The Exovo SBC

The Exovo SBC is a small container that lives at a remote office. The site's desk phones register to it locally, and it carries all their signaling and media to your PBX over a single mutually-authenticated TLS tunnel (port 5090) — one install per site instead of per-phone anything, and nothing at the branch exposed to the internet.

When to use an SBC vs per-phone VPN

• Several phones at one location → SBC. One tunnel, zero per-phone ceremony; phones there provision normally with the SBC selected.
• One phone in a home office → per-phone VPN is lighter.
• A laptop anywhere → the web client needs neither.

Some phone models can be the SBC for a very small site — current Fanvil V6x/X-V2 and Snom D86x models are SBC-capable, so a two-phone branch may not need a separate box at all.

Enrolling a new SBC

Enrollment pairs a specific box with your system using a one-time key:

1. Admin → Advanced → SBC → Add — name the site. The console shows a one-time enrollment key exactly once (with copy-as-.env-line convenience).
2. On the site's box, put the key in the SBC's compose environment (SBC_ENROLL_KEY=…) and docker compose up -d.
3. First boot, the SBC exchanges the key for its own certificate, stores it on a persistent volume, and connects. The console entry moves Pending → Enrolled; the key is consumed and can never enroll a second device.

The certificate is long-lived; the key expires after 7 days if unused. Revoke on the SBC page cuts a compromised or retired site off immediately.

Pointing phones at the site

When assigning a phone, choose SBC as its connection type and pick the site. Provisioning automatically sets the phone's outbound proxy to the SBC's LAN address — which the SBC self-reports and keeps current, so a DHCP change at the branch heals itself — while the registrar remains your system FQDN.

What the site needs

A small always-on Linux box (a NUC-class machine is plenty) with Docker, LAN access to the phones, and outbound internet to your PBX on port 5090. No inbound ports, no firewall exceptions at the branch.

Security posture

• Mutual TLS with per-site certificates — the PBX knows exactly which site is connecting; there are no shared secrets to leak.
• Fail-closed — if the tunnel is down, the SBC forwards nothing; branch phones simply show unregistered rather than attempting any unprotected path.
• The tunnel also carries the console's phone web-UI access to branch phones — strictly limited to registered phones' web ports.