering: $filename"
        envsubst < "$template" > "$CONFIG_DIR/$filename"
    done
fi

# ---- Step 2: Process ODBC configuration ----
if [ -f "/etc/odbc.ini.template" ]; then
    echo "Rendering ODBC configuration..."
    envsubst < /etc/odbc.ini.template > /etc/odbc.ini
fi

# ---- Step 3: Set NAT/network variables ----
# Auto-detect public IP if not provided
if [ -z "$PJSIP_EXTERNAL_IP" ]; then
    echo "PJSIP_EXTERNAL_IP not set, auto-detecting..."
    PJSIP_EXTERNAL_IP=$(curl -s -4 --max-time 5 https://ifconfig.me || echo "")
    if [ -n "$PJSIP_EXTERNAL_IP" ]; then
        echo "  Detected external IP: $PJSIP_EXTERNAL_IP"
        export PJSIP_EXTERNAL_IP
    else
        echo "  WARNING: Could not detect external IP. NAT may not work correctly."
    fi
fi

# Re-process templates now that PJSIP_EXTERNAL_IP might be set
if [ -d "$TEMPLATE_DIR" ]; then
    for template in "$TEMPLATE_DIR"/*.template; do
        [ -f "$template" ] || continue
        filename=$(basename "$template" .template)
        envsubst < "$template" > "$CONFIG_DIR/$filename"
    done
fi

# ---- Step 4: Fix permissions ----
echo "Setting permissions..."
chown -R asterisk:asterisk /var/run/asterisk
chown -R asterisk:asterisk /var/log/asterisk
chown -R asterisk:asterisk /var/spool/asterisk
chown -R asterisk:asterisk /etc/asterisk
chown -R asterisk:asterisk /var/lib/asterisk

# ---- Step 5: Wait for database ----
if [ -n "$DB_HOST" ]; then
    echo "Waiting for database at $DB_HOST:${DB_PORT:-3306}..."
    for i in $(seq 1 30); do
        if curl -sf "telnet://$DB_HOST:${DB_PORT:-3306}" --max-time 2 >/dev/null 2>&1 || \
           bash -c "echo >/dev/tcp/$DB_HOST/${DB_PORT:-3306}" 2>/dev/null; then
            echo "  Database is ready!"
            break
        fi
        echo "  Attempt $i/30 - waiting..."
        sleep 2
    done
fi

# ---- Step 6: Start Asterisk ----
echo "Starting Asterisk..."
echo "Command: $@"

# If the command is 'asterisk', run as the asterisk user
if [ "$1" = "asterisk" ]; then
    exec "$@" -U asterisk -G asterisk
else
    exec "$@"
fi

cd /opt/asterisk-docker

# Build the image (takes 10-20 minutes on first build)
docker build -t asterisk:21-custom ./asterisk/

# Verify the image size
docker images asterisk:21-custom
# REPOSITORY         TAG         SIZE
# asterisk           21-custom   ~250MB

# Quick smoke test
docker run --rm asterisk:21-custom asterisk -V
# Asterisk 21.7.0

# Test module loading
docker run --rm asterisk:21-custom asterisk -rx "module show like pjsip" 2>/dev/null | head -5

# Build with a different Asterisk version
docker build --build-arg ASTERISK_VERSION=21.8.0 -t asterisk:21.8 ./asterisk/

# Build with Asterisk 20 LTS instead
docker build --build-arg ASTERISK_VERSION=20.11.0 -t asterisk:20 ./asterisk/

# =============================================================================
# Asterisk Docker Stack - Environment Variables
# Copy this file to .env and customize for your deployment
# =============================================================================

# ---- General ----
COMPOSE_PROJECT_NAME=asterisk-stack
TZ=UTC

# ---- Network / NAT ----
# Your server's public IP address (REQUIRED for SIP/RTP to work)
PJSIP_EXTERNAL_IP=YOUR_SERVER_IP
# Your domain name (for TLS certificates)
DOMAIN=YOUR_DOMAIN
# Contact email for Let's Encrypt
ACME_EMAIL=admin@YOUR_DOMAIN

# ---- SIP Configuration ----
# Default SIP endpoint password (change this!)
SIP_DEFAULT_PASSWORD=Ch4ng3M3N0w!
# SIP realm for authentication
SIP_REALM=YOUR_DOMAIN

# ---- RTP ----
RTP_PORT_START=10000
RTP_PORT_END=20000

# ---- Database ----
DB_HOST=mariadb
DB_PORT=3306
DB_NAME=asterisk
DB_USER=asterisk
DB_PASSWORD=Ast3r1sk_DB_2026!
DB_ROOT_PASSWORD=R00t_DB_S3cur3!

# ---- Redis ----
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=R3d1s_S3cur3_2026!

# ---- ARI ----
ARI_USERNAME=ari_user
ARI_PASSWORD=Ar1_S3cur3_2026!

# ---- AMI (Asterisk Manager Interface) ----
AMI_USERNAME=ami_admin
AMI_PASSWORD=Am1_S3cur3_2026!

# ---- TURN Server ----
TURN_SECRET=T0rn_Sh4r3d_S3cr3t_2026!
TURN_REALM=YOUR_DOMAIN

# ---- Nginx ----
NGINX_CLIENT_MAX_BODY=50M

# =============================================================================
# Asterisk Production Stack - Docker Compose
# =============================================================================
# Usage:
#   docker compose up -d          # Start all services
#   docker compose logs -f        # Follow all logs
#   docker compose exec asterisk asterisk -rvvv   # Asterisk CLI
#   docker compose down           # Stop all services
# =============================================================================

services:

  # ---------------------------------------------------------------------------
  # Asterisk PBX
  # ---------------------------------------------------------------------------
  asterisk:
    build:
      context: ./asterisk
      dockerfile: Dockerfile
    container_name: asterisk
    restart: unless-stopped
    # For production with real SIP trunks, host networking is often simplest.
    # See Section 7 for detailed discussion of networking modes.
    # Option A: Bridge networking (more isolated, more complex NAT config)
    networks:
      - asterisk-net
    ports:
      # SIP signaling
      - "5060:5060/udp"
      - "5060:5060/tcp"
      - "5061:5061/tcp"
      # AMI (restrict to localhost in production)
      - "127.0.0.1:5038:5038/tcp"
      # ARI HTTP (proxied through Nginx, but expose for internal access)
      - "127.0.0.1:8088:8088/tcp"
      # RTP media - this is a LARGE range
      # See Section 7 for why this is necessary and how to minimize it
      - "10000-20000:10000-20000/udp"
    # Option B: Host networking (uncomment below, comment out ports above)
    # network_mode: host
    environment:
      - TZ=${TZ:-UTC}
      - PJSIP_EXTERNAL_IP=${PJSIP_EXTERNAL_IP}
      - DOMAIN=${DOMAIN}
      - SIP_DEFAULT_PASSWORD=${SIP_DEFAULT_PASSWORD}
      - SIP_REALM=${SIP_REALM:-${DOMAIN}}
      - RTP_PORT_START=${RTP_PORT_START:-10000}
      - RTP_PORT_END=${RTP_PORT_END:-20000}
      - DB_HOST=${DB_HOST:-mariadb}
      - DB_PORT=${DB_PORT:-3306}
      - DB_NAME=${DB_NAME:-asterisk}
      - DB_USER=${DB_USER:-asterisk}
      - DB_PASSWORD=${DB_PASSWORD}
      - REDIS_HOST=${REDIS_HOST:-redis}
      - REDIS_PORT=${REDIS_PORT:-6379}
      - ARI_USERNAME=${ARI_USERNAME:-ari_user}
      - ARI_PASSWORD=${ARI_PASSWORD}
      - AMI_USERNAME=${AMI_USERNAME:-ami_admin}
      - AMI_PASSWORD=${AMI_PASSWORD}
    volumes:
      # Configuration templates (processed by entrypoint)
      - ./asterisk/configs:/etc/asterisk/templates:ro
      # Static configs (not templated)
      - ./asterisk/configs/modules.conf:/etc/asterisk/modules.conf:ro
      - ./asterisk/configs/rtp.conf:/etc/asterisk/rtp.conf:ro
      - ./asterisk/configs/cdr.conf:/etc/asterisk/cdr.conf:ro
      # ODBC configuration template
      - ./asterisk/configs/odbc.ini.template:/etc/odbc.ini.template:ro
      # Persistent data
      - recordings:/var/spool/asterisk/monitor
      - voicemail:/var/spool/asterisk/voicemail
      - asterisk-logs:/var/log/asterisk
      # Custom sounds
      - ./asterisk/sounds/custom:/var/lib/asterisk/sounds/custom:ro
      # TLS certificates (shared with Nginx/Certbot)
      - certs:/etc/asterisk/certs:ro
    depends_on:
      mariadb:
        condition: service_healthy
      redis:
        condition: service_healthy
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
      core:
        soft: -1
        hard: -1
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 4G
        reservations:
          cpus: '1'
          memory: 512M
    healthcheck:
      test: ["CMD", "asterisk", "-rx", "core show version"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"

  # ---------------------------------------------------------------------------
  # MariaDB - CDR, Realtime Config, Voicemail
  # ---------------------------------------------------------------------------
  mariadb:
    image: mariadb:11.4
    container_name: asterisk-mariadb
    restart: unless-stopped
    networks:
      - asterisk-net
    # Do NOT expose port externally in production
    # Uncomment only for debugging:
    # ports:
    #   - "127.0.0.1:3306:3306/tcp"
    environment:
      - MARIADB_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
      - MARIADB_DATABASE=${DB_NAME:-asterisk}
      - MARIADB_USER=${DB_USER:-asterisk}
      - MARIADB_PASSWORD=${DB_PASSWORD}
      - TZ=${TZ:-UTC}
    volumes:
      - mariadb-data:/var/lib/mysql
      - ./mariadb/init:/docker-entrypoint-initdb.d:ro
    command: >
      --character-set-server=utf8mb4
      --collation-server=utf8mb4_unicode_ci
      --max-connections=200
      --innodb-buffer-pool-size=256M
      --innodb-log-file-size=64M
      --max-allowed-packet=64M
      --slow-query-log=1
      --slow-query-log-file=/var/lib/mysql/slow.log
      --long-query-time=2
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 1G
        reservations:
          memory: 256M
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 15s
      timeout: 5s
      start_period: 30s
      retries: 5
    logging:
      driver: json-file
      options:
        max-size: "20m"
        max-file: "3"

  # ---------------------------------------------------------------------------
  # Redis - ARI State, Session Cache
  # ---------------------------------------------------------------------------
  redis:
    image: redis:7-alpine
    container_name: asterisk-redis
    restart: unless-stopped
    networks:
      - asterisk-net
    command: >
      redis-server
      --requirepass ${REDIS_PASSWORD}
      --maxmemory 128mb
      --maxmemory-policy allkeys-lru
      --appendonly yes
      --appendfsync everysec
    volumes:
      - redis-data:/data
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 15s
      timeout: 3s
      retries: 3
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # ---------------------------------------------------------------------------
  # Nginx - Reverse Proxy, TLS Termination, WebSocket Proxy
  # ---------------------------------------------------------------------------
  nginx:
    image: nginx:1.27-alpine
    container_name: asterisk-nginx
    restart: unless-stopped
    networks:
      - asterisk-net
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
    environment:
      - DOMAIN=${DOMAIN}
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - certs:/etc/nginx/certs:ro
      - certbot-webroot:/var/www/certbot:ro
    depends_on:
      - asterisk
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 256M
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/health"]
      interval: 30s
      timeout: 5s
      retries: 3
    logging:
      driver: json-file
      options:
        max-size: "20m"
        max-file: "3"

  # ---------------------------------------------------------------------------
  # Certbot - Let's Encrypt Certificate Management
  # ---------------------------------------------------------------------------
  certbot:
    image: certbot/certbot:latest
    container_name: asterisk-certbot
    restart: unless-stopped
    volumes:
      - certs:/etc/letsencrypt
      - certbot-webroot:/var/www/certbot
    # Check for renewal twice daily (standard recommendation)
    entrypoint: /bin/sh -c "trap exit TERM; while :; do certbot renew --quiet; sleep 12h & wait $${!}; done"
    depends_on:
      - nginx

  # ---------------------------------------------------------------------------
  # Coturn - TURN/STUN Server for WebRTC NAT Traversal
  # ---------------------------------------------------------------------------
  coturn:
    image: coturn/coturn:latest
    container_name: asterisk-coturn
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./coturn/turnserver.conf:/etc/turnserver.conf:ro
      - certs:/etc/certs:ro
    command: ["-c", "/etc/turnserver.conf"]
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
    logging:
      driver: json-file
      options:
        max-size: "20m"
        max-file: "3"

# =============================================================================
# Networks
# =============================================================================
networks:
  asterisk-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.25.0.0/24

# =============================================================================
# Volumes
# =============================================================================
volumes:
  mariadb-data:
    driver: local
  redis-data:
    driver: local
  recordings:
    driver: local
    driver_opts:
      type: none
      device: /opt/asterisk-docker/data/recordings
      o: bind
  voicemail:
    driver: local
    driver_opts:
      type: none
      device: /opt/asterisk-docker/data/voicemail
      o: bind
  asterisk-logs:
    driver: local
    driver_opts:
      type: none
      device: /opt/asterisk-docker/data/logs
      o: bind
  certs:
    driver: local
    driver_opts:
      type: none
      device: /opt/asterisk-docker/data/certs
      o: bind
  certbot-webroot:
    driver: local

cd /opt/asterisk-docker

# Create bind-mount directories
mkdir -p data/{recordings,voicemail,logs,certs}

# Build and start everything
docker compose up -d --build

# Watch logs during startup
docker compose logs -f asterisk

# Verify all containers are healthy
docker compose ps

# Access Asterisk CLI
docker compose exec asterisk asterisk -rvvv

; =============================================================================
; PJSIP Configuration - Containerized Asterisk
; Variables like ${VARIABLE} are replaced by entrypoint.sh at container start
; =============================================================================

; ---- Global Settings ----
[global]
type = global
max_forwards = 70
user_agent = Asterisk PBX
default_outbound_endpoint = default-endpoint
keep_alive_interval = 90

; ---- System Settings ----
[system]
type = system
timer_t1 = 500
timer_b = 32000
compact_headers = no

; =============================================================================
; Transports
; =============================================================================

; ---- UDP Transport ----
[transport-udp]
type = transport
protocol = udp
bind = 0.0.0.0:5060
; NAT settings - critical for containerized Asterisk
external_media_address = ${PJSIP_EXTERNAL_IP}
external_signaling_address = ${PJSIP_EXTERNAL_IP}
local_net = 172.25.0.0/24
local_net = 10.0.0.0/8
local_net = 172.16.0.0/12
local_net = 192.168.0.0/16
local_net = 127.0.0.0/8

; ---- TCP Transport ----
[transport-tcp]
type = transport
protocol = tcp
bind = 0.0.0.0:5060
external_media_address = ${PJSIP_EXTERNAL_IP}
external_signaling_address = ${PJSIP_EXTERNAL_IP}
local_net = 172.25.0.0/24
local_net = 10.0.0.0/8
local_net = 172.16.0.0/12
local_net = 192.168.0.0/16
local_net = 127.0.0.0/8

; ---- TLS Transport ----
[transport-tls]
type = transport
protocol = tls
bind = 0.0.0.0:5061
external_media_address = ${PJSIP_EXTERNAL_IP}
external_signaling_address = ${PJSIP_EXTERNAL_IP}
local_net = 172.25.0.0/24
local_net = 10.0.0.0/8
local_net = 172.16.0.0/12
local_net = 192.168.0.0/16
local_net = 127.0.0.0/8
cert_file = /etc/asterisk/certs/live/${DOMAIN}/fullchain.pem
priv_key_file = /etc/asterisk/certs/live/${DOMAIN}/privkey.pem
method = tlsv1_2
; cipher = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256

; ---- WebSocket Transport (for WebRTC) ----
[transport-wss]
type = transport
protocol = wss
bind = 0.0.0.0:8089
external_media_address = ${PJSIP_EXTERNAL_IP}
external_signaling_address = ${PJSIP_EXTERNAL_IP}
local_net = 172.25.0.0/24
local_net = 10.0.0.0/8
local_net = 172.16.0.0/12
local_net = 192.168.0.0/16
local_net = 127.0.0.0/8
cert_file = /etc/asterisk/certs/live/${DOMAIN}/fullchain.pem
priv_key_file = /etc/asterisk/certs/live/${DOMAIN}/privkey.pem

; =============================================================================
; Endpoint Templates
; =============================================================================

; ---- Template for standard SIP phones ----
[endpoint-internal](!)
type = endpoint
context = from-internal
dtmf_mode = rfc4733
disallow = all
allow = opus,g722,ulaw,alaw
direct_media = no
rtp_symmetric = yes
force_rport = yes
rewrite_contact = yes
ice_support = no
media_encryption = no
trust_id_inbound = yes
send_rpid = yes
send_pai = yes
callerid_privacy = allowed_not_screened
; One-way audio fix for NAT
media_address = ${PJSIP_EXTERNAL_IP}

; ---- Template for WebRTC endpoints ----
[endpoint-webrtc](!)
type = endpoint
context = from-internal
dtmf_mode = rfc4733
disallow = all
allow = opus,ulaw
direct_media = no
rtp_symmetric = yes
force_rport = yes
rewrite_contact = yes
ice_support = yes
media_encryption = dtls
dtls_auto_generate_cert = yes
dtls_verify = fingerprint
dtls_setup = actpass
media_use_received_transport = yes
trust_id_inbound = yes
webrtc = yes

; ---- Template for SIP trunks ----
[endpoint-trunk](!)
type = endpoint
context = from-trunk
dtmf_mode = rfc4733
disallow = all
allow = g722,ulaw,alaw
direct_media = no
rtp_symmetric = yes
force_rport = yes
rewrite_contact = yes
send_rpid = yes
send_pai = yes
media_address = ${PJSIP_EXTERNAL_IP}
t38_udptl = yes
t38_udptl_ec = redundancy

; =============================================================================
; Sample Endpoints
; =============================================================================

; ---- Extension 1001 (SIP Phone) ----
[1001](endpoint-internal)
auth = 1001-auth
aors = 1001-aor
callerid = "Reception" <1001>
mailboxes = 1001@default
call_group = 1
pickup_group = 1

[1001-auth]
type = auth
auth_type = userpass
username = 1001
password = ${SIP_DEFAULT_PASSWORD}
realm = ${SIP_REALM}

[1001-aor]
type = aor
max_contacts = 3
remove_existing = yes
qualify_frequency = 60
qualify_timeout = 5
minimum_expiration = 120
default_expiration = 300

; ---- Extension 1002 (SIP Phone) ----
[1002](endpoint-internal)
auth = 1002-auth
aors = 1002-aor
callerid = "Sales" <1002>
mailboxes = 1002@default
call_group = 1
pickup_group = 1

[1002-auth]
type = auth
auth_type = userpass
username = 1002
password = ${SIP_DEFAULT_PASSWORD}
realm = ${SIP_REALM}

[1002-aor]
type = aor
max_contacts = 3
remove_existing = yes
qualify_frequency = 60
qualify_timeout = 5

; ---- Extension 1010 (WebRTC Softphone) ----
[1010](endpoint-webrtc)
auth = 1010-auth
aors = 1010-aor
callerid = "Web Phone" <1010>
mailboxes = 1010@default

[1010-auth]
type = auth
auth_type = userpass
username = 1010
password = ${SIP_DEFAULT_PASSWORD}
realm = ${SIP_REALM}

[1010-aor]
type = aor
max_contacts = 5
remove_existing = yes
qualify_frequency = 30

; ---- Sample SIP Trunk ----
; Uncomment and configure for your SIP provider
; [my-trunk](endpoint-trunk)
; outbound_auth = my-trunk-auth
; aors = my-trunk-aor
; from_domain = sip.provider.example.com
; from_user = your_account_id
;
; [my-trunk-auth]
; type = auth
; auth_type = userpass
; username = your_account_id
; password = your_trunk_password
;
; [my-trunk-aor]
; type = aor
; contact = sip:sip.provider.example.com
; qualify_frequency = 60
;
; [my-trunk-identify]
; type = identify
; endpoint = my-trunk
; match = sip.provider.example.com

; ---- Default Endpoint (catch-all for unmatched) ----
[default-endpoint]
type = endpoint
context = default
disallow = all
allow = ulaw
transport = transport-udp

; =============================================================================
; Dialplan - Containerized Asterisk
; =============================================================================

[general]
static = yes
writeprotect = no
clearglobalvars = no

[globals]
; Voicemail context
VM_CONTEXT = default
; Ring time before voicemail (seconds)
RING_TIMEOUT = 25
; Company name for auto-attendant
COMPANY_NAME = "Acme Corp"
; ARI application name
ARI_APP = autoattendant
; External caller ID for outbound calls
TRUNK_CID = "Main Line" <+15551234567>

; =============================================================================
; Internal Calls Context
; =============================================================================
[from-internal]
; ---- Direct extension dialing (1001-1099) ----
exten => _10XX,1,NoOp(Internal call to ${EXTEN})
 same => n,Set(CALLERID(name)=${CALLERID(name)})
 same => n,Dial(PJSIP/${EXTEN},${RING_TIMEOUT},tTkK)
 same => n,GotoIf($["${DIALSTATUS}" = "BUSY"]?busy:unavail)
 same => n(busy),VoiceMail(${EXTEN}@${VM_CONTEXT},b)
 same => n,Hangup()
 same => n(unavail),VoiceMail(${EXTEN}@${VM_CONTEXT},u)
 same => n,Hangup()

; ---- Ring group: Sales (ring all sales extensions) ----
exten => 2001,1,NoOp(Ring Group: Sales)
 same => n,Set(CALLERID(name)=${CALLERID(name)} [Sales])
 same => n,Dial(PJSIP/1001&PJSIP/1002&PJSIP/1003,${RING_TIMEOUT},tTkK)
 same => n,VoiceMail(2001@${VM_CONTEXT},u)
 same => n,Hangup()

; ---- Ring group: Support ----
exten => 2002,1,NoOp(Ring Group: Support)
 same => n,Set(CALLERID(name)=${CALLERID(name)} [Support])
 same => n,Dial(PJSIP/1004&PJSIP/1005&PJSIP/1006,${RING_TIMEOUT},tTkK)
 same => n,VoiceMail(2002@${VM_CONTEXT},u)
 same => n,Hangup()

; ---- Conference rooms (3001-3009) ----
exten => _300X,1,NoOp(Conference Room ${EXTEN})
 same => n,Answer()
 same => n,ConfBridge(${EXTEN},default_bridge,default_user)
 same => n,Hangup()

; ---- Admin conference (3000 with admin profile) ----
exten => 3000,1,NoOp(Admin Conference)
 same => n,Answer()
 same => n,ConfBridge(3000,default_bridge,admin_user)
 same => n,Hangup()

; ---- Voicemail access ----
exten => *97,1,NoOp(Voicemail Access)
 same => n,VoiceMailMain(${CALLERID(num)}@${VM_CONTEXT})
 same => n,Hangup()

; ---- Voicemail access (other mailbox) ----
exten => *98,1,NoOp(Voicemail Access - Other Mailbox)
 same => n,VoiceMailMain(@${VM_CONTEXT})
 same => n,Hangup()

; ---- Echo test ----
exten => *43,1,NoOp(Echo Test)
 same => n,Answer()
 same => n,Playback(demo-echotest)
 same => n,Echo()
 same => n,Playback(demo-echodone)
 same => n,Hangup()

; ---- Speaking clock ----
exten => *60,1,NoOp(Speaking Clock)
 same => n,Answer()
 same => n,SayUnixTime(,,IMp)
 same => n,Hangup()

; ---- Attended transfer ----
exten => _*2.,1,NoOp(Attended Transfer to ${EXTEN:2})
 same => n,Dial(PJSIP/${EXTEN:2},${RING_TIMEOUT},tTkK)
 same => n,Hangup()

; ---- Outbound calls via trunk ----
; Dial 9 + number for outbound
exten => _9.,1,NoOp(Outbound call to ${EXTEN:1})
 same => n,Set(CALLERID(all)=${TRUNK_CID})
 same => n,Dial(PJSIP/${EXTEN:1}@my-trunk,60,tTkK)
 same => n,Hangup()

; ---- ARI-controlled calls ----
; Prefix with 7 to route to ARI application
exten => _7.,1,NoOp(ARI Application for ${EXTEN:1})
 same => n,Stasis(${ARI_APP},${EXTEN:1})
 same => n,Hangup()

; ---- Invalid extension ----
exten => i,1,Playback(invalid)
 same => n,Hangup()

; =============================================================================
; Inbound Calls Context (from SIP trunks)
; =============================================================================
[from-trunk]
; ---- Main IVR ----
exten => _X.,1,NoOp(Inbound call from ${CALLERID(num)} to ${EXTEN})
 same => n,Answer()
 same => n,Wait(1)
 same => n,Set(TIMEOUT(response)=10)
 same => n,Set(TIMEOUT(digit)=5)
 same => n(ivr),Background(custom/welcome)
 same => n,WaitExten(5)
 same => n,Goto(ivr-timeout,s,1)

; IVR option 1: Sales
exten => 1,1,NoOp(IVR: Sales selected)
 same => n,Playback(custom/transferring-sales)
 same => n,Goto(from-internal,2001,1)

; IVR option 2: Support
exten => 2,1,NoOp(IVR: Support selected)
 same => n,Playback(custom/transferring-support)
 same => n,Goto(from-internal,2002,1)

; IVR option 0: Operator
exten => 0,1,NoOp(IVR: Operator selected)
 same => n,Goto(from-internal,1001,1)

; IVR timeout or invalid
[ivr-timeout]
exten => s,1,NoOp(IVR timeout - routing to reception)
 same => n,Playback(custom/no-input)
 same => n,Goto(from-internal,1001,1)

; =============================================================================
; Default Context (catch-all, drop unknown traffic)
; =============================================================================
[default]
exten => _X.,1,NoOp(Dropping unrouted call to ${EXTEN} from ${CALLERID(num)})
 same => n,Hangup(21)

exten => _[a-z].,1,Hangup(21)

; =============================================================================
; Module Loading Configuration
; Load only what we need for a smaller memory footprint
; =============================================================================

[modules]
autoload = no

; ---- Core / Resource ----
load = res_pjproject.so
load = res_sorcery_astdb.so
load = res_sorcery_config.so
load = res_sorcery_memory.so
load = res_sorcery_memory_cache.so
load = res_sorcery_realtime.so
load = res_timing_timerfd.so
load = res_crypto.so
load = res_http_websocket.so
load = res_musiconhold.so
load = res_rtp_asterisk.so
load = res_rtp_multicast.so
load = res_speech.so
load = res_stasis.so
load = res_stasis_answer.so
load = res_stasis_playback.so
load = res_stasis_recording.so
load = res_stasis_snoop.so
load = res_stasis_device_state.so

; ---- PJSIP ----
load = res_pjsip.so
load = res_pjsip_authenticator_digest.so
load = res_pjsip_caller_id.so
load = res_pjsip_dialog_info_body_generator.so
load = res_pjsip_diversion.so
load = res_pjsip_dtmf_info.so
load = res_pjsip_endpoint_identifier_ip.so
load = res_pjsip_endpoint_identifier_user.so
load = res_pjsip_exten_state.so
load = res_pjsip_header_funcs.so
load = res_pjsip_logger.so
load = res_pjsip_messaging.so
load = res_pjsip_mwi.so
load = res_pjsip_mwi_body_generator.so
load = res_pjsip_nat.so
load = res_pjsip_notify.so
load = res_pjsip_outbound_authenticator_digest.so
load = res_pjsip_outbound_registration.so
load = res_pjsip_pidf_body_generator.so
load = res_pjsip_pidf_digium_body_supplement.so
load = res_pjsip_pidf_eyebeam_body_supplement.so
load = res_pjsip_publish_asterisk.so
load = res_pjsip_pubsub.so
load = res_pjsip_refer.so
load = res_pjsip_registrar.so
load = res_pjsip_rfc3326.so
load = res_pjsip_sdp_rtp.so
load = res_pjsip_send_to_voicemail.so
load = res_pjsip_session.so
load = res_pjsip_t38.so
load = res_pjsip_transport_websocket.so

; ---- ARI (Asterisk REST Interface) ----
load = res_ari.so
load = res_ari_applications.so
load = res_ari_asterisk.so
load = res_ari_bridges.so
load = res_ari_channels.so
load = res_ari_device_states.so
load = res_ari_endpoints.so
load = res_ari_events.so
load = res_ari_mailboxes.so
load = res_ari_model.so
load = res_ari_playbacks.so
load = res_ari_recordings.so
load = res_ari_sounds.so

; ---- Applications ----
load = app_bridgewait.so
load = app_confbridge.so
load = app_dial.so
load = app_directed_pickup.so
load = app_echo.so
load = app_exec.so
load = app_macro.so
load = app_mixmonitor.so
load = app_originate.so
load = app_playback.so
load = app_queue.so
load = app_read.so
load = app_record.so
load = app_sayunixtime.so
load = app_senddtmf.so
load = app_stack.so
load = app_stasis.so
load = app_transfer.so
load = app_verbose.so
load = app_voicemail.so
load = app_waituntil.so

; ---- Bridging ----
load = bridge_builtin_features.so
load = bridge_builtin_interval_features.so
load = bridge_holding.so
load = bridge_native_rtp.so
load = bridge_simple.so
load = bridge_softmix.so

; ---- CDR ----
load = cdr_adaptive_odbc.so
load = cdr_csv.so
load = cdr_custom.so
load = cdr_manager.so

; ---- Channel ----
load = chan_bridge_media.so
load = chan_pjsip.so
load = chan_rtp.so

; ---- Codecs ----
load = codec_a_mu.so
load = codec_adpcm.so
load = codec_alaw.so
load = codec_g722.so
load = codec_g726.so
load = codec_gsm.so
load = codec_opus.so
load = codec_resample.so
load = codec_speex.so
load = codec_ulaw.so

; ---- Formats ----
load = format_g722.so
load = format_g726.so
load = format_gsm.so
load = format_mp3.so
load = format_ogg_vorbis.so
load = format_pcm.so
load = format_sln.so
load = format_wav.so
load = format_wav_gsm.so

; ---- Functions ----
load = func_base64.so
load = func_callerid.so
load = func_cdr.so
load = func_channel.so
load = func_config.so
load = func_curl.so
load = func_cut.so
load = func_db.so
load = func_devstate.so
load = func_dialgroup.so
load = func_dialplan.so
load = func_env.so
load = func_global.so
load = func_groupcount.so
load = func_hangupcause.so
load = func_logic.so
load = func_math.so
load = func_md5.so
load = func_module.so
load = func_odbc.so
load = func_periodic_hook.so
load = func_pjsip_aor.so
load = func_pjsip_contact.so
load = func_pjsip_endpoint.so
load = func_realtime.so
load = func_shell.so
load = func_sprintf.so
load = func_strings.so
load = func_sysinfo.so
load = func_timeout.so
load = func_uri.so
load = func_version.so
load = func_volume.so

; ---- PBX ----
load = pbx_config.so
load = pbx_lounge.so
load = pbx_realtime.so

; ---- Database ----
load = res_config_odbc.so
load = res_odbc.so
load = res_odbc_transaction.so
load = func_realtime.so

; =============================================================================
; HTTP Server Configuration (for ARI and WebSocket)
; =============================================================================

[general]
enabled = yes
bindaddr = 0.0.0.0
bindport = 8088
; TLS is handled by Nginx reverse proxy
; For direct TLS access, uncomment below:
; tlsenable = yes
; tlsbindaddr = 0.0.0.0:8089
; tlscertfile = /etc/asterisk/certs/live/${DOMAIN}/fullchain.pem
; tlsprivatekey = /etc/asterisk/certs/live/${DOMAIN}/privkey.pem
prefix =
sessionlimit = 100
session_inactivity = 30000
session_keep_alive = 15000

; =============================================================================
; ARI (Asterisk REST Interface) Configuration
; =============================================================================

[general]
enabled = yes
pretty = yes
allowed_origins = https://${DOMAIN}

[${ARI_USERNAME}]
type = user
read_only = no
password = ${ARI_PASSWORD}

; =============================================================================
; RTP Configuration
; Port range MUST match the Docker port mapping in docker-compose.yml
; =============================================================================

[general]
rtpstart = 10000
rtpend = 20000
; Strict RTP - helps prevent RTP injection attacks
strictrtp = yes
; Probation count before RTP source is accepted
probation = 4
; Enable symmetric RTP (important for NAT)
icesupport = yes
stunaddr = stun.l.google.com:19302
; RTP keepalives (prevent NAT timeout)
rtpkeepalive = 15
; DTMF timeout
dtmftimeout = 3000

; =============================================================================
; CDR (Call Detail Records) Configuration
; =============================================================================

[general]
enable = yes
unanswered = yes
congestion = yes
endbeforehexten = no
initiatedseconds = yes
batch = yes
size = 100
time = 300

; =============================================================================
; CDR Adaptive ODBC - Write CDR to MariaDB
; =============================================================================

[asterisk-cdr]
connection = asterisk-connector
table = cdr
alias start => calldate
alias clid => clid
alias src => src
alias dst => dst
alias dcontext => dcontext
alias channel => channel
alias dstchannel => dstchannel
alias lastapp => lastapp
alias lastdata => lastdata
alias duration => duration
alias billsec => billsec
alias disposition => disposition
alias amaflags => amaflags
alias accountcode => accountcode
alias uniqueid => uniqueid
alias userfield => userfield
alias peeraccount => peeraccount
alias linkedid => linkedid
alias sequence => sequence

; =============================================================================
; ODBC Connection Configuration
; =============================================================================

[asterisk-connector]
enabled = yes
dsn = asterisk-connector
username = ${DB_USER}
password = ${DB_PASSWORD}
pre-connect = yes
sanitysql = SELECT 1
max_connections = 20
connect_timeout = 5
negative_connection_cache = 600

[asterisk-connector]
Description = MariaDB Asterisk Connection
Driver = /usr/lib/x86_64-linux-gnu/odbc/libmaodbc.so
Server = ${DB_HOST}
Port = ${DB_PORT}
Database = ${DB_NAME}
Option = 3
Socket =

; =============================================================================
; Voicemail Configuration
; =============================================================================

[general]
format = wav49|gsm|wav
serveremail = voicemail@${DOMAIN}
attach = yes
skipms = 3000
maxsilence = 10
silencethreshold = 128
maxlogins = 3
minsecs = 3
maxsecs = 300
maxmsg = 100
moveheard = yes
forward_urgent_auto = yes
; Email notification (requires sendmail/msmtp in container)
; emailsubject = New voicemail ${VM_MSGNUM} in mailbox ${VM_MAILBOX}
; emailbody = Dear ${VM_NAME},\n\nYou have a new voicemail from ${VM_CALLERID}\nDuration: ${VM_DUR}\nDate: ${VM_DATE}\n
emaildateformat = %A, %B %d, %Y at %r

[default]
1001 => 1234,Reception,reception@${DOMAIN},,
1002 => 1234,Sales,sales@${DOMAIN},,
1003 => 1234,Sales 2,,,
1004 => 1234,Support,support@${DOMAIN},,
1005 => 1234,Support 2,,,
1006 => 1234,Support 3,,,
1010 => 1234,Web Phone,webphone@${DOMAIN},,
2001 => 0000,Sales Group,sales@${DOMAIN},,
2002 => 0000,Support Group,support@${DOMAIN},,

; =============================================================================
; ConfBridge Configuration (Conference Rooms)
; Uses res_timing_timerfd - no DAHDI needed
; =============================================================================

[general]

[default_bridge]
type = bridge
max_members = 50
record_conference = no
internal_sample_rate = auto
mixing_interval = 20
video_mode = follow_talker
sound_join = confbridge-join
sound_leave = confbridge-leave
sound_has_joined = confbridge-has-joined
sound_has_left = confbridge-has-left

[default_user]
type = user
announce_user_count = yes
announce_user_count_all = yes
announce_join_leave = yes
music_on_hold_when_empty = yes
quiet = no
startmuted = no
wait_marked = no
end_marked = no
dsp_drop_silence = yes
denoise = yes
talk_detection_events = yes
dtmf_passthrough = no

[admin_user]
type = user
announce_user_count = yes
announce_join_leave = yes
music_on_hold_when_empty = yes
admin = yes
marked = yes
startmuted = no
wait_marked = no
end_marked = no
dsp_drop_silence = yes
denoise = yes

SIP Phone (Public)              Docker Host              Asterisk Container
203.0.113.50                    198.51.100.10             172.25.0.2
     │                              │                          │
     │◄── SIP INVITE ──────────────►│◄── port forward ────────►│
     │    (signaling works fine)     │    (5060 mapped)         │
     │                              │                          │
     │    RTP: "Send audio to       │                          │
     │         172.25.0.2:15000"    │    ← PROBLEM!            │
     │    Phone can't reach that    │                          │
     │                              │                          │

; On each transport:
external_media_address = ${PJSIP_EXTERNAL_IP}    ; Tell peers to send RTP here
external_signaling_address = ${PJSIP_EXTERNAL_IP} ; Tell peers to send SIP here
local_net = 172.25.0.0/24                          ; Docker bridge subnet
local_net = 10.0.0.0/8                             ; Other private ranges
local_net = 172.16.0.0/12
local_net = 192.168.0.0/16

; On each endpoint:
direct_media = no          ; Force media through Asterisk (don't try peer-to-peer)
rtp_symmetric = yes        ; Send RTP back to the source address we received from
force_rport = yes          ; Use the source port from the Contact header
rewrite_contact = yes      ; Rewrite Contact to the address we see the peer at

# In docker-compose.yml, for the asterisk service:
asterisk:
  # Remove: networks, ports
  network_mode: host
  environment:
    # PJSIP_EXTERNAL_IP is still needed if behind a cloud NAT/firewall
    - PJSIP_EXTERNAL_IP=${PJSIP_EXTERNAL_IP}

networks:
  asterisk-macvlan:
    driver: macvlan
    driver_opts:
      parent: eth0    # Your host's network interface
    ipam:
      config:
        - subnet: 198.51.100.0/24
          gateway: 198.51.100.1

services:
  asterisk:
    networks:
      asterisk-macvlan:
        ipv4_address: 198.51.100.20    # Unique IP for the container

; rtp.conf - Smaller port range for fewer calls
[general]
rtpstart = 10000
rtpend = 10200    ; ~100 simultaneous calls

ports:
  - "10000-10200:10000-10200/udp"

Browser (WebRTC)        TURN Server (Coturn)       Asterisk Container
10.0.0.50 (private)     198.51.100.10:3478         172.25.0.2
     │                        │                          │
     │── STUN Binding Req ──►│                          │
     │◄── Your public IP is  │                          │
     │    203.0.113.50:45000 │                          │
     │                        │                          │
     │── TURN Allocate Req ─►│                          │
     │◄── Relay address:     │                          │
     │    198.51.100.10:49200│                          │
     │                        │                          │
     │    ICE Negotiation    │    SIP/WebSocket         │
     │◄──────────────────────►◄────────────────────────►│
     │                        │                          │
     │◄── RTP via TURN ──────►◄── RTP ────────────────►│

stunaddr = stun.l.google.com:19302
icesupport = yes

# 1. Check RTP ports are actually mapped
docker compose exec asterisk ss -ulnp | grep -E '1[0-9]{4}'

# 2. Check what SDP Asterisk is sending (look for the c= line)
docker compose exec asterisk asterisk -rx "pjsip set logger on"
# Make a test call and look for:
#   c=IN IP4 198.51.100.10    (should be your public IP)
#   NOT: c=IN IP4 172.25.0.2  (container IP = broken)

# 3. Capture RTP traffic on the host
tcpdump -i any -n udp portrange 10000-20000 -c 50

# 4. Check if RTP is flowing in both directions
docker compose exec asterisk asterisk -rx "rtp set debug on"
# You should see "Got RTP packet from..." AND "Sent RTP packet to..."
# If you only see one direction, that's your one-way audio

# 5. Check NAT settings are applied
docker compose exec asterisk asterisk -rx "pjsip show transport transport-udp"
# Verify external_media_address and external_signaling_address

# 6. Use sngrep to see the full SIP exchange
docker compose exec asterisk sngrep

Need multiple Asterisk containers on one host?
  └── YES → Use bridge networking with careful NAT config
  └── NO ─┐
           ├── Have spare public IPs?
           │   └── YES → Macvlan (cleanest isolation)
           │   └── NO ──┐
           │             ├── WebRTC only (no SIP trunks)?
           │             │   └── Bridge + TURN server
           │             └── SIP trunks with real carriers?
           │                 └── Host networking (simplest, proven)
           └──────────────────────────────────────────────

# Bind mount - you control the exact path on the host
volumes:
  recordings:
    driver: local
    driver_opts:
      type: none
      device: /opt/asterisk-docker/data/recordings
      o: bind

# Named volume - Docker manages the path
volumes:
  mariadb-data:
    driver: local

# Create recording directory structure
mkdir -p /opt/asterisk-docker/data/recordings

# Set up a separate mount point for recordings if you have a dedicated disk
# (recommended for production)
# Example: mount a dedicated partition
# mkfs.ext4 /dev/sdb1
# echo '/dev/sdb1 /opt/asterisk-docker/data/recordings ext4 defaults,noatime 0 2' >> /etc/fstab
# mount /opt/asterisk-docker/data/recordings

#!/bin/bash
# =============================================================================
# Recording Cleanup Script
# Removes recordings older than RETENTION_DAYS
# Run via cron on the Docker host (not inside the container)
# =============================================================================

RECORDING_DIR="/opt/asterisk-docker/data/recordings"
RETENTION_DAYS="${1:-90}"    # Default 90 days, override with first argument
LOG_FILE="/var/log/asterisk-recording-cleanup.log"

echo "$(date '+%Y-%m-%d %H:%M:%S') Starting recording cleanup (retention: ${RETENTION_DAYS} days)" >> "$LOG_FILE"

# Count files before cleanup
BEFORE=$(find "$RECORDING_DIR" -type f -name "*.wav" -o -name "*.WAV" -o -name "*.gsm" -o -name "*.mp3" | wc -l)
BEFORE_SIZE=$(du -sh "$RECORDING_DIR" 2>/dev/null | cut -f1)

# Delete old recordings
find "$RECORDING_DIR" -type f \( -name "*.wav" -o -name "*.WAV" -o -name "*.gsm" -o -name "*.mp3" \) \
    -mtime +${RETENTION_DAYS} -delete

# Delete empty directories left behind
find "$RECORDING_DIR" -type d -empty -delete 2>/dev/null

# Count files after cleanup
AFTER=$(find "$RECORDING_DIR" -type f -name "*.wav" -o -name "*.WAV" -o -name "*.gsm" -o -name "*.mp3" | wc -l)
AFTER_SIZE=$(du -sh "$RECORDING_DIR" 2>/dev/null | cut -f1)

DELETED=$((BEFORE - AFTER))
echo "$(date '+%Y-%m-%d %H:%M:%S') Cleanup complete: deleted $DELETED files. Before: $BEFORE ($BEFORE_SIZE) After: $AFTER ($AFTER_SIZE)" >> "$LOG_FILE"

# Make executable and add to cron
chmod +x /opt/asterisk-docker/scripts/cleanup-recordings.sh

# Run daily at 3 AM, keep 90 days
(crontab -l 2>/dev/null; echo "0 3 * * * /opt/asterisk-docker/scripts/cleanup-recordings.sh 90") | crontab -

/opt/asterisk-docker/data/logs/messages
/opt/asterisk-docker/data/logs/full
/opt/asterisk-docker/data/logs/error
/opt/asterisk-docker/data/logs/verbose
{
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    create 0640 1000 1000
    postrotate
        docker exec asterisk asterisk -rx "logger reload" 2>/dev/null || true
    endscript
}

/opt/asterisk-docker/data/logs/cdr-csv/*.csv
{
    monthly
    rotate 12
    compress
    delaycompress
    missingok
    notifempty
    create 0640 1000 1000
}

# Install logrotate config
cp /opt/asterisk-docker/scripts/logrotate-asterisk.conf /etc/logrotate.d/asterisk-docker

#!/bin/bash
# =============================================================================
# Asterisk Docker Stack - Full Backup
# Backs up: MariaDB dump, recordings, voicemail, configs, certificates
# =============================================================================

set -e

BACKUP_DIR="/opt/asterisk-docker/backups"
DATE=$(date '+%Y%m%d_%H%M%S')
BACKUP_PATH="$BACKUP_DIR/$DATE"
RETENTION_DAYS=30

# Source environment
set -a
source /opt/asterisk-docker/.env
set +a

echo "=== Asterisk Backup Starting: $DATE ==="

mkdir -p "$BACKUP_PATH"

# ---- 1. Database dump ----
echo "Backing up MariaDB..."
docker exec asterisk-mariadb mysqldump \
    -u root -p"${DB_ROOT_PASSWORD}" \
    --all-databases \
    --single-transaction \
    --routines \
    --triggers \
    --events \
    > "$BACKUP_PATH/mariadb-all-databases.sql"
echo "  Database dump: $(du -sh "$BACKUP_PATH/mariadb-all-databases.sql" | cut -f1)"

# ---- 2. Configuration files ----
echo "Backing up configuration..."
tar czf "$BACKUP_PATH/configs.tar.gz" \
    -C /opt/asterisk-docker \
    asterisk/configs/ \
    nginx/ \
    coturn/ \
    docker-compose.yml \
    .env

# ---- 3. Voicemail ----
echo "Backing up voicemail..."
if [ -d "/opt/asterisk-docker/data/voicemail" ] && [ "$(ls -A /opt/asterisk-docker/data/voicemail 2>/dev/null)" ]; then
    tar czf "$BACKUP_PATH/voicemail.tar.gz" \
        -C /opt/asterisk-docker/data voicemail/
    echo "  Voicemail: $(du -sh "$BACKUP_PATH/voicemail.tar.gz" | cut -f1)"
else
    echo "  Voicemail: empty, skipped"
fi

# ---- 4. Certificates ----
echo "Backing up certificates..."
if [ -d "/opt/asterisk-docker/data/certs" ]; then
    tar czf "$BACKUP_PATH/certs.tar.gz" \
        -C /opt/asterisk-docker/data certs/
fi

# ---- 5. Recordings (optional - can be very large) ----
# Uncomment to include recordings in backup
# echo "Backing up recordings..."
# tar czf "$BACKUP_PATH/recordings.tar.gz" \
#     -C /opt/asterisk-docker/data recordings/

# ---- 6. Create manifest ----
echo "Creating backup manifest..."
cat > "$BACKUP_PATH/manifest.txt" <<MANIFEST
Asterisk Docker Backup
Date: $(date)
Host: $(hostname)
Docker Compose Project: ${COMPOSE_PROJECT_NAME}

Files:
$(ls -lh "$BACKUP_PATH/")

Container Status:
$(docker compose -f /opt/asterisk-docker/docker-compose.yml ps 2>/dev/null)

Asterisk Version:
$(docker exec asterisk asterisk -V 2>/dev/null || echo "not running")

Database Size:
$(docker exec asterisk-mariadb mysql -u root -p"${DB_ROOT_PASSWORD}" -e "SELECT table_schema AS db, ROUND(SUM(data_length + index_length) / 1024 / 1024, 2) AS 'Size (MB)' FROM information_schema.tables GROUP BY table_schema;" 2>/dev/null || echo "not available")
MANIFEST

# ---- 7. Compress entire backup ----
echo "Compressing backup..."
tar czf "$BACKUP_DIR/asterisk-backup-$DATE.tar.gz" -C "$BACKUP_DIR" "$DATE/"
rm -rf "$BACKUP_PATH"
echo "Final backup: $(du -sh "$BACKUP_DIR/asterisk-backup-$DATE.tar.gz" | cut -f1)"

# ---- 8. Cleanup old backups ----
echo "Cleaning up backups older than $RETENTION_DAYS days..."
find "$BACKUP_DIR" -name "asterisk-backup-*.tar.gz" -mtime +${RETENTION_DAYS} -delete

echo "=== Backup Complete ==="

chmod +x /opt/asterisk-docker/scripts/backup.sh

# Run backup daily at 2 AM
(crontab -l 2>/dev/null; echo "0 2 * * * /opt/asterisk-docker/scripts/backup.sh >> /var/log/asterisk-backup.log 2>&1") | crontab -

#!/bin/bash
# =============================================================================
# Asterisk Docker Stack - Restore from Backup
# Usage: ./restore.sh /path/to/asterisk-backup-YYYYMMDD_HHMMSS.tar.gz
# =============================================================================

set -e

BACKUP_FILE="$1"
RESTORE_DIR="/tmp/asterisk-restore-$$"

if [ -z "$BACKUP_FILE" ] || [ ! -f "$BACKUP_FILE" ]; then
    echo "Usage: $0 /path/to/asterisk-backup-*.tar.gz"
    exit 1
fi

# Source environment
set -a
source /opt/asterisk-docker/.env
set +a

echo "=== Asterisk Restore Starting ==="
echo "Backup file: $BACKUP_FILE"
echo ""
echo "WARNING: This will overwrite current data. Press Ctrl+C to abort."
echo "Continuing in 10 seconds..."
sleep 10

# Extract backup
mkdir -p "$RESTORE_DIR"
tar xzf "$BACKUP_FILE" -C "$RESTORE_DIR"
BACKUP_DATE=$(ls "$RESTORE_DIR")
BACKUP_PATH="$RESTORE_DIR/$BACKUP_DATE"

echo "Backup date: $BACKUP_DATE"

# Stop services
echo "Stopping services..."
cd /opt/asterisk-docker
docker compose down

# Restore database
if [ -f "$BACKUP_PATH/mariadb-all-databases.sql" ]; then
    echo "Restoring database..."
    docker compose up -d mariadb
    sleep 10    # Wait for MariaDB to be ready
    docker exec -i asterisk-mariadb mysql -u root -p"${DB_ROOT_PASSWORD}" \
        < "$BACKUP_PATH/mariadb-all-databases.sql"
    echo "  Database restored."
fi

# Restore configs
if [ -f "$BACKUP_PATH/configs.tar.gz" ]; then
    echo "Restoring configurations..."
    tar xzf "$BACKUP_PATH/configs.tar.gz" -C /opt/asterisk-docker/
    echo "  Configs restored."
fi

# Restore voicemail
if [ -f "$BACKUP_PATH/voicemail.tar.gz" ]; then
    echo "Restoring voicemail..."
    tar xzf "$BACKUP_PATH/voicemail.tar.gz" -C /opt/asterisk-docker/data/
    echo "  Voicemail restored."
fi

# Restore certificates
if [ -f "$BACKUP_PATH/certs.tar.gz" ]; then
    echo "Restoring certificates..."
    tar xzf "$BACKUP_PATH/certs.tar.gz" -C /opt/asterisk-docker/data/
    echo "  Certificates restored."
fi

# Start all services
echo "Starting all services..."
docker compose up -d

# Cleanup
rm -rf "$RESTORE_DIR"

echo "=== Restore Complete ==="
echo "Verify with: docker compose ps"

chmod +x /opt/asterisk-docker/scripts/restore.sh

-- =============================================================================
-- Asterisk Database Schema
-- Executed automatically on first MariaDB container start
-- =============================================================================

USE asterisk;

-- ---- CDR Table ----
CREATE TABLE IF NOT EXISTS cdr (
    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
    calldate DATETIME NOT NULL DEFAULT '1970-01-01 00:00:00',
    clid VARCHAR(80) NOT NULL DEFAULT '',
    src VARCHAR(80) NOT NULL DEFAULT '',
    dst VARCHAR(80) NOT NULL DEFAULT '',
    dcontext VARCHAR(80) NOT NULL DEFAULT '',
    channel VARCHAR(80) NOT NULL DEFAULT '',
    dstchannel VARCHAR(80) NOT NULL DEFAULT '',
    lastapp VARCHAR(80) NOT NULL DEFAULT '',
    lastdata VARCHAR(80) NOT NULL DEFAULT '',
    duration INT NOT NULL DEFAULT 0,
    billsec INT NOT NULL DEFAULT 0,
    disposition VARCHAR(45) NOT NULL DEFAULT '',
    amaflags INT NOT NULL DEFAULT 0,
    accountcode VARCHAR(20) NOT NULL DEFAULT '',
    uniqueid VARCHAR(150) NOT NULL DEFAULT '',
    userfield VARCHAR(255) NOT NULL DEFAULT '',
    peeraccount VARCHAR(20) NOT NULL DEFAULT '',
    linkedid VARCHAR(150) NOT NULL DEFAULT '',
    sequence INT NOT NULL DEFAULT 0,
    PRIMARY KEY (id),
    INDEX idx_calldate (calldate),
    INDEX idx_dst (dst),
    INDEX idx_src (src),
    INDEX idx_uniqueid (uniqueid),
    INDEX idx_disposition (disposition),
    INDEX idx_accountcode (accountcode),
    INDEX idx_clid (clid(20))
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- ---- PJSIP Realtime Tables ----
-- These allow you to manage SIP endpoints via database instead of config files

-- Endpoints
CREATE TABLE IF NOT EXISTS ps_endpoints (
    id VARCHAR(40) NOT NULL,
    transport VARCHAR(40) DEFAULT NULL,
    aors VARCHAR(200) DEFAULT NULL,
    auth VARCHAR(40) DEFAULT NULL,
    context VARCHAR(40) DEFAULT 'from-internal',
    disallow VARCHAR(200) DEFAULT 'all',
    allow VARCHAR(200) DEFAULT 'opus,g722,ulaw,alaw',
    direct_media ENUM('yes','no') DEFAULT 'no',
    connected_line_method VARCHAR(40) DEFAULT NULL,
    direct_media_method VARCHAR(40) DEFAULT NULL,
    direct_media_glare_mitigation VARCHAR(40) DEFAULT NULL,
    disable_direct_media_on_nat ENUM('yes','no') DEFAULT NULL,
    dtmf_mode VARCHAR(40) DEFAULT 'rfc4733',
    external_media_address VARCHAR(40) DEFAULT NULL,
    force_rport ENUM('yes','no') DEFAULT 'yes',
    ice_support ENUM('yes','no') DEFAULT 'no',
    identify_by VARCHAR(80) DEFAULT NULL,
    mailboxes VARCHAR(40) DEFAULT NULL,
    media_address VARCHAR(40) DEFAULT NULL,
    media_encryption VARCHAR(40) DEFAULT 'no',
    media_use_received_transport ENUM('yes','no') DEFAULT NULL,
    100rel VARCHAR(40) DEFAULT NULL,
    outbound_auth VARCHAR(40) DEFAULT NULL,
    outbound_proxy VARCHAR(256) DEFAULT NULL,
    rewrite_contact ENUM('yes','no') DEFAULT 'yes',
    rtp_ipv6 ENUM('yes','no') DEFAULT NULL,
    rtp_symmetric ENUM('yes','no') DEFAULT 'yes',
    send_diversion ENUM('yes','no') DEFAULT NULL,
    send_pai ENUM('yes','no') DEFAULT 'yes',
    send_rpid ENUM('yes','no') DEFAULT 'yes',
    timers_min_se INT DEFAULT NULL,
    timers VARCHAR(40) DEFAULT NULL,
    timers_sess_expires INT DEFAULT NULL,
    callerid VARCHAR(40) DEFAULT NULL,
    callerid_privacy VARCHAR(40) DEFAULT NULL,
    callerid_tag VARCHAR(40) DEFAULT NULL,
    trust_id_inbound ENUM('yes','no') DEFAULT 'yes',
    trust_id_outbound ENUM('yes','no') DEFAULT NULL,
    use_ptime ENUM('yes','no') DEFAULT NULL,
    use_avpf ENUM('yes','no') DEFAULT NULL,
    force_avp ENUM('yes','no') DEFAULT NULL,
    media_encryption_optimistic ENUM('yes','no') DEFAULT NULL,
    inband_progress ENUM('yes','no') DEFAULT NULL,
    call_group VARCHAR(40) DEFAULT NULL,
    pickup_group VARCHAR(40) DEFAULT NULL,
    named_call_group VARCHAR(40) DEFAULT NULL,
    named_pickup_group VARCHAR(40) DEFAULT NULL,
    device_state_busy_at INT DEFAULT NULL,
    t38_udptl ENUM('yes','no') DEFAULT NULL,
    t38_udptl_ec VARCHAR(40) DEFAULT NULL,
    t38_udptl_maxdatagram INT DEFAULT NULL,
    fax_detect ENUM('yes','no') DEFAULT NULL,
    t38_udptl_nat ENUM('yes','no') DEFAULT NULL,
    t38_udptl_ipv6 ENUM('yes','no') DEFAULT NULL,
    tone_zone VARCHAR(40) DEFAULT NULL,
    language VARCHAR(40) DEFAULT NULL,
    one_touch_recording ENUM('yes','no') DEFAULT NULL,
    record_on_feature VARCHAR(40) DEFAULT NULL,
    record_off_feature VARCHAR(40) DEFAULT NULL,
    rtp_engine VARCHAR(40) DEFAULT NULL,
    allow_transfer ENUM('yes','no') DEFAULT NULL,
    allow_subscribe ENUM('yes','no') DEFAULT NULL,
    sdp_owner VARCHAR(40) DEFAULT NULL,
    sdp_session VARCHAR(40) DEFAULT NULL,
    tos_audio VARCHAR(10) DEFAULT NULL,
    tos_video VARCHAR(10) DEFAULT NULL,
    sub_min_expiry INT DEFAULT NULL,
    from_domain VARCHAR(40) DEFAULT NULL,
    from_user VARCHAR(40) DEFAULT NULL,
    mwi_from_user VARCHAR(40) DEFAULT NULL,
    dtls_verify VARCHAR(40) DEFAULT NULL,
    dtls_rekey VARCHAR(40) DEFAULT NULL,
    dtls_cert_file VARCHAR(200) DEFAULT NULL,
    dtls_private_key VARCHAR(200) DEFAULT NULL,
    dtls_cipher VARCHAR(200) DEFAULT NULL,
    dtls_ca_file VARCHAR(200) DEFAULT NULL,
    dtls_ca_path VARCHAR(200) DEFAULT NULL,
    dtls_setup VARCHAR(40) DEFAULT NULL,
    srtp_tag_32 ENUM('yes','no') DEFAULT NULL,
    webrtc ENUM('yes','no') DEFAULT 'no',
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- Authentication
CREATE TABLE IF NOT EXISTS ps_auths (
    id VARCHAR(40) NOT NULL,
    auth_type VARCHAR(40) DEFAULT 'userpass',
    nonce_lifetime INT DEFAULT NULL,
    md5_cred VARCHAR(40) DEFAULT NULL,
    password VARCHAR(80) DEFAULT NULL,
    realm VARCHAR(40) DEFAULT NULL,
    username VARCHAR(40) DEFAULT NULL,
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- AORs (Address of Record)
CREATE TABLE IF NOT EXISTS ps_aors (
    id VARCHAR(40) NOT NULL,
    contact VARCHAR(255) DEFAULT NULL,
    default_expiration INT DEFAULT 300,
    mailboxes VARCHAR(80) DEFAULT NULL,
    max_contacts INT DEFAULT 3,
    minimum_expiration INT DEFAULT 60,
    remove_existing ENUM('yes','no') DEFAULT 'yes',
    qualify_frequency INT DEFAULT 60,
    qualify_timeout FLOAT DEFAULT 3.0,
    authenticate_qualify ENUM('yes','no') DEFAULT NULL,
    outbound_proxy VARCHAR(256) DEFAULT NULL,
    support_path ENUM('yes','no') DEFAULT NULL,
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- Contacts (registered devices)
CREATE TABLE IF NOT EXISTS ps_contacts (
    id VARCHAR(255) NOT NULL,
    uri VARCHAR(255) DEFAULT NULL,
    expiration_time BIGINT DEFAULT NULL,
    qualify_frequency INT DEFAULT NULL,
    outbound_proxy VARCHAR(256) DEFAULT NULL,
    path TEXT DEFAULT NULL,
    user_agent VARCHAR(255) DEFAULT NULL,
    qualify_timeout FLOAT DEFAULT NULL,
    reg_server VARCHAR(20) DEFAULT NULL,
    authenticate_qualify ENUM('yes','no') DEFAULT NULL,
    via_addr VARCHAR(40) DEFAULT NULL,
    via_port INT DEFAULT NULL,
    call_id VARCHAR(255) DEFAULT NULL,
    endpoint VARCHAR(40) DEFAULT NULL,
    prune_on_boot ENUM('yes','no') DEFAULT 'yes',
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- Endpoint Identification by IP
CREATE TABLE IF NOT EXISTS ps_endpoint_id_ips (
    id VARCHAR(40) NOT NULL,
    endpoint VARCHAR(40) DEFAULT NULL,
    match VARCHAR(80) DEFAULT NULL,
    srv_lookups ENUM('yes','no') DEFAULT NULL,
    match_header VARCHAR(255) DEFAULT NULL,
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- Domain Aliases
CREATE TABLE IF NOT EXISTS ps_domain_aliases (
    id VARCHAR(40) NOT NULL,
    domain VARCHAR(80) DEFAULT NULL,
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- Registrations (outbound registration to SIP trunks)
CREATE TABLE IF NOT EXISTS ps_registrations (
    id VARCHAR(40) NOT NULL,
    auth_rejection_permanent ENUM('yes','no') DEFAULT NULL,
    client_uri VARCHAR(255) DEFAULT NULL,
    contact_user VARCHAR(40) DEFAULT NULL,
    expiration INT DEFAULT NULL,
    max_retries INT DEFAULT NULL,
    outbound_auth VARCHAR(40) DEFAULT NULL,
    outbound_proxy VARCHAR(256) DEFAULT NULL,
    retry_interval INT DEFAULT NULL,
    forbidden_retry_interval INT DEFAULT NULL,
    server_uri VARCHAR(255) DEFAULT NULL,
    transport VARCHAR(40) DEFAULT NULL,
    support_path ENUM('yes','no') DEFAULT NULL,
    line ENUM('yes','no') DEFAULT NULL,
    endpoint VARCHAR(40) DEFAULT NULL,
    PRIMARY KEY (id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- ---- Voicemail Users Table ----
CREATE TABLE IF NOT EXISTS voicemail_users (
    uniqueid INT UNSIGNED NOT NULL AUTO_INCREMENT,
    context VARCHAR(50) NOT NULL DEFAULT 'default',
    mailbox VARCHAR(20) NOT NULL,
    password VARCHAR(20) NOT NULL DEFAULT '1234',
    fullname VARCHAR(150) DEFAULT NULL,
    email VARCHAR(250) DEFAULT NULL,
    pager VARCHAR(250) DEFAULT NULL,
    tz VARCHAR(80) DEFAULT 'central',
    attach ENUM('yes','no') DEFAULT 'yes',
    saycid ENUM('yes','no') DEFAULT 'yes',
    dialout VARCHAR(10) DEFAULT NULL,
    callback VARCHAR(10) DEFAULT NULL,
    review ENUM('yes','no') DEFAULT 'no',
    operator ENUM('yes','no') DEFAULT 'no',
    envelope ENUM('yes','no') DEFAULT 'no',
    sayduration ENUM('yes','no') DEFAULT 'yes',
    saydurationm INT DEFAULT 1,
    sendvoicemail ENUM('yes','no') DEFAULT 'no',
    delete_vm ENUM('yes','no') DEFAULT 'no',
    nextaftercmd ENUM('yes','no') DEFAULT 'yes',
    forcename ENUM('yes','no') DEFAULT 'no',
    forcegreetings ENUM('yes','no') DEFAULT 'no',
    hidefromdir ENUM('yes','no') DEFAULT 'yes',
    stamp DATETIME DEFAULT NULL,
    PRIMARY KEY (uniqueid),
    INDEX idx_context_mailbox (context, mailbox)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- ---- Queue Tables (for call queues) ----
CREATE TABLE IF NOT EXISTS queue_members (
    uniqueid INT UNSIGNED NOT NULL AUTO_INCREMENT,
    membername VARCHAR(40) DEFAULT NULL,
    queue_name VARCHAR(128) DEFAULT NULL,
    interface VARCHAR(128) DEFAULT NULL,
    penalty INT DEFAULT NULL,
    paused INT DEFAULT NULL,
    state_interface VARCHAR(128) DEFAULT NULL,
    PRIMARY KEY (uniqueid),
    UNIQUE INDEX idx_queue_interface (queue_name, interface)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE IF NOT EXISTS queue_rules (
    rule_name VARCHAR(80) NOT NULL DEFAULT '',
    time VARCHAR(32) NOT NULL DEFAULT '0',
    min_penalty VARCHAR(32) NOT NULL DEFAULT '0',
    max_penalty VARCHAR(32) NOT NULL DEFAULT '0',
    INDEX idx_rule_name (rule_name)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- ---- Seed sample data ----
-- Insert sample endpoints into realtime tables
INSERT IGNORE INTO ps_endpoints (id, transport, aors, auth, context, disallow, allow, direct_media, dtmf_mode, force_rport, rtp_symmetric, rewrite_contact, callerid, mailboxes, call_group, pickup_group)
VALUES
    ('1001', 'transport-udp', '1001', '1001', 'from-internal', 'all', 'opus,g722,ulaw,alaw', 'no', 'rfc4733', 'yes', 'yes', 'yes', '"Reception" <1001>', '1001@default', '1', '1'),
    ('1002', 'transport-udp', '1002', '1002', 'from-internal', 'all', 'opus,g722,ulaw,alaw', 'no', 'rfc4733', 'yes', 'yes', 'yes', '"Sales" <1002>', '1002@default', '1', '1');

INSERT IGNORE INTO ps_auths (id, auth_type, username, password, realm)
VALUES
    ('1001', 'userpass', '1001', 'changeme', 'YOUR_DOMAIN'),
    ('1002', 'userpass', '1002', 'changeme', 'YOUR_DOMAIN');

INSERT IGNORE INTO ps_aors (id, max_contacts, remove_existing, qualify_frequency, qualify_timeout, default_expiration)
VALUES
    ('1001', 3, 'yes', 60, 5.0, 300),
    ('1002', 3, 'yes', 60, 5.0, 300);

-- Insert sample voicemail users
INSERT IGNORE INTO voicemail_users (context, mailbox, password, fullname, email)
VALUES
    ('default', '1001', '1234', 'Reception', 'reception@example.com'),
    ('default', '1002', '1234', 'Sales', 'sales@example.com');

; =============================================================================
; Sorcery Configuration - Maps PJSIP objects to database tables
; =============================================================================

[res_pjsip]
endpoint = realtime,ps_endpoints
auth = realtime,ps_auths
aor = realtime,ps_aors
domain_alias = realtime,ps_domain_aliases
contact = realtime,ps_contacts

[res_pjsip_endpoint_identifier_ip]
identify = realtime,ps_endpoint_id_ips

[res_pjsip_outbound_registration]
registration = realtime,ps_registrations

; =============================================================================
; External Configuration - Maps Asterisk subsystems to ODBC
; =============================================================================

[settings]
ps_endpoints => odbc,asterisk-connector,ps_endpoints
ps_auths => odbc,asterisk-connector,ps_auths
ps_aors => odbc,asterisk-connector,ps_aors
ps_contacts => odbc,asterisk-connector,ps_contacts
ps_domain_aliases => odbc,asterisk-connector,ps_domain_aliases
ps_endpoint_id_ips => odbc,asterisk-connector,ps_endpoint_id_ips
ps_registrations => odbc,asterisk-connector,ps_registrations
voicemail => odbc,asterisk-connector,voicemail_users
queue_members => odbc,asterisk-connector,queue_members
queue_rules => odbc,asterisk-connector,queue_rules

-- Add a new extension
INSERT INTO ps_endpoints (id, transport, aors, auth, context, disallow, allow,
    direct_media, dtmf_mode, force_rport, rtp_symmetric, rewrite_contact,
    callerid, mailboxes)
VALUES ('1003', 'transport-udp', '1003', '1003', 'from-internal', 'all',
    'opus,g722,ulaw,alaw', 'no', 'rfc4733', 'yes', 'yes', 'yes',
    '"Support" <1003>', '1003@default');

INSERT INTO ps_auths (id, auth_type, username, password, realm)
VALUES ('1003', 'userpass', '1003', 'SecurePass123!', 'YOUR_DOMAIN');

INSERT INTO ps_aors (id, max_contacts, remove_existing, qualify_frequency)
VALUES ('1003', 3, 'yes', 60);

-- The endpoint is immediately available - no reload needed!
-- Verify from Asterisk CLI:
-- asterisk -rx "pjsip show endpoint 1003"

# From the Docker host, you can manage endpoints via:
docker exec asterisk-mariadb mysql -u asterisk -p'Ast3r1sk_DB_2026!' asterisk \
    -e "SELECT id, context, callerid FROM ps_endpoints;"

[asterisk-connector]
enabled = yes
dsn = asterisk-connector
username = ${DB_USER}
password = ${DB_PASSWORD}
pre-connect = yes              ; Establish connections at startup
max_connections = 20           ; Pool size (increase for busy systems)
connect_timeout = 5            ; Seconds before connection attempt fails
negative_connection_cache = 600 ; Cache failed connection for 10 min
sanitysql = SELECT 1           ; Keep-alive query

docker compose exec asterisk asterisk -rx "odbc show all"
# Name:   asterisk-connector
# DSN:    asterisk-connector
# Last connection attempt: 2026-01-15 10:30:00
# Pooled: Yes
# Connected: Yes (20 connections)

┌─────────────────┐     REST API        ┌──────────────────┐
│  Your App       │◄──────────────────►│  Asterisk ARI    │
│  (Python/Node)  │     WebSocket       │  Port 8088       │
│                 │◄──────────────────►│                  │
└─────────────────┘                    └──────────────────┘

REST API:
  POST /ari/channels          → Originate a call
  POST /ari/channels/{id}/answer → Answer a call
  POST /ari/channels/{id}/play   → Play audio
  POST /ari/bridges              → Create a bridge (conference)
  POST /ari/bridges/{id}/addChannel → Add channel to bridge
  DELETE /ari/channels/{id}      → Hang up

WebSocket (/ari/events):
  StasisStart    → Call entered your application
  StasisEnd      → Call left your application
  ChannelDtmfReceived → User pressed a key
  ChannelStateChange  → Channel state changed
  PlaybackFinished    → Audio playback completed

requests>=2.31.0
websocket-client>=1.7.0
redis>=5.0.0

#!/usr/bin/env python3
"""
Asterisk ARI Auto-Attendant Application
Handles inbound calls via REST API + WebSocket events.

Requires:
  - Asterisk with ARI enabled (http.conf + ari.conf)
  - Dialplan: exten => _X.,1,Stasis(autoattendant,${EXTEN})
  - pip install requests websocket-client redis
"""

import json
import logging
import os
import sys
import threading
import time
from typing import Any

import redis
import requests
import websocket

# =============================================================================
# Configuration
# =============================================================================

ARI_URL = os.getenv("ARI_URL", "http://asterisk:8088")
ARI_USER = os.getenv("ARI_USERNAME", "ari_user")
ARI_PASS = os.getenv("ARI_PASSWORD", "Ar1_S3cur3_2026!")
ARI_APP = os.getenv("ARI_APP", "autoattendant")

REDIS_HOST = os.getenv("REDIS_HOST", "redis")
REDIS_PORT = int(os.getenv("REDIS_PORT", "6379"))
REDIS_PASS = os.getenv("REDIS_PASSWORD", "R3d1s_S3cur3_2026!")

# Logging
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s [%(levelname)s] %(message)s",
    datefmt="%Y-%m-%d %H:%M:%S",
)
log = logging.getLogger("ari-autoattendant")

# =============================================================================
# Redis Client (for state tracking)
# =============================================================================

redis_client = redis.Redis(
    host=REDIS_HOST,
    port=REDIS_PORT,
    password=REDIS_PASS,
    decode_responses=True,
)


# =============================================================================
# ARI REST Client
# =============================================================================

class ARIClient:
    """Thin wrapper around the ARI REST API."""

    def __init__(self, base_url: str, username: str, password: str):
        self.base_url = base_url.rstrip("/")
        self.auth = (username, password)
        self.session = requests.Session()
        self.session.auth = self.auth

    def get(self, path: str, **kwargs) -> Any:
        resp = self.session.get(f"{self.base_url}/ari{path}", **kwargs)
        resp.raise_for_status()
        return resp.json() if resp.content else None

    def post(self, path: str, **kwargs) -> Any:
        resp = self.session.post(f"{self.base_url}/ari{path}", **kwargs)
        resp.raise_for_status()
        return resp.json() if resp.content else None

    def delete(self, path: str, **kwargs) -> Any:
        resp = self.session.delete(f"{self.base_url}/ari{path}", **kwargs)
        resp.raise_for_status()
        return resp.json() if resp.content else None

    # ---- Channel Operations ----

    def answer(self, channel_id: str):
        """Answer a channel."""
        return self.post(f"/channels/{channel_id}/answer")

    def hangup(self, channel_id: str, reason: str = "normal"):
        """Hang up a channel."""
        return self.delete(f"/channels/{channel_id}", params={"reason": reason})

    def play(self, channel_id: str, media: str, playback_id: str = None):
        """Play media on a channel. Media format: 'sound:filename' or 'tone:dial'."""
        params = {"media": media}
        if playback_id:
            params["playbackId"] = playback_id
        return self.post(f"/channels/{channel_id}/play", params=params)

    def dial(self, channel_id: str, endpoint: str, context: str = None,
             caller_id: str = None, timeout: int = 30):
        """Originate a call and bridge it."""
        params = {
            "endpoint": endpoint,
            "app": ARI_APP,
            "timeout": timeout,
        }
        if caller_id:
            params["callerId"] = caller_id
        return self.post("/channels", params=params)

    # ---- Bridge Operations ----

    def create_bridge(self, bridge_type: str = "mixing", name: str = None):
        """Create a bridge (conference)."""
        params = {"type": bridge_type}
        if name:
            params["name"] = name
        return self.post("/bridges", params=params)

    def add_to_bridge(self, bridge_id: str, channel_id: str):
        """Add a channel to a bridge."""
        return self.post(f"/bridges/{bridge_id}/addChannel",
                         params={"channel": channel_id})

    def remove_from_bridge(self, bridge_id: str, channel_id: str):
        """Remove a channel from a bridge."""
        return self.post(f"/bridges/{bridge_id}/removeChannel",
                         params={"channel": channel_id})

    def destroy_bridge(self, bridge_id: str):
        """Destroy a bridge."""
        return self.delete(f"/bridges/{bridge_id}")


# =============================================================================
# Call Handler
# =============================================================================

class CallHandler:
    """Handles a single call through the IVR flow."""

    # IVR menu options: DTMF digit -> (description, PJSIP endpoint to dial)
    MENU = {
        "1": ("Sales", "PJSIP/1001"),
        "2": ("Support", "PJSIP/1004"),
        "3": ("Directory", None),  # Sub-menu
        "0": ("Operator", "PJSIP/1001"),
    }

    def __init__(self, ari: ARIClient, channel_id: str, caller_info: dict):
        self.ari = ari
        self.channel_id = channel_id
        self.caller_info = caller_info
        self.state = "greeting"
        self.dtmf_buffer = ""
        self.attempts = 0
        self.max_attempts = 3
        self.bridge_id = None

        # Track state in Redis
        redis_client.hset(f"call:{channel_id}", mapping={
            "state": self.state,
            "caller_num": caller_info.get("number", "unknown"),
            "caller_name": caller_info.get("name", "unknown"),
            "start_time": str(int(time.time())),
        })

    def start(self):
        """Begin the IVR flow."""
        log.info(f"Call {self.channel_id}: answering from {self.caller_info}")
        self.ari.answer(self.channel_id)
        time.sleep(0.5)  # Brief pause after answer
        self._play_greeting()

    def _play_greeting(self):
        """Play the main greeting."""
        self.state = "greeting"
        self._update_state()
        # Play greeting - uses built-in Asterisk sounds
        # In production, replace with custom recordings
        self.ari.play(self.channel_id, "sound:custom/welcome",
                      playback_id=f"greeting-{self.channel_id}")

    def handle_dtmf(self, digit: str):
        """Process a DTMF digit."""
        log.info(f"Call {self.channel_id}: DTMF '{digit}' in state '{self.state}'")

        if self.state in ("greeting", "waiting"):
            self._process_menu_selection(digit)
        elif self.state == "directory":
            self._process_directory_input(digit)

    def _process_menu_selection(self, digit: str):
        """Handle main menu DTMF selection."""
        if digit in self.MENU:
            description, endpoint = self.MENU[digit]
            log.info(f"Call {self.channel_id}: selected '{description}'")

            if endpoint:
                self._transfer_to(endpoint, description)
            elif digit == "3":
                self.state = "directory"
                self._update_state()
                self.ari.play(self.channel_id,
                              "sound:dir-pls-enter-person",
                              playback_id=f"directory-{self.channel_id}")
        elif digit == "#":
            # Repeat menu
            self._play_greeting()
        else:
            self.ari.play(self.channel_id, "sound:option-is-invalid",
                          playback_id=f"invalid-{self.channel_id}")
            self.attempts += 1
            if self.attempts >= self.max_attempts:
                log.info(f"Call {self.channel_id}: max attempts, routing to operator")
                self._transfer_to("PJSIP/1001", "Operator (timeout)")

    def _transfer_to(self, endpoint: str, description: str):
        """Transfer the caller to an endpoint via a bridge."""
        self.state = "transferring"
        self._update_state()

        try:
            # Create a bridge
            bridge = self.ari.create_bridge("mixing",
                                            f"transfer-{self.channel_id}")
            self.bridge_id = bridge["id"]

            # Add the caller to the bridge
            self.ari.add_to_bridge(self.bridge_id, self.channel_id)

            # Play ringing tone to caller
            self.ari.play(self.channel_id, "tone:ring",
                          playback_id=f"ring-{self.channel_id}")

            # Originate a call to the target
            target = self.ari.dial(self.channel_id, endpoint,
                                   caller_id=self.caller_info.get("number", ""))

            log.info(f"Call {self.channel_id}: dialing {endpoint} "
                     f"(bridge: {self.bridge_id})")

            # Store transfer info in Redis
            redis_client.hset(f"call:{self.channel_id}", mapping={
                "state": "transferring",
                "transfer_to": description,
                "bridge_id": self.bridge_id,
            })

        except Exception as e:
            log.error(f"Call {self.channel_id}: transfer failed: {e}")
            self.ari.play(self.channel_id, "sound:an-error-has-occurred",
                          playback_id=f"error-{self.channel_id}")

    def _process_directory_input(self, digit: str):
        """Handle directory (spell-by-name) input."""
        if digit == "*":
            # Go back to main menu
            self.state = "greeting"
            self._play_greeting()
            return

        self.dtmf_buffer += digit
        if len(self.dtmf_buffer) >= 3:
            # Look up by extension (simplified - real implementation would
            # search by name using the keypad mapping)
            ext = self.dtmf_buffer[:4]
            self.dtmf_buffer = ""
            log.info(f"Call {self.channel_id}: directory lookup for {ext}")
            self._transfer_to(f"PJSIP/{ext}", f"Directory: {ext}")

    def handle_playback_finished(self, playback_id: str):
        """Handle playback completion."""
        if playback_id.startswith("greeting-"):
            self.state = "waiting"
            self._update_state()
            # Wait for DTMF, replay after timeout handled by dialplan

    def cleanup(self):
        """Clean up when the call ends."""
        log.info(f"Call {self.channel_id}: cleanup")
        if self.bridge_id:
            try:
                self.ari.destroy_bridge(self.bridge_id)
            except Exception:
                pass
        redis_client.delete(f"call:{self.channel_id}")

    def _update_state(self):
        """Update call state in Redis."""
        redis_client.hset(f"call:{self.channel_id}", "state", self.state)


# =============================================================================
# WebSocket Event Handler
# =============================================================================

# Active call handlers
calls: dict[str, CallHandler] = {}
ari = ARIClient(ARI_URL, ARI_USER, ARI_PASS)


def on_message(ws, message):
    """Handle incoming WebSocket events from Asterisk."""
    try:
        event = json.loads(message)
        event_type = event.get("type", "unknown")
        channel = event.get("channel", {})
        channel_id = channel.get("id", "")

        if event_type == "StasisStart":
            # New call entered our application
            caller = channel.get("caller", {})
            caller_info = {
                "number": caller.get("number", "unknown"),
                "name": caller.get("name", "unknown"),
            }
            log.info(f"StasisStart: {channel_id} from {caller_info}")

            handler = CallHandler(ari, channel_id, caller_info)
            calls[channel_id] = handler

            # Start IVR in a separate thread to avoid blocking the event loop
            threading.Thread(target=handler.start, daemon=True).start()

        elif event_type == "StasisEnd":
            # Call left our application
            log.info(f"StasisEnd: {channel_id}")
            handler = calls.pop(channel_id, None)
            if handler:
                handler.cleanup()

        elif event_type == "ChannelDtmfReceived":
            # DTMF digit received
            digit = event.get("digit", "")
            handler = calls.get(channel_id)
            if handler:
                handler.handle_dtmf(digit)

        elif event_type == "PlaybackFinished":
            # Audio playback completed
            playback = event.get("playback", {})
            playback_id = playback.get("id", "")
            # Find which call this playback belongs to
            target_channel = playback.get("target_uri", "").replace("channel:", "")
            handler = calls.get(target_channel)
            if handler:
                handler.handle_playback_finished(playback_id)

        elif event_type == "ChannelDestroyed":
            # Channel was destroyed (hangup)
            handler = calls.pop(channel_id, None)
            if handler:
                handler.cleanup()

    except Exception as e:
        log.error(f"Error handling event: {e}", exc_info=True)


def on_error(ws, error):
    log.error(f"WebSocket error: {error}")


def on_close(ws, close_status_code, close_msg):
    log.warning(f"WebSocket closed: {close_status_code} - {close_msg}")


def on_open(ws):
    log.info("WebSocket connected to Asterisk ARI")


# =============================================================================
# Main
# =============================================================================

def main():
    """Connect to ARI WebSocket and handle events."""
    log.info(f"Starting ARI Auto-Attendant")
    log.info(f"ARI URL: {ARI_URL}")
    log.info(f"Application: {ARI_APP}")

    # Verify ARI is reachable
    try:
        info = ari.get("/asterisk/info")
        log.info(f"Connected to Asterisk {info.get('system', {}).get('version', 'unknown')}")
    except Exception as e:
        log.error(f"Cannot connect to ARI: {e}")
        sys.exit(1)

    # Build WebSocket URL
    ws_url = ARI_URL.replace("http://", "ws://").replace("https://", "wss://")
    ws_url = f"{ws_url}/ari/events?api_key={ARI_USER}:{ARI_PASS}&app={ARI_APP}"

    # Connect with auto-reconnect
    while True:
        try:
            ws = websocket.WebSocketApp(
                ws_url,
                on_open=on_open,
                on_message=on_message,
                on_error=on_error,
                on_close=on_close,
            )
            ws.run_forever(ping_interval=30, ping_timeout=10)
        except KeyboardInterrupt:
            log.info("Shutting down...")
            break
        except Exception as e:
            log.error(f"WebSocket connection failed: {e}")

        log.info("Reconnecting in 5 seconds...")
        time.sleep(5)


if __name__ == "__main__":
    main()