Fix installer package dependencies and guarantee asterisk user/group creation
This commit is contained in:
sorcier committed
1 parent
502543e134
commit
8326208a2c
1 file changed
+49
-9
+49
-9
@@ -37,6 +37,10 @@ fi
|
||||
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
# Pré-configuration debconf pour iptables-persistent (évite tout blocage interactif)
|
||||
echo "iptables-persistent iptables-persistent/autosave_v4 boolean true" | debconf-set-selections 2>/dev/null || true
|
||||
echo "iptables-persistent iptables-persistent/autosave_v6 boolean true" | debconf-set-selections 2>/dev/null || true
|
||||
|
||||
# 2. Mise à jour des dépôts APT et installation des dépendances système
|
||||
echo -e "${C_GREEN}[1/8] Mise à jour des paquets et installation des dépendances...${C_RESET}"
|
||||
apt-get update -y
|
||||
@@ -55,12 +59,14 @@ apt-get install -y --no-install-recommends \
|
||||
iptables \
|
||||
iptables-persistent
|
||||
|
||||
# Asterisk et banques de sons françaises
|
||||
# Asterisk (Moteur SIP)
|
||||
apt-get install -y asterisk
|
||||
|
||||
# Sons Asterisk en français (installés séparément sans bloquer si un encodage manque)
|
||||
apt-get install -y --no-install-recommends \
|
||||
asterisk \
|
||||
asterisk-core-sounds-fr-wav \
|
||||
asterisk-core-sounds-fr-g722 \
|
||||
asterisk-sounds-main || true
|
||||
asterisk-core-sounds-en-wav 2>/dev/null || true
|
||||
|
||||
# Nginx, PHP-FPM et extensions requises
|
||||
apt-get install -y --no-install-recommends \
|
||||
@@ -79,6 +85,20 @@ apt-get install -y --no-install-recommends \
|
||||
certbot \
|
||||
python3-certbot-nginx
|
||||
|
||||
# Création défensive et garantie des groupes et utilisateurs système
|
||||
if ! getent group asterisk >/dev/null 2>&1; then
|
||||
groupadd -r asterisk
|
||||
fi
|
||||
if ! getent passwd asterisk >/dev/null 2>&1; then
|
||||
useradd -r -g asterisk -d /var/lib/asterisk -s /usr/sbin/nologin asterisk
|
||||
fi
|
||||
if ! getent group www-data >/dev/null 2>&1; then
|
||||
groupadd -r www-data
|
||||
fi
|
||||
if ! getent passwd www-data >/dev/null 2>&1; then
|
||||
useradd -r -g www-data -d /var/www -s /usr/sbin/nologin www-data
|
||||
fi
|
||||
|
||||
# 3. Déploiement / Clonage du code source NexusPBX
|
||||
echo -e "${C_GREEN}[2/8] Préparation et déploiement des fichiers NexusPBX...${C_RESET}"
|
||||
TARGET_DIR="/var/www/nexus-pbx"
|
||||
@@ -87,6 +107,7 @@ if [ -d "$TARGET_DIR/.git" ]; then
|
||||
echo " -> Dépôt NexusPBX déjà présent dans $TARGET_DIR, mise à jour..."
|
||||
cd "$TARGET_DIR"
|
||||
git config --global --add safe.directory "$TARGET_DIR" 2>/dev/null || true
|
||||
git pull origin main 2>/dev/null || true
|
||||
elif [ -d "$PWD/public" ] && [ -d "$PWD/src" ]; then
|
||||
echo " -> Exécution depuis le dossier source, synchronisation vers $TARGET_DIR..."
|
||||
if [ "$PWD" != "$TARGET_DIR" ]; then
|
||||
@@ -106,7 +127,7 @@ echo -e "${C_GREEN}[3/8] Configuration des permissions et de l'arborescence...${
|
||||
usermod -aG asterisk www-data 2>/dev/null || true
|
||||
usermod -aG www-data asterisk 2>/dev/null || true
|
||||
|
||||
# Création des dossiers nécessaires
|
||||
# Création de l'ensemble des répertoires requis
|
||||
mkdir -p "$TARGET_DIR/storage/backups"
|
||||
mkdir -p "$TARGET_DIR/storage/system_backups"
|
||||
mkdir -p "$TARGET_DIR/storage/sounds"
|
||||
@@ -114,8 +135,12 @@ mkdir -p "$TARGET_DIR/public/avatars"
|
||||
mkdir -p /etc/asterisk/keys
|
||||
mkdir -p /var/lib/asterisk/sounds/custom
|
||||
mkdir -p /var/spool/asterisk/voicemail/default
|
||||
mkdir -p /var/log/asterisk
|
||||
mkdir -p /var/log/nexus-pbx
|
||||
|
||||
touch /var/log/asterisk/messages
|
||||
chown asterisk:asterisk /var/log/asterisk/messages 2>/dev/null || true
|
||||
|
||||
# Droits applicatifs stricts
|
||||
chown -R www-data:asterisk "$TARGET_DIR"
|
||||
chmod 2775 "$TARGET_DIR/storage" \
|
||||
@@ -138,7 +163,7 @@ chmod 0440 /etc/sudoers.d/nexus-pbx
|
||||
# 5. Configuration d'Asterisk & Certificats TLS de secours
|
||||
echo -e "${C_GREEN}[4/8] Configuration du moteur Asterisk PJSIP & AMI...${C_RESET}"
|
||||
|
||||
# AMI Manager
|
||||
# AMI Manager (/etc/asterisk/manager.conf)
|
||||
cat << 'EOF' > /etc/asterisk/manager.conf
|
||||
[general]
|
||||
enabled = yes
|
||||
@@ -157,6 +182,20 @@ EOF
|
||||
chown asterisk:asterisk /etc/asterisk/manager.conf
|
||||
chmod 0640 /etc/asterisk/manager.conf
|
||||
|
||||
# Fichier de logs pour Fail2ban
|
||||
if [ ! -f /etc/asterisk/logger.conf ] || ! grep -q 'security' /etc/asterisk/logger.conf 2>/dev/null; then
|
||||
cat << 'EOF' > /etc/asterisk/logger.conf
|
||||
[general]
|
||||
dateformat=%F %T
|
||||
|
||||
[logfiles]
|
||||
console => notice,warning,error
|
||||
messages => notice,warning,error,security
|
||||
EOF
|
||||
chown asterisk:asterisk /etc/asterisk/logger.conf 2>/dev/null || true
|
||||
chmod 0644 /etc/asterisk/logger.conf 2>/dev/null || true
|
||||
fi
|
||||
|
||||
# Certificat TLS auto-signé initial pour PJSIP TLS (port 5061) et Nginx HTTPS (port 8443)
|
||||
if [ ! -f /etc/asterisk/keys/asterisk.crt ] || [ ! -f /etc/asterisk/keys/asterisk.key ]; then
|
||||
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
|
||||
@@ -170,10 +209,11 @@ if [ ! -f /etc/asterisk/keys/active_cert.crt ]; then
|
||||
cp -f /etc/asterisk/keys/asterisk.key /etc/asterisk/keys/active_key.key
|
||||
fi
|
||||
|
||||
chown asterisk:asterisk /etc/asterisk/keys/*
|
||||
chmod 0640 /etc/asterisk/keys/*
|
||||
chown asterisk:asterisk /etc/asterisk/keys/* 2>/dev/null || true
|
||||
chmod 0640 /etc/asterisk/keys/* 2>/dev/null || true
|
||||
|
||||
# Inclusions custom dans Asterisk
|
||||
touch /etc/asterisk/pjsip.conf /etc/asterisk/extensions.conf
|
||||
touch /etc/asterisk/pjsip.custom.conf /etc/asterisk/extensions.custom.conf
|
||||
if ! grep -q 'pjsip.custom.conf' /etc/asterisk/pjsip.conf 2>/dev/null; then
|
||||
printf '\n#tryinclude "pjsip.custom.conf"\n' >> /etc/asterisk/pjsip.conf
|
||||
@@ -181,7 +221,7 @@ fi
|
||||
if ! grep -q 'extensions.custom.conf' /etc/asterisk/extensions.conf 2>/dev/null; then
|
||||
printf '\n#tryinclude "extensions.custom.conf"\n' >> /etc/asterisk/extensions.conf
|
||||
fi
|
||||
chown asterisk:asterisk /etc/asterisk/pjsip* /etc/asterisk/extensions*
|
||||
chown asterisk:asterisk /etc/asterisk/pjsip* /etc/asterisk/extensions* 2>/dev/null || true
|
||||
chmod 0664 /etc/asterisk/pjsip.conf /etc/asterisk/extensions.conf 2>/dev/null || true
|
||||
chmod 0660 /etc/asterisk/*.custom.conf 2>/dev/null || true
|
||||
|
||||
@@ -321,7 +361,7 @@ echo -e "${C_GREEN}[8/8] Démarrage et activation des services système...${C_RE
|
||||
systemctl daemon-reload
|
||||
|
||||
# Redémarrage PHP-FPM
|
||||
PHP_SVC=$(systemctl list-unit-files --type=service | grep -E "php.*-fpm" | awk '{print $1}' | head -n 1 || echo "php8.4-fpm")
|
||||
PHP_SVC=$(systemctl list-unit-files --type=service 2>/dev/null | grep -E "php.*-fpm" | awk '{print $1}' | head -n 1 || echo "php8.4-fpm")
|
||||
systemctl restart "$PHP_SVC" && systemctl enable "$PHP_SVC"
|
||||
|
||||
# Redémarrage Asterisk, Nginx, Fail2ban, Cron
|
||||
|
||||
Reference in new issue
Block a user