Initial LisgloSIPS V2 implementation

2026-06-22 10:56:38 +08:00
commit 5fa1bd35e9
303 changed files with 35644 additions and 0 deletions
@@ -0,0 +1,112 @@
+# Server A OpenSIPS Baseline Runbook
+
+> Task: S18 - Server A OpenSIPS baseline
+> Environment: local KVM development servers over Tailscale
+
+## Scope
+
+S18 installs and pins OpenSIPS 3.6.x on Server A, binds SIP to the Tailscale address `100.90.90.90:15060/udp`, enables local-only MI HTTP, loads the Redis and HEP/tracer module baseline, and adds basic SIP anti-scan handling.
+
+Full Redis routing, RTPEngine/media handling, CDR Stream emission, and production SIP routing are intentionally left for S19-S22.
+
+## Installed Packages
+
+Packages installed from `https://apt.opensips.org noble 3.6-releases`:
+
+- `opensips` `3.6.7-1`
+- `opensips-auth-modules` `3.6.7-1`
+- `opensips-redis-module` `3.6.7-1`
+- `opensips-http-modules` `3.6.7-1`
+- `opensips-json-module` `3.6.7-1`
+- `opensips-restclient-module` `3.6.7-1`
+- `opensips-prometheus-module` `3.6.7-1`
+- `opensips-tlsmgm-module` `3.6.7-1`
+- `opensips-tls-module` `3.6.7-1`
+- `opensips-tls-openssl-module` `3.6.7-1`
+- `opensips-cli` `0.4.0~20260522~570a9a9-1`
+
+All listed OpenSIPS packages are held with `apt-mark hold`.
+
+## Server Files
+
+- `/etc/opensips/opensips.cfg`
+- `/etc/default/opensips`
+- `/etc/apt/sources.list.d/opensips.list`
+- `/etc/apt/sources.list.d/opensips-cli.list`
+- `/etc/nftables.d/lisglosips-s18-opensips.nft`
+
+Repository copies:
+
+- `infra/server-a/s18/opensips/opensips.cfg`
+- `infra/server-a/s18/opensips/opensips.default`
+- `infra/server-a/s18/nftables/lisglosips-s18-opensips.nft`
+
+## Runtime
+
+- OpenSIPS listens on `100.90.90.90:15060/udp`.
+- HEP transport placeholder listens on `127.0.0.1:9061/udp`.
+- MI HTTP listens on `127.0.0.1:8888/tcp`.
+- Node Exporter remains on `100.90.90.90:9100/tcp` from S06.
+
+## SIP Behavior
+
+- `OPTIONS` without a user part returns `200 Keepalive`.
+- `REGISTER` returns `401 Authentication Required` with a Digest challenge.
+- `INVITE` returns `503 Routing Not Ready` until S20/S21 routes are implemented.
+- `pike` blocks excessive request density.
+- `maxfwd` rejects loops with `483 Too Many Hops`.
+
+## Firewall
+
+The S18 nftables table only filters the new SIP and MI surfaces:
+
+- allow `100.93.185.30 -> 100.90.90.90:15060/udp`;
+- drop other UDP `15060` sources;
+- drop non-local TCP access to `8888`.
+
+The table uses `policy accept` and does not alter SSH. SSH key login remains enabled and unchanged.
+
+## Validation
+
+Commands used:
+
+```bash
+opensips -C -f /etc/opensips/opensips.cfg
+systemctl is-active opensips
+systemctl is-enabled opensips
+ss -lntu | grep -E '15060|8888|9061|9100'
+curl -X POST http://127.0.0.1:8888/mi -H 'Content-Type: application/json' --data-binary @mi-version.json
+```
+
+Observed results:
+
+- OpenSIPS config check: OK.
+- `opensips.service`: active and enabled.
+- MI JSON-RPC `version`: returned `OpenSIPS (3.6.7 (x86_64/linux))`.
+- From Server T, SIP `OPTIONS` returned `SIP/2.0 200 Keepalive`.
+- From Server T, SIP `REGISTER` returned `SIP/2.0 401 Authentication Required` with `WWW-Authenticate`.
+
+## Rollback
+
+Backup directory:
+
+```text
+/var/backups/lisglosips-s18/20260621T051403Z
+```
+
+Basic rollback:
+
+```bash
+sudo systemctl stop opensips
+sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-etc-before-deploy/. /etc/opensips/
+sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-default-before-deploy /etc/default/opensips
+sudo nft delete table inet lisglosips_s18_opensips
+sudo systemctl daemon-reload
+```
+
+If removing packages is required, do it in a maintenance window after confirming no S19/S20 work depends on them:
+
+```bash
+sudo apt-mark unhold opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
+sudo apt-get remove --purge opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
+```