hectorzhao/lisglosips
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
309bffc7ffa70a760bce21ae59cb6c457c9c57fe
lisglosips/install-opensips-stack.sh
T

586 lines
19 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
set -euo pipefail
# One-shot OpenSIPS + OpenSIPS-CP + RTPengine installer for Ubuntu 24.04.
# Tested against OpenSIPS 3.6.x on Ubuntu Noble.
#
# Usage:
# sudo bash install-opensips-stack.sh
#
# Optional environment variables:
# SIP_IP=100.93.185.30 DB_PASS=change-me CP_VERSION=9.3.6 sudo -E bash install-opensips-stack.sh
export DEBIAN_FRONTEND=noninteractive
export NEEDRESTART_MODE=a
OPEN_SIPS_SERIES="${OPEN_SIPS_SERIES:-3.6}"
CP_VERSION="${CP_VERSION:-9.3.6}"
SIP_IP="${SIP_IP:-$(hostname -I | awk '{print $1}')}"
SIP_DOMAIN="${SIP_DOMAIN:-$SIP_IP}"
DB_NAME="${DB_NAME:-opensips}"
DB_USER="${DB_USER:-opensips}"
DB_PASS="${DB_PASS:-opensipsrw}"
DB_RO_USER="${DB_RO_USER:-opensipsro}"
DB_RO_PASS="${DB_RO_PASS:-opensipsro}"
CP_PATH="${CP_PATH:-/var/www/html/opensips-cp}"
MI_HTTP_IP="${MI_HTTP_IP:-127.0.0.1}"
MI_HTTP_PORT="${MI_HTTP_PORT:-8888}"
RTPENGINE_NG="${RTPENGINE_NG:-127.0.0.1:2223}"
RTPENGINE_PORT_MIN="${RTPENGINE_PORT_MIN:-30000}"
RTPENGINE_PORT_MAX="${RTPENGINE_PORT_MAX:-40000}"
MONIT_IP="${MONIT_IP:-127.0.0.1}"
MONIT_PORT="${MONIT_PORT:-2812}"
MONIT_USER="${MONIT_USER:-admin}"
MONIT_PASS="${MONIT_PASS:-monit}"
log() {
printf '\n### %s\n' "$*"
}
require_root() {
if [ "$(id -u)" -ne 0 ]; then
echo "Run as root, for example: sudo -E bash $0" >&2
exit 1
fi
}
backup_once() {
local file="$1"
[ -f "$file" ] || return 0
cp -an "$file" "$file.bak.$(date +%Y%m%d%H%M%S)" 2>/dev/null || true
}
apt_install() {
apt-get install -y "$@"
}
setup_apt_repo() {
log "Configure OpenSIPS APT repository"
apt-get update
apt_install ca-certificates curl gnupg lsb-release git unzip sed gawk
curl -fsSL https://apt.opensips.org/opensips-org.gpg -o /usr/share/keyrings/opensips-org.gpg
cat > /etc/apt/sources.list.d/opensips.list <<EOF
deb [signed-by=/usr/share/keyrings/opensips-org.gpg] https://apt.opensips.org noble ${OPEN_SIPS_SERIES}-releases
EOF
cat > /etc/apt/sources.list.d/opensips-cli.list <<EOF
deb [signed-by=/usr/share/keyrings/opensips-org.gpg] https://apt.opensips.org noble cli-nightly
EOF
apt-get update
}
install_packages() {
log "Install OpenSIPS, OpenSIPS-CP dependencies and RTPengine"
apt_install \
opensips opensips-cli \
opensips-mysql-module opensips-mysql-dbschema \
opensips-auth-modules opensips-tls-module \
opensips-http-modules opensips-json-module \
rtpengine-daemon \
monit \
mariadb-server mariadb-client \
apache2 libapache2-mod-php \
php php-cli php-mysql php-gd php-pear php-apcu php-curl php-xml php-mbstring \
git unzip curl
}
setup_database() {
log "Create OpenSIPS database and users"
systemctl enable --now mariadb
mysql --protocol=socket -uroot <<SQL
CREATE DATABASE IF NOT EXISTS \`${DB_NAME}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS '${DB_USER}'@'localhost' IDENTIFIED BY '${DB_PASS}';
GRANT ALL PRIVILEGES ON \`${DB_NAME}\`.* TO '${DB_USER}'@'localhost';
CREATE USER IF NOT EXISTS '${DB_RO_USER}'@'localhost' IDENTIFIED BY '${DB_RO_PASS}';
GRANT SELECT ON \`${DB_NAME}\`.* TO '${DB_RO_USER}'@'localhost';
FLUSH PRIVILEGES;
SQL
}
import_schema_file_if_needed() {
local sql_file="$1"
local first_table
first_table="$(awk '/CREATE TABLE/{gsub(/`/, "", $3); print $3; exit}' "$sql_file")"
if [ -z "$first_table" ]; then
return 0
fi
if mysql --protocol=socket -uroot -D "$DB_NAME" -NBe "SHOW TABLES LIKE '$first_table'" | grep -qx "$first_table"; then
echo "schema already present: $(basename "$sql_file")"
else
echo "importing schema: $(basename "$sql_file")"
mysql --protocol=socket -uroot "$DB_NAME" < "$sql_file"
fi
}
setup_opensips_schema() {
log "Import OpenSIPS MySQL schemas"
if ! mysql --protocol=socket -uroot -D "$DB_NAME" -NBe "SHOW TABLES LIKE 'version'" | grep -qx version; then
mysql --protocol=socket -uroot "$DB_NAME" < /usr/share/opensips/mysql/standard-create.sql
else
echo "standard schema already present"
fi
local schema
for schema in \
acc alias_db auth_db permissions domain dialog dispatcher drouting dialplan \
load_balancer rtpengine rtpproxy tracer usrloc tls_mgm group speeddial
do
import_schema_file_if_needed "/usr/share/opensips/mysql/${schema}-create.sql"
done
}
configure_opensipsctlrc() {
log "Configure opensipsctlrc"
backup_once /etc/opensips/opensipsctlrc
cat > /etc/opensips/opensipsctlrc <<EOF
SIP_DOMAIN=${SIP_DOMAIN}
DBENGINE=MYSQL
DBHOST=localhost
DBNAME=${DB_NAME}
DBRWUSER=${DB_USER}
DBRWPW="${DB_PASS}"
DBROUSER=${DB_RO_USER}
DBROPW=${DB_RO_PASS}
DBROOTUSER=root
EOF
}
patch_opensips_cfg() {
log "Configure OpenSIPS listener, MI HTTP and permissions"
local cfg=/etc/opensips/opensips.cfg
backup_once "$cfg"
python3 - "$cfg" <<PY
from pathlib import Path
cfg = Path("$cfg")
s = cfg.read_text()
lines = []
socket_done = False
for line in s.splitlines():
if line.strip().startswith("socket=udp:"):
if not socket_done:
lines.append("socket=udp:${SIP_IP}:5060 /* installed by install-opensips-stack.sh */")
socket_done = True
continue
lines.append(line)
s = "\\n".join(lines) + "\\n"
if not socket_done:
marker = "####### Modules Section ########"
s = s.replace(marker, f"socket=udp:${SIP_IP}:5060\\n\\n{marker}", 1)
managed = """\
#### Managed OpenSIPS-CP runtime support
loadmodule "db_mysql.so"
loadmodule "auth.so"
loadmodule "auth_db.so"
modparam("auth_db", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
modparam("auth_db", "calculate_ha1", 1)
loadmodule "domain.so"
modparam("domain", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
modparam("domain", "db_mode", 1)
loadmodule "httpd.so"
modparam("httpd", "ip", "${MI_HTTP_IP}")
modparam("httpd", "port", ${MI_HTTP_PORT})
loadmodule "mi_http.so"
modparam("mi_http", "root", "mi")
loadmodule "permissions.so"
modparam("permissions", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
modparam("permissions", "address_table", "address")
loadmodule "dialog.so"
modparam("dialog", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
modparam("dialog", "profiles_no_value", "inbound;outbound")
modparam("dialog", "profiles_with_value", "caller;callee")
loadmodule "dispatcher.so"
modparam("dispatcher", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
modparam("dispatcher", "persistent_state", 1)
loadmodule "drouting.so"
modparam("drouting", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
modparam("drouting", "drd_table", "dr_gateways")
modparam("drouting", "drr_table", "dr_rules")
modparam("drouting", "drg_table", "dr_groups")
modparam("drouting", "drc_table", "dr_carriers")
loadmodule "rtpengine.so"
modparam("rtpengine", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
modparam("rtpengine", "db_table", "rtpengine")
loadmodule "rtpproxy.so"
modparam("rtpproxy", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")
modparam("rtpproxy", "db_table", "rtpproxy_sockets")
loadmodule "tracer.so"
modparam("tracer", "trace_on", 1)
modparam("tracer", "trace_id", "[tid]uri=mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME};table=sip_trace;")
#### End managed OpenSIPS-CP runtime support
"""
start = "#### Managed OpenSIPS-CP runtime support"
end = "#### End managed OpenSIPS-CP runtime support"
if start in s and end in s:
before, rest = s.split(start, 1)
_, after = rest.split(end, 1)
s = before + managed + after
else:
marker = '#### SIGNALING module\\n'
if marker in s:
s = s.replace(marker, managed + "\\n" + marker, 1)
else:
s = s.replace('#### Modules Section ########\\n', '#### Modules Section ########\\n' + managed + "\\n", 1)
lines = []
for line in s.splitlines():
stripped = line.strip()
if stripped.startswith('modparam("usrloc", "working_mode_preset"'):
lines.append('modparam("usrloc", "working_mode_preset", "single-instance-sql-write-through")')
continue
if stripped.startswith('modparam("usrloc", "db_url"'):
lines.append('modparam("usrloc", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")')
continue
lines.append(line)
if stripped == 'loadmodule "usrloc.so"' and 'modparam("usrloc", "db_url"' not in s:
lines.append('modparam("usrloc", "db_url", "mysql://${DB_USER}:${DB_PASS}@localhost/${DB_NAME}")')
s = "\n".join(lines) + "\n"
old_register = """\tif (is_method("REGISTER")) {
\t\t# store the registration and generate a SIP reply
\t\tif (!save("location"))
\t\t\txlog("failed to register AoR $tu\\n");
\t\texit;
\t}"""
new_register = """\tif (is_method("REGISTER")) {
\t\tif (!www_authorize("$fd", "subscriber")) {
\t\t\twww_challenge("$fd", "auth");
\t\t\texit;
\t\t}
\t\tif (!save("location"))
\t\t\txlog("failed to register AoR $tu\\n");
\t\texit;
\t}"""
if old_register in s:
s = s.replace(old_register, new_register, 1)
if 'create_dialog();' not in s:
out = []
inserted = False
lines = s.splitlines()
for i, line in enumerate(lines):
out.append(line)
if line.strip() == 'if (is_method("INVITE")) {' and i > 0 and 'account only INVITEs' in lines[i - 1]:
out.append('\t\tcreate_dialog();')
out.append('\t\tset_dlg_profile("outbound");')
out.append('\t\tset_dlg_profile("caller", "$fU");')
out.append('\t\tset_dlg_profile("callee", "$rU");')
inserted = True
if inserted:
s = "\n".join(out) + "\n"
if 'trace("tid", "m", "sip", "$fU");' not in s:
s = s.replace('route{\n', 'route{\n\n\ttrace("tid", "m", "sip", "$fU");\n', 1)
cfg.write_text(s)
PY
opensips -C -f "$cfg"
}
deploy_opensips_cp() {
log "Deploy OpenSIPS Control Panel ${CP_VERSION}"
if [ ! -d "$CP_PATH/.git" ]; then
rm -rf "$CP_PATH"
git clone --depth 1 --branch "$CP_VERSION" https://github.com/OpenSIPS/opensips-cp.git "$CP_PATH"
else
git -C "$CP_PATH" fetch --tags --depth 1 origin "$CP_VERSION" || true
git -C "$CP_PATH" checkout "$CP_VERSION"
fi
if ! mysql --protocol=socket -uroot -D "$DB_NAME" -NBe "SHOW TABLES LIKE 'ocp_admin_privileges'" | grep -qx ocp_admin_privileges; then
mysql --protocol=socket -uroot "$DB_NAME" < "$CP_PATH/config/db_schema.mysql"
else
echo "OpenSIPS-CP schema already present"
fi
mysql --protocol=socket -uroot "$DB_NAME" <<SQL
UPDATE ocp_boxes_config
SET monit_conn='${MONIT_IP}:${MONIT_PORT}',
monit_user='${MONIT_USER}',
monit_pass='${MONIT_PASS}',
monit_ssl=0
WHERE id=1;
INSERT INTO rtpengine (socket, set_id)
SELECT 'udp:${RTPENGINE_NG}', 0
WHERE NOT EXISTS (
SELECT 1 FROM rtpengine WHERE socket='udp:${RTPENGINE_NG}' AND set_id=0
);
SQL
[ -f "$CP_PATH/config/db.inc.php.sample" ] && [ ! -f "$CP_PATH/config/db.inc.php" ] && cp "$CP_PATH/config/db.inc.php.sample" "$CP_PATH/config/db.inc.php"
[ -f "$CP_PATH/config/boxes.global.inc.php.sample" ] && [ ! -f "$CP_PATH/config/boxes.global.inc.php" ] && cp "$CP_PATH/config/boxes.global.inc.php.sample" "$CP_PATH/config/boxes.global.inc.php"
python3 - "$CP_PATH/config/db.inc.php" <<PY
from pathlib import Path
p = Path("$CP_PATH/config/db.inc.php")
s = p.read_text()
repls = {
"db_host": "localhost",
"db_user": "${DB_USER}",
"db_pass": "${DB_PASS}",
"db_name": "${DB_NAME}",
}
out = []
for line in s.splitlines():
stripped = line.strip()
replaced = False
for key, value in repls.items():
needle = f"\$config->{key}"
if stripped.startswith(needle) and "=" in line:
out.append(f" \$config->{key} = '{value}';")
replaced = True
break
if not replaced:
if "db_port" in line and "db_host" in line and "port=" in line:
out.append(' if (!empty(\$config->db_port) ) \$config->db_host = \$config->db_host . ";port=" . \$config->db_port;')
else:
out.append(line)
p.write_text("\\n".join(out) + "\\n")
PY
find "$CP_PATH/config" -type f \( -name '*.inc.php' -o -name '*.php' \) -print0 | xargs -0 sed -i \
-e "s/'db_host'[[:space:]]*=>[[:space:]]*'[^']*'/'db_host' => 'localhost'/g" \
-e "s/'db_name'[[:space:]]*=>[[:space:]]*'[^']*'/'db_name' => '${DB_NAME}'/g" \
-e "s/'db_user'[[:space:]]*=>[[:space:]]*'[^']*'/'db_user' => '${DB_USER}'/g" \
-e "s/'db_pass'[[:space:]]*=>[[:space:]]*'[^']*'/'db_pass' => '${DB_PASS}'/g" || true
# OpenSIPS-CP 9.3.6 passes validation regexes to browser-side JavaScript
# through preg_quote(), which turns regexes into literal strings for
# JavaScript's RegExp(). This breaks forms such as Domains, where both IPs
# and FQDNs are intended to be valid. Keep regex semantics and only escape
# quotes for the generated JS string.
local forms_file="$CP_PATH/web/common/forms.php"
backup_once "$forms_file"
python3 - "$forms_file" <<'PY'
from pathlib import Path
import sys
p = Path(sys.argv[1])
s = p.read_text()
s = s.replace("preg_quote($re, '/')", "addslashes($re)")
s = s.replace("preg_quote($value['validation_regex'], '/')", "addslashes($value['validation_regex'])")
p.write_text(s)
PY
# Some OpenSIPS-CP 9.3.6 Domains installs still over-escape the SIP Domain
# field regex after the common generator patch. Keep the field required, but
# let the backend accept normal SIP domains such as an IP or an FQDN.
local domains_form="$CP_PATH/web/tools/system/domains/template/domains.form.php"
if [ -f "$domains_form" ]; then
backup_once "$domains_form"
python3 - "$domains_form" <<'PY'
from pathlib import Path
import sys
p = Path(sys.argv[1])
s = p.read_text()
lines = []
changed = False
for line in s.splitlines():
if '"domain", "n", $domain_form' in line:
indent = line[:len(line) - len(line.lstrip())]
lines.append(indent + '"domain", "n", $domain_form[\'domain\'], 128, null);')
changed = True
else:
lines.append(line)
if changed:
p.write_text("\n".join(lines) + "\n")
PY
php -l "$domains_form"
fi
php -l "$CP_PATH/config/db.inc.php"
php -l "$forms_file"
}
configure_apache() {
log "Configure Apache /cp alias"
cat > /etc/apache2/conf-available/opensips-cp.conf <<EOF
Alias /cp ${CP_PATH}/web
<Directory ${CP_PATH}/web>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Require all granted
</Directory>
<Directory ${CP_PATH}>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Require all denied
</Directory>
<DirectoryMatch "${CP_PATH}/web/tools/.*/.*/(template|custom_actions|lib)/">
Require all denied
</DirectoryMatch>
EOF
a2enconf opensips-cp >/dev/null || true
chown -R www-data:www-data "$CP_PATH"
systemctl enable --now apache2
systemctl reload apache2
}
configure_rtpengine() {
log "Configure RTPengine"
local defaults=/etc/default/rtpengine-daemon
[ -f "$defaults" ] || defaults=/etc/default/rtpengine
backup_once "$defaults"
if [ -f "$defaults" ]; then
grep -q '^RUN_RTPENGINE=' "$defaults" && sed -i 's|^#*RUN_RTPENGINE=.*|RUN_RTPENGINE=yes|' "$defaults" || echo 'RUN_RTPENGINE=yes' >> "$defaults"
local opts="OPTIONS=\"--interface=${SIP_IP} --listen-ng=${RTPENGINE_NG} --port-min=${RTPENGINE_PORT_MIN} --port-max=${RTPENGINE_PORT_MAX} --log-level=6\""
grep -q '^OPTIONS=' "$defaults" && sed -i "s|^OPTIONS=.*|${opts}|" "$defaults" || echo "$opts" >> "$defaults"
fi
systemctl enable rtpengine-daemon
systemctl restart rtpengine-daemon || true
}
configure_monit() {
log "Configure Monit HTTP interface for OpenSIPS-CP"
local monitrc=/etc/monit/monitrc
backup_once "$monitrc"
python3 - "$monitrc" <<PY
from pathlib import Path
import sys
p = Path(sys.argv[1])
s = p.read_text()
block = """set httpd port ${MONIT_PORT} and
use address ${MONIT_IP}
allow ${MONIT_IP}
allow ${MONIT_USER}:${MONIT_PASS}
"""
lines = s.splitlines()
out = []
i = 0
inserted = False
while i < len(lines):
line = lines[i]
stripped = line.strip()
if stripped.startswith("set httpd port") or stripped.startswith("# set httpd port"):
if not inserted:
out.extend(block.rstrip("\\n").splitlines())
inserted = True
i += 1
while i < len(lines):
nxt = lines[i]
nstr = nxt.strip()
if not nstr:
out.append(nxt)
i += 1
break
if nstr.startswith("set ") and not nstr.startswith("set httpd port"):
break
if nxt.startswith(" ") or nxt.startswith("\\t") or nstr.startswith("#"):
i += 1
continue
break
continue
out.append(line)
i += 1
if not inserted:
out.append("")
out.extend(block.rstrip("\\n").splitlines())
p.write_text("\\n".join(out) + "\\n")
PY
monit -t
systemctl enable monit
systemctl restart monit
}
enable_runtime_services() {
log "Enable runtime services at boot"
# OpenSIPS-CP is served by Apache and uses MariaDB; it is not a separate
# daemon. Enabling these services makes http://SERVER_IP/cp/ available after
# reboot, while enabling opensips starts the SIP proxy itself.
systemctl enable --now mariadb
systemctl enable --now apache2
systemctl enable opensips
systemctl restart opensips
systemctl enable rtpengine-daemon
systemctl restart rtpengine-daemon || true
systemctl enable monit
systemctl restart monit
}
restart_and_verify() {
log "Restart services and verify"
enable_runtime_services
systemctl reload apache2
systemctl is-active mariadb apache2 opensips rtpengine-daemon monit
systemctl is-enabled mariadb apache2 opensips rtpengine-daemon monit
opensips -V | head -n 4
curl -fsS --max-time 10 "http://127.0.0.1/cp/" | grep -m1 "OpenSIPS Control Panel"
curl -fsS --max-time 10 -u "${MONIT_USER}:${MONIT_PASS}" "http://${MONIT_IP}:${MONIT_PORT}/" | grep -m1 "Monit"
curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"rtpengine_show"}'
curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":2,"method":"rtpproxy_show"}'
curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":3,"method":"trace"}'
curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":4,"method":"dr_gw_status"}'
curl -fsS --max-time 10 -X POST "http://${MI_HTTP_IP}:${MI_HTTP_PORT}/mi" \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"address_reload"}'
ss -ltnup | grep -E "(:80|:5060|:${MI_HTTP_PORT}|:2223)" || true
}
main() {
require_root
setup_apt_repo
install_packages
setup_database
setup_opensips_schema
configure_opensipsctlrc
patch_opensips_cfg
deploy_opensips_cp
configure_apache
configure_rtpengine
configure_monit
restart_and_verify
cat <<EOF
Install complete.
OpenSIPS-CP URL: http://${SIP_IP}/cp/
Default OpenSIPS-CP login:
username: admin
password: opensips
MI HTTP endpoint is bound to ${MI_HTTP_IP}:${MI_HTTP_PORT}/mi for local CP usage.
Do not expose MI HTTP to the public Internet.
EOF
}
main "$@"
Reference in New Issue View Git Blame Copy Permalink