From 2db63d66ce6dda0b165a46beedfdf171b4b57cd3 Mon Sep 17 00:00:00 2001
From: sorcier <sorcier@sorcier-research.com>
Date: Fri, 6 Nov 2026 00:00:33 +0100
Subject: [PATCH] feat(update): align update script with install script for HA
 cluster prerequisites

---
 scripts/update.sh | 45 ++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 42 insertions(+), 3 deletions(-)

diff --git a/scripts/update.sh b/scripts/update.sh
index 029defb..bbea215 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -102,12 +102,51 @@ chmod 2775 "$APP_DIR/storage" "$APP_DIR/storage/backups" "$APP_DIR/storage/sound
 mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt 2>/dev/null || true
 chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
 chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
-chmod +x "$APP_DIR/scripts/update.sh" "$APP_DIR/scripts/nexus-firewall" "$APP_DIR/scripts/nexus-banner.sh" 2>/dev/null || true
+chmod +x "$APP_DIR/scripts/update.sh" "$APP_DIR/scripts/nexus-firewall" "$APP_DIR/scripts/nexus-banner.sh" "$APP_DIR/scripts/nexus-cluster" 2>/dev/null || true
+chmod +x "$APP_DIR"/scripts/cluster/*.sh 2>/dev/null || true
 
 # Liens symboliques CLI (non-bloquants si exécuté sous sandbox PHP ProtectSystem)
 ln -sf "$APP_DIR/scripts/update.sh" /usr/local/bin/nexus-update 2>/dev/null || true
 ln -sf "$APP_DIR/scripts/nexus-firewall" /usr/local/bin/nexus-firewall 2>/dev/null || true
 ln -sf "$APP_DIR/scripts/nexus-banner.sh" /usr/local/bin/nexus-banner 2>/dev/null || true
+ln -sf "$APP_DIR/scripts/nexus-cluster" /usr/local/bin/nexus-cluster 2>/dev/null || true
+
+# Configuration sysctl pour l'IP flottante (VIP HA)
+if [ -w /etc/sysctl.d ]; then
+    sysctl -w net.ipv4.ip_nonlocal_bind=1 >/dev/null 2>&1 || true
+    echo "net.ipv4.ip_nonlocal_bind=1" > /etc/sysctl.d/99-nexus-ha.conf 2>/dev/null || true
+fi
+
+# Pré-déploiement des scripts Keepalived HA
+if [ -d "$APP_DIR/scripts/cluster" ] && [ -w /etc ]; then
+    mkdir -p /etc/keepalived/scripts 2>/dev/null || true
+    cp -f "$APP_DIR/scripts/cluster/"*.sh /etc/keepalived/scripts/ 2>/dev/null || true
+    chown -R root:root /etc/keepalived 2>/dev/null || true
+    chmod 755 /etc/keepalived /etc/keepalived/scripts 2>/dev/null || true
+    chmod 755 /etc/keepalived/scripts/*.sh 2>/dev/null || true
+fi
+
+# Cron synchronisation Cluster HA
+if [ -w /etc/cron.d ]; then
+    cat << 'EOF_CRON' > /etc/cron.d/nexus-cluster-sync 2>/dev/null || true
+# Synchronisation périodique du cluster NexusPBX HA vers le nœud Backup
+*/2 * * * * www-data /usr/bin/php /var/www/nexus-pbx/scripts/nexus_cluster_sync.php >> /var/log/nexus_cluster.log 2>&1
+EOF_CRON
+    chmod 0644 /etc/cron.d/nexus-cluster-sync 2>/dev/null || true
+    touch /var/log/nexus_cluster.log 2>/dev/null || true
+    chown www-data:asterisk /var/log/nexus_cluster.log 2>/dev/null || true
+    chmod 666 /var/log/nexus_cluster.log 2>/dev/null || true
+fi
+
+# Optimisation de la réserve de processus PHP-FPM
+for pool in /etc/php/*/fpm/pool.d/www.conf; do
+    if [ -f "$pool" ] && [ -w "$pool" ]; then
+        sed -i 's/^pm.max_children = .*/pm.max_children = 25/' "$pool" 2>/dev/null || true
+        sed -i 's/^pm.start_servers = .*/pm.start_servers = 4/' "$pool" 2>/dev/null || true
+        sed -i 's/^pm.min_spare_servers = .*/pm.min_spare_servers = 2/' "$pool" 2>/dev/null || true
+        sed -i 's/^pm.max_spare_servers = .*/pm.max_spare_servers = 6/' "$pool" 2>/dev/null || true
+    fi
+done
 
 # Mise à jour des privilèges sudoers (www-data) si accessible en écriture
 if [ -w /etc/sudoers.d ]; then
@@ -119,9 +158,9 @@ fi
 
 # 3. Vérification des dépendances Debian
 echo -e "${C_GRAY}[3/6] Vérification des composants et outils système...${C_RESET}"
-which ffmpeg >/dev/null 2>&1 && which rsync >/dev/null 2>&1 && which sox >/dev/null 2>&1 && which sshpass >/dev/null 2>&1 || {
+which ffmpeg >/dev/null 2>&1 && which rsync >/dev/null 2>&1 && which sox >/dev/null 2>&1 && which sshpass >/dev/null 2>&1 && which keepalived >/dev/null 2>&1 && which arping >/dev/null 2>&1 || {
     echo -e "  -> Installation de paquets complémentaires..."
-    (apt-get update -y -qq && apt-get install -y -qq --no-install-recommends acl ffmpeg rsync sox sshpass) 2>/dev/null || true
+    (apt-get update -y -qq && apt-get install -y -qq --no-install-recommends acl ffmpeg rsync sox sshpass keepalived iputils-arping) 2>/dev/null || true
 }
 
 # 4. Exécution des migrations SQLite et régénération Dialplan