✨(sip) add a sip software simulator to test unified encrypted flow

docker/janus/conf/janus.jcfg

@@ -0,0 +1,42 @@
+// Minimal Janus config for browser-↔-SIP demo. Trimmed from the upstream
+// sample to the bits we actually need.
+general: {
+    configs_folder = "/usr/local/etc/janus"
+    plugins_folder = "/usr/local/lib/janus/plugins"
+    transports_folder = "/usr/local/lib/janus/transports"
+    events_folder = "/usr/local/lib/janus/events"
+    log_to_stdout = true
+    debug_level = 4
+    server_name = "meet-sip-demo"
+}
+
+media: {
+    // Janus ↔ Browser media (WebRTC over TCP — Lima only forwards TCP).
+    rtp_port_range = "10100-10120"
+    ipv6 = false
+}
+
+nat: {
+    // The whole reason this works without vmnet — Janus offers TCP ICE
+    // candidates the Mac browser can actually connect to.
+    ice_tcp = true
+    // libnice quirk: ICE-TCP needs ICE Lite mode on the server side or
+    // the connectivity check state machine deadlocks. Janus warns about
+    // this at startup if Lite is off while TCP is on.
+    ice_lite = true
+    // Janus advertises this IP in ICE candidates. From the Mac browser's
+    // perspective, the Janus daemon lives at 127.0.0.1:<port> (Lima
+    // forwards Mac:127.0.0.1:<port> → VM → docker port-map → container).
+    nat_1_1_mapping = "127.0.0.1"
+    keep_private_host = true
+}
+
+plugins: {
+    // Only keep the SIP plugin. Everything else trimmed for boot time.
+    disable = "libjanus_audiobridge.so,libjanus_videoroom.so,libjanus_streaming.so,libjanus_textroom.so,libjanus_recordplay.so,libjanus_voicemail.so,libjanus_echotest.so,libjanus_videocall.so,libjanus_nosip.so,libjanus_duktape.so,libjanus_lua.so"
+}
+
+transports: {
+    // Only HTTP. WS is overkill for the demo and adds another port.
+    disable = "libjanus_websockets.so,libjanus_mqtt.so,libjanus_nanomsg.so,libjanus_rabbitmq.so,libjanus_pfunix.so"
+}

docker/janus/conf/janus.plugin.sip.jcfg

@@ -0,0 +1,8 @@
+// SIP plugin defaults. RTP range for the SIP leg (Janus ↔ livekit/sip)
+// is kept separate from WebRTC range — both legs are inside the docker
+// bridge network, so any UDP range works.
+general: {
+    local_ip = "0.0.0.0"
+    rtp_port_range = "20000-20100"
+    events = true
+}

docker/janus/conf/janus.transport.http.jcfg

@@ -0,0 +1,24 @@
+// HTTP transport: bind 0.0.0.0:8088 inside the container, served to the
+// browser through the nginx sidecar that also hosts the demo HTML.
+general: {
+    json = "indented"
+    base_path = "/janus"
+    http = true
+    port = 8088
+    https = false
+    mhd_connection_limit = 1020
+}
+
+admin: {
+    admin_base_path = "/admin"
+    admin_http = false
+    admin_https = false
+}
+
+certificates: {
+}
+
+cors: {
+    // Same-origin via nginx proxy; demo page and API share a host.
+    # allow_origin = "*"
+}

docker/janus/conf/nginx.conf

@@ -0,0 +1,33 @@
+server {
+    listen 80;
+    server_name _;
+
+    # Docker's embedded DNS (127.0.0.11). Without this, nginx resolves
+    # upstreams once at startup and breaks the moment a peer container is
+    # recreated with a new bridge IP. The `valid=10s` plus a variable in
+    # proxy_pass forces per-request re-resolution.
+    resolver 127.0.0.11 valid=10s ipv6=off;
+
+    # Serve the Janus demo HTML/JS extracted from the canyan image.
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Janus HTTP API — same origin as the demo pages so the default
+    # settings.js URL ("http://<host>:8088/janus") just works. Regex so
+    # /janus and /janus/<session>/... proxy, but /janus.js still hits
+    # the static file root.
+    location ~ ^/janus(/|$) {
+        # Variable upstream + the resolver above = re-DNS on each request.
+        # Plain `proxy_pass http://sip-web-janus:8088` would cache the IP
+        # for the lifetime of the worker process.
+        set $janus_upstream sip-web-janus;
+        proxy_pass http://$janus_upstream:8088;
+        proxy_http_version 1.1;
+        proxy_buffering off;
+        proxy_read_timeout 120s;
+    }
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}