Initial commit - NexusPBX IP Telephony Platform
This commit is contained in:
sorcier committed
commit
c5de8d0c71
25 files changed
+18123
No files matched your search
Executable
+79
@@ -0,0 +1,79 @@
|
||||
#!/usr/bin/env php
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
require_once __DIR__ . '/../src/Database.php';
|
||||
require_once __DIR__ . '/../src/FirewallManager.php';
|
||||
|
||||
use App\Database;
|
||||
use App\FirewallManager;
|
||||
|
||||
$cmd = strtolower($argv[1] ?? 'status');
|
||||
|
||||
switch ($cmd) {
|
||||
case 'status':
|
||||
$st = FirewallManager::getStatus(true);
|
||||
$settings = $st['settings'];
|
||||
echo "=== Statut Pare-feu & Sécurité NexusPBX ===\n";
|
||||
echo "• Service Fail2ban : " . ($st['is_running'] ? "\033[32mACTIF (En ligne)\033[0m" : "\033[31mARRÊTÉ\033[0m") . "\n";
|
||||
echo "• Pare-feu & Filtrage : " . ($settings['firewall_enabled'] ? "\033[32mACTIF\033[0m" : "\033[33mINACTIF\033[0m") . "\n";
|
||||
echo "• Mode Strict Certbot 80 : " . ($settings['certbot_strict_port80'] ? "OUI (Port 80 ACME seul)" : "NON (Port 80 ouvert)") . "\n";
|
||||
echo "• Port HTTPS Admin : " . ($settings['admin_https_port'] ?? 8443) . "\n";
|
||||
echo "• Total IPs Bannies : " . $st['total_banned'] . "\n";
|
||||
if (!empty($st['banned_ips'])) {
|
||||
echo "\nListe des IPs bannies :\n";
|
||||
foreach ($st['banned_ips'] as $b) {
|
||||
echo " - {$b['ip']} (Prison: {$b['jail']} - {$b['jail_label']})\n";
|
||||
}
|
||||
}
|
||||
echo "===========================================\n";
|
||||
break;
|
||||
|
||||
case 'on':
|
||||
case 'enable':
|
||||
$db = Database::getConnection();
|
||||
$db->exec("UPDATE settings SET firewall_enabled = 1, certbot_strict_port80 = 1 WHERE id = 1");
|
||||
shell_exec('systemctl start fail2ban 2>&1');
|
||||
$settings = FirewallManager::getSettings();
|
||||
FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 1);
|
||||
@unlink('/tmp/nexus_fw_status_cache.json');
|
||||
echo "\033[32m[OK] Pare-feu NexusPBX activé avec succès (Mode Strict + Fail2ban démarré).\033[0m\n";
|
||||
break;
|
||||
|
||||
case 'off':
|
||||
case 'disable':
|
||||
$db = Database::getConnection();
|
||||
$db->exec("UPDATE settings SET firewall_enabled = 0, certbot_strict_port80 = 0 WHERE id = 1");
|
||||
shell_exec('systemctl stop fail2ban 2>&1');
|
||||
$settings = FirewallManager::getSettings();
|
||||
FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 0);
|
||||
@unlink('/tmp/nexus_fw_status_cache.json');
|
||||
echo "\033[33m[OK] Pare-feu NexusPBX désactivé (Mode normal + Fail2ban arrêté).\033[0m\n";
|
||||
break;
|
||||
|
||||
case 'unban':
|
||||
$ip = $argv[2] ?? '';
|
||||
if (!$ip) {
|
||||
echo "Usage: nexus-firewall unban <ip>\n";
|
||||
exit(1);
|
||||
}
|
||||
$res = FirewallManager::unbanIp($ip, 'all');
|
||||
echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
|
||||
break;
|
||||
|
||||
case 'ban':
|
||||
$ip = $argv[2] ?? '';
|
||||
$jail = $argv[3] ?? 'asterisk';
|
||||
if (!$ip) {
|
||||
echo "Usage: nexus-firewall ban <ip> [jail]\n";
|
||||
exit(1);
|
||||
}
|
||||
$res = FirewallManager::banIp($ip, $jail);
|
||||
echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
|
||||
break;
|
||||
|
||||
default:
|
||||
echo "Usage: nexus-firewall [status|on|off|ban <ip>|unban <ip>]\n";
|
||||
exit(1);
|
||||
}
|
||||
|
||||
Executable
+23
@@ -0,0 +1,23 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
/**
|
||||
* Script d'automatisation des sauvegardes périodiques NexusPBX
|
||||
* Exécuté automatiquement par cron (ex: toutes les heures ou selon la fréquence programmée)
|
||||
*/
|
||||
|
||||
require_once __DIR__ . '/../src/Database.php';
|
||||
require_once __DIR__ . '/../src/ConfigGenerator.php';
|
||||
require_once __DIR__ . '/../src/AmiClient.php';
|
||||
require_once __DIR__ . '/../src/BackupManager.php';
|
||||
|
||||
use App\BackupManager;
|
||||
|
||||
try {
|
||||
$result = BackupManager::runAutoBackupCron();
|
||||
echo date('[Y-m-d H:i:s] ') . "NexusPBX Backup Cron: " . json_encode($result, JSON_UNESCAPED_SLASHES) . "\n";
|
||||
} catch (Throwable $e) {
|
||||
echo date('[Y-m-d H:i:s] ') . "NexusPBX Backup Cron ERROR: " . $e->getMessage() . "\n";
|
||||
exit(1);
|
||||
}
|
||||
|
||||
Executable
+119
@@ -0,0 +1,119 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
echo "=== Configuration Debian pour NexusPBX ==="
|
||||
|
||||
# 1. Ajout de www-data au groupe asterisk
|
||||
usermod -aG asterisk www-data
|
||||
|
||||
# 2. Création d'un certificat TLS local de secours pour PJSIP TLS (port 5061)
|
||||
mkdir -p /etc/asterisk/keys
|
||||
if [ ! -f /etc/asterisk/keys/asterisk.crt ]; then
|
||||
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
|
||||
-keyout /etc/asterisk/keys/asterisk.key \
|
||||
-out /etc/asterisk/keys/asterisk.crt \
|
||||
-subj "/C=FR/ST=IDF/L=Paris/O=NexusPBX/CN=pbx.local" 2>/dev/null
|
||||
fi
|
||||
|
||||
# 3. Configuration de l'AMI (/etc/asterisk/manager.conf) sur 127.0.0.1:5038
|
||||
cat << 'EOF' > /etc/asterisk/manager.conf
|
||||
[general]
|
||||
enabled = yes
|
||||
port = 5038
|
||||
bindaddr = 127.0.0.1
|
||||
displayconnects = no
|
||||
timestampevents = yes
|
||||
|
||||
[pbxgui]
|
||||
secret = AsteriskAmi2026!
|
||||
deny = 0.0.0.0/0.0.0.0
|
||||
permit = 127.0.0.1/255.255.255.0
|
||||
read = all
|
||||
write = all
|
||||
EOF
|
||||
|
||||
# 4. Fichiers .custom.conf initiaux et inclusions dans pjsip.conf et extensions.conf
|
||||
touch /etc/asterisk/pjsip.custom.conf /etc/asterisk/extensions.custom.conf
|
||||
|
||||
if ! grep -q 'pjsip.custom.conf' /etc/asterisk/pjsip.conf; then
|
||||
printf '\n#tryinclude "pjsip.custom.conf"\n' >> /etc/asterisk/pjsip.conf
|
||||
fi
|
||||
|
||||
if ! grep -q 'extensions.custom.conf' /etc/asterisk/extensions.conf; then
|
||||
printf '\n#tryinclude "extensions.custom.conf"\n' >> /etc/asterisk/extensions.conf
|
||||
fi
|
||||
|
||||
# 5. Permissions Debian strictes pour asterisk:asterisk et accès groupe www-data
|
||||
chown -R asterisk:asterisk /etc/asterisk
|
||||
chmod 2775 /etc/asterisk
|
||||
chmod 2750 /etc/asterisk/keys
|
||||
chmod 0640 /etc/asterisk/keys/asterisk.key /etc/asterisk/keys/asterisk.crt
|
||||
chmod 0660 /etc/asterisk/pjsip.custom.conf /etc/asterisk/extensions.custom.conf
|
||||
chmod 0664 /etc/asterisk/pjsip.conf /etc/asterisk/extensions.conf
|
||||
chmod 0640 /etc/asterisk/manager.conf
|
||||
|
||||
# 6. Permissions du projet Web et des répertoires de stockage / sauvegardes
|
||||
mkdir -p /var/www/nexus-pbx/storage/backups
|
||||
mkdir -p /var/www/nexus-pbx/storage/system_backups
|
||||
mkdir -p /var/www/nexus-pbx/storage/sounds
|
||||
mkdir -p /var/lib/asterisk/sounds/custom
|
||||
mkdir -p /var/spool/asterisk/voicemail/default
|
||||
|
||||
chown -R www-data:asterisk /var/www/nexus-pbx
|
||||
chmod 2775 /var/www/nexus-pbx/storage /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /var/www/nexus-pbx/storage/sounds
|
||||
chown -R asterisk:asterisk /var/lib/asterisk/sounds /var/spool/asterisk/voicemail
|
||||
chmod -R g+rwX /var/lib/asterisk/sounds /var/spool/asterisk/voicemail
|
||||
|
||||
# Configuration du cron pour sauvegardes automatiques NexusPBX
|
||||
cat << 'EOF' > /etc/cron.d/nexus-backup
|
||||
# Sauvegardes programmées automatiques NexusPBX
|
||||
*/10 * * * * www-data /usr/bin/php /var/www/nexus-pbx/scripts/nexus_autobackup.php >> /var/log/nexus_backup.log 2>&1
|
||||
EOF
|
||||
chmod 0644 /etc/cron.d/nexus-backup
|
||||
touch /var/log/nexus_backup.log && chown www-data:asterisk /var/log/nexus_backup.log && chmod 664 /var/log/nexus_backup.log
|
||||
|
||||
# 7. Configuration du VirtualHost Nginx (Port 80)
|
||||
PHP_SOCK=$(find /run/php/ -name "php*-fpm.sock" | head -n 1)
|
||||
if [ -z "$PHP_SOCK" ]; then
|
||||
PHP_SOCK="/run/php/php8.4-fpm.sock"
|
||||
fi
|
||||
|
||||
cat << EOF > /etc/nginx/sites-available/nexus-pbx
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name _;
|
||||
|
||||
root /var/www/nexus-pbx/public;
|
||||
index index.php;
|
||||
|
||||
access_log /var/log/nginx/nexus-pbx.access.log;
|
||||
error_log /var/log/nginx/nexus-pbx.error.log;
|
||||
|
||||
location / {
|
||||
try_files \$uri \$uri/ /index.php?\$query_string;
|
||||
}
|
||||
|
||||
location ~ \.php\$ {
|
||||
include snippets/fastcgi-php.conf;
|
||||
fastcgi_pass unix:${PHP_SOCK};
|
||||
fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
|
||||
}
|
||||
|
||||
location ~ /\.(?!well-known).* {
|
||||
deny all;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
chown root:asterisk /etc/nginx/sites-available/nexus-pbx
|
||||
chmod 664 /etc/nginx/sites-available/nexus-pbx
|
||||
rm -f /etc/nginx/sites-enabled/default
|
||||
ln -sf /etc/nginx/sites-available/nexus-pbx /etc/nginx/sites-enabled/nexus-pbx
|
||||
|
||||
# 8. Redémarrage des services Debian
|
||||
systemctl restart php8.4-fpm
|
||||
nginx -t && systemctl restart nginx
|
||||
systemctl restart asterisk
|
||||
|
||||
echo "=== Déploiement NexusPBX terminé avec succès ==="
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
setup-debian.sh
|
||||
Executable
+29
@@ -0,0 +1,29 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
// Arguments transmis par Asterisk externpassnotify : <context> <mailbox> <newpassword>
|
||||
$context = $argv[1] ?? 'default';
|
||||
$mailbox = trim((string)($argv[2] ?? ''));
|
||||
$newPass = trim((string)($argv[3] ?? ''));
|
||||
|
||||
if ($mailbox === '' || $newPass === '') {
|
||||
exit(0);
|
||||
}
|
||||
|
||||
require_once __DIR__ . '/../src/Database.php';
|
||||
|
||||
try {
|
||||
$db = \App\Database::getConnection();
|
||||
$stmt = $db->prepare('
|
||||
UPDATE extensions
|
||||
SET voicemail_pin = :pin, force_pin_change = 0
|
||||
WHERE extension = :ext
|
||||
');
|
||||
$stmt->execute([
|
||||
':pin' => $newPass,
|
||||
':ext' => $mailbox,
|
||||
]);
|
||||
} catch (\Throwable $e) {
|
||||
error_log("[voicemail_pass_sync] Erreur synchronisation PIN : " . $e->getMessage());
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user