sorcier/NexusPBX
1
0 Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ucp): NexusPBX v2.5.0 Portail Utilisateur isolé (Refs #4)

Browse Source
This commit is contained in:
sorcier committed 2026-11-11 18:47:25 +01:00
1 parent 7922e338e3
commit 72e43f1a9a
18 files changed
+3499 -62
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

install.sh
+22 -10
View File
@@ -184,9 +184,9 @@ touch /var/log/asterisk/messages /var/log/asterisk/security.log /var/log/asteris
chown -R asterisk:asterisk /var/log/asterisk 2>/dev/null || true
chmod 0664 /var/log/asterisk/messages /var/log/asterisk/security.log /var/log/asterisk/cdr-csv/Master.csv 2>/dev/null || true
touch /var/log/nexus_security.log
chown www-data:asterisk /var/log/nexus_security.log 2>/dev/null || true
chmod 0664 /var/log/nexus_security.log 2>/dev/null || true
touch /var/log/nexus_security.log /var/log/nexus_ucp_security.log
chown www-data:asterisk /var/log/nexus_security.log /var/log/nexus_ucp_security.log 2>/dev/null || true
chmod 0664 /var/log/nexus_security.log /var/log/nexus_ucp_security.log 2>/dev/null || true
# Droits applicatifs stricts
chown -R www-data:asterisk "$TARGET_DIR"
@@ -195,6 +195,7 @@ chmod 2775 "$TARGET_DIR/storage" \
"$TARGET_DIR/storage/system_backups" \
"$TARGET_DIR/storage/sounds" \
"$TARGET_DIR/public/avatars"
[ -d "$TARGET_DIR/ucp" ] && chmod 0755 "$TARGET_DIR/ucp" "$TARGET_DIR/ucp/assets" 2>/dev/null || true
mkdir -p /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk/voicemail
chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk
@@ -207,7 +208,7 @@ setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/s
# Droits sudoers pour l'interface web (www-data)
cat << 'EOF' > /etc/sudoers.d/nexus-pbx
# Privilèges spécifiques NexusPBX pour l'utilisateur Web www-data
www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/systemctl, /usr/bin/fail2ban-client, /bin/fail2ban-client, /var/www/nexus-pbx/scripts/nexus-firewall, /usr/bin/certbot, /usr/sbin/nft, /usr/sbin/iptables, /var/www/nexus-pbx/scripts/update.sh, /usr/local/bin/nexus-update, /var/www/nexus-pbx/scripts/nexus-cluster
www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/systemctl, /usr/bin/fail2ban-client, /bin/fail2ban-client, /var/www/nexus-pbx/scripts/nexus-firewall, /usr/bin/certbot, /usr/sbin/nft, /usr/sbin/iptables, /usr/sbin/ufw, /var/www/nexus-pbx/scripts/update.sh, /usr/local/bin/nexus-update, /var/www/nexus-pbx/scripts/nexus-cluster
EOF
chmod 0440 /etc/sudoers.d/nexus-pbx
@@ -436,16 +437,22 @@ mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled
rm -f /etc/nginx/sites-enabled/default
ln -sf /etc/nginx/sites-available/nexus-pbx /etc/nginx/sites-enabled/nexus-pbx
# Application de la configuration Nginx complète (Ports 80, 8080, 8443)
# Application de la configuration Nginx complète (Ports Admin 80/8080/8443 + VHosts UCP isolés 8444/8084)
php -r '
require_once "/var/www/nexus-pbx/src/Database.php";
require_once "/var/www/nexus-pbx/src/FirewallManager.php";
$db = App\Database::getConnection();
$st = $db->query("SELECT admin_https_port, certbot_strict_port80 FROM settings WHERE id = 1")->fetch(PDO::FETCH_ASSOC);
App\FirewallManager::applyNginxConfig((int)($st["admin_https_port"] ?? 8443), (int)($st["certbot_strict_port80"] ?? 0));
$st = App\FirewallManager::getSettings();
App\FirewallManager::ensureUcpFail2banArtifacts();
App\FirewallManager::applyNginxConfig(
(int)($st["admin_https_port"] ?? 8443),
(int)($st["certbot_strict_port80"] ?? 0),
(int)($st["ucp_enabled"] ?? 1),
(int)($st["ucp_https_port"] ?? 8444),
(int)($st["ucp_http_port"] ?? 8084)
);
'
# Filtre Fail2ban pour l'interface Nexus-Web
# Filtre Fail2ban pour l'interface Nexus-Web et Portail UCP
cat << 'EOF' > /etc/fail2ban/filter.d/nexus-web.conf
[Definition]
failregex = ^.*\[NEXUS-WEB-AUTH-FAIL\]:\s*<HOST>.*$
@@ -465,7 +472,12 @@ App\FirewallManager::generateJailLocal(
(int)$st["fail2ban_sip_bantime"],
(int)$st["fail2ban_web_maxretry"],
(int)$st["fail2ban_web_bantime"],
(int)$st["admin_https_port"]
(int)$st["admin_https_port"],
(int)($st["ucp_enabled"] ?? 1),
(int)($st["ucp_https_port"] ?? 8444),
(int)($st["ucp_http_port"] ?? 8084),
(int)($st["fail2ban_ucp_maxretry"] ?? 3),
(int)($st["fail2ban_ucp_bantime"] ?? 3600)
);
'