Your server. Your responsibility.
Understand the documented controls, configure access deliberately and plan how you will recover your phone system.
Start with access
MunaSIP provides optional admin TOTP two-factor authentication, admin/portal/SIP IP allowlists, login-flood bans, SIP scanning visibility, audit logging and outbound dialing controls. Enable and configure the controls your deployment needs.
Change all lab credentials, restrict administrative access and review the provider’s outbound country and spend limits. Toll fraud is a practical risk when an extension is compromised.
Some older security notes describe admin 2FA as mandatory and SIP secrets as hidden random values. Current authentication code makes TOTP optional, and current extensions use a shared portal/SIP password. This guide follows the current implementation.
Keep the network boundary small
Use trusted HTTPS for the panel and WSS. The Compose stack supports automatic Let’s Encrypt HTTP-01 certificates from Settings; TCP port 80 must reach the server for challenges. Protect SIP/RTP with office, VPN and provider access rules.
Do not publish ARI, AMI or PostgreSQL to the internet. TURN/TURNS and RTP requirements depend on the actual remote clients and network edge. Disable SIP ALG when it interferes with office phones.
WebRTC media uses DTLS-SRTP. Do not infer end-to-end encryption or universal encryption for every SIP trunk or desk phone: transport and media security depend on endpoint and provider configuration.
Know where data goes
CDR and recordings are stored on your infrastructure. Role-specific access, recording announcements, retention settings and access auditing support your own privacy process; they do not by themselves establish legal compliance.
API lookups and webhooks send data to the destinations you configure. Edge Neural speech needs an external online service during synthesis. EMA offers offline Turkish speech; offline English is not available.
Tell employees and callers about recording as appropriate to your use. Configure recording policy and retention deliberately. Review the speech engine documentation before choosing which prompt data to send to an online engine.
Persist, back up, restore
For the single image, persist /data and protect /data/.munasip-secrets. Compose uses separate database, recording, upload and Asterisk configuration volumes, plus certificate files. Keep encryption keys with your recovery material.
The project includes JSON backup/restore and recording archive options for a mounted path or SFTP. An application export is not a replacement for a complete database and media recovery plan. Test a restore on a separate host.
Plan recording disk usage around real traffic and retention. If the host or uplink fails, inbound failover to a mobile number is a carrier-side configuration; automatic clustered failover is not a documented MunaSIP feature.
Updates and responsible reporting
Pin an image version when you want controlled upgrades. Read the release notes, back up, recreate the service with its existing volumes and verify calling after the update.
MIT permits forks, modification and redistribution with its copyright notice. Visit the official repository for current development, contribution and security-reporting information. Review the available private reporting options before sharing vulnerability details publicly.
Read the project readme and VPS deployment guide for current upstream instructions.