@bitcall/webrtc-sip-gateway 0.2.3 → 0.2.5

package/README.md

@@ -5,7 +5,7 @@ Linux-only CLI to install and operate the Bitcall WebRTC-to-SIP gateway.
 ## Install
 
 ```bash
-sudo npm i -g @bitcall/webrtc-sip-gateway@0.2.3
+sudo npm i -g @bitcall/webrtc-sip-gateway@0.2.5
 ```
 
 ## Main workflow
@@ -16,6 +16,11 @@ sudo bitcall-gateway status
 sudo bitcall-gateway logs -f
 ```
 
+Default media policy is IPv4-only (`MEDIA_IPV6=0` and `MEDIA_FORCE_IPV4=1`),
+including IPv6 candidate stripping on SIP->WebRTC SDP. Set `MEDIA_IPV6=1`
+and `MEDIA_FORCE_IPV4=0` in `/opt/bitcall-gateway/.env` only if you want
+IPv6 candidates.
+
 ## Commands
 
 - `sudo bitcall-gateway init`

package/lib/constants.js

@@ -14,7 +14,7 @@ module.exports = {
   SSL_DIR: path.join(GATEWAY_DIR, "ssl"),
   ENV_PATH: path.join(GATEWAY_DIR, ".env"),
   COMPOSE_PATH: path.join(GATEWAY_DIR, "docker-compose.yml"),
-  DEFAULT_GATEWAY_IMAGE: "ghcr.io/bitcallio/webrtc-sip-gateway:0.2.3",
+  DEFAULT_GATEWAY_IMAGE: "ghcr.io/bitcallio/webrtc-sip-gateway:0.2.5",
   DEFAULT_PROVIDER_HOST: "sip.example.com",
   DEFAULT_WEBPHONE_ORIGIN: "*",
   RENEW_HOOK_PATH: "/etc/letsencrypt/renewal-hooks/deploy/bitcall-gateway.sh",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitcall/webrtc-sip-gateway",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Linux CLI for bootstrapping and managing the Bitcall WebRTC-to-SIP Gateway",
   "repository": {
     "type": "git",

package/src/index.js

@@ -34,7 +34,7 @@ const {
 } = require("../lib/system");
 const { readTemplate, renderTemplate } = require("../lib/template");
 
-const PACKAGE_VERSION = "0.2.3";
+const PACKAGE_VERSION = "0.2.5";
 
 function detectComposeCommand() {
   if (run("docker", ["compose", "version"], { check: false }).status === 0) {
@@ -103,6 +103,8 @@ function envOrder() {
     "WSS_LISTEN_PORT",
     "INTERNAL_WSS_PORT",
     "INTERNAL_WS_PORT",
+    "MEDIA_IPV6",
+    "MEDIA_FORCE_IPV4",
     "RTPENGINE_MIN_PORT",
     "RTPENGINE_MAX_PORT",
     "WITH_REVERSE_PROXY",
@@ -468,6 +470,18 @@ async function runWizard(existing = {}, preflight = {}) {
       existing.WEBPHONE_ORIGIN || DEFAULT_WEBPHONE_ORIGIN
     );
 
+    const mediaIpv6Enabled = await prompt.askYesNo(
+      "Enable IPv6 media candidates? (default: No)",
+      existing.MEDIA_IPV6 === "1"
+    );
+
+    const mediaForceIpv4Enabled = await prompt.askYesNo(
+      "Force IPv4-only SDP candidates? (default: Yes)",
+      existing.MEDIA_FORCE_IPV4
+        ? existing.MEDIA_FORCE_IPV4 === "1"
+        : !mediaIpv6Enabled
+    );
+
     const configureUfw = await prompt.askYesNo("Configure ufw firewall rules now", true);
 
     const config = {
@@ -492,6 +506,8 @@ async function runWizard(existing = {}, preflight = {}) {
       turnExternalUsername,
       turnExternalCredential,
       webphoneOrigin,
+      mediaIpv6: mediaIpv6Enabled ? "1" : "0",
+      mediaForceIpv4: mediaForceIpv4Enabled ? "1" : "0",
       rtpMin: "10000",
       rtpMax: "20000",
       acmeListenPort: deployMode === "reverse-proxy" ? "8080" : "80",
@@ -509,6 +525,8 @@ async function runWizard(existing = {}, preflight = {}) {
     console.log(`  SIP provider URI: ${config.sipProviderUri}`);
     console.log(`  Allowed SIP domains: ${config.allowedDomains || "(empty/dev-mode)"}`);
     console.log(`  TURN mode: ${config.turnMode}`);
+    console.log(`  IPv6 media candidates: ${config.mediaIpv6 === "1" ? "enabled" : "disabled (IPv4-only)"}`);
+    console.log(`  Force IPv4 SDP strip: ${config.mediaForceIpv4 === "1" ? "enabled" : "disabled"}`);
 
     const proceed = await prompt.askYesNo("Proceed with provisioning", true);
     if (!proceed) {
@@ -557,6 +575,8 @@ function renderEnvContent(config, tlsCert, tlsKey) {
     WSS_LISTEN_PORT: config.wssListenPort,
     INTERNAL_WSS_PORT: config.internalWssPort,
     INTERNAL_WS_PORT: config.internalWsPort,
+    MEDIA_IPV6: config.mediaIpv6,
+    MEDIA_FORCE_IPV4: config.mediaForceIpv4,
   });
 
   let extra = "";
@@ -772,6 +792,8 @@ function statusCommand() {
   console.log(`Port ${envMap.WSS_LISTEN_PORT || "443"}: ${formatMark(p443.inUse)} listening`);
   console.log(`Port 5060: ${formatMark(p5060.inUse)} listening`);
   console.log(`rtpengine control: ${formatMark(rtpReady)} reachable`);
+  console.log(`IPv6 media candidates: ${(envMap.MEDIA_IPV6 || "0") === "1" ? "enabled" : "disabled (IPv4-only)"}`);
+  console.log(`Force IPv4 SDP strip: ${(envMap.MEDIA_FORCE_IPV4 || "1") === "1" ? "enabled" : "disabled"}`);
   if (envMap.TURN_MODE && envMap.TURN_MODE !== "none") {
     console.log(`/turn-credentials: ${formatMark(turnReady)} reachable`);
   }
@@ -789,6 +811,8 @@ function statusCommand() {
   console.log(`DEPLOY_MODE=${envMap.DEPLOY_MODE || ""}`);
   console.log(`ALLOWED_SIP_DOMAINS=${envMap.ALLOWED_SIP_DOMAINS || ""}`);
   console.log(`TURN_MODE=${envMap.TURN_MODE || "none"}`);
+  console.log(`MEDIA_IPV6=${envMap.MEDIA_IPV6 || "0"}`);
+  console.log(`MEDIA_FORCE_IPV4=${envMap.MEDIA_FORCE_IPV4 || "1"}`);
 }
 
 function certStatusCommand() {

package/templates/.env.template

@@ -23,3 +23,5 @@ ACME_LISTEN_PORT=__ACME_LISTEN_PORT__
 WSS_LISTEN_PORT=__WSS_LISTEN_PORT__
 INTERNAL_WSS_PORT=__INTERNAL_WSS_PORT__
 INTERNAL_WS_PORT=__INTERNAL_WS_PORT__
+MEDIA_IPV6=__MEDIA_IPV6__
+MEDIA_FORCE_IPV4=__MEDIA_FORCE_IPV4__

package/templates/docker-compose.yml.template

@@ -10,6 +10,9 @@ services:
     security_opt:
       - no-new-privileges:true
     env_file: .env
+    environment:
+      - MEDIA_IPV6=${MEDIA_IPV6:-0}
+      - MEDIA_FORCE_IPV4=${MEDIA_FORCE_IPV4:-1}
     volumes:
       - ${TLS_CERT}:/etc/ssl/cert.pem:ro
       - ${TLS_KEY}:/etc/ssl/key.pem:ro