;==============================================================================
; pjsip.conf  —  ePhone mobile WebRTC + PSTN trunk
;------------------------------------------------------------------------------
; Two worlds live in this file:
;   1. The mobile apps    -> connect over WSS (WebSocket Secure) + DTLS-SRTP
;   2. The PSTN provider  -> connects over a normal SIP-over-UDP/TLS trunk
;
; Field engineer extensions are 6000-6999. Each engineer = one WebRTC endpoint.
;==============================================================================


;==============================================================================
; SECTION A — TRANSPORTS
;==============================================================================

; --- A1. WebSocket Secure transport for the mobile apps -----------------------
; NOTE: Asterisk terminates WSS via its built-in HTTP server, NOT here.
; This transport block only tells PJSIP "accept SIP signalling arriving on ws".
; You MUST also enable the TLS websocket in http.conf (see http.conf file).
[transport-wss]
type=transport
protocol=wss
bind=0.0.0.0:8089            ; same port as http.conf tlsbindaddr

; --- A2. TLS transport for the SIP trunk (if your provider supports SIP-TLS) --
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/asterisk/keys/asterisk.crt
priv_key_file=/etc/asterisk/keys/asterisk.key
ca_list_file=/etc/asterisk/keys/ca.crt
method=tlsv1_2
; external_signaling_address / external_media_address are set on the trunk AORs
; below when Asterisk sits behind NAT.

; --- A3. Plain UDP transport (only if your carrier is UDP-only) ---------------
[transport-udp]
type=transport
protocol=udp
bind=0.0.0.0:5060


;==============================================================================
; SECTION B — SIP TRUNK to the PSTN / DID provider  (named "trunk2")
;   Keeps the same name your dialserv AMI Originate already uses:
;   Channel: PJSIP/<number>@trunk2
;==============================================================================

[trunk2]
type=endpoint
context=from-trunk                 ; << inbound calls land in this dialplan context
transport=transport-udp            ; switch to transport-tls if carrier supports it
disallow=all
allow=ulaw
allow=alaw
;allow=g722
outbound_auth=trunk2-auth
aors=trunk2-aor
from_user=YOUR_TRUNK_USERNAME
from_domain=sip.your-provider.com
direct_media=no                    ; keep media on Asterisk (needed to bridge to WebRTC)
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
; If Asterisk is behind NAT, uncomment and set your public IP:
;media_address=YOUR_PUBLIC_IP

[trunk2-auth]
type=auth
auth_type=userpass
username=YOUR_TRUNK_USERNAME
password=YOUR_TRUNK_PASSWORD

[trunk2-aor]
type=aor
contact=sip:sip.your-provider.com:5060   ; where we send outbound INVITEs
qualify_frequency=30                      ; OPTIONS keepalive every 30s

; Identify inbound calls from the carrier as this trunk (by source IP).
; Use this when the carrier does NOT send matching auth on inbound.
[trunk2-identify]
type=identify
endpoint=trunk2
match=sip.your-provider.com               ; carrier signalling IP or FQDN
;match=203.0.113.10/32                     ; add each carrier media/sig IP as needed


;==============================================================================
; SECTION C — WebRTC MOBILE ENDPOINT TEMPLATE
;   One [aor]/[auth]/[endpoint] trio per field engineer. A template keeps the
;   per-engineer block down to a few lines.
;==============================================================================

; --- C1. Reusable template for every mobile WebRTC endpoint -------------------
[webrtc-endpoint](!)
type=endpoint
context=from-mobile               ; << outbound calls from the app land here
transport=transport-wss
disallow=all
allow=opus                        ; primary codec for mobile / lossy networks
allow=ulaw                        ; fallback so PSTN leg needs no transcoding grief
; ---- WebRTC mandatory switches ----
webrtc=yes                        ; macro: enables the 6 lines below in one shot:
                                  ;   use_avpf=yes, media_encryption=dtls,
                                  ;   dtls_verify=fingerprint, dtls_setup=actpass,
                                  ;   ice_support=yes, media_use_received_transport=yes
dtls_auto_generate_cert=yes       ; auto self-signed DTLS cert per endpoint
; ---- NAT / ICE / media hardening ----
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes               ; REQUIRED: WebRTC contact is a random ws GUID
direct_media=no                   ; Asterisk always stays in the media path
; ---- registration behaviour ----
;   auth + aors are set on the concrete endpoint below.

[webrtc-aor](!)
type=aor
max_contacts=1                    ; one active device per engineer (raise for multi-device)
remove_existing=yes               ; new registration kicks the stale one
qualify_frequency=30

[webrtc-auth](!)
type=auth
auth_type=userpass
; username + password set per engineer below.


; --- C2. Concrete engineers (repeat this trio per person) ---------------------
; Extension 6001 — engineer "arun"
[6001](webrtc-endpoint)
auth=6001-auth
aors=6001-aor
callerid=Arun Field <6001>

[6001-aor](webrtc-aor)

[6001-auth](webrtc-auth)
username=6001
password=CHANGE_ME_STRONG_SECRET_1

; Extension 6002 — engineer "priya"
[6002](webrtc-endpoint)
auth=6002-auth
aors=6002-aor
callerid=Priya Field <6002>

[6002-aor](webrtc-aor)

[6002-auth](webrtc-auth)
username=6002
password=CHANGE_ME_STRONG_SECRET_2

; ...add 6003, 6004, ... the same way (4 lines + 2 short blocks each).
