Only this pageAll pages
Powered by GitBook
Couldn't generate the PDF for 224 pages, generation stopped at 100.
Extend with 50 more pages.
1 of 100

English

Loading...

Loading...

Loading...

Loading...

Installation

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

User manual

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Security

Loading...

Loading...

Loading...

FAQ

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Hetzner cloud (In dev)

System requirements

Discription of system requirements for the MikoPBX system

Network Channel Requirement

An example of calculating the required channel bandwidth for different codecs for 30 simultaneous calls. PBX supports the most popular codecs:

  • G.711 - 4.67 Mbps

  • GSM - 1.68 Mbps

  • G.722 - 4.67 Mbps

  • G.729 - 1.38 Mbps

  • 800 Mb hard disk for the main system

  • A 50+ Gb hard drive for recording conversations

  • 1 (2 cores) x86-64 processor

Getting to know MikoPBX

Description of the first login to the MikoPBX web-interface

First login to the MikoPBX system

Go to the MikoPBX installation console, remember the IP address that your PBX received.

MikoPBX IP address for connecting to the WEB interface

Enter the received MikoPBX IP address in the web browser. The authorization page will be displayed. Log in using the default credentials:

Use the following default credentials for the first login to the MikoPBX web interface:

  • Username: admin

  • Password: admin

Authorization page in the web interface

After successful authorization, MikoPBX will automatically open the settings for changing the password:

First authorization in the MikoPBX WEB interface

For more information about the General Settings, see the section.

After changing the password, the system will be fully operational. It is recommended to immediately configure the firewall rules. You can read about how to do this by following the link.

Standalone Computer

In this article you will find instructions on how to install MikoPBX on a separate computer.

MikoPBX supports installation on a standalone computer. There are two installation methods:

  • Live USB — writing the image to a flash drive and then installing it onto another disk.

  • Bootable USB — installing the system directly onto the USB drive itself, allowing you to boot and run the system from it.

This section provides image writing instructions for all supported operating systems (Windows, MacOS, Linux).

Quick start

This guide provides detailed steps to get started with MikoPBX and helps you quickly configure the system.

Follow the step-by-step instructions in the order presented for a quick and successful system setup.

MikoPBX is a full-fledged operating system for your hardware; it is not a standalone application. It is provided as an image file (*.iso, *.img, *.raw).

It supports various installation methods:

  • Installation .

MikoPBX Manual

Description of MikoPBX and the sections you can find in the documentation. Introduction to the documentation.

Welcome to the MikoPBX documentation resource! Here you can find step-by-step instructions related to interacting with the MikoPBX PBX system. For your convenience, the documentation is organized into sections - just like in the web interface, making it very easy to navigate.

Thank you for choosing MikoPBX! ❤️

MikoPBX is a free telephony server with its own operating system and a simple, user-friendly web interface. It works with virtually any telephony technology in the world.

MikoPBX is a fully modular interface for Asterisk, written in PHP and JavaScript. This means that you can implement absolutely any additional Asterisk telephony functionality within MikoPBX. Moreover, if you develop a useful module, you can place it in the public repository and make it available to all MikoPBX users. Additionally, MikoPBX has very low hardware requirements:

Virtual Machine

In this article you will find instructions on how to install MikoPBX using various virtual machines.

MikoPBX supports installation using many virtual machines. In this section you can find detailed instructions for them. Click on an item in the list below to go to the instruction for a specific virtual machine:

Cloud

In this article you will find instructions on how to install MikoPBX using various cloud services.

MikoPBX supports installation via many cloud services. In this section you can find detailed instructions for them. Click on an item in the list below to go to the instruction for a specific virtual machine:

AWS

MikoPBX Installation Options Using AWS

The simplest way to install MikoPBX is by deploying a ready-made image from the AWS Marketplace. If you wish to launch a custom version of MikoPBX, please refer to the detailed instructions where we describe step-by-step how to create an AMI image from any MikoPBX distribution.

Google Cloud

MikoPBX Installation Guide using Google Cloud

Installing MikoPBX in Google Cloud can be done in two ways: using an image from the Google Cloud Marketplace or from an image based on a file uploaded from the MikoPBX distribution. The first method provides quick and easy deployment of the standard version of MikoPBX, while the second is suitable for intermediate releases.

2 GB of RAM
  • Network Adapter

  • The calculation is approximate, when using the same codec on all devices connected to the PBX. Read more here.

    Minimum system requirements

    We recommend using two hard drives for PBX deployment.

    A PC with such parameters, in our tests, holds 38 simultaneous incoming calls under the conditions:

    • 10 agents are connected to the queue (all online)

    • Every second a new call comes in

    • Music (MOH) is played to the client while waiting

    • Modules on the PBX is not installed

    Approximately, 1 hour of conversation takes up 14MB of disk space. The recommended size for the disk storing call recordings is at least 50 gigabytes.

    VMware ESXi
    VMware Fusion
    VirtualBOX
    VMware Workstation Pro
    Hyper-V
    Proxmox
    UTM
    AWS
    Microsoft Azure
    Google Cloud
    Hetzner cloud (In dev)
    Digital Ocean
    Alibaba Cloud
    Vultr
    Cover

    Installation by writing the image to a USB drive (Live USB)

    Cover

    Installing the system directly onto a USB drive (Bootable USB)

    Cover

    AWS deployment guide

    Detailed instruction on how to create an AMI image

    Cover

    AWS Marketplace

    Instructions for installing a ready-made image from AWS Marketplace

    Cover

    AWS Terraform script

    Installation instructions using Terraform (IaC)

    Cover

    Google Cloud Marketplace

    Instructions for installing a ready-made image from Google Cloud Marketplace

    Cover

    Google Cloud deployment guide

    Detailed instructions for uploading MikoPBX from an image based on a .vhd file from the distribution

    General Settings

    Setup

    Management

    Docker installation and creating a user and directories

    Preparation guide for MikoPBX using Docker

    Installing Docker and Docker Compose on Ubuntu 22.04

    Before working with Docker, you need to install Docker and Docker Compose themselves. Here's how to do it:

    Creating a user and directories on the host system

    Before creating the container on the host machine, it's necessary to create a user and group with limited permissions, as well as a folder for storing configuration settings and call recordings

    Useful commands

    Command to connect to the PBX console:

    sudo docker exec -it mikopbx sh

    Command to connect to the PBX console menu:

    Connecting to sngrep for SIP analysis

    # Update package list and install required dependencies
    sudo apt-get update
    sudo apt-get install -y ca-certificates curl
    
    # Add the GPG key for Docker's official repository
    sudo install -m 0755 -d /etc/apt/keyrings
    sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
    sudo chmod a+r /etc/apt/keyrings/docker.asc
    
    # Add Docker's repository to the APT sources list
    echo \
      "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
      $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
      sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
    
    # Install Docker CE and Docker Compose
    sudo apt-get update
    sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
    
    # Verify Docker Compose version
    sudo docker compose version
    # Creating a new user (e.g., www-user) without superuser rights
    sudo adduser --disabled-password --gecos "" www-user
    
    # Creating directories for data storage
    sudo mkdir -p /var/spool/mikopbx/cf
    sudo mkdir -p /var/spool/mikopbx/storage
    
    # Granting the created user ownership of the directories
    sudo chown -R www-user:www-user /var/spool/mikopbx/
    sudo docker exec -it mikopbx /etc/rc/console_menu
    sudo docker exec -it mikopbx sngrep
    Installation in a virtual machine.
  • Installation using cloud services.

  • Installation in a Docker container.

  • Follow the link for your preferred installation method and proceed according to the provided instructions.

    After installation, you need to access the MikoPBX web interface for further system configuration. To do this, find the PBX's IP address in the MikoPBX console:

    Example of MikoPBX Console

    In this example, the IP address is 192.168.0.203. To access the web interface, enter this IP address into your browser's address bar:

    MikoPBX login window

    After the first login, the system will prompt you to change your password.

    For stable PBX operation, you need to configure the network through the Network and Firewall → Network Interface section. Detailed instructions for these settings can be found here.

    In MikoPBX, all local subnets can be defined in the Network and Firewall → Firewall section. The firewall is intended to restrict access to the PBX based on traffic type and subnets. Follow the setup instructions here.


    Fail2Ban blocks IP addresses exhibiting unusual activity; it can reduce the rate of failed authentication attempts and helps protect your PBX from hacking. Instructions to help with the setup can be found here.


    After completing the initial PBX setup, you can proceed to create accounts for your employees. This instruction will assist you.


    After adding employees, you need to connect providers to your PBX. Instructions for this section can be found here. Instructions with examples of configuring real providers can be found here.


    At this stage, you need to set routing rules for incoming and outgoing calls: how calls passing through a specific provider will be handled:

    • Incoming Call Routing

    • Outbound Call Routing

    To create routing rules, you may also need the following features:

    • Call Queues

    • IVR Menu

    • Conferences


    The Marketplace allows you to extend the system's standard functionality using modules:

    • You can read more about Modules in MikoPBX in this article.

    • Information on registering in the MikoPBX Marketplace can be found here.

    Installing MikoPBX

    on a standalone computer

    First Login to the Web Interface

    If the logs do not provide a username and password, use the default credentials:

    Username: admin

    Password: admin

    Settings Within the Web Interface:

    Network and Firewall Settings

    Configuring Protection Against Hacking (Fail2Ban)

    Adding and Configuring Employee Accounts

    Connecting Providers

    Setting Up Incoming and Outgoing Routing

    Marketplace and Modules

    This completes the basic setup of MikoPBX! For a deeper exploration of MikoPBX's capabilities, we recommend referring to the comprehensive documentation.

    Simultaneous Calls
    Minimally Recommended Configuration

    5 - 10

    1 GHz x86-64, 512 MB RAM

    Up to 25

    3 GHz x86-64, 1 GB RAM

    Over 25

    2 CPUs 3 GHz x86-64, 2 GB RAM or more

    To get started, you should install MikoPBX using any method convenient for you. Below are installation options. By clicking on their names, you can access detailed articles:

    • Installation on a standalone computer.

    • Installation in a virtual machine.

    • Installation using cloud services.

    • Installation in a Docker container.

    After installation, you can begin exploring your PBX system. The "User Guide" documentation will help you with this, providing detailed information about specific sections:

    • Telephony.

    • Call Routing.

    • Modules.

    • Maintenance.

    • .

    • .

    For additional help with getting started quickly, you can refer to this article.

    If you have familiarized yourself with the basic setup and operation of MikoPBX, you can expand its functionality using modules.

    Modules allow you to add extra features to your system. You can learn more about them step by step:

    1. Registration in the MikoPBX Marketplace – here you'll find a detailed description of the registration process and its specifics.

    2. Module Management – this section provides a detailed explanation of how to install and manage modules.

    3. Documentation on Specific Modules – in this section, you'll find detailed descriptions of each module, as well as steps for configuring and using them.

    In this section, you can find answers to your questions and solutions that will help you expand the functionality of basic features. This section, like the main documentation, is divided into categories for easy navigation.

    If you have a question that isn't covered here, you can seek assistance in the Telegram Community, where MikoPBX users help each other resolve issues and needs related to the PBX system.

    Foreword

    What is MikoPBX?

    MikoPBX Interface

    Where to Start?

    Modules

    FAQ Section

    Docker container

    MikoPBX Installation Guide using Docker container

    The "Host system" must run on Linux 5+. Tested on Debian 11, Ubuntu 21.04, and Ubuntu Server 22.04 LTS.

    MikoPBX can be run in Docker using two main methods. The first method involves running the container directly using a Docker command with the necessary parameters. The second method involves using Docker Compose, which simplifies managing multi-container applications and allows the entire configuration to be described in a yaml file, making the deployment and maintenance of the system more convenient.

    Telephony

    Description of the MikoPBX telephony section

    The "Telephony" chapter in the MikoPBX documentation contains detailed information and instructions related to setting up and using telephony in the system.

    "Telephony" Section MikoPBX

    Extensions

    Extensions

    Extensions in MikoPBX are individual users of the system who are assigned internal numbers for making and receiving calls. They have personal accounts that allow you to configure access rights, call forwarding and other personal settings in the system.

    In this article, you will find detailed documentation on adding new employees to the station, setting up their rights and profiles. In addition, information about their additional parameters.


    Call queues

    Call queues

    Call queues in MikoPBX are a feature that allows you to distribute incoming calls between a group of operators, holding calls in a queue until an operator becomes available. This ensures efficient management of a large call flow and improves customer service.

    In this article, you will find detailed documentation on creating and configuring such queues.


    IVR menu in MikoPBX is an interactive voice menu that allows callers to interact with the phone system by pressing keys (DTMF). It automatically routes calls to the right departments or employees, improving call handling efficiency and customer service.

    In this article, you will find documentation on creating and configuring an IVR menu.


    Conferences in MikoPBX are a feature that allows you to organize group phone calls with multiple participants at the same time. It allows you to hold group discussions, meetings and appointments over the phone, improving communication both within the company and with external partners.

    In this article, you will find documentation on creating and configuring conference rooms.


    Sound files in MikoPBX are audio recordings that are used by the system to play various messages, such as greetings, announcements, IVR menu instructions or waiting signals. They allow you to personalize the audio content that callers hear, improving interaction with the system and providing the necessary information.

    In this article, you will find detailed information about them, as well as how to add and edit them.


    Call detail records in MikoPBX is a log that stores information about all incoming and outgoing calls through the system. It provides detailed data about each call, including time, duration, participant numbers and status, which allows you to analyze communications and optimize the operation of the company's telephone network. In this article, you will find information about storing call records and their filters.

    Maintenance

    Description of the Maintenance section in MikoPBX

    The Maintenance section of MikoPBX is an interface for managing the technical aspects of the system and ensuring its stable operation. Here, administrators can perform tasks on data backup and recovery, software updates, system status monitoring, and event log management. This section helps maintain the functionality of the telephone system, promptly detect and eliminate possible problems.

    "Maintenance" section in MikoPBX

    PBX update

    PBX update

    The "PBX update" section in MikoPBX is an interface for managing system software updates. Here, administrators can check for new versions, install updates, and view the change history. Regular use of this section ensures that MikoPBX is up-to-date, secure, and stable.


    System log entries

    System log entries

    The "System log entries" section in MikoPBX is a tool for monitoring and analyzing the status of the telephone system. Here, administrators can view event logs, check the status of various services and system components, and test connections and calls. Using this section helps to promptly detect and eliminate technical problems, ensuring stable and efficient operation of MikoPBX.


    Reboot

    Reboot

    The "Reboot" section in MikoPBX is an interface for securely managing the state of the telephone system via the web interface. Here, administrators can reboot the system to apply new settings or shut it down gracefully for maintenance. Using this section prevents possible errors and ensures stable operation of MikoPBX. In addition, the possibility of rebooting via the console will be discussed.

    Updating from the MikoPBX console

    Update option from MikoPBX console

    Below is an example of a PBX installed on a VirtualBOX virtual machine, updated from version 2023.1.223 to version 2023.2.206. Download the iso image of the required PBX version from the repository.

    .iso image in MikoPBX release repository

    In VirtualBOX, open the settings of the virtual machine where the PBX is installed. Go to the Storage section. Select the virtual optical drive. Click the icon in the Attributes group, and click Choose Disk File. Select the downloaded PBX iso image. Start the machine.

    Selecting a disk file in the VirtualBox interface

    The console will display the line "The system loaded in Recovery mode".

    MikoPBX Console

    Select Install / Repair (or press the number 8 on the keyboard) and press Enter.

    You need the command "Update to version ****.*.**". Press the number 2 on the keyboard, then press Enter. The update installation will begin. When it is complete, the PBX will reboot.

    After the PBX reboots, the message "The system loaded in Recovery mode" will no longer appear, indicating that the PBX has booted from the hard disk and not from the virtual optical drive. The installed update version will be displayed in green at the top.

    Network and Firewall

    Description of the Network and Firewall section in MikoPBX

    The "Network and Firewall" section of MikoPBX is an interface for configuring network settings and managing the system's firewall. Here, administrators can configure IP addresses, network interfaces, and create firewall rules to protect the system from unauthorized access. This section ensures the secure and stable operation of MikoPBX in the organization's network infrastructure.

    Section "Network and Firewall" in MikoPBX

    Network interface

    Network interface

    The "Network Interface" section in MikoPBX is an interface for configuring the system's network connection parameters. Here, administrators can manage IP addresses, subnet masks, gateways, and other network settings for each network interface. This allows MikoPBX to be correctly integrated into the organization's network and ensure its stable operation in accordance with the requirements of the network infrastructure.


    Firewall

    Firewall

    The "Firewall" section of MikoPBX is an interface for configuring the system's firewall. Here, administrators can create and manage network traffic filtering rules, controlling access to MikoPBX and protecting it from unauthorized access and network threats. Configuring the firewall ensures the security of the telephone system, preventing potential attacks and ensuring stable operation in the organization's network infrastructure.


    The "Anti brute force (Fail2Ban)" section in MikoPBX is a tool for ensuring system security from unauthorized access and network attacks. Fail2Ban monitors event logs and automatically blocks IP addresses that make suspicious or repeated failed login attempts. Setting up this section helps prevent system hacking and protect the organization's confidential data.

    Conferences

    Creating and configuring conferences in MikoPBX

    Conference calling is used for conducting group discussions, meetings, or negotiations in cases where participants are unable to meet in person. It is also used when a particular matter needs to be discussed with multiple participants simultaneously.

    The list of conference rooms is located in the "Telephony" -> "Conferences section".

    To create a new conference room, click the "Add conference".

    You must specify the name of the conference and its internal number, by calling which you can enter this conference

    To prevent unauthorized access to the conference by employees for whom the discussion is not intended, you can secure the conference room with a password. To do this, fill in the "

    Sound files

    Adding/Creating Audio Files in MikoPBX

    Audio files in MikoPBX are used in various call scenarios and interactive voice menus (In IVR menu, during non-working hours, in call queues, for various system notifications, and in hold music.) to play voice greetings or notify customers.

    The list of available sound files is displayed in the "Telephony" -> "Sound files".

    To add a new sound file, click "Add a new sound file".

    Click "Upload a new file" and select a sound file.

    Call detail records (CDR)

    How to view and filter call history in MikoPBX

    Call History provides a log of all incoming, outgoing, and internal calls. It is located under "Telephony" -> "Call History".

    The Call History feature in MikoPBX enables users to:

    • Display all calls;

    • Filter calls based on criteria

    Incoming routing

    Description and configuration of incoming routing

    In this section, you need to create rules and templates for distributing incoming calls for providers created in MikoPBX. The rules for incoming calls describe the route of a call from the moment it arrives at the PBX to the moment it is completed. You can create an unlimited number of inbound routing rules. You can create several rules for one provider.

    Rules are listed in order of priority. If no one answers the incoming call within the time interval specified in the rule, the call will be routed to the next priority rule. Rules can be moved up and down in the list, that is, their priority can be changed by dragging them by the arrows.

    If the call is not answered according to any of the rules, the Default incoming route is used.

    The following actions are available and can be specified as the default rule:

    Night and Holiday Switch

    Setting up non-working time rules

    "Off-hours" in MikoPBX is a tool for setting up call processing rules during periods when the company is not working, such as at night, on weekends or holidays. With its help, administrators can determine how the system will handle incoming calls during off-hours: forward to an answering machine, play special voice messages or forward calls to the mobile numbers of on-duty employees. This ensures correct interaction with customers outside of working hours and maintains a high level of service.

    To add a new rule, click on the "Add Time Interval" button.

    A form for creating a new rule will open.

    In the form, you will find the following fields:

    Updating from the web interface

    Update option from the web interface

    In some sections of the interface (e.g., Extensions), the current version of MikoPBX is displayed in the lower right corner.

    In the PBX web interface, go to Maintenance → PBX update.

    If there are newer versions of the PBX available, they will be displayed in the Online updates available table, with the version number in the first field and the list of changes in the second.

    There are two update options: online update and update using a downloaded img file.

    Updating the docker

    Upgrade option for MikoPBX in Docker container

    To update the MikoPBX container to the latest version, you can follow these steps in the command line. These steps include stopping the current container, downloading the new version of the image, and running the container with the updated image.

    First, you need to properly stop the running container. After stopping the container, you can safely remove it

    To launch a new container using the latest image version with the same settings as before, use the following commands:

    First, you need to properly stop the running container. After stopping the container, you can safely remove it

    An example of the docker-compose.yml file that can be used to update your MikoPBX container through Docker Compose:

    Save the contents to a file named docker-compose.yml

    Reboot

    Description of section functions

    The system shutdown/reboot menu can be found in MikoPBX by clicking on "Reboot" in the "Maintenance" section.

    When you open the page, a list of active calls to the PBX will be displayed. The start date of the call is displayed, from whom and to whom the call.

    • Restart the PBX - the command starts restarting the station.

    Date and Time

    In this subsection, you can configure the clock and calendar settings.

    You need to set the time zone correctly to ensure accurate system time display. If the time zone is not set, notifications and call history will be recorded with incorrect timestamps.

    To configure the time zone, go to the "System" section and select "Time Settings":

    To manually set the time, toggle the switch "Adjust the time manually."

    Network and Firewall
    System

    There is an option to set the time "manually" without using an NTP server. However, whenever possible, we recommend using automatic time synchronization.

    "Time Settings" section
    "Adjust the time manually" switch

    Docker installation and creating a user and directories

    Commands to install Docker and Docker Compose and configuration before creating the container

    Running MikoPBX in a container

    Instructions for running a ready-made MikoPBX container, creating a container from a custom image, and running it

    Running MikoPBX using docker compose

    Instructions for running multiple MikoPBX instances on a single host using Docker Compose

    External firewall for Docker

    How to protect the web interface when `userland-proxy=true`: an external bouncer or host networking.

    Cover
    Cover
    Cover

    IVR Menu

    Conferences

    Sound files

    Call detail records (CDR)

    IVR Menu
    Conferences
    Sound files
    Call detail records (CDR)
    Update installation process
    Updated version

    Anti brute force (Fail2Ban)

    , make the necessary adjustments, and run the command:
    • Data: Since data is stored in Docker volumes (mikopbx_cf and mikopbx_storage), it remains untouched during the update, preserving settings and user data.

    • Environment Variables: Ensure that all necessary environment variables are correctly passed.

    • Safety: Always create backups of your data before updating.

    These steps will help ensure a smooth and safe update of your MikoPBX container.

    Updating the docker

    Updating using Docker compose

    Notes

    # Stop the current container
    sudo docker stop mikopbx
    
    # Remove the current container
    sudo docker rm mikopbx
    # Downloading the latest container image version
    sudo docker pull ghcr.io/mikopbx/mikopbx:latest
    
    # Starting the container in unprivileged mode
    sudo docker run --net=host --name mikopbx --hostname mikopbx \
               -v /var/spool/mikopbx/cf:/cf \
               -v /var/spool/mikopbx/storage:/storage \
               -e SSH_PORT=23 \
               -e ID_WWW_USER="$(id -u www-user)" \
               -e ID_WWW_GROUP="$(id -g www-user)" \
               -it -d --restart always ghcr.io/mikopbx/mikopbx:latest
    export ID_WWW_USER=$(id -u www-user)
    export ID_WWW_GROUP=$(id -g www-user)
    
    sudo docker compose -f docker-compose.yml pull
    sudo docker compose -f docker-compose.yml up -d
    docker-compose.yml
    services:
      mikopbx:
        container_name: "mikopbx"
        image: "ghcr.io/mikopbx/mikopbx:latest"
        network_mode: "host"
        entrypoint: "/sbin/docker-entrypoint"
        hostname:  "mikopbx-in-a-docker"
        volumes:
          - /var/spool/mikopbx/cf:/cf
          - /var/spool/mikopbx/storage:/storage
        tty: true
        environment:
          - ID_WWW_USER=${ID_WWW_USER}
          - ID_WWW_GROUP=${ID_WWW_GROUP}
          # Change the station name through environment variables
          - PBX_NAME=MikoPBX-in-Docker
          # Change the default SSH port to 23
          - SSH_PORT=23
          # Change the default WEB port to 8080
          - WEB_PORT=8080
          # Change the default WEB HTTPS port to 8443
          - WEB_HTTPS_PORT=8443
    export ID_WWW_USER=$(id -u www-user)
    export ID_WWW_GROUP=$(id -g www-user)
    
    sudo docker compose -f docker-compose.yml pull
    sudo docker compose -f docker-compose.yml up -d
    Conference Pin
    " field. Only digits can be entered in this field, with a minimum requirement of at least one digit.
    Conference PIN field

    In this case, to join the conference, employees will need to enter the PIN code after dialing the conference PIN.

    • Communication is conducted solely through voice (no other means of information transmission besides speech are provided).

    • All participants can speak and hear each other simultaneously, ensuring duplex communication.

    • Participants use telephones (hardware or software) for communication.

    • Each participant dials the conference number. The first participant hears hold music until at least one more participant joins the conference. An employee can transfer their caller into the conference by using specific key combinations on their phone. Transfers can be made to both internal and external numbers. The key combination for transfers is set in the System -> General Settings -> Call Transfers section.

    • Example: An employee dials the combination **1111 (the combination for unconditional transfer), and their caller joins the conference as its first participant. The call is completed for the transferring employee, and to join the conference, they dial the conference number 1111.

    Create conference rooms

    "Add conference" button
    New conference room parameters

    Characteristics of conference calling include:

    Usage:

    The maximum number of conference participants is not limited.

    "Upload a new file" button

    Correct the file name if necessary.

    The name of the recording file

    Save settings

    "Save settings" button
    "Start recording" button

    Custom sound files are stored on the PBX along the path /storage/usbdisk1/mikopbx/media/custom. Music on hold files are stored in /storage/usbdisk1/mikopbx/media/moh.

    If a client gets into a queue during a call or is waiting for redirection, the PBX plays a melody for him. It is possible to download your own tunes for listening while waiting.

    You can do this on the "Music on Hold" tab as described above.

    "Music on hold" tab

    Uploading a sound file to the PBX

    Supported file formats: wav, mp3, ogg, m4a, aac.

    "Sound files" section
    "add a new sound file" button

    When working over the https protocol, it is possible to record an audio file using a microphone.

    Music on hold

    ;
  • Visually identify missed calls from the call log;

  • Download or listen to call recordings.

  • Each entry in the call log contains information about:

    • The caller’s phone number (Who);

    • The recipient’s phone number (To Whom);

    • The date and time of the call (Call Date);

    • The duration of the call (Duration) – this excludes time spent on greetings or announcements.

    Calls marked in red are missed calls. Their duration is logged as zero, and these calls cannot be played back:

    Missed calls

    For answered calls, users can listen to or download the recording. When downloading a recording, you can choose WebM (Opus), MP3, WAV, or OGG (Opus) format.

    Listen to the recording function

    Each call log entry provides detailed information about the participants involved.

    Detailed information

    The search bar in the Call History page supports the following filters:

    1. Phone Number Filter

    You can search using either an internal staff number or an external client number.

    Filter by Phone number
    1. Specific Field Filter

    You can add a prefix to search only in a specific field:

    • src:74952293042 - search by caller number;

    • dst:302 - search by destination number;

    • did:74952293042 - search by DID number;

    • linkedid:mikopbx-... - search by the unique call identifier.

    If no prefix is specified, MikoPBX performs a general search by caller number, destination number, DID, and employee name.

    Search by number or a specific call history field
    1. Date Filter

    When opening the Call History, MikoPBX selects a date range based on the latest call records. To filter for a specific period, select the date range and click Apply.

    Filter by date

    Benefits

    Call detail records (CDR)

    Filters

    To apply a filter, press Enter after entering the search criteria.

    • Play busy signal - the client will play a busy signal and the incoming call will be ended;

    • Hang up;

    • Redirect the call - the call can be transferred to a number that you can select in the field located to the right of the action. You can select an IVR menu, call queue, conference, or employee extension number as the number for transfer.

    For one provider, you can describe several incoming routes.

    First, the call goes along the upper route. If the client does not get through, then the call goes according to the lower rule (lower priority). If the client does not get through via the second route, then the call goes through the default route.

    Several incoming routes for one provider

    To add a new incoming routing rule, click the Add a new rule button.

    New Rule

    In the Note field, describe the route you want to implement. In the future, this will help you debug the call circuit.

    Select the Provider for which you are creating a new incoming call distribution template.

    The additional DID number is the number the client called you on. This field is optional and should be completed if you need to route calls more accurately.

    Parameters for a new rule

    At the next step, you need to indicate to which phone number the incoming call from the client will be sent. The telephone number can be IVR menu numbers, call queues, conferences, or employee internal numbers.

    Parameters for a new rule

    Specify the time during which the call will be sent to the phone number you specified.

    Parameters for a new rule

    If after the specified time interval no one answers the incoming call, the call will be routed to the next priority rule.

    Additional examples of configuring incoming routing are available in the FAQ section.

    Routing rule priority and default route

    "Call Routing" -> "Incoming Routing" section
    Priority Scheme
    Default incoming route

    Multiple routes for one provider

    Create a routing rule

    Period: The calendar period when employees are absent from the office, such as during New Year's or May holidays.

  • Weekdays: Specific weekdays for which the rule will be applied.

  • Time Range: The time period during the day when employees are absent.

  • Incoming Call Action: You can choose to play a sound file or perform a call transfer. Call transfer options include transferring the call to a conference, IVR menu, queue, internal employee extension, or specific termination numbers.

  • In the Note field, you can add a note with a description of the created rule, so that you can quickly navigate through the essence of this rule using this description. With the eraser button, you can clear the fields opposite which this button is located.

    By activating this function, a new menu "Route restrictions" will appear on top of you

    "Apply only to certain incoming routes" switch and "Route restrictions" Section

    Here you can choose which specific routes the rule you are creating will apply to.

    "Route restrictions" section

    This rule is used for calls during non-working hours from Monday to Friday, specifically from 7:00 PM to 9:00 AM:

    Example of the rule

    This rule is used to handle calls on Saturdays and Sundays:

    Example of the rule

    Creating a rule

    "Call routing" -> "Night and Holiday Switch" Section
    "Add time interval" button
    A form for creating a new rule

    Apply only to certain incoming routes

    Examples of rules

    Updates are downloaded to the PBX and applied immediately. To update this way, click the button for the desired version.
    Button to update the system

    A warning window will appear. Click Upgrade.

    Warning window

    The PBX will download and apply the updates, and then reboot.

    To update using this method, click the button for the desired version.

    Button to download the update file

    The img file will start downloading. Wait for the download to complete.

    Then click the button and select the downloaded img file.

    Selecting a file to update

    Then click Apply the update, and in the warning window, click Upgrade.

    Installing the update

    The updates will be applied, and the PBX will reboot upon completion.

    The update process

    We recommend performing updates sequentially without skipping releases.

    Online upgrade

    Be cautious! If the system is installed on the same disk where call recordings are stored, there may be difficulties with the update. See forum

    Displaying the version in the web interface
    "PBX update" section
    Section "Available online updates"

    Update using a downloaded img file

    Please note that this method can also be used to roll back to a previous version.

    Turn off PBX - completes all processes and disconnects the station.

    System shutdown/reboot options

    You can restart the station via the console menu. To do this, select the section "[3] Reboot the system"

    MikoPBX console
    • If you want to restart the station: press "[1] Reboot MikoPBX"

    • If you want to turn off the station: press "[2] Shutdown"

    The system will reboot.

    Restart/shutdown station

    In case of an emergency restart of the PBX (for example, power outage), it may be necessary to check the disk for errors.

    In the PBX console menu, enter the command "[9] Console(Shell)" and press Enter.

    System launch the MikoPBX console.

    Console menu MikoPBX

    Enter the command reboot. Press Enter.

    The system will reboot with a disk check.

    Reboot command

    Rebooting the station via the MikoPBX interface

    As long as there are active calls, the reboot and shutdown will not be available via the web interface.

    "Maintenance" -> "Reboot" section
    List of active calls

    Rebooting the station via the console menu

    Reboot with disk check

    AWS Marketplace

    Installation guide for MikoPBX image from AWS Marketplace

    Sign in to the service Amazon Web Services https://aws.amazon.com

    MikoPBX in AWS Marketplace:

    X86:

    ARM64:

    Let's get started with the setup

    For quick and convenient navigation within the Amazon service, use the search panel

    Creating a virtual machine

    1. Open Services / Compute / EC2 and navigate to Images / AMI Catalog

    2. In the open tab enter MikoPBX in the search bar

    3. In the AWS Marketplace AMIs section select the image (x86 or ARM version) by clicking the Select button

    4. On the opened tab click Subscribe now

    5. Click the Launch an instance from AMI button to create a virtual machine

    1. Enter the virtual machine name, for example mikopbx-vm

    If you have an SSH key

    1. Specify the SSH key in the Key pair field

    If you don't have an SSH key

    1. Select Create new key pair and specify the key pair name, for example mikopbx_key

    Follow the instructions further

    1. If necessary, change the size of the storage disk in Configure storage, default size is 50Gb

    1. Under Network settings, all required Firewall rules are configured automatically

    1. For other fields use default values

    2. Click Launch instance

    1. Go to the created virtual machine mikopbx-vm

    2. On the opened tab, select Connect / EC2 serial console, wait for the system to fully load until the authentication parameters are displayed

    1. Copy the external address of the created virtual machine and enter it in the browser's address bar

    2. Use the login and password provided in EC2 serial console for login

    Google Cloud Marketplace

    MikoPBX Installation Guide using Google Cloud Marketplace

    Log in to the platform at https://console.cloud.google.com/

    MikoPBX on Google Cloud Marketplace: https://console.cloud.google.com/marketplace/product/mikopbx-public/mikopbx

    Let's start with the setup

    For quick and easy search on the Google Cloud platform, use the search bar

    Adding roles to a Service account

    If you have a service account, check if it has the necessary roles, and add them if needed

    If you do not have a service account, create one and add the necessary roles

    1. Open the Navigation menu / Products & solutions / Management / IAM & Admin

    2. Go to the Service accounts tab and click on CREATE SERVICE ACCOUNT

    3. Enter a name for the service account, for example mikopbx-service-account

    4. Click the CREATE AND CONTINUE button

    1. Add the roles Cloud Infrastructure Manager Agent, Compute Admin, Compute Network Admin, Service Account User

    1. Click the DONE button

    1. Open the Marketplace and enter MikoPBX in the search bar

    2. Select the image

    3. On the opened tab select LAUNCH

    1. In the Deployment name field, enter a name, for example mikopbx-vm

    2. In the Deployment Service Account section, check the Existing account option and select the previously created service account

    1. If necessary, change the size of the data storage disk in the Data Storage section. By default, its size is 50 GB

    1. Under Networking, all required Firewall rules are configured automatically

    1. For other fields, use the default values

    2. After entering the values, click the DEPLOY button

    1. Open the Compute Engine tab and go to the Virtual machines / VM Instance section

    2. Go to the created virtual machine mikopbx-vm-mikopbx-vm

    3. On the opened tab, go to Logs / Serial port 1 (console)

    1. Copy the external address of the created virtual machine and enter it in the browser address bar

    2. Use the login and password provided in Serial port 1 (console) to log in

    Connecting DigitalOcean S3 Storage

    Instructions for connecting DigitalOcean Spaces Object Storage as an S3 storage

    Creating a Bucket and Access Keys

    1. Go to the DigitalOcean console (link).

    2. Navigate to Manage → Spaces Object Storage. Click Create a Spaces Bucket to create a new bucket.

    Spaces Object Storage section
    1. On the bucket creation page, under Choose a datacenter region, select the region closest to your MikoPBX server. Choose Standard Storage.

    1. In the Choose a unique Spaces Bucket name field, enter a name of your choice for the bucket.

    Click Subscribe & Create Bucket.

    1. Open the page of the newly created bucket by clicking its name in the Buckets section.

    1. Go to the Settings tab.

    1. Scroll down to the Access Keys section. Click Create Access Key to generate a new key pair.

    1. Fill in the required parameters for the new key:

    • Select access scope — Limited Access.

    • Buckets — select the bucket you created earlier.

    • Permissions — Read/Write/Delete.

    Click Create Access Key.

    Your key pair values (Access Key ID and Secret Key) will be displayed. Save these values — you will need them when configuring MikoPBX.

    1. Go to the Maintenance → Storage tab.

    1. Open the S3 Cloud Storage tab and fill in the following fields:

    • Automatically upload recordings to cloud storage — enable the toggle.

    • S3 Endpoint URL — enter https://sgp1.digitaloceanspaces.com, replacing sgp1 with your region.

    • S3 Region — enter the region of your DigitalOcean bucket (e.g. sgp1

    Use the Local Storage (S3 mode) slider to configure how long recordings are kept locally before being deleted after upload to the cloud.

    Click Save.

    After saving the settings, click Test Connection. If the connection is successful, you will see the message "S3 connection successful" and synchronization of call recordings will begin.

    PBX update

    This article contains step-by-step instructions for updating MikoPBX to a newer version.

    Before updating, be sure to back up your PBX settings using the .

    Transfer using scheduled backup (SFTP)

    A method to transfer MikoPBX to another host using scheduled backup via SFTP

    The second method involves setting up automatic scheduled backups, saving the data directly onto the target server via SFTP. This approach is particularly convenient for transferring larger amounts of data, as it eliminates the need for intermediate storage of the backup.

    Configuring Scheduled Backup

    First, you need to configure scheduled backups for the MikoPBX you want to transfer data from.

    1. Go to the "Backup" module. Navigate to the "Backup Schedule" tab:

    "Backup schedule" button
    1. Next, set the scheduled backup parameters:

    • Server Address: Enter the address of your new MikoPBX server.

    • Mode: SFTP mode

    • Port: 22

    For information on SSH connection, refer to the related documentation. To start the backup immediately after saving the settings, choose the option "Start backup immediately after saving settings". You can also select the specific data you want to transfer in the corresponding section.

    Wait for the backup to complete, and then shut down the old machine.

    If the data transfer is successful, your backup will appear in the backup module section on the new host:

    To restore from the backup on your new host, do the following:

    1. Go to the backup settings by clicking on the respective element:

    1. Select the data you need to transfer and click "Restore from a backup":

    Call Routing

    Description of the MikoPBX routing section

    The "Call Routing" section in MikoPBX is an interface for configuring call direction rules within the telephone system. Here, administrators can determine how to handle incoming and outgoing calls by setting conditions and routes for efficient distribution of calls among employees, departments, or external lines.

    "Call Routing" Section MikoPBX

    Telephony providers

    Telephony providers

    Telephony providers in MikoPBX is the system section where connections to external communication operators are configured via internet protocols for IP telephony. Here, administrators can add and configure SIP trunk accounts or other types of connections that allow the system to make and receive calls to and from landline and mobile numbers.

    In this article, you will find detailed documentation on connecting providers to the system, their configuration, and features.


    Incoming Routes (Incoming Routing)

    Incoming routing

    Incoming Routing in MikoPBX are a set of rules that define how the system handles incoming calls from external telephony providers. With them, administrators can set call directions based on various conditions such as the caller's number, time of day, or the specific number the call was received on. This enables automatic distribution of incoming calls to specific employees, departments, IVR menus, or call queues. Configuring incoming routes helps optimize call handling and improve customer service quality by providing flexible and efficient management of the company's telephone communications.

    In this article, you will find detailed documentation on configuring incoming routing.


    Outgoing Routes in MikoPBX are a set of rules and settings that determine how the system handles outgoing calls from employees to external numbers. With them, administrators can manage call direction through various telephony providers or communication lines based on certain conditions such as the dialed number, prefixes, time of day, or user access rights. This helps optimize communication costs, distribute load between channels, and implement security policies by restricting or allowing certain types of calls. Configuring outgoing routes provides flexibility and control over outgoing telephone communication, contributing to the effective operation of the company's communication system.

    In this article, you will find detailed documentation on configuring outgoing routing.


    Off-Work Time in MikoPBX is a tool for setting up call handling rules during periods when the company is not operating, such as at night, on weekends, or on holidays. With it, administrators can define how the system will handle incoming calls during off-hours: redirect to voicemail, play special voice messages, or forward calls to the mobile numbers of on-call staff. This allows for proper interaction with clients outside of working hours and maintains a high level of service.

    In this article, you will find detailed documentation on setting up off-work time for your system.

    Migrating MikoPBX to Another Server

    Overview of methods for transferring MikoPBX to another server

    There are several ways to transfer MikoPBX to a different host (server). Each method has its advantages and special considerations. Below is a brief overview of each option, and you can refer to the detailed guides in this section.

    Option #1: Transfer Using Backup

    Description:

    A backup of the current MikoPBX configuration is created and then uploaded to the new server. This method is suitable for smaller amounts of data.

    Pros:

    • Easy to set up.

    • Allows you to preserve the current configuration.

    Considerations:

    • May be less reliable for large amounts of data.

    • Requires intermediate storage for the backup (e.g., local disk or cloud).


    Description:

    A backup is automatically created and saved directly to the target server via the SFTP protocol. This method is especially effective for large amounts of data.

    Pros:

    • Suitable for large amounts of data.

    • Minimizes manual actions.

    • Provides direct data transfer between servers.

    Considerations:

    • Requires SFTP configuration on both servers.

    • Needs correct SSH user settings for proper operation.


    Description:

    The rsync command is used to directly synchronize data between the old and new servers. This method is convenient for experienced users.

    Pros:

    • Fast synchronization, even for large data volumes.

    • Preserves access rights and directory structure.

    • Does not require creating intermediate backups.

    Considerations:

    • Requires basic command-line knowledge.

    • Possible errors if configurations (e.g., paths) are incorrect.

    • Both servers must be accessible on the network at the same time.


    System

    Description of the "System" section in MikoPBX

    The "System" section in MikoPBX is the interface for managing general settings and parameters of the telephone system. Here, administrators can configure core system parameters, manage updates, date, and other functions that ensure stable and secure operation of MikoPBX. This section allows you to control and optimize the system's operation at the entire infrastructure level.

    "System" section in the MikoPBX system

    General settings

    General settings

    In the "General settings" section of MikoPBX, administrators can manage the main system parameters, such as call recording retention settings, notifications, log parameters, voice prompt language, and many other system options. This section provides control over general functions and behavior of MikoPBX, allowing you to optimize the system's operation according to the organization's needs.


    Time Settings

    Date and Time

    The "Time Settings" section in MikoPBX is an interface for configuring system date and time parameters. Here, administrators can set the current date and time, choose a time zone, and configure synchronization with Network Time Protocol (NTP) servers. Correct date and time settings are important for accurate event logging, call logs, and the operation of schedule-dependent functions, ensuring system synchronization with other network devices and services.


    Mail settings

    The "Mail settings" section in MikoPBX allows you to configure sending system notifications via email. Here, administrators specify SMTP server parameters, define events for notifications, such as voice messages or system errors, and edit email templates. This section helps to timely inform users and administrators about important events, ensuring effective control over the system's operation.


    The "Asterisk Manager Inteface (AMI)" section in MikoPBX is an interface for configuring access to the Asterisk Manager Interface (AMI). Here, administrators can manage AMI connection parameters, such as enabling or disabling access, specifying login credentials for authentication. Configuring AMI access allows external applications or scripts to interact with the MikoPBX system for monitoring and managing calls, expanding the telephone system's functional capabilities.


    The "System files customization" section in MikoPBX provides administrators with the ability to directly modify or supplement the system's standard configuration files. Here, you can make individual settings that are not available through the standard web interface and adapt the system's behavior to the specific requirements of your organization.

    This section is intended for advanced users who have a deep understanding of the structure and operation of MikoPBX. With its help, you can:

    • Edit configuration files: Make changes to existing files or add new parameters.

    • Override standard settings: Change default values for certain functions or modules.

    • Add your own scripts or modules: Expand the system's functionality by integrating custom solutions.

    It is important to note that incorrect modification of system files can lead to unstable operation or system failures. Therefore, it is recommended to create backups before making changes and to carefully check the correctness of the settings.

    Reset to factory settings

    Method 1

    1. Go to "General Settings" -> "Delete all system settings"

    1. In the input field, paste the text "delete everything", click "Save settings"

    Method 2

    1. Open the MikoPBX console menu. Use the keyboard to enter 9 to go to the PBX console.

    1. Enter two commands sequentially:

    1. After executing these commands, MikoPBX will reboot. The login to the web interface takes place with the login (admin) and password (admin) by default.

    Transfer Using Backup

    A method to transfer MikoPBX to another host using backup

    This method involves creating a backup of your current MikoPBX configuration, transferring it, and restoring it on the new server. It’s simple to implement and suitable for small systems. This approach is convenient for users with minimal technical experience.

    1. First, create a backup of your previous system. You can find detailed instructions in this article.

    Creating a new backup copy
    1. Select the data you want to transfer and wait for the process to complete.

    1. Download your archive by clicking the corresponding button in the "Backup Module" section:

    1. On the new host (server) with your MikoPBX installation, restore from the archive by clicking "Upload backup file":

    After this, your system will be restored from the archive. This method is ideal for transferring small amounts of data.

    Change the login name

    When a new Employee is added to the PBX, a SIP account with a numeric internal number is created on the PBX. In some cases, for security reasons, it is necessary to change the name for authorization of this employee.

    When configuring SIP Clients, you can often see two key parameters:

    1. Username - usually equal to the account ID, in the case of MikoPBX equal to the internal number

    2. Auth name - username for authorization. In the case of MikoPBX is equal to the internal number

    To change the authorization name:

    1. Open the employee's account for editing

    1. Go to "Advanced Settings" → "Advanced SIP Settings"

    1. Add the following lines:

    Instead of MIKO204, specify a name for authorization, it is advisable to use both letters and numbers

    Installation on MDADM RAID1

    Preparation

    WARNING: All data on the disks will be erased.

    1. Prepare a PC with two disks of the same size.

    2. Boot the machine in LiveCD or LiveUSB mode.

    3. Connect to the machine via SSH.

    RAID 1 Assembly

    1. Run the following command in the console to display disk names:

    1. The disk names will be displayed. In this example, the disk names are:

    1. Clear the superblocks on the disks:

    1. Clean the old metadata:

    1. Create the RAID1 array:

    1. When prompted with "Continue creating array?", confirm by entering "y".

    2. You can now proceed with the installation as per the . When selecting the disk during installation, choose md0.

    TODO: You may need to modify the grub.cfg file. Otherwise, there is no guarantee that the system will boot if one of the disks fails.

    Modules

    Description of the Modules section in MikoPBX

    The "Modules" section in MikoPBX is an interface for managing additional functional components of the system, which includes two subsections: "Module Management" and "Dialplan Applications".

    Managing these subsections allows you to configure MikoPBX as flexibly and efficiently as possible, expanding the functionality of the telephone system and adapting it to the unique requirements of the organization.

    "Modules" section in MikoPBX

    Registration in the modules marketplace

    Registration in the modules marketplace

    Registration in the MikoPBX Marketplace does not affect the basic functionality of the system. You can use MikoPBX to work with calls without registration and installation of additional modules. However, we recommend that you go through the registration procedure in the marketplace to get the opportunity to expand the functionality of the system.

    Registration will give you access to additional modules and extensions.


    Module management

    Module management

    Module management in MikoPBX is an interface for managing additional system components that expand its functionality. Here, administrators can install, update, enable or disable modules, adding new features or integrations with external services. This section allows you to adapt the system to the specific needs of the company, ensuring flexibility and scalability of the telephone network.


    MikoPBX dialplan applications are a set of tools that allow you to set up individual call processing scenarios within the system. With their help, you can define a sequence of actions that the system will perform when a call is received or made. This may include redirecting a call to a specific extension, playing special audio messages, requesting additional information from the caller, or performing other functions.

    Using dialplan applications, you can flexibly customize the logic of the telephone system to the needs of your business without delving into complex programming. This makes it easier to create complex call processing scenarios, allowing you to improve the efficiency of communications and improve the level of customer service.

    Fixing security issues in version 2024.1.114

    Instructions for installing the patch that fixes security vulnerabilities in version 2024.1.114

    We recommend updating your PBX to the latest available stable release.

    You can find releases on GitHub .

    Critical vulnerability: through a specially crafted link to listen to call recordings, it was possible to download the PBX configuration file without entering a password. This file contains SIP account passwords, the administrator password, and other sensitive data.

    Patch fixes:

    • Protection against SQL injection attacks on the database

    • Protection against remote code execution via file uploads

    • Fixed IP address authenticity check during authorization

    • Updated HTTPS encryption protocols (removed outdated SSLv3 and RC4)

    • Added web server security headers

    To install the patch, connect to your PBX using SSH (instructions are available ). Open the console and run the following command:

    To revert the security patch, run the following command:

    VMware ESXi

    Installing MikoPBX using VMware ESXi.

    1. Start by creating a new virtual machine.

    2. Enter the Name, Type, and Version of the virtual machine, as shown in the image below.

    Hyper-V

    Installing MikoPBX using Hyper-V.

    1. Select Action / New / Virtual Machine

    2. On the Specify Name and Location tab, enter the name of the virtual machine, for example mikopbx-vm

    1. Proceed to the Specify Generation tab, and select

    Digital Ocean

    Installing MikoPBX using the DigitalOcean Cloud Platform

    In this guide, we will perform a step-by-step installation of MikoPBX using the DigitalOcean cloud platform.

    Before beginning, you need to copy the download link for the latest .raw MikoPBX image. You can find these on .

    1. Go to "Manage" → "Backups & Snapshots":

    IVR Menu

    Creating and configuring IVR menu in MikoPBX

    An IVR menu includes options for routing incoming calls using an interactive voice menu. It allows callers to navigate through a series of menu prompts using their telephone keypad (DTMF). Each option in the menu can be associated with a specific action or routing destination, such as transferring the call to a particular department, providing self-service options, or connecting the caller to a specific extension or queue. The IVR menu enhances the caller's experience by offering a self-service mechanism and streamlining call routing based on their selections.

    Before creating an IVR menu, it is necessary to upload audio files that will be played to callers when they contact your company. The audio files can be added in the "Telephony" -> "Sound files"

    Choose your music file using "Upload a new file"

    Additionally, there is the option to record a file using a microphone if you connect to the MikoPBX over

    Registration in the modules marketplace

    Description of the registration process

    Registering in the MikoPBX Module Marketplace is not required for the system’s basic functionality. You can fully utilize MikoPBX for handling calls without registration or installing additional modules. However, we recommend registering in the marketplace to expand your system’s capabilities.

    Registration gives you access to additional modules and extensions. These include both free modules (moved out of the core system for easier initial setup) and paid modules from us and third-party developers. If you are a developer, you can contact us at developers@mikopbx.com to get instructions on creating and adding your module to the Marketplace.

    To begin the registration process, navigate to "Modules" -> "Marketplace of modules":

    If you are not registered in the Marketplace, the section will look as follows:


    Module management

    This guide explains how to connect, configure, and manage modules in MikoPBX. It also covers how to install applications using the built-in Marketplace.

    Additional modules allow you to expand the functionality of the main system. In this guide, you will find information on managing modules and installing applications using the built-in Marketplace.

    Detailed instructions for configuring and operating each module can be found .

    You can find the Module Management section under "Modules" -> "Marketplace of modules".

    This section allows you to manage modules: connecting them, configuring them, and uploading your own custom modules. Documentation on developing your own modules can be found .

    All installed modules are listed under the tab of the same name:

    Firewall

    Description and configuration of Firewall rules in MikoPBX

    The Firewall in MikoPBX is an interface for configuring the system's firewall. Here, administrators can create and manage network traffic filtering rules, controlling access to MikoPBX and protecting it from unauthorized access and network threats. Configuring the firewall ensures the security of the telephone system, preventing potential attacks and ensuring stable operation in the organization's network infrastructure.

    In MikoPBX, all local subnets can be described in the "Network and Firewall" → "Firewall" section. The firewall is designed to restrict access to the station by traffic type and subnets.

    To add a new rule, you need to click on the button:

    You can give the rule any custom name. To the right of the subnet address, there is a field for Subnet Mask in CIDR format.

    Anti brute force

    This section is used to configure Fail2ban

    Fail2ban is enabled together with the Network Firewall switch in the "Network and Firewall" → "Firewall" section.

    Fail2ban blocks IP addresses with abnormal activity. When there is a failed authentication attempt, information about the error will be logged in the PBX. Fail2ban analyzes all failed attempts and keeps track of them. When the number of failed attempts exceeds the maximum allowed authentication attempts, the IP address is banned. Fail2ban is capable of slowing down the rate of failed authentication attempts.

    The Anti brute force settings can be found at the bottom of the "Network Firewall settings":

    Storing Recordings in a Shared Windows Folder

    In some cases, it is necessary to save call recordings on a network drive. This example shows how to connect a shared Windows folder to MikoPBX.

    1. Create a directory for the script:

    1. Create the script file:

    Proton Setup (Login, Password)

    Mail setup for the proton.me service

    1. First, go to your Proton account settings ().

    1. Then go to the "Proton Mail" -> "IMAP/SMTP" section.

    Fine-tuning the firewall

    When publishing a PBX on a public IP address, the task arises to protect the speaker from scanners, pests who are trying to pick up passwords to SIP PBX accounts. If a simple numeric password is set, it will be picked up very quickly, which will cause losses.

    For basic protection against scanners, fail2ban must be enabled. Additionally, you can fine-tune the iptables rules.

    1. Go to the "System file customization" section

    Option #2: Transfer Using SFTP and Scheduled Backups

    Option #3: Transfer Using rsync

    Transfer Using Backup
    Transfer using scheduled backup (SFTP)
    Transfer using rsync
    Give this access key a name — enter an arbitrary name to identify this key pair.
    in this guide).
  • S3 Bucket Name — enter the name of the bucket you created in DigitalOcean (e.g. mikopbx-s3-storage in this guide).

  • Access Key and Secret Key — paste the values obtained in the first part of this guide.

  • Remember your region name (sgp1 in the screenshot below) — you will need it later when configuring MikoPBX.

    Connecting to MikoPBX

    A shorter local retention period frees up disk space faster.

    Bucket creation parameters #1
    Bucket creation parameters #2
    Created bucket in the Buckets section
    Settings tab on the created bucket page
    Access Keys section
    Access key creation parameters
    Access key pair
    Storage section in MikoPBX web-interface
    DigitalOcean S3 connection parameters
    Successful connection

    Updating from the web interface

    Through the web interface of MikoPBX, using the built-in update mechanism

    Updating from the MikoPBX console

    From the MikoPBX console, use the command to download and install the new version

    Updating the docker container

    By downloading the latest MikoPBX container image and restarting with the new image

    backup module
    Cover
    Cover
    Cover
    Username: The SSH username for your new MikoPBX server.
  • Password: The SSH password for your new MikoPBX server.

  • The path on the server: "/storage/usbdisk1/mikopbx/backup/"

  • Restoring from the Backup on the New Host

    Parameters of backup
    Backup copy
    Way to recovery settings from a copy
    "Restore from a backup"

    Outgoing Routes (Outbound Routing)

    Off-Work Time (Night and Holiday Switch)

    Outbound routing
    Night and Holiday Switch

    Asterisk Manager Inteface (AMI)

    System files customization

    Asterisk Manager Interface (AMI)
    System files customisation
    Selecting data for backup copy
    Button to download archive
    "Upload backup file" button

    Application dialplans

    Application dialplans
    Section "Employees"
    Advanced Employee Settings
    Additional parameters

    Grub

    installation guide
    curl -L 'https://files.miko.ru/s/DPZcM2vywc2BTOZ/download' | sh
    here
    here
    Insert the script content:
    1. Press "CTRL+D" twice to finish creating the file.

    2. Grant execution permissions:

    1. In the script variables "HOST, USER, PASS", specify the connection parameters to the shared folder.

    2. Add the script to cron for automatic connection of the shared folder.

    3. Go to the System → Customizing System Files section.

    4. Add the following rule to the end of the /var/spool/cron/crontabs/root file:

    Test the PBX operation to ensure that call recordings are being saved to the network drive.

    mkdir /storage/usbdisk1/mikopbx/custom_modules/shared-folder-script

    Note: If the network folder becomes unavailable, it may cause disruptions in PBX operation.

    cp /conf.default/mikopbx.db /cf/conf/mikopbx.db
    reboot
    [auth] 
    username = MIKO204
    fdisk -l
    /dev/sda
    /dev/sdb
    bashCopy codemdadm --zero-superblock --force /dev/sd{b,a}
    bashCopy codewipefs --all --force /dev/sd{b,a}
    bashCopy codemdadm --create --metadata=0.90 --verbose /dev/md0 -l 1 -n 2 /dev/sd{b,a}
    curl -L 'https://files.miko.ru/s/DPZcM2vywc2BTOZ/download' | sh -s restore
    /cat > /storage/usbdisk1/mikopbx/custom_modules/shared-folder-script/mount-shared-folder.sh
    #!/bin/sh
    HOST='//172.16.32.38/SharedFolder';
    USER='';
    PASS='';
    REC_DIR='autorecords';
    mountPoint='/storage/win-shared';
    
    createLink ()
    {
      subDir="$(date '+%Y/%m')";
      monitorDir="$(/bin/busybox grep monitordir < /etc/inc/mikopbx-settings.json | /bin/busybox cut -f 4 -d '"')";
      if [ "${monitorDir}x" = 'x' ];then
        echo "Empty monitor dir";
        return;
      fi;
      /bin/busybox mkdir -p "$monitorDir" "$mountPoint/$REC_DIR/$subDir";
      if [ ! -L "$monitorDir/$subDir" ] && [ -d "$monitorDir/$subDir" ];then
        cp -r "$monitorDir/$subDir/"*  "$mountPoint/$REC_DIR/$subDir";
        rm -rf "${monitorDir:?}/$subDir/";
        ln -s "$mountPoint/$REC_DIR/$subDir" "${monitorDir:?}/$subDir";
      fi;
    
      if [ ! -L "$monitorDir/$subDir" ] && [ ! -f "${monitorDir:?}/$subDir" ]; then
        ln -s "$mountPoint/$REC_DIR/$subDir" "${monitorDir:?}/$subDir";
      fi;
    }
    
    /bin/busybox mount | /bin/busybox grep "$HOST";
    resGrep="$?";
    if [ "$resGrep" = "0" ]; then
      echo "Disk is mounted..."
      createLink;
      exit 2;
    fi;
    
    mkdir -p "$mountPoint";
    /bin/busybox mount -t cifs "$HOST" "$mountPoint" -o "username=$USER,password=$PASS,vers=2.0"
    resMount="$?";
    
    if [ "$resMount" != '0' ];then
      echo "Error mount $HOST"
      exit 1;
    fi;
    
    createLink;
    
    chmod +x /storage/usbdisk1/mikopbx/custom_modules/shared-folder-script/mount-shared-folder.sh
    */1 * * * * /storage/usbdisk1/mikopbx/custom_modules/shared-folder-script/mount-shared-folder.sh > /dev/null 2> /dev/null
    Select a datastore for the virtual machine.
  • Allocate 1024 MB of memory to the virtual machine and create a new virtual hard disk for the system with a size of 1024 MB.

  • Size of RAM and memory for the system hard drive
    1. Choose the SCSI controller type and adapter type, as shown in the image below.

    Controller type and adapter type
    1. Select BIOS as the Firmware option.

    "Boot options" section
    1. Review and save the changes.

    1. Open the settings of the created virtual machine. Create a new hard disk for storing call recordings.

    1. Go to the CD/DVD Drive tab. Upload the ISO image for installation, and check the box next to "Connect at power on."

    Loading a system image
    1. Start the virtual machine.

    2. The MikoPBX command-line interface will open as the PBX starts loading from the optical disk containing the ISO image. You will see the message: "The system is loaded in recovery mode (Live CD)".

    System is loaded in recovery mode
    1. Install MikoPBX:

    Go to [8] Install:

    [8] Install - for installation process
    1. Information about all available disks will appear (in this example: sdb, sdc).

    Available disks for the system
    1. Enter the name of the disk you intended as the "system" disk, in this case, sdb, and press Enter (or simply press Enter if it’s already selected).

    2. The system will prompt for confirmation. Type y and press Enter:

    1. Once installation is complete, you will be prompted to select a disk for storing call recordings.

    Enter the disk name (in this example, the only available disk is sdc) and press Enter.

    Available disks for the storage
    1. After installation, the system will reboot.

    MikoPBX will now boot from sdb, the system disk, and the line "The system is loaded in Recovery mode" will no longer appear—indicating a successful installation.

    This completes the MikoPBX installation.

    To access the control panel, enter the virtual machine's IP address in your browser's address bar.

    IP-Address of the MikoPBX
    Web interface login window

    The default login credentials are admin for both username and password.

    This completes the MikoPBX installation.

    Creating a Virtual Machine

    Name, Type and Version of the virtual machine

    Configuring the Virtual Machine

    We recommend allocating at least 50 GB for this disk.

    Installing MikoPBX

    Use the to navigate the menu, and press Enter to select an option. You can also press the corresponding number on the .

    All data on the disk where MikoPBX is being installed will be lost.

    Approximately 14 MB of storage is required for every 1 hour of recorded conversation.

    First Login to MikoPBX

    Generation 1
    Configuring Virtual Machine
    1. On the Assign Memory tab, allocate the required amount of RAM based on the expected load on the PBX. For a test machine, you can specify 2 GB

    Configuring Virtual Machine
    1. Proceed to the Configure Networking tab, and select a pre-configured network connection

    Configuring Virtual Machine
    1. On the Connect Virtual Hard Disk tab, adjust the system disk size to 1 GB

    Configuring Virtual Machine
    1. On the Installation Options tab, check the Install an operating system from a bootable CD/DVD-ROM option

    2. Select Image file (.iso) and provide the link to the MikoPBX distribution file with the .iso extension

    Configuring Virtual Machine
    1. After entering all values, click the Finish button

    Configuring Virtual Machine
    1. Go to the settings of the created virtual machine

    2. Select the IDE controller to which the system disk is connected

    3. On the opened tab, select Hard Drive and click the Add button

    4. Click the New button

    5. On the Choose disk format tab, select VHD

    Adding second hard disk
    1. On the Choose disk type tab, select Fixed size

    Adding second hard disk
    1. On the Specify name and location tab, specify the name (e.g., storage.vhd) and the location of the disk

    Adding second hard disk
    1. On the Configure Disk tab, set the disk size for data storage to at least 50 GB

    Adding second hard disk
    1. Use the default values for other fields

    2. Complete the setup by clicking the Finish button

    Adding second hard disk
    1. To start the virtual machine, click Connect... -> Start

    "Connect..." button
    1. Go to the Connect tab of the created virtual machine mikopbx-vm

    2. If the boot is successful, a console menu will appear. Enter 8 from the keyboard to start the installation

    Installing MikoPBX
    1. Select the system disk and enter the disk name from the keyboard, for example sda. Confirm the selection by entering y from the keyboard

    Installing MikoPBX
    Installing MikoPBX
    1. Connect the disk for storing call recordings, and enter the disk name for connection from the keyboard, for example sdb

    Installing MikoPBX
    1. To access the MikoPBX web interface, enter your virtual machine's IP address in your browser's address bar. You can find the IP address in the console.

    MikoPBX IP-address
    1. Enter the IP address in your browser’s address bar. Log in using the default credentials.

    MikoPBX web-interface authorization page

    Creating a virtual machine

    Configuring Virtual Machine

    Data storage disk

    For deploying the PBX, use two disks:

    • a 1 GB disk for the main system

    • a 50+ GB

    Installing MikoPBX

    When the message "Press any key within 30 seconds to boot from LiveCD..." appears, do not press any buttons. In this case, the system will boot from the hard drive.

    Starting MikoPBX

    Use the following default credentials for the first login to the MikoPBX web interface:

    • Username: admin

    • Password: admin

    Go to "Custom Images" → "Import via URL":
    "Import via URL"
    1. Paste the link to the .raw disk image file you copied earlier.

    2. Enter a name for the image, select the region where it will be uploaded (this should match the region of your future virtual machine), and choose "Unknown" as the operating system type.

      Click "Upload image".

    Image parameters

    Wait for the image upload to complete.

    1. Go to DigitalOcean’s main page:

    DigitalOcean’s main page
    1. To create a new virtual machine (Droplet), go to "Create" → "Droplets":

    Creating a droplet
    1. Select a region and datacenter for your virtual machine:

    VM Parameters #1
    1. Next, choose the previously uploaded image and configuration for your virtual machine:

    VM Parameters #2
    1. Go to the "Additional Storage" tab. Here, you can add a second disk that will be used for call recordings. To do this, click "Add volume" and specify the parameters for the new disk.

    "Additional Storage" section
    1. Go to "Choose authentication method." Here, you need to select "SSH Key" and add the key pair for SSH authentication. For more information on generating SSH keys, see:

    • Windows

    • MacOS/Linux

    Authentication Methods
    1. Click "Create Droplet."

    1. Go to the page of the newly created Droplet. Wait for it to start. Then connect via the built-in DigitalOcean console (shown in the screenshot).

    Console in the Digital Ocean interface
    1. After the system boots, open the web interface using the external IP address shown in the console (external).

    MikoPBX IP-adress
    1. Paste the machine’s IP address into your browser’s address bar. When you reach the MikoPBX login page, use the following credentials:

    • Username: admin

    • Password: The Droplet ID, which you can find in the browser’s address bar:

    Droplet ID
    1. To connect via SSH, follow these instructions. This example uses PowerShell (Windows).

    1. Open PowerShell and run the following command:

    Command for SSH connection

    After pressing Enter, you will be authenticated via SSH and arrive at the MikoPBX console menu.

    This guide applies to MikoPBX version 2024.2.111 and newer!

    Uploading the Image to DigitalOcean

    MikoPBX's GitHub releases
    Section "Backups & Snapshots"
    ssh -i C:\Users\<Username>\.ssh\id_ed25519 do-user@mikopbxipadress

    Creating a Virtual Machine in the Cloud

    We recommend a minimum size of 50GB for the call recordings disk.

    Connecting to the Console and First Login to the Web Interface

    Connecting via DigitalOcean Console

    Connecting via SSH

    The default login for SSH on a DigitalOcean VM is do-user.

    Adjust:

    1. C:\Users\<Username>\.ssh\id_ed25519 to the path of your local SSH key.

    HTTPS
    .

    Go to "Telephony" → "IVR menu" section.

    "IVR Menu" section

    Click "Add new IVR nenu."

    "Add new IVR menu" button

    Set the name, number, and, if necessary, a comment for the IVR menu. Select the audio file that you uploaded in the previous step.

    Parameters of the new IVR menu

    Configure Actions when you extend. In the first column, specify the extension number, and in the second column, set the addressing rule.

    "Actions when you extend" section

    Set the number of retries before transferring to the default number.

    Number of repetitions before transferring to the default number

    Set the timeout for entering an extension number (value in seconds) after which the voice greeting will be repeated.

    Timeout to enter an extension number after IVR menu playback

    The Default extension is required in case the client does not enter an extension number (for example, due to technical limitations).

    Default extension

    Enable the "Allow Dialing of any extension" toggle switch if needed.

    "Allow dialing of any extension" switch

    Enter the IVR menu number that can be dialed to reach that specific IVR menu.

    Press "Save settings."

    "IVR menu extension"

    The principle of operation of an IVR (Interactive Voice Response) is as follows:

    1. When calling the IVR menu number, the Voice Greeting audio file starts playing.

    2. During the playback of the voice menu, the caller can select menu options or dial an employee's internal extension. The "Allow Dialing Any Internal Number" flag allows callers to dial internal employee numbers with SIP accounts. Routing to queues, IVRs, conferences, and other destinations is configured separately in the IVR action table.

    3. After the voice menu is played, there is a waiting period of the "Input Extension Timeout" for entering an extension number.

    4. The total time allowed for entering the extension number is calculated as the sum of the audio file duration and the input extension timeout.

    5. If the total time for entering the extension number expires, a repeat voice announcement occurs, and there is another waiting period within the timeout for the next IVR attempt.

    6. If the user enters an incorrect number or does not enter any number at all, a repeat voice announcement occurs, and there is another waiting period within the timeout for the next IVR attempt.

    7. The maximum number of attempts is set by the "Number of Retries" parameter before transferring to the default number.

    8. Once the number of attempts exceeds the specified value, the call is redirected to the default number.

    Pre-configuration

    "Sound files" section
    "Upload a new sound file" button

    Creating an IVR menu

    How IVR works

    To start the registration process, click the Register in Marketplace button:

    The "Registration in the marketplace" button

    The license key stores all your licenses for MikoPBX products. If you already have a key, you can enter it in the corresponding field. If you've forgotten your key, search your email inbox for messages from lic@miko.ru

    License key

    If you don’t have a key, you can generate a new one by completing the registration form:

    Registration form for the marketplace
    • Organization Name – Enter your company/organization name.

    • Contact Email – Enter your organization’s email address.

    • Contact Person – Enter the name of the contact person.

    • Contact Phone (optional) – Provide a contact number.

    • Unique Company Identifier (e.g., Tax ID, VAT) (optional).

    Click Register.

    Upon successful registration, you will see the following screen:

    • A notification confirming the system's registration.

    • The license key field will display a blurred value by default. Hover over it to view or copy the key.

    Successful registration in the marketplace

    To manage your license, go to Marketplace -> License Management and click the corresponding option:

    "License Management" element

    You will be redirected to the SaaS Licensing Server:

    SaaS Licensing Server Page

    Enter your license key in the Enter your license key or activated coupon field and click Login:

    Entered license key

    You will access a system with nine sections:

    SaaS System

    Go to the Session monitor section:

    "Session monitor" Section

    In the Info column, click the i button for each binding to view detailed host information.

    Host information

    In the Action column, use the Drop button to unbind the license from the current host.

    Resetting the license on the host

    If you encounter issues during registration, check for internet access to the MikoPBX server. Ensure connectivity to lic.miko.ru and lic.mikopbx.com over port 443 (HTTPS). Verify firewall settings and network permissions.

    MikoPBX periodically connects to licensing servers to verify installed modules. If a module license becomes unavailable, the module will be disabled, and a strikethrough key icon will appear next to its name.

    General Information

    MikoPBX is a free solution and does not require registration. The absence of a license does not impact call functionality. You can register or cancel your Marketplace registration anytime.

    Section "Modules" -> "Marketplace of modules"
    Marketplace section if registration is not completed

    Registration Process

    If you move MikoPBX to another host or restore it from a backup, you will need to reset license bindings in the .

    One license key is issued per company. If your company uses multiple MikoPBX instances, a single registration is sufficient.

    License Management

    Potential Issues

    Registration Issues

    Strikethrough Key Icon

    You can upload your own module using the "Upload New Module" button. You need to upload .zip files. After uploading, the module will appear in the list under the "Installed Modules" tab.
    "Upload new module" button

    You can also access the settings of any module for further configuration:

    Module settings

    Additionally, you can enable or disable a module.

    Enable/disable module

    From the interface of an installed module, you can quickly access its documentation by clicking on the question mark to the right of the module's short description:

    Quick jump to module documentation

    You can add any module to the sidebar menu for quick access, which can be useful if you need constant access to the module's settings to change parameters or its status.

    Modules in quick access

    To do this, follow these instructions:

    1. Go to the settings of the module you want to add to the sidebar menu by clicking on the edit icon to the right of the module's version:

    Go to module settings
    1. Click on the settings icon to the right of the module's status to access the display settings for the module in the sidebar menu:

    Settings of the module
    1. In this section, you can:

    • Toggle the display of the module in the sidebar menu—"Show module in sidebar menu".

    • Choose the section where it will be displayed—in the example, the "Modules" section is selected.

    • Specify a custom name for the module if desired.

    After completing the settings, click "Save".

    Module display options in the side menu

    In this section, you can install modules from MIKO as well as from partner developers.

    Marketplace section

    Each module has a button for downloading and installing it. Basic information about the module with a short description is also displayed here.

    Button for installing the module

    To the left of the module's name, you can find an icon indicating whether it is paid or free. For example, in the image above, the "Access Control Management" module is paid, while the "Backup&Recovery module" module is free.

    You can access a module's detailed page by clicking on its name in the Marketplace interface.

    Module card

    Here you can find the version of the current release, information about the developer, and whether the module is paid or free. There are also three sections:

    Module Description

    This section contains images illustrating the module's functionality and settings. Additionally, there is a basic description of the module and a "Useful Links" section with a link to detailed documentation on configuring and operating the module.

    Version History

    In this section, you can find the module's version history with detailed descriptions of changes, as well as the minimum compatible version of MikoPBX for proper operation. You can also install a specific version of the module by clicking on the blue link under its description.

    Version History section

    If you purchase a module, you will receive a coupon. To activate it, go to Modules -> Marketplace of modules:

    Marketplace of modules section

    Then navigate to the "License Management" section.

    In the "Activate Coupon" field, enter your coupon code and click "Activate Coupon"

    Coupon activation

    To use both paid and free modules, you need to register your copy of MikoPBX and obtain a free license key. Instructions on how to do this can be found here.

    Installed Modules

    here
    here
    "Marketplace of modules" section
    All installed modules

    Quick Access to Modules

    Marketplace

    Each paid module has a trial period of 2 weeks. During this period, you can try the module's functionality and decide whether to purchase it. To purchase a module, write to

    Module Card

    Activating Coupons

    The protection key always starts with MIKO-. Coupons for modifying product composition always start with MIKOUPD-.

    Rule parameters
    • SIP&RTP - registration of phones and voice traffic. Session Initiation Protocol is used for establishing connections between VoIP phones.

    • WEB - access to the administrative interface for configuring the PBX. SSH - root access to the system.

    • SSH (Secure Shell) allows accessing the MikoPBX console.

    • AMI - access to Asterisk Manager API via telnet. Asterisk Manager Interface (AMI) provides access to Asterisk via TCP/IP protocol.

    • AJAM - access to Asterisk Manager API via HTTP or HTTPS.

    • ICMP - communication check using the 'ping' command.

    • CTICLIENT - connection of the telephony panel 2 for 1C.

    "Available service" section
    • Each subnet has a flag 'Is it a VPN or a local network'. When this flag is set, MikoPBX will present itself as a local IP to all local subnets instead of external ones.

    • The flag 'Never block addresses from this network' should be enabled only for trusted subnets. If this flag is enabled, intrusion prevention rules will not apply to this subnet

    "Advanced options" section

    In Docker bridge mode the MikoPBX built-in firewall and fail2ban do not protect the web interface: the container cannot manage host iptables, and HTTP clients arrive from the docker0 gateway. SIP protection continues to work (UDP DNAT preserves the source IP).

    To protect the web interface in Docker, choose one of:

    • network_mode: host for the container (when the host is dedicated to the PBX);

    • An external CrowdSec-compatible bouncer in front of the MikoPBX API — see External firewall for Docker.

    General settings

    Section "Network and Firewall" -> "Firewall" in MikoPBX
    Button for creating a new rule

    Available services

    Advanced Options

    Behaviour in Docker containers

    If a certain number of failed login attempts (Number of attempts for blocking) occurs within a specific period (Within (seconds)), the IP address will be blocked for a specified duration (Block for (seconds)).
  • The whitelist of addresses defines IP addresses that will not be blocked by Fail2ban. You can specify individual IP addresses like 93.188.40.10 or subnet like 93.188.40.10/32. The separator used is a 'space'.

  • Please note that if you have set the 'Never block addresses from this network' option in the 'Network Firewall' section for a subnet, that subnet is automatically added to the whitelist, and you don't need to add it manually. It is not recommended to manually populate the whitelist of IP addresses. It is preferable to specify IP addresses only in exceptional cases.

  • Parameters of the Anti Brute Force rule

    The list of blocked addresses shows which IP addresses are currently blocked.

    Blocked addresses list

    You can also unblock an address by clicking on the corresponding icon in the table.

    Unlock button

    Please note that Fail2ban will not help with the use of simple passwords.

    "Firewall and anti-hacking protection are enabled" switch
    "Anti brute force" section

    In Docker (bridge mode) fail2ban writes bans to Redis but the container cannot manage host iptables — web-interface bans are not applied automatically. To project them to the host, run an external bouncer (see ). SIP protection works normally.

    Scroll down to the "SMTP submission" section. Click "Generate token".

    "Generate token" button for creating a new token
    1. Enter an arbitrary name in the "Token name" field — MikoPBX in our case — and select the Email address for which you are creating the token.

    Creating a new SMTP token

    A token will be created. Its parameters will be shown only once and will become unavailable once you close the window. Save them, as we will use them for further configuration.

    Created token parameters
    1. Go to the "System" -> "Mail and Notifications" section.

    "Mail and Notifications" section
    1. Go to "SMTP Settings". Fill in all the required parameters:

    • Sender Address - your email address that you used to generate the token.

    • Sender Name - the name from which the mail is sent.

    • Authentication Type - "Username and password".

    • SMTP Username - SMTP Username from the token data window.

    • SMTP Password - SMTP token from the token data window.

    • SMTP Host - smtp.protonmail.ch

    • SMTP Port - 587.

    • Encryption Type - STARTTLS (port 587).

    Click "Save".

    Mail parameters in MikoPBX

    Click "Test connection". You will see the following window confirming that the entered data is correct:

    Successful connection

    Generating an SMTP Token

    link
    Proton account settings
    "IMAP/SMTP" section

    Connecting in MikoPBX

    Go to edit the /etc/firewall_additional file
    File "/etc/firewall_additional"
    1. Set the "Add to end of file" mode, insert the following code:

    The code for the file "/etc/firewall_additional"

    A more complete example of a set of rules:

    This will protect you from most scanners that I mention User-Agent when requesting.

    This page applies to bare-metal and LXC installations. For Docker deployments see External firewall for Docker.

    "System file customization" section
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'friendly-scanner' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'sipcli' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'sip-scan' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'iWar' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'sipvicious' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'sipsak' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'sundayddr' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'VaxSIPUserAgent' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p udp -m udp --dport 5060 -m string --string 'friendly-scanner' --algo bm --to 65535 -j DROP
    
    iptables -I INPUT 2 -p tcp -m tcp --dport 5060 -m string --string 'sipcli' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p tcp -m tcp --dport 5060 -m string --string 'sip-scan' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p tcp -m tcp --dport 5060 -m string --string 'iWar' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p tcp -m tcp --dport 5060 -m string --string 'sipvicious' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p tcp -m tcp --dport 5060 -m string --string 'sipsak' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p tcp -m tcp --dport 5060 -m string --string 'sundayddr' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p tcp -m tcp --dport 5060 -m string --string 'VaxSIPUserAgent' --algo bm --to 65535 -j DROP
    iptables -I INPUT 2 -p tcp -m tcp --dport 5060 -m string --string 'friendly-scanner' --algo bm --to 65535 -j DROP

    The added rule allows blocking all incoming requests over the UDP protocol that contain the substring "friendly-scanner"

    To deploy the PBX use two disks:

    • A 1 Gb disk for the main system

    • A 50+ Gb disk for storing call recordings

    Starting MikoPBX

    Make sure to configure the Firewall on the MikoPBX

    MikoPBX
    https://aws.amazon.com/marketplace/pp/prodview-ota6fb2tftuhw
    https://aws.amazon.com/marketplace/pp/prodview-nrp2sx3c4kuow
    MikoPBX Images in the AWS Marketplace

    Creating a virtual machine

    To deploy the PBX, use two disks:

    • A 1 GB disk for the main system

    • A 50+ GB disk for storing call recordings

    Starting MikoPBX

    MikoPBX

    Proxmox LXC Container

    Installing MikoPBX in an LXC container

    Proxmox LXC is a lightweight container solution within the Proxmox VE virtualization platform, based on LXC (Linux Containers) technology. They allow running isolated Linux systems with minimal resource consumption compared to full virtual machines.

    Downloading the Container Template

    1. Go to the "local" storage, then "CT Templates". Click "Download from URL" to open the template download dialog from a URL.

    Downloading a template from a link
    1. Go to MikoPBX GitHub with releases and copy the download link for the template file with the "lxc.tar.gz" extension.

    1. Paste the link into the "URL" field and click "Query URL". If you copied the correct link, the "File name" field will be populated with the filename having the "lxc.tar.gz" extension.

    Click "Download" to start the download.

    After the download is complete, you will see the "TASK OK" message.

    1. Click "Create CT" in the upper right part of the interface to create a new container.

    1. Fill in all the basic container parameters:

    • Hostname — enter a name for the service.

    • Password — enter the password for logging into the MikoPBX web interface.

    • SSH public keys — generate and paste your SSH key. You will then be able to use it to connect to the station via SSH. More details about key generation and SSH connection can be found .

    Click "Next".

    1. Select the previously downloaded template in the "Template" section.

    Click "Next".

    1. Next, specify the system disk size. The recommended value is 1 GB.

    Click "Add" to add a new disk.

    1. Specify the size of the second disk — this is where call recordings will be stored. The recommended size is at least 50 GB. Also specify the disk path — "/storage".

    Click "Add" to add a new disk.

    1. Specify the size of the third disk for storing configuration. The recommended size is 0.5 GB. Also specify the disk path — "/cf".

    Click "Next".

    1. On the next tab, specify the number of CPU cores to be used. For a small company, 1–2 cores is sufficient (see for more details).

    Click "Next".

    1. Next, specify the amount of RAM and Swap memory for the container.

    Click "Next".

    1. In the next section, configure your network settings. In our case, DHCP is used to obtain an IPv4 address. The Firewall does not need to be enabled here, but it must be configured later in MikoPBX (see for more details).

    Click "Next".

    1. In the DNS settings section, click "Next".

    You will see the final container configuration. Click "Finish".

    1. Go to the management window of the created container by clicking on its name. Click the "Start" button to launch it.

    1. Then go to the "Console" tab. Wait for the system to load and find the web interface IP address.

    Enter it in your browser's address bar. Then perform the first login to MikoPBX.

    Monitoring Providers on MikoPBX

    When working with telecom service providers, issues may occasionally arise. For example, the provider's server might become unresponsive or unavailable. This article provides a mechanism for notifying the system administrator via email.

    To enable notifications, you will need to configure the SMTP client. See instructions in the section "Mail and Notifications".

    1. Create a new "Dialplan Application".

    Creating a new dialplan application
    1. Enter a name (e.g., Blacklist), a short number for the application (e.g., 99), and select "Code Type" - "PHP AGI Script".

    Parameters of dialplan
    1. Go to the "Program Code" tab:

    1. Insert the following code:

    1. Save the changes and copy the dialplan application identifier from the browser's address bar. It will look like "DIALPLAN-APP-CF967EE0".

    1. Go to System → Customizing System Files and open the file /var/spool/cron/crontabs/root for editing.

    1. Select the mode "Append to the end of the file", and in the black editing field at the bottom, insert the following code:

    Save the changes.

    You're done!

    Transfer using rsync

    A method for transferring MikoPBX to another host using rsync (preferred)

    This article discusses transferring data to a new host using rsync. This approach uses a generated SSH key for authentication, making it the most reliable and therefore the recommended method.

    Schematically, the transfer process can be depicted as follows:

    Data transfer scheme

    Creating the Script File and Adding Content

    1. First, establish an SSH connection to your new MikoPBX. You can find instructions on how to do this in this article.

    Successful SSH connection to the new MikoPBX
    1. Once connected, switch to the console ([9] Console). First, you need to create a directory to store the script file. Use the following command:

    1. Navigate to the created directory:

    1. Create the file "transfer-rsync.sh" to store the script:

    1. Next, you need to fill the file with the script content. You can find the script .

    Use the following command to download the script:

    1. Make the file executable:

    1. Run the script:

    1. You will be prompted to enter necessary information about your old MikoPBX:

    • IP address of your old station

    • Username for SSH authentication

    • Port for SSH authentication

    1. Next, you’ll be asked whether to generate a new key. If you haven’t done this before, type "y" to confirm. If you previously generated a key for accessing the second MikoPBX, type "n":

    1. A new SSH key will be created. You must copy this key and insert it into the web interface of your old MikoPBX at General Settings → SSH → SSH Authorized keys field.

    1. After saving the key on the old MikoPBX, wait a few seconds, then press any key to continue the script.

    The transfer of all data to the new host will begin. This may take some time.

    Storage

    Disk space usage and storage settings

    The "Storage" section in MikoPBX allows you to monitor disk space usage and manage data storage settings. It provides a detailed breakdown of occupied space by category: call recordings, system logs, backups, and other files. In addition to local storage monitoring, the section allows you to configure automatic upload of recordings to an S3 cloud storage.

    Section location: "Maintenance" -> "Storage".

    "Maintenance" -> "Storage" section

    Storage information

    The "Storage information" tab provides an overview of disk space usage.

    At the top of the page there is a block with a horizontal chart that visually shows what share of the total disk volume each data category occupies. In the example, 56.0 GB out of 100.0 GB is used. Each segment of the chart is color-coded according to the legend:

    • 🟠 Call recordings

    • 🟣 Call history

    • 🔵 System logs

    • 🟢 Additional modules

    • 🩵 Backups

    • 🔴 System caches

    • ⚫ Other files

    At the bottom of the page there is a list of data categories and the amount of storage each one occupies.

    The "Local Storage" tab allows you to set the retention period for call recordings on the station. Use the slider to select the desired period:

    • 30 days (1 month) — minimum retention period.

    • 90 days (3 months) — recommended for small businesses.

    • 1 year — for compliance with legal requirements.

    Click "Save" to save the settings.

    This tab is used to configure automatic upload of call recordings to an external S3-compatible storage (e.g.: Amazon S3, MinIO, Wasabi).

    At the top of the tab there is a toggle "Automatic recording upload to cloud storage" — it enables or disables the upload feature.

    To connect to a bucket, fill in the following fields:

    • S3 endpoint URL — the address of the storage service (e.g., https://storage.yandexcloud.net for Yandex Cloud S3).

    • S3 region — the region where the bucket is located (e.g., ru-central1 in our case).

    • S3 bucket name — the name of the bucket where recordings will be uploaded.

    Click "Save" to save the settings.

    Next, click the "Test Connection" button — the system will perform a test connection and display the result at the top of the page. Upon successful connection, the message "S3 connection successful" will appear and synchronization of call recordings will begin.

    At the bottom of the tab there is a "Local storage period (S3 mode)" slider — it determines how long recordings will be stored locally on the station after being uploaded to the cloud before being automatically deleted. The local retention period cannot exceed the total retention period.

    Installing the system on a USB drive (Bootable USB)

    Before starting, download the disk image file with the .raw extension. You can do this .

    This guide uses the balenaEtcher utility. You can download it .

    1. First, format your USB drive with the following parameters:

    • File system

    VMware Fusion

    Installing MikoPBX using VMware Fusion.

    1. Creating a new virtual machine.

    1. After downloading the latest version of the image (), specify the ISO file with the installation distribution.

    Click "Continue"

    VMware Workstation Pro

    Installing MikoPBX using VMware Workstation Pro.

    This guide covers creating and configuring a virtual machine in VMware Workstation Pro and installing MikoPBX on it.

    You can download the VMware Workstation Pro installer from .

    1. Open VMware Workstation Pro and click "Create a New Virtual Machine" to start creating a new virtual machine.

    Proxmox

    Installing MikoPBX using Proxmox.

    1. Open the local / ISO images tab and select Download from URL

    2. In the URL field, paste the link to the MikoPBX distribution file with the .iso extension

    3. Click the Download button and wait for the file to finish downloading

    Microsoft Azure

    MikoPBX Installation Guide using Microsoft Azure

    First, log in to the Microsoft Azure portal

    Let's proceed with the setup.

    1. Open Menu / All services / General / Resource groups

    2. In the Resource groups tab, select Create

    Call queues

    Creating and configuring call queues.

    Queues allow you to:

    1. Distribute phone calls among a group of employees (agents): You can create a call queue and add multiple employees to it. When a call comes in, the system automatically routes it to an available employee in the queue, ensuring a more even distribution of workload and increasing call handling efficiency.

    2. Hold the customer on the line when all employees are busy: If all employees in the queue are occupied with other calls, the customer will be placed on hold until one of the employees becomes available. This helps avoid call abandonment and ensures better customer service.

    Outbound routing

    Description and configuration of outgoing routing

    Outgoing routes in MikoPBX are a set of rules and settings that determine how the system handles outgoing calls from employees to external numbers. With their help, administrators can control the direction of calls through different telephony providers or communication lines depending on certain conditions, such as the dialed number, prefixes, time of day or user access rights. This allows you to optimize communication costs, distribute the load between channels and apply security policies by restricting or allowing certain types of calls. Setting up outgoing routes provides flexibility and control over outgoing telephone communications, contributing to the efficient operation of the company's communication system.

    In this article, you will find detailed documentation on setting up outgoing routing.

    To add a new outgoing routing rule, click the "Add a new rule" button.

    The name of the rule can be set arbitrarily.

    UTM

    Installing MikoPBX in UTM

    In this manual, the installation will be performed on UTM. Before it starts, download the disk image file with the ".iso" extension. You can do this by .

    1. Go to UTM. Click "Create a New Virtual Machine" to create a new virtual machine.

    1. Select "Virtualize" as the VM type.

    Mail and Notifications

    Mail and Notifications Settings

    The "Mail and Notifications" section in MikoPBX allows you to configure sending system notifications via email. Here, administrators specify SMTP server parameters, define events for notifications such as voicemail or system errors, and edit email templates. This section helps keep users and administrators informed about important events in a timely manner, ensuring effective system monitoring.

    • Enable Notifications - enables/disables all email notifications, including voicemail.

    Asterisk Manager Interface (AMI)

    Setting up AMI access

    Asterisk Manager Interface (AMI) is a powerful and convenient Asterisk programming interface (API) for managing the system from external programs. Thanks to the AMI, external programs can connect to Asterisk via the TCP protocol, initiate the execution of commands, read the result of their execution, as well as receive notifications about events in real time.

    AMI is often used for integration with business processes and systems, CRM software (Customer Relationship Management - customer interaction management). Asterisk is often managed from the CLI console, but using AMI does not require direct access to the server running Asterisk. AMI is the simplest tool, which in the hands of a developer can be a very powerful and flexible tool for integration with other software products. It enables developers to use the information generated by Asterisk in real time.

    The first thing to do is to enable the AMI and create a user with which the client program will authenticate. "System" -> "Asterisk Manager Interface(AMI)":

    To add a new account, you must specify a Username and Password. In addition, it is necessary to set a Network filter, i.e. from which subnet the connection to the AMI user is allowed. You can allow connections from any addresses, or specify a specific network that you have configured in the "

    API Keys

    Description of usage in MikoPBX

    REST API MikoPBX allows you to automate station management and integrate it with external systems - CRM, helpdesk, corporate portals, and custom services. API keys are used to access the API.

    All REST API requests are authorized via the Authorization: Bearer <token> header. MikoPBX supports two token types:

    Type
    When to use?
    arrow keys
    numpad
    License Manager
    sale@mikopbx.com
    External firewall for Docker
    Unlimited — store all recordings without restrictions.

    Access key and Secret key — service account credentials for authorization.

    Local Storage

    Longer retention periods require more disk space.

    S3 Cloud Storage

    Shorter local storage duration frees up disk space faster.

    Instructions for connecting cloud storage

    Connecting AWS S3 Storage
    "Storage information" tab
    "Local storage" tab
    "Cloud storage S3" tab
    Successful connection to S3 storage
    "Local storage (S3 mode)" slider

    Adjust the file name according to your dialplan application identifier "DIALPLAN-APP-CF967EE0

    Identificator of dialplan application
    File for editing
    <?php
    use MikoPBX\Common\Models\PbxSettings;
    use MikoPBX\Common\Models\LanInterfaces;
    use MikoPBX\Core\System\Notifications;
    use MikoPBX\PBXCoreREST\Lib\SIPStackProcessor;
    
    require_once 'Globals.php';
    
    $result = SIPStackProcessor::callBack(['action' => 'getRegistry']);
    $adminMail = null;
    $localIP = '';
    $message = '';
    foreach ($result->data as $provider) {
        if ($provider['state'] !== 'OFF' && $provider['state'] !== 'REGISTERED') {
            if ($adminMail === null) {
                $adminMail = PbxSettings::getValueByKey('SystemNotificationsEmail');
                $interfaces = LanInterfaces::find("disabled='0'");
                foreach ($interfaces as $interface) {
                    if (!empty($interface->ipaddr)) {
                        $localIP = $interface->ipaddr;
                        break;
                    }
                }
            }
            $message .= "Provider state: {$provider['state']}<br>" . "Url (local): ']} <br><br>";
        }
    }
    
    if (!empty($message) && !empty($adminMail)) {
        $notify = new Notifications();
        try {
            $notify->sendMail($adminMail, 'Provider invalid state...', $message);
        } catch (\Throwable $e) {
        }
    }
    */5 * * * * /usr/bin/php -f /var/lib/asterisk/agi-bin/DIALPLAN-APP-9С060381.php start > /dev/null 2> /dev/null 
    disk for storing call recordings
    do-user
    if you changed the root user during VM creation.
  • mikopbxipadress to the IP address of your station (IPv4 in the VM management interface).

  • - FAT32
  • Allocation unit size - 8192 bytes

  • Formatting USB drive
    1. Open balenaEtcher. Click "Flash from file" and select the previously downloaded .raw file.

    "Flash from file" button
    1. Click "Select target".

    "Select target" button
    1. From the list, select your USB drive. Then click "Select 1".

    Selecting the disk for writing
    1. Next, click "Flash!"

    "Flash!" button

    Wait for the process to complete. Then proceed to the section "Booting from USB drive".

    Successfully writed image
    1. Connect your USB drive and open the Terminal.

    1. Run the following command:

    This command displays all connected disks. Look for the disk labeled (external, physical). In our case, it is disk4 (the number may differ on your system). Use this number in the following steps.

    List of all available disks
    1. Next, format the USB drive using this command:

    Enter your administrator password when prompted and wait for the formatting to complete.

    Formatting the disk
    1. Unmount (disconnect) the disk using the following command:

    unmountDisk command
    1. Write the image to the USB drive using this command:

    Wait for the writing process to complete. Then proceed to the section "Booting from USB drive".

    Successfully writed image

    In this example, the image writing process will be demonstrated on Ubuntu 24.04.

    1. Connect your USB drive and open the Terminal.

    1. Run the following command:

    This command displays information about all connected disks. Find your USB drive in the list and note its name. In our case, it is sdb.

    "lsblk" command
    1. Next, format the USB drive using this command:

    Enter your administrator password when prompted and wait for the formatting to complete.

    Formatting the disk
    1. Unmount (disconnect) the disk using this command:

    "umount" command
    1. Write the image to the USB drive using this command:

    Wait for the process to complete. Then proceed to the section "Booting from USB drive".

    Successfully writed image
    1. Boot from the USB drive. If errors occur (black screen), make sure that:

    • Secure Boot - Disabled

    • CSM (Compatibility Support Module) - Enabled

    Booting from USB drive
    1. The system has successfully booted, but no drive is connected for storing call recordings. To connect it, use the arrow keys to navigate to "[6] Data storage" and press Enter.

    "[6] Data Storage" section
    1. Then select "Mount drive as data storage" to connect the disk.

    "Mount drive as data storage" option
    1. Select the disk that will be used to store call recordings. Enter its ID (name), for example sdc in our case, and press Enter.

    Selecting the disk
    1. After this, the system will reboot and will be ready for use and for the first login to the Web interface.

    Successfully installed MikoPBX system

    To open the Web interface, enter your MikoPBX IP address in your browser’s address bar. Use the default login credentials.

    Installing the system on a USB drive

    Windows

    The USB drive must be at least 1 GB in size. All data on the USB drive will be deleted!

    here
    here
    diskutil list
    sudo diskutil eraseDisk FAT32 NONAME MBRFormat /dev/disk4;
    sudo diskutil unmountDisk /dev/disk4;
    sudo dd if=mikopbx-2024.1.114-x86_64.raw of=/dev/disk4 bs=1m;
    lsblk
    sudo mkfs.vfat -F 32 -n NONAME /dev/sdb
    sudo umount /dev/sdb*
    sudo dd if=mikopbx-2024.1.114-x86_64.raw of=/dev/sdb bs=1M

    MacOS

    The USB drive must be at least 1 GB in size. All data on the USB drive will be deleted!

    All data on the disk will be deleted! Double-check the disk name before formatting!

    Linux

    The USB drive must be at least 1 GB in size. All data on the USB drive will be deleted!

    All data on the disk will be deleted! Double-check the disk name before formatting!

    Booting from USB drive

    Default credentials for first login to the Web interface:

    Login: admin Password: admin

    Choosing image page
    1. Select the type of operating system Other Linux 5.x and later kernel 64-bit

    Click "Continue"

    Choosing verison of OS for VM
    1. Choosing the Legacy bios type

    Click "Continue"

    Choosing the boot firmware for VM
    1. Click "Finish"

    Summary config
    1. After creating a virtual machine, wait for it to load

    MikoPBX Console
    1. Go to the section "[3] Reboot the system"

    "[3] Reboot the system" element
    1. Choose "[2] Shutdown"

    Shutting down the system
    1. After shutting down the virtual machine, go to Settings

    Settings button
    1. Select "Add device"

    Add device button
    1. Select "New Hard Disk"

    Click "Add..."

    New Hard Disk
    1. Choose the size of the hard drive (we recommend at least 50 GB)

    Click "Apply"

    Parameters for new hard drive
    1. Start the virtual machine

    Starting button
    1. Select "[8] Install"

    Installation process
    1. Enter the name of the disk on which MikoPBX will be installed

    In our case - sdb, enter its name and press Enter

    Installation process
    1. Confirm the disk selection: enter y

    Installation process
    1. Select a disk for recording conversations

    In our case - sdc, enter its name and press Enter

    Installation process
    1. The system will reboot and MikoPBX will be ready for use.

    MikoPBX Console
    1. The PBX displays the IP address of the station by which you can connect to it

    IP address of MikoPBX
    1. Enter the IP address of the station in the browser bar and the MIkoPBX login menu will open:

    Creating a virtual machine

    link
    Button for creating a new VM

    Connecting a new disk

    1 hour of recording conversations takes approximately 14mb on disk.

    Installing MikoPBX

    First connection to MikoPBX

    Default creditionals for the first login are:

    Username - admin

    Password - admin

    System will ask to change them after the first login. It is important for the security of your MikoPBX.

    In the setup interface, select the virtual machine type: "
    Typical (recommended)
    ". Then, click "
    Next >
    ".
    Selecting the type of virtual machine to create
    1. Choose the installation source, "Installer disc image file (iso):". Select the .iso file you want to use. You can download the distribution from this link. Click "Next >" to continue.

    Selecting the system installation source for the virtual machine being created
    1. Select "Linux" for the "Guest operating system" and "Debian 11.x 64-bit" as the version. Click "Next >".

    Selecting an operating system and version for the virtual machine being created
    1. Enter a desired name for the virtual machine in "Virtual machine name:" and, if necessary, specify a location on your computer under "Location". Click "Next >".

    Specifying the name and path for the virtual machine being created
    1. Set the size for the primary (system) hard drive, with a recommended size of 1GB. Choose "Split virtual disk into multiple files" and click "Next >".

    Specifying parameters for the system hard disk for the virtual machine being created
    1. A summary of the virtual machine configuration will appear. Click "Finish" to create the virtual machine.

    The final configuration of the machine being created.

    Now, let's create and attach a second hard drive, which will be used to store call recordings.

    1. Open the settings of the previously created virtual machine.

    Virtual Machine Settings Section
    1. Click "Add..." to add a new system component.

    Button for adding a new system element
    1. In Hardware types, select "Hard Disk" and click "Next >".

    Selecting the type of a new system element
    1. Choose "Virtual disk type" - "SCSI". Click "Next >".

    Selecting a disk type
    1. Choose "Create a new virtual disk" and click "Next >".

    Selecting the "Create a new virtual disk" option
    1. Specify the disk size, with a recommended minimum of 50GB. Also, choose "Split virtual disk into multiple files". Click "Next >".

    Specifying parameters for the disk being created
    1. Give the hard drive a custom name and click "Finish".

    Name for the second hard drive

    In the settings, go to "Network Adapter" and select "Network connection" - "Bridged: Connected directly to the physical network". Click "OK".

    Setting up a network interface
    1. Start the virtual machine.

    Button to start the virtual machine
    1. The MikoPBX command-line interface will open as the PBX starts loading from the optical disk where the ISO image was mounted. This is indicated by the line: "The system is loaded in Recovery mode":

    Loaded MikoPBX from optical disk
    1. To install MikoPBX, select "[8] Install".

    2. A list of available disks will be displayed (in this example, sdb, sdc). The system suggests a default disk, sdb in our case, for the installation. If you agree with the suggested disk for the system, press Enter. Otherwise, enter the name of another disk.

    Selecting a disk for the system
    1. The system will issue a warning. To confirm the operation, enter "y" and press Enter.

    2. After installation, you'll be prompted to select a disk for storing call recordings. Enter the disk name (in this example, sdc) and press Enter.

    Selecting a disk for storing call recordings
    1. After installation, the system will restart. MikoPBX will now boot from sdb, the installation disk, without the line "The system is loaded in Recovery mode"—indicating a successful installation.

    MikoPBX successfully installed

    To access the MikoPBX web interface, enter your virtual machine's IP address in your browser's address bar. You can find the IP address in the console.

    MikoPBX IP address

    Enter the IP address in your browser’s address bar. Log in using the default credentials.

    MikoPBX WEB interface authorization page

    Use versions of MikoPBX other than 2024.1.114 for installation on VMware Workstation Pro. Version 2024.1.114 currently does not support installation via VMware Workstation Pro!

    Creating a Virtual Machine

    the official website
    The "Create a New Virtual Machine" element

    Adding and Connecting a Second Disk

    Configuring the Network Interface for the Virtual Machine

    First System Boot

    Use the to navigate through the menu options. Press Enter to select an option, or press the corresponding number on the .

    All data on the selected installation disk will be erased.

    First Login to MikoPBX

    Use the following default credentials for the first login to the MikoPBX web interface:

    • Username: admin

    • Password: admin

    Loading the MikoPBX image
    1. Select Create VM

    2. On the General tab, enter the name of the virtual machine, for example mikopbx-vm

    Configuring virtual machine
    1. Go to the OS tab, and in the ISO image field, select the previously downloaded image

    2. Set the OS type to Linux

    Configuring virtual machine
    1. On the System tab, uncheck the Qemu Agent box, and use the default values for other fields

    Configuring virtual machine
    1. Go to the Disks tab

    2. Adjust the size of the system disk to 1 GB

    Configuring virtual machine
    1. Click the Add button and add an additional disk for data storage

    2. Specify a disk size of at least 50 GB

    Configuring virtual machine
    1. On the CPU and Memory tabs, specify the computing resources for the virtual machine based on the expected load on the PBX. For a test machine, you can set Cores (CPU tab) to 2 and Memory (Memory tab) to 2 GB

    Configuring virtual machine
    Configuring virtual machine
    1. On the Network tab, uncheck the Firewall box

    Configuring virtual machine
    1. Go to the last tab, Confirm, and check the Start after created box

    2. After entering the values, click the Finish button

    Configuring virtual machine
    1. Go to the created virtual machine mikopbx-vm

    2. On the open tab, go to the Console section

    3. If the boot is successful, a console menu will appear. Enter 8 from the keyboard to start the installation

    Installing MikoPBX
    1. Select the disk for the system and enter the disk name from the keyboard, for example sda. Confirm the selection by entering y from the keyboard

    Installing MikoPBX
    Installing MikoPBX
    1. Connect the disk for storing call recordings, enter the disk name for connection from the keyboard, for example sdb

    Installing MikoPBX
    1. To access the MikoPBX web interface, enter your virtual machine's IP address in your browser's address bar. You can find the IP address in the console.

    MikoPBX IP-address
    1. Enter the IP address in your browser’s address bar. Log in using the default credentials.

    MikoPBX WEB-interface authorization page

    The QEMU Guest Agent lets Proxmox read the guest IP addresses from MikoPBX, perform a clean OS-level shutdown from the Shutdown button, and take consistent backups (fs-freeze). The qemu-ga binary is already shipped with MikoPBX and is automatically started by monit (the vm-tools service) — you only need to enable the agent channel on the Proxmox side.

    1. Select the MikoPBX virtual machine, open the Options tab and double-click the QEMU Guest Agent row

    2. Tick Use QEMU Guest Agent (set to Enabled), keep Type = VirtIO (default) and click OK

    Enabling QEMU Guest Agent in VM Options

    On the Proxmox host (quick alive/dead check):

    Inside MikoPBX (via SSH):

    If monit summary shows vm-tools Initializing and /dev/virtio-ports/org.qemu.guest_agent.0 is missing, the virtio-serial channel has not been attached to the VM yet — either the option is not enabled on the Proxmox side, or the VM has not been cold-restarted after enabling it.

    Loading the MikoPBX image

    qm agent <VMID> ping                       # should return an empty response with no error
    qm agent <VMID> info                       # agent version and supported commands
    qm guest cmd <VMID> get-host-name          # guest hostname — proves the agent actually replies
    qm agent <VMID> network-get-interfaces     # guest IP addresses (also visible in the VM summary)
    ls -la /dev/virtio-ports/org.qemu.guest_agent.0   # this file must exist
    ps w | grep qemu-ga | grep -v grep                # the qemu-ga process must be running
    monit summary | grep vm-tools                     # expected state: Running

    Creating a virtual machine

    To deploy the PBX use two disks:

    • A 1 Gb disk for the main system

    • A 50+ Gb

    Installing MikoPBX

    When the message "Press any key within 30 seconds to boot from LiveCD..." appears, do not press any buttons. In this case, the system will boot from the hard drive.

    Starting MikoPBX

    Use the following default credentials for the first login to the MikoPBX web interface:

    • Username: admin

    • Password: admin

    Enabling the QEMU Guest Agent

    After enabling the option you must perform a full stop and start of the VM (Stop → Start in the WEB UI, or from the Proxmox CLI: qm stop <VMID> && qm start <VMID>).

    A regular Reboot is not enough — the virtio-serial device that the agent talks through is attached to the QEMU process only on a cold start. Without that restart the /dev/virtio-ports/org.qemu.guest_agent.0 device never appears inside MikoPBX and the agent cannot start.

    Verifying the QEMU Guest Agent

    Enter the group name, for example MikoPBX_group

  • Use default values for other fields

  • After entering the values, click the Review + create button, then the Create button

    1. Open Menu / All services / Analyze and transform data / Storage accounts

    2. In the Storage accounts tab, select Create

    3. Specify the created resource group MikoPBX_group

    4. Enter the storage account name, for example pbximgs

    5. Use default values for other fields

    6. After entering the values, click the Review + create button, then the Create button

    1. Go to the card of the created storage account pbximgs

    2. In the opened tab, go to the Data storage / Containers

    3. Add a new container

    4. Enter the container name, for example imgs

    5. Click the Create button

    1. Open the created container imgs

    2. In the opened tab, select Upload

    3. Select a file from the MikoPBX distribution with the .vhd extension

    4. Click the Upload button

    1. Open Menu / All services / Compute / Images

    2. In the Images tab, select Create, let's create a new image based on the uploaded *.vhd file

    3. Specify the resource group MikoPBX_group

    4. Enter a unique name for the image, for example MikoPBX_Azure

    1. Specify the OS type - Linux

    2. Specify the generation of virtual machines - Gen 1

    3. Select the blob storage object by clicking Browse, Browse / pbximgs / imgs / *.vhd

    4. Specify the account type - Standard HDD

    5. Use default values for other fields

    6. After entering the values, click the Review + create button, then the Create button

    1. Open Menu / All services / Compute / Virtual machines

    2. In the Virtual machines tab, select Create / Azure virtual machine

    3. Specify the resource group MikoPBX_group

    4. Enter the virtual machine name, for example MikoPBX-vm

    1. Choose the previously created image, See all images / Other items / My images / MikoPBX_Azure

    2. Specify the machine size (combination of CPU / RAM to be at least 1GB / HDD parameters)

    1. Specify the username for the administrator account

    If you have an SSH key, do the following

    1. Select the source of the SSH public key - Use existing public key

    2. Specify it in the SSH public key field

    If you do not have an SSH key, do the following

    1. Select the source of the SSH public key - Generate new key pair

    2. Specify the key pair name, for example mikopbx_key

    Continue with the following instructions:

    1. In the license type field, specify Other

    2. Use default values for the other fields

    1. Go to the Disks tab

    2. Specify the OS disk type

    3. Check the Delete with VM checkbox

    1. Create a new data disk

    2. Specify the disk size to be at least 50GB

    3. Use default values for the other fields, click OK

    1. After entering the values, click the Review + create button, then click Create

    1. Open the virtual machine you created and go to Networking / Network settings / Rules

    2. In the tab, choose Create inbound port rule

    3. Specify the destination port ranges - 0 - 65535

    4. Choose the protocol TCP

    1. Specify a name, for example TCP

    2. Use default values for the other fields

    3. After entering the values, click the Add button

    1. Similarly, create a rule for UDP. Specify the destination port ranges - 0 - 65535, protocol UDP, and name

    1. Open the virtual machine you created and go to the Connect section

    2. In the drop-down menu under More ways to connect, select Serial console

    1. Copy the external address of the created virtual machine and enter it in the browser's address bar

    2. For login use the login and password provided in Serial console

    For quick and convenient searching on the Azure portal, use the search bar.

    Creating a resource group

    https://portal.azure.com/

    Creating a storage account

    Configuring the created storage account

    Creating an image

    Creating a virtual machine

    To deploy the PBX use two disks:

    • A 1 Gb disk for the main system

    • A 50+ Gb

    Configuring ports for incoming connections

    Make sure to configure the Firewall on the MikoPBX

    Starting MikoPBX

    Notify the customer of their position in the queue and approximate wait time: While the customer is in the queue, the system can provide information about their current position in the queue and an estimated wait time. This helps keep the customer informed and improves their waiting experience.

  • Display the queue name along with the customer's number on the employee's phone: When an employee answers a call from the queue, their phone displays not only the customer's number but also the name of the corresponding queue. This helps the employee handle calls more effectively and provide personalized service.

  • To configure call queues in MikoPBX, go to the "Telephony" section and select "Call Queue." Here, you can create and customize your queues according to your business requirements and customer service needs.

    "Call queue" section

    To add a new queue, perform the "Add a new call queue" action

    "Add a new call queue" button

    In the queue creation form or dialog, you will find the following fields:

    • Queue Name: Enter a name for the queue. This name will be used for reference when setting up call routing rules.

    • Note: Provide a brief description or note about the queue. This information will be visible in the queue list, allowing you to provide additional details or instructions.

    New call queue parameters

    In the Queue Agents section, you can add an arbitrary number of employees (queue agents) and specify a call distribution strategy.

    Queue agents section

    Here are the options for queue strategy:

    • Ring All: Calls are distributed to all agents at the same time until someone answers the call (default behavior).

    • Linear: Calls are sent to agents one by one in the order configured in the Queue Agents list. After the Time attempt call to agents interval expires, the call is sent to the next agent.

    • Linear Progressive: The first agent starts ringing immediately. After each Time attempt call to agents interval, the next agent is added while the previous agents continue ringing. Make sure the timeout in Scenario 1 is long enough for all required agents to be added.

    • Least Recent: The call is routed to the agent who has been idle for the longest time within the queue.

    • Fewest Calls: The call is routed to the agent who has handled the fewest answered calls within the queue.

    • Random: A random available agent within the queue is selected to receive the call.

    • Memory Hunt: The system remembers the last agent who answered a call and starts the next distribution from the following agent.

    Advanced settings button

    In this section, you can provide additional information:

    • Phone number for this queue - you can call the queue using this number from any internal employee extension. Calls can also be transferred to this number.

    • Short name for the queue - for display before the CallerID on the telephone device of the subscriber, for example, "consult."

    • Time attempt call to agents - the duration in seconds for which a call will ring on an individual agent's phone. After this time elapses, the call to the agent will be logged as a missed call in the call history. Once the ring time is over, the call will be routed to the next available agent based on the selected strategy.

    • The rest time of the agent after the processing of the call, before starting to accept new calls - the duration in seconds that is counted from the moment an agent finishes a call from the queue until they are ready to receive new calls. This period allows agents to update notes, complete necessary tasks, or take a short break before being assigned another call.

    • Receive New Calls During A Call - this toggle switch enables or disables the ability to receive new calls while the agent is already on a call. When enabled, agents can handle multiple calls simultaneously.

    Queue settings for the caller
    • What the caller hears while waiting - During the wait for their call to be answered, the caller can hear either hold music or a ringing tone.

    • Background Music (MOH) - You can specify a unique audio file to be played to the caller during the wait, such as promotional materials.

    • Notify about current queue position - If all operators (queue agents) are occupied, enabling this toggle switch allows you to notify the caller about their position in the queue. If the Additional Audio Announcement option is activated, this announcement will supplement the information about the position.

    • Notify about estimated hold time - If all operators (queue agents) are occupied, enabling this toggle switch allows you to inform the caller about the approximate wait time for a call to be answered. If the Additional Audio Announcement option is activated, this announcement will supplement the information about the estimated wait time.

    • Additional notification - A sound message is played only if all participants in the queue are occupied.

    • Time in seconds to repeat all alerts periodically - Describes the interval at which to announce the queue position, wait time, and announcement.

    Call routing in case of failures
    • The script #1 - In this scenario, you can configure the maximum allowable wait time for a client in the queue. If none of the queue agents can answer the client within the specified time, the call will be redirected to the selected number. If no redirect destination is selected, the overall queue timeout is not applied.

    • The script #2 - If there are no agents available in the queue (meaning no agents are currently logged into the phone system), you can specify a number to which the client's call will be transferred.

    If Scenario 1 has no backup destination selected, the queue has no overall waiting timeout: the call remains in the queue until an agent answers or the caller hangs up. To limit the waiting time, set the duration in Scenario 1 and choose the destination for redirecting the call.

    Main settings

    Queue Agents

    After saving the queue, MikoPBX regenerates and reloads the queue configuration automatically. A manual Asterisk restart is not required when changing the strategy.

    Advanced Settings

    Queue settings for agents

    Queue settings for the caller

    Call routing in case of failures

    In these scenarios, as a redirection number, you can choose not only an internal extension but also options such as a conference, queue, IVR (Interactive Voice Response), or a special number within the dial plan application. These options provide flexibility in directing the call to different destinations based on your specific requirements or business needs.

    In Scenario 1, specify both the waiting time and the redirect destination. If only the time is filled in without a backup destination, MikoPBX does not pass the overall timeout to the queue application so that the call is not ended without a route to continue.

    In a note, you can describe the call route that you want to implement; this can help you in debugging in the future.
    Step 2: Title and Note

    Set a template for outgoing calls. Read more about number templates in this articles group.

    Step 3: Setting the number template

    The example in the picture above means the following: if the dialed number starts with "345" or "375" and the rest of the number consists of 10 digits.

    Convert number - this setting is intended to remove the number prefix and replace it with the desired prefix.

    Set a template for outgoing calls. Read more about number templates in the next paragraph.

    Step 4: Number Conversaion

    In the example given, digits are not cut off at the beginning of the number and digits are not added.

    Select from the list the provider for which you configured outgoing routing and save the changes.

    Step 5: Selecting a provider
    The number starts with
    The rest of the number consists of the specified number of digits
    Examples of numbers

    [7-8]{1}

    10

    79257184255, 84952293042

    7925

    leave the field blank

    For example, the number +74952293042 should be converted to the number 84952293042.

    The implementation of the rule looks like this:

    +7 to 8

    For example, the numbers 84952293042 and 74952293042 should be converted to +74952293042.

    The implementation of the rule looks like this:

    7 and 8 to +7

    For example, the numbers 4952293042 and 4996382584 should be converted to 84952293042 and 84996382584 respectively.

    The implementation of the rule looks like this:

    Prefix 8

    For example, the numbers 84952293042 and 74996382584 should be converted to 2293042 and 6382584 respectively.

    The implementation of the rule looks like this:

    Remove prefix

    Creating a rule

    Additional examples of configuring outgoing routing are available in the FAQ section.

    Step 1: Add a new rule

    Step 2: Title and Note

    "Call routing" -> "Outbound routing" section
    New rule in outbound routing

    Step 3. Setting the number template

    If the dialed number matches the rules of several routes, then the call will be made in the order of the route descriptions, one by one, until the call is answered, or until there are no more suitable routes.

    Step 4: Number Conversion

    Step 5. Selecting a provider

    Examples

    Examples of number templates

    Examples of changing number prefixes

    Example 1. It is necessary to replace the number prefixes “+7” with “8”.

    Example 2. It is necessary to replace the number prefixes “8”, “7” with “+7”.

    Example 3: You need to add the prefix "8" to the number.

    Example 4: You need to remove the area code "8495" or "7495" or "8499" or "7499" and leave the 7-digit number.

    Select "Preconfigured" - "Linux" as the operating system type.

    Choosing the type of operating system
    1. Select the previously downloaded disk image file in the "Boot ISO Image" section. To do this, click on "Browse...".

    Selecting a disk image file for a VM
    1. Next, specify the characteristics of your virtual machine. In our case, 2 GB of RAM and 2 processor cores will be used.

    VM Configuration
    1. Next, specify the size for the system disk. In our case, 1 GB.

    Specifying the size of the system disk
    1. Click Continue.

    The "Shared Directory" section
    1. The final configuration of the VM will be displayed. Give it the desired name (the "Name" field). And click "Save".

    The final configuration
    1. Go to the VM settings. To do this, right-click on its name, then "Edit".

    VM Settings
    1. Go to "Drives". Click "New..."

    "Drives" section
    1. Create a new disk with the following parameters:

    • Interface - VirtlO

    • Size - at least 50 GB (in this documentation, 10 GB will be used for the test machine)

    Click "Create".

    Creating a second disk
    1. Start the VM.

    Launching a VM
    1. After loading, you will see the message PBX is running in Live or Recovery mode. This means that the system is loaded from the disk image in Live mode. It is necessary to install the system. To do this, go to the "[8] Install on Hard Drive" section.

    MikoPBX in LiveCD mode
    1. Select the disk to install the system. In our case, vda and vdb disks are available, and we select the vda disk for installation.

    Selecting a disk to install the system on
    1. Confirm the selection: enter "y" from the keyboard and press Enter.

    Confirming the disk selection
    1. Next, select a disk for storing conversation recordings. In our case, the only remaining one is 10 GB size disk.

    Selecting a disk for storing conversation recordings

    After that, the system will reboot and be available in normal mode (the label "PBX is running in Live or Recovery mode" will disappear).

    MikoPBX IP-address

    Enter this IP address in the browser bar to access the Web interface.

    MikoPBX Web-interface

    This instruction has been relevant since the first release, published in 2026. Tested on Apple Silicon processors.

    Creating a virtual machine

    following this link
    The main page of UTM. Creating a new VM.
    Selecting the type of virtual machine

    MikoPBX uses two disks:

    1. The system disk. The system is installed on it, the recommended size is 1 GB.

    2. A disk for storing recordings of conversations. The recommended size is from 50 GB.

    Connecting a disk for data storage

    System installation

    Standard login information:

    • Login: admin

    • Password: admin

    Send missed call notifications - enables/disables missed call notifications.
  • Common Email for Missed Call Notifications - a shared email address for sending notifications about missed external calls (if an employee has no email specified, this shared address is used).

  • Send voicemail notifications - enables/disables voicemail notifications.

  • Common Email for Voicemail Messages - a shared email address for sending voicemail notifications (priority: 1. Employee's personal email; 2. The email specified in this field).

  • Send login notifications - enables/disables system login notifications.

  • Send system notifications - enables/disables sending of system notifications.

  • System Administrator Email - the address to which system notifications will be sent.

  • General SMTP Settings
    • Sender Address, Sender Name - emails will be sent on behalf of this address and name.

    • Authentication Type:

      • Username and Password - classic authentication method when connecting to an SMTP server, using a mailbox address (login) and password. All parameters (server, port, encryption, login, and password) are entered and stored manually.

      • OAuth2 - an authentication method in which you do not store or transmit your mailbox password. Instead, the application obtains a temporary access token from the mail provider (Microsoft 365/Outlook, Google Workspace/Gmail, etc.) and uses it when sending emails via SMTP.

    SMTP Settings. Username and Password Authentication Type
    • SMTP Username, SMTP password - authorization credentials.

    • SMTP Host - mail server address.

    • SMTP Port - mail server port.

    • Encryption type:

      • No encryption (port 25) - classic SMTP connection without channel protection.

      • STARTTLS (port 587) - the recommended and most common method for sending mail. The connection starts without encryption, after which the client and server negotiate a transition to a secure channel.

      • SSL/TLS (port 465) - SMTP connection with encryption from the very beginning of the connection. The channel is secured immediately after the TCP connection is established, without a switching phase.

    • Verify server certificate - a security setting that determines whether the client will verify the authenticity of the SMTP server's SSL/TLS certificate when establishing a secure connection (STARTTLS or SSL/TLS).

    SMTP Settings.OAuth2 Authentication Type
    • SMTP Username - authorization credentials.

    • OAuth2 Provider - the mail service through which OAuth authentication is performed (e.g., Microsoft/Outlook, Google/Gmail).

    • Application ID (Client ID) - the unique identifier of the application created in the control panel of the selected OAuth provider. Used so the provider knows which application is requesting access to the mailbox.

    • Secret Key (Client Secret) - the confidential application key issued by the OAuth provider. Used together with the Client ID to verify the authenticity of the application when obtaining and refreshing access tokens. Must be kept secret and not shared with third parties.

    • SMTP Host - mail server address.

    • SMTP Port - mail server port.

    • Encryption type:

      • No encryption (port 25) — classic SMTP connection without channel protection.

      • STARTTLS (port 587) — the recommended and most common method for sending mail. The connection starts without encryption, after which the client and server negotiate a transition to a secure channel.

    • Verify Server Certificate - a security setting that determines whether the client will verify the authenticity of the SMTP server's SSL/TLS certificate when establishing a secure connection (STARTTLS or SSL/TLS).

    Our documentation includes several connection examples for each authentication type. Below you can find links to these instructions.

    • Login and password authentication:

    • OAuth2 authentication:

    General Settings

    "Mail and notifications" section in MikoPBX
    General mail settings

    SMTP Settings

    Login and Password Authentication

    OAuth2 Authentication

    How to connect?

    Proton Setup (Login, Password)
    Gmail Setup (oAuth2)
    Microsoft Outlook Setup (OAuth2)
    Network and Firewall" → "
    "
    New User AMI Parameters

    AMI user rights set in the [user] section of the configuration file /etc/asterisk/manager.conf

    rights ID
    reading
    writing

    System

    Reading general information about the system, for example, configuration restart notifications

    Allows the user to execute Asterisk control system commands such as Restart, Reload, or Shutdown. This permission also gives users the ability to run system commands outside of Asterisk. Granting such permission is equivalent to granting access to the command shell, with the rights of the user/group under which the Asterisk process is running

    Call

    Reading an event about channels in the system

    Allows the user to set information on channels

    "Asterisk Manager Interface (AMI)" section

    AMI User Options and Rights

    Firewall

    API key

    External integrations: CRM, scripts, third-party services

    For external integrations, always use an API key — it is created manually, has configurable access permissions, and can be revoked at any time.

    1. Go to "System" → "API Keys".

    "API Keys" section in MikoPBX
    1. `Click "Add API Key".

    • Fill in the Description field (e.g.: CRM Integration)

    • Copy the generated API key — it is displayed only once

    Important: save the key immediately after creation. Once the page is closed, it cannot be recovered — you will need to create a new one.

    Basic API key parameters

    Follow the principle of least privilege — each key should only have access to the resources that are actually needed.

    When creating a key, two options are available:

    • Full access — the key gets read and write access to all API resources. Use only if truly necessary.

    • Manual configuration — the access level for each API resource is specified individually: read-only, read and write, or no access.

    Network filter: choose one of two options:

    • Localhost connections only — the key will only work from the local network. Recommended if the integration runs within the infrastructure.

    • Connections from any address are allowed — the key is accessible without IP restrictions. Use only if the client is located outside the local network.

    Following these requirements protects the API from token interception and unauthorized access:

    1. Valid SSL certificate:

    Use a trusted SSL certificate on the MikoPBX server side. The easiest way is to issue a free certificate via the Let's Encrypt module (instructions for working with the module are available here).

    Operating without a valid certificate is only acceptable in an isolated test environment with no internet access.

    1. Certificate trust on the client side:

    The client must verify the server certificate on every request. Disabling verification (verify=False in Python, -k in curl) is not acceptable in production: without it, a man-in-the-middle (MITM) attack becomes possible, where an attacker intercepts the Bearer token in plaintext.

    1. Key scope restriction:

    Each key must only have access to the resources actually used by the integration. Do not use "Full access" unless necessary — compromising such a key gives an attacker full control over the API.

    1. Network access restriction:

    If the integration runs within a local network — choose "Local connections only". This prevents a compromised key from being used from an external network.

    Use "Allow connections from any address" only when the client is physically located outside the local network, and make sure all other security measures are in place — a valid SSL certificate and minimal key permissions.

    Click a card to navigate:

    JWT token

    Authorization

    Internal system components, modules, built-in tools

    Creating an API Key

    Configuring Access Permissions

    • "Read" allows you to retrieve data (GET)

    • "Read and write" allows you to create, modify, and delete data (POST, PUT, DELETE)

    Security

    Examples and Detailed Documentation

    mkdir -p /storage/usbdisk1/transfer
    cd /storage/usbdisk1/transfer
    touch transfer-rsync.sh
    curl -o /storage/usbdisk1/transfer/transfer-rsync.sh https://gist.githubusercontent.com/excla1mmm/c9891306b459cac0c7ea3c785ab0936e/raw/ec57ab60ee48112b4a16635e7b47955e5a044513/transfer-rsync.sh
    chmod +x transfer-rsync.sh
    ./transfer-rsync.sh

    Running and Using the Script

    After the transfer, always verify the integrity of all data before retiring the old MikoPBX!

    here
    Running commands to create a file
    Entering the required data
    Generating a new key
    Generated ssh key
    Inserted key
    Successful transfer

    Creating an LXC Container

    Swap is a disk area that the system uses as additional memory when RAM runs out. It operates significantly slower than RAM and serves as a reserve to prevent the system from terminating processes when memory is insufficient.

    First Launch

    Login credentials:

    Login: admin

    Password: the password you set during the initial container creation.

    here
    this article
    this article
    Copying the template link
    Downloading a template from URL
    Successful template download
    "Create CT" button for creating a new container
    Basic container parameters
    Selecting a template for the container being created
    System disk parameters
    Parameters for the second disk
    Parameters for the third disk
    Container parameters (CPU)
    Container parameters (Memory)
    Container parameters (Network)
    Container parameters (DNS)
    Final container configuration
    Container startup process
    Web interface IP address
    MikoPBX web interface

    Installation via writing the image to a USB drive (Live USB)

    Installing the system by writing the image to a USB drive

    Writing the image to a USB drive

    Windows

    Before starting the process, format your USB drive with the following parameters:

    • File system - FAT32

    • Allocation unit size - 8192 bytes

    Formatting the disk

    The image will be written using the Rufus utility. You can download it here.

    1. After installing the utility, open its interface. In the "Device" section, select your USB drive, click SELECT, and choose the previously downloaded . Its verification will begin.

    1. Once verification is complete, set the following parameters and click START:

    • File system - FAT32

    • Cluster size - 8192 Bytes

    • Quick format - checked

    1. In the popup window, select "Write in DD Image mode" and click OK.

    1. In the confirmation window warning that all data on the disk will be erased, click OK.'

    Wait until the image writing process is complete. When done, you’ll see the message "READY". Then proceed to the section .

    1. Connect your USB drive and open the Terminal.

    1. Run the following command:

    This will display information about all connected disks. Find the one labeled (external, physical) — for example, disk4 (the number may differ on your system). Use its number for the next steps.

    1. Next, format the USB drive with this command:

    Enter your admin password when prompted and wait until formatting completes.

    1. Unmount (disconnect) the disk using this command:

    1. Write the image to the USB drive using this command:

    Wait until the writing process is complete. Then proceed to the section .

    This example uses Ubuntu 24.04 to demonstrate the image writing process.

    1. Connect your USB drive and open the Terminal.

    1. Run the following command:

    This will display information about all connected drives. Find your USB drive in the list and remember its name. In our example, it is sdb.

    1. Next, format the USB drive with the following command:

    Enter your admin password when prompted and wait until formatting completes.

    1. Unmount (disconnect) the disk using this command:

    1. Write the image to the USB drive using this command:

    Wait until the writing process is complete. Then proceed to the section .

    1. Boot from the USB drive. If errors occur (black screen), make sure that:

    • Secure Boot - Disabled

    • CSM (Compatibility Support Module) - Enabled

    1. The system is booted in LiveCD mode — indicated by the red message. To install, use the keyboard arrows to navigate to "[8] Install" and press Enter.

    1. Select the disk where the system will be installed. Enter its ID (name), for example sdc.

    1. Confirm your choice by typing "y" to continue.

    1. After installation, you will be asked to select a disk for storing call recordings. Make your choice as before.

    1. After that, the system will reboot and be ready for use and the first login to the Web interface.

    To open the Web interface, enter the IP address of your MikoPBX in your browser’s address bar. Use the default login credentials.

    Vultr

    Installing MikoPBX using the Vultr cloud platform

    This guide applies to MikoPBX version 2024.2.138 and later!

    This guide provides a step-by-step process for installing MikoPBX on the Vultr cloud platform.

    Before starting, you must download the latest .iso MikoPBX image file from MikoPBX’s GitHub releases.

    Uploading the Image to Vultr

    Uploading the File to Storage

    First, you need to upload the image to the cloud platform.

    1. Navigate to "Cloud Storage" → "Object Storage":

    "Object Storage" section
    1. Create a new storage resource by clicking "Add Object Storage":

    1. Select the type of storage (it’s recommended to use the basic option, as you only need it to store the disk image). Also provide a name.

    2. Click on your newly created storage resource:

    1. Go to the "Buckets" tab and create a new bucket with a custom name.

    1. The storage information will display S3 connection details.

    1. Next, connect to your storage via WinSCP. Open WinSCP and select "New Site":

    1. Enter the following parameters:

    • File protocol – Amazon S3

    • Encryption – TLS/SSL Implicit encryption

    • Port number – 443

    Click "Login".

    1. Upload the .iso disk image file to the storage.

    1. Return to the Vultr interface and go to your bucket’s directory.

    1. Click the three dots to the right of the file name, then "Change Access". Grant access by toggling the switch.

    1. Click the three dots to the right of the file name and select "Copy URL".

    1. Navigate to "Orchestration" → "ISOs":

    1. Click "Add ISO":

    1. Paste the link to your previously uploaded file and click "Upload".

    1. Go to "Account" → "SSH Keys". Click "Add SSH Key":

    1. Generate an SSH key pair .

    2. In the interface for adding the key pair, provide a custom name and paste your public SSH key.

      Click "Add SSH Key".

    1. Go to "Products" → "Compute":

    1. Click "Deploy Server":

    1. In the next section, select the region and configuration for your virtual machine.

    1. Continue configuring the server:

    • Under ISO/iPXE, select the previously uploaded ISO.

    • Select the SSH key pair you created.

    Click "Deploy".

    After the server is created, power it off.

    1. Go to "Cloud Storage" → "Block Storage":

    1. Click "Add Block Storage":

    1. Select the disk type, region (same as the VM), size, and a custom name.

    1. Go to the management page for the newly created block storage. Attach the volume to your virtual machine using the "Attach to:" option.

    1. Go to your virtual machine management page.

    1. Open the console by clicking the relevant button:

    1. You will enter the built-in console.

    1. Navigate to "[8] Install".

    2. Select the disk to be used as the system disk. Confirm by typing "y" and pressing "Enter":

    1. Select the disk for storing call recordings. The system will reboot.

    2. Go to "Settings" for your virtual machine and then "Custom ISO". Click "Remove ISO".

    At this point, MikoPBX is installed and ready to use.

    1. In your browser, enter the IP adress of your virtual machine. You can find it in the MikoPBX console.

    1. Log in using the following credentials:

    • Username: admin

    • Password: The VM ID, which looks like "150dd137-a0e2-45f6-baf9-ddc15a600d60" and can be found in the address bar (screenshot below).

    System log entries

    Description of section functions

    The "System Diagnostics" section in MikoPBX is a tool for monitoring and analyzing the status of the telephone system. Using this section helps to promptly detect and eliminate technical problems, ensuring stable and efficient operation of MikoPBX.

    Section location: "Maintenance" -> "System log entries"

    System logs section

    Contains 3 tabs: Show log, System information, Capturing network packets.

    Three sections

    Show log section

    This section allows you to view log files for detailed analysis of PBX operations.

    1. To start, select a file.

    2. Set the lines for the number of lines to fetch.

    3. Set the offset value to shift the selection.

    4. Set the filter by entering a string to be included in the selection.

    The following options are available:

    1. Download the selected log as a file .

    2. Refresh the log .

    3. Auto-refresh the log .

    Suppose you need to analyze an outgoing call to the number 74952293042.

    1. Select the log file asterisk/verbose.

    2. Set the phone number 74952293042 as the filter.

    3. Set the limit to a sufficient value, such as 2000, to ensure all log entries are included.

    1. In this example, the ID = C-0000000f.

    2. Repeat the log query but use the filter C-0000000f this time.

    3. You will receive the entire log of the dialplan process.

    The tab displays the following information:

    • Network settings

    • CPU load

    • RAM usage

    • iptables settings

    This section allows you to perform a detailed analysis of errors in PBX operation.

    You can start capturing network packets passing through the network interface.

    1. To start the process, press the Start button.

    1. Reproduce your issue: make a call or perform an action that causes the error or failure.

    2. Press the Stop and Download button.

    The network packets will automatically be saved in the archive MikoPBXLogs_log-tcpdump-XXXXXXXXXX. They should also automatically save in your browser's Downloads folder.

    If you cannot find the archive in the Downloads folder, you can and download it from the /storage/usbdisk1/mikopbx/tmp directory - the file will be log-tcpdump-XXXXXXXXXX.zip.

    You can download all system logs accumulated on the PBX. To do this, click the Download All System Logs button.

    The system logs will automatically be saved in the archive MikoPBXLogs_log-sys-XXXXXXXXXX.zip. The logs should also automatically save in your browser's Downloads folder. You can also obtain this log archive from the /storage/usbdisk1/mikopbx/tmp directory by connecting to the PBX using WinSCP. The file will be log-sys-XXXXXXXXXX.zip.

    Other ways to collect logs:

    • Using an

    • Using the

    • Using the

    Gmail Setup (oAuth2)

    Gmail service mail configuration via OAuth2 Authentication

    Setting up OAuth 2.0 in Google requires using the station's URL address. The easiest way is to create a DNS record on the local server or add an IP address-to-domain name mapping in the hosts file on the device from which the configuration is being performed.

    Google Account Settings

    1. Before starting the setup, you need to change some Google account parameters. To do this, go to the account management page (link).

    Google Account management page
    1. Go to the "Security and sign-in" section. Make sure that two-step authentication is configured.

    Two-step authentication setup
    1. Go to the Google Cloud Console, to the "APIs & Services" section (). Create a project for the current task.

    1. Go to the APIs library (the "Library" section).

    1. Enter "gmail api" in the search bar. Open the Gmail API card.

    1. Click "Enable" to connect.

    1. Go to the main APIs & Services page. Then click "OAuth consent screen".

    1. Create a project (click "Get started"). Fill in an arbitrary name and your email. Select "Internal" as the Audience. Click "Create" to finish.

    1. Return to the main APIs & Services page. Then go to the "Credentials" section. Click "Create credentials". Select "OAuth client ID" to create.

    1. Select "Web application" as the Application type. Then enter an arbitrary name. Click "Create".

    1. Add a new "Authorized redirect URI".

    1. An OAuth client will be created. Save the Client ID and Client Secret to your notes. You will need this data for the connection in the future.

    1. Go to the "System" -> "Mail and notifications" section:

    1. Next, go to "SMTP Settings". Fill in the following parameters:

    • Sender address, Sender name — your email and the name from which the emails will be sent.

    • Authentication type — OAuth2.

    • SMTP login — your email.

    Leave all other settings at their default values. A more detailed description can be found in the main article about mail parameters ().

    After that, click "Save"!

    1. Click the blue "Connect via OAuth2" button. Then select your Gmail account.

    1. Confirm the sign-in: click "Continue".

    1. Confirm granting the required permissions (click "Allow").

    Upon successful authorization, you will see the following window.

    Access blocked: Authorization Error (**Error 400: invalid_request)

    Solution: enter the station's URL address in the MikoPBX web interface: "Network and Firewall" -> "Network Interfaces". Go to the "Network Topology" section and enter the hostname in the "External hostname of your router" field. (Enable "This station is located behind a NAT router".)

    Application dialplans

    Creating and Configuring Dialplan Applications

    Dialplan applications are programmable voice applications in PHP and Asterisk Dialplan. MikoPBX comes with several pre-configured applications. With some basic knowledge of Asterisk dialplans, additional applications can be easily created. Like a phone account, applications can have an extension assigned in the settings.

    MikoPBX comes with several pre-configured applications. With some basic knowledge of Asterisk dialplan, you can easily create additional applications. Like a phone extension, applications can have an internal number assigned in the settings.

    Below you will see a description of the basic applications included in MikoPBX:

    Application Number
    Application Description

    Microsoft Outlook Setup (OAuth2)

    Mail setup for the Outlook service (outlook.com; hotmail.com) via OAuth2 Authentication

    1. Sign in to the

    1. Go to "Entra ID" -> "App registrations". Then click "New registration" to register a new application.

    Running MikoPBX in a container

    MikoPBX Installation Guide using Docker container

    To work with MikoPBX in a container, you need to install Docker and Docker Compose, as well as create a user and directories for storing configuration settings and call recordings according to the instructions

    To launch the container with your application, use the following commands:

    To ensure that your MikoPBX application is posted and working in the Docker container, you can follow these steps after launching it. These steps will help you verify the container's status and view its logs.

    First, ensure that the container is successfully launched and running. To do this, use the command docker ps, which will show a list of running containers and their statuses.

    This command will display information about all active containers. Make sure that the mikopbx container is present in the list and its status indicates that it is running (e.g., status

    Connecting AWS S3 Storage

    Instructions for connecting AWS S3 as cloud storage for automatic uploading of call recordings from MikoPBX

    1. Go to the AWS console (). Navigate to "All services" -> "Storage" -> "S3".

    1. Click "Create bucket".

    disk for storing call recordings

    79257184255, 7925, 7925718…

    7ХХ

    0

    700, 701, 702…

    74952293042

    0

    74952293042

    74(95|99)

    7

    74952293042, 74996382584…

    (7|8)0{1}

    1

    700, 701, 802, 803…

    (25|26)

    0

    25, 26

    [0-9]{1}

    0

    digit from 0 to 9, occurrence once

    [1-5]{2}

    0

    12, 15, 14, 25 digit from 1 to 5, occurrence twice

    [8-9]+

    0

    8899, 888, 988888 digit from 8 to 9, occurrence one or more times

    SSL/TLS (port 465) — SMTP connection with encryption from the very beginning of the connection. The channel is secured immediately after the TCP connection is established, without a switching phase.

    Log

    Provides the user with access to reading logs

    Read only

    Verbose

    Provides the user with access to reading detailed logs

    Read only

    Agent

    Reading agent status events from app_queue and chan_agent modules

    Allows the user to perform actions to manage and retrieve the status of queues and agents

    User

    Access to user events as well as Jabber/XMPP user events

    Allows the user to execute the UserEvent command to create custom events

    Config

    For recording only

    Allows the user to receive, update, and overload configuration files

    Command

    For recording only

    Allows the user to execute Asterisk CLI commands from AMI

    DTMF

    Allows the user to receive DTMF events

    Read only

    Reporting

    Access to call quality events such as jitterbuffer or RTCP

    Allows the user to perform a number of actions to obtain statistics and information about the status of the entire system

    Cdr

    Reading data write events in CDR

    Read only

    Dialplan

    Reading events for setting dialplan variables, creating extents

    Read only

    Originate

    For recording only

    Allowing the user to execute the Originate command, which sends a request to create a new call

    REST API usage examples

    Interactive documentation and endpoint list

    Cover
    Cover
    OAuth2 Provider — Google/Gmail.
  • Application ID (Client ID), Secret key (Client Secret) — the data saved from Google Cloud (step 12 from the previous section of this guide).

  • Format:

    https://mikopbx.station.com/pbxcore/api/v3/mail-settings/oauth2-callback

    Replace "mikopbx.station.com" with your station's URL.

    Settings in MikoPBX

    Troubleshooting

    link
    link
    "APIs & Services" section in Google Cloud
    "Library" section in APIs & Services
    Gmail API in the Google Cloud library
    Enabling the API
    "OAuth consent screen" section in APIs & Services
    "Audience" parameter in project creation process
    Creating a new OAuth client ID
    Creating a new OAuth client ID
    Adding a new redirect URL
    Successfully created client
    "Mail and Notifications" section in MikoPBX
    Mail parameters for connecting Gmail
    Selecting a Google account
    Continuing authorization
    Granting permissions
    Successful authorization
    Error 400: invalid_request
    Problem solution
    In the last line of the log selection, find the identifier:
    The obtained data can be sent to technical support for further assistance.

    Example: Call Analysis

    System Information

    Campuring network packets

    Capturing Network Packets

    You can use the search function in WinSCP by entering "log-tcpdump*" in the file name field and specifying the search directory as "/storage"

    Download All System Logs

    Be careful! If there are many calls or heavy network "load" on the PBX, logs can take up a significant amount of disk space.

    connect to the PBX via WinSCP
    SSH client
    Wireshark utility
    tcpdump application
    "Show log" section
    Filters
    System information section
    "Computer network packets" section
    "Start" button
    "Stop" button
    Logs file
    "Download all system logs" button
    [2023-03-18 16:28:17] VERBOSE[21654][C-0000000f] app_stack.c: Spawn extension (SIP-1676196499-22-outgoing, 74952293042, 13) exited non-zero on 'PJSIP/302-0000001a'
    Create extended label and icon files -
    uncheck this option
    diskutil list
    sudo diskutil eraseDisk FAT32 NONAME MBRFormat /dev/disk4;
    sudo diskutil unmountDisk /dev/disk4;
    sudo dd if=mikopbx-2024.1.114-x86_64.iso of=/dev/disk4 bs=1m;
    lsblk
    sudo mkfs.vfat -F 32 -n NONAME /dev/sdb
    sudo umount /dev/sdb*
    sudo dd if=mikopbx-2024.1.114-x86_64.iso of=/dev/sdb bs=1M

    The USB drive size must be at least 1 GB. All data on the USB drive will be deleted!

    MacOS

    The USB drive size must be at least 1 GB. All data on the USB drive will be deleted!

    All data on the disk will be deleted! Double-check the disk name before formatting!

    Linux

    The USB drive size must be at least 1 GB. All data on the USB drive will be deleted!

    All data on the disk will be deleted! Double-check the disk name before formatting!

    System installation

    All data on the selected disk will be erased!

    Default credentials for first login to the Web interface:

    Login: admin Password: admin

    .iso image
    "System installation"
    "System installation"
    "System installation"
    Rufus main page
    Selected image and disk
    Starting the image writing process
    "Write in DD image mode" option
    Disk format confirmation
    Successfully writed image
    List of all available disks
    Formatting the disk
    unmountDisk command
    Successfully writed image
    lsblk command
    Disk fromatting
    umount command
    Successfully writed image
    System booted from LiveUSB device
    Section "[8] Install"
    Selecting the system disk
    Confirmation of your choice
    Selecting the records storage disk
    Successfully installed system
    Host Name, Access key ID, and Secret access key – from the storage information

    Importing the ISO

    Adding an SSH Key Pair

    Creating a Virtual Machine

    Creating a Second Disk

    We recommend at least 50GB for storing call recordings. This guide uses 30GB as an example.

    Installing the System

    Connecting to the Web Interface

    following this guide
    "Add Object Storage" button
    Name of the Object Storage
    Creating a new bucket
    S3 Credetials
    "New Site"
    S3 Connection parameters
    Uploading the .iso disk image file
    "Change Access"
    "Copy URL" button
    "ISOs" section
    "Add ISO" button
    "Add SSH Key" button
    Adding SSH Key Pair
    "Compute" section
    "Deploy Server" button
    VM Parameters №1
    VM Parameters №2
    "Block Storage" section
    "Add Block Storage" button
    "Attach to" option
    "Server Information" page
    "Console" button
    Built-in console
    Installing system
    "Remove ISO" element
    MikoPBX IP-adress
    Machine ID
    MikoPBX Web-interface
    disk for storing call recordings

    000063

    The application reads the internal number of the employee used to call the application and voices it to the employee, i.e. the employee is voiced his internal number on the PBX

    000064

    0000MILLI - Generates a constant sound signal with a frequency of 1000 Hz. Used to check the quality of the connection.

    10003246

    The Echo application sends the received audio signals back to the user so that the delay duration can be determined. In general, you hear what you say. The application is mainly used for testing.

    MikoPBX applications are created from several plans of the Asterisk application suite. There are many examples of ready-to-run applications in the system. To add a new MikoPBX application, click on "Add a New" in the application menu.

    "Add a new" button

    In just a few steps, you can create your own applications. First, define the Name and Call Number for the application, and optionally fill in the Comment field.

    Possible application code types:

    • PHP-AGI script - AGI is an embedded method in Asterisk for executing external scripts (similar to CGI for HTTP servers), which can extend Asterisk's functionality using other programming languages, particularly PHP. AGI scripts can control call handling in the dialplan and are invoked from the extensions.conf file.

    • Asterisk Dialplan - The configuration of the dialplan is contained in the Asterisk configuration file called extensions.conf. This is one of the most important configuration files where the processing and routing of incoming and outgoing calls are defined. This file governs the behavior of all connections passing through your PBX (Private Branch Exchange).

    Parameters of the new dialplan application

    Let's clarify: we will refer to MikoPBX applications as "applications" and Asterisk dialplan functions as "functions". For example, Answer(), NoOP(), Set(), and Wait() are functions. These are individual target functions in Asterisk that are then combined in MikoPBX to create more powerful MikoPBX applications.

    Describe the logical operations in the text field of the Programme Code. Please note that only one command is allowed per line, for example:

    "Programme code" section

    The figure shows an example of the simplest application for the number 000063. After dialing the number, you will hear the robot voice your internal number.

    Description of Asterisk functions that you can use in your applications:

    Наименование команды
    Описание

    answer

    Transfer the call to the answered state.

    channel status

    Returns the status of the connected channel.

    control stream file

    Sending a preset audio file to the channel, with the ability to control its playback (pause/rewind/resume playback) using the DTMF digits received from the subscriber, if specified. (Asterisk 1.2)

    List of basic Application dialplans

    Creating applications

    MikoPBX will check the commands used. It is possible that incorrectly programmed operations may affect the performance of your telephone system.

    Select the following parameters for your application:

    • Name - enter a name for your application.

    • Supported account types - select "Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)".

    Application parameters
    1. Specify the Redirect URL:

    • Select a platform — select "Web".

    • URL:

    Replace 192.168.100.71 with your MikoPBX address.

    Then click "Register".

    Redirect URL parameters
    1. The application will be created. Save the Client ID — you will need it in the future for configuration inside the MikoPBX web interface.

    Created application overview page
    1. From the application's main page, go to "Manage" -> "API permissions".

    "API permissions" section
    1. Click "Add a permission".

    Adding permissions
    1. In the "Microsoft Graph" section, select "Delegated Permissions". Enter "SMTP" in the search bar. Check the box next to "SMTP.Send".

    Granting the "SMTP.Send" permission
    1. Also enter "offline" in the search bar. Check the box next to "offline_access".

    Click "Add permissions".

    Granting the "offline_access" permission
    1. Next, go to "Certificates & secrets" -> "Client secrets". Click "New client secret".

    Creating a new Secret ID
    1. Set the required parameters:

    • Description - an arbitrary description.

    • Expires - the duration for which you are issuing this client secret. It will be needed for application authentication in MikoPBX.

    Click "Add".

    Parameters for creating a new client secret
    1. Copy the "Value" (not the Secret ID!). It will be needed for configuration in the MikoPBX web interface.

    Copying the Value of the previously created Client Secret

    For the application to work correctly, you need to grant permission to use the SMTP protocol for the user whose mailbox you are authorizing during this setup. To do this, follow these steps:

    1. Go to the organization's admin center (link).

    Microsoft Admin Center home page
    1. Go to "Users" -> "Active Users". Click on the name of the user account under which the application is being created.

    "Active Users" section in Microsoft Admin Center
    1. In the account, go to the "Mail" section and select "Manage email apps".

    "Mail" section in the user account
    1. Make sure that "Authenticated SMTP" is allowed. Save the changes by clicking "Save changes".

    Allowing Authenticated SMTP for the selected user
    1. Go to the MikoPBX web interface. Then "System" -> "Mail and Notifications" -> "SMTP Settings".

    Fill in all the required fields:

    • Sender address, Sender name — your email and the name from which the emails will be sent.

    • Authentication type — OAuth2.

    • SMTP login — your email.

    • OAuth2 Provider — Microsoft/Outlook.

    • Application ID (Client ID), Secret key (Client Secret) — data from Microsoft Entra.

    Leave all other settings at their default values. A more detailed description can be found in the main article about mail parameters (link).

    After that, click "Save"!

    1. Click "Connect via OAuth2". Sign in to your Microsoft account. Then confirm granting all requested permissions.

    Upon successful authorization, you will see the corresponding window.

    Successful authorization

    Settings in Microsoft Entra

    Application Registration

    Microsoft Entra admin center.
    Microsoft Entra admin center home page
    Registering a new application
    https://192.168.100.71/pbxcore/api/v3/mail-settings/oauth2-callback

    Granting Permissions and Creating a Client Secret

    After expiration, the created client secret will stop functioning and you will need to repeat the process of creating a new key and connecting to MikoPBX.

    After creation, the Client Secret value will be shown only once. Do not forget to copy it into the MikoPBX web interface.

    Granting Permissions to a User

    Settings in MikoPBX

    up
    ).

    After confirming that the container is running, the next step is to view the logs to ensure that the application has loaded without errors and is functioning properly. The docker logs command will allow you to see the output generated by your application.

    Check the command output for a message similar to the one below. This message indicates that MikoPBX is successfully loaded and ready for use:

    If you see the MikoPBX startup process, wait a moment and re-run the command sudo docker logs mikopbx

    When the container starts, it lacks information about the host system's address, so you need to open the external address of the host system, in this case, Ubuntu, in a web browser. https://<host machine IP>

    Log into the web interface using the admin login and the admin password to make sure that the web interface is accessible and functioning correctly.

    • If you need to use the "Backup Module", the container should be run with the –privileged flag. When MikoPBX is run in a container, backups can also be performed by manually archiving the cf and storage directories. In this case, the privileged mode is not necessary, but the container must be stopped during copying.

    • The –net=host flag indicates that NAT between the host and container will not be used. MikoPBX will be directly connected to the host machine's network. All ports that the container needs to occupy will also be occupied on the host machine. If any port on the host machine is unavailable, errors will occur when loading MikoPBX. More details in the Docker documentation.

    • If necessary, you can adjust the standard set of ports used by MikoPBX. This can be done by declaring environment variables when launching the container.

    In addition to using our official registry, you might need to create a container from an image, for example, for a beta version. Our published releases and pre-releases include a tar archive, which we use to create a container.

    Here is an example code for its use:

    Do not forget to configure the external firewall correctly for your PBX. You can find the setup instructions here.

    Below are some of the environment variables that will allow you to adjust the MikoPBX ports and settings used.

    • SSH_PORT - port for SSH (22)

    • WEB_PORT - port for the web interface via HTTP protocol (80)

    • WEB_HTTPS_PORT - port for the web interface via HTTPS protocol (443)

    • SIP_PORT - port for connecting a SIP client (5060)

    • TLS_PORT - port for connecting a SIP client with encryption (5061)

    • RTP_PORT_FROM - beginning of the RTP port range, voice transmission (10000)

    • RTP_PORT_TO - end of the RTP port range, voice transmission (10800)

    • IAX_PORT - port for connecting IAX clients (4569)

    • AMI_PORT - AMI port (5038)

    • AJAM_PORT - AJAM port used for connecting the telephony panel for 1C (8088)

    • AJAM_PORT_TLS - AJAM port used for connecting the telephony panel for 1C (8089)

    • BEANSTALK_PORT - port for the Beanstalkd queue server (4229)

    • REDIS_PORT - port for the Redis server (6379)

    • GNATS_PORT - port for the gnatsd server (4223)

    • ID_WWW_USER - identifier for www-user (can be set with the expression $(id -u www-user), where www-user is NOT a root user)

    • ID_WWW_GROUP - group identifier for www-user (can be set with the expression $(id -g www-user), where www-user is NOT a root group)

    • WEB_ADMIN_LOGIN - login for Web interface access

    • WEB_ADMIN_PASSWORD - password for Web interface access

    A full list of all possible setting parameters is available in the source code here.

    # Pulling the container image
    sudo docker pull ghcr.io/mikopbx/mikopbx:latest
    
    ## Alternatively, you can download the image from Docker Hub.
    # sudo docker pull mikopbx/mikopbx:latest
    
    # Running the container in unprivileged mode
    sudo docker run --net=host --name mikopbx --hostname mikopbx \
               -v /var/spool/mikopbx/cf:/cf \
               -v /var/spool/mikopbx/storage:/storage \
               -e SSH_PORT=23 \
               -e ID_WWW_USER="$(id -u www-user)" \
               -e ID_WWW_GROUP="$(id -g www-user)" \
               -it -d --restart always ghcr.io/mikopbx/mikopbx:latest
    sudo docker ps

    Launching the Docker container

    Docker will automatically download the image for your system architecture (x86-64 or arm64).

    The image is also available on Docker Hub: mikopbx/mikopbx:latest

    Testing the functionality

    Step 1: Check container status

    Docker installation and creating a user and directories
    sudo docker logs mikopbx
    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    |               All services are fully loaded welcome                |
    |                         MikoPBX 2026.1.223                         |
    |       built on Tue Apr 7 03:39:14 UTC 2026 (arm64) in Docker       |
    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    |                        Web Interface Access                        |
    |                                                                    |
    | Local Network Address:                                             |
    | https://192.168.65.3                                               |                                             |
    |                                                                    |
    | Web credentials:                                                   |
    |    Login: admin                                                    |
    |    Password: admin                                                 |
    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    | SSH access disabled!                                               |
    |                                                                    |
    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    # Create a container from a tar archive (you need to download it first!)
    sudo docker load -i mikopbx-2026.1.223-x86_64-docker.tar
    
    # Launch the created container
    sudo docker run --net=host --name mikopbx --hostname mikopbx \
         -v mikopbx_cf:/cf \
         -v mikopbx_storage:/storage \
         -e SSH_PORT=23 \
         -e ID_WWW_USER="$(id -u www-user)" \
         -e ID_WWW_GROUP="$(id -g www-user)" \
         -it mikopbx:2026.1.223

    Step 2: View container logs

    Step 3: Check access to the web Interface

    Features of containerized MikoPBX

    Creating a container from a tar archive

    Environment variables for configuring MikoPBX

    Enter any name for the bucket (field "Bucket name"). Leave all other parameters as default and click "Create bucket".

    Parameters of the bucket being created
    1. Go to "All services" -> "Security, Identity, & Compliance" -> "IAM".

    "IAM" section
    1. Next, create a new IAM user. Go to the "Access Management" tab, then "Users". Click "Create user".

    Creating a new IAM user
    1. Enter the name of the IAM user in the "User name" field.

    Click "Next".

    "Specify user details" tab
    1. Select "Attach policies directly" as the "Permissions options". Scroll down the page.

    Selecting "Permissions options"
    1. In the "Permissions policies" section click "Create policy".

    "Create policy" button
    1. In the newly opened tab, in the "Policy editor", select "JSON" as the format and paste the following content into the parameters field:

    Click "Next".

    Creating a new policy. Step 1
    1. Next, specify any name for the policy being created.

    Click "Next".

    Creating a new policy. Step 2
    1. Return to the user creation tab, refresh the policy list, and select the previously created policy (in this guide — "access-mikopbx").

    Click "Next".

    Selecting the previously created policy
    1. Confirm user creation: click "Create user".

    Confirming user creation
    1. Open the page of the created user by clicking on the username.

    Opening the created user's page
    1. Go to the "Security credentials" section. Click "Create access key".

    Creating an access key
    1. Select "Application running outside AWS". Click "Next".

    Selecting parameters when creating the key
    1. Enter a description for the key so that you can identify it later. Click "Create access key".

    Key description

    The Access key and Secret access key will be displayed. Save them — they will be needed later when configuring MikoPBX.

    Access key and Secret access key
    1. Go to the "Maintenance" -> "Storage" tab.

    "Maintenance" -> "Storage" section
    1. Open the "S3 Cloud Storage" tab and fill in the following fields:

    • Automatic recording upload to cloud storage — enable the switch.

    • S3 endpoint URL — enter the S3 AWS endpoint depending on the region of your bucket (link to the table with all URLs). In this guide — https://s3.ap-southeast-1.amazonaws.com

    • S3 region — specify the region of your bucket. In this guide — ap-southeast-1

    • S3 bucket name — enter the name of the bucket created in AWS (for example aws-s3-mikopbxstorage in this guide)

    • Access key and Secret key — paste the values obtained when creating the service account access key.

    Configure the “Local storage period (S3 mode)” slider — choose how long recordings will be stored locally before being deleted after uploading to the cloud.

    Click “Save”.

    Parameters for connecting S3 cloud storage in MikoPBX

    After saving the settings, click "Test connection". If the connection is successful, the message “S3 connection successful” will appear and synchronization of call recordings will begin.

    Successful connection

    Creating a Bucket

    link
    "S3" section in AWS
    Button for creating a bucket
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:ListBucket"
          ],
          "Resource": [
            "arn:aws:s3:::your-bucket-name",
            "arn:aws:s3:::your-bucket-name/*"
          ]
        }
      ]
    }

    Creating an IAM User and Access Keys

    Replace "your-bucket-name" with the name of the bucket you created earlier (in this guide — "aws-s3-mikopbxstorage").

    The secret access key can only be viewed or downloaded now. It cannot be recovered later.

    Connecting to MikoPBX

    Shorter local storage periods free up disk space faster.

    arrow keys
    numpad

    VirtualBOX

    Installing MikoPBX as a guest machine in VirtualBOX

    Use versions of MikoPBX below 2024.1.114 for installation on VirtualBOX

    Version 2024.1.114 temporarily does not support installation on VirtualBOX

    Create a virtual machine

    1. Download Virtual Box from the link and install it.

    2. Create a new virtual machine.

    Button for creating a new VM
    1. Specify the Machine Name and Folder.

    Type - Linux.

    Version - Other Linux (64Bit).

    Click Next.

    1. Specify the size of the base memory - 1024 MB, as well as the number of processors - 2

    Press Next.

    1. Select Create a new virtual hard disk. Enter a disk size of 700 MB, and also check the box "Pre-allocate Full Size"

    Click Create.

    1. Confirm the creation of the virtual machine: click Finish.

    1. Go to the settings of the created virtual machine.

    To do this, click "Settings" in the upper menu.

    1. Click the "Storage" tab. Add a new hard drive to store call records.

    1. In the window that appears, click Create.

    1. Select the hard disk format - VDI (VirtualBox Disk Image).

    Click Next.

    1. The hard disk must be of a fixed size.

    Check the box next to "Pre-allocate Full Size"

    Click Next.

    1. Specify the Name of the created disk.

    Set the Disk Size to about 50 GB.

    Click Finish.

    1. Choose the newly created drive and click Select.

    1. The created drive will appear in the media list.

    1. Please mount the MikoPBX image onto an optical disc. To do this, select the optical disc in the 'Media' section and click on the image file selection button in the 'Attributes' section.

    1. In the appeared menu, click on 'Choose a disk file...'

    1. Select the downloaded ISO disk image.

    1. "Go to the 'Network' tab.

    Set the Connection Type to 'Bridged Adapter'. Click 'OK' to save all the settings you have made.

    1. Start the created virtual machine.

    1. The command interface of the PBX will open. The PBX will start booting.

    At this stage, MikoPBX is booting from the optical disc containing the ISO image. This is indicated by the message: 'The system is loaded in Recovery mode'.

    1. Install MikoPBX.

    Click Install.

    1. Information about all available disks will be displayed (in this example: sdb, sdc).

    1. Enter the name of the disk you referred to as the 'system disk' from the keyboard, in this case sdb, and press Enter. (If it is selected by default, you can simply press Enter).

    2. The system will prompt for confirmation. Enter 'y' and press Enter.

    1. After completing the installation, you will be prompted to select a disk for storing call records.

    Enter the disk name (in this example, the only available disk is 'cdc') and press Enter.

    1. After the installation is complete, the system will reboot.

    MikoPBX will now run from the sdb drive where you installed it.

    We will see that the line "The system is loaded in Recovery mode" is missing.

    To access the control panel, you need to enter the IP address of your virtual machine in the browser's address bar.

    The installation of MikoPBX using VirtualBOX is now complete.

    Alibaba Cloud

    Installing MikoPBX using the Alibaba Cloud platform

    This guide applies to MikoPBX version 2024.2.135 and later!

    This step-by-step guide will walk you through installing MikoPBX on the Alibaba Cloud platform.

    Before starting, download the latest .raw MikoPBX image from MikoPBX’s GitHub releases.

    Uploading the Image to Alibaba Cloud

    Creating a Bucket

    First, create a bucket for storing your image. Go to the OSS Management Console (link).

    1. Go to Buckets.

    Buckets section
    1. Click Create Bucket:

    1. Specify the following:

    • Bucket name – a custom name for your storage.

    • Region – pick the region where your image will be stored.

    Click OK.

    1. Go to your newly created bucket by clicking its name in the Buckets section:

    1. Click Upload object and upload the previously downloaded .raw disk image file (leave other parameters at default).

    1. Once the disk image file is uploaded, copy its link. Click View Details to the right of the file name; in the opened menu, copy the URL field.

    1. Return to the ECS Console () and go to Images.

    1. Click Import Image:

    1. Select Linux Operating System and click Next.

    2. Enter/select the following image parameters:

      • Image File URL – Paste the link to the disk image file you uploaded.

    Click OK to create the image. Wait until the process finishes (the Status will show Available).

    Next, create and add an SSH key pair in Alibaba Cloud.

    1. In the ECS Console, go to Network Security → Key Pairs:

    1. Click Create SSH Key Pair:

    1. Generate an SSH key pair. For details on how to generate a key pair, see . Fill in the required parameters:

    • Name – A custom name for your key pair.

    • Creation Mode – Import

    • Public Key – Paste your public key, generated earlier.

    Click OK to create the key pair in the cloud.

    Before creating the virtual machine, you must set up a security group (firewall).

    1. Go to Network & Security → Security Groups:

    1. Click Create Security Group:

    1. Specify the following security group parameters:

    • Security Group – A custom name for your security group.

    • Network – Your selected network. If it doesn’t exist yet, click "Create VPC" to the right.

    • Security Group – Basic Security Group.

    Click Create Security Group.

    1. Go to Instances & Images → Instances:

    1. Click Create Instance to create a new virtual machine:

    1. Select your VM parameters:

    • Billing Method – Choose how you’ll pay for the VM.

    • Region, Network, and Zone – Select the region and zone to match your needs.

    • Instance – Pick a configuration for your VM.

    1. Configure additional VM parameters:

    • Image – Custom Images → Choose the previously imported image.

    • Storage – Select the type and size of the System Disk (20 GB is the minimum for Alibaba Cloud).

    • Add a second disk by clicking Add Data Disk, specifying its type and size.

    1. Choose the network parameters for your VM. The security group created earlier will be assigned automatically:

    1. Click Create Order.

    In the Instances section, open the newly created VM by clicking its name.

    1. Click Connect.

    1. Select VNC. A new tab will open in your browser with console access.

    Enter the following command to connect via SSH:

    Replace:

    • C:\Users\username\.ssh\id_ed25519 with the path to your SSH key,

    • root if you changed the default user when creating the VM,

    • ip-adress with the external IP address of your MikoPBX instance.

    You will then connect via SSH:

    On the VM’s main page, you’ll see important parameters for logging into the MikoPBX web interface.

    Paste the IP address into your browser’s address bar to access the MikoPBX web interface login page.

    Connecting MinIO S3 Storage

    Instructions for deploying and connecting local MinIO S3 to MikoPBX

    This guide describes the process of deploying local MinIO S3 storage and connecting it to MikoPBX. All actions are performed on macOS - for other operating systems, the official documentation is available at the link.

    Installing MinIO on macOS

    1. Open the terminal and run the command:

    brew install minio/stable/minio

    After the installation is complete, the terminal will display a confirmation:

    🍺  /opt/homebrew/Cellar/minio/RELEASE.2025-09-06T17-38-46Z_1: 4 files, 108.2MB, built in 3 seconds
    1. Create a directory for data.

    mkdir -p ~/minio-data
    1. Start the server:

    You will see the following output with useful information, including the WebUI address for convenient further work with the storage.

    After starting, leave the terminal window open - closing it will stop the server.

    To start MinIO automatically when the system starts, run:

    1. Open a browser and go to the WebUI address.

    Enter the credentials:

    • Username: minioadmin

    • Password: minioadmin

    1. Click "Create Bucket" in the left menu.

    1. Enter a bucket name, for example mikopbx-recordings.

    Click "Create Bucket".

    To create an access key and configure access permissions, you will need the mc console utility.

    Install MinIO Client:

    After installation, check the version:

    Add the local MinIO server as an alias:

    Check the connection:

    If the connection is successful, information about the MinIO server will appear in the terminal.

    It is not recommended to use the MinIO root user for connecting external applications.

    1. Create a separate user for MikoPBX:

    1. Create a policy file:

    1. Add the following content to it:

    1. Save the file:

    1. Create the policy in MinIO:

    1. Attach the policy to the user:

    Create an access key for the mikopbx-user user:

    MinIO will display access data in response:

    Save Access Key and Secret Key. They will be needed to connect MinIO to MikoPBX.

    Secret Key is displayed only when it is created.

    1. Go to the "Maintenance" -> "Storage" tab.

    1. Open the "Cloud storage S3" tab and fill in the following fields:

    • Automatic recording upload to cloud storage - enable the switch.

    • S3 storage provider - MinIO

    • S3 endpoint URL - http://192.168.64.1:9000

    Configure the "Local storage period (S3 mode)" slider - choose how long recordings will be stored locally before being deleted after uploading to the cloud.

    Click "Save".

    After saving the settings, click "Test connection". If the connection is successful, the message "S3 connection successful" will appear and synchronization of call recordings will begin.

    Connecting Wasabi S3 Storage

    Instructions for connecting Wasabi Cloud Storage as an S3 storage

    Creating a Bucket and Access Keys

    1. Go to the Wasabi console (link).

    2. In the left menu, select "Buckets" and click "Create Bucket".

    Creating a new bucket
    1. On the bucket creation page, specify:

    • Bucket Name — enter any unique name for the bucket (e.g., mikopbx-s3-storage).

    • Region — select the region closest to your MikoPBX server.

    Click "Create Bucket".

    1. After creating the bucket, you need to create an access policy. Go to "Policies" in the left menu and click "Create Policy".

    1. Enter a name for the policy (Policy Name) and a description for future identification (Description). In the "Policy Editor" field, paste the following set of rules:

    1. Go to "Users" in the left menu (under "Users & Groups") and click "Create User".

    1. On the first step "Details", fill in the following parameters:

    • UserName — enter any username (e.g., mikopbx-user).

    • Type of Access — check only "Programmatic (create API keys)".

    • Require MFA — leave disabled.

    Click "Next".

    1. On the Groups step — skip it and click "Next".

    1. On the Policies step — select the policy you created earlier (e.g., mikopbx-access in this guide) and click "Next".

    1. On the Review step, verify the parameters and click "Create User".

    After the user is created, the Access Key and Secret Key will be displayed. Save these values — you will need them to configure MikoPBX. The Secret Key is shown only once.

    1. Go to the "Maintenance" tab → "Storage".

    1. Switch to the "S3 Cloud Storage" tab and fill in the following fields:

    • Automatically upload recordings to cloud storage — enable the toggle.

    • S3 endpoint URL — enter the endpoint for your region from the table below. For example, for region eu-central-1: https://s3.eu-central-1.wasabisys.com

    • S3 region — specify the region of your Wasabi bucket (e.g., eu-central-1

    Click "Save".

    Region
    Endpoing URL

    After saving the settings, click "Test Connection". If the connection is successful, the message "S3 connection successful" will appear and synchronization of call recordings will begin.

    System files customisation

    Description of the capabilities of the "System file customization" section

    The system file customization section can be found under "System" -> "System file customization":

    System file customization section

    This section allows for customization of system and Asterisk configuration files. We recommend using this section only for experienced Asterisk administrators. MikoPBX provides the ability to modify the following configuration files via the web interface:

    File Name

    Description

    To edit a configuration file, use the button:

    You will be presented with the configuration file editing form:

    Choose one of four editing options:

    • "Not change" - prevents modifications, read-only mode.

    • "Add to end of file" - appends content to the end of the selected configuration file (recommended).

    • "To replace all" - your changes will completely overwrite the configuration file.

    In some cases, more complex modifications to system files are required than simply adding text to the end of a configuration file. For instance, you may need to redistribute PJSIP account parameters while retaining the ability to configure the system through the web interface.

    We've introduced a new approach to customization, where you can describe a Bash script that will execute each time the system generates a configuration file. This way, integrators can make precise changes to configuration files without developing additional modules.

    For example, you can modify the pjsip.conf file and change the max_contacts parameter for all internal numbers, except one.

    You can add parameters to an existing section using the (+) syntax:

    It is possible to intercept the execution of the dialplan by defining custom contexts. Currently, you can intercept executions in the following contexts:

    • internal-originate-custom - used for calls originating from the telephony panel for 1C.

    • <PROVIDER-ID>-incoming-custom - used for handling incoming calls from the provider.

    • <PROVIDER-ID>-outgoing-custom - used for handling outgoing calls via the provider.

    Example context:

    Make sure to call the method "return" at the end.

    Increasing the MikoPBX Storage Disk Size

    Use this guide when the disk that contains the local MikoPBX storage has been expanded in the hypervisor or on the physical server, but the /storage/usbdisk1 partition still shows the old size.

    The local storage contains call recordings, call history, system logs, additional modules, backups, and system caches. In a standard installation, the storage is mounted at /storage/usbdisk1.

    Before changing partitions, create a MikoPBX backup and a virtual machine snapshot or disk backup using your hypervisor tools.

    You can run diagnostics over SSH. Run the actual resize operation from the local console, hypervisor console, or serial console. The standard resize script calls /sbin/freestorage, which stops the SSH server dropbear, so the SSH session will be disconnected.

    When to Use This Guide

    Use this scenario if:

    • MikoPBX is installed on a virtual machine or a physical server;

    • the storage disk has already been expanded at the hypervisor, RAID controller, or storage subsystem level;

    • df -h /storage/usbdisk1 still shows the old file system size;

    • the disk has unallocated space after the current storage partition.

    This guide does not apply to Docker installations. In Docker, the size of the /storage directory is managed by the host operating system and volume settings.

    Connect to MikoPBX over SSH for diagnostics only, or open the MikoPBX console and run:

    Find the disk listed in the m_Storage table. For example:

    In this example, the storage disk is /dev/vdc, and the storage partition is /dev/vdc1.

    Save the disk name to a variable:

    Check the disk size and unallocated free space:

    After the disk has been expanded in the hypervisor, the output must show that the disk itself is larger and that Free Space appears after the existing partition.

    Example state before resizing:

    If there is no free space, first expand the disk in the hypervisor or check that you selected the correct disk.

    On GPT disks, after expanding a virtual disk, parted may show this warning:

    In this case, first move the backup GPT header to the end of the new disk size:

    Then repeat the check:

    The Not all of the space... warning should disappear. The free space after the partition should still be visible.

    Open the local MikoPBX console or the virtual machine console.

    In the console menu, select:

    Confirm stopping processes:

    Enter y.

    MikoPBX will run the standard scenario:

    • stop services that use storage;

    • unmount /storage/usbdisk1;

    • expand the storage partition to the end of the disk;

    If you need to run the same scenario as a command from the console, use:

    After MikoPBX boots, identify the storage disk again and run the checks:

    In a correct state:

    • /storage/usbdisk1 is mounted from the same storage partition;

    • the size of /storage/usbdisk1 has increased;

    • there is no free space after the storage partition, or only a minimal technical gap remains;

    Example result after a successful resize:

    Check that the data is accessible:

    The correct response for the call history database is:

    Check services:

    Immediately after reboot, some monit checks may be in the Initializing state. Wait 1-2 minutes and repeat the check.

    If Resize storage reported success but df -h /storage/usbdisk1 still shows the old size, check GPT and free space:

    If the Not all of the space... warning is present, run:

    Then run the resize operation again from the console:

    If the free space is less than 5% of the disk size, the standard script may finish without resizing. In this case, check whether the disk was actually expanded enough.

    If the system does not boot or storage is not mounted after resizing, use the backup or snapshot created before the operation.

    If MikoPBX boots but storage is not mounted, check the UUID and database record:

    If needed, connect the storage disk again using the standard script:

    AWS deployment guide

    Full installation guide for MikoPBX using AWS

    Sign in to the service Amazon Web Services

    To follow the instructions, install the Amazon Command Line Utility by opening Terminal and entering the following command

    Let's get started with the setup

    1. Go to your account

    2. From the dropdown menu, select Security credentials

    Telephony providers

    Connecting and configuring telephony providers in MikoPBX

    "Telephony Providers" in MikoPBX is a section of the system where connections to external telecom operators via Internet protocols for IP telephony are configured. Here, administrators can add and configure SIP trunk accounts or other types of connections that allow the system to make and receive calls from landline and mobile numbers.

    To make or receive external phone calls via the public switched telephone network or the Internet, you must create at least one provider account. Each technology has its own account type. To add a new account or change an existing one, go to "Call Routing" -> "Telephony Providers":

    The provider overview contains a list of all available service providers. A green icon next to the provider's name indicates that MikoPBX has registered this provider, and you can start using this provider. You can enable or disable the use of the provider using the switch on the left.

    To connect a new provider account, click

    Network interface

    Description and configuration of network interfaces

    The "Network Interface" section in MikoPBX is an interface for configuring the system's network connection parameters. Here, administrators can manage IP addresses, subnet masks, gateways, and other network settings for each network interface. This allows MikoPBX to be correctly integrated into the organization's network and ensure its stable operation in accordance with the requirements of the network infrastructure.

    The section is located in "Network and Firewall" -> "Network Interface":

    The hostname is the name of the machine. If no value is specified, the default hostname used is 'mikopbx.local'.

    There are two ways to configure the IP address:

    database del

    Deleting a key/value from the database.

    database deltree

    Deleting the key/value tree from the database.

    database get

    Get the value from the database.

    database put

    Adding/changing a value in the database.

    exec

    Execution of the specified Command. (Commands are functions that you use when describing the set plan in the extensions.conf file).

    get data

    Get data from the channel.

    get option

    Behaves similarly to the "STREAM FILE" command, but is used with a specified value for timeout. (Asterisk 1.2)

    get variable

    Get the value of the channel variable.

    hangup

    Break the connection (Hangup) on the current channel.

    noop

    An empty command. Does nothing.

    receive char

    Accepts one character from the channel if it supports this feature.

    receive text

    Accepts a text string from a channel if it supports this feature.

    record file

    Writes to the specified file.

    say alpha

    Pronounces the specified string of characters. (Asterisk 1.2)

    say date

    Pronounces the date. (Asterisk 1.2)

    say datetime

    Pronounces the date and time according to the specified format. (Asterisk 1.2)

    say digits

    Pronounces the specified string of digits.

    say number

    Pronounces the specified number.

    say phonetic

    Pronounces the specified string of characters.

    say time

    Pronounces the time.

    send image

    Sends the image to the channel if it supports this feature.

    send text

    Sends text to the channel if it supports this feature.

    set autohangup

    Automatic termination of the connection (Autohangup) on the channel at the specified time.

    set callerid

    Setting the caller id for the current channel.

    set context

    Setting the context for the current channel.

    set extension

    Change the extension for the current channel.

    set music

    Включение/Выключение музыки ожидания (Music on hold), например: «SET MUSIC ON default».

    set priority

    Enabling/Turning off the standby music (Music on hold), for example: "SET MUSIC ON default".

    set variable

    Setting the channel variable.

    stream file

    Sending an audio file to the channel.

    tdd mode

    Setting the TDD mode for a channel that can support it to enable interaction with TDD.

    verbose

    Writing a message to the verbose log of the asterisk server.

    wait for digit

    Waiting for the DTMF button to be pressed

    S3 region - leave us-east-1 or enter any value (if you did not specify another one in the MinIO settings)
  • S3 bucket name - specify the bucket name created in MinIO (mikopbx-recordings in this guide)

  • Access key and Secret key - paste the values obtained in the previous part of this guide (key pair).

  • Creating a Bucket in MinIO

    Connecting MinIO Client to the Local Server

    Parameters here:

    • local - an arbitrary connection name

    • http://127.0.0.1:9000 - MinIO API address.

    • minioadmin - root user

    • minioadmin - root password

    Creating a User and Bucket Access Policy

    Replace strong-password with a strong password.

    Creating an Access Key for MikoPBX

    Connecting to MikoPBX

    Shorter local storage frees up disk space faster.

    MinIO web interface
    "Create Bucket" button in the MinIO web interface
    Specifying the name for the bucket being created
    Information about the MinIO server
    "Storage" section in the MikoPBX web interface
    Parameters for connecting MinIO S3
    Successful connection to the S3 bucket
    ).
  • S3 bucket Name — specify the name of the bucket created in Wasabi (e.g., mikopbx-s3-storage).

  • Access Key and Secret Key — paste the values obtained when creating the Access Key.

  • Configure the "Local storage (S3 mode)" slider — select how long recordings will be stored locally before being deleted after upload to the cloud.

  • eu-central-1 (Amsterdam)

    https://s3.eu-central-1.wasabisys.com

    eu-central-2 (Frankfurt)

    https://s3.eu-central-2.wasabisys.com

    eu-west-1 (London)

    https://s3.eu-west-1.wasabisys.com

    eu-west-2 (Paris)

    https://s3.eu-west-2.wasabisys.com

    ap-northeast-1 (Tokyo)

    https://s3.ap-northeast-1.wasabisys.com

    ap-northeast-2 (Osaka)

    https://s3.ap-northeast-2.wasabisys.com

    ap-southeast-1 (Singapore)

    https://s3.ap-southeast-1.wasabisys.com

    ap-southeast-2 (Sydney)

    https://s3.ap-southeast-2.wasabisys.com

    us-east-1 (N. Virginia)

    https://s3.wasabisys.com

    us-east-2 (N. Virginia)

    https://s3.us-east-2.wasabisys.com

    us-west-1 (Oregon)

    https://s3.us-west-1.wasabisys.com

    Remember your region name (e.g., ap-southeast-1), as you will need it when configuring MikoPBX.

    Replace "YOUR-BUCKET-NAME" with the name of the bucket you created earlier (e.g., mikopbx-s3-storage in this guide).

    Connecting to MikoPBX

    Bucket configuration parameters
    Creating a new access policy
    Access policy configuration parameters
    Creating a new user
    "Details" tab when creating a user
    "Groups" tab when creating a user
    "Policies" tab when creating a user
    "Review" tab when creating a user
    Access Key and Secret Key
    "Storage" section in MikoPBX
    S3 Wasabi connection parameters
    Successful connection
    "Script" mode in MikoPBX system file customization allows administrators to add custom scripts or commands directly into the configuration files. This mode is ideal for advanced users who need to execute specific actions, automate tasks, or modify system behavior dynamically, enhancing the flexibility of the PBX configuration. It should be used with caution to avoid system disruptions.

    all_peers-custom - used for direct outgoing calls from a phone.

  • outgoing-custom - used when dialing an external number, before selecting an outbound route.

  • add-trim-prefix-clid-custom - used for handling incoming calls, best suited for normalizing incoming phone numbers by adding/removing a prefix.

  • internal-users-custom - used for handling calls to internal extensions.

  • public-direct-dial-custom - used for handling incoming calls without authentication.

  • asterisk.conf

    General (global) settings of Asterisk. In the asterisk.conf configuration file, you define the following: - The location, permissions, and owner of the socket used to connect the remote management console to the server. The location of various directories used by the Asterisk server to determine where configuration files, libraries, scripts, and logs will be created. Default command-line parameters for starting the server.

    cel.conf

    Channel Event Logging. Unlike CDR, it logs all events that occur in the channel.

    extensions.conf

    The Asterisk dialplan. It defines how incoming and outgoing calls are handled and routed. This file controls the behavior of all connections passing through your PBX.

    features.conf

    The file defines custom codes and options for Asterisk functions like call transfer, call pickup, on-demand recording, digit timeout, call parking, etc.

    http.conf

    Built-in Asterisk HTTP server configuration.

    iax.conf

    Describes your IAX protocol connections.

    indications.conf

    Nationalization of tonal signals.

    logger.conf

    Asterisk logging configuration. This file configures logging of Asterisk events to files, console, and Linux syslog. To apply settings, run the command "logger reload" in the Asterisk console (CLI).

    manager.conf

    AMI (Asterisk Manager Interface) configuration.

    modules.conf

    Asterisk module loading parameters.

    musiconhold.conf

    Music-on-hold settings in IVR.

    queues.conf

    Asterisk queue settings. Detailed description of call strategies, penalty, timeout, member, and other available parameters.

    rtp.conf

    Global RTP settings – media ports and protocol.

    sip.conf

    Configures internal and external SIP channels in Asterisk.

    voicemail.conf

    Email notification settings.

    jail.local

    Fail2ban settings.

    msmtp.conf

    SMTP client settings.

    Customizing System Files with Scripts

    sip.conf

    extensions.conf

    Modify the dialplan with caution – there is a high chance of disrupting the PBX!

    Some examples of using custom contexts:

    • Call through a specific provider

    • Configuring outbound AOH for an employee

    Customization menu of the system file /acl.conf (example)
    File customization with "Scripts"
    run e2fsck;
  • run resize2fs;

  • reboot the system.

  • the UUID in /etc/fstab matches the UUID of the storage partition;

  • the m_Storage table points to the same storage disk.

  • Check the Current Storage Disk

    Instructions for connecting via SSH are available here.

    Fix GPT After Expanding the Disk

    Run Storage Resize

    Do not run this command from an SSH session. During execution, dropbear will be stopped and the connection will be disconnected.

    Check the Result After Reboot

    If the Size Did Not Change

    Rollback

    MINIO_ROOT_USER=minioadmin MINIO_ROOT_PASSWORD=minioadmin \
      minio server ~/minio-data --console-address ":9001"
    MinIO Object Storage Server
    Copyright: 2015-2026 MinIO, Inc.
    License: GNU AGPLv3 - https://www.gnu.org/licenses/agpl-3.0.html
    Version: RELEASE.2025-09-06T17-38-46Z (go1.24.6 darwin/arm64)
    
    API: http://192.168.100.114:9000  http://192.168.64.1:9000  http://127.0.0.1:9000
       RootUser: minioadmin
       RootPass: minioadmin
    
    WebUI: http://192.168.100.114:9001 http://192.168.64.1:9001 http://127.0.0.1:9001
       RootUser: minioadmin
       RootPass: minioadmin
    
    CLI: https://docs.min.io/community/minio-object-store/reference/minio-mc.html#quickstart
       $ mc alias set 'myminio' 'http://192.168.100.114:9000' 'minioadmin' 'minioadmin'
    
    Docs: https://docs.min.io
    brew services start minio/stable/minio
    brew install minio/stable/mc
    mc --version
    mc alias set local http://127.0.0.1:9000 minioadmin minioadmin
    mc admin info local
    mc admin user add local mikopbx-user 'strong-password'
    nano mikopbx-recordings-policy.json
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "s3:ListBucket",
            "s3:GetBucketLocation"
          ],
          "Resource": [
            "arn:aws:s3:::mikopbx-recordings"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject"
          ],
          "Resource": [
            "arn:aws:s3:::mikopbx-recordings/*"
          ]
        }
      ]
    }
    Ctrl + O
    Enter
    Ctrl + X
    mc admin policy create local mikopbx-recordings-rw mikopbx-recordings-policy.json
    mc admin policy attach local mikopbx-recordings-rw --user mikopbx-user
    mc admin accesskey create local/ mikopbx-user
    Access Key: A6FMEQOVJAK7K6TUI5O4
    Secret Key: HuKLsNh7hmS+3xdLzlpYaFjxu5wVxLPkM8XUTgsj
    Expiration: NONE
    Name:
    Description:
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:ListBucket"
          ],
          "Resource": [
            "arn:aws:s3:::YOUR-BUCKET-NAME",
            "arn:aws:s3:::YOUR-BUCKET-NAME/*"
          ]
        }
      ]
    }
    [user2_pingtel]
    type=friend
    username=user2_pingtel
    secret=blah
    host=dynamic
    qualify=1000 ; Consider the client unreachable if response time exceeds 1 sec.
    callgroup=1,3-4 ; The client is a member of call groups: 1, 3, and 4.
    pickupgroup=1,3-4 ; We can "pick up" calls using *8 for calls in groups 1, 3, and 4.
    defaultip=192.168.0.60
    disallow=all
    allow=ulaw
    allow=alaw
    allow=g729
    [outgoing-custom]
    exten => _X!,1,NoOp(--- hangup - ${CHANNEL} ---)
        same => n,return
    lsblk -f
    df -h /storage/usbdisk1
    mount | grep /storage/usbdisk1
    cat /etc/fstab
    sqlite3 /cf/conf/mikopbx.db "select id,name,device,uniqid,filesystemtype,media from m_Storage;"
    1|Storage №1|/dev/vdc|854d0b18-608a-4634-b910-dea3726ae1a5|ext4|1
    STORAGE_DISK=$(sqlite3 /cf/conf/mikopbx.db "select device from m_Storage where media='1' limit 1;")
    echo "$STORAGE_DISK"
    blockdev --getsize64 "$STORAGE_DISK"
    parted -s "$STORAGE_DISK" unit MiB print free
    Disk /dev/vdc: 12288MiB
    
    Number  Start     End       Size      File system  Name     Flags
            0.02MiB   1.00MiB   0.98MiB   Free Space
     1      1.00MiB   10239MiB  10238MiB  ext4         primary
            10239MiB  12288MiB  2049MiB   Free Space
    Warning: Not all of the space available to /dev/vdc appears to be used
    sgdisk -e "$STORAGE_DISK"
    sync
    blockdev --rereadpt "$STORAGE_DISK" 2>/dev/null || true
    partprobe "$STORAGE_DISK" 2>/dev/null || true
    parted -s "$STORAGE_DISK" unit MiB print free
    Storage -> Resize storage
    All processes will be completed. Continue? (y/n):
    /etc/rc/resize_storage_part "$STORAGE_DISK"
    STORAGE_DISK=$(sqlite3 /cf/conf/mikopbx.db "select device from m_Storage where media='1' limit 1;")
    echo "$STORAGE_DISK"
    
    lsblk -f
    df -h /storage/usbdisk1
    parted -s "$STORAGE_DISK" unit MiB print free
    mount | grep /storage/usbdisk1
    cat /etc/fstab
    sqlite3 /cf/conf/mikopbx.db "select id,name,device,uniqid,filesystemtype,media from m_Storage;"
    Filesystem                Size      Used Available Use% Mounted on
    /dev/vdc1                11.7G      1.1G     10.0G  10% /storage/usbdisk1
    test -d /storage/usbdisk1/mikopbx && echo "mikopbx directory OK"
    test -f /storage/usbdisk1/mikopbx/astlogs/asterisk/cdr.db && echo "cdr.db OK"
    sqlite3 /storage/usbdisk1/mikopbx/astlogs/asterisk/cdr.db "pragma integrity_check;"
    ok
    monit summary
    pbx-console services status
    asterisk -rx "core show uptime"
    STORAGE_DISK=$(sqlite3 /cf/conf/mikopbx.db "select device from m_Storage where media='1' limit 1;")
    parted -s "$STORAGE_DISK" unit MiB print free
    sgdisk -e "$STORAGE_DISK"
    sync
    blockdev --rereadpt "$STORAGE_DISK" 2>/dev/null || true
    partprobe "$STORAGE_DISK" 2>/dev/null || true
    /etc/rc/resize_storage_part "$STORAGE_DISK"
    blkid
    cat /etc/fstab
    sqlite3 /cf/conf/mikopbx.db "select id,name,device,uniqid,filesystemtype,media from m_Storage;"
    mount | grep /storage/usbdisk1
    printf "%s\n" "$(basename "$STORAGE_DISK")" | /etc/rc/connect_storage
    Image Name – A custom, unique name for your image.
  • OS Type – Linux

  • OS Version – Others Linux

  • Architecture – 64-bit OS

  • Uncheck "Check After Import"

  • Resource Group – Choose your resource group.
    Resource Group – Your resource group.
  • Allow all inbound connections (see example below). Outbound is allowed by default.

  • ssh -i C:\Users\username\.ssh\id_ed25519 root@ip-adress

    The bucket region for your image must match the region of your future virtual machine!

    Creating the Image

    Creating an SSH Key Pair

    Creating a Security Group

    Be sure to configure the firewall within MikoPBX itself as soon as possible after creating the virtual machine. Read more about that here.

    Creating the Virtual Machine

    We recommend a minimum of 50GB for call recordings.In this guide we use 30GB as an example.

    Connecting to the MikoPBX Console

    Connecting via Built-in Cloud Console

    Connecting via SSH

    For more information on SSH connections, refer to this set of articles. In this guide, we demonstrate SSH access via PowerShell.

    First Login to the Web Interface

    Login credentials:

    • Username: admin

    • Password: Your Virtual Machine’s ID

    link
    this guide
    "Create Bucket" button
    Bucket parameters
    Bucket name
    "Upload Object" button
    URL of the uploaded file
    "Images" section
    "Import Image" Button
    Image Parameters
    "Key Pairs" section
    "Create SSH Key Pair" button
    SSH Key Pair Parameters
    "Security Groups" Section
    "Create Security Group" button
    Security Group parameters
    "Instances" section
    "Create Instance" button
    VM Parameters №1
    VM Parameters №2
    VM Parameters №3
    "Create Order" button
    VM's name
    "Connect" button
    VNC Console
    Command for SSH connection
    SSH Connection
    Authorization Parameters for the WEB-interface
    MikoPBX WEB-interface
    If you don't have an access key, do the following
    1. Under the Access keys table, select Create access key

    2. Copy the Access key and Secret access key

    If you already have an access key, simply copy the Access key and Secret access key

    1. Open Services / Storage / S3

    2. On the tab select Create bucket

    3. Enter a unique bucket name

    1. Use default values for other fields

    2. After entering the values, click Create bucket

    1. Open the created bucket and select Upload

    2. On the opened tab select Add files

    3. Upload the file from the MikoPBX distribution with the .raw extension

    4. Click Upload

    5. Wait for the file to finish uploading

    If not done previously for this cloud

    1. Create a separate folder for files on your computer

    2. Create a file named trust-policy.json in the folder

      1. Open Terminal and navigate to the created folder

      2. Run the command vi trust-policy.json

      3. Enter editing mode by pressing i and paste the text

      4. Press ESC and type :wq to save the file

    1. Similarly, create a file named role-policy.json and change the bucket name value in the text to the name of your created bucket

    1. Similarly, create a file named import-image.sh, change the DEFAULT_BUCKET parameter value to the name of your created bucket and the DEFAULT_IMAGE parameter value to the name of the image uploaded to the bucket

    1. Run the command aws configure, specify the region and copied Access key and Secret access key

    1. Run the command

    1. Run the command

    1. Run the command

    If the command executes successfully, a unique AMI identifier will be generated

    1. Open Services / Compute / EC2 and navigate to Images / AMIs

    2. Select the created image and click Launch an instance from AMI to create a virtual machine

    1. Enter the virtual machine name, for example mikopbx-vm

    1. Specify the instance type - t3.micro

    If you have an SSH key

    1. Specify the SSH key in the Key pair field

    If you don't have an SSH key

    1. Select Create new key pair and specify the key pair name, for example mikopbx_key

    Follow the instructions further

    1. In the Network settings section, check Allow SSH traffic and Allow HTTPS traffic

    1. If necessary, change the size of the storage disk in Configure storage, default size is 50Gb

    1. For other fields use default values

    2. Click Launch instance

    1. Go to the created virtual machine mikopbx-vm

    2. On the opened tab, select Connect / EC2 serial console, wait for the system to fully load until the authentication parameters are displayed

    1. Copy the external address of the created virtual machine and enter it in the browser's address bar

    2. Use the login and password provided in EC2 serial console for login

    curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg" 
    sudo installer -pkg AWSCLIV2.pkg -target /

    For quick and convenient navigation within the Amazon service, use the search panel

    Copying access keys

    https://aws.amazon.com
    vi trust-policy.json
    {
    "Version": "2012-10-17",
        "Statement":
        [
            {
                "Effect": "Allow",
                "Principal": { "Service": "vmie.amazonaws.com" },
                "Action": "sts:AssumeRole",
                "Condition": {
                    "StringEquals":{"sts:Externalid": "vmimport"}
                }
            }
        ]
    }
    {
        "Version":"2012-10-17",
        "Statement":
        [
            {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket"
                ],
            "Resource": [
                "arn:aws:s3:::mikopbx-bucket",
                "arn:aws:s3:::mikopbx-bucket/*"
                ]
            },
            {
            "Effect": "Allow",
            "Action": [
                "ec2:ModifySnapshotAttribute",
                "ec2:CopySnapshot",
                "ec2:RegisterImage",
                "ec2:Describe*"
            ],
            "Resource": "*"
            }
        ]
    }
    
    #!/bin/bash
    
    # Default variable definition
    DEFAULT_IMAGE="mikopbx-2024.1.40-dev-x86_64.raw"
    DEFAULT_BUCKET="mikopbx-bucket"
    DEFAULT_DESCRIPTION="MikoPBX the best open source PBX on asterisk"
    DEFAULT_NAME="MikoPBX 2024.1.40-dev"
    
    # Overriding variables with environment variable values, if set
    IMAGE="${IMAGE:-$DEFAULT_IMAGE}"
    BUCKET="${BUCKET:-$DEFAULT_BUCKET}"
    DESCRIPTION="${DESCRIPTION:-$DEFAULT_DESCRIPTION}"
    NAME="${NAME:-$DEFAULT_NAME}"
    
    # JSON file for import-snapshot command
    JSON_FILE="disk_container.json"
    
    # Creating JSON file
    cat <<EOF> ${JSON_FILE}
    {
      "Description": "${DESCRIPTION} image",
      "Format": "raw",
      "UserBucket": {
    	"S3Bucket": "${BUCKET}",
    	"S3Key": "${IMAGE}"
      }
    }
    EOF
    
    # Importing the snapshot
    IMPORT_TASK_ID=$(aws ec2 import-snapshot --description "${DESCRIPTION} image" --disk-container "file://${JSON_FILE}" --query 'ImportTaskId' --output text)
    
    echo "Import task started with ID: $IMPORT_TASK_ID"
    
    # Waiting for snapshot import to complete
    while true; do
    	STATUS=$(aws ec2 describe-import-snapshot-tasks --import-task-ids $IMPORT_TASK_ID --query 'ImportSnapshotTasks[0].SnapshotTaskDetail.Status' --output text)
    	echo "Current status: $STATUS"
    	if [ "$STATUS" == "completed" ]; then
    		break
    	fi
    	sleep 30
    done
    
    # Getting SnapshotId
    SNAPSHOT_ID=$(aws ec2 describe-import-snapshot-tasks --import-task-ids $IMPORT_TASK_ID --query 'ImportSnapshotTasks[0].SnapshotTaskDetail.SnapshotId' --output text)
    
    # Registering AMI
    AMI_ID=$(aws ec2 register-image \
    	  --name "$NAME" \
    	  --description "$DESCRIPTION" \
    	  --architecture x86_64 \
    	  --sriov-net-support simple \
    	  --virtualization-type hvm \
    	  --ena-support \
    	  --boot-mode legacy-bios \
    	  --root-device-name "/dev/sda1" \
    	  --block-device-mappings "[{\"DeviceName\": \"/dev/sda1\", \"Ebs\":{\"DeleteOnTermination\":true, \"VolumeSize\":1, \"SnapshotId\":\"$SNAPSHOT_ID\"}}, {\"DeviceName\": \"/dev/sdb\", \"Ebs\":{\"VolumeSize\":50}}]" \
    	  --query 'ImageId' \
    	  --output text)
    
    echo "AMI created with ID: $AMI_ID"
    
    aws configure
    aws iam create-role --role-name vmimport --assume-role-policy-document "file://trust-policy.json"
    aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document "file://role-policy.json"
    sh import-image.sh

    Creating a bucket

    Adding permissions and attaching policies

    Creating a virtual machine

    To deploy the PBX use two disks:

    • A 1 Gb disk for the main system

    • A 50+ Gb

    Starting MikoPBX

    Make sure to configure the Firewall on the MikoPBX

    Connect SIP
    or
    Connect IAX
    depending on the type of account you are connecting.
    Different types of connection
    General settings of provider

    In the general settings of the SIP provider, specify the following settings:

    Provider Name - an arbitrary name that is convenient for you. It will be displayed in the selection lists in the corresponding menus.

    Account Type - the type of registration for the provider account.

    Provider host URL or IP Address - can be either a URL or an IP address.

    Username and Password provided by your provider.

    DTMF Mode - determines how DTMF signals are transmitted over SIP. There are different standards used to transmit DTMF to SIP providers. Try using different standards to find the mode that suits you.

    • inband sends keypresses as "tones." To use this standard, you need a high-quality audio codec.

    • Auto, rfc, and info transmit keypresses through SIP encoding.

    Advanced Settings

    In this section, list all communication service provider addresses from which incoming calls can arrive. Access to these addresses for SIP and RTP ports will be automatically opened on the firewall.

    Additional provider hosts or ip

    By default, it is set to 5060. The SIP protocol describes how a client application (e.g., a softphone) can request the initiation of a connection from another, possibly physically remote client in the same network using its unique name. The protocol defines how clients agree on opening exchange channels based on other protocols that can be used for direct information transmission (e.g., RTP).

    SIP Connection Port

    Allows you to specify the transport protocol used for this provider account.

    Transport Protocol

    This is the provider's SIP proxy server for processing requests. The actual SIP server may differ from this address. The outbound proxy takes on primary requests and forwards them to the appropriate server.

    Outbound proxy

    When this option is enabled, Asterisk will send SIP OPTIONS packets. This is necessary to support NAT tunneling on your router.

    Specify the frequency with which Asterisk will send OPTIONS-type SIP messages to check if this device is working and available for making calls.

    If this device does not respond within the specified period (default is 60 seconds), Asterisk considers it turned off and unavailable for making calls.

    Support NAT Session

    You can disable the use of the fromuser field of the SIP packet header.

    Redefining SIP Header "From"

    The fromuser and fromdomain parameters in the pjsip.conf file are used for outgoing calls from Asterisk to the SIP device.

    You can override:

    • the username in the From field in SIP packets (fromuser).

    • the domain name in the From field in SIP packets (fromdomain).

    The fields User and Domain serve this purpose.

    User and Domain fields

    In this field, you can modify Asterisk configuration files.

    You can override almost all parameters. For example, when using chan_pjsip, the provider is described with the following sections:

    To override fields in sections, fill in the Additional Parameters field as follows:

    To complete the configuration, click Save Settings.

    Save settings

    There are cases when you need to connect multiple accounts from one communication service provider. In this case, the settings Host or IP Address and SIP Connection Port may be the same for all accounts.

    Asterisk handles this situation differently. The PBX will not be able to correctly route the call to the desired provider, and the call will be dropped.

    As a solution, in older versions of the PBX, you could describe additional inbound routes for which you would fill in the Additional Number (DID) field with the Username value for each account of the provider. This required creating N number of additional routes, equal to the number of provider accounts.

    An alternative is the "Registering multiple accounts from one provider" instruction. This approach was not very intuitive.

    The Username field, in most cases, will be used as the destination number Additional Number (DID) for incoming calls. Considering that outgoing routes for all Usernames will be configured, the call will be correctly processed by the PBX.

    This option is used when connecting most providers.

    Registration is necessary when the provider cannot know from which IP address the client will connect. For example, when the PBX is behind NAT. The provider's server is usually on a public IP address.

    This option is relevant for the operation of some FXO / GSM gateways when an external device must connect to your PBX using a login and password.

    This option is also relevant when the remote device is behind NAT, and MikoPBX cannot know its IP address.

    Relevant for secure private networks. For example, Rostelecom often lays its network cable and connects the client to its local network.

    In this case, the PBX and the provider must be in the same network.

    General Information

    Telephony providers section
    Switching provider status
    [REG-AUTH-***]
    type = auth
    ; ----
    
    [REG-***] 
    type = registration
    transport = transport-udp
    ; ----
    
    [***-OUT]
    type = auth
    ; ----
    
    [***]
    type = aor
    max_contacts = 1
    ; ----
    
    [***]
    type = identify
    ; ----
    
    [***]
    type = endpoint
    context = incoming
    ; ----
    [registration-auth]
    ; Describe authentication parameters for [REG-AUTH-***]
    
    [registration]
    ; Describe registration parameters on the remote server [REG-***]
    
    [endpoint-auth]
    ; Describe authentication parameters for outgoing calls through the provider
    
    [identify]
    ; This section is responsible for matching registration and endpoint. When an incoming call arrives, 
    ; an identity parameter check will be carried out according to the INVITE.
     
    [aor]
    ; Edit the AOR section for the endpoint
    
    [endpoint]
    ; Edit endpoint parameters

    Setting up SIP Provider

    General Settings

    Instructions for connecting to the most popular service providers can be found in our .

    Advanced SIP Provider Settings

    Additional provider hosts or ip

    SIP Connection Port

    Transport Protocol

    Outbound Proxy

    Support NAT Session

    Redefining SIP Header "From"

    Additional Parameters

    Multiple Providers on One IP (Host)

    More about Registration Types

    1. Outgoing Registration

    2. Incoming Registration

    3. IP Authentication, No Password

    DHCP (Dynamic Host Configuration Protocol) can be used for automatic IP address configuration. Enable the 'Use DHCP to obtain network settings' switch. This is recommended for most users. To not rely on DHCP server settings (to provide a specific address), you can disable the switch.

  • If you do not want to use settings obtained from a DHCP server, you can configure the network manually. This requires some knowledge about the network topology. To the right of the IP address, there is a field for Subnet Mask in CIDR format. You should use the alternative format: /8 corresponds to the subnet mask 255.0.0.0, /16 corresponds to 255.255.0.0, and /24 corresponds to 255.255.255.0.

  • "VLAN ID" - MikoPBX supports virtual network interfaces. This is relevant only for physical PCs. Sometimes a PC may have only one network interface, and it may not be possible to connect a second one physically. Using VLAN, you can create a virtual interface that works 'on top' of the physical one. One of the advantages of using VLAN is that all phone calls can be routed through it, while the network equipment can 'tag' all VLAN traffic and guarantee a stable connection.

    The number of network interfaces in MikoPBX is not limited.

    "Network interfaces" section

    The 'Network interface with internet access' is the primary network interface through which access to external addresses (non-local) will be established.

    If no DNS server addresses are specified, MikoPBX uses built-in fallback DNS servers. For non-Russian locales, the order is 1.1.1.1, 8.8.8.8, and then 77.88.8.8; for the Russian locale, 77.88.8.8 is tried first, followed by 1.1.1.1 and 8.8.8.8.

    Depending on your network topology, you need to perform the following steps to configure MikoPBX. The PBX can be behind a network router, which is the most common scenario, or it can have a public IP.

    • If the PBX is behind a router, you need to check the 'This station is located behind a NAT router' option.

    • If you know the external address of the station (IP or domain name) and have forwarded the ports of the PBX to the external world, it is recommended to fill in the fields 'External IP address of your router' or 'External hostname of your router'.

    For all addresses that are not local to the PBX, the station will be represented by the external address:

    If 'External IP address of your router' is empty and 'External hostname of your router' is filled, the PBX will be represented by the hostname (External hostname) field.

    "Network topology" section

    Static routes are used when MikoPBX must send traffic to a specific network through a separate gateway instead of the main Internet gateway. This is most often required in the following cases:

    • the PBX has several network interfaces;

    • telephony, VPN, or remote offices are available through a separate router;

    • traffic must be routed to a specific provider or branch-office subnet;

    • the main gateway is used for Internet access, while separate internal networks must be reached through another gateway.

    1. Go to Network and Firewall → Network interfaces.

    2. At the bottom of the form, find the Static routes block.

    Static routes configuration section
    1. In the Static routes block, click Add route.

    2. Fill in the route row.

    3. Add several routes if needed. You can change the order by dragging rows; this order is saved as the route priority.

    4. Click Save at the bottom of the form.

    Adding a static route
    Field
    Description

    Network

    Destination network address. For example, specify 192.168.10.0 for a remote subnet. If the route is needed for one specific IP address, specify that IP address and select the 32 - 255.255.255.255 mask.

    Mask

    CIDR mask of the destination network. It is selected from a list in the interface, for example 24 - 255.255.255.0 for a /24 subnet or 32 - 255.255.255.255 for a single address.

    Gateway

    IP address of the router through which MikoPBX should send traffic to the specified network. The gateway must be reachable from the selected interface.

    Example route to a remote subnet:

    Field
    Value

    Network

    192.168.10.0

    Mask

    24 - 255.255.255.0

    Gateway

    172.16.32.15

    Example route to a single address:

    Field
    Value

    Network

    54.246.198.136

    Mask

    32 - 255.255.255.255

    Gateway

    172.16.32.15

    Check that the required remote address or service is reachable from MikoPBX: SIP provider registration, connection to a remote phone, access to a VPN network, or another working scenario for which the route was added.

    If you have console or SSH access, you can additionally check which path the system selects:

    The output should show the expected gateway or interface. To check host reachability, you can use:

    You can also open Maintenance → System logs → System information and check the current network settings.

    • Invalid gateway. The Gateway field must contain a valid IP address. If it is incorrect, MikoPBX may show the Invalid gateway address message.

    • The gateway is not in the selected interface subnet. If a specific Interface is selected, make sure the specified gateway is reachable through that interface. Otherwise, the route may be saved, but traffic will not go through the required path.

    • Conflict with the main gateway. Do not use a static route as a replacement for the main Internet gateway. The main gateway is configured in the Internet interface settings, while static routes are better suited for separate networks and addresses.

    • Invalid mask/CIDR. Specify the network address and the correct Mask. For example, for the 192.168.10.0/24 subnet, use 192.168.10.0 and 24 - 255.255.255.0; for a single IP address, use 32 - 255.255.255.255.

    • The route is not applied after saving. Check that the page was saved without errors, the route remains in the Static routes table, the selected gateway is reachable from MikoPBX, and Interface is selected correctly or set to Auto.

    General parameters

    Network interfaces

    "Network Interface" Section in MikoPBX system
    ip route get 192.168.10.10
    ping 192.168.10.10

    Network topology

    When NAT is enabled, specify either the external IP address of the router or the external hostname. If both fields are filled in, the hostname takes priority and the external IP address is not used. In Dual-Stack mode, the external hostname is required.

    When enabling the option 'This station is located behind a NAT router,' it is mandatory to specify the external address or hostname of the router. Additionally, you need to perform port forwarding on the router for SIP port 5060 and RTP ports 10000-10200 to the local address of the PBX.

    If your provider allows registration and you do not need to connect external subscribers, you can choose not to enable the option "This PBX is located behind a NAT router", even if the PBX is behind a NAT router.

    Manual configuration of network routes

    Where to find this setting in the interface

    In Docker installations, the Static routes block may be hidden because the network stack is managed by the container or the host system.

    How to add a route

    Field description

    How to check that the route works

    Common mistakes

    Setting up a virtual machine

    Installantion MikoPBX

    You can navigate through the menu items using the arrow keys.

    To select a menu item, press the Enter key.

    Alternatively, you can select a menu item by pressing the corresponding number on the alphanumeric keypad."

    All data on the disk where MikoPBX is being installed will be lost

    The disk where MikoPBX will be installed is referred to as the system disk (SYSTEM). You can choose a disk with a size larger than 500MB as the system disk.

    Approximately, 1 hour of conversation takes up 14MB of disk space.

    The first login to MikoPBX

    Default creditionals for the first login are:

    Username - admin

    Password - admin

    System will ask to change them after the first login. It is important for the security of your MikoPBX.

    Parameters of the new VM
    Parameters of the new VM
    Parameters of the new VM
    Summary configuration
    "Settings" button
    Creating a new hard disk
    Creating a new hard disk
    Creating a new hard disk
    Creating a new hard disk
    Creating a new hard disk
    Selecting a new hard disk
    Mounting an image
    Mounting an image
    List of MikoPBX images option. You need .iso image!
    "Network" tab
    Button for starting the created VM
    Installation process
    Installation process
    Installation process
    Installation process
    Installation process
    MikoPBX Console Page
    IP address of your MikoPBX
    Web-interface of MikoPBX

    Securing MikoPBX

    How to protect MikoPBX from hacking and unauthorized access

    IP PBX systems are increasingly being targeted by attackers. Criminals gain access to your telephony and make calls at your expense - to premium numbers and international destinations. This can result in losses of tens or hundreds of thousands of dollars within just a few hours.

    Beyond direct financial losses, a compromised PBX can be used by fraudsters to make calls on behalf of your organization - for example, calling citizens while impersonating banks or government agencies. Victims see your company's phone number, causing reputational damage and potential investigations by law enforcement.

    Go through every item in this guide - even if you have already configured the system, something may have been missed.

    ⚠️ Critical vulnerability in version 2024.1.114!

    A vulnerability has been discovered in the external panel module: if the module is exposed to the internet or the Firewall is misconfigured, an attacker can obtain all SIP credentials and make calls on behalf of your company.

    You must perform the following steps:


    Security Patch for Version 2024.1.114

    If you are running version 2024.1.114, install the patch with a single command:

    curl -L 'https://files.miko.ru/s/DPZcM2vywc2BTOZ/download' | sh

    You can read more about it here.

    If you are using an older version — upgrade to the latest release. Steps 3 and 4 from the list above must be completed regardless of your version.


    The firewall is your first line of defense. It restricts who can connect to your PBX.

    Go to Network and Firewall → Network Firewall, make sure the toggle is enabled, and create rules that allow access only from the required subnets.

    Addresses to add to your rules:

    • Your office subnet

    • VPN server addresses

    • Your telephony provider's IP addresses (check with your provider)

    • Static IP addresses of remote employees

    The PBX admin panel is effectively the "master key" to the entire system. If it is accessible from the internet without restrictions, an attacker can gain full control over your telephony.

    In the firewall rules, allow WEB and CTI access only for your office subnet or VPN. For all other rules, uncheck the WEB and CTI boxes. If you need remote access — use a VPN.

    A weak password is the most common cause of a breach. Attackers try thousands of combinations per second, and passwords like 1234, admin, or password are cracked instantly.

    Password requirements for SIP accounts and the web interface:

    • Minimum 12 characters

    • UPPER and lowercase letters

    • Numbers and special characters (!@#$%^&*)

    What to check:

    • Open each employee's profile under Telephony → Extensions and verify that the SIP password is sufficiently complex.

    • Check the web interface password under System → General Settings → WEB interface password.

    By default, the employee's extension number (e.g., 204) is used for SIP authentication. Attackers know this and specifically target standard extension numbers.

    Auth Username is the username that a phone or softphone sends when registering with the PBX. It differs from the internal extension number and is used solely for authenticating the connection.

    How to configure the Auth Username prefix in MikoPBX:

    Go to System → General Settings → SIP and fill in the Auth Username prefix for authorization field. For example, with the prefix MIKO, extension 204 will authenticate as 204MIKO.

    After changing the Auth Username, you must update the settings on every phone or softphone. The setting name varies by manufacturer:

    Manufacturer
    Setting Name

    This setting is typically found under the Account or SIP Account section in the phone's web interface.

    Fail2Ban automatically blocks IP addresses that exhibit suspicious connection attempts.

    Go to Network and Firewall → Intrusion Protection and review the configured protection level:

    • Weak — 20 attempts in 10 min, ban for 10 min. For initial setup and trusted networks.

    • Normal — 10 attempts in 1 hour, ban for 1 day. Recommended for most deployments.

    • Strong — 5 attempts in 6 hours, ban for 7 days. For internet-facing servers.

    Warning: Make sure your office addresses are added to the whitelist to avoid accidentally locking yourself out.

    Fail2Ban does not replace strong passwords - even with Fail2Ban enabled, a weak password can still be brute-forced.

    • Docker deployment: in bridge mode the built-in firewall and fail2ban do not protect the web interface. Set up an or switch the container to network_mode: host.

    If your PBX is directly accessible from the internet, it becomes a target for automated scanners that continuously search for vulnerable systems.

    • Place the PBX behind a NAT router.

    • Use VPN connections for remote employees.

    • If a public IP is unavoidable — be sure to configure the Firewall and Fail2Ban.

    • Under Network and Firewall → Network interfaces


    Even with strong technical security, it is worth adding a financial safety net. If a breach does occur, these measures will limit potential losses.

    Contact your telephony provider and request:

    • A daily spending limit on outbound calls

    • A block on service when the balance is negative

    • Blocking of international and premium-rate calls if you do not use them

    • Top up your balance in small amounts as needed.

    • Set up spending alerts with your provider if that option is available.


    If you discover that your PBX has been compromised, follow these steps:

    Step 1 — Isolate the PBX Immediately

    Block all external access via the firewall. Change all passwords — SIP accounts, web interface, SSH.

    Step 2 — Save Logs and Call Recordings

    Save call recording files and system logs separately — they may be needed as evidence. They can be overwritten over time.

    Step 3 — Notify Your Telephony Provider

    Contact your telephony provider and report the incident. The provider may be able to block further calls and officially document the breach.

    Step 4 — Report the Incident to the Relevant Authorities

    File a report with your national cybercrime authority or law enforcement agency. Briefly describe what happened, state that calls were made without your knowledge, and indicate that you are prepared to provide logs and call recordings as evidence.


    Go through this list and confirm that every item has been completed:


    • — configuring access rules.

    • — network configuration, NAT, DNS.

    Moving MikoPBX Data to a New Disk

    Use this guide when the local MikoPBX storage is full or when the current data storage disk must be replaced. The storage contains call recordings, call history, system logs, additional modules, backups, and system caches. In a standard installation, the storage directory is mounted at /storage/usbdisk1.

    This guide applies to MikoPBX installed on a virtual machine or a physical server. For Docker installations, move the host directory that is mounted into the container as /storage using the host operating system tools.

    Partitioning and formatting commands delete all data on the selected disk. Continue only if you have positively identified the new empty disk.

    Important Notes

    MikoPBX does not use a manually maintained /etc/fstab entry as the only source of truth. Disk information is stored in the MikoPBX configuration database, and when storage is connected, the system mounts the partition by UUID and rebuilds /etc/fstab.

    After copying data, use the standard script to switch the storage disk:

    Do not run /sbin/freestorage as the first migration step from an SSH session. This script also stops the SSH server dropbear, so the remote session can be disconnected.

    • root SSH access to MikoPBX;

    • a new empty disk connected to the server;

    • a current backup of the configuration and important data;

    • enough free space on the current storage disk for the system to keep working during the copy;

    • a planned short telephony downtime while services are stopped and the PBX is rebooted.

    Connect to MikoPBX over SSH and run the diagnostic commands:

    Find:

    • the current storage partition mounted at /storage/usbdisk1;

    • the new disk with no mount point, no file system, and no important data.

    Example: the current storage is on /dev/vdb1, and the new empty disk is /dev/vdc.

    Check the new disk again:

    If the disk has partitions, a file system, a UUID, a mount point, or you are not sure what the disk is used for, stop and confirm that it is really an empty disk.

    Before switching the disk, save a copy of the database and the current /etc/fstab:

    This copy is not a replacement for a full backup, but it helps you quickly roll back the selected storage disk.

    Stop PBX workers and the main MikoPBX services:

    Check that no processes still keep files open on the old storage:

    If the command prints any processes, do not continue. Find the remaining service, stop it, and repeat the check.

    Create a GPT partition table, one partition using the whole disk, and an ext4 file system:

    Make sure the variables are populated:

    Mount the new partition to a temporary directory and copy the contents of the current /storage/usbdisk1:

    Check the copy:

    The object counts must match. If services are started before the migration is finished, the number of files can change because of logs and temporary files, so compare the counts while services are stopped.

    Unmount the temporary mount point:

    Unmount the old storage partition from /storage/usbdisk1:

    If you get target is busy, check which processes still use the mount point:

    Stop the reported processes and repeat umount. If lsof and, when available, fuser show no holders but the partition is still busy, use the fallback option:

    Run the standard storage connection script and pass the new disk name without /dev/:

    The script should find the new partition with the mikopbx directory, save the UUID in the MikoPBX configuration, mount it at /storage/usbdisk1, and rebuild /etc/fstab.

    Return the services under monit control and restart the workers:

    Check the state:

    Reboot MikoPBX:

    The SSH session may be disconnected. After MikoPBX boots, connect again and check:

    In a correct state:

    • /storage/usbdisk1 is mounted from the new partition;

    • the UUID of the new partition is listed in /etc/fstab;

    • the m_Storage table points to the new disk;

    If the new disk is not connected correctly and the old disk has not been wiped, you can switch back to the old storage:

    Replace vdb with the old disk name without /dev/.

    If you need to restore the entire storage configuration record from the saved database copy:

    /etc/rc/connect_storage says the disk is already mounted.

    The old storage is still connected to /storage/usbdisk1. Stop the services that write to storage and run umount /storage/usbdisk1.

    The new disk is not listed as a suitable disk.

    Check lsblk -f. The disk must be visible to the system, must not be mounted elsewhere, and must be larger than 2 GB.

    umount returns target is busy.

    Use lsof +f -- /storage/usbdisk1 and, if available, fuser -vm /storage/usbdisk1. Stop the processes that keep files open. Use umount -l only after stopping services and checking that there are no active holders.

    Storage is not mounted after reboot.

    Compare the UUID in blkid, /etc/fstab, and m_Storage. Then connect storage again:

    Services stay in Initializing or Waiting for a while.

    This is normal for some monit checks immediately after boot. Wait 1-2 minutes and repeat:

    External firewall for Docker

    ℹ️ Available starting from MikoPBX 2026.2.76. On earlier versions the firewall-bouncer LAPI endpoint, the Firewall page banner, and the "Create bouncer token" button do not exist.

    In Docker mode, MikoPBX's built-in firewall and fail2ban do not protect the web interface:

    • The container cannot manage host iptables.

    The firewall-export endpoint

    ℹ️ Available starting from MikoPBX 2026.1.76.

    Technical reference for developers writing their own bouncers and for integrating MikoPBX with edge providers (Cloudflare, AWS WAF, custom nftables generators).

    • Base URL: https://<MIKOPBX-HOST>/pbxcore/api/v3/firewall-bouncer/

    No dictionary words, names, or dates of birth

    Snom

    Authentication Username

    Linphone

    Auth userid

    Zoiper

    Authentication user / Auth. Username

    MicroSIP

    Login

    Cisco (SPA)

    Auth ID

    Paranoid — 3 attempts in 24 hours, ban for 30 days. For servers under active attack.
    , correctly specify the network topology and external address.
  • — route configuration through the web interface.
  • Extensions — managing accounts and SIP passwords.

  • Upgrade to version 2026.1.223 or newer.

  • Install the security patch (see below).

  • Close WEB, CTI, and SIP access to the PBX from external networks.

  • Update all passwords.

  • Yealink

    Register Name / Authentication User

    Grandstream

    Authenticate ID

    Fanvil

    Authentication User

    Mandatory Security Measures

    Enable the Firewall

    Note: For remote employees with dynamic IPs, we recommend purchasing a static IP address from their ISP (typically very low cost per month). An alternative is VPN: all remote employees connect through a VPN server, and only that server's address is added to the Firewall.

    Block Web Interface and CTI from the Internet

    Use Strong Passwords

    Change the Auth Username

    Enable Brute-Force Protection (Fail2Ban)

    Protect the web interface in Docker

    Do Not Expose the PBX on a Public IP Address

    Financial Protection

    Set a Spending Limit with Your Provider

    Do Not Keep a Large Balance on Your Account

    What to Do If a Breach Has Already Occurred

    Security Checklist

    Useful Links

    external firewall bouncer
    Firewall
    Intrusion Protection (Fail2Ban).
    Network Interfaces
    Static Routes
    "Intrusion protection" section in MikoPBX web-interface
    disk for storing call recordings
    FAQ

    Interface

    Network interface through which the route will be used. You can leave Auto so that the operating system chooses the interface, or select a specific interface such as eth0 or a VLAN interface.

    Description

    Administrator comment. Use it to describe the purpose of the route, for example Branch VPN or SIP provider network.

    Interface

    eth0 or Auto

    Description

    Office VPN

    Interface

    eth0 or Auto

    /storage/usbdisk1/mikopbx and the call history database are accessible;

  • the main MikoPBX services have OK status in monit summary;

  • Asterisk responds to core show uptime.

  • Requirements

    Instructions for connecting via SSH are available here.

    Identify the Current and New Disks

    Save a Local Copy of the Configuration Database

    Stop Services That Write to Storage

    Partition and Format the New Disk

    The following commands completely erase NEW_DISK.

    Copy Data from the Old Storage

    Connect the New Disk as MikoPBX Storage

    Start Services

    Check Persistent Mounting After Reboot

    Rollback

    Troubleshooting

    /etc/rc/connect_storage
    lsblk -f
    blkid
    df -h
    mount
    cat /etc/fstab
    sqlite3 /cf/conf/mikopbx.db "select id,name,device,uniqid,filesystemtype,media from m_Storage;"
    NEW_DISK=/dev/vdc
    
    lsblk -o NAME,PATH,SIZE,TYPE,FSTYPE,LABEL,UUID,MOUNTPOINTS,MODEL,SERIAL,VENDOR "$NEW_DISK"
    blkid "$NEW_DISK" || true
    wipefs -n "$NEW_DISK"
    parted -s "$NEW_DISK" print
    STAMP=$(date +%Y%m%d-%H%M%S)
    cp /cf/conf/mikopbx.db "/cf/conf/mikopbx.db.before-storage-move-$STAMP"
    cp /etc/fstab "/cf/conf/fstab.before-storage-move-$STAMP"
    pbx-console services stop-all
    
    for svc in asterisk nginx php-fpm fail2ban rsyslogd gnatsd crond; do
        monit stop "$svc"
    done
    
    sleep 10
    lsof +f -- /storage/usbdisk1
    parted --script --align optimal "$NEW_DISK" mklabel gpt
    parted --script --align optimal "$NEW_DISK" mkpart primary ext4 0% 100%
    sync
    blockdev --rereadpt "$NEW_DISK" 2>/dev/null || true
    partprobe "$NEW_DISK" 2>/dev/null || true
    
    NEW_PART=$(lsblk -nr -o PATH,TYPE "$NEW_DISK" | awk '$2=="part"{print $1; exit}')
    mkfs.ext4 -F "$NEW_PART"
    sync
    
    NEW_UUID=$(blkid -s UUID -o value "$NEW_PART")
    echo "$NEW_PART $NEW_UUID"
    echo "NEW_DISK=$NEW_DISK"
    echo "NEW_PART=$NEW_PART"
    echo "NEW_UUID=$NEW_UUID"
    mkdir -p /mnt/newstorage
    mount -t ext4 UUID="$NEW_UUID" /mnt/newstorage
    
    rsync -aHAX --numeric-ids /storage/usbdisk1/ /mnt/newstorage/
    sync
    find /storage/usbdisk1 -xdev | wc -l
    find /mnt/newstorage -xdev | wc -l
    test -d /mnt/newstorage/mikopbx && echo "mikopbx directory OK"
    test -f /mnt/newstorage/mikopbx/astlogs/asterisk/cdr.db && echo "cdr.db OK"
    umount /mnt/newstorage
    umount /storage/usbdisk1
    lsof +f -- /storage/usbdisk1
    command -v fuser >/dev/null 2>&1 && fuser -vm /storage/usbdisk1
    umount -l /storage/usbdisk1
    printf "%s\n" "$(basename "$NEW_DISK")" | /etc/rc/connect_storage
    for svc in crond rsyslogd fail2ban php-fpm nginx gnatsd asterisk; do
        monit start "$svc"
    done
    
    pbx-console services restart-all
    sleep 20
    monit summary
    pbx-console services status
    asterisk -rx "core show uptime"
    mount | grep /storage/usbdisk1
    df -h /storage/usbdisk1
    /sbin/pbx_reboot
    lsblk -f
    mount | grep /storage/usbdisk1
    df -h /storage/usbdisk1
    cat /etc/fstab
    sqlite3 /cf/conf/mikopbx.db "select id,name,device,uniqid,filesystemtype,media from m_Storage;"
    test -d /storage/usbdisk1/mikopbx && echo "mikopbx directory OK"
    test -f /storage/usbdisk1/mikopbx/astlogs/asterisk/cdr.db && echo "cdr.db OK"
    monit summary
    pbx-console services status
    asterisk -rx "core show uptime"
    pbx-console services stop-all
    
    for svc in asterisk nginx php-fpm fail2ban rsyslogd gnatsd crond; do
        monit stop "$svc"
    done
    
    umount /storage/usbdisk1
    printf "vdb\n" | /etc/rc/connect_storage
    
    for svc in crond rsyslogd fail2ban php-fpm nginx gnatsd asterisk; do
        monit start "$svc"
    done
    
    pbx-console services restart-all
    cp /cf/conf/mikopbx.db.before-storage-move-YYYYMMDD-HHMMSS /cf/conf/mikopbx.db
    /sbin/pbx_reboot
    printf "%s\n" "$(basename "$NEW_DISK")" | /etc/rc/connect_storage
    monit summary
    asterisk -rx "core show uptime"
    With Docker's default userland-proxy=true, the container sees the HTTP client as the docker0 gateway (e.g. 172.17.0.1), not the real attacker IP. Nginx-level ACLs and the fail2ban jail for the web form block only the gateway — i.e. nobody.

    SIP protection still works: UDP DNAT preserves the source IP, Asterisk sees the real address, fail2ban writes the ban to Redis, and module reload acl rejects subsequent REGISTERs. Only the HTTP segment is broken.

    The fix is to export ban decisions outside the container and apply them in the real host firewall (or edge CDN, or cloud security group) via an external bouncer.

    The Security → Web access page shows a yellow banner — "Docker bridge: external firewall enforcement required" — when MikoPBX detects the failure mode. If you see it, this document is for you.

    "External firewall required" banner on the firewall page in Docker bridge mode

    The Check my IP visibility button calls the system:checkClientIpVisibility endpoint and reports one of three verdicts:

    • ip_visible — the real client IP is visible; no action needed.

    • ip_not_visible — the real client IP has been replaced by the Docker bridge gateway. HTTP firewall rules will not protect you.

    • proxy_detected — a reverse proxy is in front of the PBX, and the PBX deliberately does not trust proxy headers. Configure the proxy to expose the real source IP, or deploy an external bouncer.

    If the host is dedicated to the PBX and there are no port conflicts, flip the container to host mode:

    The container shares the host network namespace; Asterisk and Nginx see real source IPs, and the built-in firewall works as on bare metal. Best for SIP-heavy installations.

    Limitations: only one host-mode container per host, no side-by-side PBX copies, conflicts with other processes on standard ports.

    The MikoPBX container stays in bridge mode. On the Linux host, install cs-firewall-bouncer (open-source, CrowdSec project). It polls the MikoPBX endpoint every 10 seconds and translates decisions into the host's iptables / nftables.

    Recommended for most installations.

    1. Open System → API keys.

    2. Click Create bouncer token (pre-fills the correct path restriction).

    3. A token-creation form opens. The description ("External firewall bouncer (CrowdSec-compatible)") and the API key are pre-filled — optionally pick a Network filter to restrict the source IP the bouncer is allowed to call from. Leave Full access permissions off: the Create bouncer token button has already scoped the token to /api/v3/firewall-bouncer, so it has no access to the rest of the API.

    Token creation form with the description and key pre-filled
    1. Save. A modal will pop up with a ready-to-paste cs-firewall-bouncer.yaml snippet — copy it immediately, the API key is shown only once.

    Modal with the cs-firewall-bouncer preset config after creating the token

    Open /etc/crowdsec/bouncers/cs-firewall-bouncer.yaml and replace api_url / api_key with the values from step 1:

    📌 api_url is the base URL — cs-firewall-bouncer appends /v1/decisions/stream itself and sends the token in the X-Api-Key header. Do not put the full decisions path in api_url, and do not prefix the key with Bearer — the bouncer manages both.

    ⚠️ If your MikoPBX listens on HTTPS with a self-signed certificate, add insecure_skip_verify: true or install the CA certificate on the host.

    🚨 iptables_chains: [INPUT, FORWARD, DOCKER-USER] is not the CrowdSec default (default is INPUT only). Without DOCKER-USER, traffic Docker routes to the container goes via the DOCKER chain and never sees the bouncer's DROP rule — the ban appears in iptables but actually does nothing. This is the single most common trap when wiring CrowdSec to a Docker-hosted PBX.

    • The bouncer log should show received N new decisions, 0 deleted.

    • sudo iptables -L CROWDSEC -n (or the IPv6 counterpart for crowdsec-firewall-bouncer-iptables-v6) lists the applied bans.

    • Manually ban a test IP via the Firewall → Networks UI or trigger a fail2ban ban, and confirm the entry appears in the host iptables within 30 seconds.

    CrowdSec bouncers ban at IP level, not protocol level — a single ipset entry drops every TCP and UDP packet from the banned address. That includes port 22. If an operator's source IP ends up in the ban list by mistake (say, fail2ban detects three failed auth:login attempts from the office NAT), SSH gets dropped too, and the operator can lock themselves out of the host.

    Insert a high-priority ACCEPT for the admin port above the bouncer's DROP rule, so administrative access stays reachable even when the operator's own IP gets banned:

    Repeat for any other port you administer through (Wireguard, the cloud provider's serial console, etc.) — anything you do not want the bouncer to ever drop.

    For installations where losing access to the host has a high cost, add a systemd-timer that periodically flushes the bouncer's ipset. The bouncer will re-apply current bans on the next poll, so this is a bounded-blast-radius safety net rather than a feature disable:

    30 minutes is a reasonable default — short enough that an accidental lockout self-recovers before the operator's coffee gets cold, long enough that real attacks still get blocked for a meaningful window.

    CrowdSec maps decisions to a single ipset per IP family. iptables rules then drop all traffic from listed IPs, regardless of protocol or port. So a mikopbx/http ban (web brute-force) will also silently drop the same IP's SIP / IAX / AMI / SSH packets — and the reverse: a mikopbx/sip ban (Asterisk fail2ban jail) will drop the same IP's HTTP and AMI too. MikoPBX feeds all four ban categories (sip, http, ami, iax) into the same stream, so once the bouncer is wired every ban becomes IP-wide.

    For most installations that's the right behaviour — if an IP is hostile to HTTP it has no business reaching SIP either, and vice versa. But if you deliberately want per-protocol isolation (e.g. block HTTP brute-forcers without affecting their SIP), do not deploy the bouncer for that PBX. The existing in-Docker SIP defence path (fail2ban → Redis → pjsip ACL inside Asterisk) keeps SIP bans isolated to Asterisk, but only as long as those bans never reach the host ipset — which is exactly what the bouncer changes.

    GET /pbxcore/api/v3/firewall-bouncer/v1/decisions/stream returns a snapshot of currently active decisions in the exact shape stock cs-firewall-bouncer expects — {new, deleted} at the top level, no MikoPBX envelope:

    new[] carries the full snapshot of currently active bans on every poll — bouncers refresh their entry timeouts to the value of duration, so an active ban stays alive at the source's declared lifetime. deleted[] is computed per-token (MikoPBX stores the previous snapshot per ApiKey id) and contains decisions that disappeared since the last poll. Operator-triggered unbans propagate to the bouncer's ipset in one poll cycle (≈ 5–10 seconds), not at natural-TTL decay.

    ?startup=true on the first poll after bouncer restart resets the per-token cursor and emits deleted: [] — so a freshly-restarted bouncer never sees phantom evictions for state it never tracked.

    Both header forms authenticate the same token:

    GET /pbxcore/api/v3/firewall-bouncer/v1/whitelist returns the operator-defined whitelist as a flat JSON array:

    This endpoint is MikoPBX-specific. Stock cs-firewall-bouncer does not poll it (CrowdSec LAPI has no "allow" decision type, and the bouncer uses its own whitelists.yaml). Provided for MikoPBX-aware integrations that want server-side whitelist consistency with the PBX's NetworkFilters.

    The full response format, query parameters, and MikoPBX↔CrowdSec field mapping are documented in the firewall-export endpoint reference.

    The problem

    services:
      mikopbx:
        image: mikopbx/mikopbx:latest
        network_mode: host
        # delete all `ports:` entries
    # Debian / Ubuntu
    curl -s https://install.crowdsec.net | sudo sh
    sudo apt-get install -y crowdsec-firewall-bouncer-iptables
    api_url: http://<MIKOPBX-HOST>/pbxcore/api/v3/firewall-bouncer/
    api_key: <token-from-modal>
    update_frequency: 10s
    mode: iptables
    log_mode: stdout
    log_level: info
    
    # CRITICAL for Docker deployments: the rule MUST be inserted in
    # DOCKER-USER, otherwise traffic Docker forwards to the container
    # bypasses INPUT/FORWARD entirely and the ban is silently
    # ineffective.
    iptables_chains:
      - INPUT
      - FORWARD
      - DOCKER-USER
    
    # Disable IPv6 unless Docker has an IPv6 bridge configured. ip6tables
    # does not have a DOCKER-USER chain on hosts without docker IPv6, and
    # the bouncer fatals at startup when it tries to insert there.
    disable_ipv6: true
    sudo systemctl restart crowdsec-firewall-bouncer.service
    sudo systemctl status crowdsec-firewall-bouncer.service
    # Always-accept SSH (port 22) — survives bouncer state changes
    sudo iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT \
      -m comment --comment "admin-protect"
    
    # Persist across reboots (Debian / Ubuntu)
    sudo apt-get install -y iptables-persistent
    sudo netfilter-persistent save
    # /etc/systemd/system/crowdsec-safety-flush.service
    [Unit]
    Description=Safety net - flush crowdsec ipset to prevent lockout
    After=crowdsec-firewall-bouncer.service
    
    [Service]
    Type=oneshot
    ExecStart=/usr/sbin/ipset flush crowdsec-blacklists
    # /etc/systemd/system/crowdsec-safety-flush.timer
    [Unit]
    Description=Run crowdsec ipset flush every 30 minutes
    
    [Timer]
    OnBootSec=30min
    OnUnitActiveSec=30min
    Unit=crowdsec-safety-flush.service
    
    [Install]
    WantedBy=timers.target
    sudo systemctl daemon-reload
    sudo systemctl enable --now crowdsec-safety-flush.timer
    {
      "new": [
        {
          "id": 12345,
          "origin": "mikopbx-fail2ban",
          "type": "ban",
          "scope": "Ip",
          "value": "203.0.113.7",
          "duration": "3600s",
          "scenario": "mikopbx/sip"
        }
      ],
      "deleted": []
    }
    # Stock cs-firewall-bouncer (CrowdSec convention):
    curl -H "X-Api-Key: <token>" \
         "http://<MIKOPBX-HOST>/pbxcore/api/v3/firewall-bouncer/v1/decisions/stream?startup=true"
    
    # Equivalent for ad-hoc probes with curl / Postman / Insomnia:
    curl -H "Authorization: Bearer <token>" \
         "http://<MIKOPBX-HOST>/pbxcore/api/v3/firewall-bouncer/v1/decisions/stream"
    ["10.0.0.0/8", "192.168.1.0/24"]

    Step 1. Check whether this applies to you

    Step 2. Choose an approach

    Option A — network_mode: host (minimum effort)

    Option B — cs-firewall-bouncer apt package on the host

    1. Create an API token

    2. Install the bouncer on the host

    3. Configure

    4. Verify

    Production deployment notes

    Protect SSH (and other admin ports) from the bouncer

    Optional: safety-net auto-flush timer

    Bouncer bans cover every protocol — by design

    Endpoint response shape

    Whitelist sibling endpoint (custom)

    Technical reference

    Endpoints:
    • GET /v1/decisions/stream — full decision snapshot in CrowdSec LAPI format. Stock cs-firewall-bouncer polls this path automatically by appending it to api_url.

    • GET /v1/whitelist — operator allow-list as a flat JSON array (MikoPBX extension, see Whitelist).

  • Auth: the bouncer token can be sent in either header:

    • X-Api-Key: <token> — what stock cs-firewall-bouncer sends.

    • Authorization: Bearer <token> — convenient for curl, Postman, or custom HTTP clients. Both forms validate the same ApiKeys row, so path restrictions and ACLs apply identically.

  • Permission scope: firewall_bouncer. Issue tokens with allowed_paths: {"/api/v3/firewall-bouncer": "read"} — the UI preset in the ApiKeys section does this for you.

  • Compatibility: the decisions/stream response shape matches the CrowdSec LAPI exactly ({new, deleted} at the top level, no envelope). Existing CrowdSec bouncers (cs-firewall-bouncer, cs-cloudflare-bouncer, cs-nginx-bouncer, and dozens of community plugins) work out of the box.

  • GET /pbxcore/api/v3/firewall-bouncer/v1/decisions/stream

    Field
    Type
    Description

    id

    int

    Stable positive 32-bit integer — crc32(value + scenario) & 0x7fffffff.

    origin

    string

    mikopbx-fail2ban (Redis) or mikopbx-networkfilters (operator DB).

    MikoPBX
    CrowdSec
    Source

    mikopbx-fail2ban

    aggregated origin

    Redis keys firewall:<cat>:<ip>

    mikopbx-networkfilters

    aggregated origin

    m_NetworkFilters.deny table

    • Every poll returns the full snapshot of currently active bans in new. Bouncers refresh their ipset / nftables entry timeouts on every appearance, so a still-active ban stays alive at the source's declared duration.

    • deleted carries the per-bouncer diff since the previous poll. MikoPBX stores the last-served snapshot per ApiKey id (Redis key _PH_REDIS_CLIENT:fwbouncer:cursor:<token-id>, TTL 1 h refreshed on every poll — the cursor expires only after one hour of bouncer silence). Decisions that disappeared between two polls — operator-triggered unban, ban TTL elapsed, NetworkFilters entry deleted — appear in deleted as full decision objects on the next poll, so the bouncer evicts the entry from its local store immediately rather than waiting for natural ipset timeout.

    • update_frequency: 5–10s is the recommended polling interval.

    The bouncer-sent query parameters behave as follows:

    Param
    Behaviour

    startup

    startup=true ignores the stored cursor for this poll only — full snapshot in new, empty deleted — then writes the just-served snapshot to the cursor. The NEXT poll diffs against that fresh snapshot normally. Bouncers send this on the first poll after restart. Other values (including false) are treated as steady-state polls.

    scopes

    Accepted but ignored. MikoPBX only emits scope=Ip and scope=Range; no filtering applied server-side.

    origins

    Accepted but ignored. Both origins (mikopbx-fail2ban, mikopbx-networkfilters) always present in the response. Bouncers that want to filter must do so client-side.

    Cursor isolation lets multiple independent bouncers (e.g. one running nftables locally, another driving a Cloudflare endpoint) each track their own delta — issue one ApiKey per bouncer. Sharing one ApiKey between two or more bouncers makes them share a single cursor: polls from different bouncers interleave their snapshot writes, producing nondeterministic deleted[] timing and missed eviction events for short-lived bans.

    Note that the JSON body is the LAPI shape at the top level — there is no {result, data, ...} envelope around new / deleted.

    GET /pbxcore/api/v3/firewall-bouncer/v1/whitelist returns the operator-defined allow-list as a flat JSON array:

    Sources merged into the response:

    • NetworkFilters rows with newer_block_ip = '1',

    • Fail2BanRules.whitelist.

    This endpoint is MikoPBX-specific. Stock cs-firewall-bouncer does not poll it — CrowdSec LAPI has no "allow" decision type and the bouncer uses its own whitelists.yaml. Provided for MikoPBX-aware integrations that want server-side whitelist consistency.

    MikoPBX additionally enforces the whitelist on the write side (via DockerNetworkFilterService::isIpWhitelisted), but that's defence in depth — your bouncer should still subtract the whitelist from new before applying bans.

    • The whitelist endpoint exposes operator allow-list networks. Never expose this endpoint without authentication.

    • Optimally, bind the bouncer token to a NetworkFilter that permits only the bouncer host's IP. Calls from any other source will return 403.

    • After compromise — revoke the token in the ApiKeys UI; the bouncer will stop receiving new decisions, and its local bans will start expiring after 30 seconds (if that mode is enabled).

    Basics

    {
      "new": [
        {
          "id": 12345,
          "origin": "mikopbx-fail2ban",
          "type": "ban",
          "scope": "Ip",
          "value": "203.0.113.7",
          "duration": "3600s",
          "scenario": "mikopbx/sip"
        },
        {
          "id": 678901,
          "origin": "mikopbx-networkfilters",
          "type": "ban",
          "scope": "Range",
          "value": "198.51.100.0/24",
          "duration": "8760h",
          "scenario": "mikopbx/manual"
        }
      ],
      "deleted": []
    }
    # Read the bouncer API key from an env var / secret manager on the host
    # where you run this — never paste it inline in scripts that get checked
    # into version control.
    TOKEN=$BOUNCER_API_KEY
    
    # CrowdSec-style:
    curl -H "X-Api-Key: $TOKEN" \
      "https://pbx.example.com/pbxcore/api/v3/firewall-bouncer/v1/decisions/stream?startup=true" \
      | jq
    
    # Bearer-style (equivalent):
    curl -H "Authorization: Bearer $TOKEN" \
      "https://pbx.example.com/pbxcore/api/v3/firewall-bouncer/v1/decisions/stream" \
      | jq
    import requests, time
    
    BASE = "https://pbx.example.com/pbxcore/api/v3/firewall-bouncer"
    HEADERS = {"X-Api-Key": TOKEN}
    
    # Bouncer-local whitelist (refreshed less often than decisions).
    whitelist = set(requests.get(f"{BASE}/v1/whitelist", headers=HEADERS).json())
    
    while True:
        resp = requests.get(f"{BASE}/v1/decisions/stream", headers=HEADERS).json()
        bans = {d["value"] for d in resp["new"]}
        apply_iptables(bans - whitelist)
        time.sleep(10)
    ["10.0.0.0/8", "192.168.1.0/24"]

    Decisions stream

    Decision fields

    Mapping to CrowdSec

    Polling semantics

    Examples

    curl

    Minimal custom bouncer (Python)

    Whitelist

    Security

    Google Cloud deployment guide

    MikoPBX Installation deployment Guide using Google Cloud

    Authorize on the platform https://console.cloud.google.com/

    Let's start configuring

    For quick and convenient navigation on the Google Cloud platform, use the search pane

    Creating storage

    1. Open Navigation menu / Products & solutions / Storage / Cloud Storage

    2. On the Cloud Storage tab select Create

    3. Enter the storage name, for example miko-images

    4. Use default values for other fields

    5. After entering the values, click the Create button

    1. Open the created miko-images storage

    2. On the opened tab select UPLOAD FILES

    3. Upload the file from the MikoPBX distribution with the .vhd extension

    1. Open Navigation menu / APIs & Services / Library / Google Enterprise API / Cloud Build API

    2. On the opened tab select ENABLE

    1. Open Navigation menu / APIs & Services / Library / Google Enterprise API / Compute Engine API

    2. On the opened tab select ENABLE

    1. Open Navigation menu / Products & solutions / Compute / Compute Engine

    2. Go to the Storage / Images section

    3. Select CREATE IMAGE to create a new image

    1. In the Compute Engine tab go to the Virtual machines / VM Instance section

    2. Select CREATE INSTANCE

    3. Enter the virtual machine name, for example mikopbx-vm

    1. In the Machine configuration / General purpose table select Series - N1

    1. In the Machine type section choose Shared-core / f1-micro from the dropdown menu

    1. In the Boot disk section select CHANGE

    2. On the opened tab go to CUSTOM IMAGES

    3. In the Image field select the previously created mikopbx-new-image

    1. In the Advanced options / Disks section select ADD NEW DISK

    2. On the opened tab enter the disk name for data storage, for example disk-storage-mikopbx

    3. Specify the disk size of at least 50GB

    If you have an SSH key, proceed as follows:

    1. In the Advanced options / Security / MANAGE ACCESS section, select ADD ITEM

    2. Specify it in the SSH key field

    If you don't have an SSH key, proceed directly to step 18

    1. Use default values for other fields

    2. After entering the values, click the CREATE button

    1. Open Navigation menu / VPC network / Firewall

    2. Select CREATE FIREWALL RULE to create a new rule for incoming connections

    3. Enter the name of the new rule, for example internal-allow

    1. Specify Direction of traffic - Ingress

    2. Specify Targets

    3. From the Source filter dropdown menu select IPV4 ranges and in the Source IPv4 ranges field enter 0.0.0.0/0

    1. In the Protocols and ports section check the TCP (Ports - 0-65535) and UDP (Ports - 0-65535) checkboxes

    1. Use default values for other fields

    2. After entering the values, click the CREATE button

    1. Open the Compute Engine tab and go to the Virtual machines / VM Instance section

    2. Go to the created virtual machine mikopbx-vm

    3. On the opened tab navigate to Logs / Serial port 1 (console)

    1. Copy the external address of the created virtual machine and enter it in the browser's address bar

    2. For login use the login and password provided in Serial port 1 (console)

    Авторизуйтесь на платформе

    Приступим к настройке

    1. Откройте Navigation menu / Products & solutions / Storage / Cloud Storage

    2. На вкладке Cloud Storage выберите Create

    3. Введите имя хранилища, например miko-images

    1. Откройте Navigation menu / APIs & Services / Library / Google Enterprise API / Cloud Build API

    2. На открывшейся вкладке выберите ENABLE

    1. Откройте Navigation menu / APIs & Services / Library / Google Enterprise API / Compute Engine API

    2. На открывшейся вкладке выберите ENABLE

    1. Откройте Navigation menu / Products & solutions / Compute / Compute Engine

    2. Перейдите в раздел Storage / Images

    3. Выберите CREATE IMAGE для создания нового образа

    1. Во вкладке Compute Engine перейдите в раздел Virtual machines / VM Instance

    2. Выберите CREATE INSTANCE

    3. Введите имя виртуальной машины (Name), например mikopbx-vm

    Если у вас есть ключ SSH, выполните следующее

    1. В разделе Advanced options / Security / MANAGE ACCESS выберите ADD ITEM

    2. Укажите его в поле SSH key

    Если у вас есть нет ключа SSH, сразу перейдите к пункту 19

    1. Для других полей используйте значения по умолчанию

    2. Завершив ввод значений, нажмите кнопку CREATE

    1. Откройте Navigation menu / VPC network / Firewall

    2. Выберите CREATE FIREWALL RULE для создания нового правила для входящего соединения

    3. Введите имя нового правила (Name), например http-80

    1. Откройте вкладку Compute Engine перейдите в раздел Virtual machines / VM Instance

    2. Скопируйте External IP созданной виртуальной машины

    3. Введите в строке браузера External IP

    4. Откройте созданную виртуальную машину

    Running MikoPBX using docker compose

    MikoPBX Installation Guide using Docker compose

    To work with MikoPBX in a container, you need to install Docker and Docker Compose following the instructions

    Docker installation and creating a user and directories

    Docker compose launch option

    Here is an example of a docker-compose.yml file that can be used to manage your MikoPBX container via Docker Compose:

    docker-compose.yml
    services:
      mikopbx:
        container_name: "mikopbx"
        image: "ghcr.io/mikopbx/mikopbx:latest"
        network_mode: "host"
        entrypoint: "/sbin/docker-entrypoint"
        hostname:  "mikopbx-in-a-docker"
        volumes:
          - /var/spool/mikopbx/cf:/cf
          - /var/spool/mikopbx/storage:/storage
        tty: true
        environment:
          - ID_WWW_USER=${ID_WWW_USER}
          - ID_WWW_GROUP=${ID_WWW_GROUP}
          # Change the station name through environment variables
          - PBX_NAME=MikoPBX-in-Docker
          # Change the default SSH port to 23
          - SSH_PORT=23
          # Change the default WEB port to 8080
          - WEB_PORT=8080
          # Change the default WEB HTTPS port to 8443
          - WEB_HTTPS_PORT=8443

    Save the contents into a file named docker-compose.yml, make the necessary adjustments, and launch MikoPBX using the command:

    export ID_WWW_USER=$(id -u www-user)
    export ID_WWW_GROUP=$(id -g www-user)
    sudo docker compose -f docker-compose.yml up -d

    Running Multiple MikoPBX Instances on One Host

    Mode Without Network Isolation Between Host and Containers (–net=host)

    It is also possible to organize the launch of multiple MikoPBX containers on a single host. However, you need to consider Docker's port handling features. If the –net=host mode is not used, it will lead to a high load on the host system's CPU because Docker creates a separate rule in Iptables for each allocated port.

    With the –net=host mode enabled, you need to manually monitor the distribution of available ports between the running containers and built-in applications. For instance, to run two MikoPBX containers on one host, you can use the following configuration file:

    Save the contents into a file named docker-compose.yml, make the necessary adjustments, and launch MikoPBX using the command:

    There is an option to launch MikoPBX containers in the –net=bridge mode. However, as mentioned above, to use this mode you either need to significantly limit the range of RTP ports or open them on the host machine without using Docker's capabilities.

    For this, you will need to write a small script to determine the name of the current bridge interface and the IP address of each container. After running Docker Compose, you will then need to add the necessary iptables rules for the RTP port range as follows:

    Let's describe several containers in the docker-compose.yaml file, specify different ports for the web interface, SIP ports, and ranges of RTP ports to ensure they do not overlap.

    Creating a directory for scripts

    Save the start-multiple-mikopbx.sh and docker-compose.yaml files into this folder.

    Install the necessary dependencies for the script.

    Navigate to our folder, add execution rights and launch our script.

    While waiting for the containers to start, check the firewall settings on the host, and if necessary, open the ports specified in our docker-compose.yaml file, specifically:

    • TCP/UDP ports 5060 and 6060 for SIP

    • UDP ranges 10000-10800 and 20000-20800 for RTP voice transmission

    • TCP ports 8443 and 9443 for HTTPS protocol, for web interface operation.

    Access each station in turn at the addresses:

    • https://<host machine IP>:8443

    • https://<host machine IP>:9443

    To access the web interface of the first MikoPBX, use the login admin and the password mikopbx-first-password

    To access the web interface of the second MikoPBX, use the login admin and the password mikopbx-second-password

    Each machine should have NAT mode enabled, indicating that the container is behind a router in the network interface settings. If the stations will be used within a local network, then in the external IP field, enter the local IP address of the host machine, otherwise its public IP address.

    With that, the setup is complete, and you can configure accounts and make calls.

    Below are some of the environment variables that will allow you to adjust the MikoPBX ports and settings used.

    • SSH_PORT - port for SSH (22)

    • WEB_PORT - port for the web interface via HTTP protocol (80)

    • WEB_HTTPS_PORT - port for the web interface via HTTPS protocol (443)

    A full list of all possible setting parameters is available in the source code .

    Extensions

    Setting Primary Phone Numbers

    Extensions in MikoPBX are individual users of the system who are assigned internal numbers for making and receiving calls. They have personal accounts that allow you to configure access rights, call forwarding and other personal settings in the system.

    The "Extensions" section displays a list of internal user accounts for employees. On the left side of each employee, the status of the authorized device is displayed. If the device is successfully authorized under the respective internal user account, a green circle is shown; otherwise, it appears gray.

    In the search bar, you can find the desired contact. You can search by the employee's name, internal number, mobile number, or email address.

    The form also provides the ability to sort the list of employees by name, internal number, mobile number, or email address. There are buttons for copying the account password to the clipboard, editing the account, and deleting the account.

    type

    string

    Always "ban".

    scope

    string

    "Ip" for a single address or "Range" for a CIDR.

    value

    string

    IP address or CIDR.

    duration

    string

    Remaining time until expiry, e.g. "3600s" or "8760h".

    scenario

    string

    mikopbx/sip, mikopbx/http, mikopbx/ami, mikopbx/iax, or mikopbx/manual.

    mikopbx/sip

    scenario tag

    Redis sip category

    mikopbx/http

    scenario tag

    Redis http category

    mikopbx/ami

    scenario tag

    Redis ami category

    mikopbx/iax

    scenario tag

    Redis iax category

    mikopbx/manual

    scenario tag

    Operator-defined Firewall UI entries

    SIP_PORT - port for connecting a SIP client (5060)
  • TLS_PORT - port for connecting a SIP client with encryption (5061)

  • RTP_PORT_FROM - beginning of the RTP port range, voice transmission (10000)

  • RTP_PORT_TO - end of the RTP port range, voice transmission (10800)

  • IAX_PORT - port for connecting IAX clients (4569)

  • AMI_PORT - AMI port (5038)

  • AJAM_PORT - AJAM port used for connecting the telephony panel for 1C (8088)

  • AJAM_PORT_TLS - AJAM port used for connecting the telephony panel for 1C (8089)

  • BEANSTALK_PORT - port for the Beanstalkd queue server (4229)

  • REDIS_PORT - port for the Redis server (6379)

  • GNATS_PORT - port for the gnatsd server (4223)

  • ID_WWW_USER - identifier for www-user (can be set with the expression $(id -u www-user), where www-user is NOT a root user)

  • ID_WWW_GROUP - group identifier for www-user (can be set with the expression $(id -g www-user), where www-user is NOT a root group)

  • WEB_ADMIN_LOGIN - login for Web interface access

  • WEB_ADMIN_PASSWORD - password for Web interface access

  • Network Bridge Mode (–net=bridge)

    Important note! One of our containers uses port forwarding from SIP port changing its value from 5060 to 6060. In this case, for the system to function correctly, you need to add the external value of the SIP port in the NAT settings in the network interfaces section of MikoPBX. This setting can also be made by setting the corresponding value of the environment variable EXTERNAL_SIP_PORT=6060 in the docker-compose file.

    Environment variables for configuring MikoPBX

    In the default bridge mode the built-in MikoPBX firewall does not protect the web interface — the container cannot manage host iptables. See External firewall for Docker.

    here
    docker-compose.yml
    services:
      mikopbx-first:
        container_name: "mikopbx-first"
        image: "ghcr.io/mikopbx/mikopbx:latest"
        network_mode: "host"
        entrypoint: "/sbin/docker-entrypoint"
        hostname: "mikopbx-in-docker-first"
        volumes:
          - /var/spool/mikopbx/first/cf:/cf
          - /var/spool/mikopbx/first/storage:/storage
        tty: true
        environment:
          - ID_WWW_USER=${ID_WWW_USER}
          - ID_WWW_GROUP=${ID_WWW_GROUP}
          - PBX_NAME=MikoPBXFirst
          - PBX_FIREWALL_ENABLED=0
          - PBX_FAIL2BAN_ENABLED=0
          - SSH_PORT=123
          - WEB_PORT=8080
          - WEB_HTTPS_PORT=8443
          - SIP_PORT=5060
          - TLS_PORT=5061
          - RTP_PORT_FROM=10000
          - RTP_PORT_TO=10800
          - IAX_PORT=4569
          - AMI_PORT=5038
          - AJAM_PORT=8088
          - AJAM_PORT_TLS=8089
          - BEANSTALK_PORT=4229
          - REDIS_PORT=6379
          - GNATS_PORT=4223
      mikopbx-second:
        container_name: "mikopbx-second"
        image: "ghcr.io/mikopbx/mikopbx:latest"
        network_mode: "host"
        tty: true
        entrypoint: "/sbin/docker-entrypoint"
        hostname: "mikopbx-in-docker-second"
        volumes:
          - /var/spool/mikopbx/second/cf:/cf
          - /var/spool/mikopbx/second/storage:/storage
        environment:
          - ID_WWW_USER=${ID_WWW_USER}
          - ID_WWW_GROUP=${ID_WWW_GROUP}
          - PBX_NAME=MikoPBXSecond
          - PBX_FIREWALL_ENABLED=0
          - PBX_FAIL2BAN_ENABLED=0
          - SSH_PORT=2223
          - WEB_PORT=8081
          - WEB_HTTPS_PORT=9443
          - SIP_PORT=6060
          - TLS_PORT=6061
          - RTP_PORT_FROM=20000
          - RTP_PORT_TO=20800
          - IAX_PORT=5569
          - AMI_PORT=6038
          - AJAM_PORT=9088
          - AJAM_PORT_TLS=9089
          - BEANSTALK_PORT=5229
          - REDIS_PORT=7379
          - GNATS_PORT=5223
    export ID_WWW_USER=$(id -u www-user)
    export ID_WWW_GROUP=$(id -g www-user)
    sudo docker compose -f docker-compose.yml up -d
    start-multiple-mikopbx.sh
    #!/bin/bash
    
    COMPOSE_FILE="$1"
    
    if [ -z "$COMPOSE_FILE" ]; then
        echo "Usage: $0 path/to/docker-compose.yaml"
        exit 1
    fi
    
    # We will obtain the user ID for running the container
    export ID_WWW_USER=$(id -u www-user)
    export ID_WWW_GROUP=$(id -g www-user)
    
    # Stop current containers if they are running
    docker compose -f "$COMPOSE_FILE" down
    
    # Remove them
    docker compose -f "$COMPOSE_FILE" rm
    
    # Start containers in the background
    docker compose -f "$COMPOSE_FILE" up -d
    sleep 60
    
    # Create a label for IPTABLES rules
    IPTABLES_COMMENT="mikopbx-custom-rule"
    
    # Determine the project identifier, used when creating a network bridge
    project_prefix=$(cat "$COMPOSE_FILE" | yq e '.x-project-name' -)
    
    # If the prefix is not set, use a default value
    if [ -z "$project_prefix" ]; then
        project_prefix="default_prefix"
    fi
    
    # Function to get container IP address
    function get_container_ip() {
        docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"
    }
    
    # Function to get the name of the bridge interface
    function get_bridge_name() {
        local network_name="$1"
        local prefix="$2"
        local network_id=$(docker network inspect "${prefix}_${network_name}" -f '{{.Id}}')
    
        if [ -z "$network_id" ]; then
            echo "Error: Network ${prefix}_${network_name} not found."
            return 1
        fi
    
        local bridge_name=$(ip link show type bridge | grep -o "br-${network_id:0:12}\b")
        echo $bridge_name
    }
    
    echo "Delete tagged iptables rules"
    # Delete all iptables rules tagged with our comment
    iptables -S | grep "$IPTABLES_COMMENT" | sed 's/-A /-D /' | while read rule; do
            echo "Delete rule $rule"
            iptables $rule
    done
    
    # Delete all NAT iptables rules tagged with our comment
    iptables -S -t nat | grep "$IPTABLES_COMMENT" | sed 's/-A /-D /' | while read rule; do
         echo "Delete rule $rule"
         iptables -t nat $rule
    done
    
    # Parse the docker-compose file and obtain all necessary parameters.
    echo "Parsing docker-compose file and configuring iptables rules"
    cat "$COMPOSE_FILE" | yq e '.services[] | select(.environment[] | test("RTP_PORT_FROM")) | {"container_name": .container_name, "environment": .environment, "network": .networks[0]}' -o=json | jq -c '.' | while read -r service; do
        container_name=$(echo $service | jq -r '.container_name')
        network_name=$(echo $service | jq -r '.network')
        bridge_name=$(get_bridge_name "$network_name" "$project_prefix")
        container_ip=$(get_container_ip "$container_name")
    
        RTP_PORT_FROM=$(echo $service | jq -r '.environment[] | select(contains("RTP_PORT_FROM")) | split("=")[1]')
        RTP_PORT_TO=$(echo $service | jq -r '.environment[] | select(contains("RTP_PORT_TO")) | split("=")[1]')
    
        echo "Configuring iptables for $container_name ($container_ip) on $bridge_name from port $RTP_PORT_FROM to $RTP_PORT_TO"
    
        iptables -A DOCKER -t nat ! -i "$bridge_name" -p udp -m udp --dport $RTP_PORT_FROM:$RTP_PORT_TO -j DNAT --to-destination $container_ip:$RTP_PORT_FROM-$RTP_PORT_TO -m comment --comment "$IPTABLES_COMMENT"
        iptables -A DOCKER -d $container_ip/32 ! -i "$bridge_name" -o "$bridge_name" -p udp -m udp --dport $RTP_PORT_FROM:$RTP_PORT_TO -j ACCEPT -m comment --comment "$IPTABLES_COMMENT"
        iptables -A POSTROUTING -t nat -s $container_ip/32 -d $container_ip/32 -p udp -m udp --dport $RTP_PORT_FROM:$RTP_PORT_TO -j MASQUERADE -m comment --comment "$IPTABLES_COMMENT"
    
        echo "Don't forget to open UDP ports $RTP_PORT_FROM to $RTP_PORT_TO on external firewall if it exists"
    done
    
    echo "iptables configuration completed successfully."
    
    docker-compose.yaml
    services:
      mikopbx-first:
        container_name: "mikopbx-first"
        image: "ghcr.io/mikopbx/mikopbx:latest"
        entrypoint: "/sbin/docker-entrypoint"
        hostname:  "mikopbx-in-docker-first"
        volumes:
          - /var/spool/mikopbx/first/cf:/cf
          - /var/spool/mikopbx/first/storage:/storage
        tty: true
        networks:
          - network-bridge1
        environment:
          - ID_WWW_USER=${ID_WWW_USER}
          - ID_WWW_GROUP=${ID_WWW_GROUP}
          - PBX_NAME=MikoPBXFirst
          - RTP_PORT_FROM=10000 # UDP range 10000-10800 on host will be directed to the container
          - RTP_PORT_TO=10800
          - WEB_ADMIN_PASSWORD=mikopbx-first-password
          - ENABLE_USE_NAT=1
          - PBX_FIREWALL_ENABLED=1
          - PBX_FAIL2BAN_ENABLED=1
        ports:
          - "8443:443"  # TCP port 8443 on the host is directed to port 443 in the container
          - "5060:5060/udp"  # UDP port 5060 on the host is directed to port 5060 in the container
      mikopbx-second:
        container_name: "mikopbx-second"
        image: "ghcr.io/mikopbx/mikopbx:latest"
        tty: true
        networks:
          - network-bridge2
        entrypoint: "/sbin/docker-entrypoint"
        hostname:  "mikopbx-in-docker-second"
        volumes:
          - /var/spool/mikopbx/second/cf:/cf
          - /var/spool/mikopbx/second/storage:/storage
        environment:
          - ID_WWW_USER=${ID_WWW_USER}
          - ID_WWW_GROUP=${ID_WWW_GROUP}
          - PBX_NAME=MikoPBXSecond
          - RTP_PORT_FROM=20000 # UDP range 20000-20800 on host will be directed to the container
          - RTP_PORT_TO=20800
          - EXTERNAL_SIP_PORT=6060 # Inform MikoPBX about its external SIP port
          - WEB_ADMIN_PASSWORD=mikopbx-second-password
          - ENABLE_USE_NAT=1
          - PBX_FIREWALL_ENABLED=1
          - PBX_FAIL2BAN_ENABLED=1
        ports:
          - "9443:443"  # TCP port 9443 on the host is directed to port 443 in the container
          - "6060:5060/udp"  # UDP port 6060 on the host is directed to port 5060 in the container
    x-project-name: mikopbx # This parameter must be present
    networks:
      network-bridge1:
        driver: bridge
      network-bridge2:
        driver: bridge
    mkdir -p /usr/src/mikopbx
    sudo apt-get update
    sudo apt-get install jq
    sudo snap install yq
    cd /usr/src/mikopbx
    sudo chmod +x start-multiple-mikopbx.sh
    sudo ./start-multiple-mikopbx.sh docker-compose.yaml
    Wait for the file upload to complete
    Enter the image name, for example
    mikopbx-new-image
  • Specify the source type - Virtual disk (VMDK, VHD)

  • Select Virtual disk file under the BROWSE link, Browse / miko-images / .vhd

  • Uncheck the Install guest packages checkbox

  • In the Operating system on virtual disk field specify - No operating system. Data only.

  • Use default values for other fields

  • After entering the values, click the Create button and wait for the image creation to complete

  • Use default values for other fields on the tab
  • Click the SELECT button

  • Use default values for other fields on the tab
  • Click the SAVE button

  • Для других полей используйте значения по умолчанию
  • Завершив ввод значений, нажмите кнопку Create

  • Откройте созданное хранилище miko-images

  • На открывшейся вкладке выберите UPLOAD FILES

  • Загрузите файл из дистрибутива MikoPBX с расширением .vhd

  • Дождитесь окончания загрузки файла

  • Введите имя образа (Name), например mikopbx-new-image
  • Укажите тип источника (Source) - Virtual disk (VMDK, VHD)

  • Выберите Virtual disk file по ссылке BROWSE, *Browse / miko-images / .vhd

  • Уберите флажок Install guest packages

  • В поле Operating system on virtual disk укажите - No operating system. Data only.

  • Для других полей используйте значения по умолчанию

  • Завершив ввод значений, нажмите кнопку Create и дождитесь окончания создания образа

  • В таблице Machine configuration / General purpose ****выберите ****Series - N1
  • В разделе Machine type в выпадающем меню выберите Shared-core / f1-micro

  • В разделе Boot disk выберите CHANGE

  • На открытой вкладке перейдите к CUSTOM IMAGES

  • В поле Image выберите созданный ранее образ mikopbx-new-image

  • Для других полей на вкладке используйте значения по умолчанию

  • Нажмите кнопку SELECT

  • В разделе Firewall ****разрешите HTTP трафик, установите флажок Allow HTTP traffic

  • В разделе Advanced options / Disks выберите ADD NEW DISK

  • На открытой вкладке введите имя диска для хранения данных (Name), например disk-storage-mikopbx

  • Укажите размер диска (Size) не менее 50Гб

  • Для других полей на вкладке используйте значения по умолчанию

  • Нажмите кнопку SAVE

  • Укажите Direction of traffic - Ingress
  • Укажите Targets

  • Из выпадающего меню в поле Source filter выберите IPV4 ranges и в поле Source IPv4 ranges укажите 0.0.0.0/0

  • В разделе Protocols and ports установите флажок TCP и в поле Ports укажите 80

  • Для других полей используйте значения по умолчанию

  • Завершив ввод значений, нажмите кнопку CREATE

  • Аналогично создайте правило для HTTPS. Укажите имя, Direction of traffic - Ingress, Targets, Source filter - IPV4 ranges, Source IPv4 ranges - 0.0.0.0/0, Protocols and ports - TCP, Ports - 443

  • Аналогично создайте правило для SIP сигнализации TCP. Укажите имя, Direction of traffic - Ingress, Targets, Source filter - IPV4 ranges, Source IPv4 ranges - 0.0.0.0/0, Protocols and ports - TCP, Ports - 5060

  • Аналогично создайте правило для SIP сигнализации UDP. Укажите имя, Direction of traffic - Ingress, Targets, Source filter - IPV4 ranges, Source IPv4 ranges - 0.0.0.0/0, Protocols and ports - UDP, Ports - 5060

  • Аналогично создайте правило для передачи звука RTP. Укажите имя, Direction of traffic - Ingress, Targets, Source filter - IPV4 ranges, Source IPv4 ranges - 0.0.0.0/0, Protocols and ports - UDP, Ports - 10000-10200

  • Скопируйте Instance Id - это пароль для входа в АТС по умолчанию

  • Логин для входа по умолчанию - admin

  • Connecting Cloud Build API

    Check the roles for the Cloud Build service account:

    1. Open the IAM page https://console.cloud.google.com/projectselector2/iam-admin/iam.

    2. Select your Google Cloud project

    3. Check the Include Google-provided role grants checkbox

    4. In the table, find the row with the email address ending with @cloudbuild.gserviceaccount.com

    5. Select Edit principal

    6. The roles to be granted to the Cloud Build service account are Compute Admin and Service Account User

    If the required roles are not present, add them and click SAVE

    Connecting Compute Engine API

    Creating an image

    Creating a virtual machine

    To deploy the PBX use two disks:

    • A 1 Gb disk for the main system

    • A 50+ Gb disk for storing call recordings

    Configuring ports for incoming connections

    Make sure to configure the Firewall on the MikoPBX

    Starting MikoPBX

    Для быстрого и удобного поиска на платформе Google Cloud используйте панель поиска

    Создание хранилища

    Подключение Cloud Build API

    Проверьте роли учетной записи службы Cloud Build, для этого

    1. Откройте страницу IAM https://console.cloud.google.com/projectselector2/iam-admin/iam

    2. Выберите свой проект Google Cloud

    3. Установите флажок Include Google-provided role grants

    4. В таблице найдите строку с адресом электронной почты, заканчивающимся на @cloudbuild.gserviceaccount.com

    5. Выберите Править (Edit principal)

    6. Роли, которые должны быть предоставлены учетной записи службы Cloud Build, - Сompute Admin и Service Account User

    Если нужных ролей нет, добавьте и нажмите SAVE

    Подключение Compute Engine API

    Создание образа

    Создание виртуальной машины

    Настройка портов для входящих соединений

    Запуск АТС MikoPBX

    https://console.cloud.google.com/
    Sorting employees and functions in the main menu

    To add a new employee, click the "Add new employee" button.

    Button "Add new employee"

    There is an option to export and import employees for configuration convenience. To do this, click the arrow to the right of the "Add New Employee" button.

    3 options are available:

    1. Import from CSV — load employees from a CSV file into MikoPBX.

    2. Export to CSV — download employees to a CSV file from MikoPBX (employees will not be deleted from the station).

    3. Download template — download a CSV table template to fill in and subsequently import into MikoPBX.

    Options for bulk employee import/export

    Click "Select CSV file" and choose the previously prepared file with data in the table. It is recommended to use templates from the "Template" tab.

    "Import" section

    After selecting the file, information about all detected users in the table will be displayed. Select a duplicate handling strategy and click "Confirm import" to start the process.

    Employee import parameters

    After the process is complete, you will see the employee creation status as well as a notification about the end of the import.

    Click "Back to list" to return to the employee list.

    Successful employee import

    There is an option to export a CSV file with all the data of current employees. Several export formats are available:

    Minimal:

    • number — Internal number (required)

    • user_username — Employee full name (required)

    • user_email — Email address

    • mobile_number — Mobile number

    • sip_secret — SIP password (will be generated if not specified)

    • fwd_ringlength — Ring time (seconds) before forwarding

    • fwd_forwarding — Forwarding number if no answer

    Standard:

    • All parameters from Minimal.

    • mobile_dialstring — Number for dialing mobile

    • sip_dtmfmode — DTMF mode (auto/rfc4733/info/inband/auto_info)

    • sip_transport — Transport (udp/tcp/tls), default udp,tcp

    • sip_enableRecording — Call recording (true/false)

    • fwd_forwardingonbusy — Forwarding number if busy

    • fwd_forwardingonunavailable — Forwarding number if unavailable

    Full:

    • All parameters from Minimal and Standard.

    • user_avatar — Photo URL

    • sip_acceptMultipleCalls — Accept multiple calls at the same time (true/false)

    • sip_manualattributes — Additional SIP parameters

    You can also specify a range of internal employee numbers to export (the "Filter by number range" section).

    Click "Export employees". The file will be downloaded to your device.

    "Export" section

    On this tab, you can download a blank file template with the specified "columns" to fill in and subsequently import into MikoPBX.

    Select the template format (see the "Export" section for more details), then click "Download CSV template".

    "Template" section
    Employee Account Settings Tab

    On the "Basic Parameters" tab, you can configure the general settings for an employee's internal account:

    • Username: This value will be used for name substitution and displayed in the corresponding field on the phone screen.

    • Internal Number: This is the employee's internal extension number, which is also used as the login when connecting the phone.

    • Mobile Number: It is used for additional routing purposes.

    • Email Address: It is used for email notifications.

    • Password for SIP

    Accesses the Advanced drop-down list:

    Advanced settings option

    Redefining the set string

    In the "Redefining the set string" field, enter the dialing rule for mobile numbers according to your provider's requirements.

    If you want employees to have the ability to record conversations, you can enable the Сall recording feature.

    The setting determines how DTMF (Dual Tone Multi-Frequency) signals are transmitted over the SIP protocol. DTMF signals are used, for example, when dialing phone numbers or interacting with IVR systems.

    This setting allows you to specify the transport protocol used for this account. The transport protocol determines how data is transmitted over the network. The most common transport protocols used in SIP (Session Initiation Protocol) are UDP (User Datagram Protocol), TCP (Transmission Control Protocol), and TLS (Transport Layer Security)

    The subnet described in the "Network Firewall" section specifies the allowed subnet for this account. It determines which IP addresses or networks are permitted to connect to this account. Connections originating from other subnets will result in authentication errors.

    This field is used to modify/override the configuration files of Asterisk. You can override almost all parameters. For example, when using chan_pjsip, a SIP account for an employee is described by the following sections:

    To override fields in the sections, you should fill in the "Additional Parameters" field as follows:

    "Routing settings" section

    On this tab, you can set rules for call forwarding when the employee is unavailable, busy, or does not answer.

    Set the time period in seconds during which the call will be directed to the employee's internal account. If the employee cannot answer the call within the specified time, indicate to which number the call should be forwarded. By default, the call will be redirected to the employee's mobile number.

    You can also specify the numbers to which the call should be redirected in case of busy and unavailable status.

    Feel free to configure these parameters according to your preferences and requirements.

    • MicroSIP

    • Groundwire

    • Zoiper

    • Jitsi

    • Configuring telegram as SIP softphone

    • Yealink T19

    • Yealink T21

    • Yealink T28

    • Snom D120

    Extensions List

    Extensions status
    Search for an employee by email
    [***]
    type = aor
    max_contacts = 10
    ; ----
    
    [***]
    type = auth
    ; ----
    
    [***]
    type = endpoint
    context = all_peers
    ; ----
    
    [acl_***] 
    deny = 0.0.0.0/0.0.0.0
    permit = 0.0.0.0/0.0.0.0
    ; ----
    [acl]
    ; Describe access parameters from different subnets [acl_***]
    
    [auth] 
    ; Describe authentication parameters for outbound calls
    
    [aor]
    ; Edit AOR section for the endpoint
    
    [endpoint] 
    ; Edit endpoint parameters

    Adding an extension

    There are two ways to add employees:

    1) Adding employees one by one by entering data in the Web interface.

    2) Importing multiple employees from a CSV file.

    Adding Employees One by One

    Importing and Exporting Employees from a CSV File

    Import

    Export

    Template

    Main Account Settings

    Please set strong passwords for SIP accounts. MikoPBX validates the password length and strength when the account is saved. A secure SIP password should use a non-dictionary combination of uppercase and lowercase letters, digits, and special characters.

    • By setting complex passwords, you can enhance the security of the user accounts and protect them from unauthorized access.

    Advanced Account Settings

    Call recording

    DTMF Mode

    Transport protocol

    Network filter

    Manual additional attributes for SIP

    Routing Settings

    Connecting softphones

    Connecting telephones

    ARI Access

    Short description of ARI (Asterisk REST Interface)

    ARI is a RESTful API with WebSocket support that gives full control over Asterisk channels, bridges, and media streams in real time. Unlike the MikoPBX REST API, ARI works directly with the Asterisk core and is designed for building custom telephony applications.

    Detailed ARI documentation is available on the official Asterisk website:

    What is it used for?

    ARI is used when the standard PBX features are not enough and custom call handling logic is required:

    • WebRTC applications and softphones — web phones and mobile clients with direct media stream control

    • Interactive voice response (IVR) — custom menu logic unavailable through the standard dialplan

    • Conference calls — programmatic control of bridges and participants

    • Call recording and processing — real-time audio interception for analytics or transcription

    • Voice bots and assistants — integration with external AI services

    • Advanced queues — custom call distribution logic

    ARI consists of three components:

    1. REST API — management of Asterisk objects: channels, bridges, recordings

    2. WebSocket (/asterisk/ari/events) — receiving asynchronous real-time events: incoming call, call end, DTMF keypress, etc.

    3. Stasis — a dialplan application that passes a channel to your ARI application for control

    Typical scenario: a call enters the dialplan → Stasis() passes the channel to your application → the application controls the call via REST API and receives events via WebSocket.

    1. Before starting, you need to enable the ARI interface (it is disabled by default). Go to "System" → "General Settings".

    1. Go to the "AMI & ARI" tab and toggle the "Use ARI Interface" switch. In the "CORS allowed origins" field, specify the domains from which requests to ARI will be made. CORS is a browser security mechanism that restricts cross-domain API requests.

    Value
    When to use
    1. Go to "System" → "ARI Access".

    1. Click "Add User".

    1. Fill in the following parameters:

    • Username — login for connection, e.g. ari_user.

    • Password — password for connection.

    • Description — description for the current user, e.g. "WebRTC Demo".

    Save the settings.

    Type
    URL

    Replace [application] with the name of your Stasis application.

    Type
    URL

    Authentication: HTTP Basic Auth — ARI user login and password.

    This is a minimal ARI example — a channel enters a Stasis application, the application plays a sound file and ends the call.

    The example is taken from the official Asterisk documentation:

    In MikoPBX, go to "Routing" → "Dialplan Applications", create an application with the type "Asterisk Dialplan" and the following code:

    Assign the application to the required incoming route.

    When an incoming call arrives, the WebSocket will receive a StasisStart event:

    Open a new terminal window and run the following command:

    On successful playback, you will see the following output in the terminal:

    After the call ends, the WebSocket will send a StasisEnd event:

    A live employee status table in the terminal — no incoming route or Stasis application configuration required. Works by subscribing to all station events.

    Install dependencies:

    As calls are made, the table will update in real time:


    Full ARI documentation is available on the Asterisk website:

    General settings

    Description of the main system settings

    This section configures the core system parameters. It is recommended to complete these settings immediately after installing the PBX.

    "General Settings" section in the MikoPBX web interface

    Main

    • PBX system name - displayed on the MikoPBX main page.

    • Additional description - visible to system administrators only.

    • Language of system audio messages - language used for voice announcements.

    • Maximum length of internal numbers - the maximum length of an employee's internal extension number.

    • Allow incoming calls from any servers - allows accepting SIP calls from unauthorized devices and servers without registration.

    • Restart PBX every night — automatic restart of Asterisk at night (at 01:00 AM system time).

    • Send crash information to developers — when an error occurs, its description is sent to developers (requires internet access).

    Click "Save".

    • Call Recording - enable or disable recording of all calls.

    • Recording internal conversations- enable or disable recording of calls between employees.

    Below, you can select audio files to be used as a recording notification (different audio files can be selected for incoming and outgoing calls).

    Phone calls are saved in WebM format with the Opus codec. File size depends on call quality: if at least one participant uses a high-quality codec (e.g., G.722 or Opus), the recording is saved at a higher bitrate — this takes more disk space but improves speech recognition quality.

    Call Parking is a way to temporarily place a customer on hold while you look up information. The caller hears music while waiting.

    MikoPBX supports two parking methods:

    1. Dial *2 during a call — the call will be placed on hold and you will be told the parking slot number. Any employee can pick up the call by dialing that number.

    2. In the settings, configure a parking number — when a call is transferred to this number, MikoPBX will place it on hold and announce the slot number. Any employee can retrieve the call.

    The parking slot range and parking number can be configured in this section:

    • Call parking number — the number to transfer a call to in order to place it on hold, default is 800.

    • Parking slot range — the range of parking slot numbers, default is 801–820.

    MikoPBX supports two types of transfers:

    • Attended (Consultative) Transfer — you can speak with a colleague before transferring the call to them. The caller is on hold during this time. The transfer completes when you hang up.

    • Blind (Unattended) Transfer — the call is transferred immediately, without a prior conversation with the colleague. Useful when a second call comes in while you are already busy — the call can be instantly transferred to a free employee.

    The key combinations for transfers can be changed in this section:

    • Combination for attended transfer — default is ##.

    • Combination for blind transfer — default is **.

    • Call return time if no answer after attended transfer — if no one answers after an attended transfer, the call returns. Set in seconds, default is 45 sec.

    • Maximum timeout between digits when entering an extension number (in milliseconds) — the wait time for the next digit when dialing an extension. Set in milliseconds, default is 2500 ms.

    If a colleague's phone is ringing, you can pick up the call without leaving your desk:

    • *8<ColleagueNumber> — pick up a specific employee's call.

    • *8 — pick up any incoming call when the colleague's number is unknown.

    The pickup combination can be changed in the "Combination for intercepting incoming calls" field, default is *8.

    Session Initiation Protocol (SIP) is the signaling protocol used by most VoIP phones. You can change the SIP port (default 5060) to improve security.

    RTP (Real-time Transport Protocol) defines the standard format for transmitting audio and video over IP networks. The default port range is 10000–10800. Some routers and firewalls may require additional range configuration. Another reason to expand the range is a large number of concurrent calls: each active call uses two RTP ports, meaning 200 ports support no more than 100 simultaneous calls. If load is higher — expand the range.

    • SIP port for registering phones on this station — the port for phone registration on the station, default 5060. Changing the port can improve system security.

    • SIP TLS port (encrypted calls) — the port for encrypted calls, default 5061.

    • RTP port range — the port range for audio transmission, default 10000–10800.

    • STUN server address — helps when the PBX is behind NAT, including when using WebRTC.

    • Auth Username prefix for authorization — by default, the username for SIP account authorization matches the employee's internal extension (e.g., 101). When this setting is filled in, the specified prefix will be appended to the auth username: username remains 101, but AuthUsername becomes 101MIKO. This approach significantly complicates password brute-forcing for SIP accounts.

    Some firewalls close ports after a period of inactivity — in such cases, it is advisable to reduce the registration timeout. Different SIP providers may also require different timeout values.

    • Default time in seconds to send Keep-alive — the interval for sending keep-alive packets in seconds, default 120 seconds.

    • Minimum Registration Time (SIPMiniExpiry) — default 60 seconds.

    • Maximum Registration Time (SIPMaxExpiry) — default 3600 seconds.

    This section configures the allowed audio and video codecs for the entire PBX.

    Asterisk Manager Interface (AMI) is a powerful and convenient software interface (API) for Asterisk that allows external programs to manage the system. Through AMI, external programs can connect to Asterisk via TCP, initiate command execution, read results, and receive real-time event notifications. AMI is often used for integration with business processes and CRM (Customer Relationship Management) systems.

    Asynchronous Javascript Asterisk Manager (AJAM) is a technology that allows web browsers or other HTTP-capable applications to directly access the Asterisk Manager Interface (AMI) via HTTP/HTTPS.

    Asterisk REST Interface (ARI) is a RESTful API with WebSocket support that provides full control over Asterisk channels, bridges, and media streams in real time. Designed for developing custom telephony applications.

    • Use AMI Interface — enable or disable AMI.

    • AMI Port — the port for connecting external programs to AMI, default 5038. A client application connects to AMI through this port and authenticates, after which Asterisk responds to requests and sends notifications about state changes in specified subsystems.

    • HTTP Port (AJAM and ARI) — the port for HTTP connections, default 8088.

    • HTTPS Port (AJAM and ARI) — the port for HTTPS connections, default 8089.

    • Use AJAM Interface — enable or disable AJAM.

    • Use ARI Interface — enable or disable ARI. Disabled by default.

    • CORS allowed origins — domains from which requests to ARI are permitted. CORS is a browser security mechanism that restricts cross-domain API requests.

    SSH (Secure Shell) is an encrypted protocol commonly used for interacting with and remotely managing servers. An SSH server can authenticate users using various algorithms. The most popular is password authentication. It is fairly simple but not very secure: passwords are transmitted over a secure channel, but are not complex enough to withstand brute-force attempts. The computational power of modern systems combined with specialized scripts makes brute-forcing very easy.

    A more secure authentication method is SSH keys. Each pair consists of a public and private key: the private key is stored on the client, and the public key is uploaded to the server in the ~/.ssh/authorized_keys file. When connecting, the server sends a message encrypted with the public key — if the client decrypts it with the private key and returns the correct response, authentication is considered successful.

    • SSH port — the port for SSH connections, default 22.

    • SSH console login — the username for connecting.

    • Disable password authentication — enabled by default in MikoPBX (password authentication is disabled).

    To improve security, you can change the HTTP port (default 80) or enable HTTPS mode. HTTPS encrypts traffic between the browser and the PBX using SSL/TLS protocols. The default TCP port is 443.

    • HTTP port — the port for accessing the web interface via HTTP, default 80.

    • HTTPS port — the port for accessing the web interface via HTTPS, default 443.

    • Redirect to HTTPS — when the web interface is opened via HTTP, the user will be automatically redirected to HTTPS.

    An SSL/TLS certificate is a digital document that verifies the server's identity and ensures encrypted communication between the browser and the PBX. In MikoPBX, the certificate is used for:

    • HTTPS access to the web interface

    • WebRTC connections (required for browser-based calls)

    • Secure AJAM and ARI connections via HTTPS

    • Secured REST API for integrations

    The certificate must be in PEM format — beginning with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----. If you have intermediate certificates, add them after the main certificate in the same field.

    Ways to obtain a certificate:

    • Let's Encrypt Module — automatic issuance and renewal of free certificates. Recommended method.

    • Purchase from a Certificate Authority (DigiCert, Comodo, GlobalSign, etc.)

    • Self-signed Certificate — automatically generated on first PBX startup, but causes browser warnings.

    The secret key used to decrypt SSL/TLS connections. It must exactly match the public certificate — if they do not match, HTTPS will not work.

    The key must be in PEM format — beginning with -----BEGIN RSA PRIVATE KEY----- or -----BEGIN PRIVATE KEY-----.

    Security recommendations:

    • Keep a backup copy of the key in a secure location.

    • Use keys of at least 2048 bits in length (4096 recommended).

    • Regularly renew certificates and keys.

    In this section, you can change the login and password for accessing the web interface, and configure login via Passkeys.

    • Login — the username for logging into the web interface.

    • Password — the password for logging into the web interface.

    Passkeys are a modern passwordless login method using biometrics or a hardware security key: Face ID, Touch ID, Windows Hello, or YubiKey. This is faster and more secure than traditional passwords.

    To add a Passkey, click the "+ Add Passkey" button and follow the browser instructions.

    This section allows you to fully reset the system to its factory state. The reset will permanently delete all settings, call history, call recording files, and installed extension modules.

    To confirm, type delete everything in the input field and click "Save".

    PhonerLite
    Linphone(Mac OS)
    Telephone(Mac OS)
    WebRTC tutorial using SIPML5
    Softphone.pro
    Bria Solo
  • Use WebRTC — additional settings will be applied for WebRTC connections. For example, for internal extension 201, an additional endpoint will be created, accessible via WebRTC using the URL sip:201-WS@IP_PBX.

  • SSH password — the login password (available only if password authentication is not disabled).
  • Authorized SSH Keys — add your public SSH key here using the "+ Add Key" button. If you have multiple keys, add each one separately.

  • System Public SSH Key — the public SSH key of the current PBX. It can be copied into the "Authorized SSH Keys" field on another station — this allows connecting to the remote server without additional authentication.

  • Enabling this option may pose a security risk. Make sure your network is properly protected and filtering rules are in place!

    Call Recording

    Approximately 1 hour of conversation takes 14–28 MB of disk space depending on recording quality.

    Call Transfers

    Parking (Hold)

    Call Transfers

    Combinations are entered from the phone during an active call, followed by the internal extension number of the employee to transfer to.

    Timeouts

    Call Pickup

    SIP

    SIP Signaling Port and RTP Range Settings

    Additional Parameters

    Registration Duration Settings

    Audio/Video Codecs

    AMI&ARI

    AMI Settings

    HTTP Server Settings

    AJAM Settings

    ARI Settings

    Never use * in production. Only specify trusted domains over HTTPS.

    SSH

    In MikoPBX, password authentication is disabled by default — SSH keys must be used to connect. A key can be added in this section or when creating a virtual machine in the cloud (it will be automatically applied during MikoPBX installation).

    You can read more about connecting to MikoPBX via SSH here.

    Section Parameters

    HTTP/HTTPS

    HTTPS Public Key (SSL/TLS Certificate)

    We recommend using the Let's Encrypt module for automatic certificate management. Learn more in this article.

    HTTPS private key

    Never share your private key with third parties. If the key is compromised, an attacker will be able to intercept encrypted traffic. In case of compromise — replace the key pair immediately.

    WEB interface password

    Default MikoPBX credentials:

    • Login: admin

    • Password: admin — it is recommended to change this immediately.

    Passkeys (Biometric Authentication)

    You can read more about this here.

    System settings deletion

    This action is irreversible. Before clearing the system, make sure you have a backup of all important data.

    "General" tab in system settings
    "Call Recording" tab in system settings
    "Call Transfers" tab in system settings
    "SIP" tab in system settings
    "Audio/Video Codecs" section in system settings
    "AMI&ARI" tab in system settings
    "SSH" tab in system settings
    "HTTP/HTTPS" tab in system settings
    "WEB Interface Password" tab in system settings
    "System Settings Reset" section in system settings

    *

    All origins — for testing purposes only

    Applications — specify the names of Stasis applications the user has access to. Leave the field empty for access to all applications.

    (empty)

    Access from the same domain only

    http://localhost:3000

    Local development

    https://app.mycompany.com

    Production application

    Regular

    ws://your-mikopbx.com:8088/asterisk/ari/events

    Secure (TLS)

    wss://your-mikopbx.com:8089/asterisk/ari/events

    HTTP

    http://your-mikopbx.com:8088/asterisk/ari

    HTTPS

    https://your-mikopbx.com:8089/asterisk/ari/

    How does it work?

    Configuring an ARI User

    Never use * in production. Only specify trusted domains over HTTPS.

    Common applications

    • ari-app: Main ARI application

    • stasis: Base Stasis application

    • external-media: Working with external media streams

    • bridge-app: Call bridge management

    • channel-spy: Channel monitoring

    Connection Parameters

    WebSocket

    REST API

    It is recommended to use secure connections (wss:// and https://) with a valid SSL certificate. Regular ws:// and http:// are acceptable only in an isolated test environment.

    Example: Hello World

    Step 1 — Connect to WebSocket

    Step 2 — Configure the Incoming Route

    Step 3 — Make a Call

    Step 4 — Play Sound via REST API

    Use the channel id from the StasisStart event!

    Step 5 — End the Call

    Example: Presence Monitor

    Getting Started with ARI
    docs.asterisk.org
    Asterisk REST Interface
    "General settings" section in MikoPBX
    Enabling ARI
    "ARI Access" section in MikoPBX
    "Add User" button
    Configuring user access to the ARI
    # REST API request via curl
    curl -u username:password https://your-mikopbx.com:8089/asterisk/ari/asterisk/info
    wscat -c "wss://username:password@your-mikopbx.com:8089/asterisk/ari/events?app=hello-world"
    1,Answer()
    n,Stasis(hello-world)
    n,Hangup()
    {
      "type": "StasisStart",
      "timestamp": "2026-03-25T07:18:27.423+0300",
      "args": [],
      "channel": {
        "id": "mikopbx-1774412307.28",
        "name": "Local/10003258@internal-incoming-0000000a;2",
        "state": "Up",
        "protocol_id": "",
        "caller": {
          "name": "79257184275",
          "number": "79257184275"
        },
        "connected": {
          "name": "",
          "number": "252"
        },
        "accountcode": "",
        "dialplan": {
          "context": "internal",
          "exten": "10003258",
          "priority": 2,
          "app_name": "Stasis",
          "app_data": "hello-world"
        },
        "creationtime": "2026-03-25T07:18:27.371+0300",
        "language": "en-en"
      },
      "asterisk_id": "82:6a:9e:68:10:11",
      "application": "hello-world"
    }
    curl -u username:password -X POST \
      "https://your-mikopbx.com:8089/asterisk/ari/channels/mikopbx-1774412307.28/play?media=sound:/storage/usbdisk1/mikopbx/media/custom/miko_hello"
    {
      "id": "a0ee0d43-2af5-4250-a303-43825507a06c",
      "media_uri": "sound:/storage/usbdisk1/mikopbx/media/custom/miko_hello",
      "target_uri": "channel:mikopbx-1774412307.28",
      "language": "en-en",
      "state": "playing"
    }
    {
      "type": "StasisEnd",
      "timestamp": "2026-03-25T07:19:44.982+0300",
      "channel": {
        "id": "mikopbx-1774412307.28",
        "name": "Local/10003258@internal-incoming-0000000a;2",
        "state": "Up",
        "protocol_id": "",
        "caller": {
          "name": "79257184275",
          "number": "79257184275"
        },
        "connected": {
          "name": "",
          "number": "252"
        },
        "accountcode": "",
        "dialplan": {
          "context": "internal",
          "exten": "10003258",
          "priority": 2,
          "app_name": "Stasis",
          "app_data": "hello-world"
        },
        "creationtime": "2026-03-25T07:18:27.371+0300",
        "language": "en-en"
      },
      "asterisk_id": "82:6a:9e:68:10:11",
      "application": "hello-world"
    }
    pip install requests websockets
    import asyncio
    import websockets
    import json
    import os
    from datetime import datetime
    
    ARI_HOST = 'your-mikopbx.com'
    ARI_USER = 'ari_user'
    ARI_PASS = 'your-ari-password'
    
    peers = {}
    
    STATES = {
        'NOT_INUSE':   ('🟢', 'Available'),
        'BUSY':        ('🔴', 'Busy'),
        'UNAVAILABLE': ('⚫', 'Unavailable'),
    }
    
    def draw():
        print('\033[2J\033[H', end='')
        now = datetime.now().strftime('%H:%M:%S')
        print(f'MikoPBX — Presence Monitor [{now}]')
        print('─' * 50)
        print(f'  {"Number":<10} {"Name":<20} {"Status":<15} {"Updated"}')
        print('─' * 50)
        for number, info in sorted(peers.items()):
            icon, label = STATES.get(info['state'], ('❓', info['state']))
            print(f'  {number:<10} {info["name"]:<20} {icon} {label:<12} {info["updated"]}')
        print('─' * 50)
        print(f'  Employees: {len(peers)}')
    
    async def run():
        uri = (
            f"wss://{ARI_USER}:{ARI_PASS}@{ARI_HOST}:8089/asterisk/ari/events"
            f"?app=auto-receptionist&subscribeAll=true"
        )
        async with websockets.connect(uri) as ws:
            draw()
            async for message in ws:
                event = json.loads(message)
                etype = event.get('type')
    
                if etype == 'DeviceStateChanged':
                    ds     = event.get('device_state', {})
                    name   = ds.get('name', '')
                    state  = ds.get('state', '')
    
                    if not name.startswith('PJSIP/'):
                        continue
    
                    number = name.replace('PJSIP/', '')
    
                    if number not in peers:
                        peers[number] = {'name': number, 'state': state, 'updated': '—'}
    
                    peers[number]['state']   = state
                    peers[number]['updated'] = datetime.now().strftime('%H:%M:%S')
                    draw()
    
                elif etype == 'PeerStatusChange':
                    ep     = event.get('endpoint', {})
                    number = ep.get('resource', '')
                    state  = ep.get('state', '')
    
                    if not number:
                        continue
    
                    if number not in peers:
                        peers[number] = {'name': number, 'state': 'unknown', 'updated': '—'}
    
                    if state == 'online':
                        peers[number]['state'] = 'NOT_INUSE'
                    elif state == 'offline':
                        peers[number]['state'] = 'UNAVAILABLE'
    
                    peers[number]['updated'] = datetime.now().strftime('%H:%M:%S')
                    draw()
    
                elif etype == 'ContactStatusChange':
                    ep     = event.get('endpoint', {})
                    number = ep.get('resource', '')
                    ci     = event.get('contact_info', {})
                    status = ci.get('contact_status', '')
    
                    if not number:
                        continue
    
                    if number not in peers:
                        peers[number] = {'name': number, 'state': 'unknown', 'updated': '—'}
    
                    if status == 'Reachable':
                        peers[number]['state'] = 'NOT_INUSE'
                    elif status in ('Unreachable', 'NonQualified'):
                        peers[number]['state'] = 'UNAVAILABLE'
    
                    peers[number]['updated'] = datetime.now().strftime('%H:%M:%S')
                    draw()
    
    asyncio.run(run())
    MikoPBX — Presence Monitor [11:34:43]
    ──────────────────────────────────────────────────
      Number     Name                 Status          Updated
    ──────────────────────────────────────────────────
      202        202                  🟢 Available    11:34:25
      243        243                  ⚫ Unavailable  11:34:43
      252        252                  🔴 Busy         11:34:41
    ──────────────────────────────────────────────────
      Employees: 3

    AWS Terraform Script

    Instructions for deploying MikoPBX in AWS via Terraform script

    This guide describes deploying MikoPBX in AWS using the Infrastructure as Code (IaC) approach with Terraform. The entire infrastructure — EC2 instance, network rules, disks, and IP address — is declared in code, ensuring reproducibility, versioning, and the ability to quickly redeploy in any environment.

    General process:

    Download .raw  →  Upload to S3  →  Import as AMI  →  Deploy via Terraform

    Note: AMI image import cannot be performed directly via Terraform — AWS does not support this process through the Terraform provider. A separate bash script is used for the import, after which Terraform uses the created AMI.


    Prerequisites

    • Terraform >= 1.3.0

    • AWS CLI configured with access keys (aws configure)

    • Bash (macOS / Linux)

    • IAM permissions: ec2:*, s3:*, iam:CreateRole, iam:PutRolePolicy

    Configuring AWS CLI


    1. Go to the MikoPBX releases page:

      Download the latest image with the .raw extension.

    2. Go to the .

    1. Navigate to Services → Storage → S3.

    1. Click Create bucket. Enter a unique bucket name in the Bucket name field. Use default values for all other fields.

    Confirm by clicking Create bucket.

    1. Open the created bucket by clicking its name. Click Upload and select the disk image file with the .raw extension.

    Click Upload to confirm.


    AWS requires a special IAM role vmimport for image imports. Perform these steps once per account.

    Create a file trust-policy.json with the following content:

    Create a file role-policy.json with the following content:

    Replace mikopbx-bucket with your S3 bucket name.

    Run the following commands to apply the policies:


    Save the script below as import-image.sh and edit the variables DEFAULT_BUCKET, DEFAULT_IMAGE, and DEFAULT_NAME.

    import-image.sh

    Run the script:

    Once complete, the script will output the AMI ID — save it, as it will be needed for Terraform.


    Create all of the following files (directory structure):

    Below we walk through each file and the content to add to each:

    The main configuration file describing all AWS resources to be created: EC2 instance, Security Group, EBS disks, and Elastic IP. By default, the Security Group opens only the ports required for MikoPBX to operate: SSH, HTTP/HTTPS, SIP, and RTP.

    Warning: Be sure to configure the Firewall in MikoPBX after your first login!


    Declares variables with their types, descriptions, and default values. Does not contain specific values on its own — only the schema.


    Defines what data Terraform will output after a successful apply: the web interface URL, and the login and password for the first login. Convenient for quickly retrieving credentials without opening the AWS Console.


    Contains the specific variable values for your environment: region, AMI ID, instance type, etc. This is the file that changes when moving between environments (dev/staging/prod).

    Note: Specify your own parameters in this file — replace aws_region, instance_name, instance_type, storage_disk_size, allowed_ssh_cidr, create_key_pair, and public_key_path as needed. Be sure to replace custom_ami_id with the ID of the AMI you created earlier.


    Make sure all 4 files are created, then run the following commands:

    You will see the following output:

    Run the following command to preview the configuration:

    You will see the configuration that Terraform has parsed and plans to create. Review all parameters, then run:

    Enter yes to confirm. Upon successful creation of the MikoPBX instance, the required credentials will be displayed:


    After a successful terraform apply:

    1. Copy the URL from the output values.

    2. Open it in your browser: https://<URL>

    Use the credentials displayed during infrastructure creation to log in.

    ⚠️ After logging in, be sure to configure the Firewall in MikoPBX.


    ⚠️ The AMI and the S3 bucket containing the image are not deleted automatically — they must be removed manually via the AWS Console or CLI if no longer needed.


    Error: InvalidAMIID.NotFound

    Cause: The AMI exists in a different region. Solution: Make sure the region in terraform.tfvars matches the region where the import script was run.

    Error: OptInRequired during import

    Cause: The vmimport role has not been created or lacks the required permissions. Solution: Repeat the IAM role configuration step.

    Error: import status error

    Cause: Corrupted .raw file or incorrect format. Solution: Verify that the original image was downloaded correctly and that the filename in DEFAULT_IMAGE is accurate.

    Slow snapshot import

    Importing a large image can take 10–30 minutes. The script automatically waits for completion, polling the status every 30 seconds.

    aws configure
    # AWS Access Key ID: your_key
    # AWS Secret Access Key: your_secret_key
    # Default region name: us-east-1 (your region)
    # Default output format: json
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": { "Service": "vmie.amazonaws.com" },
          "Action": "sts:AssumeRole",
          "Condition": {
            "StringEquals": { "sts:Externalid": "vmimport" }
          }
        }
      ]
    }
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "s3:GetBucketLocation",
            "s3:GetObject",
            "s3:ListBucket"
          ],
          "Resource": [
            "arn:aws:s3:::mikopbx-bucket",
            "arn:aws:s3:::mikopbx-bucket/*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:ModifySnapshotAttribute",
            "ec2:CopySnapshot",
            "ec2:RegisterImage",
            "ec2:Describe*"
          ],
          "Resource": "*"
        }
      ]
    }
    # Create the role
    aws iam create-role \
      --role-name vmimport \
      --assume-role-policy-document "file://trust-policy.json"
    # Attach the policy to the role
    aws iam put-role-policy \
      --role-name vmimport \
      --policy-name vmimport \
      --policy-document "file://role-policy.json"
    #!/bin/bash
    
    # -----------------------------------------------
    # Settings — change these to match your values
    # -----------------------------------------------
    DEFAULT_IMAGE="mikopbx-2026.1.223-x86_64.raw"
    DEFAULT_BUCKET="mikopbx-bucket"
    DEFAULT_DESCRIPTION="MikoPBX PBX on Asterisk"
    DEFAULT_NAME="MikoPBX 2026.1.223"
    
    # Override via environment variables (optional)
    IMAGE="${IMAGE:-$DEFAULT_IMAGE}"
    BUCKET="${BUCKET:-$DEFAULT_BUCKET}"
    DESCRIPTION="${DESCRIPTION:-$DEFAULT_DESCRIPTION}"
    NAME="${NAME:-$DEFAULT_NAME}"
    
    # -----------------------------------------------
    # Import snapshot from S3
    # -----------------------------------------------
    JSON_FILE="disk_container.json"
    
    cat <<EOF > ${JSON_FILE}
    {
      "Description": "${DESCRIPTION} image",
      "Format": "raw",
      "UserBucket": {
        "S3Bucket": "${BUCKET}",
        "S3Key": "${IMAGE}"
      }
    }
    EOF
    
    echo "Starting snapshot import..."
    IMPORT_TASK_ID=$(aws ec2 import-snapshot \
      --description "${DESCRIPTION} image" \
      --disk-container "file://${JSON_FILE}" \
      --query 'ImportTaskId' \
      --output text)
    
    echo "Import task started: $IMPORT_TASK_ID"
    
    # Wait for import to complete
    while true; do
      STATUS=$(aws ec2 describe-import-snapshot-tasks \
        --import-task-ids "$IMPORT_TASK_ID" \
        --query 'ImportSnapshotTasks[0].SnapshotTaskDetail.Status' \
        --output text)
      echo "Status: $STATUS"
      if [ "$STATUS" == "completed" ]; then
        break
      elif [ "$STATUS" == "error" ]; then
        echo "Import failed!"
        exit 1
      fi
      sleep 30
    done
    
    # Get snapshot ID
    SNAPSHOT_ID=$(aws ec2 describe-import-snapshot-tasks \
      --import-task-ids "$IMPORT_TASK_ID" \
      --query 'ImportSnapshotTasks[0].SnapshotTaskDetail.SnapshotId' \
      --output text)
    
    echo "Snapshot created: $SNAPSHOT_ID"
    
    # -----------------------------------------------
    # Register AMI from snapshot
    # -----------------------------------------------
    AMI_ID=$(aws ec2 register-image \
      --name "$NAME" \
      --description "$DESCRIPTION" \
      --architecture x86_64 \
      --sriov-net-support simple \
      --virtualization-type hvm \
      --ena-support \
      --boot-mode uefi \
      --root-device-name "/dev/sda1" \
      --block-device-mappings "[
        {\"DeviceName\": \"/dev/sda1\", \"Ebs\": {
          \"DeleteOnTermination\": true,
          \"VolumeSize\": 1,
          \"SnapshotId\": \"$SNAPSHOT_ID\"
        }},
        {\"DeviceName\": \"/dev/sdb\", \"Ebs\": {\"VolumeSize\": 50}}
      ]" \
      --query 'ImageId' \
      --output text)
    
    echo ""
    echo "=========================================="
    echo "AMI successfully created: $AMI_ID"
    echo "Use this ID in terraform.tfvars:"
    echo "  custom_ami_id = \"$AMI_ID\""
    echo "=========================================="
    
    # Remove temporary file
    rm -f "$JSON_FILE"
    sh import-image.sh
    ==========================================
    AMI successfully created: ami-0c8820696110d0613
    Use this ID in terraform.tfvars:
      custom_ami_id = "ami-0c8820696110d0613"
    ==========================================
    mikopbx-aws-custom/
    ├── main.tf
    ├── variables.tf
    ├── outputs.tf
    ├── terraform.tfvars
    terraform {
      required_providers {
        aws = {
          source  = "hashicorp/aws"
          version = "~> 5.0"
        }
      }
      required_version = ">= 1.3.0"
    }
    
    provider "aws" {
      region = var.aws_region
    }
    
    # --------------------------------------------------
    # Security Group
    # --------------------------------------------------
    resource "aws_security_group" "mikopbx_sg" {
      name        = "${var.instance_name}-sg"
      description = "Security group for MikoPBX"
    
      ingress {
        from_port   = 22
        to_port     = 22
        protocol    = "tcp"
        cidr_blocks = [var.allowed_ssh_cidr]
        description = "SSH"
      }
    
      ingress {
        from_port   = 443
        to_port     = 443
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
        description = "HTTPS web UI"
      }
    
      ingress {
        from_port   = 80
        to_port     = 80
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
        description = "HTTP"
      }
    
      ingress {
        from_port   = 5060
        to_port     = 5060
        protocol    = "udp"
        cidr_blocks = ["0.0.0.0/0"]
        description = "SIP UDP"
      }
    
      ingress {
        from_port   = 5060
        to_port     = 5060
        protocol    = "tcp"
        cidr_blocks = ["0.0.0.0/0"]
        description = "SIP TCP"
      }
    
      ingress {
        from_port   = 10000
        to_port     = 10200
        protocol    = "udp"
        cidr_blocks = ["0.0.0.0/0"]
        description = "RTP media"
      }
    
      egress {
        from_port   = 0
        to_port     = 0
        protocol    = "-1"
        cidr_blocks = ["0.0.0.0/0"]
      }
    
      tags = {
        Name = "${var.instance_name}-sg"
      }
    }
    
    # --------------------------------------------------
    # SSH Key Pair (optional)
    # --------------------------------------------------
    resource "aws_key_pair" "mikopbx_key" {
      count      = var.create_key_pair ? 1 : 0
      key_name   = "${var.instance_name}-key"
      public_key = file(pathexpand(var.public_key_path))
    }
    
    # --------------------------------------------------
    # EC2 Instance with custom AMI
    # --------------------------------------------------
    resource "aws_instance" "mikopbx" {
      # Use the AMI created by import-image.sh
      ami           = var.custom_ami_id
      instance_type = var.instance_type
    
      key_name               = var.create_key_pair ? aws_key_pair.mikopbx_key[0].key_name : var.existing_key_pair_name
      vpc_security_group_ids = [aws_security_group.mikopbx_sg.id]
    
      # System disk (1 GB)
      root_block_device {
        volume_size = 1
        volume_type = "gp3"
      }
    
      tags = {
        Name = var.instance_name
      }
    }
    
    # --------------------------------------------------
    # Disk for call recordings (50+ GB)
    # --------------------------------------------------
    resource "aws_ebs_volume" "mikopbx_storage" {
      availability_zone = aws_instance.mikopbx.availability_zone
      size              = var.storage_disk_size
      type              = "gp3"
    
      tags = {
        Name = "${var.instance_name}-storage"
      }
    }
    
    resource "aws_volume_attachment" "storage_attach" {
      device_name = "/dev/sdc"
      volume_id   = aws_ebs_volume.mikopbx_storage.id
      instance_id = aws_instance.mikopbx.id
    }
    
    # --------------------------------------------------
    # Elastic IP
    # --------------------------------------------------
    resource "aws_eip" "mikopbx_eip" {
      instance = aws_instance.mikopbx.id
      domain   = "vpc"
    
      tags = {
        Name = "${var.instance_name}-eip"
      }
    }
    variable "aws_region" {
      description = "AWS region"
      type        = string
      default     = "us-east-1"
    }
    
    variable "custom_ami_id" {
      description = "ID of the custom AMI created by import-image.sh"
      type        = string
      # Value must be provided via terraform.tfvars
    }
    
    variable "instance_name" {
      description = "EC2 instance name"
      type        = string
      default     = "mikopbx-vm"
    }
    
    variable "instance_type" {
      description = "EC2 instance type"
      type        = string
      default     = "t3.micro"
    }
    
    variable "storage_disk_size" {
      description = "Size of the recordings disk (GB)"
      type        = number
      default     = 50
    }
    
    variable "allowed_ssh_cidr" {
      description = "CIDR block for SSH access"
      type        = string
      default     = "0.0.0.0/0"
    }
    
    variable "create_key_pair" {
      description = "Create an SSH Key Pair (true) or use an existing one (false)"
      type        = bool
      default     = true
    }
    
    variable "public_key_path" {
      description = "Path to the public SSH key"
      type        = string
      default     = "~/.ssh/id_rsa.pub"
    }
    
    variable "existing_key_pair_name" {
      description = "Name of an existing Key Pair (if create_key_pair = false)"
      type        = string
      default     = ""
    }
    output "first_login" {
      description = "Credentials for the first login to the MikoPBX web interface"
      value = <<-EOT
    
        ======================================
         MikoPBX is ready!
        ======================================
         URL:      https://${aws_eip.mikopbx_eip.public_ip}
         Login:    admin
         Password: ${aws_instance.mikopbx.id}
        ======================================
    
      EOT
    }
    aws_region        = "ap-southeast-1"
    custom_ami_id     = "ami-0c8820696110d0613"   # <- ID from import-image.sh
    instance_name     = "mikopbx-vm"
    instance_type     = "t3.micro"
    storage_disk_size = 50
    allowed_ssh_cidr  = "0.0.0.0/0"
    create_key_pair   = true
    public_key_path   = "~/.ssh/id_rsa.pub"
    cd mikopbx-aws-custom  # Navigate to the directory with the created files
    
    terraform init
    Terraform has been successfully initialized!
    
    You may now begin working with Terraform. Try running "terraform plan" to see
    any changes that are required for your infrastructure. All Terraform commands
    should now work.
    
    If you ever set or change modules or backend configuration for Terraform,
    rerun this command to reinitialize your working directory. If you forget, other
    commands will detect it and remind you to do so if necessary.
    terraform plan
    terraform apply
    ======================================
     MikoPBX is ready!
    ======================================
     URL:      https://52.221.99.139
     Login:    admin
     Password: i-007352c23fa6d3b01
    ======================================
    terraform destroy
    # Delete the AMI
    aws ec2 deregister-image --image-id ami-0a1b2c3d4e5f67890
    
    # Delete the snapshot (ID can be found in AWS Console → EC2 → Snapshots)
    aws ec2 delete-snapshot --snapshot-id snap-xxxxxxxxxxxxxxxxx
    
    # Delete the file from S3
    aws s3 rm s3://mikopbx-bucket/mikopbx-2026.1.223-x86_64.raw
    
    # Delete the bucket (if empty)
    aws s3 rb s3://mikopbx-bucket
    Error: InvalidAMIID.NotFound: The image id 'ami-xxxx' does not exist
    Error: OptInRequired
    Status: error
    Import failed!

    Uploading the Image to S3

    Configuring the IAM Role for Import

    Importing the Image as an AMI

    Deploying via Terraform

    main.tf

    variables.tf

    outputs.tf

    terraform.tfvars

    Running Terraform

    Connecting to MikoPBX

    Destroying Resources

    Common Errors

    https://github.com/mikopbx/Core/releases
    Amazon Web Services Console
    Amazon Web Services Console
    S3 section in AWS Console
    Creating bucket to store disk image file
    Uploading disk image file
    MikoPBX Web-Interface (Deployed using terraform in AWS)

    REST API Usage Examples

    Instructions with examples on creating and using API keys

    Working with the REST API follows the OpenAPI standard. To get the current list of endpoints, use the "Documentation" section inside the PBX. Below are examples of working with the main features of the MikoPBX REST interface.

    If you do not have a trusted certificate — add verify=False to each request and disable warnings:

    It is strongly recommended to issue a trusted certificate. The easiest way to do this is by using the Let's Encrypt module.

    Connection

    To run all examples in this guide, create an API key and configure the following access permissions (see the general article for details):

    Resource
    Access Level
    Used for

    In this article we will be working with Python, so you need to install the required dependencies:

    Below is a connection template for accessing the station via an API key. Use it before all scripts in this guide. The API key is passed directly in the request header — no additional authentication is required:

    Endpoint: POST /pbxcore/api/v3/employees

    The table below lists the parameters for this request.

    Field
    Req.
    Type / constraints
    Description

    Example API response (HTTP 201):

    Possible response codes:

    Code
    Description

    On successful execution, you will see the following console output:

    Employees 283 and 284 will be created on the station.

    On successful execution, you will see the following console output:

    On successful execution, you will see the following console output:

    3 employees will be created on the station.

    Endpoint: POST /pbxcore/api/v3/sip-providers

    Field
    Req.
    Type
    Description

    On successful execution, you will see the following console output:

    A provider will be created on the station:

    On successful execution, you will see the following console output:

    Endpoint: GET /pbxcore/api/v3/cdr — read-only.

    Parameter
    Type
    Description

    On successful execution, you will see the following console output:

    On successful execution, you will see the following console output:

    Field
    Type
    Description

    Endpoints: GET /pbxcore/api/v3/sip , GET /pbxcore/api/v3/sip-providers

    On successful execution, you will see the following console output:

    Employee statuses (status field)

    Value
    Description

    Provider statuses (state field)

    Value
    Description

    Endpoint: GET /pbxcore/api/v3/pbx-status

    On successful execution, you will see the following console output:

    The full list of endpoints and interactive documentation is available in the section.

    string, 1–100 characters

    Employee full name

    sip_secret

    ✅

    string, 5–100 characters

    SIP account password

    user_email

    —

    string email, ≤255

    Email for notifications

    mobile_number

    —

    string E.164, ≤50

    Mobile number (+1...) for forwarding

    mobile_dialstring

    —

    string, ≤255

    Mobile dial string

    sip_transport

    —

    udp / tcp / tls / udp,tcp

    SIP transport (default: udp)

    sip_dtmfmode

    —

    auto / rfc4733 / inband / info

    DTMF mode (default: auto)

    sip_enableRecording

    —

    boolean

    Call recording (default: true)

    sip_networkfilterid

    —

    number | "none"

    Network filter ID

    sip_manualattributes

    —

    string, ≤1024

    Additional SIP parameters

    fwd_ringlength

    —

    integer, ≤180

    Ring time before forwarding (sec, default: 45)

    fwd_forwarding

    —

    number | hangup | busy

    Unconditional forwarding

    fwd_forwardingonbusy

    —

    number | hangup | busy

    Forwarding on busy

    fwd_forwardingonunavailable

    —

    number | hangup | busy

    Forwarding on unavailable

    403

    No write permission for the /employees resource

    409

    Conflict — number already in use

    string

    Provider SIP server address

    username

    —

    string

    Login on the provider's server

    secret

    —

    string

    Password

    registration_type

    —

    string

    inbound / outbound / none

    qualify

    —

    boolean

    Availability monitoring (default: true)

    transport

    —

    string

    udp / tcp / tls / udp,tcp (default: udp,tcp)

    dtmfmode

    —

    string

    auto / rfc4733 / inband / info (default: auto)

    port

    —

    integer

    Connection port (default: 5060)

    disabled

    —

    boolean

    Disable provider (default: false)

    dateFrom

    string

    Period start: %Y-%m-%dT%H:%M:%S

    dateTo

    string

    Period end: %Y-%m-%dT%H:%M:%S

    src_num

    string

    Filter by caller number

    dst_num

    string

    Filter by destination number

    disposition

    string

    ANSWERED / NO ANSWER / BUSY / FAILED

    src_num

    string

    Caller number

    src_name

    string

    Caller name

    dst_num

    string

    Destination number

    dst_name

    string

    Destination name

    disposition

    string

    ANSWERED / NO ANSWER / NOANSWER / BUSY / CHANUNAVAIL / FAILED

    totalBillsec

    integer

    Call duration (seconds)

    totalDuration

    integer

    Total duration (including ringing)

    records

    array

    Detailed records for each call leg

    records[].recordingfile

    string

    Path to the recording file

    records[].playback_url

    string

    URL for playing back the recording

    records[].download_url

    string

    URL for downloading the recording

    records[].dtmf_digits

    string

    DTMF digits pressed in IVR

    Employees Management

    Read and write

    Creating and editing employees

    Providers

    Read and write

    Creating and editing providers

    SIP

    Read

    Employee and trunk registration statuses

    Call Records

    Read

    Call history (CDR)

    PBX Status

    Read

    Active calls in real time

    SIP Providers

    Read and write

    Creating and editing SIP providers

    number

    ✅

    string, 2–8 digits

    Extension number

    user_username

    201

    Employee successfully created

    400

    Validation error (weak password <5 characters, invalid number format)

    401

    Invalid or missing API key

    description

    ✅

    string

    Provider name

    host

    offset

    integer

    Pagination offset (default: 0)

    limit

    integer

    Number of records, max. 100

    linkedid

    string

    Unique call identifier

    start

    datetime

    Call start time

    Available

    Registered and available

    Unavailable

    Not registered (offline)

    registered

    Registered on the provider's server

    rejected

    Registration rejected by the server

    unregistered

    Not registered

    In the template, replace the following parameters:

    • your-mikopbx.com — with the IP address or URL of your station.

    • your-api-key — with the previously created API key with the required permissions.

    Working with Employees

    Creating a Single Employee

    Listing Employees

    Group Employee Creation

    Working with SIP Providers

    Creating a Provider

    Listing All Providers

    Retrieving Call History (CDR)

    Statistics for a Period

    Calls with the CHANUNAVAIL status are not counted in the Answered, Missed, or Avg. duration statistics.

    CDR Record Fields

    Monitoring: SIP Statuses and Active Calls

    Employee and SIP Provider Registration Statuses

    Active Calls in Real Time

    Interactive Documentation and Endpoint List
    Example of access permission configuration (Call Records and Employees permissions)
    Employees created via REST API
    Employees created via REST API
    Provider created via REST API

    ✅

    ✅

    pip install requests
    import requests
    
    BASE_URL = 'https://your-mikopbx.com/pbxcore/api/v3'
    API_KEY  = 'your-api-key'
    
    HEADERS = {
        'Authorization': f'Bearer {API_KEY}',
        'Content-Type':  'application/json',
    }
    def create_employee(
        number: str,
        name: str,
        sip_secret: str,
        email: str = '',
        mobile: str = '',
        record_calls: bool = True,
        fwd_ringlength: int = 45,
    ) -> dict:
        payload = {
            'number':              number,
            'user_username':       name,
            'sip_secret':          sip_secret,
            'sip_enableRecording': record_calls,
            'fwd_ringlength':      fwd_ringlength,
        }
        if email:  payload['user_email']    = email
        if mobile: payload['mobile_number'] = mobile
    
        r = requests.post(f'{BASE_URL}/employees', headers=HEADERS, json=payload)
        result = r.json()
        if result.get('result'):
            print(f" Created: {number} ({name}), id={result['data']['id']}")
        else:
            print(f" Error: {result.get('messages', {}).get('error', [])}")
        return result
    
    
    # Minimal example (required fields only)
    create_employee(
        number='243',
        name='John Smith',
        sip_secret='Secure#Pass9201',
    )
    
    # Full example
    create_employee(
        number='244',
        name='Anna Johnson',
        sip_secret='Secure#Pass9202',
        email='anna@company.com',
        mobile='79001234567',
        record_calls=True,
        fwd_ringlength=30,
    )
    {
      "result": true,
      "data": {
        "number": "201",
        "user_username": "John Smith",
        "sip_secret": "Secure#Pass9201",
        "sip_dtmfmode": "auto",
        "sip_transport": "udp",
        "sip_enableRecording": true,
        "sip_networkfilterid": "none",
        "fwd_ringlength": 45,
        "id": "1",
        "extensions_length": 3
      },
      "messages": {"error": [], "info": [], "warning": []}
    }
     Created: 283 (John Smith), id=113
     Created: 284 (Anna Johnson), id=114
    
    Process finished with exit code 0
    def list_employees(search: str = '', limit: int = 100, offset: int = 0) -> list:
        params = {'limit': limit, 'offset': offset}
        if search: params['search'] = search
        r = requests.get(f'{BASE_URL}/employees', headers=HEADERS, params=params)
        return r.json().get('data', {}).get('data', [])
    
    for emp in list_employees():
        print(f"  {emp.get('number'):>6}  {emp.get('user_username', '')}")
         202  Brown Brandon
         203  Collins Melanie
         201  Smith James
         283  John Smith
         284  Anna Johnson
    
    Process finished with exit code 0
    import time
    
    employees = [
        {'number': '291', 'name': 'John Smith',   'secret': 'Pass#9201'},
        {'number': '292', 'name': 'Anna Johnson', 'secret': 'Pass#9202'},
        {'number': '293', 'name': 'Peter Brown',  'secret': 'Pass#9203'},
    ]
    
    created, failed = [], []
    for emp in employees:
        r = requests.post(
            f'{BASE_URL}/employees',
            headers=HEADERS,
            json={
                'number':        emp['number'],
                'user_username': emp['name'],
                'sip_secret':    emp['secret'],
            }
        )
        result = r.json()
        if result.get('result'):
            created.append(emp['number'])
            print(f" {emp['number']} {emp['name']}")
        else:
            failed.append(emp['number'])
            print(f" {emp['number']}: {result.get('messages', {}).get('error', [])}")
        time.sleep(0.2)  # small pause between requests
    
    print(f'Created: {len(created)}, Errors: {len(failed)}')
     291 John Smith
     292 Anna Johnson
     293 Peter Brown
    Created: 3, Errors: 0
    
    Process finished with exit code 0
    def create_sip_provider(
        description: str,
        host: str,
        username: str = '',
        password: str = '',
        registration_type: str = 'outbound',
        qualify: bool = True,
    ) -> dict:
        payload = {
            'description': description,
            'host':        host,
        }
        if username:          payload['username']          = username
        if password:          payload['secret']            = password
        if registration_type: payload['registration_type'] = registration_type
        if not qualify:       payload['qualify']           = qualify
    
        r = requests.post(f'{BASE_URL}/sip-providers', headers=HEADERS, json=payload)
        result = r.json()
        if result.get('result'):
            print(f" Provider created: {description}")
        else:
            print(f" Error: {result.get('messages', {}).get('error', [])}")
        return result
    
    
    create_sip_provider(
        description='Zadarma',
        host='sip.zadarma.com',
        username='316811',
        password='mysecretpass',
    )
     Provider created: Zadarma
    
    Process finished with exit code 0
    def list_providers() -> list:
        r = requests.get(f'{BASE_URL}/sip-providers', headers=HEADERS)
        return r.json().get('data', [])
    
    for prov in list_providers():
        print(f"  {prov.get('id'):<20} {prov.get('description', '')}  [{prov.get('type', '')}]")
      SIP-TRUNK-34F7CAFE     [SIP]
      SIP-TRUNK-7B5977ED     [SIP]
    
    Process finished with exit code 0
    from datetime import datetime, timedelta
    
    def get_cdr(
        offset: int = 0,
        limit: int = 20,
        date_from: str = None,
        date_to: str = None,
        src_num: str = None,
        dst_num: str = None,
        disposition: str = None,
    ) -> list:
        params = {'offset': offset, 'limit': min(limit, 100)}
        if date_from:   params['dateFrom'] = date_from
        if date_to:     params['dateTo']   = date_to
        if src_num:     params['src_num']  = src_num
        if dst_num:     params['dst_num']  = dst_num
        if disposition: params['disposition'] = disposition
    
        r = requests.get(f'{BASE_URL}/cdr', headers=HEADERS, params=params)
        return r.json().get('data', {}).get('records', [])
    
    
    now  = datetime.now()
    then = now - timedelta(days=7)
    
    for row in get_cdr(
        date_from=then.strftime('%Y-%m-%dT%H:%M:%S'),
        date_to=now.strftime('%Y-%m-%dT%H:%M:%S'),
    ):
        print(
            str(row.get('start', ''))[:16],
            row.get('src_num', ''), '→', row.get('dst_num', ''),
            row.get('disposition', ''), row.get('totalBillsec', 0), 's'
        )
    2026-03-17 13:30 252 → 202 ANSWERED 48 s
    2026-03-17 13:30 243 → 252 BUSY 0 s
    2026-03-17 13:30 243 → 89161111111 CHANUNAVAIL 0 s
    2026-03-17 13:29 202 → 243 NOANSWER 0 s
    2026-03-17 13:29 202 → 202 ANSWERED 2 s
    2026-03-17 13:29 202 → 243 NOANSWER 0 s
    2026-03-17 13:29 202 → 10003246 NOANSWER 0 s
    2026-03-17 13:28 202 → 243 NOANSWER 0 s
    
    Process finished with exit code 0
    def cdr_stats(days: int = 1) -> dict:
        now  = datetime.now()
        then = now - timedelta(days=days)
        records = get_cdr(
            date_from=then.strftime('%Y-%m-%dT%H:%M:%S'),
            date_to=now.strftime('%Y-%m-%dT%H:%M:%S'),
            limit=100
        )
        answered  = [r for r in records if r.get('disposition') == 'ANSWERED']
        missed = [r for r in records if r.get('disposition') in ('NO ANSWER', 'NOANSWER')]
        total_dur = sum(r.get('totalBillsec', 0) for r in answered)
        return {
            'total':    len(records),
            'answered': len(answered),
            'missed':   len(missed),
            'avg_sec':  total_dur // len(answered) if answered else 0,
        }
    
    stats = cdr_stats(days=7)
    print(f"Calls over 7 days: {stats['total']}")
    print(f"Answered:          {stats['answered']}")
    print(f"Missed:            {stats['missed']}")
    print(f"Avg. duration:     {stats['avg_sec']}s")
    Calls over 7 days: 13
    Answered:          2
    Missed:            5
    Avg. duration:     25s
    
    Process finished with exit code 0
    from datetime import datetime
    
    def show_employees():
        r = requests.get(f'{BASE_URL}/sip:getStatuses', headers=HEADERS)
        peers = r.json().get('data', {})
        for number, info in peers.items():
            icon = '🟢' if info.get('status') == 'Available' else '🔴'
            print(f"  {icon}  {number:>6}  {info.get('callerid', '')}  [{info.get('status', '')}]")
    
    
    def show_providers():
        r = requests.get(f'{BASE_URL}/sip-providers:getStatuses', headers=HEADERS)
        providers = r.json().get('data', {}).get('sip', {})
        for prov_id, info in providers.items():
            icon = '🟢' if info.get('state') == 'registered' else '🔴'
            print(f"  {icon}  {info.get('description', prov_id):>20}  {info.get('username', '')}@{info.get('host', '')}  [{info.get('state', '')}]")
    
    
    if __name__ == '__main__':
        print(f'MikoPBX Monitor [{datetime.now().strftime("%Y-%m-%d %H:%M:%S")}]')
        print('\n── Employees ───────────────────────────────')
        show_employees()
        print('\n── Providers ───────────────────────────────')
        show_providers()
    MikoPBX Monitor [2026-03-17 16:47:35]
    
    ── Employees ───────────────────────────────
      🔴     201  Smith James  [Unavailable]
      🟢     202  Brown Brandon  [Available]
      🔴     203  Collins Melanie  [Unavailable]
      🔴     243  John Smith  [Unavailable]
      🟢     244  Anna Johnson  [Available]
      🔴     251  John Smith  [Unavailable]
      🟢     252  Anna Johnson  [Available]
      🔴     253  Peter Brown  [Unavailable]
    
    ── Providers ───────────────────────────────
      🔴         Demo provider  SIP-PROVIDER-122642725b9265fd7151c@demo.askozia.ru  [rejected]
      🟢               Zadarma  316811@sip.zadarma.com  [registered]
    
    Process finished with exit code 0
    def get_active_calls() -> list:
        r = requests.get(f'{BASE_URL}/pbx-status:getActiveCalls', headers=HEADERS)
        return r.json().get('data', [])
    
    calls = get_active_calls()
    
    print(f'Active calls: {len(calls)}')
    for call in calls:
        print(f"  {call.get('src_num', '?')} → {call.get('dst_num', '?')}  [{call.get('src_name', '')} → {call.get('dst_name', '')}]")
    Active calls: 1
      243 → 252  [John Smith → Anna Johnson]
    
    Process finished with exit code 0
    import urllib3
    urllib3.disable_warnings()

    Interactive Documentation and Endpoint List

    Description of documentation and endpoint table for working with REST API in MikoPBX

    MikoPBX REST API follows the OpenAPI standard. The interactive documentation is built directly into the PBX and always contains the current list of endpoints, parameters, and schemas for your version of the system.

    How to Open the Documentation

    1. Go to "System" → "API Keys".

    Section "System" -> "API Keys" in MikoPBX web-interface
    1. Click the "API Documentation" button.

    The documentation is built on the OpenAPI standard and provides a complete description of all MikoPBX REST API endpoints.

    Endpoint navigation — in the left panel, all endpoints are grouped by section.

    For each endpoint, a brief description is shown along with the request method (GET, POST, PUT, PATCH, DELETE) and the endpoint with the PBX address substituted. All available request parameters are displayed below.

    Code examples — ready-made request examples in different languages are available for each endpoint. The switcher is located below the parameters panel — Shell / cURL is shown by default, other languages are also available (click the language name to switch — in this guide, Python 3).

    A server response example is shown below.

    Online request execution — the documentation allows you to send real requests directly from the browser and receive responses from your PBX. The server is determined automatically from the current page address.

    At the bottom of the page you will find possible response codes with brief explanations, as well as all body parameters for the selected response.

    Base prefix for all paths: /pbxcore/api/v3

    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description

    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description

    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description

    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description

    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description
    Method
    Path
    Description

    • — exports ban decisions for external bouncers (CrowdSec-compatible). Available starting from MikoPBX 2026.1.76.

    GET

    /employees/{id}

    Get employee by ID

    PUT

    /employees/{id}

    Update employee

    PATCH

    /employees/{id}

    Partially update employee

    DELETE

    /employees/{id}

    Delete employee

    GET

    /employees:getDefault

    Get default values

    POST

    /employees:batchCreate

    Batch create employees

    POST

    /employees:batchDelete

    Batch delete employees

    POST

    /employees:import

    Import employees (preview)

    POST

    /employees:confirmImport

    Confirm import

    POST

    /employees:export

    Export employees

    POST

    /employees:exportTemplate

    Export template

    POST

    /extensions:available

    Check number availability

    GET

    /extensions:getForSelect

    Get extensions for dropdown list

    POST

    /extensions/{id}:getPhoneRepresent

    Get phone representation

    POST

    /extensions:getPhonesRepresent

    Get phones representation

    GET

    /sip-providers/{id}

    Get SIP provider by ID

    PUT

    /sip-providers/{id}

    Update SIP provider

    PATCH

    /sip-providers/{id}

    Partially update SIP provider

    DELETE

    /sip-providers/{id}

    Delete SIP provider

    GET

    /sip-providers/{id}:copy

    Copy SIP provider

    GET

    /sip-providers:getDefault

    Get SIP provider template

    GET

    /iax-providers/{id}

    Get IAX provider by ID

    PUT

    /iax-providers/{id}

    Update IAX provider

    PATCH

    /iax-providers/{id}

    Partially update IAX provider

    DELETE

    /iax-providers/{id}

    Delete IAX provider

    GET

    /iax-providers/{id}:copy

    Copy IAX provider

    GET

    /iax-providers:getDefault

    Get IAX provider template

    GET

    /providers:getForSelect

    Get providers for dropdown list

    GET

    /call-queues/{id}

    Get queue by ID

    PUT

    /call-queues/{id}

    Update queue

    PATCH

    /call-queues/{id}

    Partially update queue

    DELETE

    /call-queues/{id}

    Delete queue

    GET

    /call-queues/{id}:copy

    Copy queue

    GET

    /call-queues:getDefault

    Get default values

    GET

    /ivr-menu/{id}

    Get IVR menu by ID

    PUT

    /ivr-menu/{id}

    Update IVR menu

    PATCH

    /ivr-menu/{id}

    Partially update IVR menu

    DELETE

    /ivr-menu/{id}

    Delete IVR menu

    GET

    /ivr-menu/{id}:copy

    Copy IVR menu

    GET

    /ivr-menu:getDefault

    Get default values

    GET

    /incoming-routes/{id}

    Get incoming route by ID

    PUT

    /incoming-routes/{id}

    Update incoming route

    PATCH

    /incoming-routes/{id}

    Partially update incoming route

    DELETE

    /incoming-routes/{id}

    Delete incoming route

    POST

    /incoming-routes/{id}:copy

    Copy incoming route

    GET

    /incoming-routes:getDefault

    Get default values

    GET

    /incoming-routes:getDefaultRoute

    Get default route

    POST

    /incoming-routes:changePriority

    Change route priorities

    GET

    /outbound-routes/{id}

    Get outbound route by ID

    PUT

    /outbound-routes/{id}

    Update outbound route

    PATCH

    /outbound-routes/{id}

    Partially update outbound route

    DELETE

    /outbound-routes/{id}

    Delete outbound route

    GET

    /outbound-routes/{id}:copy

    Copy outbound route

    GET

    /outbound-routes:getDefault

    Get default values

    POST

    /outbound-routes:changePriority

    Change route priorities

    GET

    /off-work-times/{id}

    Get time condition by ID

    PUT

    /off-work-times/{id}

    Update time condition

    PATCH

    /off-work-times/{id}

    Partially update time condition

    DELETE

    /off-work-times/{id}

    Delete time condition

    GET

    /off-work-times/{id}:copy

    Copy time condition

    GET

    /off-work-times:getDefault

    Get default values

    POST

    /off-work-times:changePriorities

    Change condition priorities

    GET

    /conference-rooms/{id}

    Get conference room by ID

    PUT

    /conference-rooms/{id}

    Update conference room

    PATCH

    /conference-rooms/{id}

    Partially update conference room

    DELETE

    /conference-rooms/{id}

    Delete conference room

    GET

    /conference-rooms:getDefault

    Get conference room template

    GET

    /dialplan-applications/{id}

    Get dialplan application by ID

    PUT

    /dialplan-applications/{id}

    Update dialplan application

    PATCH

    /dialplan-applications/{id}

    Partially update dialplan application

    DELETE

    /dialplan-applications/{id}

    Delete dialplan application

    GET

    /dialplan-applications/{id}:copy

    Copy dialplan application

    GET

    /dialplan-applications:getDefault

    Get dialplan application template

    GET

    /sound-files/{id}

    Get sound file by ID

    PUT

    /sound-files/{id}

    Update sound file

    PATCH

    /sound-files/{id}

    Partially update sound file

    DELETE

    /sound-files/{id}

    Delete sound file

    GET

    /sound-files:getDefault

    Get default values

    GET

    /sound-files:getForSelect

    Get for dropdown list

    GET

    /sound-files:playback

    Play back sound file

    POST

    /sound-files:uploadFile

    Upload sound file

    POST

    /sound-files:convertAudioFile

    Convert audio file

    GET

    /custom-files/{id}

    Get custom file by ID

    PUT

    /custom-files/{id}

    Update custom file

    PATCH

    /custom-files/{id}

    Partially update custom file

    DELETE

    /custom-files/{id}

    Delete custom file

    GET

    /custom-files:getDefault

    Get default values

    GET

    /sip:getRegistry

    Get registration status (legacy)

    POST

    /sip:processAuthFailures

    Process authentication failures

    GET

    /sip/{id}:getStatus

    Get SIP device status

    GET

    /sip/{id}:getStats

    Get SIP device statistics

    GET

    /sip/{id}:getHistory

    Get connection history

    GET

    /sip/{id}:getSecret

    Get SIP password

    GET

    /sip/{id}:getAuthFailureStats

    Get authentication failure statistics

    POST

    /sip/{id}:clearAuthFailureStats

    Clear failure statistics

    POST

    /sip/{id}:forceCheck

    Force status check

    GET

    /sip-providers/{id}:getHistory

    Get connection history

    GET

    /sip-providers/{id}:getStats

    Get SIP provider statistics

    POST

    /sip-providers/{id}:forceCheck

    Force registration check

    POST

    /sip-providers/{id}:updateStatus

    Update provider status

    GET

    /iax-providers/{id}:getHistory

    Get connection history

    GET

    /iax-providers/{id}:getStats

    Get IAX provider statistics

    POST

    /iax-providers/{id}:forceCheck

    Force registration check

    POST

    /iax-providers/{id}:updateStatus

    Update provider status

    GET

    /iax:getRegistry

    Get IAX provider registration status

    GET

    /providers/{id}:getHistory

    Get provider history

    GET

    /providers/{id}:getStats

    Get provider statistics

    POST

    /providers/{id}:updateStatus

    Update provider status

    DELETE

    /cdr/{id}

    Delete CDR record

    GET

    /cdr:getMetadata

    Get CDR metadata

    GET

    /cdr:playback

    Play back call recording

    GET

    /cdr:download

    Download call recording

    POST

    /auth:logout

    Log out of the system

    GET

    /api-keys/{id}

    Get API key by ID

    PUT

    /api-keys/{id}

    Update API key

    PATCH

    /api-keys/{id}

    Partially update API key

    DELETE

    /api-keys/{id}

    Delete API key

    GET

    /api-keys:getDefault

    Get default values

    POST

    /api-keys:generateKey

    Generate a new key

    GET

    /asterisk-managers/{id}

    Get AMI user by ID

    PUT

    /asterisk-managers/{id}

    Update AMI user

    PATCH

    /asterisk-managers/{id}

    Partially update AMI user

    DELETE

    /asterisk-managers/{id}

    Delete AMI user

    GET

    /asterisk-managers/{id}:copy

    Copy AMI user

    GET

    /asterisk-managers:getDefault

    Get default values

    GET

    /asterisk-rest-users/{id}

    Get ARI user by ID

    PUT

    /asterisk-rest-users/{id}

    Update ARI user

    PATCH

    /asterisk-rest-users/{id}

    Partially update ARI user

    DELETE

    /asterisk-rest-users/{id}

    Delete ARI user

    GET

    /asterisk-rest-users:getDefault

    Get default values

    GET

    /passkeys/{id}

    Get passkey by ID

    PATCH

    /passkeys/{id}

    Update passkey

    DELETE

    /passkeys/{id}

    Delete passkey

    GET

    /passkeys:checkAvailability

    Check passkey availability

    GET

    /passkeys:authenticationStart

    Start passkey authentication

    POST

    /passkeys:authenticationFinish

    Finish passkey authentication

    POST

    /passkeys:registrationStart

    Start passkey registration

    POST

    /passkeys:registrationFinish

    Finish passkey registration

    POST

    /passwords:checkDictionary

    Check password against dictionary

    POST

    /passwords:batchValidate

    Batch validate passwords

    POST

    /passwords:batchCheckDictionary

    Batch dictionary check

    GET

    /network-filters:getForSelect

    Get filters for dropdown list

    GET

    /system:datetime

    Get system time

    GET

    /system:getAvailableLanguages

    Get available languages

    GET

    /system:checkForUpdates

    Get detailed update information

    GET

    /system:checkIfNewReleaseAvailable

    Quick check for new version availability

    GET

    /system:getDeleteStatistics

    Get deletion statistics

    POST

    /system:reboot

    Reboot the system

    POST

    /system:shutdown

    Shut down the system

    POST

    /system:upgrade

    Upgrade the system

    POST

    /system:restoreDefault

    Restore default settings

    POST

    /system:changeLanguage

    Change system language

    POST

    /system:convertAudioFile

    Convert audio file

    POST

    /system:executeBashCommand

    Execute bash command

    POST

    /system:executeSqlRequest

    Execute SQL query

    POST

    /system:updateMailSettings

    Update mail settings

    PATCH

    /general-settings

    Partially update general settings

    GET

    /general-settings/{id}

    Get specific setting

    GET

    /general-settings:getDefault

    Get default values

    POST

    /general-settings:updateCodecs

    Update codec settings

    DELETE

    /network/{id}

    Delete network interface

    GET

    /network:getConfig

    Get full network configuration

    GET

    /network:getNatSettings

    Get NAT settings

    POST

    /network:saveConfig

    Save network configuration

    GET

    /firewall/{id}

    Get firewall rule by ID

    PUT

    /firewall/{id}

    Update firewall rule

    PATCH

    /firewall/{id}

    Partially update firewall rule

    DELETE

    /firewall/{id}

    Delete firewall rule

    GET

    /firewall:getDefault

    Get default values

    GET

    /firewall:getBannedIps

    Get list of banned IPs

    POST

    /firewall:unbanIp

    Unban IP address

    POST

    /firewall:enable

    Enable firewall

    POST

    /firewall:disable

    Disable firewall

    PATCH

    /fail2ban

    Partially update Fail2Ban settings

    PATCH

    /mail-settings

    Partially update mail settings

    DELETE

    /mail-settings

    Reset mail settings

    GET

    /mail-settings:getDefault

    Get default values

    GET

    /mail-settings:getDiagnostics

    Get mail settings diagnostics

    GET

    /mail-settings:getOAuth2Url

    Get OAuth2 authorization URL

    POST

    /mail-settings:refreshToken

    Refresh OAuth2 token

    POST

    /mail-settings:testConnection

    Test SMTP server connection

    POST

    /mail-settings:sendTestEmail

    Send test email

    POST

    /storage:mount

    Mount storage device

    POST

    /storage:umount

    Unmount storage device

    POST

    /storage:mkfs

    Format storage device

    POST

    /storage:statusMkfs

    Get formatting status

    PATCH

    /s3-storage

    Partially update S3 configuration

    GET

    /s3-storage:stats

    Get S3 synchronization statistics

    GET

    /s3-storage:testConnection

    Test S3 connection

    GET

    /modules/{id}

    Get module by ID

    PUT

    /modules/{id}

    Update module

    PATCH

    /modules/{id}

    Partially update module

    DELETE

    /modules/{id}

    Delete module

    GET

    /modules/{id}:getModuleInfo

    Get module information

    GET

    /modules/{id}:getModuleLink

    Get module download link

    GET

    /modules/{id}:getDownloadStatus

    Get download status

    POST

    /modules/{id}:startDownload

    Start module download

    POST

    /modules/{id}:installFromRepo

    Install module from repository

    POST

    /modules:installFromPackage

    Install module from package

    POST

    /modules:getMetadataFromPackage

    Get metadata from package

    POST

    /modules/{id}:enable

    Enable module

    POST

    /modules/{id}:disable

    Disable module

    POST

    /modules/{id}:uninstall

    Uninstall module

    POST

    /modules:updateAll

    Update all modules

    GET

    /modules:getAvailableModules

    Get available modules

    GET

    /modules:getInstallationStatus

    Get installation status

    GET

    /modules:getDefault

    Get default module settings

    GET

    /license:resetKey

    Reset license key

    GET

    /license:sendPBXMetrics

    Send PBX metrics

    POST

    /license:captureFeatureForProductId

    Capture feature for product

    POST

    /license:processUserRequest

    Process user request

    DELETE

    /files/{id}

    Delete file

    POST

    /files:upload

    Upload file (chunked)

    GET

    /files:uploadStatus

    Check upload status

    POST

    /files:downloadFirmware

    Download firmware

    GET

    /files:firmwareStatus

    Check firmware download status

    GET

    /sysinfo:getHypervisorInfo

    Get hypervisor information

    GET

    /sysinfo:getDMIInfo

    Get DMI information

    POST

    /syslog:getLogTimeRange

    Get log time range

    POST

    /syslog:eraseFile

    Clear log file

    POST

    /syslog:startCapture

    Start packet capture

    POST

    /syslog:stopCapture

    Stop packet capture

    POST

    /syslog:prepareArchive

    Prepare log archive

    POST

    /syslog:downloadArchive

    Download log archive

    POST

    /syslog:downloadLogFile

    Download log file

    GET

    /openapi:getDetailedPermissions

    Get detailed permissions list

    GET

    /openapi:getSimplifiedPermissions

    Get simplified permissions list

    GET

    /openapi:getValidationSchemas

    Get validation schemas

    POST

    /openapi:clearCache

    Clear OpenAPI cache

    GET

    /employees

    Get list of employees

    POST

    /employees

    Create a new employee

    GET

    /extensions

    Get list of extensions

    GET

    /extensions/{id}

    Get extension by ID

    GET

    /sip-providers

    Get list of SIP providers

    POST

    /sip-providers

    Create SIP provider

    GET

    /iax-providers

    Get list of IAX providers

    POST

    /iax-providers

    Create IAX provider

    GET

    /providers

    Get list of all providers

    GET

    /providers/{id}

    Get provider by ID

    GET

    /call-queues

    Get list of queues

    POST

    /call-queues

    Create a new queue

    GET

    /ivr-menu

    Get list of IVR menus

    POST

    /ivr-menu

    Create a new IVR menu

    GET

    /incoming-routes

    Get list of incoming routes

    POST

    /incoming-routes

    Create incoming route

    GET

    /outbound-routes

    Get list of outbound routes

    POST

    /outbound-routes

    Create outbound route

    GET

    /off-work-times

    Get list of time conditions

    POST

    /off-work-times

    Create time condition

    GET

    /conference-rooms

    Get list of conference rooms

    POST

    /conference-rooms

    Create conference room

    GET

    /dialplan-applications

    Get list of dialplan applications

    POST

    /dialplan-applications

    Create dialplan application

    GET

    /sound-files

    Get list of sound files

    POST

    /sound-files

    Create sound file

    GET

    /custom-files

    Get list of custom files

    POST

    /custom-files

    Create new custom file

    GET

    /pbx-status:getActiveCalls

    Get active calls

    GET

    /pbx-status:getActiveChannels

    Get active channels

    GET

    /sip:getStatuses

    Get statuses of all SIP devices

    GET

    /sip:getPeersStatuses

    Get SIP peer statuses (legacy)

    GET

    /sip-providers:getStatuses

    Get statuses of all SIP providers

    GET

    /sip-providers/{id}:getStatus

    Get SIP provider status

    GET

    /iax-providers:getStatuses

    Get statuses of all IAX providers

    GET

    /iax-providers/{id}:getStatus

    Get IAX provider status

    GET

    /providers:getStatuses

    Get statuses of all providers

    GET

    /providers/{id}:getStatus

    Get provider status

    GET

    /cdr

    Get list of CDR records

    GET

    /cdr/{id}

    Get CDR record by ID

    GET

    /advice:getList

    Get list of system notifications

    GET

    /advice:refresh

    Refresh notification cache

    POST

    /auth:login

    Log in to the system

    POST

    /auth:refresh

    Refresh access token

    GET

    /api-keys

    Get list of API keys

    POST

    /api-keys

    Create a new API key

    GET

    /asterisk-managers

    Get list of AMI users

    POST

    /asterisk-managers

    Create a new AMI user

    GET

    /asterisk-rest-users

    Get list of ARI users

    POST

    /asterisk-rest-users

    Create a new ARI user

    GET

    /passkeys

    Get list of passkeys

    POST

    /passkeys

    Create a new passkey

    GET

    /passwords:generate

    Generate password

    POST

    /passwords:validate

    Validate password strength

    GET

    /users:available

    Check email availability

    GET

    /network-filters

    Get list of network filters

    GET

    /network-filters/{id}

    Get network filter by ID

    GET

    /system:ping

    Check system availability

    GET

    /system:checkAuth

    Check authentication

    GET

    /general-settings

    Get general settings

    PUT

    /general-settings

    Update general settings

    GET

    /network

    Get list of network interfaces

    GET

    /network/{id}

    Get network interface by ID

    GET

    /firewall

    Get list of firewall rules

    POST

    /firewall

    Create firewall rule

    GET

    /fail2ban

    Get Fail2Ban settings

    PUT

    /fail2ban

    Update Fail2Ban settings

    GET

    /time-settings:getAvailableTimezones

    Get list of available timezones

    GET

    /mail-settings

    Get mail settings

    PUT

    /mail-settings

    Update mail settings

    GET

    /storage:usage

    Get storage usage statistics

    GET

    /storage:list

    Get list of available storage devices

    GET

    /s3-storage

    Get S3 storage configuration

    PUT

    /s3-storage

    Update S3 storage configuration

    GET

    /modules

    Get list of modules

    POST

    /modules

    Create module

    GET

    /license:getLicenseInfo

    Get license information

    GET

    /license:ping

    Check license server connection

    GET

    /files/{id}

    Get file contents

    PUT

    /files/{id}

    Upload/update file

    GET

    /sysinfo:getInfo

    Get system information

    GET

    /sysinfo:getExternalIpInfo

    Get external IP address

    GET

    /syslog:getLogsList

    Get list of log files

    POST

    /syslog:getLogFromFile

    Get log file contents

    GET

    /openapi:getSpecification

    Get OpenAPI specification

    GET

    /openapi:getAclRules

    Get API ACL rules

    GET

    /search:getSearchItems

    Global search

    GET

    /wiki-links:getLink

    Get documentation link

    POST

    /user-page-tracker:pageView

    Track page view

    POST

    /user-page-tracker:pageLeave

    Track page leave

    Interactive Documentation Features

    Endpoint List

    Telephony and Routing

    Employees

    Extensions

    SIP Providers

    IAX Providers

    Providers (combined SIP + IAX list)

    Call Queues

    IVR Menu

    Incoming Routing

    Outbound Routing

    Off-Work Time

    Conference Rooms

    Dialplan Applications

    Sound Files

    System File Customization

    Monitoring and Statistics

    PBX Status

    SIP Devices

    SIP Providers (Monitoring)

    IAX Providers (Monitoring)

    Providers (Monitoring)

    Call Records (CDR)

    Advice and Recommendations

    Authentication and Access

    Authentication

    API Keys

    AMI Users

    ARI Users

    Passkeys

    Passwords

    Users

    Network Filters

    System Settings

    System Operations

    General Settings

    Network Interfaces and Routing

    Firewall

    Intrusion Prevention (Fail2Ban)

    Time Settings

    Mail Settings

    Storage

    S3 Cloud Storage

    Modules

    Licensing

    File Operations

    Diagnostics

    System Information

    System Logs

    OpenAPI Documentation

    Search

    Documentation Links

    User Activity Tracking

    Technical endpoints

    The firewall-export endpoint
    "API Documentation" button in the API Keys section
    Navigation menu
    Endpoint description with request parameters and body example
    Request example in Python and server response example
    Executing requests from the API documentation
    Response codes and response body structure