Table of contents

1. Introduction

OpenGate Containers is the module responsible for managing VoIP connections in an OpenGate environment, as well as the configuration of extensions, trunks, etc. This guide explains how to perform a quick installation. Please refer to the Presence installation guide for more information about the different modules and architectures.

2. Installation

2.1. Prerequisites

To complete a successful installation and ensure a proper operation as described in this guide, the following must be met:

• Have a “host” machine with a recent version of Docker Engine and Docker Compose installed.

• The “host” machine must have the network properly configured.

  • In case of a Master node configured with a SIP Registrar, two IPs are required.

• The “host” machine should not execute other services which may clash with the ports used in your services.

  • Exception: The Master node should have an MTA installed, such as “postfix” to send emails from mailboxes.

  • When a “SMTP relay" server is being used, it must be configured as detailed in this /wiki/spaces/PRSPS/pages/177045505.

• The “host” machine must not limit the connection to your services through a firewall.

For a quick guide see: Instalación de Rocky Linux 9 y Docker

2.2. General installation process

There are different types of environments which require different services to be started (Master, Node, WebRTC, and combinations of these), and therefore a help script is provided that automates the following steps: Creating the docker-compose.yml and .env files, creating the secrets, connecting to the registry and pulling the images. This script can be launched directly using the following command:

bash -c "$(curl -s ftps://OpenGate_Update:Op3nG3t3@ftp.emea.enghouseinteractive.com/install.sh )" MODE [-norecording]

Replace MODE with one of the following:

• master: Installs postgresql, ssh-server, webservices, kamailio and asterisk.

• masterwebrtc: Same as master, but adds freeswitch to use as WebRTC Gateway.

• masteronlywebrtc: Does not include kamailio, which allows you to use it in environments with a single IP with WebRTC phones. However, no Agent/SIP user extensions can be registered.

• node: Installs asterisk and ssh-server.

• nodewebrtc: Same as node, but adds freeswitch to use as WebRTC Gateway.

• webrtc: Installs freeswitch and ssh-server.

• turn: Installs coturn server.

The optional parameter -norecording configures an environment without integration with Presence Recording, eliminating the need to set up a shared folder for recordings.

2.3. Additional technical information

See the document: Additional technical OpenGate Containers information

3. OpenGate Master installation

Run the install command, specifying master option.

bash -c "$(curl -s ftps://OpenGate_Update:Op3nG3t3@ftp.emea.enghouseinteractive.com/install.sh )" master

After executing the command, it will automatically connect to the registry and pull the images.

When done, the following screen will prompt you to configure the environments in the.env file, and will also show the instructions to create secrets. Something like this:

Please edit .env file with the appropriate values. Current .env contents:
TZ=Europe/Madrid
SSH_USERNAME=opengate
DATA_BINDADDR=10.X.X.X
VOICE_BINDADDR=10.X.X.X
SIP_REGISTRAR_IP=10.X.X.X
# DB_NAME MUST be opengate (hardcoded at OpenGate Proxy)
DB_NAME=opengate
DB_USER=opengaterw
RECORDING_SHARE=//X.X.X.X/recording
RECORDING_SHARE_USER=Administrator
RECORDING_SHARE_PASSWORD=PASSWORD
RECORDING_MOUNT_POINT=/recordings
# set to true to restore from a backup
RESTORE_MODE=false

Generate the secrets using the following commands and instructions:
 - DB password: echo "MYPASSWORD" > secrets/db_password.txt
 - SSH Key: ssh-keygen -f secrets/ssh_key
 - TLS certificates (generate self-signed): openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650
    or copy your own to the apropriate files:
      cat key.pem cert.pem > secrets/asterisk.pem

When done, start the environment by executing:  docker compose up -d

Edit the .env file using your preferred editor, and configure at least the following lines:

• DATA_BINDADDR: define the IP address of the data network.

• VOICE_BINDADDR: define the IP address of the voice network. If you do not setup voice/data separation, use the same as before.

• SIP_REGISTRAR_IP: define the IP address of the SIP Registrar. It cannot be one of the previous ones. Make sure to configure two IP addresses in the Host operating system.

• RECORDING_SHARE, RECORDING_SHARE_USER y RECORDING_SHARE_PASSWORD: define the parameters for the shared recordings folder.

And execute the steps to create the secrets:

• Replace MYPASSWORD with the password you want:

  echo "MYPASSWORD" > secrets/db_password.txt

  This password and the value of the DB_USER variable (opengaterw by default) must match what is configured in the OpenGate Proxy Server configuration.

• Generate the SSH keys:

  ssh-keygen -f secrets/ssh_key

• Generate self-signed certificates if you don't have your own:

  openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650

  • And concatenate the two resulting files into a single one at the corresponding path:

    cat key.pem cert.pem > secrets/asterisk.pem

Finally, start with the command below:

docker compose up -d

4. OpenGate Node installation

Run the install command, specifying node option.

bash -c "$(curl -s ftps://OpenGate_Update:Op3nG3t3@ftp.emea.enghouseinteractive.com/install.sh )" node

After executing the command, it will automatically connect to the registry and pull the images.

When done, a screen will prompt you to configure the environments in the.env file, and will also show the instructions to create secrets.

Edit the .env file using your preferred editor, and configure at least the following lines:

• DATA_BINDADDR: define the IP address of the data network.

• VOICE_BINDADDR: define the IP address of the voice network. If you do not setup voice/data separation, use the same as before.

• RECORDING_SHARE, RECORDING_SHARE_USER y RECORDING_SHARE_PASSWORD: define the parameters for the shared recordings folder.

And execute the steps to create the secrets:

• Copy the SSH public key you generated on the Master. Either manually with a graphical SFTP/SCP client or by executing on the node:

  scp opengate@MASTERIP:secrets/ssh_key.pub secrets/ssh_key.pub

  Where opengate is the user you configured on the operating system of the Master, and MASTERIP is its IP address. You will need to correctly enter the password for the opengate user of the Master machine when prompted.

• Generate self-signed certificates if you don't have your own:

  openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650

  • And concatenate the two resulting files into a single one at the corresponding path:

    cat key.pem cert.pem > secrets/asterisk.pem

4. OpenGate WebRTC Gateway installation

Run the install command, specifying webrtc option.

bash -c "$(curl -s ftps://OpenGate_Update:Op3nG3t3@ftp.emea.enghouseinteractive.com/install.sh )" webrtc

After executing the command, it will automatically connect to the registry and pull the images.

When done, a screen will prompt you to configure the environments in the.env file, and will also show the instructions to create secrets.

Edit the .env file using your preferred editor, and configure at least the following lines:

• WSS_BINDADDR: define the IP address of the DMZ network (if you don’t have DMZ/Private network separation, enter the Private network IP).

• WSS_EXTERNAL_IP: define the public external IP address of the system.

And execute the steps to create the secrets:

• Copy the SSH public key you generated on the Master. Either manually with a graphical SFTP/SCP client or by executing on the node:

  scp opengate@MASTERIP:secrets/ssh_key.pub secrets/ssh_key.pub

  Where opengate is the user you configured on the operating system of the Master, and MASTERIP is its IP address. You will need to correctly enter the password for the opengate user of the Master machine when prompted.

• Generate self-signed certificates if you don't have your own:

  openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650

  • And concatenate the two resulting files into a single one at the corresponding path:

    cat key.pem cert.pem > secrets/freeswitch.pem

4. Update

1. Edit the docker-compose.yml file and check tags from all images.

   1. Tags pointing to :latest will automatically download the latest version.

   2. Alternatively, indicate a specific release (example: release-01). Check https://enghouseglobal.atlassian.net/wiki/spaces/PSRN.

2. Run the following commands to update and start the environment again:

   docker compose pull docker compose up -d

3. The above commands will cause that containers with changes (and also depending containers) to restart.

Once the environment is up and running, old images can be cleared using docker image prune.

5. Restoring from backup

1. Edit the .env file in the Master node to set the variable RESTORE_MODE=true.

2. Stop Presence OpenGate Proxy Server and any other applications that may be using the database. Apply the changes using the following command: docker compose up -d.

3. Wait for the environment to get started again. Then, access the Master node IP from a web browser.
   

   

   1. Load the backup copy and follow the steps.

   2. If the restore process is performed using a backup copy generated with another database user (e.g., for 12.3 or 13.0 updates), you may expect many changes related to permissions in the above first step.

      

4. When all the steps are completed, edit the .env file in the Master node. Set the variable RESTORE_MODE=false and apply using the following command: docker compose up -d.

6. IMPORTANT

Certain technical details are important to keep in mind:

• You MUST NOT change the database username once the environment has been started for the first time. The PostgreSQL official container creates the database for the user specified in the first boot. If you subsequently change that user, the database will not start successfully.

• Docker compose does not update the configuration of CIFS volumes (such as the recordings volume of Presence Recording). If you wish to modify this configuration once the volume has been created, you must first stop the environment, then delete the volume using the following command: docker compose down; docker volume rm VOLUME_NAME.

• If you make a change that results in the creation of a new container (e.g. a change to the image, one environment variable or volume), then the previous trace logs will be lost.

  • Realice una copia si lo considera necesario. Ejemplo, copia de las últimas 48 horas: docker compose logs -t --since 48h | gzip -c > 48hlogs.gz.

• In case of a core dump in a service that is running in a container, the kernel configuration of the host machine is inherited, which means that this configuration will be saved in the host as specified. For Rocky Linux 9, these are stored in /var/lib/systemd/coredumps.

6.1. Changing the mount directory of recordings

Because of the change made to set absolute paths, it is important to update the configuration of Presence Recording Server so that the new absolute paths will be used as shown below: