Service roles and dependencies

Use this reference to identify which service owns a symptom or configuration change. A role groups processes and configuration; it is not a guarantee of one host, one container or one instance in every deployment. Start with your generated deployment bundle and inventory, including enabled modules and image identities.

Availability: This chapter is for operators authorized to inspect their deployment. Platform UI roles do not grant host, database, registry or cloud access. Optional services depend on the deployment configuration; an image or container name in a generic catalogue does not prove it is installed.

Follow the request path

In words: telephony enters through the edge and voice services; browser integrations start through TelAPI, with the enabled voice-media path involving the edge. The management UI, runtimes and background work depend on database/Redis state. AI providers and selected storage/notification services are external dependencies. This is a responsibility map, not a complete packet-flow or firewall diagram.

Role catalogue

Each role has its own Compose file in the deployment bundle. SigNoz is the exception: its stack is generated, and the export collector has a separate Compose file. The second column lists the Compose service names.

Role	Compose services	Responsibility	Dependencies to investigate with it
Web	telweb, caddy, otel-collector	Management UI, sign-in and administrative interactions	Database/Redis, configured identity/email services, TLS/DNS and relevant API connections
API	telapi, otel-collector	HTTP sessions and WebSocket channel	Database/Redis, authorization/configuration, provider access, enabled voice gateway and optional media cache
TelPro	telpro, rtpengine, webrtc, turn, log-to-span, otel-collector	Kamailio signaling, RTPEngine media, Janus browser gateway and coturn relay	Redis routing/configuration, Voice destinations, public/private addressing, SIP/TLS/RTP paths
Voice	voiceai-telsys, voiceai-telphi, voiceai-audioproc, log-to-span, otel-collector	TelSys/Asterisk telephony, TelPhi conversation runtime and optional AudioProc preprocessing	Edge signaling/media, ARI/media connections, database/Redis, providers, recording/storage and optional media cache
Database	voiceai-postgres, voiceai-pgbouncer, redis, otel-collector	PostgreSQL, PgBouncer connection pooling and Redis state	Persistent storage, credentials/TLS, migrations and all client connection settings
Ops	tasker, scaler, db-migrate, otel-collector	Background jobs, server-group scaling and the one-shot database migration	Database/Redis, cloud credentials/APIs, queue producers, backup/object storage and notification delivery
Media	media-upload, caddy	Media-upload service and Caddy serving persistent media	Storage permissions/capacity, upload authentication, TLS and consumer trust/configuration
SigNoz	Generated SigNoz stack; otel-collector-export for export	Observability backend, its ingester collector and the optional export collector	Telemetry ingestion, its storage, retention, query access and configured network paths
Squid	squid, otel-collector	Outbound proxy where the deployment uses it	Proxy ACLs, upstream DNS/connectivity and every consumer configured to use that proxy

The otel-collector service in each role delivers telemetry; it does not execute calls. The log-to-span sidecars convert container logs of the telephony components (TelSys, Kamailio, RTPEngine, Janus) and captured SIP into trace spans. Telemetry and monitoring explains how the service collectors differ from the SigNoz ingester collector. A bastion provides operator access; it is not a call-processing service.

Optional, local and separately managed components

• Janus and TURN: browser-voice deployments use these gateway and relay components. The TelPro Compose names its upstream coturn container voiceai-turn; there is no separate Delphi voiceai-turn image. Before you remove an installed relay, determine whether your browser connectivity path needs it.
• AudioProc: an optional preprocessing component. Its container, runtime configuration, provider audio format and user entitlement must agree; a UI toggle alone does not install it.
• Media cache: consumers use it only when configured. If you disable cache use, you do not need to delete the Media host or unrelated stored media.
• Log-to-span: on Voice and TelPro hosts, the log-to-span sidecar runs a mounted log-to-span binary in an alpine:3.19 container. The voiceai-log-to-span image exists for the local development stack. Update the mounted binary when the converter changes.
• Delphi Portal and its identity service: these are separately managed services. Portal manages deployment configuration, release distribution information and status monitoring; it is not a container inside your call-processing stack. Its operator and identity lifecycle is separate from TelWeb team access.

Use the role bundles of your deployment as the source of truth for service hosts, and follow the deployment journey to change them. A local development stack uses different container names, ports and a shared database; do not copy them into a production topology.

Configuration and network ownership

Identify each consumer before changing a setting. Bootstrap selects image/bundle identity; service vars.yaml and cloud configuration supply runtime environment; the database contains application/routing policy; external systems own provider credentials, certificates and stored objects. Configuration recovery explains which backup can restore each layer.

Obtain firewall rules from the generated configuration for the selected deployment. Account for public SIP/browser ingress, internal signaling/media, database/Redis access, registry/cloud/provider egress and telemetry export separately. Host-network services and published container ports have different exposure; a list of Docker port mappings alone is incomplete. Validate TLS trust on the real client path, not only a host-local probe.

When a service fails, trace both its upstream callers and downstream dependencies before you restart anything.

Related

• Check service health and intervene safely: to choose a bounded intervention for the failing role.
• Logs and diagnostics: to correlate evidence across roles instead of restarting every role.
• Release compatibility: to find the image and upstream versions each role runs.
• Prerequisites for a Delphi deployment: to check the ports each role needs.