113 lines
3.9 KiB
Markdown
113 lines
3.9 KiB
Markdown
# Server A OpenSIPS Baseline Runbook
|
|
|
|
> Task: S18 - Server A OpenSIPS baseline
|
|
> Environment: local KVM development servers over Tailscale
|
|
|
|
## Scope
|
|
|
|
S18 installs and pins OpenSIPS 3.6.x on Server A, binds SIP to the Tailscale address `100.90.90.90:15060/udp`, enables local-only MI HTTP, loads the Redis and HEP/tracer module baseline, and adds basic SIP anti-scan handling.
|
|
|
|
Full Redis routing, RTPEngine/media handling, CDR Stream emission, and production SIP routing are intentionally left for S19-S22.
|
|
|
|
## Installed Packages
|
|
|
|
Packages installed from `https://apt.opensips.org noble 3.6-releases`:
|
|
|
|
- `opensips` `3.6.7-1`
|
|
- `opensips-auth-modules` `3.6.7-1`
|
|
- `opensips-redis-module` `3.6.7-1`
|
|
- `opensips-http-modules` `3.6.7-1`
|
|
- `opensips-json-module` `3.6.7-1`
|
|
- `opensips-restclient-module` `3.6.7-1`
|
|
- `opensips-prometheus-module` `3.6.7-1`
|
|
- `opensips-tlsmgm-module` `3.6.7-1`
|
|
- `opensips-tls-module` `3.6.7-1`
|
|
- `opensips-tls-openssl-module` `3.6.7-1`
|
|
- `opensips-cli` `0.4.0~20260522~570a9a9-1`
|
|
|
|
All listed OpenSIPS packages are held with `apt-mark hold`.
|
|
|
|
## Server Files
|
|
|
|
- `/etc/opensips/opensips.cfg`
|
|
- `/etc/default/opensips`
|
|
- `/etc/apt/sources.list.d/opensips.list`
|
|
- `/etc/apt/sources.list.d/opensips-cli.list`
|
|
- `/etc/nftables.d/lisglosips-s18-opensips.nft`
|
|
|
|
Repository copies:
|
|
|
|
- `infra/server-a/s18/opensips/opensips.cfg`
|
|
- `infra/server-a/s18/opensips/opensips.default`
|
|
- `infra/server-a/s18/nftables/lisglosips-s18-opensips.nft`
|
|
|
|
## Runtime
|
|
|
|
- OpenSIPS listens on `100.90.90.90:15060/udp`.
|
|
- HEP transport placeholder listens on `127.0.0.1:9061/udp`.
|
|
- MI HTTP listens on `127.0.0.1:8888/tcp`.
|
|
- Node Exporter remains on `100.90.90.90:9100/tcp` from S06.
|
|
|
|
## SIP Behavior
|
|
|
|
- `OPTIONS` without a user part returns `200 Keepalive`.
|
|
- `REGISTER` returns `401 Authentication Required` with a Digest challenge.
|
|
- `INVITE` returns `503 Routing Not Ready` until S20/S21 routes are implemented.
|
|
- `pike` blocks excessive request density.
|
|
- `maxfwd` rejects loops with `483 Too Many Hops`.
|
|
|
|
## Firewall
|
|
|
|
The S18 nftables table only filters the new SIP and MI surfaces:
|
|
|
|
- allow `100.93.185.30 -> 100.90.90.90:15060/udp`;
|
|
- drop other UDP `15060` sources;
|
|
- drop non-local TCP access to `8888`.
|
|
|
|
The table uses `policy accept` and does not alter SSH. SSH key login remains enabled and unchanged.
|
|
|
|
## Validation
|
|
|
|
Commands used:
|
|
|
|
```bash
|
|
opensips -C -f /etc/opensips/opensips.cfg
|
|
systemctl is-active opensips
|
|
systemctl is-enabled opensips
|
|
ss -lntu | grep -E '15060|8888|9061|9100'
|
|
curl -X POST http://127.0.0.1:8888/mi -H 'Content-Type: application/json' --data-binary @mi-version.json
|
|
```
|
|
|
|
Observed results:
|
|
|
|
- OpenSIPS config check: OK.
|
|
- `opensips.service`: active and enabled.
|
|
- MI JSON-RPC `version`: returned `OpenSIPS (3.6.7 (x86_64/linux))`.
|
|
- From Server T, SIP `OPTIONS` returned `SIP/2.0 200 Keepalive`.
|
|
- From Server T, SIP `REGISTER` returned `SIP/2.0 401 Authentication Required` with `WWW-Authenticate`.
|
|
|
|
## Rollback
|
|
|
|
Backup directory:
|
|
|
|
```text
|
|
/var/backups/lisglosips-s18/20260621T051403Z
|
|
```
|
|
|
|
Basic rollback:
|
|
|
|
```bash
|
|
sudo systemctl stop opensips
|
|
sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-etc-before-deploy/. /etc/opensips/
|
|
sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-default-before-deploy /etc/default/opensips
|
|
sudo nft delete table inet lisglosips_s18_opensips
|
|
sudo systemctl daemon-reload
|
|
```
|
|
|
|
If removing packages is required, do it in a maintenance window after confirming no S19/S20 work depends on them:
|
|
|
|
```bash
|
|
sudo apt-mark unhold opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
|
|
sudo apt-get remove --purge opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
|
|
```
|