Fix: permissions and ACLs for www-data on /etc/asterisk, fail2ban filters and logs, and AMI diagnostics loading

src/ConfigGenerator.php

@@ -1729,16 +1729,33 @@ class ConfigGenerator
 
         $tmpPath = $targetPath . '.tmp.' . getmypid();
         if (@file_put_contents($tmpPath, $content, LOCK_EX) === false) {
+            // Repli en écriture directe si le fichier existe déjà et est accessible
+            if (file_exists($targetPath) && is_writable($targetPath)) {
+                if (@file_put_contents($targetPath, $content, LOCK_EX) !== false) {
+                    @chgrp($targetPath, 'asterisk');
+                    @chmod($targetPath, 0664);
+                    return;
+                }
+            }
             throw new RuntimeException("Impossible d'écrire dans {$targetPath}. Vérifiez que www-data fait partie du groupe asterisk et que /etc/asterisk est accessible en écriture de groupe (chmod 2775).");
         }
 
         @chgrp($tmpPath, 'asterisk');
-        @chmod($tmpPath, 0660);
+        @chmod($tmpPath, 0664);
 
         if (!@rename($tmpPath, $targetPath)) {
             @unlink($tmpPath);
+            // Repli en écriture directe si le renommage échoue
+            if (@file_put_contents($targetPath, $content, LOCK_EX) !== false) {
+                @chgrp($targetPath, 'asterisk');
+                @chmod($targetPath, 0664);
+                return;
+            }
             throw new RuntimeException("Échec du remplacement atomique de {$targetPath}.");
         }
+
+        @chgrp($targetPath, 'asterisk');
+        @chmod($targetPath, 0664);
     }
 
     public static function normalizeInboundRoutes(string $json): array

src/FirewallManager.php

@@ -291,8 +291,6 @@ ignoreip = {$whitelist}
 findtime = {$sipFindTime}
 bantime = {$sipBanTime}
 maxretry = {$sipMaxRetry}
-banaction = nftables-multiport
-banaction_allports = nftables-allports
 
 [sshd]
 enabled = true
@@ -306,7 +304,7 @@ bantime = 3600
 [asterisk]
 enabled = true
 filter = asterisk
-logpath = /var/log/asterisk/security.log
+logpath = /var/log/asterisk/messages
 maxretry = {$sipMaxRetry}
 findtime = {$sipFindTime}
 bantime = {$sipBanTime}
@@ -326,6 +324,8 @@ protocol = tcp
 EOF;
 
         file_put_contents(self::JAIL_LOCAL_PATH, $conf);
+        @chgrp(self::JAIL_LOCAL_PATH, 'asterisk');
+        @chmod(self::JAIL_LOCAL_PATH, 0664);
     }
 
     /**
@@ -477,6 +477,8 @@ EOF;
 
         $fullNginxConfig = $port80Block . "\n\n" . $phonebookBlock . "\n\n" . $httpsBlock . "\n";
         file_put_contents(self::NGINX_CONF_PATH, $fullNginxConfig);
+        @chgrp(self::NGINX_CONF_PATH, 'asterisk');
+        @chmod(self::NGINX_CONF_PATH, 0664);
 
         // Test de syntaxe
         exec('sudo /usr/sbin/nginx -t 2>&1', $tOut, $tCode);

src/SystemChecker.php

@@ -6,6 +6,9 @@ namespace App;
 use PDO;
 use Throwable;
 
+require_once __DIR__ . '/ConfigGenerator.php';
+require_once __DIR__ . '/AmiClient.php';
+
 class SystemChecker
 {
     public static function runDiagnostics(PDO $db): array