99 lines
5.0 KiB
Markdown
99 lines
5.0 KiB
Markdown
# Physical-host deployment
|
|
|
|
Production services run directly on Debian 13 (Trixie) physical/virtual host
|
|
processes managed by systemd. Docker is permitted only for disposable local or
|
|
ECS smoke validation; it is not a production runtime dependency.
|
|
|
|
The pinned baseline is [`versions.lock.json`](versions.lock.json): Go 1.27.1,
|
|
`0.1.0-p1.20260919`, Debian 13 amd64 and Asterisk 22.10.1. The Go release
|
|
package contains only our SIP Agent/Dispatcher business binaries and their
|
|
systemd units. SaaS-provided MQ, OSS, AI and other infrastructure are endpoints,
|
|
not packages deployed by this project; local chain validation may use isolated
|
|
fixtures/mocks only. Secrets, certificates, SIP credentials, broker URLs and
|
|
phone-log keys are injected separately.
|
|
|
|
Before every real outbound attempt, obtain a fresh user confirmation in the
|
|
current conversation and display the exact SIP channel, raw target number and
|
|
packet-capture plan. Real SIP outbound calls are permitted only from 09:00
|
|
(inclusive) through 20:00 (exclusive), Asia/Shanghai time; outside that window
|
|
the Agent/Dispatcher must fail closed rather than wait, retry, delay or switch
|
|
trunks. A prior confirmation does not authorize retries or another target; stop
|
|
after a failed attempt until a new confirmation is received.
|
|
|
|
## Build an uploadable package
|
|
|
|
From the project root:
|
|
|
|
```sh
|
|
deploys/build-package.sh
|
|
deploys/packages/sip-go-agent-0.1.0-p1.20260919-linux-amd64.tar.gz
|
|
```
|
|
|
|
The package includes its SHA-256 manifest, a non-root systemd deployment
|
|
layout, and the fail-closed non-production capture-first entrypoint. The
|
|
installer installs that entrypoint as `/usr/local/sbin/agent-call-nonprod-evidence`
|
|
and adds a dedicated validated sudoers rule for `rogee`; it does not install
|
|
`tcpdump` or silently weaken production gates. A dirty/unapproved source
|
|
manifest is intentionally rejected by the installer unless
|
|
`--allow-nonproduction` is supplied for smoke work.
|
|
|
|
## Install on Debian 13
|
|
|
|
Upload and extract the archive on the target host, then run as root:
|
|
|
|
```sh
|
|
tar -xzf sip-go-agent-0.1.0-p1.20260919-linux-amd64.tar.gz
|
|
./install.sh
|
|
```
|
|
|
|
The installer verifies Debian 13 amd64, package checksums and the release
|
|
manifest; creates `rogee`, `/opt/sip-go-agent`, `/etc/sip-go-agent` and
|
|
`/var/lib/sip-go-agent`, installs both systemd units, and does not overwrite
|
|
existing environment or PKI files. Configure the injected values and approved
|
|
static Cell artifact, then start explicitly:
|
|
|
|
```sh
|
|
systemctl enable sip-go-agent-agent.service sip-go-agent-dispatcher.service
|
|
systemctl start sip-go-agent-dispatcher.service sip-go-agent-agent.service
|
|
```
|
|
|
|
Use `./install.sh --start` only after the environment, mTLS identity, broker
|
|
ACL and static Cell artifact have been reviewed. Production mode never silently
|
|
falls back to Mock.
|
|
|
|
## Non-production capture-first gate
|
|
|
|
Development, `mock`, `mixed` and non-production `real` validation must use
|
|
[`cell/nonprod-call-evidence.sh`](cell/nonprod-call-evidence.sh) as the single
|
|
capture-first entrypoint. It refuses `production`, validates the approved trunk
|
|
and whitelist target, verifies `tcpdump` raw-capture capability, records the
|
|
pre-call Debian/systemd/ECS-facing facts plus Asterisk/PJSIP/channel/media
|
|
state, enables the PJSIP logger, captures SIP UDP 5060 and RTP UDP
|
|
10000-10800 before the call command starts, and always stops capture/logger and
|
|
writes redacted status plus SHA-256 facts on success or failure. Real calls reserve a daily attempt in `/var/lib/sip-go-agent/state/real-call-attempts.tsv` per `trunk + original target`; the fourth attempt is rejected fail-closed, while `--preflight-only` does not consume quota. Existing real evidence is counted when seeding the ledger.
|
|
|
|
Run it only after a fresh current-conversation confirmation naming the exact
|
|
trunk, raw target and capture plan; the command after `--` must execute as the
|
|
non-root `rogee` user. Do not invoke the Agent directly for a non-production
|
|
real/mixed call, do not retry inside the wrapper, and do not treat a missing
|
|
PCAP or state snapshot as a pass. The private call output and raw capture stay
|
|
under the mode-0700 evidence directory and must not be copied into repository
|
|
long-term evidence without redaction.
|
|
|
|
## Cell boundary
|
|
|
|
Asterisk remains the SIP owner and is installed as the separately approved
|
|
physical Asterisk 22.10.1 Cell service. Asterisk and the SIP Agent are the only
|
|
business-code services in this repository. The Go package does not rewrite
|
|
`pjsip.conf`, embed SIP credentials, or run Asterisk in Docker. Management owns
|
|
the immutable static Cell artifact and its systemd/maintenance release; the Go
|
|
Agent consumes the approved artifact and reports the applied revision.
|
|
|
|
RabbitMQ, OSS, AI providers and SaaS APIs are external infrastructure. They are
|
|
not installed by `deploys/`; their production ACLs/endpoints are supplied by
|
|
SaaS, while local validation uses explicitly isolated test infrastructure. For
|
|
non-ECS/offline Alibaba OSS validation, use
|
|
`deploys/env/dispatcher.offline-oss.env.example` (public
|
|
`oss-cn-beijing.aliyuncs.com`); keep `dispatcher.env.example`'s internal
|
|
endpoint for the separately managed production ECS profile.
|