Complete training workflow and acceptance hardening

sip/Dockerfile

@@ -9,7 +9,7 @@ COPY pjsip.conf.template /opt/lct-sip/pjsip.conf.template
 COPY extensions.conf /etc/asterisk/extensions.conf
 COPY http.conf /etc/asterisk/http.conf
 COPY modules.conf /etc/asterisk/modules.conf
-COPY rtp.conf /etc/asterisk/rtp.conf
+COPY rtp.conf.template /opt/lct-sip/rtp.conf.template
 COPY entrypoint.sh /usr/local/bin/lct-sip-entrypoint
 RUN chmod +x /usr/local/bin/lct-sip-entrypoint \
     && mkdir -p /recordings /var/lib/lct-sip /tls \

sip/entrypoint.sh

@@ -20,6 +20,16 @@ SIP_6003_PASSWORD=${override_6003:-${SIP_6003_PASSWORD:-$(openssl rand -hex 16)}
 SIP_6101_PASSWORD=${override_6101:-${SIP_6101_PASSWORD:-$(openssl rand -hex 16)}}
 SIP_6102_PASSWORD=${override_6102:-${SIP_6102_PASSWORD:-$(openssl rand -hex 16)}}
 SIP_EXTERNAL_MEDIA_ADDRESS=${SIP_EXTERNAL_MEDIA_ADDRESS:-127.0.0.1}
+SIP_RTP_START=${SIP_RTP_START:-10000}
+SIP_RTP_END=${SIP_RTP_END:-10099}
+case "$SIP_RTP_START:$SIP_RTP_END" in
+    *[!0-9:]*|:*|*:) echo "SIP_RTP_START/END must be positive decimal ports" >&2; exit 64 ;;
+esac
+if [ "$SIP_RTP_START" -lt 1024 ] || [ "$SIP_RTP_END" -gt 65535 ] \
+    || [ "$SIP_RTP_END" -lt "$SIP_RTP_START" ]; then
+    echo "SIP RTP port range must satisfy 1024 <= START <= END <= 65535" >&2
+    exit 64
+fi
 cat > "$credentials" <<EOF
 SIP_6001_PASSWORD=$SIP_6001_PASSWORD
 SIP_6002_PASSWORD=$SIP_6002_PASSWORD
@@ -30,11 +40,17 @@ EOF
 chmod 600 "$credentials"
 
 export SIP_6001_PASSWORD SIP_6002_PASSWORD SIP_6003_PASSWORD SIP_6101_PASSWORD SIP_6102_PASSWORD SIP_EXTERNAL_MEDIA_ADDRESS
+export SIP_RTP_START SIP_RTP_END
 envsubst '${SIP_6001_PASSWORD} ${SIP_6002_PASSWORD} ${SIP_6003_PASSWORD} ${SIP_6101_PASSWORD} ${SIP_6102_PASSWORD} ${SIP_EXTERNAL_MEDIA_ADDRESS}' \
     < /opt/lct-sip/pjsip.conf.template > /etc/asterisk/pjsip.conf
 chmod 640 /etc/asterisk/pjsip.conf
 chown root:asterisk /etc/asterisk/pjsip.conf
 
+envsubst '${SIP_RTP_START} ${SIP_RTP_END}' \
+    < /opt/lct-sip/rtp.conf.template > /etc/asterisk/rtp.conf
+chmod 640 /etc/asterisk/rtp.conf
+chown root:asterisk /etc/asterisk/rtp.conf
+
 if [ ! -s /tls/sip.crt ] || [ ! -s /tls/sip.key ]; then
     openssl req -x509 -nodes -newkey rsa:3072 -sha256 -days 365 \
         -keyout /tls/sip.key -out /tls/sip.crt \

sip/pjsip.conf.template

@@ -136,7 +136,10 @@ password=${SIP_6101_PASSWORD}
 type=aor
 max_contacts=2
 remove_existing=yes
-qualify_frequency=30
+# Browser SIP.js clients use a persistent WSS registration and do not reliably
+# answer Asterisk's periodic OPTIONS probes. Do not mark a live WSS contact
+# unreachable based on those probes; registration expiry still governs liveness.
+qualify_frequency=0
 
 [6102](webrtc-endpoint)
 auth=6102-auth
@@ -153,4 +156,4 @@ password=${SIP_6102_PASSWORD}
 type=aor
 max_contacts=2
 remove_existing=yes
-qualify_frequency=30
+qualify_frequency=0

sip/rtp.conf

@@ -1,5 +0,0 @@
-[general]
-rtpstart=10000
-rtpend=10099
-strictrtp=yes
-icesupport=yes

sip/rtp.conf.template

@@ -0,0 +1,5 @@
+[general]
+rtpstart=${SIP_RTP_START}
+rtpend=${SIP_RTP_END}
+strictrtp=yes
+icesupport=yes