From 4370deb26c22339b7db92628587f20004d0cea4b Mon Sep 17 00:00:00 2001
From: sorcier <sorcier@sorcier-research.com>
Date: Mon, 2 Nov 2026 04:19:55 +0100
Subject: [PATCH] Add fix.sh script for instant server repair

---
 scripts/fix.sh | 97 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 97 insertions(+)
 create mode 100755 scripts/fix.sh

diff --git a/scripts/fix.sh b/scripts/fix.sh
new file mode 100755
index 0000000..a712026
--- /dev/null
+++ b/scripts/fix.sh
@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# NexusPBX - Script de Réparation Automatique des Permissions & Services
+# ==============================================================================
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "[ERREUR] Ce script doit être exécuté en root."
+    exit 1
+fi
+
+echo "-> Correction des répertoires Git et mise à jour..."
+git config --global --add safe.directory /var/www/nexus-pbx 2>/dev/null || true
+cd /var/www/nexus-pbx
+git fetch origin main
+git reset --hard origin/main
+
+echo "-> Installation des outils de droits (ACL)..."
+which setfacl >/dev/null 2>&1 || (apt-get update -y && apt-get install -y acl)
+
+echo "-> Création des dossiers et des fichiers de journalisation..."
+mkdir -p /etc/fail2ban/filter.d /etc/asterisk /var/log/asterisk /var/log/nexus-pbx /var/www/nexus-pbx/storage/backups
+
+touch /var/log/asterisk/messages /var/log/asterisk/security.log /var/log/nexus_security.log
+chown asterisk:asterisk /var/log/asterisk/messages /var/log/asterisk/security.log 2>/dev/null || true
+chmod 0664 /var/log/asterisk/messages /var/log/asterisk/security.log 2>/dev/null || true
+chown www-data:asterisk /var/log/nexus_security.log 2>/dev/null || true
+chmod 0664 /var/log/nexus_security.log 2>/dev/null || true
+
+echo "-> Filtre Fail2ban Nexus-Web..."
+cat << 'EOF' > /etc/fail2ban/filter.d/nexus-web.conf
+[Definition]
+failregex = ^.*\[NEXUS-WEB-AUTH-FAIL\]:\s*<HOST>.*$
+ignoreregex =
+EOF
+chmod 0644 /etc/fail2ban/filter.d/nexus-web.conf
+
+echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..."
+usermod -aG asterisk www-data 2>/dev/null || true
+usermod -aG www-data asterisk 2>/dev/null || true
+
+chown -R www-data:asterisk /var/www/nexus-pbx
+chmod 2775 /var/www/nexus-pbx/storage /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/public/avatars 2>/dev/null || true
+
+touch /etc/asterisk/pjsip.conf \
+      /etc/asterisk/pjsip.custom.conf \
+      /etc/asterisk/extensions.conf \
+      /etc/asterisk/extensions.custom.conf \
+      /etc/asterisk/musiconhold.custom.conf \
+      /etc/asterisk/voicemail.custom.conf \
+      /etc/asterisk/rtp.conf \
+      /etc/asterisk/features.conf 2>/dev/null || true
+
+chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk 2>/dev/null || true
+chmod -R 775 /etc/asterisk
+chmod 2775 /etc/asterisk
+chmod 2750 /etc/asterisk/keys 2>/dev/null || true
+chmod 0664 /etc/asterisk/*.conf /etc/asterisk/*.custom.conf 2>/dev/null || true
+
+setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
+setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
+
+chown root:asterisk /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
+chmod 0664 /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
+setfacl -m u:www-data:rw /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
+
+cat << 'EOF' > /etc/sudoers.d/nexus-pbx
+www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/systemctl, /usr/bin/fail2ban-client, /var/www/nexus-pbx/scripts/nexus-firewall, /usr/bin/certbot, /usr/sbin/nft, /usr/sbin/iptables
+EOF
+chmod 0440 /etc/sudoers.d/nexus-pbx
+
+echo "-> Génération des configurations Asterisk..."
+php -r '
+require_once "/var/www/nexus-pbx/src/Database.php";
+require_once "/var/www/nexus-pbx/src/ConfigGenerator.php";
+$db = App\Database::getConnection();
+$gen = new App\ConfigGenerator($db);
+$gen->writeAllConfigs();
+' 2>/dev/null || true
+
+echo "-> Redémarrage des services..."
+systemctl daemon-reload
+systemctl restart php*-fpm 2>/dev/null || true
+PHP_SVC=$(systemctl list-unit-files --type=service 2>/dev/null | grep -E "php.*-fpm" | awk '{print $1}' | head -n 1 || echo "")
+if [ -n "$PHP_SVC" ]; then
+    systemctl restart "$PHP_SVC" 2>/dev/null || true
+fi
+systemctl restart asterisk 2>/dev/null || true
+systemctl restart fail2ban 2>/dev/null || true
+systemctl restart nginx 2>/dev/null || true
+
+echo ""
+echo "=========================================================="
+echo " [OK] Réparation terminée ! Toutes les permissions sont actives."
+echo "=========================================================="
+/var/www/nexus-pbx/scripts/nexus-banner.sh --force || true