Fix: convert audio in storage/sounds first to prevent Permission Denied on /var/lib/asterisk/sounds, fix ACLs and systemd ReadWritePaths

install.sh

@@ -176,12 +176,13 @@ chmod 2775 "$TARGET_DIR/storage" \
            "$TARGET_DIR/storage/sounds" \
            "$TARGET_DIR/public/avatars"
 
+mkdir -p /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk/voicemail
 chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk
-chmod -R 775 /etc/asterisk
+chmod -R 775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk
-chmod 2775 /etc/asterisk
+chmod 2775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk
 chmod 2750 /etc/asterisk/keys
-setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
+setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
-setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
+setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
 
 # Droits sudoers pour l'interface web (www-data)
 cat << 'EOF' > /etc/sudoers.d/nexus-pbx
@@ -197,7 +198,7 @@ for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*
         mkdir -p "/etc/systemd/system/${svc_name}.d"
         cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
 [Service]
-ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log
+ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk
 EOF_OVERRIDE
     fi
 done

public/api.php

@@ -699,43 +699,56 @@ try {
             $targetAlaw = "{$customDir}/{$slug}.alaw";
             $targetMp3  = "{$storeDir}/{$slug}.mp3";
 
+            // Fichiers de travail dans storage/sounds (garanti accessible en écriture par www-data)
+            $storeWav  = "{$storeDir}/{$slug}.wav";
+            $storeAlaw = "{$storeDir}/{$slug}.alaw";
+
             // 1. Conversion Asterisk WAV (8kHz mono 16-bit PCM)
-            $cmdWav = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -c:a pcm_s16le %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetWav));
+            $cmdWav = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -c:a pcm_s16le %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($storeWav));
             exec($cmdWav, $outWav, $retWav);
             if ($retWav !== 0) {
+                @unlink($storeWav);
                 throw new RuntimeException("Erreur de conversion audio WAV Asterisk : " . implode("\n", $outWav));
             }
 
             // 2. Conversion Asterisk ALAW (G.711a 8kHz mono)
-            $cmdAlaw = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -f alaw %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetAlaw));
+            $cmdAlaw = sprintf('ffmpeg -y -i %s -ar 8000 -ac 1 -f alaw %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($storeAlaw));
             exec($cmdAlaw, $outAlaw, $retAlaw);
 
             // 3. Conversion MP3 Web preview
             $cmdMp3 = sprintf('ffmpeg -y -i %s -c:a libmp3lame -b:a 128k %s 2>&1', escapeshellarg($tmpPath), escapeshellarg($targetMp3));
             exec($cmdMp3, $outMp3, $retMp3);
 
-            // 4. Si musique d'attente (MOH), copier dans le dossier MOH correspondant
+            // 4. Copie vers les dossiers Asterisk custom
+            @copy($storeWav, $targetWav);
+            if (file_exists($storeAlaw)) {
+                @copy($storeAlaw, $targetAlaw);
+            }
+
+            // 5. Si musique d'attente (MOH), copier dans le dossier MOH correspondant
             if ($usageType === 'moh') {
                 $siteSlug = preg_replace('/[^a-z0-9]+/i', '-', strtolower($siteCategory));
                 $siteSlug = trim($siteSlug, '-') ?: 'default';
                 if ($siteSlug === 'global') $siteSlug = 'default';
                 $siteMohDir = "{$mohBase}/{$siteSlug}";
                 @mkdir($siteMohDir, 0775, true);
-                @copy($targetWav, "{$siteMohDir}/{$slug}.wav");
+                @copy($storeWav, "{$siteMohDir}/{$slug}.wav");
-                @copy($targetAlaw, "{$siteMohDir}/{$slug}.alaw");
+                if (file_exists($storeAlaw)) {
+                    @copy($storeAlaw, "{$siteMohDir}/{$slug}.alaw");
+                }
                 @chown($siteMohDir, 'www-data');
                 @chgrp($siteMohDir, 'asterisk');
             }
 
             // Calcul de la durée en secondes
-            $cmdDur = sprintf('ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 %s 2>&1', escapeshellarg($targetWav));
+            $cmdDur = sprintf('ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 %s 2>&1', escapeshellarg($storeWav));
             $durStr = trim((string)shell_exec($cmdDur));
             $durationSec = max(1, (int)round((float)$durStr));
 
             // Permissions
-            @chown($targetWav, 'www-data');  @chgrp($targetWav, 'asterisk');
+            @chown($storeWav, 'www-data');   @chgrp($storeWav, 'asterisk');   @chmod($storeWav, 0664);
-            @chown($targetAlaw, 'www-data'); @chgrp($targetAlaw, 'asterisk');
+            @chown($targetWav, 'asterisk');  @chgrp($targetWav, 'asterisk');  @chmod($targetWav, 0664);
-            @chown($targetMp3, 'www-data');  @chgrp($targetMp3, 'asterisk');
+            @chown($targetMp3, 'www-data');  @chgrp($targetMp3, 'asterisk');  @chmod($targetMp3, 0664);
 
             $stmt = $db->prepare('
                 INSERT INTO sounds (name, slug, site_category, usage_type, description, filename, original_filename, duration_sec, file_size, format)

scripts/fix.sh

@@ -69,14 +69,15 @@ touch /etc/asterisk/pjsip.conf \
       /etc/asterisk/rtp.conf \
       /etc/asterisk/features.conf 2>/dev/null || true
 
+mkdir -p /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk/voicemail 2>/dev/null || true
 chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk 2>/dev/null || true
-chmod -R 775 /etc/asterisk
+chmod -R 775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
-chmod 2775 /etc/asterisk
+chmod 2775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
 chmod 2750 /etc/asterisk/keys 2>/dev/null || true
 chmod 0664 /etc/asterisk/*.conf /etc/asterisk/*.custom.conf 2>/dev/null || true
 
-setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
+setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
-setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
+setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
 
 chown root:asterisk /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
 chmod 0664 /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
@@ -94,7 +95,7 @@ for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*
         mkdir -p "/etc/systemd/system/${svc_name}.d"
         cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
 [Service]
-ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log
+ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk
 EOF_OVERRIDE
     fi
 done