Kamailio¶

Status: Current | Last reviewed: 2026-06-04

SIP routing front-end. Holds the public TLS surface for SIP, normalizes incoming requests, and forwards to Asterisk over loopback.

Image¶

ghcr.io/kamailio/kamailio:5.8 plus a thin overlay for our config. See Dockerfile.

Ports¶

Port	Purpose
5060/UDP, 5060/TCP	SIP plain
5061/TCP	SIP TLS
5065/TCP	Genesys BYOC trunk

What it does¶

Terminates inbound TLS for SIP.
Routes to Asterisk on the same host for the agent legs.
Maintains per-trunk routing for BYOC vendors (Genesys, Twilio, custom).
Preserves the SIP Route header on outbound ACK so vendor-side stateless routing works.
Rejects unknown initial INVITEs before dispatcher fallback so scanner/noisy traffic cannot consume Asterisk RTP sockets.

Inbound INVITE policy¶

Kamailio only relays an initial INVITE to Asterisk when it matches an explicit call shape:

Asterisk-originated outbound call from loopback to a +E.164 user.
Genesys BYOC trunk domain, BYOC load-balancer domain, or ;tgrp= URI.
CCaaS transfer marker: pipeline-*, translation-assist*, X-Pipeline-Id, or User-to-User.
Amazon Connect / Chime Voice Connector marker: X-Amzn-SourceArn.

Sources outside sip_provider_endpoints.ip_cidrs are dropped by the request-route ACL without a SIP response. Sources that pass the ACL but do not match any known INVITE shape get 404 No route before dispatcher relay. Do not add a broad catch-all INVITE dispatcher fallback; add an explicit matcher for the new integration shape instead.

Per-city TLS¶

Each city dev environment has its own TLS cert. Mismatches between the cert, the trunk ACL, and the shared NAT egress IP 54.92.142.217 produce 404 Not Found from Genesys on transfer. See the city-env-genesys-byoc-wiring memory note.

Vanguard¶

Started by docker-compose.media.yml as tsf-local-kamailio. The container entrypoint copies /inject-configs/kamailio.cfg into /etc/kamailio/ and renders template variables, including POSTGRES_PASSWORD, before starting Kamailio.

Production¶

Helm chart at charts/kamailio. Runs hostNetwork: true on the media node pool.