Access WSS interface directly from within HA

[felipecrs]

So that we don't need to forward an additional port in the router for making it work outside of the local network. This should also greatly simplify scenarios with Cloudflare.

This basically means that the sipjs-card would not communicate with Asterisk through the port 8089, but instead with the HA's https port. This also means that certificates do not need to be configured or added to Asterisk (most likely), as the Ingress should be configured to use port 8088 (non-TLS).

Some references:

https://warlord0blog.wordpress.com/2020/04/16/asterisk-webrtc/
https://developers.home-assistant.io/docs/add-ons/presentation#ingress
hassio-addons/addon-traccar@f3b00f4
https://github.com/hassio-addons/addon-ssh/blob/main/ssh/rootfs/etc/services.d/ttyd/run#L22-L23

Related:

#31 (@ErnestStaug as you are using Cloudflare)

[felipecrs]

Initial support for ingress has been released in version 1.2.0. But some work will be required from the Integration as mentioned in TECH7Fox/asterisk-hass-addons#57 (comment).

[felipecrs]

Actually, no work is required from the addon side, and Ingress was actually not needed. All the work needed is from the integration, which needs to proxy the WSS interface (8089) of the addon to be accessed by the card directly from HA.

@TECH7Fox can you transfer this issue to the integration repo instead?

[TECH7Fox]

@felipecrs did you find any documentation on how to do this?

[felipecrs]

@TECH7Fox I didn't find documentation, but there is an example:

https://github.com/blakeblackshear/frigate-hass-integration/blob/cbdfb4fe6493f629c7464b67429713b53a99b0ac/custom_components/frigate/views.py#L280

[miguelangel-nubla]

Hi, did anyone manage to enable a workaround to make it work?

[miguelangel-nubla]

I managed to get wss proxy work using cloudflared addon

additional_hosts:
- hostname: sip.mydomain.com
  service: https://<hass-address>:8089

The card connects and registers correctly.
Calls start, WebRTC candidates showing up from ICE on both sides but no audio or video.
Shouldn't UDP hole punching with the STUN do the heavy lifting?

Is the addon configured to act as a proxy between the WebRTC clients, or only direct connection allowed?

[felipecrs]

I managed to get wss proxy work using cloudflared addon

That's exactly what I do too, for more than a year so far. :D

For those not using cloudflared, it's easily possible to make it work similarly using the NGINX Proxy Manager add-on.

[miguelangel-nubla]

Does it work for you over WAN with a cellular connection for example?
Do you manually forward any ports to the asterisk server for the media?

[felipecrs]

I don't forward any ports. And yes, calling through Asterisk still works when I'm not home. (we are still talking about cloudflared, right?)

[miguelangel-nubla]

we are still talking about cloudflared, right?

I am not sure I follow.

I am talking opened ports for WebRTC for the audio/video to the Asterisk server after the cloudflared connection "proxy" has registered and served the candidates.

As far as I understand the wss connection via cloudflare is only for registering and candidate exchange, audio/video travels over WebRTC which is what I am having issue with.

[pergolafabio]

i believe for audio and video you need to open the RTP ports too (public access), then webrtc is not enough

[felipecrs]

I did not know I had to open extra ports. I thought everything was happening through the WSS port.

So I guess I'm lucky, because I don't have any ports open in my router (except go2rtc's webrtc 8555 for Frigate). Everything else goes through cloudflared.

[pergolafabio]

but you only use the card on local lan?

[felipecrs]

No, it works outside home too. Or when using cellular data.

[pergolafabio]

Ah good to know, i dont use the wss, i thought it was needed too like for softphones

[felipecrs]

Oh man. My bad. I had always believed it was working, but I guess I was only counting on the fact that the card shows as connected, and that the call also connects.

I am testing now, and although the card and Asterisk believes the call is happening, there is no audio.

[miguelangel-nubla]

Sorry to hear that, guess there is some piece missing.