Initial commit - NexusPBX IP Telephony Platform

scripts/nexus-firewall

@@ -0,0 +1,79 @@
+#!/usr/bin/env php
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/../src/Database.php';
+require_once __DIR__ . '/../src/FirewallManager.php';
+
+use App\Database;
+use App\FirewallManager;
+
+$cmd = strtolower($argv[1] ?? 'status');
+
+switch ($cmd) {
+    case 'status':
+        $st = FirewallManager::getStatus(true);
+        $settings = $st['settings'];
+        echo "=== Statut Pare-feu & Sécurité NexusPBX ===\n";
+        echo "• Service Fail2ban       : " . ($st['is_running'] ? "\033[32mACTIF (En ligne)\033[0m" : "\033[31mARRÊTÉ\033[0m") . "\n";
+        echo "• Pare-feu & Filtrage    : " . ($settings['firewall_enabled'] ? "\033[32mACTIF\033[0m" : "\033[33mINACTIF\033[0m") . "\n";
+        echo "• Mode Strict Certbot 80 : " . ($settings['certbot_strict_port80'] ? "OUI (Port 80 ACME seul)" : "NON (Port 80 ouvert)") . "\n";
+        echo "• Port HTTPS Admin       : " . ($settings['admin_https_port'] ?? 8443) . "\n";
+        echo "• Total IPs Bannies      : " . $st['total_banned'] . "\n";
+        if (!empty($st['banned_ips'])) {
+            echo "\nListe des IPs bannies :\n";
+            foreach ($st['banned_ips'] as $b) {
+                echo "  - {$b['ip']} (Prison: {$b['jail']} - {$b['jail_label']})\n";
+            }
+        }
+        echo "===========================================\n";
+        break;
+
+    case 'on':
+    case 'enable':
+        $db = Database::getConnection();
+        $db->exec("UPDATE settings SET firewall_enabled = 1, certbot_strict_port80 = 1 WHERE id = 1");
+        shell_exec('systemctl start fail2ban 2>&1');
+        $settings = FirewallManager::getSettings();
+        FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 1);
+        @unlink('/tmp/nexus_fw_status_cache.json');
+        echo "\033[32m[OK] Pare-feu NexusPBX activé avec succès (Mode Strict + Fail2ban démarré).\033[0m\n";
+        break;
+
+    case 'off':
+    case 'disable':
+        $db = Database::getConnection();
+        $db->exec("UPDATE settings SET firewall_enabled = 0, certbot_strict_port80 = 0 WHERE id = 1");
+        shell_exec('systemctl stop fail2ban 2>&1');
+        $settings = FirewallManager::getSettings();
+        FirewallManager::applyNginxConfig((int)$settings['admin_https_port'], 0);
+        @unlink('/tmp/nexus_fw_status_cache.json');
+        echo "\033[33m[OK] Pare-feu NexusPBX désactivé (Mode normal + Fail2ban arrêté).\033[0m\n";
+        break;
+
+    case 'unban':
+        $ip = $argv[2] ?? '';
+        if (!$ip) {
+            echo "Usage: nexus-firewall unban <ip>\n";
+            exit(1);
+        }
+        $res = FirewallManager::unbanIp($ip, 'all');
+        echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
+        break;
+
+    case 'ban':
+        $ip = $argv[2] ?? '';
+        $jail = $argv[3] ?? 'asterisk';
+        if (!$ip) {
+            echo "Usage: nexus-firewall ban <ip> [jail]\n";
+            exit(1);
+        }
+        $res = FirewallManager::banIp($ip, $jail);
+        echo ($res['success'] ? "\033[32m[OK]\033[0m " : "\033[31m[ERREUR]\033[0m ") . $res['message'] . "\n";
+        break;
+
+    default:
+        echo "Usage: nexus-firewall [status|on|off|ban <ip>|unban <ip>]\n";
+        exit(1);
+}
+