feat(ucp): NexusPBX v2.5.0 Portail Utilisateur isolé (Refs #4)

scripts/nexus-firewall

@@ -19,6 +19,8 @@ switch ($cmd) {
         echo "• Pare-feu & Filtrage    : " . ($settings['firewall_enabled'] ? "\033[32mACTIF\033[0m" : "\033[33mINACTIF\033[0m") . "\n";
         echo "• Mode Strict Certbot 80 : " . ($settings['certbot_strict_port80'] ? "OUI (Port 80 ACME seul)" : "NON (Port 80 ouvert)") . "\n";
         echo "• Port HTTPS Admin       : " . ($settings['admin_https_port'] ?? 8443) . "\n";
+        $ucpSt = !empty($settings['ucp_enabled']) ? "\033[32mACTIF\033[0m (HTTPS:" . ($settings['ucp_https_port'] ?? 8444) . " / HTTP:" . ($settings['ucp_http_port'] ?? 8084) . ")" : "\033[33mINACTIF\033[0m";
+        echo "• Portail Utilisateur UCP: " . $ucpSt . "\n";
         echo "• Total IPs Bannies      : " . $st['total_banned'] . "\n";
         if (!empty($st['banned_ips'])) {
             echo "\nListe des IPs bannies :\n";

scripts/update.sh

@@ -151,7 +151,7 @@ done
 # Mise à jour des privilèges sudoers (www-data) si accessible en écriture
 if [ -w /etc/sudoers.d ]; then
     cat << 'EOF_SUDO' > /etc/sudoers.d/nexus-pbx 2>/dev/null || true
-www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/systemctl, /usr/bin/fail2ban-client, /bin/fail2ban-client, /var/www/nexus-pbx/scripts/nexus-firewall, /usr/bin/certbot, /usr/sbin/nft, /usr/sbin/iptables, /var/www/nexus-pbx/scripts/update.sh, /usr/local/bin/nexus-update, /var/www/nexus-pbx/scripts/nexus-cluster
+www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/systemctl, /usr/bin/fail2ban-client, /bin/fail2ban-client, /var/www/nexus-pbx/scripts/nexus-firewall, /usr/bin/certbot, /usr/sbin/nft, /usr/sbin/iptables, /usr/sbin/ufw, /var/www/nexus-pbx/scripts/update.sh, /usr/local/bin/nexus-update, /var/www/nexus-pbx/scripts/nexus-cluster
 EOF_SUDO
     chmod 0440 /etc/sudoers.d/nexus-pbx 2>/dev/null || true
 fi
@@ -163,14 +163,48 @@ which ffmpeg >/dev/null 2>&1 && which rsync >/dev/null 2>&1 && which sox >/dev/n
     (apt-get update -y -qq && apt-get install -y -qq --no-install-recommends acl ffmpeg rsync sox sshpass keepalived iputils-arping) 2>/dev/null || true
 }
 
-# 4. Exécution des migrations SQLite et régénération Dialplan
-echo -e "${C_GRAY}[4/6] Exécution des migrations de base de données & régénération dialplan...${C_RESET}"
+# 4. Exécution des migrations SQLite, régénération Dialplan, Nginx & Fail2ban UCP
+echo -e "${C_GRAY}[4/6] Exécution des migrations de base de données & régénération dialplan/web...${C_RESET}"
+if [ -w /var/log ]; then
+    touch /var/log/nexus_ucp_security.log 2>/dev/null || true
+    chown www-data:asterisk /var/log/nexus_ucp_security.log 2>/dev/null || true
+    chmod 0664 /var/log/nexus_ucp_security.log 2>/dev/null || true
+fi
+[ -d "$APP_DIR/ucp" ] && chmod 0755 "$APP_DIR/ucp" "$APP_DIR/ucp/assets" 2>/dev/null || true
 php -r '
 require_once "/var/www/nexus-pbx/src/Database.php";
 require_once "/var/www/nexus-pbx/src/ConfigGenerator.php";
+require_once "/var/www/nexus-pbx/src/FirewallManager.php";
 $db = App\Database::getConnection(true);
 $gen = new App\ConfigGenerator($db);
 $gen->writeAllConfigs();
+try {
+    $st = App\FirewallManager::getSettings();
+    App\FirewallManager::ensureUcpFail2banArtifacts();
+    App\FirewallManager::applyNginxConfig(
+        (int)($st["admin_https_port"] ?? 8443),
+        (int)($st["certbot_strict_port80"] ?? 0),
+        (int)($st["ucp_enabled"] ?? 1),
+        (int)($st["ucp_https_port"] ?? 8444),
+        (int)($st["ucp_http_port"] ?? 8084)
+    );
+    App\FirewallManager::generateJailLocal(
+        (string)($st["fail2ban_whitelist_ips"] ?? ""),
+        (int)($st["fail2ban_sip_maxretry"] ?? 3),
+        (int)($st["fail2ban_sip_findtime"] ?? 600),
+        (int)($st["fail2ban_sip_bantime"] ?? 3600),
+        (int)($st["fail2ban_web_maxretry"] ?? 3),
+        (int)($st["fail2ban_web_bantime"] ?? 3600),
+        (int)($st["admin_https_port"] ?? 8443),
+        (int)($st["ucp_enabled"] ?? 1),
+        (int)($st["ucp_https_port"] ?? 8444),
+        (int)($st["ucp_http_port"] ?? 8084),
+        (int)($st["fail2ban_ucp_maxretry"] ?? 3),
+        (int)($st["fail2ban_ucp_bantime"] ?? 3600)
+    );
+} catch (\Throwable $e) {
+    fwrite(STDERR, "Warning UCP/Firewall update: " . $e->getMessage() . "\n");
+}
 '
 
 # 5. Fix permissions & ACLs
@@ -211,8 +245,9 @@ asterisk -rx "dialplan reload" >/dev/null 2>&1 || true
 if [ -t 1 ]; then
     systemctl reload php8.4-fpm 2>/dev/null || systemctl reload php8.2-fpm 2>/dev/null || systemctl reload php*-fpm 2>/dev/null || true
     systemctl reload nginx 2>/dev/null || true
+    fail2ban-client reload >/dev/null 2>&1 || true
 else
-    (nohup bash -c "sleep 2 && (systemctl reload php8.4-fpm 2>/dev/null || systemctl reload php8.2-fpm 2>/dev/null || systemctl reload php*-fpm 2>/dev/null || true); systemctl reload nginx 2>/dev/null || true" >/dev/null 2>&1 &)
+    (nohup bash -c "sleep 2 && (systemctl reload php8.4-fpm 2>/dev/null || systemctl reload php8.2-fpm 2>/dev/null || systemctl reload php*-fpm 2>/dev/null || true); systemctl reload nginx 2>/dev/null || true; fail2ban-client reload >/dev/null 2>&1 || true" >/dev/null 2>&1 &)
 fi
 
 NEW_VER="Inconnue"