# Server A OpenSIPS Baseline Runbook

> Task: S18 - Server A OpenSIPS baseline
> Environment: local KVM development servers over Tailscale

## Scope

S18 installs and pins OpenSIPS 3.6.x on Server A, binds SIP to the Tailscale address `100.90.90.90:15060/udp`, enables local-only MI HTTP, loads the Redis and HEP/tracer module baseline, and adds basic SIP anti-scan handling.

Full Redis routing, RTPEngine/media handling, CDR Stream emission, and production SIP routing are intentionally left for S19-S22.

## Installed Packages

Packages installed from `https://apt.opensips.org noble 3.6-releases`:

- `opensips` `3.6.7-1`
- `opensips-auth-modules` `3.6.7-1`
- `opensips-redis-module` `3.6.7-1`
- `opensips-http-modules` `3.6.7-1`
- `opensips-json-module` `3.6.7-1`
- `opensips-restclient-module` `3.6.7-1`
- `opensips-prometheus-module` `3.6.7-1`
- `opensips-tlsmgm-module` `3.6.7-1`
- `opensips-tls-module` `3.6.7-1`
- `opensips-tls-openssl-module` `3.6.7-1`
- `opensips-cli` `0.4.0~20260522~570a9a9-1`

All listed OpenSIPS packages are held with `apt-mark hold`.

## Server Files

- `/etc/opensips/opensips.cfg`
- `/etc/default/opensips`
- `/etc/apt/sources.list.d/opensips.list`
- `/etc/apt/sources.list.d/opensips-cli.list`
- `/etc/nftables.d/lisglosips-s18-opensips.nft`

Repository copies:

- `infra/server-a/s18/opensips/opensips.cfg`
- `infra/server-a/s18/opensips/opensips.default`
- `infra/server-a/s18/nftables/lisglosips-s18-opensips.nft`

## Runtime

- OpenSIPS listens on `100.90.90.90:15060/udp`.
- HEP transport placeholder listens on `127.0.0.1:9061/udp`.
- MI HTTP listens on `127.0.0.1:8888/tcp`.
- Node Exporter remains on `100.90.90.90:9100/tcp` from S06.

## SIP Behavior

- `OPTIONS` without a user part returns `200 Keepalive`.
- `REGISTER` returns `401 Authentication Required` with a Digest challenge.
- `INVITE` returns `503 Routing Not Ready` until S20/S21 routes are implemented.
- `pike` blocks excessive request density.
- `maxfwd` rejects loops with `483 Too Many Hops`.

## Firewall

The S18 nftables table only filters the new SIP and MI surfaces:

- allow `100.93.185.30 -> 100.90.90.90:15060/udp`;
- drop other UDP `15060` sources;
- drop non-local TCP access to `8888`.

The table uses `policy accept` and does not alter SSH. SSH key login remains enabled and unchanged.

## Validation

Commands used:

```bash
opensips -C -f /etc/opensips/opensips.cfg
systemctl is-active opensips
systemctl is-enabled opensips
ss -lntu | grep -E '15060|8888|9061|9100'
curl -X POST http://127.0.0.1:8888/mi -H 'Content-Type: application/json' --data-binary @mi-version.json
```

Observed results:

- OpenSIPS config check: OK.
- `opensips.service`: active and enabled.
- MI JSON-RPC `version`: returned `OpenSIPS (3.6.7 (x86_64/linux))`.
- From Server T, SIP `OPTIONS` returned `SIP/2.0 200 Keepalive`.
- From Server T, SIP `REGISTER` returned `SIP/2.0 401 Authentication Required` with `WWW-Authenticate`.

## Rollback

Backup directory:

```text
/var/backups/lisglosips-s18/20260621T051403Z
```

Basic rollback:

```bash
sudo systemctl stop opensips
sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-etc-before-deploy/. /etc/opensips/
sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-default-before-deploy /etc/default/opensips
sudo nft delete table inet lisglosips_s18_opensips
sudo systemctl daemon-reload
```

If removing packages is required, do it in a maintenance window after confirming no S19/S20 work depends on them:

```bash
sudo apt-mark unhold opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
sudo apt-get remove --purge opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
```