Service roles and dependencies
Use this reference to identify which service owns a symptom or configuration change. A role groups processes and configuration; it is not a guarantee of one host, one container or one instance in every deployment. Start with your generated deployment bundle and inventory, including enabled modules and image identities.
Availability: This chapter is for operators authorized to inspect their deployment. Platform UI roles do not grant host, database, registry or cloud access. Optional services depend on the deployment configuration; an image or container name in a generic catalogue does not prove it is installed.
Follow the request path
In words: telephony enters through the edge and voice services; browser integrations start through TelAPI, with the enabled voice-media path involving the edge. The management UI, runtimes and background work depend on database/Redis state. AI providers and selected storage/notification services are external dependencies. This is a responsibility map, not a complete packet-flow or firewall diagram.
Role catalogue
Each role has its own Compose file in the deployment bundle. SigNoz is the exception: its stack is generated, and the export collector has a separate Compose file. The second column lists the Compose service names.
| Role | Compose services | Responsibility | Dependencies to investigate with it |
|---|---|---|---|
| Web | telweb, caddy, otel-collector | Management UI, sign-in and administrative interactions | Database/Redis, configured identity/email services, TLS/DNS and relevant API connections |
| API | telapi, otel-collector | HTTP sessions and WebSocket channel | Database/Redis, authorization/configuration, provider access, enabled voice gateway and optional media cache |
| TelPro | telpro, rtpengine, webrtc, turn, log-to-span, otel-collector | Kamailio signaling, RTPEngine media, Janus browser gateway and coturn relay | Redis routing/configuration, Voice destinations, public/private addressing, a bound media address for Janus and TURN, SIP/TLS/RTP paths. From 0.9.19 the edges form a TelPro server group that Ops provisions; it is not scaled automatically. |
| Voice | voiceai-telsys, voiceai-telphi, voiceai-audioproc, log-to-span, otel-collector | TelSys/Asterisk telephony, TelPhi conversation runtime and optional AudioProc preprocessing | Edge signaling/media, ARI/media connections, database/Redis, providers, recording/storage and optional media cache |
| Database | voiceai-postgres, voiceai-pgbouncer, redis, otel-collector | PostgreSQL, PgBouncer connection pooling and Redis state | Persistent storage, credentials/TLS, migrations and all client connection settings |
| Ops | tasker, scaler, db-migrate, otel-collector | Background jobs, server-group scaling and the one-shot database migration | Database/Redis, cloud credentials/APIs, queue producers, backup/object storage, notification delivery and, from 0.9.19, direct access to the SigNoz query API for stored SIP ladders and span trees |
| Media | media-upload, caddy | Media-upload service and Caddy serving persistent media | Storage permissions/capacity, upload authentication, a certificate from the media CA that the host delivers into memory, and consumers that trust that CA |
| SigNoz | Generated SigNoz stack; otel-collector-export for export | Observability backend, its ingester collector and the optional export collector | Telemetry ingestion, its storage, retention, query access and configured network paths |
| Squid | squid, otel-collector | Outbound proxy where the deployment uses it | Proxy ACLs, upstream DNS/connectivity and every consumer configured to use that proxy |
The otel-collector service in each role delivers telemetry; it does not execute calls. The log-to-span sidecars convert container logs of the telephony components (TelSys, Kamailio, RTPEngine, Janus) and captured SIP into trace spans. Telemetry and monitoring explains how the service collectors differ from the SigNoz ingester collector. A bastion provides operator access; it is not a call-processing service.
Optional, local and separately managed components
- Janus and TURN: browser-voice deployments use these gateway and relay components. The TelPro Compose names its upstream coturn container
voiceai-turn; there is no separate Delphivoiceai-turnimage. Before you remove an installed relay, determine whether your browser connectivity path needs it. - AudioProc: an optional preprocessing component. Its container, runtime configuration, provider audio format and user entitlement must agree; a UI toggle alone does not install it.
- Media cache: consumers use it only when configured. If you disable cache use, you do not need to delete the Media host or unrelated stored media.
- Log-to-span: on Voice and TelPro hosts, the
log-to-spansidecar runs a mountedlog-to-spanbinary in analpine:3.24.2container. Thevoiceai-log-to-spanimage exists for the local development stack. Update the mounted binary when the converter changes. - Delphi Portal and its identity service: these are separately managed services. Portal manages deployment configuration, release distribution information and status monitoring; it is not a container inside your call-processing stack. Its operator and identity lifecycle is separate from TelWeb team access.
Use the role bundles of your deployment as the source of truth for service hosts, and follow the deployment journey to change them. A local development stack uses different container names, ports and a shared database; do not copy them into a production topology.
Configuration and network ownership
Identify each consumer before changing a setting. Bootstrap selects image/bundle identity; service vars.yaml and cloud configuration supply runtime environment; the database contains application/routing policy; external systems own provider credentials, certificates and stored objects. Configuration recovery explains which backup can restore each layer.
Obtain firewall rules from the generated configuration for the selected deployment. Account for public SIP/browser ingress, internal signaling/media, database/Redis access, registry/cloud/provider egress and telemetry export separately. Host-network services and published container ports have different exposure; a list of Docker port mappings alone is incomplete. Validate TLS trust on the real client path, not only a host-local probe.
When a service fails, trace both its upstream callers and downstream dependencies before you restart anything.
Related
- Check service health and intervene safely: to choose a bounded intervention for the failing role.
- Logs and diagnostics: to correlate evidence across roles instead of restarting every role.
- Release compatibility: to find the image and upstream versions each role runs.
- Prerequisites for a Delphi deployment: to check the ports each role needs.