diff --git a/install.sh b/install.sh
index 69d15fc..236eb87 100755
--- a/install.sh
+++ b/install.sh
@@ -37,6 +37,10 @@ fi
 
 export DEBIAN_FRONTEND=noninteractive
 
+# Pré-configuration debconf pour iptables-persistent (évite tout blocage interactif)
+echo "iptables-persistent iptables-persistent/autosave_v4 boolean true" | debconf-set-selections 2>/dev/null || true
+echo "iptables-persistent iptables-persistent/autosave_v6 boolean true" | debconf-set-selections 2>/dev/null || true
+
 # 2. Mise à jour des dépôts APT et installation des dépendances système
 echo -e "${C_GREEN}[1/8] Mise à jour des paquets et installation des dépendances...${C_RESET}"
 apt-get update -y
@@ -55,12 +59,14 @@ apt-get install -y --no-install-recommends \
     iptables \
     iptables-persistent
 
-# Asterisk et banques de sons françaises
+# Asterisk (Moteur SIP)
+apt-get install -y asterisk
+
+# Sons Asterisk en français (installés séparément sans bloquer si un encodage manque)
 apt-get install -y --no-install-recommends \
-    asterisk \
     asterisk-core-sounds-fr-wav \
     asterisk-core-sounds-fr-g722 \
-    asterisk-sounds-main || true
+    asterisk-core-sounds-en-wav 2>/dev/null || true
 
 # Nginx, PHP-FPM et extensions requises
 apt-get install -y --no-install-recommends \
@@ -79,6 +85,20 @@ apt-get install -y --no-install-recommends \
     certbot \
     python3-certbot-nginx
 
+# Création défensive et garantie des groupes et utilisateurs système
+if ! getent group asterisk >/dev/null 2>&1; then
+    groupadd -r asterisk
+fi
+if ! getent passwd asterisk >/dev/null 2>&1; then
+    useradd -r -g asterisk -d /var/lib/asterisk -s /usr/sbin/nologin asterisk
+fi
+if ! getent group www-data >/dev/null 2>&1; then
+    groupadd -r www-data
+fi
+if ! getent passwd www-data >/dev/null 2>&1; then
+    useradd -r -g www-data -d /var/www -s /usr/sbin/nologin www-data
+fi
+
 # 3. Déploiement / Clonage du code source NexusPBX
 echo -e "${C_GREEN}[2/8] Préparation et déploiement des fichiers NexusPBX...${C_RESET}"
 TARGET_DIR="/var/www/nexus-pbx"
@@ -87,6 +107,7 @@ if [ -d "$TARGET_DIR/.git" ]; then
     echo "  -> Dépôt NexusPBX déjà présent dans $TARGET_DIR, mise à jour..."
     cd "$TARGET_DIR"
     git config --global --add safe.directory "$TARGET_DIR" 2>/dev/null || true
+    git pull origin main 2>/dev/null || true
 elif [ -d "$PWD/public" ] && [ -d "$PWD/src" ]; then
     echo "  -> Exécution depuis le dossier source, synchronisation vers $TARGET_DIR..."
     if [ "$PWD" != "$TARGET_DIR" ]; then
@@ -106,7 +127,7 @@ echo -e "${C_GREEN}[3/8] Configuration des permissions et de l'arborescence...${
 usermod -aG asterisk www-data 2>/dev/null || true
 usermod -aG www-data asterisk 2>/dev/null || true
 
-# Création des dossiers nécessaires
+# Création de l'ensemble des répertoires requis
 mkdir -p "$TARGET_DIR/storage/backups"
 mkdir -p "$TARGET_DIR/storage/system_backups"
 mkdir -p "$TARGET_DIR/storage/sounds"
@@ -114,8 +135,12 @@ mkdir -p "$TARGET_DIR/public/avatars"
 mkdir -p /etc/asterisk/keys
 mkdir -p /var/lib/asterisk/sounds/custom
 mkdir -p /var/spool/asterisk/voicemail/default
+mkdir -p /var/log/asterisk
 mkdir -p /var/log/nexus-pbx
 
+touch /var/log/asterisk/messages
+chown asterisk:asterisk /var/log/asterisk/messages 2>/dev/null || true
+
 # Droits applicatifs stricts
 chown -R www-data:asterisk "$TARGET_DIR"
 chmod 2775 "$TARGET_DIR/storage" \
@@ -138,7 +163,7 @@ chmod 0440 /etc/sudoers.d/nexus-pbx
 # 5. Configuration d'Asterisk & Certificats TLS de secours
 echo -e "${C_GREEN}[4/8] Configuration du moteur Asterisk PJSIP & AMI...${C_RESET}"
 
-# AMI Manager
+# AMI Manager (/etc/asterisk/manager.conf)
 cat << 'EOF' > /etc/asterisk/manager.conf
 [general]
 enabled = yes
@@ -157,6 +182,20 @@ EOF
 chown asterisk:asterisk /etc/asterisk/manager.conf
 chmod 0640 /etc/asterisk/manager.conf
 
+# Fichier de logs pour Fail2ban
+if [ ! -f /etc/asterisk/logger.conf ] || ! grep -q 'security' /etc/asterisk/logger.conf 2>/dev/null; then
+    cat << 'EOF' > /etc/asterisk/logger.conf
+[general]
+dateformat=%F %T
+
+[logfiles]
+console => notice,warning,error
+messages => notice,warning,error,security
+EOF
+    chown asterisk:asterisk /etc/asterisk/logger.conf 2>/dev/null || true
+    chmod 0644 /etc/asterisk/logger.conf 2>/dev/null || true
+fi
+
 # Certificat TLS auto-signé initial pour PJSIP TLS (port 5061) et Nginx HTTPS (port 8443)
 if [ ! -f /etc/asterisk/keys/asterisk.crt ] || [ ! -f /etc/asterisk/keys/asterisk.key ]; then
     openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
@@ -170,10 +209,11 @@ if [ ! -f /etc/asterisk/keys/active_cert.crt ]; then
     cp -f /etc/asterisk/keys/asterisk.key /etc/asterisk/keys/active_key.key
 fi
 
-chown asterisk:asterisk /etc/asterisk/keys/*
-chmod 0640 /etc/asterisk/keys/*
+chown asterisk:asterisk /etc/asterisk/keys/* 2>/dev/null || true
+chmod 0640 /etc/asterisk/keys/* 2>/dev/null || true
 
 # Inclusions custom dans Asterisk
+touch /etc/asterisk/pjsip.conf /etc/asterisk/extensions.conf
 touch /etc/asterisk/pjsip.custom.conf /etc/asterisk/extensions.custom.conf
 if ! grep -q 'pjsip.custom.conf' /etc/asterisk/pjsip.conf 2>/dev/null; then
     printf '\n#tryinclude "pjsip.custom.conf"\n' >> /etc/asterisk/pjsip.conf
@@ -181,7 +221,7 @@ fi
 if ! grep -q 'extensions.custom.conf' /etc/asterisk/extensions.conf 2>/dev/null; then
     printf '\n#tryinclude "extensions.custom.conf"\n' >> /etc/asterisk/extensions.conf
 fi
-chown asterisk:asterisk /etc/asterisk/pjsip* /etc/asterisk/extensions*
+chown asterisk:asterisk /etc/asterisk/pjsip* /etc/asterisk/extensions* 2>/dev/null || true
 chmod 0664 /etc/asterisk/pjsip.conf /etc/asterisk/extensions.conf 2>/dev/null || true
 chmod 0660 /etc/asterisk/*.custom.conf 2>/dev/null || true
 
@@ -321,7 +361,7 @@ echo -e "${C_GREEN}[8/8] Démarrage et activation des services système...${C_RE
 systemctl daemon-reload
 
 # Redémarrage PHP-FPM
-PHP_SVC=$(systemctl list-unit-files --type=service | grep -E "php.*-fpm" | awk '{print $1}' | head -n 1 || echo "php8.4-fpm")
+PHP_SVC=$(systemctl list-unit-files --type=service 2>/dev/null | grep -E "php.*-fpm" | awk '{print $1}' | head -n 1 || echo "php8.4-fpm")
 systemctl restart "$PHP_SVC" && systemctl enable "$PHP_SVC"
 
 # Redémarrage Asterisk, Nginx, Fail2ban, Cron