Telephony · In development

Telephony on Asterisk– in development

We are building SecTepe.Comm telephony directly on Asterisk. The core and a service that links calls to your apps are built and tested. Neither is rolled out yet. You cannot make calls with it today, because extensions, trunks, queues and voicemail are still missing.

Built so far

Asterisk 22 core, built from source
ARI on loopback only
TLS and SRTP for desk phones
Click-to-dial
Screen pop for incoming calls
Call log with a tenant field

What comes next

These parts are planned in the migration plan. None of them is built yet, and we give no dates.

SIP trunks (planned)

Trunks will be set up as code. The plan expects only a few trunks that rarely change. Plain SIP will be used only where a trunk can do nothing else.

Voice menus (planned)

Voice menus will live in the dialplan as code. Where it pays off, the integration service will run them over ARI.

Queues and ring groups (planned)

Queues will be defined as code. While calls run, ARI will control them.

Call recording (off by default)

Recording will use what Asterisk has on board. It stays off by default. Where you turn it on, the design calls for an announcement and a retention period.

Voicemail (planned)

Voicemail will use Asterisk's own tools. Notices will go out by email through the existing gateway. You will find voicemail and the call list in the web interface.

Extension management (planned)

A new tool will create and change extensions and trunks. It takes over the job of the old FreePBX screens. It is the largest open task.

Technology & status

FreePBX has been removed from SecTepe.Comm. It never went live, and its base image had vanished from Docker Hub. The new setup runs Asterisk directly, next to our own integration service.

• Asterisk 22.11.0, pinned to one commit
• Debian trixie-slim base, pinned by digest
• Signed image (Cosign), SLSA provenance, Trivy scan
• SIP through PJSIP only, no chan_sip
• Codecs: G.722, A-law, μ-law
• TLS 1.2 or newer for SIP over TLS

Status today

CI builds the Asterisk image and runs a start-up test
The integration service builds; its logic is tested
The web interface can show the screen pop window
Not yet in any Compose file or Kubernetes manifest

How telephony works in practice

SecTepe.Comm builds its phone system directly on Asterisk. A separate integration service links calls to your other apps. Both parts are built and tested. They are not yet part of the standard Compose or Kubernetes setup.

How the parts fit together

Asterisk 22 handles SIP and voice. Its image is built from the source code, pinned to one commit, on a slim Debian base.
The dialplan hands every call to the integration service through the Asterisk REST Interface (ARI). The service then decides what happens next.
ARI listens only on the loopback address. It is never published through the reverse proxy.
Desk phones use SIP over TLS on port 5061 with encrypted voice (SRTP). Plain SIP on UDP 5060 is meant for trunks that need it and for devices in your own network.

What the integration service does

Click-to-dial: You click a number in the web interface. Your own phone rings first, then the other party.
Screen pop: On an incoming call, a small window shows the caller's number and, if known, the name. It goes only to the person whose phone rings. If an extension has no owner, no window appears.
Call log: The service keeps a call journal. Each entry has a tenant field. Asterisk will pass the tenant in a later stage.
On-call alerts: It can phone the on-call team when an alert fires. This is off by default. It only dials numbers on an approved list.

Security by design

Asterisk loads only the modules named in its config. Everything else stays off, including the old chan_sip driver. There is no anonymous endpoint. Unknown calls are hung up, not routed onward. Together this blocks the classic toll fraud pattern. The image holds no secrets. It will not start without an ARI password of at least 20 characters.

Common questions

Can I make calls with it today? No. Nothing is rolled out, and there are no extensions or trunks yet.

Is call recording on? Not by default. In Germany, recording needs consent from both sides. Where you turn it on, the design calls for an announcement and a retention period.

What about extensions, queues and voicemail? They are the next steps in the move away from FreePBX. Extensions and trunks will come from a new extension management tool. Until then, the system accepts no calls, because no one is registered.

Why was FreePBX dropped? FreePBX is a web interface on top of Asterisk. The interfaces for linking apps belong to Asterisk itself. Running Asterisk directly removes a whole layer of extra software.

Is high availability planned? Not in this plan. It would need a plan of its own.

Interested in telephony on Asterisk?

Telephony is not available yet. Tell us what you need. We will walk you through the plan and the current status.

How we work with you

We see every project as a long-term partnership, not a one-off delivery. Our approach has four clear phases. So you always know what happens next, who is in charge of what and which results to expect.

1. Free initial conversation

We learn about your starting point, your goals and your constraints. In 30 to 45 minutes we check whether our offer fits your situation. We outline possible paths and answer your questions, with no obligation.

2. Structured assessment

We record the current state: technical, organizational and regulatory. You get a prioritized assessment that names strengths, gaps and areas for action. It is the basis for a reliable offer.

3. Delivery with a dedicated lead

An experienced lead guides you through the delivery. You get clear milestones, transparent planning of effort and cost, and a weekly status. All results are documented and belong to you.

4. Continuous operations & review

After the project, we stay with you in operations. This includes managed services, regular reviews and tracking of open actions. We also reach out when new threats, new rules or technology changes come up.

Frequently asked questions about our services

These are the questions we hear most often in first conversations. For anything else, reach our team at hello@sectepe.de or by phone.

How do we start working with SecTepe?: Every project starts with a free initial conversation. You then get an offer with a clear scope, timeline and outcome. If you like, we start with a small pilot. That way you get to know how we work before the full project begins.
What company sizes and sectors do you support?: We work with small and mid-sized businesses, with corporate divisions and with operators of critical infrastructure (KRITIS). Our core sectors are manufacturing, trades, healthcare, financial services, energy and the public sector. Our focus is the mid-market in the DACH region.
Do you work on site, remotely or hybrid?: Both. Assessments, consulting and most managed services run remotely from our German data centers. For workshops, training and incident response on site, we mainly cover North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
Which standards and regulations do you cover?: We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
How do you protect the confidentiality of my data?: We secure confidentiality by contract and by technology. Before every project we sign a mutual non-disclosure agreement. We process data only in German data centers. Access runs through zero-trust rules with multi-factor authentication. All staff are bound to confidentiality by contract and under the GDPR.

Book a conversation