cloud-init.yaml

## template: jinja
#cloud-config

# SET OUR VARIABLES
# =================

# Ubuntu Pro token from: https://ubuntu.com/pro/dashboard (not needed for Ubuntu Pro instances on Azure, AWS, or Google Cloud)
{% set TOKEN = '' %}

# SMTP credentials (sendgrid and gmail example configurations)
# sendgrid: https://console.cloud.google.com/marketplace/product/sendgrid-app/sendgrid-email
# {% set SMTP_HOST = 'smtp.sendgrid.net' %}
# {% set SMTP_PORT = '587' %}
# {% set SMTP_USERNAME = 'apikey' %}
# substitute `YOUR-API-KEY-HERE` below, with your API KEY, https://app.sendgrid.com/settings/api_keys
# {% set SMTP_PASSWORD = 'YOUR-API-KEY-HERE' %}

# gmail:
# {% set SMTP_HOST = 'smtp.gmail.com' %}
# {% set SMTP_PORT = '587' %}
# replace `YOUREMAIL@GMAIL.COM` with your email, get `YOUR-APP-PASSWORD` from: https://myaccount.google.com/apppasswords
# {% set SMTP_USERNAME = 'YOUREMAIL@GMAIL.COM' %}
# {% set SMTP_PASSWORD = 'YOUR-APP-PASSWORD' %}

{% set SMTP_HOST = '' %}
{% set SMTP_PORT = '' %}
{% set SMTP_USERNAME = '' %}
{% set SMTP_PASSWORD = '' %}

# NOTIFICATION_EMAIL address for daily crontab notifications
{% set NOTIFICATION_EMAIL = 'youremail@example.com' %}

# HOSTNAME and FQDN are used by Postfix, and necessary for Sendgrid
# HOSTNAME: subdomain of FQDN (e.g. `server` for `server.example.com`)
# FQDN (e.g. `example.com` or `server.example.com`)
{% set HOSTNAME = 'voip' %}
{% set FQDN = 'voip.example.com' %}

# OPTIONAL: PRECONFIGURE FREEPBX CORE MODULE (OUTBOUND ROUTES AND TRUNKS)
# ubuntupbx.core.backup.tar.gz was generated with the Backup & Restore FreePBX Module
# this can be replaced with the address of your backup file, if you're copying configurations from another FreePBX installation
{% set RESTORE_BACKUP = 'https://github.com/rajannpatel/ubuntupbx/raw/refs/heads/main/ubuntupbx.core.backup.tar.gz' %}
# ubuntupbx.core.backup.tar.gz Outbound Routes include: N11, North America FoIP, North America VoIP, International VoIP
# ubuntupbx.core.backup.tar.gz SIP Trunks include:
{% set enable_T38Fax = true %}      # https://t38fax.com
{% set enable_Flowroute = false %}  # https://flowroute.com
{% set enable_Telnyx = false %}     # https://telnyx.com
{% set enable_BulkVS = true %}      # https://bulkvs.com

# List of public IPv4 addresses that should never be blocked by fail2ban
# - Use standard dotted decimal notation for each IP address or CIDR (slash) notation IP ranges
# - Separate multiple entries with a space, and do not use commas:
# {% set USER_IPS = '192.178.0.0/15 142.251.47.238' %}
{% set USER_IPS = '' %}

# TIMEZONE: default value is fine
# As represented in /usr/share/zoneinfo. An empty string ('') will result in UTC time being used.
{% set TIMEZONE = 'America/New_York' %}

# TIME TO INSTALL AND REBOOT UBUNTU FOR SECURITY PATCHES FROM CANONICAL IN XX:XX FORMAT
{% set SECURITY_INSTALL_TIME = "04:10" %}
{% set SECURITY_REBOOT_TIME = "04:30" %}

# NUMBER OF DAYS TO RETAIN CDR AND CEL RECORDS IN FREEPBX
{% set CDR_RETENTION_DAYS = "60" %}
{% set CEL_RETENTION_DAYS = "60" %}

# PHP 8.2 IS OFFICIALLY TESTED WITH FREEPBX BY SANGOMA, PHP 8.2 IS SECURITY MAINTAINED UNTIL 31 Dec 2026 FROM THE PHP GROUP (UPSTREAM)
# PHP 8.3 IS COMPATIBLE WITH FREEPBX AND ALL AVAILABLE MODULES, PHP 8.3 GETS SECURITY PATCHING UNTIL 2036 THROUGH CANONICAL, THE PUBLISHERS OF UBUNTU
# PHP_VERSION = 8.2|8.3
{% set PHP_VERSION = "8.3" %}

# =========================
# END OF SETTING VARIABLES

# SIP Signaling IPs for each provider
# T38Fax: https://helpdesk.t38fax.com/hc/en-us/articles/360053046071-Recommended-Firewall-Settings
# Flowroute: https://manage.flowroute.com/accounts/interconnection/setup/ or https://support.bcmone.com/flowroute-support/docs/configure-an-inbound-route-with-your-preferred-pop#pop-options
# Telnyx: https://sip.telnyx.com/
# Bulkvs: `dig +short SRV _sip._udp.sip.bulkvs.com | awk '{print $4}' | xargs -I {} dig +short {}`

{% set PROVIDERS = [
  ('T38Fax', enable_T38Fax, '8.20.91.194 8.34.182.111 8.34.182.112 130.51.64.200/29 130.51.65.200/29 130.51.66.200/29 130.51.67.200/29'),
  ('Flowroute', enable_Flowroute, '34.210.91.112/28 34.226.36.32/28 16.163.86.112/30 3.0.5.12/30 3.8.37.20/30 3.71.103.56/30 18.228.70.48/30'),
  ('Telnyx', enable_Telnyx, '192.76.120.10 64.16.250.10 185.246.41.140 185.246.41.141 103.115.244.145 103.115.244.146 192.76.120.31 64.16.250.13'),
  ('BulkVS', enable_BulkVS, '162.249.171.198 23.190.16.198 76.8.29.198')
] %}

{% set FAIL2BAN_IGNOREIPS = [USER_IPS] %}
{% for PROVIDER, ENABLED, IP in PROVIDERS %}
  {% if ENABLED %}
    {% do FAIL2BAN_IGNOREIPS.append(IP) %}
  {% endif %}
{% endfor %}
{% set FAIL2BAN_IGNOREIPS = FAIL2BAN_IGNOREIPS | join(' ') %}

# FQDN could be a subdomain, so we determine the domain programmatically 
{% set parts = FQDN.split(".") %}
{% if parts|length > 1 %}
  {% set DOMAIN = parts[-2] + "." + parts[-1] %}
{% else %}
  {% set DOMAIN = FQDN %}
{% endif %}

hostname: {{ HOSTNAME }}
fqdn: {{ FQDN }}

users:
  - name: asterisk
    gecos: 'Asterisk User'
    groups: users
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    shell: /bin/bash
    lock_passwd: true

write_files:
  - path: /etc/systemd/system/apt-daily-upgrade.timer.d/override.conf
    permissions: '0644'
    content: |
      [Timer]
      OnCalendar=
      OnCalendar={{ SECURITY_INSTALL_TIME }}
      RandomizedDelaySec=0
  - path: /etc/postfix/sasl_passwd
    permissions: '0400'
    content: |
      [{{ SMTP_HOST }}]:{{ SMTP_PORT }} {{ SMTP_USERNAME }}:{{ SMTP_PASSWORD }}
  - path: /etc/systemd/system/freepbx.service
    permissions: '0644'
    content: |
      [Unit]
      Description=FreePBX
      After=mariadb.service
      [Service]
      Type=oneshot
      RemainAfterExit=yes
      ExecStart=/usr/sbin/fwconsole start -q
      ExecStop=/usr/sbin/fwconsole stop -q
      [Install]
      WantedBy=multi-user.target
  - path: /etc/odbcinst.ini
    permissions: '0644'
    content: |
      [MySQL]
      Description = ODBC for MySQL (MariaDB)
      Driver = libmaodbc.so
      FileUsage = 1
  - path: /etc/logrotate.d/asterisk-custom
    permissions: '0644'
    content: |
      /var/log/asterisk/backup*.log {
          weekly
          missingok
          rotate 1
          maxage 7
          su asterisk asterisk
      }
      /var/log/asterisk/core*.log /var/log/asterisk/freepbx*.log /var/log/asterisk/asterisk*.log /var/log/asterisk/debug /var/log/asterisk/messages /var/log/asterisk/full /var/log/asterisk/*_log {
          daily
          missingok
          rotate 3
          sharedscripts
          su asterisk asterisk
          postrotate
              cd /home/asterisk && /usr/sbin/invoke-rc.d asterisk logger-reload > /dev/null 2> /dev/null
          endscript
      }
  - path: /etc/fail2ban/jail.local
    permissions: '0644'
    content: |
      [DEFAULT]
{% if NOTIFICATION_EMAIL %}
      destemail = {{ NOTIFICATION_EMAIL }}
      sender = no-reply@{{ DOMAIN }}
{% endif %}
      ignoreip = 127.0.0.0/8 {{ FAIL2BAN_IGNOREIPS }}

      [sshd]
      enabled = true
      action = iptables[name=sshd, port=22, protocol=tcp]

      [asterisk]
      enabled = true
      filter = asterisk
      backend = auto
      logpath = /var/log/asterisk/asterisk_security.log
      maxretry = 3
      findtime = 120
      bantime = 1h
      action = iptables[name=asterisk, port=5060, protocol=udp]
               %(action_mw)s

      [freepbx]
      enabled = true
      backend = auto
      logpath  = /var/log/asterisk/freepbx_security.log
      maxretry = 3
      findtime = 120
      bantime = 1h
      action = iptables[name=freepbx, port=80, protocol=tcp]
               %(action_mw)s
  - path: /var/log/asterisk/asterisk_security.log
    permissions: '0664'
    content: |
      ---LOG BEGINS---
  - path: /var/log/asterisk/freepbx_security.log
    permissions: '0664'
    content: |
      ---LOG BEGINS---
  - path: /etc/fail2ban/filter.d/freepbx.conf
    permissions: '0644'
    content: |
      [Definition]
      failregex = ^\[.*\] \[freepbx_security\.NOTICE\]: Authentication failure for .* from <HOST> .*$
      ignoreregex =
  - path: /root/schedule.txt
    permissions: '0644'
    content: |
{% if NOTIFICATION_EMAIL %}
      MAILTO={{ NOTIFICATION_EMAIL }}
{% endif %}
      @daily (find /var/spool/asterisk/monitor/*/ -type d -mtime +365 -exec rm -rf {} + 2>/dev/null; find /var/spool/asterisk/monitor/*/*/*/ -type d -mtime +5 -exec rm -rf {} + 2>/dev/null; find /var/spool/asterisk/monitor -type f -size 44c -delete)
      @daily find /var/spool/asterisk/voicemail -type f -name msg????.??? -mtime +45 -delete
      @daily find /var/www/html/admin/modules/_cache -type f -mtime 365 -delete
      @daily mysql -u root asteriskcdrdb -e 'DELETE FROM cdr WHERE calldate < DATE_SUB(NOW(), INTERVAL {{ CDR_RETENTION_DAYS }} DAY); optimize table cdr;'
      @daily mysql -u root asteriskcdrdb -e 'DELETE FROM cel WHERE eventtime < DATE_SUB(NOW(), INTERVAL {{ CEL_RETENTION_DAYS }} DAY); optimize table cel;'

apt:
  conf: |+
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Download-Upgradeable-Packages "1";
      APT::Periodic::AutocleanInterval "7";
      APT::Periodic::Unattended-Upgrade "1";
{% if PHP_VERSION == "8.2" %}
  sources:
    php:
      source: 'ppa:ondrej/php'
{% endif %}

# `apt update && apt upgrade -y` and reboot if /var/run/reboot-required while provisioning
package_update: true
package_upgrade: true
package_reboot_if_required: true

{% if TOKEN %}
ubuntu_pro:
  token: {{ TOKEN }}
  enable: [livepatch, esm-apps, esm-infra]
{% endif %}

{% if "/" in TIMEZONE %}
timezone: {{ TIMEZONE }}
{% endif %}

packages:
  - apache2
  - asterisk
  - asterisk-mp3
  - asterisk-moh-opsound-wav
  - asterisk-moh-opsound-gsm
  - asterisk-moh-opsound-g722
  - fail2ban
  - ffmpeg
  - lame
  - mariadb-server
  - mariadb-client
  - mpg123
  - nodejs
  - npm
  - odbc-mariadb
  - php-pear
  - php{{ PHP_VERSION }}
  - php{{ PHP_VERSION }}-cli
  - php{{ PHP_VERSION }}-common
  - php{{ PHP_VERSION }}-curl
  - php{{ PHP_VERSION }}-gd
  - php{{ PHP_VERSION }}-intl
  - php{{ PHP_VERSION }}-mbstring
  - php{{ PHP_VERSION }}-mysql
  - php{{ PHP_VERSION }}-soap
  - php{{ PHP_VERSION }}-xml
  - postfix
  - sox
  - unixodbc

runcmd:
# add public IPv4 to ignoreip for fail2ban
  - |
    PUBLIC_IP=$(curl -s https://checkip.amazonaws.com) && [ -n "$PUBLIC_IP" ] && ! grep -q "$PUBLIC_IP" /etc/fail2ban/jail.local && sed -i "s/^ignoreip = \(.*\)/ignoreip = \1 ${PUBLIC_IP}/" /etc/fail2ban/jail.local
    systemctl restart fail2ban
# for Ubuntu Pro enabled public cloud images, where a token may not be provided by the user
  - pro status --format yaml | grep -x attached:\ true && pro status --format yaml | grep -A1 name:\ esm-infra | grep -q status:\ disabled && pro enable esm-infra
  - pro status --format yaml | grep -x attached:\ true && pro status --format yaml | grep -A1 name:\ esm-apps | grep -q status:\ disabled && pro enable esm-apps
  - pro status --format yaml | grep -x attached:\ true && pro status --format yaml | grep -A1 name:\ livepatch | grep -q status:\ disabled && pro enable livepatch
  - sed -i "s/^#\$nrconf{restart} = 'i';/\$nrconf{restart} = 'a';/" /etc/needrestart/needrestart.conf
  - needrestart -r a
  - sed -i 's|^//\s*Unattended-Upgrade::Remove-Unused-Kernel-Packages\s*".*";|Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";|' /etc/apt/apt.conf.d/50unattended-upgrades
  - sed -i 's|^//\s*Unattended-Upgrade::Remove-New-Unused-Dependencies\s*".*";|Unattended-Upgrade::Remove-New-Unused-Dependencies "true";|' /etc/apt/apt.conf.d/50unattended-upgrades
  - sed -i 's|^//\s*Unattended-Upgrade::Remove-Unused-Dependencies\s*".*";|Unattended-Upgrade::Remove-Unused-Dependencies "true";|' /etc/apt/apt.conf.d/50unattended-upgrades
  - sed -i 's|^//\s*Unattended-Upgrade::Automatic-Reboot\s*".*";|Unattended-Upgrade::Automatic-Reboot "true";|' /etc/apt/apt.conf.d/50unattended-upgrades
  - sed -i 's|^//\s*Unattended-Upgrade::Automatic-Reboot-WithUsers\s*".*";|Unattended-Upgrade::Automatic-Reboot-WithUsers "true";|' /etc/apt/apt.conf.d/50unattended-upgrades
  - sed -i 's|^//\s*Unattended-Upgrade::Automatic-Reboot-Time\s*".*";|Unattended-Upgrade::Automatic-Reboot-Time "{{ SECURITY_REBOOT_TIME }}";|' /etc/apt/apt.conf.d/50unattended-upgrades
# Erase Oracle Cloud's default restrictive iptables rules
  - iptables -L | grep -q -v '^Chain' && iptables -F && netfilter-persistent save || echo "No iptables rules found"
# fallocate -l 2G of space for swap file
  - fallocate -l 2G /swapfile
# Set permission of the swap file to be readable and writable only by the owner  
  - chmod 600 /swapfile
# Create a Linux swap area on the file
  - mkswap /swapfile
# Enable the swap file
  - swapon /swapfile
# Add the swap file to the /etc/fstab file if it is not already there
  - grep -qxF '/swapfile none swap sw 0 0' /etc/fstab || sed -i -e "\$a/swapfile none swap sw 0 0" /etc/fstab
{% if SMTP_HOST %}
  - postconf -e myhostname="{{ FQDN }}"
  - postconf -e mydomain="{{ DOMAIN }}"
  - postconf -e myorigin="{{ DOMAIN }}"
  - postconf -e masquerade_domains="{{ DOMAIN }}"
  - postconf -e mydestination=localhost
  - postconf -e default_transport=smtp
  - postconf -e relay_transport=smtp
  - postconf -e relayhost="[{{ SMTP_HOST }}]:{{ SMTP_PORT }}"
  - postconf -e smtp_sasl_auth_enable=yes
  - postconf -e smtp_sasl_password_maps=hash:/etc/postfix/sasl_passwd
  - postconf -e header_size_limit=4096000
  - postconf -e smtp_sasl_security_options=noanonymous
  - postconf -e smtp_sasl_tls_security_options=noanonymous
  - postconf -e smtp_tls_security_level=encrypt
  - postconf -e smtp_use_tls=yes
  - postmap /etc/postfix/sasl_passwd
  - rm /etc/postfix/sasl_passwd
  - systemctl restart postfix.service
{% endif %}
  - chown -R asterisk:asterisk /etc/asterisk
  - chown -R asterisk:asterisk /var/{lib,log,spool}/asterisk
  - sed -i 's|#AST_USER|AST_USER|' /etc/default/asterisk
  - sed -i 's|#AST_GROUP|AST_GROUP|' /etc/default/asterisk
  - sed -i 's|;runuser|runuser|' /etc/asterisk/asterisk.conf
  - sed -i 's|;rungroup|rungroup|' /etc/asterisk/asterisk.conf
  - ldconfig
{% if PHP_VERSION == "8.2" %}
  - apt-get -y purge php8.3
  - rm -rf /etc/php/8.3
  - a2enmod php8.2
  - update-alternatives --set php /usr/bin/php8.2
{% endif %}
  - sed -i 's/\(^upload_max_filesize = \).*/\120M/' /etc/php/{{ PHP_VERSION }}/apache2/php.ini
  - sed -i 's/\(emory_limit = \).*/\1256M/' /etc/php/{{ PHP_VERSION }}/apache2/php.ini
  - sed -i 's/^\(User\|Group\).*/\1 asterisk/' /etc/apache2/apache2.conf
  - sed -i 's/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf
  - a2enmod rewrite
  - rm /var/www/html/index.html
  - systemctl restart apache2
  - systemctl stop asterisk
# Asterisk and FreePBX use /var/lib/asterisk/sounds/en/custom and not the `custom -> ../../../local/share/asterisk/sounds` symlink in /usr/share/asterisk/sounds/
  - rm -rf /usr/share/asterisk/sounds/custom; ln -s /var/lib/asterisk/sounds/en/custom /usr/share/asterisk/sounds/custom
# FreePBX expects default MOH files in /var/lib/asterisk/moh/default, but Ubuntu's deb package places them in /usr/share/asterisk/moh/
  - ln -s /usr/share/asterisk/moh /var/lib/asterisk/moh/asterisk-moh-opsound
  - chown -R asterisk:asterisk /usr/share/asterisk/moh && chown -R asterisk:asterisk /var/lib/asterisk/moh/
  - curl -L -O --output-dir /var/tmp http://mirror.freepbx.org/modules/packages/freepbx/freepbx-17.0-latest.tgz && tar zxvf /var/tmp/freepbx-17.0-latest.tgz -C /usr/src
  - cd /usr/src/freepbx && ./start_asterisk start
  - while asterisk -rx 'core show version' 2>&1 | grep -Eq '(Unable to connect to remote asterisk|No such command)'; do echo 'Waiting for Asterisk core to be available'; sleep 2; done && cd /usr/src/freepbx && ./install -n;
# FreePBX is unaware of Ubuntu Noble's new mysql socket location
  - sed -i 's|Socket=/var/lib/mysql/mysql.sock|Socket=/run/mysqld/mysqld.sock|' /etc/odbc.ini
  - fwconsole ma downloadinstall pm2 framework customappsreg featurecodeadmin recordings soundlang calendar conferences core ivr infoservices queues ringgroups timeconditions asteriskinfo voicemail logfiles dashboard music filestore backup sipsettings
  - systemctl enable freepbx
  - crontab /root/schedule.txt && rm /root/schedule.txt
  - mkdir -p /var/spool/asterisk/backup && chown asterisk:asterisk /var/spool/asterisk/backup
  - curl -L -O --output-dir /var/spool/asterisk/backup https://github.com/rajannpatel/ubuntupbx/raw/refs/heads/main/ubuntupbx.asterisklogs.backup.tar.gz
  - fwconsole backup --restore='/var/spool/asterisk/backup/ubuntupbx.asterisklogs.backup.tar.gz'
{% if RESTORE_BACKUP.startswith('https://') %}
  - curl -L -o /var/spool/asterisk/backup/restored-at-first-boot.tar.gz {{ RESTORE_BACKUP }}
{% elif RESTORE_BACKUP.startswith('gs://') %}
  - gcloud storage cp {{ RESTORE_BACKUP }} /var/spool/asterisk/backup/restored-at-first-boot.tar.gz
{% else %}
  - echo "Unsupported RESTORE_BACKUP URL format: {{ RESTORE_BACKUP }}"
{% endif %}
{% if RESTORE_BACKUP %}
  - fwconsole backup --restore='/var/spool/asterisk/backup/restored-at-first-boot.tar.gz'
{% endif %}
# BEGIN -- ubuntupbx.core.backup.tar.gz
{% if RESTORE_BACKUP == 'https://github.com/rajannpatel/ubuntupbx/raw/refs/heads/main/ubuntupbx.core.backup.tar.gz' %}
  - echo "DELETE FROM ampusers;" | fwconsole mysql
  - echo "DELETE FROM kvstore_OOBE;" | fwconsole mysql
# Configure FoIP Trunks and Outbound Routes
{% if not enable_T38Fax %}
  - echo "use asterisk; DELETE FROM trunks where trunkid='9'; DELETE FROM pjsip where id='9';" | fwconsole mysql
{% else %}
  - echo "use asterisk; INSERT INTO outbound_route_trunks (route_id, trunk_id, seq) VALUES (12, 9, 0);" | fwconsole mysql
{% endif %}
# Configure VoIP Trunks and Outbound Routes
{% if not enable_Flowroute %}
  - echo "use asterisk; DELETE FROM trunks where trunkid='10'; DELETE FROM pjsip where id='10';" | fwconsole mysql
{% endif %}
{% if not enable_Telnyx %}
  - echo "use asterisk; DELETE FROM trunks where trunkid='11'; DELETE FROM pjsip where id='11';" | fwconsole mysql
{% endif %}
{% if not enable_BulkVS %}
  - echo "use asterisk; DELETE FROM trunks where trunkid='12'; DELETE FROM pjsip where id='12';" | fwconsole mysql
{% endif %}
{% endif %}
# END -- ubuntupbx.core.backup.tar.gz
  - echo "INSERT INTO sipsettings (keyword, data) VALUES ('t38pt_udptl', 'redundancy') ON DUPLICATE KEY UPDATE data = 'redundancy';" | fwconsole mysql
  - fwconsole chown
  - fwconsole reload
  - fwconsole restart
  - echo "cloud-init RUNCMD COMPLETED AT $(date)"