Two engines, not one
Kamailio does registration, digest auth and flood control on 5060. FreeSWITCH does media and PBX logic, bound to 127.0.0.1. A scanner that finds your SIP port cannot reach the media core at all.
Two engines.
One install.
An open-source, multi-tenant VoIP PBX for Debian 13. Kamailio takes the public SIP ports; FreeSWITCH sits behind it on loopback and never faces the internet.
curl -fsSL https://get.qwixbox.com | sudo bash Debian 13, 2 vCPU, 4 GB. Opens a four-question wizard and hands you a login.
Why it is built this way
Multi-tenant by construction
A tenant is an organization, and the API refuses to run a query that is not scoped to one. An unscoped query is a data breach, so it raises an error instead of returning everything.
A stack you can extend
TypeScript on Bun, React, PostgreSQL, Redis. The portal is a client of the same REST API you get, so there is no admin action that only exists as a form.
The installer is the product
28 idempotent steps from a bare server. Re-running is quiet, not destructive, because each step records a checksum of the script that satisfied it.
What you get
- Telephony
- Extensions with encrypted SIP credentials, trunks with IP or registration auth, inbound DID routing, outbound routing with regex patterns and digit manipulation, ring groups with failover, IVR menus, and time conditions for business hours and holidays.
- Per-user control
-
Do not disturb, call forwarding on all, busy and no answer, call waiting and ring
timeout — from the portal or from the handset with
*72,*78and friends. - Portal
- Extensions, trunks, routing, call flows, call history with CSV export, faxes, users and an audit trail. Four roles enforced server-side on every request.
- Platform
- SIP-domain isolation, per-tenant call limits, TLS throughout with automatic Let's Encrypt, nftables and fail2ban, DKIM-signed mail, scheduled backups, and DNS records created for you at nine providers via Domain Connect.
Where it actually is
Not everything here is finished, and the list says which.
| Installs and configures | proven | 28 steps from bare Debian, idempotent, 38 postflight checks |
|---|---|---|
| Registration | proven | A softphone completes digest auth against the projected HA1 |
| Call setup | proven | Extension-to-extension, inbound DID and outbound-to-carrier |
| Two-way audio | not yet | rtpengine is wired and answers; no call has been listened to end to end |
| Admin portal | proven | Extensions, trunks, routing, call flows, calls, faxes, users, audit |
| Voicemail, fax, IVR digits | not yet | Written and deployed; each needs the media path first |
Two-way audio is the one that gates the rest — voicemail recording, IVR digit selection and fax all sit behind it. The full list is in the repo, kept current rather than aspirational.