tls-server
daemon ovpn1
proto udp
port 1195
dev tap
comp-lzo
ca /usr/share/easy-rsa/keys/ca.crt
cert /usr/share/easy-rsa/keys/ovpn1.crt
key /usr/share/easy-rsa/keys/ovpn1.key
dh /usr/share/easy-rsa/keys/dh2048.pem
status /var/log/openvpn/ovpn1.log
log /var/log/openvpn/ovpn1.log
management 127.0.0.1 6001
script-security 2
up /etc/openvpn/braddif.sh
down /etc/openvpn/brdelif.sh

# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.ee1b119301a1       no              tap0

 ping -b 192.168.0.255 -I tap0
ping: Warning: source address might be selected on device other than tap0.
PING 192.168.0.255 (192.168.0.255) from 192.168.206.200 tap0: 56(84) bytes of data.
From 192.168.206.200 icmp_seq=1 Destination Host Unreachable
From 192.168.206.200 icmp_seq=2 Destination Host Unreachable
From 192.168.206.200 icmp_seq=3 Destination Host Unreachable
From 192.168.206.200 icmp_seq=4 Destination Host Unreachable
From 192.168.206.200 icmp_seq=5 Destination Host Unreachable

tcpdump -i tap0

#!/bin/sh

ifconfig $dev up
ip link set up dev $dev
brctl addif br0 $dev
ip link set up dev br0

May 28 16:56:05 pbx kernel: [537315.276478] device tap0 entered promiscuous mode
May 28 16:56:05 pbx kernel: [537315.276786] br0: port 1(tap0) entered forwarding state
May 28 16:56:05 pbx kernel: [537315.276836] br0: port 1(tap0) entered forwarding state
May 28 16:56:06 pbx kernel: [537316.274317] br0: port 1(tap0) entered forwarding state
May 28 16:56:09 pbx ntpd[10881]: Listen normally on 36 tap0 fe80::443e:3bff:fe23:4bd8 UDP 123
May 28 16:56:09 pbx ntpd[10881]: peers refreshed
May 28 16:58:05 pbx kernel: [537434.766200] br0: port 1(tap0) entered disabled state
May 28 16:58:05 pbx kernel: [537434.766457] device tap0 left promiscuous mode
May 28 16:58:05 pbx kernel: [537434.766508] br0: port 1(tap0) entered disabled state
May 28 16:58:07 pbx ntpd[10881]: Deleting interface #36 tap0, fe80::443e:3bff:fe23:4bd8#123, interface stats: received=0, sent=0, dropped=0, active_time=118 secs

  $phone={
    '100' => { 'pass'    => "qwrsdf86",
               'mac'     => "00:15:65:e0:68:47",
               'profile' => "YealinkT21PE2",
             },
    '101' => { 'pass'    => "qwrsdf86",
               'mac'     => "00:15:65:e0:68:48",
               'profile' => "YealinkT21PE2",
             },
    '102' => { 'pass'    => "qwrsdf86",
               'mac'     => "00:15:65:e0:68:49",
               'profile' => "YealinkT21PE2",
             },
  }

Требуется поллучить такой вид

$vpn_name_key=["001565e06847", "001565e06848", "001565e06849"]

$vpn_name_key=[]
$phone.each |$index, $value| {
    $linemac = regsubst($value['mac'], ':', '', 'G')
    $vpn_name_key = $vpn_name_key + [$linemac]
  }

  $phone={
    '100' => { 'pass'    => "123",
               'mac'     => "00:15:65:e0:68:47",
               'profile' => "YealinkT21PE2",
             },
    '101' => { 'pass'    => "123",
               'mac'     => "00:15:65:e0:68:47",
               'profile' => "YealinkT21PE2",
             },
    '102' => { 'pass'    => "123",
               'mac'     => "00:15:65:e0:68:47",
               'profile' => "YealinkT21PE2",
             },
  }

<% @users.each do |val| -%>
[<%= val[0] %>](phones)
username=<%= val[0] %>
secret=<%= val[1]["pass"] %>
callerid=<%= val[0] %> <<%= val[0] %>>
autoprov=yes
profile=<%= val[1]["profile"] %>
macaddress=<%= val[1]["mac"] %>

<% end -%>

     3 node 'server.local' {

     30   $psql = {
     31     'db'     => 'dbname',
     32     'user'   => 'username',
     33     'passwd' => 'userpasswd',
     34   }

     38   class {'postgresql':}

     58 }

      1 class postgresql  {
      2 
      3   class { 'postgresql::install': }
      4   class { 'postgresql::service': }
      5   class { 'postgresql::config': }
      6 
      7 }

      1 class postgresql::config (
      2   $psql_db = 'dbname',
      3   $psql_user = 'username',
      4   $psql_passwd = 'userpasswd'
      5 ) {

     49 }

root@tur:/etc/letsencrypt# certbot renew --quiet --no-self-upgrade
Attempting to renew cert from /etc/letsencrypt/renewal/tur.ru.conf produced an unexpected error: <Response [504]>. Skipping.

All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/tur.ru/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

cat /etc/letsencrypt/renewal/tur.ru.conf
# renew_before_expiry = 30 days
version = 0.9.3
cert = /etc/letsencrypt/live/tur.ru/cert.pem
privkey = /etc/letsencrypt/live/tur.ru/privkey.pem
chain = /etc/letsencrypt/live/tur.ru/chain.pem
fullchain = /etc/letsencrypt/live/tur.ru/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = webroot
installer = None
account = 7e0---b8a
webroot_path = /var/www/tur.ru,
[[webroot_map]]
tur.ru = /var/www/tur.ru

[menu_dept]
exten=> s,1,Answer
exten=> s,n,WaitExten(2)
exten=> 1,1(dial),Queue(depsales,tTh,,,30)
exten=> 1,n,Dial(SIP/101)
exten=> 2,1,Queue(depagency,tTh,,,30)
exten=> 2,n,Queue(depsales,tTh,,,30)
exten=> 2,n,Dial(SIP/101)
exten=> 3,1,Queue(depbuh,tTh,,,30)
exten=> 3,n,Dial(SIP/101)
exten=> h,1,Verbose(2, QUEUESTATUS ${QUEUESTATUS})
exten=> h,n,Verbose(2, DIALSTATUS ${DIALSTATUS})
exten=> h,n,DumpChan(19)

[queue-default]!
queue-callswaiting => queue-callswaiting
periodic-announce-frequency => 0
announce-frequency => 10
announce-holdtime => no
announce-position => no
strategy => ringall
timeout => 120
setinterfacevar=yes
setqueuevar=yes

[depbuh](queue-default)
member => Local/105@queue-local,1
member => Local/106@queue-local,2

   -- Executing [h@menu_dept:1] Verbose("SIP/22446688-00000000", "2, QUEUESTATUS ") in new stack
  ==  QUEUESTATUS 
    -- Executing [h@menu_dept:2] Verbose("SIP/22446688-00000000", "2, DIALSTATUS ") in new stack
  ==  DIALSTATUS 

 -- Executing [89201112233@phones:3] Macro("SIP/199-00000000", "cdr2crm, ["UNIQ":1493904033.0\,"PHONE_LOCAL":199\,"PHONE":89201112233\,"DURATION":0\,"CALL_STATUS":BUSY\,"DIRECTION":out\,"
FILENAME":2017/05/04/out-2017-05-04-1620-199-89201112233-1493904033.0.wav]") in new stack
    -- Executing [s@macro-cdr2crm:1] NoOp("SIP/199-00000000", "Добавляю запись о звонке  ["UNIQ":1493904033.0\") in new stack
    -- Executing [s@macro-cdr2crm:2] Set("SIP/199-00000000", "result=

exten=>_X.,n,Macro(macroname, param)

param = ["UNIQ":1493904033.0\,"PHONE_LOCAL":199\,"PHONE":89201112233\,"DURATION":0\,"CALL_STATUS":BUSY\,"DIRECTION":out\,"
FILENAME":2017/05/04/out-2017-05-04-1620-199-89201112233-1493904033.0.wav]

iptables -t nat -A POSTROUTING -o tunX -j MASQUERADE

bridge1 6C:3B:6B:9F:DB:80

cap17 	6C:3B:6B:9F:DB:80

12:04:58 caps,info [::ffff:192.168.239.3:57934,Join,[6C:3B:6B:9F:DB:80]] joined, provides radio(s): 6C:3B:6B:9F:DB:80 
12:05:45 caps,info 84:00:D2:37:4D:D8@cap16 connected 
12:05:46 interface,warning ether2-master: bridge port received packet with own address as source address (6c:3b:6b:9f:db:80), probably loop 
12:05:51 interface,warning ether2-master: bridge port received packet with own address as source address (6c:3b:6b:9f:db:80), probably loop 
12:05:57 interface,warning ether2-master: bridge port received packet with own address as source address (6c:3b:6b:9f:db:80), probably loop 
12:06:06 interface,warning ether2-master: bridge port received packet with own address as source address (6c:3b:6b:9f:db:80), probably loop 
12:06:12 interface,warning ether2-master: bridge port received packet with own address as source address (6c:3b:6b:9f:db:80), probably loop

mdadm --create --verbose /dev/md1 --level=5 --raid-devices=6 /dev/sdc /dev/sdd /dev/sde /dev/sdf /dev/sdg /dev/sdh

md1 : active raid5 sdh[6] sdg[4] sdf[3] sde[2] sdd[1] sdc[0]
      4883156480 blocks super 1.2 level 5, 512k chunk, algorithm 2 [6/5] [UUUUU_]
      [====>................]  recovery = 23.3% (227639680/976631296) finish=1363.9min speed=9152K/sec
      bitmap: 1/8 pages [4KB], 65536KB chunk

# mdadm --query --detail /dev/md1
/dev/md1:
        Version : 1.2
  Creation Time : Wed Apr  5 10:55:56 2017
     Raid Level : raid5
     Array Size : 4883156480 (4656.94 GiB 5000.35 GB)
  Used Dev Size : 976631296 (931.39 GiB 1000.07 GB)
   Raid Devices : 6
  Total Devices : 6
    Persistence : Superblock is persistent

  Intent Bitmap : Internal

    Update Time : Wed Apr  5 15:58:09 2017
          State : active, degraded, recovering 
 Active Devices : 5
Working Devices : 6
 Failed Devices : 0
  Spare Devices : 1

         Layout : left-symmetric
     Chunk Size : 512K

 Rebuild Status : 23% complete

           Name : s1:1  (local to host s1)
           UUID : c59f91ba:1683a43c:9a0d81f2:f058dd2b
         Events : 40725

    Number   Major   Minor   RaidDevice State
       0       8       32        0      active sync   /dev/sdc
       1       8       48        1      active sync   /dev/sdd
       2       8       64        2      active sync   /dev/sde
       3       8       80        3      active sync   /dev/sdf
       4       8       96        4      active sync   /dev/sdg
       6       8      112        5      spare rebuilding   /dev/sdh

var xhr = new XMLHttpRequest();
xhr.open('GET', 'https://pbx.ru/asterisk/rawman?action=login&username=crm&secret=321', false, user, 123);
xhr.send();

 xhr.open('GET', 'https://pbx.ru/asterisk/rawman?action=originate&channel=SIP/200&exten=89209999999&context=out&callerid=200&async=yes', false, user, 123);

/var/www/html/pbx# cat .htaccess
<IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteRule ^/asterisk/(.*)$ http://127.0.0.1:8088/asterisk/$1 [P]
</IfModule>

<Directory /var/www/html/pbx>
  Options Indexes FollowSymLinks MultiViews
  AllowOverride All
  Order allow,deny
  allow from all
</Directory>

$ uname -a
Linux petav-work 3.2.0-4-686-pae #1 SMP Debian 3.2.63-2+deb7u1 i686 GNU/Linux

$ awesome -v
awesome v3.4.13 (Octopus)
 • Build: Jul 16 2012 12:31:46 for i686 by gcc version 4.7.1 (buildd@biber)
 • D-Bus support: ✔

/asterisk/httpstatus => Asterisk HTTP General Status
/asterisk/phoneprov/... => Asterisk HTTP Phone Provisioning Tool
/asterisk/amanager => HTML Manager Event Interface w/Digest authentication
/asterisk/arawman => Raw HTTP Manager Event Interface w/Digest authentication
/asterisk/manager => HTML Manager Event Interface
/asterisk/rawman => Raw HTTP Manager Event Interface
/asterisk/static/... => Asterisk HTTP Static Delivery
/asterisk/amxml => XML Manager Event Interface w/Digest authentication
/asterisk/mxml => XML Manager Event Interface
/asterisk/ws => Asterisk HTTP WebSocket

# cat http.conf
[general]
enabled=yes
bindaddr=0.0.0.0
bindport=8088
prefix=asterisk
enablestatic=yes
tlsenable=yes         
tlsbindaddr=0.0.0.0:8089
tlscertfile=/etc/letsencrypt/live/example.ru/fullchain.pem
tlsprivatekey=/etc/letsencrypt/live/example/privkey.pem

# cat /etc/letsencrypt/live/example.ru/fullchain.pem |head -n 1
-----BEGIN CERTIFICATE-----

# cat /etc/letsencrypt/live/example.ru/privkey.pem |head -n 1
-----BEGIN PRIVATE KEY-----

# asterisk -rx "http show status"
HTTP Server Status:
Prefix: /asterisk
Server Enabled and Bound to 0.0.0.0:8088

Enabled URI's:
/asterisk/httpstatus => Asterisk HTTP General Status
/asterisk/phoneprov/... => Asterisk HTTP Phone Provisioning Tool
/asterisk/static/... => Asterisk HTTP Static Delivery
/asterisk/ws => Asterisk HTTP WebSocket

Enabled Redirects:
  None.

# netstat -an | grep 8088
tcp        0      0 0.0.0.0:8088            0.0.0.0:*               LISTEN  

p# wget --quiet -O - http://example.ru:8088/asterisk/httpstatus
<title>Asterisk HTTP Status</title>
<body bgcolor="#ffffff">
<table bgcolor="#f1f1f1" align="center"><tr><td bgcolor="#e0e0ff" colspan="2" width="500">
<h2>&nbsp;&nbsp;Asterisk&trade; HTTP Status</h2></td></tr>
<tr><td><i>Prefix</i></td><td><b>/asterisk</b></td></tr>
<tr><td><i>Bind Address</i></td><td><b>0.0.0.0</b></td></tr>
<tr><td><i>Bind Port</i></td><td><b>8088</b></td></tr>
<tr><td colspan="2"><hr></td></tr>
<tr><td colspan="2"><hr></td></tr>
</table><center><font size="-1"><i>Asterisk and Digium are registered trademarks of Digium, Inc.</i></font></center></body>

# netstat -an | grep 8089

Asterisk 11.13.1