Changelog

The audio converter's "rotated hold-music variants" option got more reliable under load. Requests asking for several variants and multiple output formats at once could occasionally time out partway through instead of finishing. The server now gives those requests more room to complete, and the maximum number of variants per request is a little lower so a single request can't run long enough to hit the wall in the first place.

Also went through several getting-started guides looking for outdated or inconsistent information, and found a few worth fixing:

• The CDR storage backend guide had two example database schemas that disagreed with each other on a column's data type. Now consistent, plus a link to the companion CDR variables and disposition values guide.
• Both PJSIP configuration guides (from scratch, and NAT traversal) got a missing NAT setting added to a trunk example, and now cross-link each other for the full picture.
• The ARI getting started guide's sample Python app used a feature that needs Python 3.9 or newer; that requirement is now called out instead of being a surprise crash.
• The audio formats guide's bandwidth capacity table had a few numbers that didn't quite match its own formula. Recalculated and corrected.
• The IAX2 trunking guide now notes that the example IP addresses assume an existing link between the two offices (a VPN or similar), and mentions IAX2's built-in call encryption option.

Small fixes individually, but if you followed any of these guides recently and hit something that didn't add up, this is why.

A busy week. Some visible additions, some quieter fixes, and a lot of small polish behind the scenes.

The /reference/ landing page used to be a bare category list with a generic title. It's now a proper "find the right building block" page: a per-type grid with counts and one-line descriptions, plus a curated shortlist of the entries people actually look up. The AMI Events category got the same treatment with a manager.conf snippet and a working client example inline, since it's the largest reference category and the biggest single traffic source from search. A handful of high-intent reference pages (PJSIP_HEADER, PJSIP_SEND_SESSION_REFRESH, CDR, and the top AMI events) also got custom SEO titles and descriptions instead of the generic template, so search results should better match what people were actually looking for.

The audio converter got several rounds of attention this week. The size limit is now 25 MB, up from 10 MB, because music-on-hold source tracks routinely exceed the old limit and nginx's raw 413 page was taking over just above the cutoff instead of the friendly in-app error. There's a new signed-linear 16 kHz output format for people working with wideband codecs. Following a stale conversion link now shows a friendly explanation page instead of a generic 404, since job IDs are shared and bookmarkable but the files themselves get cleaned up after 24 hours. Under the hood, the converter now bounds concurrent sox/ffmpeg subprocesses and caps total outputs per request, so a single request can't monopolize the box.

The vote, flag, and note actions used to include the numeric snippet ID in the URL (/vote/123, /flag/456), which made bot traffic against those paths trivial to write and hard to block cleanly through robots.txt. There are now stable bare-path aliases at /vote, /flag, and /note that take the snippet ID from the form body; the numeric ones still work for backward compatibility. A single robots.txt disallow line now covers both shapes.

iOS was requesting /apple-touch-icon.png about 86 times a month with nothing to serve it, so that's now wired up to the real icon. Chrome and Safari's prefetching proxies check /.well-known/traffic-advice before speculatively loading pages, and the file was missing, so they were conservatively falling back to no prefetch at all. Adding it should make first-navigation feel a little faster for users behind those proxies.

The admin app, only reachable through an SSH tunnel, was still serving responses with no security headers. It now sets X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a Content-Security-Policy on every response. The public MCP server also got better audit logging: it was recording tool calls but not the surrounding handshake traffic, so "someone connected and walked away" was invisible in the log. The initialize, ping, and tools/list messages are now captured too, distinguishable from real tool calls by a prefix.

An IP that had been running form-probe traffic against /vote and /flag for weeks is now denied at the edge instead of consuming rate-limiter budget on every request.

A mix of fixes from the past few weeks, some visible, some quietly annoying until now.

Upvoting got more reliable. The old dedup logic fingerprinted you by IP address and browser user agent, which meant everyone behind the same corporate or CGNAT connection looked identical (so only the first person's vote counted), while changing your user agent string was enough to vote again. Votes are now tracked with a persistent anonymous cookie instead, so shared connections aren't punished and casual re-voting isn't trivial. Votes cast before this change still dedupe correctly against their original fingerprint.

Audio conversion failures are no longer silent. If a specific output format fails to convert, mp3 works but ogg doesn't, say, the results page now shows exactly which format failed and why instead of just dropping it from the list. G.722 output also got better: when you request effects like normalization or silence trimming, the converter now runs them through a proper intermediate step instead of skipping them for that format.

/security.txt now redirects to the canonical /.well-known/security.txt location instead of 404ing, and it's no longer accidentally caught by the bot-scanning rate limiter, so security researchers checking for a disclosure policy don't get banned for looking.

Behind the scenes, a markdown rendering bug got fixed: a fenced code block containing a JSON object (starting with {, closing brace further down) could get partially eaten by a regex meant to strip an unrelated syntax. It only showed up on entries with a JSON code sample, a handful of pages, but if you saw a code block missing its middle, this was why.

The public MCP server, the tool that lets AI assistants search and read the Asterisk reference library directly, had been quietly down for a while. It's back up now, and picked up a few upgrades along the way.

It now works with ChatGPT and similar tools, not just Claude. Those assistants expect a very specific way of asking for search results, and the server didn't support that shape until now.

The browser-based "add connector" flow some AI tools use to set up a new server also needed a fix. It checks that a server is reachable before saving it, and that check was quietly failing.

It's easier to find now too. It's listed in the site's llms.txt file (a manifest some AI tools check first), and it's mentioned on the About and Colophon pages alongside the rest of how this site is put together.

If you use an AI assistant that supports MCP, point it at asteriskrecipes.com/mcp to search and pull full reference entries directly instead of relying on the assistant's own cached knowledge.

The CLI Commands reference category now covers the full Asterisk console: 481 commands, each with its own page showing syntax, a description of what it does, and links to related commands. Entries are generated straight from the Asterisk source, so they match what you actually see at the CLI prompt.

Browsing the reference library also got easier. The Reference menu in the navigation bar now opens a dropdown listing every reference section, and the reference directory page shows all sections with entry counts at a glance.

Added verification files so search engines and webmaster tools can confirm we own the site. These are small technical files served from the site root and don't affect anything visitors see.

A handful of usability improvements across the site tonight.

When a search returns no results, the page now shows something useful instead of just "no results." You get links to browse all four sections and a row of popular topic tags to help you find what you were looking for.

The Recently Updated page now has section filters. You can narrow the feed to Snippets, Scripts, Reference, or Guides instead of seeing everything mixed together.

The consulting contact form has two new fields: project type (checkboxes for dialplan work, migration, troubleshooting, architecture, security, or retainer) and timeline. This helps get the right information up front so the first reply can be more useful.

The Asterisk version compatibility matrix page now loads faster on repeat visits thanks to server-side caching.

A busy couple of days across content, notes, and a few bug fixes.

User notes now render markdown. Previously, notes submitted by readers appeared as plain text. Code blocks, inline code, bold text, and links now render properly in all note bodies.

Fifteen new editorial notes went live on some of the most-visited reference entries, covering practical usage tips, common gotchas, and version-specific behavior.

Several content corrections landed across the guides section. Two broken internal links in the "Your First Working Dialplan" guide are fixed, a wrong slug in the "Getting Started with ARI" guide now resolves correctly, the AGI CNAM Lookup snippet had a word wrong ("digits" where it should say "characters"), and the Let's Encrypt TLS guide now notes that the approach described applies to Asterisk 18 and later.

The default Open Graph image used when sharing pages on Twitter or iMessage was a WebP file, which neither platform handles reliably. It has been switched to a PNG, so link previews should now show the site image correctly.

The consulting form no longer re-submits on back navigation after a failed validation.

Site deployments are now automated through a CI pipeline connected to the source repository. Previously, pushing updates to production required running deployment commands manually. Now, triggering a deploy from the repository kicks off the full process automatically: checking out the latest code, installing dependencies, and running the Ansible playbook that updates the live site.

This makes deployments faster and less error-prone, and sets the stage for more frequent content and feature updates going forward.

The call recording consent laws by state page got a thorough overhaul. Several statute links were broken (Illinois, New Hampshire, Connecticut, and Delaware), and 16 states had no links at all. Every state and DC now points to its actual wiretapping statute.

The content got attention too. The page used "all-party consent" throughout, but most legal resources say "two-party consent," so that's clarified upfront now. Added accuracy notes for Nevada (whose one-party status comes from a 1999 court decision rather than clear statutory text), Oregon, and Connecticut, which both have narrower all-party rules than their table position implies. New sections cover TCPA and HIPAA as separate compliance layers, what happens with international calls, and whether a beep tone is a valid substitute for a verbal recording announcement.

Two reference pages, Set() and ADSIProg(), were showing completely wrong content. They had ended up displaying an unrelated guide instead of their actual documentation. Both are back to normal.

A recent security update broke more things than expected. The card/list toggle, the copy button in the dialplan widget, the search page's section filter, the flag button on user notes, the print button on reference cheat sheets, and the table of contents on the resources page all stopped working. All fixed.

On the deployment side, packages no longer ship development source files. A deploy used to transfer around 800 MB; it's under 10 MB now.

Code blocks without a language identifier weren't rendering their title bar, which hit a bunch of reference entries including MUTEAUDIO(), ABS(), CDR(), and PASSTHRU(). Fixed. Added h4 and h5 heading styles to content pages, which matters on long module config pages like res_pjsip where the visual hierarchy was getting lost. The VoiceMail() dialplan builder now shows option flags as checkboxes instead of a plain text field. Also cleared six open content flags.

Added a "Recent developments" section to the call recording consent laws by state reference page. Covers two pending or recently-considered changes: New York Senate Bill S5077 (introduced 2025, still in committee) which would shift the state to all-party consent, and Maryland's 2025 legislative hearings on narrowing its all-party requirement, which did not result in any changes. No state changed its consent classification in 2025 or 2026.

Several security improvements across the site. Fixed a bug that was breaking the audio converter and some interactive page elements after the security changes were applied.

Added dynamic range compression, a configurable output level, and one-click Voice/IVR and Music on Hold presets to the audio converter.

Miscellaneous bug fixes and under-the-hood improvements.

Improved meta descriptions on several reference entries where auto-generated text was truncating mid-sentence or including raw Markdown escape characters. Fixed the underlying strip function so backslash escapes are removed before meta text is assembled.

Hardened the consulting contact form against email header injection, added server-side validation on the budget field, and tightened the email format check.

Updated the colophon with current counts for tests, templates, Python lines, and database migrations.

Added a contact form to the consulting page with server-side validation, CSRF protection, rate limiting, and a honeypot field for bot detection. Submissions are handed off to sendmail for delivery. Fixed a z-index bug that caused code block language labels to render behind code text on line-numbered blocks. Added a tip admonition to the Convert Audio Files for Asterisk guide advertising the online Audio Converter tool.

Archive downloads now stream from temp files. Added optional source file inclusion and custom output filename sanitization for archive downloads.

Minor CSS fixes, deployment improvements, and infrastructure housekeeping.