[global]
type=global
endpoint_identifier_order=auth_username,username,ip

; ===============================
; TRANSPORT - MINDSERV OFFICE
; ===============================
[transport-udp]
type=transport
protocol=udp
bind=10.54.240.26:5060
local_net=10.54.240.24/30
external_media_address=10.54.240.26
external_signaling_address=10.54.240.26
allow_reload=yes

; ===============================
; TRANSPORT - SBC / ISHAN (eno1)
; Network : 10.202.122.16/30
; Our IP  : 10.202.122.18
; Gateway : 10.202.122.17
; Parent  : 27.54.160.154
; ===============================
[transport-udp-2]
type=transport
protocol=udp
bind=10.202.122.18:5060
local_net=10.202.122.16/30
external_media_address=10.202.122.18
external_signaling_address=10.202.122.18
allow_reload=yes

; ===============================
; TRANSPORT - WebRTC (WSS)
; ===============================
[transport-wss]
type=transport
protocol=wss
bind=0.0.0.0:8089
external_media_address=103.117.48.74
external_signaling_address=103.117.48.74
method=tlsv1_2
verify_client=no
allow_reload=yes

; ===============================
; SIP TRUNK 1 - MINDSERV OFFICE
; ===============================
[trunk]
type=endpoint
transport=transport-udp
context=trunk-in
disallow=all
allow=ulaw,alaw
inband_progress=yes
aors=trunk-aor
direct_media=no
send_pai=yes
trust_id_inbound=yes
trust_id_outbound=yes
rewrite_contact=yes
rtp_symmetric=yes
force_rport=yes
media_use_received_transport=yes

[trunk-aor]
type=aor
max_contacts=30
remove_existing=yes
contact=sip:10.79.214.164:5060
qualify_frequency=0

[trunk-identify]
type=identify
endpoint=trunk
match=10.79.214.164

; =========================================
; SIP TRUNK 2 - SBC PROVIDER - ISHAN
; Gateway : 10.202.122.17
; Parent  : 27.54.160.154
; DIDs    : 7969812700 - 7969812999
; Channels: 100
; =========================================
[trunk2]
type=endpoint
transport=transport-udp-2
context=trunk-in
disallow=all
allow=ulaw,alaw
inband_progress=yes
aors=trunk2-aor
direct_media=no
send_pai=yes
trust_id_inbound=yes
trust_id_outbound=yes
rewrite_contact=yes
rtp_symmetric=yes
force_rport=yes
media_use_received_transport=yes

[trunk2-aor]
type=aor
max_contacts=100
remove_existing=yes
; Static contact needed for outbound calls via PJSIP/trunk2
; qualify=0 to prevent ETPNOTAVAIL warnings on reload
; contact=sip:10.202.122.17:5060
contact=sip:27.54.160.154:5060
qualify_frequency=30

[trunk2-identify]
type=identify
endpoint=trunk2
; match=10.202.122.17
match=27.54.160.154

; ===============================
; WebRTC BASE TEMPLATE
; ===============================
[webrtc-template](!)
type=endpoint
transport=transport-wss
context=trunk-out
disallow=all
allow=ulaw,alaw,opus
webrtc=yes
identify_by=username,auth_username
dtls_cert_file=/etc/letsencrypt/live/go.mindserv.co/fullchain.pem
dtls_private_key=/etc/letsencrypt/live/go.mindserv.co/privkey.pem
dtls_verify=fingerprint
dtls_setup=actpass
dtls_rekey=0
ice_support=yes
media_encryption=dtls
rtcp_mux=yes
force_avp=yes
use_avpf=yes
rtp_symmetric=yes
rewrite_contact=yes
direct_media=no
media_use_received_transport=yes
inband_progress=yes          ; <-- add this: let 183 Session Progress carry real audio to agent

; ===============================
; AGENT ENTRIES
; ===============================
#include pjsip_agents.conf

; ===============================
; TRANSPORT - SBC / PUBLIC UDP transport (unused while carrier blocks UDP)
; ===============================
[transport-udp-vendors]
type=transport
protocol=udp
bind=103.117.48.74:5060
external_media_address=103.117.48.74
external_signaling_address=103.117.48.74
allow_reload=yes

; ===============================
; TRANSPORT - PUBLIC TCP for vendors (6060 avoids the SIP-ALG on 5060)
; ===============================
[transport-tcp-vendors]
type=transport
protocol=tcp
bind=103.117.48.74:6060
external_signaling_address=103.117.48.74
allow_reload=yes

; ===============================
; TRANSPORT - PUBLIC TLS for vendors (optional / not used right now)
; ===============================
[transport-tls-vendors]
type=transport
protocol=tls
bind=103.117.48.74:6061
external_signaling_address=103.117.48.74
external_media_address=103.117.48.74          ; <-- add this for RTP
cert_file=/etc/letsencrypt/live/go.mindserv.co/fullchain.pem
priv_key_file=/etc/letsencrypt/live/go.mindserv.co/privkey.pem
method=tlsv1_2
allow_reload=yes

; ===============================
; VENDOR: ACME
; ===============================
[acme]
type=endpoint
transport=transport-tls-vendors      ; <-- FIXED (was transport-tsl-vendors)
trust_id_inbound=yes      ; read the DID from the inbound PAI into CALLERID(num)
context=from-acme
disallow=all
allow=ulaw,alaw
aors=acme
auth=acme-auth
rewrite_contact=yes
rtp_symmetric=yes
force_rport=yes
direct_media=no
media_address=103.117.48.74
bind_rtp_to_media_address=yes

[acme]
type=aor
max_contacts=30
remove_existing=yes

[acme-auth]
type=auth
auth_type=userpass
username=acme
password=Acme-Sip-9f3a2c

;[acme-identify]
;type=identify
;endpoint=acme
;match=13.207.150.255        ; your box's public IP (external_signaling_address)