fix(lab): silence Asterisk noise at the source, keep notice logging

Follow-up to 3150f78, which over-corrected. Dropping `notice` from logger.conf
made the log quiet by making the gateway undebuggable: Asterisk reports
rejected SIP requests at notice level via log_failed_request ("No matching
endpoint found", "Failed to authenticate"), and on a box whose entire job is
answering SIP those are the most useful lines it produces. A call was refused
and nothing said so.

`notice` is restored. The noise is dealt with where it originates instead:

- modules.conf, new. The image ships `autoload=yes` and loads every module it
  was built with, including chan_alsa on a container with no sound card:
  ~74 ALSA config errors per restart, plus module-load ERRORs for CDR/CEL
  backends, LDAP/ODBC realtime config, and format_ogg_vorbis — none of which
  can work here. Explicit noload for those; autoload stays on, because an
  allow-list would break quietly the first time a scenario needs a module
  nobody remembered to add.

- The healthcheck reduction from 3150f78 (one CLI connection on a 60s
  interval, rather than the image's ~7 every 30s) does the rest.

Verified on galatea: ALSA lines 74 → 0, all startup ERRORs gone (only one-off
benign WARNINGs remain), steady-state 4 lines per 2 minutes against ~840 per
30 minutes originally — and a refused call still logs 6 diagnostic lines.
Transport bound, both endpoints and dialplan loaded, container healthy.

`verbose` stays excluded: dialplan execution is worth having when tracing a
specific call, not worth shipping to Loki continuously. Raise it at runtime
with `asterisk -rx "core set verbose 3"`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/lab/dialplan/asterisk.conf

@@ -1,24 +1,17 @@
 ; Minimal Asterisk core config for the lab.
-[directories](!)
-astetcdir => /etc/asterisk
-astmoddir => /usr/lib/asterisk/modules
-astvarlibdir => /var/lib/asterisk
-astdbdir => /var/lib/asterisk
-astkeydir => /var/lib/asterisk
-astdatadir => /var/lib/asterisk
-astagidir => /var/lib/asterisk/agi-bin
-astspooldir => /var/spool/asterisk
-astrundir => /var/run/asterisk
-astlogdir => /var/log/asterisk
-astsbindir => /usr/sbin
-
+;
+; Deliberately does NOT set [directories] or runuser/rungroup: the image's
+; compiled-in defaults are correct, and it runs as the `asterisk` user via a
+; USER directive. Overriding either risks breaking the container for no gain
+; (an earlier version of this file did both).
 [options]
-; Log to stdout so Docker's json-file driver captures it and Alloy ships it.
-; A file-based log inside the container would be invisible to Loki.
+; Log to stdout so Docker's json-file driver captures it and Alloy ships it
+; to Loki. A file-based log inside the container would be invisible.
 verbose = 3
 debug = 0
+; No ANSI colour. Asterisk colourises the console by default and the escape
+; codes travel through Docker into Loki, where every line arrives wrapped in
+; \x1b[0;30m — unreadable in Grafana and awkward to filter on. This setting
+; lives here, not in logger.conf, and only takes effect if this file is
+; actually mounted into the container.
 nocolor = yes
-dumpcore = no
-; Never run as root inside the container.
-runuser = asterisk
-rungroup = asterisk

tests/lab/dialplan/logger.conf

@@ -3,6 +3,28 @@
 ; the container would put the logs where nothing can see them.
 [general]
 dateformat = %F %T
+; Colour is disabled in asterisk.conf (`nocolor = yes`), not here — Asterisk
+; colourises the console by default and the escape codes travel through Docker
+; into Loki, where every line arrives wrapped in \x1b[0;30m. That file must be
+; mounted for the setting to take effect.
 
 [logfiles]
+; `notice` is KEPT, deliberately. Asterisk logs rejected SIP requests at
+; notice level via log_failed_request ("No matching endpoint found",
+; "Failed to authenticate"), and on a box whose whole job is answering SIP
+; those are the single most useful diagnostic. Dropping notice made the log
+; quieter and the gateway undebuggable — a call was refused and nothing said
+; so.
+;
+; `verbose` is excluded: dialplan execution ("Executing [1001@...]") is
+; useful when tracing a specific call, but it is not worth shipping to Loki
+; continuously. Raise it at runtime instead:
+;     asterisk -rx "core set verbose 3"
+;
+; The healthcheck's "Remote UNIX connection" pairs also arrive on notice.
+; They are dealt with at the source rather than by silencing the channel:
+; docker-compose replaces the image's ~7-connections-per-30s healthcheck with
+; a single check on a 60s interval, and modules.conf stops the container
+; loading hardware and database modules it has no use for (~74 ALSA lines per
+; restart). Those two together cut the noise without costing visibility.
 console => notice,warning,error

tests/lab/dialplan/modules.conf

@@ -0,0 +1,46 @@
+; Module loading for the lab.
+;
+; The image ships `autoload=yes`, which loads every module Asterisk was built
+; with. On a headless container that produces a lot of startup noise for
+; hardware and backends that do not exist here — measured at ~74 ALSA lines
+; plus a dozen module-load ERRORs per restart, all of it in Loki. None of it
+; was harmful; all of it made the log harder to read.
+;
+; autoload stays on: this is a lab, and an explicit allow-list would break
+; quietly every time a scenario needs a module nobody remembered to add. The
+; noload lines below are only for modules that *cannot* work in this container.
+[modules]
+autoload=yes
+
+; --- Audio hardware -------------------------------------------------------
+; No sound card in a container. chan_alsa/chan_oss probe for one and emit
+; ~74 lines of ALSA config errors on every start. The media path is RTP via
+; PJSIP, never a local device.
+noload => chan_alsa.so
+noload => chan_oss.so
+noload => chan_console.so
+
+; --- CDR/CEL backends for databases we do not run -------------------------
+; Each logs "declined to load" or a config error at startup. Call records live
+; in Hold Slayer's own Postgres, written by the gateway, not by Asterisk.
+noload => cdr_pgsql.so
+noload => cdr_sqlite3_custom.so
+noload => cdr_custom.so
+noload => cdr_csv.so
+noload => cel_pgsql.so
+noload => cel_sqlite3_custom.so
+noload => cel_custom.so
+
+; --- Realtime config backends we do not use -------------------------------
+; The lab's configuration is the mounted .conf files. LDAP/ODBC/PgSQL realtime
+; each complain about missing connection details on every start.
+noload => res_config_ldap.so
+noload => res_config_odbc.so
+noload => res_config_pgsql.so
+noload => res_config_sqlite3.so
+
+; --- Codecs and formats that fail to initialise ----------------------------
+; format_ogg_vorbis errors on load. The lab plays .sln (signed linear) and
+; negotiates ulaw/alaw, so nothing here needs Vorbis.
+noload => format_ogg_vorbis.so
+noload => format_ogg_speex.so

tests/lab/docker-compose.lab.yml

@@ -21,8 +21,25 @@ services:
       - ./dialplan/pjsip.local.conf:/etc/asterisk/pjsip.conf:ro
       - ./dialplan/rtp.local.conf:/etc/asterisk/rtp.conf:ro
       - ./dialplan/logger.conf:/etc/asterisk/logger.conf:ro
+      # Carries `nocolor = yes`: without it every log line reaches Loki
+      # wrapped in ANSI escape codes.
+      - ./dialplan/asterisk.conf:/etc/asterisk/asterisk.conf:ro
+      # noload for hardware/DB modules this container cannot use — the image
+      # autoloads everything, which costs ~74 ALSA lines per restart.
+      - ./dialplan/modules.conf:/etc/asterisk/modules.conf:ro
       # The image ships no sound files at all. These are generated by
       # sounds/generate.py; Asterisk resolves Playback(lab-music) to
       # lab-music.sln here (8kHz signed-linear, no transcoding).
       - ./sounds:/var/lib/asterisk/sounds/en:ro
+    # The image's default command is `-vvvdddf` — verbosity 3 and debug 3
+    # forced on the command line, which overrides both asterisk.conf and
+    # logger.conf. That makes every healthcheck CLI connection log a
+    # "Remote UNIX connection" pair: ~2900 lines/day of pure noise that
+    # completely buried the real SIP events in Loki.
+    #
+    # -f foreground (required: Docker needs PID 1 to stay), -T timestamps,
+    # -W colour off, -U run as asterisk, -p realtime priority. No -v, no -d:
+    # warnings and errors still log, and verbosity can be raised at runtime
+    # with `asterisk -rx "core set verbose 3"` when tracing a call.
+    command: ["/usr/sbin/asterisk", "-f", "-T", "-W", "-U", "asterisk", "-p"]
     restart: unless-stopped