mc_: could you please tell me iff I could import 1 user from old cluster to the new cluster with clone_tool?

i don't know off-hand, haven't used clone_tool in ages

ok

mc_ another question - how did you guys deal with TLS for kamailio for different resellers? In tls.cfg you can only specify one certificate and if you have 2 resellers with different domains that could be an issue?

and the same with HAProxy...

Just found how to do that for kamailio TLS. But not for HAProxy web sockets

mentax: good question

i assume of we can't do multiple certs per kamailio, if an account needed a custom cert, we would stand up a kam instance specifically for them

but afaik we don't have a big need for this

but i don't have insight into that

mc_ for TLS you can specify multiple domains.

I just done that. But for a websocket browser most likely will complain about cert

mc_ I did it ;-)

do share :)

bind 0.0.0.0:7777 ssl crt /etc/SSL/domain1.com/HAProxy_cert_key.pem crt /etc/SSL/domain2.com/HAProxy_cert_key.pem

gotcha

Now there is another things - In kamailio local.conf you specify #!substdef "!MY_WEBSOCKET_DOMAIN!domain1!g"

how can I add second domain over there...

mayve mc_ know more about websockets )))

mentax: if the websocket domain is cancelled out, any host can connect to it

if defined, only connections from that host are allowed

mc_ so, if I will specify #!substdef "!MY_WEBSOCKET_DOMAIN!127.0.0.1!g" in this case only local server will be able to connect to the websocket?

and no one else?

I mean if I will point HAProxy to to 127.0.0.1:5555 it will work with any domains from kamailio side?

mentax: from what i recall, if you define the domain, only websocket connectiosn from domain will be accepted (meaning the web page will have to be loaded from that domain)

undefined means any web page can initiate a connection

kamailio won't check the Host header

but if I need to use 2 different domains what should be done in this case?

You have whole bunch of resellers with their own domains, how did it work them?

Should I use WEBSOCKET_NO_ORIGIN_RESTRICTION in this case?

comment out MY_WEBSOCKET_DOMAIN i think

and no_origin_restriction, sounds reasonable