Skip to main content

Mobile Application

The mobile operator application is publicly available in the Apple App Store and Google Play. To use it, provisioning (initial setup) is required, during which the profile of a specific UCS user is inserted into the application.

The application uses PUSH notifications, which are authorized using the certificates of the application developer. These certificates cannot be provided directly to UCS users; therefore, notifications are delivered through the INSOFT service.

Initial Setup​

  1. Contact INSOFT and request the credentials for the UCS service.
  2. Enter the received credentials in the administration interface under ☰ System → Parameters → UCS. These include: INSOFT services URL, INSOFT services Client ID, and INSOFT services PSK.
  3. Verify that the address for external access to UCS is correctly set: ☰ System → Parameters → Networking → System public hostname
  4. For the roles of users (☰ System → Roles) who will use the mobile application, configure the following parameters:
    • DISA number for outgoing calls – the UCS phone number through which the application makes outgoing calls in GSM mode. When this mode is used, calls are routed through UCS, which allows them to be recorded and enables showing a caller ID different from the mobile phone number.
    • Available application features – features of the application available to users:
      • dial – calling (softphone as well as GSM calls)
      • chat – company chat
      • call history – history of completed calls
    • Require FaceID – biometric authentication is required each time the application is opened
    • Allow VoIP calls (uPhone) – enable softphone functionality
  5. For self-service provisioning by the user, it is necessary to enable QR code generation in the operator application. In the file /etc/ucs/operator/config.js, set the parameter window.ucsOperator.ff.passwordlessLogin to true. Then deploy the changes with the command: ucs-operator-deploy

Provisioning by E-mail​

If self-service provisioning using QR codes is not enabled, it is possible to send the user an e-mail with a link that inserts the profile into the application.

The text of the e-mail is configured in the administration interface under: ☰ System → Parameters → UCS → UCS Mobile Application provisioning e-mail

Sending the e-mail to the user is done through the administration interface: ☰ System → Users → 🔑 → Mobile device application → Send provisioning e-mail

Application Firewall​

The interface for mobile phones can be placed on a separate server running Traefik, and possibly also a STUN server and uPhone.

Traefik​

The minimal Traefik configuration is the distribution file 05_uauth.yaml, in which you set http.middlewares.uAuth.forwardAuth.address = "https://ucs.zakaznik.cz:3000" and http.services.auth.loadBalancer.servres[].url = "https://ucs.zakaznik.cz:5639".

/etc/traefik/conf.d/10_api.yaml
http:
  routers:
    ucsApiWs:
      tls: {} # Accessible only via HTTPS
      rule: "PathPrefix(`/ws`)"
      middlewares:
        - https
        - cors
        - uAuth
      service: ucsApi
    ucsApiOptions:
      tls: {} # Accessible only via HTTPS
      rule: "Path(`/`) && Method(`OPTIONS`)"
      middlewares:
        - https
        - cors
      service: ucsApi

  services:
    ucsApi:
      loadBalancer:
        servers:
          - url: "https://ucs.zakaznik.cz"
/etc/traefik/conf.d/10_ucs.yaml
http:
  routers:
    ucsCoreSecure:
      tls: {} # Accessible only via HTTPS
      rule: "PathPrefix(`/JSON`)"
      middlewares:
        - https
        - cors
        - uAuth
      service: ucsCore

  services:
    ucsCore:
      loadBalancer:
        servers:
          - url: "http://ucs.zakaznik.cz"
/etc/traefik/conf.d/20_light_log.yaml
http:
  routers:
    lightLogHttp:
      tls: {} # Accessible only via HTTPS
      rule: "PathPrefix(`/llog/http`)"
      middlewares:
        - https
        - cors
        - uAuth
      service: lightLogHttp

  services:
    lightLogHttp:
      loadBalancer:
        servers:
          - url: "http://ucs.zakaznik.cz"

STUN server​

The STUN/ICE server can run on a private IP; in that case, the external-ip parameter must be set. For the local uPhone to correctly detect the public IP address, the server needs to listen on the private IP (not on the loopback 127.0.0.1).

/etc/turnserver.conf
listening-ip=10.20.30.40
external-ip=80.70.60.50
min-port=10000
max-port=20000
no-tcp
no-tls
no-dtls
no-tcp-relay
syslog
stun-only

uPhone​

Only the parameters that require attention are listed here. The range of stun_candidate_min_port and stun_candidate_max_port must match the min-port and max-port range of the STUN server. The IP address of the stun_server parameter must not be 127.0.0.1.

/etc/ucs/uphone.conf
[sip]
interface = ens123

[webrtc]
stun_server = stun:10.20.30.40:3478
stun_candidate_min_port = 10000
stun_candidate_max_port = 20000

[nats]
url = nats://10.20.30.10:4222