<!-- Profile appropriate for exposing to the wider internet
     - exposes wss endpoint for WebRTC clients on tcp 443
     - exposes tls tcp endpoint for sip-bridge component in our new collab video experience on tcp 10092
     - external SIP and RTP ports are determined with STUN to bust through our NAT
-->
<profile name="websocket">
  <!-- http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files -->
  <!-- This profile is only for outbound registrations to providers -->
  <gateways>
  </gateways>

  <aliases>
  </aliases>

  <domains>
    <domain name="all" alias="false" parse="true"/>
  </domains>

  <settings>
    <!-- if we cant load the profile we just shutdown everything, this will help clients retry faster -->
    <param name="shutdown-on-fail" value="true"/>

    <!--Sets the dialplan path and context, basically default path and public context of it-->
    <param name="dialplan" value="XML"/>
    <param name="context" value="wss-dialplan"/>

    <!-- logging and debug information about this endpoint -->
    <param name="debug" value="0"/>
    <param name="sip-trace" value="yes"/>
    <param name="sip-capture" value="no"/>
    <!-- this is for codec negotiantion, it sets where the dynamic codecs start at -->

    <param name="dtmf-duration" value="2000"/>

    <param name="rtp-timer-name" value="soft"/>

    
    <param name="inbound-late-negotiation" value="true"/>

    <param name="local-network-acl" value="localnet.auto"/>
    <param name="apply-candidate-acl" value="localnet.auto"/>

    <!-- We dont want to manage or allow presence for any one on these servers -->
    <param name="manage-presence" value="false"/>

    <!-- Right now we need to foce PCMU until we get opus to scale better -->
    <param name="inbound-codec-negotiation" value="generous"/>
    <param name="codec-prefs" value="PCMU"/>

    <!--We do not allow authentication, have to set a nonce ttl anyway-->
    <param name="nonce-ttl" value="60"/>
    <param name="auth-calls" value="false"/>

    <!-- late-negotiation allows us to hit the dial plan scrips before we negitiate the codecs Which allows us to kill the connection before the UDP/RTP setup if there is no conference-->
    <param name="inbound-late-negotiation" value="true"/>
    <param name="inbound-zrtp-passthru" value="false"/> 

    <param name="rtp-ip" value="$${local_ip_v4}"/>
    <param name="sip-ip" value="$${local_ip_v4}"/>
    <param name="ext-rtp-ip" value="$${local_ip_v4}"/>
    <param name="ext-sip-ip" value="$${local_ip_v4}"/>

    <param name="rtp-timeout-sec" value="60"/>
    <param name="rtp-hold-timeout-sec" value="0"/>

    <!-- force DTLS-->
    <param name="require-secure-rtp" value="true"/>

    <!-- TLS: disabled by default, set to "true" to enable -->
    <param name="tls" value="true"/>
    <!-- Set to true to not bind on the normal sip-port but only on the TLS port -->
    <param name="tls-only" value="true"/>
    <param name="tls-bind-params" value="transport=tls"/>
    <param name="tls-cert-dir" value="/etc/freeswitch/tls"/>
    <param name="tls-passphrase" value=""/>
    <param name="tls-verify-date" value="true"/>
    <param name="tls-verify-policy" value="none"/>
    <!-- If the tls-verify-policy is set to subjects_all or subjects_in this sets which subjects are allowed, multiple subjects can be split with a '|' pipe -->
    <!-- TLS version ("sslv23" (default), "tlsv1"). NOTE: Phones may not work with TLSv1 -->
    <param name="tls-version" value="$${sip_tls_version}"/>
    <param name="wss-binding" value=":4443"/>
  </settings>
</profile>
