Installation

Two small Linux machines (or VMs/containers), a SIP trunk, and about half an hour — most of it Asterisk compiling.

What you need

• Two machines running Debian 12 or 13 — one for the PBX, one for the edge. Proxmox LXC containers work well (1–2 CPU cores, 1–2 GB RAM, 8–16 GB disk each). The edge is only needed for phones outside your network.
  • In Proxmox, LXC containers need nesting=1: pct set <ID> --features nesting=1.
• A SIP trunk. VoIP.ms is the only provider tested. You need the server, username, password and at least one phone number (DID).
• For phones away from home: a domain name (e.g. sip.example.com), ideally on Cloudflare for automatic DNS updates and certificates, plus a router where you can forward ports.
• Optional: an SMTP account (voicemail/text/security-alert emails), a Stripe account (paid plans), Cloudflare Tunnel (to publish My Phone).

Install the PBX server

On the PBX machine, as root:

apt-get update && apt-get install -y unzip git
# copy the project here (git clone, or upload the zip and unzip it), then:
cd /root/own-pbx

# 1. One-time install: builds Asterisk 22 from source (10-20 minutes),
#    creates the pbx service user, folders and Python environments.
./scripts/install.sh

# 2. Deploy: database, Asterisk configs, services.
./scripts/deploy.sh

At the end of the first deploy you create the admin login (at least 12 characters). Then open the panel from a computer on your network:

http://<PBX-IP>:8001

Check that everything runs:

systemctl status asterisk pbx-brain pbx-api pbx-agi --no-pager
asterisk -rx "pjsip show endpoints"
./scripts/security-check.sh

Install the edge server

Skip this if all your phones are on your own network.

1. Create the machine. For example, a Proxmox LXC:

pct create 200 local:vztmpl/<debian-13-standard template>.tar.zst \
  --hostname kamailio-edge --cores 1 --memory 1024 --rootfs local-lvm:8 \
  --net0 name=eth0,bridge=vmbr0,ip=192.168.1.11/24,gw=192.168.1.1 \
  --features nesting=1 --unprivileged 1
pct start 200
pct enter 200      # then: passwd   (set a root password)

2. Copy the kamailio/ folder to the edge box (e.g. /root/kamailio) and install:

cd /root/kamailio
chmod +x *.sh pbx-edge-notify
PUBLIC_HOST=sip.example.com ASTERISK_IP=192.168.1.10 ./install.sh

This installs Kamailio (TLS-only on 5061, with flood limit), rtpengine (SRTP audio relay), fail2ban, an nftables firewall (default deny), and an IP-follow timer.

3. Get a real certificate (domain on Cloudflare):

CF_Token=<Cloudflare API token with Zone → DNS → Edit> \
  ./get-cert-cloudflare.sh sip.example.com you@example.com

The certificate renews itself.

4. Connect security alerts to the PBX. In the admin panel go to API Keys, create a key called edge, then on the edge box:

pbx-edge-notify --setup http://192.168.1.10:8001 <the API key>

5. Verify:

./verify-edge.sh
./security-check.sh

All checks should pass.

Router, DNS and certificate

Router port forwards go to the edge server, never to the PBX:

Protocol	External port	Internal IP	Internal port
TCP	5061	192.168.1.11 (edge)	5061
UDP	20000–20099	192.168.1.11 (edge)	20000–20099

Don't forward 5060, 8001 or 22.

DNS: sip.example.com → your public IP, as a plain A record. On Cloudflare it must be DNS only (grey cloud) — the proxy can't carry phone calls.

Changing public IP? Admin → Network: add the domain and a Cloudflare API token and turn on automatic updates. The PBX updates the DNS record; the edge's timer updates itself.

First-time setup in the panel

Do these in order:

1. Trunks → add your provider (server, username, password, codecs ulaw,alaw,g722). Check with asterisk -rx "pjsip show registrations" — it should say Registered.
2. Routes → Outbound: an outbound route for your trunk with patterns 1NXXNXXXXXX, NXXNXXXXXX and 011..
3. Logins → one per person/phone: panel username and password, extension number (e.g. 8800), SIP username (usually the extension) and a SIP secret — make it long. Users can regenerate their own SIP password in My Phone.
4. Billing → User access: give users outside minutes, texts, voicemail, etc. (or set defaults). Without this, users can only call other extensions, and incoming trunk calls skip them.
5. Ring groups (optional) → e.g. "Front office".
6. Routes → Inbound → your phone number → Send callers to a ring group, IVR menu or extensions. Numbers work with or without the leading 1.
7. Email → SMTP server (voicemails, texts, alerts). Set the panel address for links in emails.
8. Email → Security alerts → your address.
9. E911 → set the E911 code, then the office fallback or per-user addresses. Test each phone by dialing 933.
10. Network → domain and Cloudflare dynamic DNS, if you use the edge.