Server A OpenSIPS Baseline Runbook

Task: S18 - Server A OpenSIPS baseline Environment: local KVM development servers over Tailscale

Scope

S18 installs and pins OpenSIPS 3.6.x on Server A, binds SIP to the Tailscale address 100.90.90.90:15060/udp, enables local-only MI HTTP, loads the Redis and HEP/tracer module baseline, and adds basic SIP anti-scan handling.

Full Redis routing, RTPEngine/media handling, CDR Stream emission, and production SIP routing are intentionally left for S19-S22.

Installed Packages

Packages installed from https://apt.opensips.org noble 3.6-releases:

opensips 3.6.7-1
opensips-auth-modules 3.6.7-1
opensips-redis-module 3.6.7-1
opensips-http-modules 3.6.7-1
opensips-json-module 3.6.7-1
opensips-restclient-module 3.6.7-1
opensips-prometheus-module 3.6.7-1
opensips-tlsmgm-module 3.6.7-1
opensips-tls-module 3.6.7-1
opensips-tls-openssl-module 3.6.7-1
opensips-cli 0.4.0~20260522~570a9a9-1

All listed OpenSIPS packages are held with apt-mark hold.

Server Files

/etc/opensips/opensips.cfg
/etc/default/opensips
/etc/apt/sources.list.d/opensips.list
/etc/apt/sources.list.d/opensips-cli.list
/etc/nftables.d/lisglosips-s18-opensips.nft

Repository copies:

infra/server-a/s18/opensips/opensips.cfg
infra/server-a/s18/opensips/opensips.default
infra/server-a/s18/nftables/lisglosips-s18-opensips.nft

Runtime

OpenSIPS listens on 100.90.90.90:15060/udp.
HEP transport placeholder listens on 127.0.0.1:9061/udp.
MI HTTP listens on 127.0.0.1:8888/tcp.
Node Exporter remains on 100.90.90.90:9100/tcp from S06.

SIP Behavior

OPTIONS without a user part returns 200 Keepalive.
REGISTER returns 401 Authentication Required with a Digest challenge.
INVITE returns 503 Routing Not Ready until S20/S21 routes are implemented.
pike blocks excessive request density.
maxfwd rejects loops with 483 Too Many Hops.

Firewall

The S18 nftables table only filters the new SIP and MI surfaces:

allow 100.93.185.30 -> 100.90.90.90:15060/udp;
drop other UDP 15060 sources;
drop non-local TCP access to 8888.

The table uses policy accept and does not alter SSH. SSH key login remains enabled and unchanged.

Validation

Commands used:

opensips -C -f /etc/opensips/opensips.cfg
systemctl is-active opensips
systemctl is-enabled opensips
ss -lntu | grep -E '15060|8888|9061|9100'
curl -X POST http://127.0.0.1:8888/mi -H 'Content-Type: application/json' --data-binary @mi-version.json

Observed results:

OpenSIPS config check: OK.
opensips.service: active and enabled.
MI JSON-RPC version: returned OpenSIPS (3.6.7 (x86_64/linux)).
From Server T, SIP OPTIONS returned SIP/2.0 200 Keepalive.
From Server T, SIP REGISTER returned SIP/2.0 401 Authentication Required with WWW-Authenticate.

Rollback

Backup directory:

/var/backups/lisglosips-s18/20260621T051403Z

Basic rollback:

sudo systemctl stop opensips
sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-etc-before-deploy/. /etc/opensips/
sudo cp -a /var/backups/lisglosips-s18/20260621T051403Z/opensips-default-before-deploy /etc/default/opensips
sudo nft delete table inet lisglosips_s18_opensips
sudo systemctl daemon-reload

If removing packages is required, do it in a maintenance window after confirming no S19/S20 work depends on them:

sudo apt-mark unhold opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli
sudo apt-get remove --purge opensips opensips-auth-modules opensips-redis-module opensips-http-modules opensips-json-module opensips-restclient-module opensips-prometheus-module opensips-tlsmgm-module opensips-tls-module opensips-tls-openssl-module opensips-cli

3.9 KiB Raw Blame History