From 886e11e3d5a0f8026fa41df4dad1a6e9d9baa279 Mon Sep 17 00:00:00 2001 From: bjorne Date: Sat, 26 Sep 2026 23:10:03 +0200 Subject: [PATCH] install: add sanitized svxreflector.conf.example, reference it from INSTALL.md Co-Authored-By: Claude Fable 5.1 --- INSTALL.md | 5 ++ install/svxreflector.conf.example | 131 ++++++++++++++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 install/svxreflector.conf.example diff --git a/INSTALL.md b/INSTALL.md index 65bd4ff..6c7a44b 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -242,6 +242,11 @@ The certificate pages additionally read `/etc/svxlink/svxreflector.conf` to find `CERT_PKI_DIR` and watch `pending_csrs/` in it, so `www-data` needs read access to the conf and the PKI directories (never to the private keys). +`install/svxreflector.conf.example` shows a complete reflector config as used +with this portal: PKI/CA paths, `COMMAND_PTY`, `HTTP_SRV_PORT`, the +`[USERS]`/`[PASSWORDS]` layout the helper edits, MQTT, and trunk/satellite +sections. All secrets and hostnames in it are placeholders. + ## 11. Checklist when something does not work - **500 on any `auth/*.php`**: `sudo tail -f /var/log/nginx/svxportal-error.log` and `journalctl -u php8.4-fpm`. Usually Redis auth or missing `php-redis`. diff --git a/install/svxreflector.conf.example b/install/svxreflector.conf.example new file mode 100644 index 0000000..76e8f13 --- /dev/null +++ b/install/svxreflector.conf.example @@ -0,0 +1,131 @@ +# Example svxreflector.conf as used together with SvxPortal (layout of a live reflector). +# All secrets are CHANGEME, hostnames are my.domain.com / peer.domain.com. Adjust to your site. +# The web admin pages read this file to find CERT_PKI_DIR and to manage [USERS]/[PASSWORDS]. +# +################################################################### +# +# Configuration file for the SvxReflector SvxLink conference node +# +################################################################### + +[GLOBAL] +#CFG_DIR=svxreflector.d +TIMESTAMP_FORMAT="%c" +LISTEN_PORT=5300 +LOCAL_PREFIX=240 +#SQL_TIMEOUT=600 +#SQL_TIMEOUT_BLOCKTIME=60 +#CODECS=OPUS +TG_FOR_V1_CLIENTS=999 +#RANDOM_QSY_RANGE=12399:100 +HTTP_SRV_PORT=8099 +COMMAND_PTY=/dev/shm/reflector_ctrl +#ACCEPT_CALLSIGN="[A-Z0-9][A-Z]{0,2}\\d[A-Z0-9]{0,3}[A-Z](?:-[A-Z0-9]{1,3})?" +#REJECT_CALLSIGN="" +#ACCEPT_CERT_EMAIL="\\w+(?:[-._+]\\w+)*@\\w+(?:\\.\\w+)*" +CERT_PKI_DIR=/etc/svxlink/pki +CERT_CA_BUNDLE=/etc/svxlink/pki/ca-bundle.crt +CERT_CA_KEYS_DIR=/etc/svxlink/pki/private/ +CERT_CA_PENDING_CSRS_DIR=/etc/svxlink/pki/pending_csrs/ +CERT_CA_CSRS_DIR=/etc/svxlink/pki/csrs/ +CERT_CA_CERTS_DIR=/etc/svxlink/pki/certs/ +#CERT_CA_HOOK=/usr/share/svxlink/ca-hook.py + +[ROOT_CA] +KEYFILE=/etc/svxlink/pki/private/svxreflector_root_ca.key +CRTFILE=/etc/svxlink/pki/certs/svxreflector_root_ca.crt +COMMON_NAME=SvxReflector Root MYCALL +ORG_UNIT=SvxLink +ORG=MYCALL +LOCALITY=Mytown +STATE=Mystate +COUNTRY=SE +EMAIL_ADDRESS=admin@my.domain.com + +[ISSUING_CA] +KEYFILE=/etc/svxlink/pki/private/svxreflector_issuing_ca.key +CSRFILE=/etc/svxlink/pki/csrs/svxreflector_issuing_ca.csr +CRTFILE=/etc/svxlink/pki/certs/svxreflector_issuing_ca.crt +COMMON_NAME=SvxReflector Issuing CA MYCALL +ORG_UNIT=SvxLink +ORG=MYCALL +LOCALITY=Mytown +STATE=Mystate +COUNTRY=SE +EMAIL_ADDRESS=admin@my.domain.com + +[SERVER_CERT] +KEYFILE=/etc/svxlink/pki/private/SvxReflector_Server_Cert_MYCALL.key +CSRFILE=/etc/svxlink/pki/csrs/SvxReflector_Server_Cert_MYCALL.csr +CRTFILE=/etc/svxlink/pki/certs/SvxReflector_Server_Cert_MYCALL.crt +COMMON_NAME=my.domain.com +ORG_UNIT=SvxLink +ORG=MYCALL +LOCALITY=Mytown +STATE=Mystate +COUNTRY=SE +SUBJECT_ALT_NAME=DNS:my.domain.com,IP:192.0.2.1 +EMAIL_ADDRESS=admin@my.domain.com + +# [USERS] maps a node callsign to a password-group name; [PASSWORDS] holds the +# group's secret. SvxPortal's "svxreflector-users" helper adds entries of the +# form CALL=CALL here (one group per node). Several nodes may share one group. +[USERS] +MYCALL-AC=MYCALL-AC +MYCALL-DMR=MYCALL-DMR +#SM0ABC-1=MyNodes +#SM0ABC-2=MyNodes +#SM3XYZ=SM3XYZ +MYCALL-T=MYCALL + +[PASSWORDS] +MYCALL-AC="CHANGEME" +MYCALL-DMR="CHANGEME" +MYCALL="CHANGEME" +#MyNodes="Change this key now!" +#SM3XYZ="A strong password" + +#[TG#9999] +#AUTO_QSY_AFTER=300 +#ALLOW=S[A-M]\\\\d.*|LA8PV +#SHOW_ACTIVITY=0 + +# Reflector-to-reflector trunking (optional). +[ReflectorTrunk] +GatewayId=SE-MYCALL +Port=5500 +Peers=PEER1 + +[TrunkPeer#PEER1] +Host=peer.domain.com +Port=5500 +TGRule=^.*$ +Retransmit=0 +ActiveFilter=0 +Key=CHANGEME +TrunkType=A +TrunkTypeSend=A +Qualify=1 + +# Satellite trunks (e.g. a DMR bridge or an Asterisk/AllStar PBX). One SECRET_ per satellite. +[SATELLITE] +LISTEN_PORT=5403 +SECRET_dmr=CHANGEME +SECRET_pbx=CHANGEME + +################################################################### +# MQTT status publishing (used by the node control pages in SvxPortal). +[MQTT] +HOST=127.0.0.1 +PORT=1883 +USERNAME=svxreflector +PASSWORD=CHANGEME +TOPIC_PREFIX=svxreflector/mycall +STATUS_INTERVAL=30000 + +#[TRUNK_OTHER] +#HOST=other.domain.com +#PORT=5403 +#SECRET=CHANGEME +#REMOTE_PREFIX=310 +#ALLOW_TGS=24016