🏗️ Sistem Arxitekturası & Mühəndislik Əsaslandırması

┌─────────────────────────────────────────────────────────────────────────────────────────┐
│                                      CLIENT LAYER                                       │
│   ┌───────────────────────────────┐               ┌─────────────────────────────────┐   │
│   │     Android Mobile App        │               │      Web Browser Client         │   │
│   │     (Kotlin + WebRTC/SIP)     │               │   (WebRTC Softphone + Portal)   │   │
│   └───────────────┬───────────────┘               └────────────────┬────────────────┘   │
└───────────────────┼────────────────────────────────────────────────┼────────────────────┘
                    │ HTTPS / WSS / TURNS (Single Port: 443)         │ HTTPS / WSS / TURNS
                    ▼                                                ▼
┌─────────────────────────────────────────────────────────────────────────────────────────┐
│                   EDGE INGRESS: NGINX PORT 443 ALPN MULTIPLEXER (L4)                    │
│   Nginx stream (ssl_preread on, PROXY protocol) — routes by ALPN, never decrypts:       │
│                                                                                         │
│   ├── [ ALPN Present ] (http/1.1, h2: Web Browsers, Mobile REST API, Management)        │
│   │     └──► Streamed to Apache 2.4 TLS Termination (127.0.0.1:8443)                    │
│   │                                                                                     │
│   └── [ ALPN Empty / None ] (WebRTC TURNS media relay behind restrictive firewalls)     │
│         └──► Streamed to coturn TURNS (via relay 127.0.0.1:15349 ──► 5349)             │
└───────────────────────────────────┬────────────────────────────────┬────────────────────┘
                                    │                                │
                     [ ALPN Present ]                                [ No ALPN ]
                                    ▼                                │
┌───────────────────────────────────────────────────────┐            │
│          APPLICATION & WEBSOCKET PROXY TIER           │            ▼
│  Apache 2.4 (127.0.0.1:8443 with TLS Termination)     │ ┌─────────────────────────────┐
│   ├── /                 ──► PHP 8 MVC Web Portal      │ │        COTURN RELAY         │
│   ├── /ws               ──► Asterisk WebRTC (8088/ws) │ │  TURNS Server (Port 5349)  │
│   └── /chat/ws          ──► Go Chat Engine (8086/ws)  │ │  Zero Media Loss for        │
│                                                       │ │  Symmetric NAT Traversal    │
│  Port 80: HTTP Redirect & Let's Encrypt ACME HTTP-01  │ └─────────────────────────────┘
└──────────┬────────────────────────┬───────────────────┘
           │                        │
           ▼                        ▼
┌─────────────────────┐  ┌─────────────────────┐
│      PHP 8 MVC      │  │     Asterisk 22     │
│     Web Portal      │  │     VoIP Engine     │
│  (Hardened Runtime) │  │    (PJSIP/WebRTC)   │
└──────────┬──────────┘  └──────────┬──────────┘
           │                        │
           │     AMI (Port 5038)    │
           ├────────────────────────┘
           │
           ▼
┌─────────────────────────────────────────────────────────────────────────────────────────┐
│                                       DATA LAYER                                        │
│  MariaDB 11 (utf8mb4_unicode_ci) — Two-Tier Privilege Security Model:                   │
│   ├── aipbx_portal   (Runtime DML: SELECT, INSERT, UPDATE, DELETE only)                 │
│   └── aipbx_migrator (Schema DDL: Phinx Migrations only)                                │
└─────────────────────────────────────────────────────────────────────────────────────────┘

stream {
    map $ssl_preread_alpn_protocols $aipbx_backend {
        default     127.0.0.1:8443;    # ALPN present: Apache (portal, /ws, /chat)
        ""          127.0.0.1:15349;   # no ALPN: TURNS, via the relay below
        ~stun\.turn 127.0.0.1:15349;   # RFC 7443 TURN clients
    }

    server {
        listen 443;
        listen [::]:443;
        ssl_preread on;                # read the ClientHello, never decrypt
        proxy_pass $aipbx_backend;
        proxy_protocol on;             # pass the real client address
        proxy_timeout 3600s;           # long calls and idle WebSockets survive
        proxy_connect_timeout 5s;
    }

    # coturn cannot read the PROXY header: this hop strips it.
    server {
        listen 127.0.0.1:15349 proxy_protocol;
        proxy_pass 127.0.0.1:5349;
        proxy_timeout 3600s;
    }
}

Web UI / REST API Request
        │
        ▼
Controller Validation & Auth Check
        │
        ▼
Service writes to MariaDB (DML)
        │
        ▼
Sync Generator (src/sync/*.php)
        ├── 1. Backs up existing file to .bak
        ├── 2. Queries DB and generates modular files under /etc/asterisk/pbx/*.conf
        └── 3. Issues Asterisk reload command (dialplan reload, queue reload...)
                │
                ├── [ SUCCESS ] ──► Updates audit log, removes .bak cleanly.
                └── [ FAILURE ] ──► AUTOMATIC ROLLBACK: Restores .bak immediately,
                                    prevents downtime, and logs error report.