Initial LisgloSIPS V2 implementation

2026-06-22 10:56:38 +08:00
commit 5fa1bd35e9
303 changed files with 35644 additions and 0 deletions
@@ -0,0 +1,11 @@
+table inet lisglosips_s19_rtpengine {
+  chain input {
+    type filter hook input priority -14; policy accept;
+    iif "lo" accept
+    ct state established,related accept
+    ip saddr 100.93.185.30 udp dport 30000-40000 accept
+    udp dport 30000-40000 drop
+    tcp dport { 2224, 2225 } drop
+    udp dport 2223 drop
+  }
+}
@@ -0,0 +1,5 @@
+CONFIG_FILE=/etc/rtpengine/rtpengine.conf
+PIDFILE=/run/rtpengine/rtpengine-daemon.pid
+MANAGE_IPTABLES=yes
+SET_USER=rtpengine
+SET_MASK=0x7
@@ -0,0 +1,7 @@
+CONFIG_FILE=/etc/rtpengine/rtpengine-recording.conf
+PIDFILE=/run/rtpengine-recording/rtpengine-recording-daemon.pid
+MUST_NFS=no
+NFS_HOST=127.0.0.1
+NFS_REMOTE_PATH=/unused
+NFS_LOCAL_MOUNT=/dev/shm/voip_rec/incoming
+NFS_OPTIONS=hard,intr,tcp
@@ -0,0 +1,16 @@
+[rtpengine-recording]
+
+table = 0
+num-threads = 4
+
+spool-dir = /dev/shm/voip_rec/spool
+output-storage = file
+output-dir = /dev/shm/voip_rec/incoming
+output-format = wav
+output-pattern = %Y/%m/%d/%c-%t
+output-mixed = true
+output-single = false
+output-chmod = 0640
+output-chmod-dir = 0750
+output-chown = rtpengine
+output-chgrp = rtpengine
@@ -0,0 +1,22 @@
+[rtpengine]
+
+table = 0
+no-fallback = true
+
+interface = 100.90.90.90
+listen-ng = 127.0.0.1:2223
+listen-cli = 127.0.0.1:2224
+listen-http = 127.0.0.1:2225
+
+timeout = 60
+silent-timeout = 3600
+tos = 184
+
+port-min = 30000
+port-max = 40000
+
+recording-dir = /dev/shm/voip_rec/spool
+recording-method = proc
+
+log-level = 6
+log-facility = daemon
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE_DIR=${1:-/dev/shm/voip_rec}
+INCOMING_DIR="$BASE_DIR/incoming"
+READY_DIR="$BASE_DIR/ready"
+FAILED_DIR="$BASE_DIR/failed"
+MIN_AGE_SECONDS=${MIN_AGE_SECONDS:-15}
+
+mkdir -p "$INCOMING_DIR" "$READY_DIR" "$FAILED_DIR"
+chmod 0770 "$READY_DIR"
+
+find "$INCOMING_DIR" -type f \( -name '*.wav' -o -name '*.mp3' \) -print0 |
+while IFS= read -r -d '' source; do
+  if [ ! -s "$source" ]; then
+    continue
+  fi
+  now=$(date +%s)
+  mtime=$(stat -c %Y "$source")
+  if [ $((now - mtime)) -lt "$MIN_AGE_SECONDS" ]; then
+    continue
+  fi
+  if command -v fuser >/dev/null 2>&1 && fuser -s -- "$source"; then
+    continue
+  fi
+  rel=${source#"$INCOMING_DIR"/}
+  part="$READY_DIR/$rel.part"
+  ready="$READY_DIR/$rel.ready"
+  failed="$FAILED_DIR/$rel"
+  mkdir -p "$(dirname "$part")" "$(dirname "$failed")"
+  chmod 0770 "$(dirname "$part")"
+  if [ -e "$ready" ] || [ -e "$part" ]; then
+    mv -- "$source" "$failed.$(date -u +%Y%m%dT%H%M%SZ).duplicate"
+    continue
+  fi
+  mv -- "$source" "$part"
+  chmod 0640 "$part"
+  mv -- "$part" "$ready"
+done
@@ -0,0 +1,19 @@
+[Unit]
+Description=Load LisgloSIPS Server A nftables rules
+Documentation=file:/etc/nftables.d/
+After=network-online.target
+Wants=network-online.target
+Before=rtpengine-daemon.service opensips.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s19_rtpengine
+ExecStartPre=-/usr/sbin/nft delete table inet lisglosips_s18_opensips
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s18-opensips.nft
+ExecStart=/usr/sbin/nft -f /etc/nftables.d/lisglosips-s19-rtpengine.nft
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s19_rtpengine
+ExecStop=-/usr/sbin/nft delete table inet lisglosips_s18_opensips
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,9 @@
+[Unit]
+Description=Finalize RTPEngine recordings into LisgloSIPS ready files
+After=rtpengine-recording-daemon.service
+
+[Service]
+Type=oneshot
+User=rtpengine
+Group=rtpengine
+ExecStart=/usr/local/sbin/lisglosips-recording-finalize /dev/shm/voip_rec
@@ -0,0 +1,11 @@
+[Unit]
+Description=Run LisgloSIPS recording finalizer frequently
+
+[Timer]
+OnBootSec=10s
+OnUnitActiveSec=5s
+AccuracySec=1s
+Unit=lisglosips-recording-finalize.service
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,6 @@
+[Unit]
+After=network-online.target tailscaled.service lisglosips-a-firewall.service
+Wants=network-online.target tailscaled.service lisglosips-a-firewall.service
+
+[Service]
+ExecStartPre=/bin/sh -c 'for i in $(seq 1 60); do ip address show | grep -q "100.90.90.90" && exit 0; sleep 1; done; echo "Tailscale address 100.90.90.90 not ready" >&2; exit 1'
@@ -0,0 +1,22 @@
+[Unit]
+Description=RTP/media Recording Daemon for LisgloSIPS
+Documentation=man:rtpengine-recording(8)
+After=network-online.target rtpengine-daemon.service dev-shm-voip_rec.mount
+Requires=network-online.target rtpengine-daemon.service
+RequiresMountsFor=/dev/shm/voip_rec
+
+[Service]
+Type=notify
+LimitNOFILE=100000
+RuntimeDirectory=rtpengine-recording
+PIDFile=/run/rtpengine-recording/rtpengine-recording-daemon.pid
+AmbientCapabilities=CAP_NET_ADMIN CAP_CHOWN
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_CHOWN
+User=rtpengine
+Group=rtpengine
+ExecStart=/usr/bin/rtpengine-recording -f -E --no-log-timestamps --pidfile /run/rtpengine-recording/rtpengine-recording-daemon.pid --config-file /etc/rtpengine/rtpengine-recording.conf
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,9 @@
+[Unit]
+After=
+After=network-online.target rtpengine-daemon.service dev-shm-voip_rec.mount
+Requires=
+Requires=network-online.target rtpengine-daemon.service
+
+[Service]
+CapabilityBoundingSet=
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_CHOWN
@@ -0,0 +1,6 @@
+d /dev/shm/voip_rec 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/spool 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/incoming 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/ready 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/failed 0750 rtpengine rtpengine -
+d /dev/shm/voip_rec/tmp 0750 rtpengine rtpengine -