SIP VAULT Admin Guide

Customer Management

SIP VAULT uses a single server for all customers. Each customer gets: - A unique ID and auth token - A dedicated R2 bucket (sipvault-{customer_id}) - An agent deployed on their OpenSIPS server

Add a Customer

sipvault-admin add-customer --id acme

This single command: 1. Creates the R2 bucket sipvault-acme 2. Generates a random auth token 3. Adds the customer to /etc/sipvault/server.env 4. Prints the agent config to deploy on the customer's server

Output:

Created R2 bucket: sipvault-acme
Added customer 'acme' to server config

============================================================
Customer: acme
Bucket:   sipvault-acme
Token:    a3f8c91b2e4d7056f1c9e8a2b3d47890
============================================================

Restart the server:  systemctl restart sipvault-server

Agent config (/etc/sipvault/agent.conf):
────────────────────────────────────────────────────────────
[server]
address = sipvault.sippulse.com.br:9060
customer_id = acme
token = a3f8c91b2e4d7056f1c9e8a2b3d47890

[capture]
mode = pcap
sip_ports = 5060
interface = eth0
log_file = /var/log/opensips.log
rtp_port_min = 35000
rtp_port_max = 65000

[buffer]
path = /var/lib/sipvault/buffer.dat
max_size = 104857600

[logging]
level = info
────────────────────────────────────────────────────────────

Options:

sipvault-admin add-customer \
  --id acme \
  --token custom-secret \
  --server vault.example.com:9060 \
  --sip-ports 5060,5080 \
  --interface eth1 \
  --log-file /var/log/syslog

After adding, restart the server:

systemctl restart sipvault-server

List Customers

sipvault-admin list-customers

Remove a Customer

sipvault-admin remove-customer --id acme

This removes the customer from the config but does not delete the R2 bucket (data preservation). Delete the bucket manually in Cloudflare dashboard if needed.

CDR Integration

After adding a customer, update their CDR Viewer with the HMAC secret. See the CDR Integration Guide for PHP/Python/Node.js code.

Installation on Server

# Copy the admin script
cp sipvault_admin.py /opt/sipvault/api/
chmod +x /opt/sipvault/api/sipvault_admin.py

# Create an alias
echo 'alias sipvault-admin="/opt/sipvault/api/venv/bin/python3 /opt/sipvault/api/sipvault_admin.py"' >> /root/.bashrc
source /root/.bashrc

Agent Deployment on Customer Server

After add-customer, deploy the agent on the customer's OpenSIPS server:

# Copy the agent binary
scp bin/sipvault-agent-linux-amd64 root@CUSTOMER_IP:/usr/local/bin/sipvault-agent

# Copy the agent config (from the add-customer output)
# Paste into /etc/sipvault/agent.conf on the customer server

# Install and start
ssh root@CUSTOMER_IP "chmod +x /usr/local/bin/sipvault-agent && \
  mkdir -p /etc/sipvault /var/lib/sipvault && \
  systemctl daemon-reload && \
  systemctl enable sipvault-agent && \
  systemctl start sipvault-agent"

Capacity Planning

A single SIP VAULT server handles multiple customers. Sizing depends on total call volume across all customers:

Total CPS	Server Spec	Notes
< 50	2 vCPU, 2 GB	Sufficient for 5-10 small customers
50-250	4 vCPU, 8 GB	Typical deployment, 10-50 customers
250-1000	8 vCPU, 16 GB	Large deployment, dedicated server
> 1000	Multiple servers	Load balance by customer groups

Bottlenecks at scale: - R2 writes: ~2 files per completed call. At 1000 CPS = 2000 writes/sec - Memory: ~10 KB per active session. 60,000 concurrent calls = 600 MB - CPU: Quality processing ~5ms per call completion

For customers with > 250 CPS each, consider a dedicated server per customer.