I feel that you're 90% of the way there with the configuration files that are emailed to people when their extensions are created, except for the very messy way that 3CXPhone and 3CXTunnel work together. If we don't want to open up port 5060 to the wider world (we don't, and that's what 3CXTunnel is supposed to solve) then it's necessary to set the external IP in the phone provisioning tab and send the welcome email. Once someone has added this configuration to 3CXPhone they then need to go into the account setup, enable 3CXTunnel in Out of office and then type in the internal IP and the password. I don't see why these three extra pieces of information can't be in the configuration file already (boolean value for whether to use 3CXTunnel, string for the IP/host of the PBX, string for the password). If you don't want to put the password into the config file then have it ask for it on first connection. The point of the config file is to make it easy for people, if we have to tell them that it almost works out of the box except for a few things they need to change themselves then it makes the whole product look less well polished.