.env.example

# voip-stack Environment Configuration Template
# Copy this file to .env and fill in actual values
# WARNING: Never commit .env file - it contains sensitive credentials

# =============================================================================
# Vault Configuration
# =============================================================================
VAULT_ADDR=http://192.168.64.1:8200
VAULT_NAMESPACE=
VAULT_SKIP_VERIFY=false

# AppRole credentials (obtained from Vault admin)
# See: docs/guides/VAULT_SETUP.md for how to generate these
VAULT_ROLE_ID=your-role-id-here
VAULT_SECRET_ID=your-secret-id-here

# =============================================================================
# Database Configuration (PostgreSQL in devstack-core)
# =============================================================================
DB_HOST=192.168.64.1
DB_PORT=5432

# Database names (created by Ansible during provisioning)
OPENSIPS_DB_NAME=opensips
KAMAILIO_DB_NAME=kamailio
ASTERISK_DB_NAME=asterisk
FREESWITCH_DB_NAME=freeswitch
HOMER_DB_NAME=homer

# Database users (created by Ansible, passwords stored in Vault)
OPENSIPS_DB_USER=opensips
KAMAILIO_DB_USER=kamailio
ASTERISK_DB_USER=asterisk
FREESWITCH_DB_USER=freeswitch
HOMER_DB_USER=homer

# Database passwords (DO NOT HARDCODE - retrieve from Vault)
# These are placeholders only - Ansible will fetch from Vault
OPENSIPS_DB_PASSWORD=${vault:secret/opensips:db_password}
KAMAILIO_DB_PASSWORD=${vault:secret/kamailio:db_password}
ASTERISK_DB_PASSWORD=${vault:secret/asterisk:db_password}
FREESWITCH_DB_PASSWORD=${vault:secret/freeswitch:db_password}
HOMER_DB_PASSWORD=${vault:secret/homer:db_password}

# =============================================================================
# Redis Configuration (in devstack-core)
# =============================================================================
REDIS_HOST=192.168.64.1
REDIS_PORT=6379
REDIS_PASSWORD=${vault:secret/redis:password}

# =============================================================================
# RabbitMQ Configuration (in devstack-core)
# =============================================================================
RABBITMQ_HOST=192.168.64.1
RABBITMQ_PORT=5672
RABBITMQ_MANAGEMENT_PORT=15672
RABBITMQ_USER=admin
RABBITMQ_PASSWORD=${vault:secret/rabbitmq:password}

# CDR queue configuration
CDR_QUEUE_NAME=voip.cdrs
CDR_EXCHANGE_NAME=voip.exchange

# =============================================================================
# Network Configuration
# =============================================================================
# Internal network (VM shared network via socket_vmnet)
INTERNAL_NETWORK=192.168.64.0/24
INTERNAL_GATEWAY=192.168.64.1

# External network (bridged adapter - your local network)
# Adjust based on your local network configuration
EXTERNAL_NETWORK=192.168.1.0/24
EXTERNAL_GATEWAY=192.168.1.1

# VM IP Addresses
SIP_VM_IP=192.168.64.10
PBX_VM_IP=192.168.64.30
MEDIA_VM_IP=192.168.64.20

# =============================================================================
# SIP Configuration
# =============================================================================
# SIP domain (change to your domain or use IP)
SIP_DOMAIN=sip.local

# OpenSIPS ports
OPENSIPS_SIP_PORT=5060
OPENSIPS_SIP_TLS_PORT=5061
OPENSIPS_WS_PORT=8080
OPENSIPS_WSS_PORT=8443

# Kamailio ports (different from OpenSIPS for coexistence)
KAMAILIO_SIP_PORT=5070
KAMAILIO_SIP_TLS_PORT=5071
KAMAILIO_WS_PORT=8090
KAMAILIO_WSS_PORT=8444

# =============================================================================
# RTPEngine Configuration
# =============================================================================
RTPENGINE_LISTEN_NG=udp:192.168.64.20:2223
RTPENGINE_PORT_MIN=10000
RTPENGINE_PORT_MAX=20000

# RTPEngine interfaces
RTPENGINE_INTERFACE_INTERNAL=192.168.64.20
RTPENGINE_INTERFACE_EXTERNAL=<your-external-ip>

# =============================================================================
# Asterisk Configuration
# =============================================================================
ASTERISK_AMI_PORT=5038
ASTERISK_ARI_PORT=8088
ASTERISK_AMI_USER=admin
ASTERISK_AMI_PASSWORD=${vault:secret/asterisk:ami_password}
ASTERISK_ARI_USER=ari
ASTERISK_ARI_PASSWORD=${vault:secret/asterisk:ari_password}

# =============================================================================
# FreeSWITCH Configuration (Phase 2.5)
# =============================================================================
FREESWITCH_ESL_PORT=8021
FREESWITCH_ESL_PASSWORD=${vault:secret/freeswitch:esl_password}

# =============================================================================
# Homer Configuration
# =============================================================================
HOMER_HOST=192.168.64.1
HOMER_HEP_PORT=9060
HOMER_WEB_PORT=9080
HOMER_USER=admin
HOMER_PASSWORD=${vault:secret/homer:password}

# =============================================================================
# Monitoring Configuration (devstack-core)
# =============================================================================
# Prometheus
PROMETHEUS_HOST=192.168.64.1
PROMETHEUS_PORT=9090

# Grafana
GRAFANA_HOST=192.168.64.1
GRAFANA_PORT=3001
GRAFANA_ADMIN_USER=admin
GRAFANA_ADMIN_PASSWORD=${vault:secret/grafana:admin_password}

# Node exporter port (on each VM)
NODE_EXPORTER_PORT=9100

# =============================================================================
# Logging Configuration (devstack-core)
# =============================================================================
# Loki
LOKI_HOST=192.168.64.1
LOKI_PORT=3100

# Log levels
OPENSIPS_LOG_LEVEL=3
KAMAILIO_LOG_LEVEL=3
ASTERISK_LOG_LEVEL=notice,warning,error

# =============================================================================
# TLS/SRTP Configuration
# =============================================================================
# PKI backend in Vault
VAULT_PKI_PATH=pki_voip
VAULT_PKI_ROLE=voip-server

# Certificate configuration
TLS_CERT_TTL=8760h  # 1 year
TLS_CERT_COMMON_NAME=${SIP_DOMAIN}

# =============================================================================
# Call Recording Configuration
# =============================================================================
# Recording storage path (NFS mount point on PBX VM)
RECORDING_PATH=/mnt/recordings

# NFS server (media VM exports recordings directory)
NFS_SERVER=${MEDIA_VM_IP}
NFS_EXPORT_PATH=/srv/recordings

# MinIO configuration (Phase 2)
# MINIO_HOST=192.168.64.1
# MINIO_PORT=9000
# MINIO_ACCESS_KEY=${vault:secret/minio:access_key}
# MINIO_SECRET_KEY=${vault:secret/minio:secret_key}
# MINIO_BUCKET=recordings

# =============================================================================
# Testing Configuration
# =============================================================================
# SIPp test extensions
TEST_EXTENSION_1=1001
TEST_EXTENSION_2=1002
TEST_EXTENSION_PASSWORD=${vault:secret/testing:extension_password}

# Load testing parameters
SIPP_CALL_RATE=10
SIPP_MAX_SIMULTANEOUS_CALLS=100
SIPP_DURATION=300  # seconds

# =============================================================================
# Development Configuration
# =============================================================================
# Enable debug mode (more verbose logging)
DEBUG_MODE=false

# Ansible verbosity (-v, -vv, -vvv)
ANSIBLE_VERBOSITY=

# =============================================================================
# Secret Rotation Configuration
# =============================================================================
# Rotation schedules (used by Ansible rotation playbook)
DB_PASSWORD_ROTATION_DAYS=90
AMI_PASSWORD_ROTATION_DAYS=180
TLS_CERT_ROTATION_DAYS=730  # 2 years

# =============================================================================
# Backup Configuration
# =============================================================================
# Backup retention
BACKUP_RETENTION_DAYS=30
CONFIG_BACKUP_RETENTION_DAYS=90

# Backup destination
BACKUP_PATH=/Users/gator/voip-stack-backups

# =============================================================================
# Phase-Specific Features
# =============================================================================
# Phase 1: Basic calling
PHASE_1_ENABLED=true

# Phase 2: Advanced features (HA, load balancing)
PHASE_2_ENABLED=false
KEEPALIVED_ENABLED=false

# Phase 3: Monitoring and analytics
PHASE_3_ENABLED=false
RTSP_ENABLED=false

# Phase 4: Production hardening
PHASE_4_ENABLED=false
WAF_ENABLED=false