fix(ucp,ha): auto-déploiement UCP, check SQLite PDO/SQLite3::backup HA, refresh comptes UCP (v2.5.1)

src/FirewallManager.php

@@ -673,18 +673,62 @@ EOF;
     public static function ensureUcpFail2banArtifacts(): void
     {
         $filterContent = "[Definition]\nfailregex = ^.*\\[NEXUS-UCP-AUTH-FAIL\\]:\\s*<HOST>.*$\nignoreregex =\n";
-        if (!file_exists(self::UCP_FILTER_PATH) || file_get_contents(self::UCP_FILTER_PATH) !== $filterContent) {
-            @file_put_contents(self::UCP_FILTER_PATH, $filterContent);
-            @chmod(self::UCP_FILTER_PATH, 0644);
+        $isNonRoot = function_exists('posix_geteuid') && posix_geteuid() !== 0;
+
+        if (!file_exists(self::UCP_FILTER_PATH) || @file_get_contents(self::UCP_FILTER_PATH) !== $filterContent) {
+            if (@file_put_contents(self::UCP_FILTER_PATH, $filterContent) !== false) {
+                @chmod(self::UCP_FILTER_PATH, 0644);
+            } elseif ($isNonRoot) {
+                @exec('sudo -n /var/www/nexus-pbx/scripts/nexus-firewall init-ucp >/dev/null 2>&1');
+                return;
+            }
         }
         if (!file_exists(self::UCP_SECURITY_LOG)) {
-            @touch(self::UCP_SECURITY_LOG);
+            if (@touch(self::UCP_SECURITY_LOG) === false && $isNonRoot) {
+                @exec('sudo -n /var/www/nexus-pbx/scripts/nexus-firewall init-ucp >/dev/null 2>&1');
+                return;
+            }
         }
         @chown(self::UCP_SECURITY_LOG, 'www-data');
         @chgrp(self::UCP_SECURITY_LOG, 'asterisk');
         @chmod(self::UCP_SECURITY_LOG, 0664);
     }
 
+    /**
+     * Auto-déploie les VHosts Nginx UCP et le filtre Fail2ban si absents (ex. après git pull).
+     */
+    public static function ensureUcpDeployed(): void
+    {
+        $st = self::getSettings();
+        if (empty($st['ucp_enabled'])) {
+            return;
+        }
+        $httpsPort = (int)($st['ucp_https_port'] ?? 8444);
+        $httpPort  = (int)($st['ucp_http_port'] ?? 8084);
+        if ($httpsPort <= 0 && $httpPort <= 0) {
+            return;
+        }
+
+        $nginxFile   = '/etc/nginx/sites-available/nexus-pbx';
+        $nginxConf   = is_readable($nginxFile) ? (string)@file_get_contents($nginxFile) : '';
+        $hasNginxUcp = str_contains($nginxConf, self::UCP_ROOT_DIR);
+        $hasFilter   = file_exists(self::UCP_FILTER_PATH);
+        $hasLog      = file_exists(self::UCP_SECURITY_LOG);
+
+        if ($hasNginxUcp && $hasFilter && $hasLog) {
+            return;
+        }
+
+        if (function_exists('posix_geteuid') && posix_geteuid() !== 0) {
+            exec('sudo -n /var/www/nexus-pbx/scripts/nexus-firewall init-ucp 2>&1', $out, $code);
+            if ($code === 0) {
+                return;
+            }
+        }
+
+        self::saveSettings($st);
+    }
+
     /**
      * Ouvre/ferme les ports UCP configurés dans UFW / iptables uniquement si un filtrage actif existe.
      */