Fix: add systemd ReadWritePaths override for PHP-FPM ProtectSystem

install.sh

@@ -187,6 +187,19 @@ www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/syste
 EOF
 chmod 0440 /etc/sudoers.d/nexus-pbx
 
+# Autorisation d'écriture systemd pour PHP-FPM (Debian 12/13 ProtectSystem=full)
+for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*-fpm.service; do
+    if [ -f "$fpm_svc" ]; then
+        svc_name=$(basename "$fpm_svc")
+        mkdir -p "/etc/systemd/system/${svc_name}.d"
+        cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
+[Service]
+ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log
+EOF_OVERRIDE
+    fi
+done
+systemctl daemon-reload
+
 # 5. Configuration d'Asterisk & Certificats TLS de secours
 echo -e "${C_GREEN}[4/8] Configuration du moteur Asterisk PJSIP & AMI...${C_RESET}"
 

scripts/fix.sh

@@ -81,6 +81,19 @@ www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/syste
 EOF
 chmod 0440 /etc/sudoers.d/nexus-pbx
 
+echo "-> Autorisation d'écriture systemd pour PHP-FPM (Debian 12/13 ProtectSystem)..."
+for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*-fpm.service; do
+    if [ -f "$fpm_svc" ]; then
+        svc_name=$(basename "$fpm_svc")
+        mkdir -p "/etc/systemd/system/${svc_name}.d"
+        cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
+[Service]
+ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log
+EOF_OVERRIDE
+    fi
+done
+systemctl daemon-reload
+
 echo "-> Génération des configurations Asterisk..."
 php -r '
 require_once "/var/www/nexus-pbx/src/Database.php";