fix(ha): orchestration Keepalived root, support unicast VRRP, preservation identite backup et synchro HTTPS

scripts/cluster/check_asterisk.sh

@@ -3,22 +3,22 @@
 # NexusPBX HA - Script de surveillance de santé d'Asterisk pour Keepalived VRRP
 # ==============================================================================
 set -euo pipefail
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
 
 # 1. Vérifie si le binaire et le démon asterisk tournent
 if ! pidof asterisk >/dev/null 2>&1; then
     exit 1
 fi
 
-# 2. Teste si Asterisk répond aux requêtes AMI/CLI (core ping)
-PING_RESP=$(asterisk -rx "core ping" 2>/dev/null || true)
+# 2. Teste si Asterisk répond aux requêtes CLI (core ping)
+PING_RESP=$(/usr/sbin/asterisk -rx "core ping" 2>/dev/null || true)
 if echo "$PING_RESP" | grep -q "Pong"; then
     exit 0
 fi
 
 # 3. Tentative alternative via core show version
-if asterisk -rx "core show version" >/dev/null 2>&1; then
+if /usr/sbin/asterisk -rx "core show version" >/dev/null 2>&1; then
     exit 0
 fi
 
 exit 1
-

scripts/cluster/notify_backup.sh

@@ -3,6 +3,7 @@
 # NexusPBX HA - Notification Keepalived : Transition vers l'état BACKUP / STANDBY
 # ==============================================================================
 set -euo pipefail
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
 
 LOG_FILE="/var/log/nexus_cluster.log"
 TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
@@ -15,6 +16,13 @@ if [ -f "$DB_PATH" ]; then
     sqlite3 "$DB_PATH" "UPDATE cluster_settings SET last_sync_status='standby_idle', updated_at=CURRENT_TIMESTAMP WHERE id=1;" 2>/dev/null || true
 fi
 
+# 2. Désenregistrement des Trunks PJSIP pour éviter les conflits d'appels entrants avec le Master
+if pidof asterisk >/dev/null 2>&1; then
+    /usr/sbin/asterisk -rx "pjsip send unregister *" >> "$LOG_FILE" 2>&1 || true
+    for reg in $(/usr/sbin/asterisk -rx "pjsip show registrations" 2>/dev/null | grep -o '[a-zA-Z0-9_\-]*-reg' | sort -u); do
+        /usr/sbin/asterisk -rx "pjsip send unregister $reg" >> "$LOG_FILE" 2>&1 || true
+    done
+fi
+
 echo "[$TIMESTAMP] [CLUSTER] Mode Standby actif. En écoute des battements de cœur VRRP." >> "$LOG_FILE"
 exit 0
-

scripts/cluster/notify_fault.sh

@@ -3,6 +3,7 @@
 # NexusPBX HA - Notification Keepalived : Transition vers l'état FAULT / ERREUR
 # ==============================================================================
 set -euo pipefail
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
 
 LOG_FILE="/var/log/nexus_cluster.log"
 TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
@@ -15,4 +16,3 @@ if [ -f "$DB_PATH" ]; then
 fi
 
 exit 0
-

scripts/cluster/notify_master.sh

@@ -3,6 +3,7 @@
 # NexusPBX HA - Notification Keepalived : Transition vers l'état MASTER
 # ==============================================================================
 set -euo pipefail
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
 
 LOG_FILE="/var/log/nexus_cluster.log"
 TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
@@ -17,8 +18,12 @@ fi
 
 # 2. Réactivation des enregistrements Trunks PJSIP et rechargement de la config
 if pidof asterisk >/dev/null 2>&1; then
-    asterisk -rx "pjsip reload" >> "$LOG_FILE" 2>&1 || true
-    asterisk -rx "dialplan reload" >> "$LOG_FILE" 2>&1 || true
+    /usr/sbin/asterisk -rx "pjsip reload" >> "$LOG_FILE" 2>&1 || true
+    /usr/sbin/asterisk -rx "pjsip send register *" >> "$LOG_FILE" 2>&1 || true
+    for reg in $(/usr/sbin/asterisk -rx "pjsip show registrations" 2>/dev/null | grep -o '[a-zA-Z0-9_\-]*-reg' | sort -u); do
+        /usr/sbin/asterisk -rx "pjsip send register $reg" >> "$LOG_FILE" 2>&1 || true
+    done
+    /usr/sbin/asterisk -rx "dialplan reload" >> "$LOG_FILE" 2>&1 || true
 fi
 
 # 3. Gratuitous ARP optionnel si arping est présent
@@ -30,4 +35,3 @@ fi
 
 echo "[$TIMESTAMP] [CLUSTER] Prise de relais MASTER terminée avec succès." >> "$LOG_FILE"
 exit 0
-

scripts/nexus-cluster

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# NexusPBX HA - Script Helper Root pour l'orchestration Keepalived
+# ==============================================================================
+set -euo pipefail
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH"
+
+CMD="${1:-status}"
+
+case "$CMD" in
+    apply)
+        # 1. Activation kernel sysctl pour liaison IP non-locale (indispensable HA)
+        sysctl -w net.ipv4.ip_nonlocal_bind=1 >/dev/null 2>&1 || true
+        if [ ! -f /etc/sysctl.d/99-nexus-ha.conf ]; then
+            echo "net.ipv4.ip_nonlocal_bind=1" > /etc/sysctl.d/99-nexus-ha.conf 2>/dev/null || true
+        fi
+
+        # 2. Vérification et installation éventuelle de Keepalived
+        if ! command -v keepalived >/dev/null 2>&1; then
+            apt-get update -qq && apt-get install -y -qq keepalived >/dev/null 2>&1 || true
+        fi
+
+        # 3. Création et sécurisation stricte du dossier des scripts Keepalived (exigences strictes Keepalived 2.x)
+        mkdir -p /etc/keepalived/scripts
+        if [ -d "/var/www/nexus-pbx/scripts/cluster" ]; then
+            cp -f /var/www/nexus-pbx/scripts/cluster/*.sh /etc/keepalived/scripts/ 2>/dev/null || true
+        fi
+        chown -R root:root /etc/keepalived
+        chmod 755 /etc/keepalived
+        chmod 755 /etc/keepalived/scripts
+        chmod 755 /etc/keepalived/scripts/*.sh 2>/dev/null || true
+
+        # 4. Déploiement de la configuration générée depuis /tmp
+        if [ -f "/tmp/keepalived.conf.tmp" ]; then
+            cp -f /tmp/keepalived.conf.tmp /etc/keepalived/keepalived.conf
+            chown root:root /etc/keepalived/keepalived.conf
+            chmod 644 /etc/keepalived/keepalived.conf
+            rm -f /tmp/keepalived.conf.tmp
+        fi
+
+        # Fichier journal du cluster accessible en écriture
+        touch /var/log/nexus_cluster.log
+        chmod 666 /var/log/nexus_cluster.log
+
+        # 5. Activation et démarrage du service
+        systemctl daemon-reload
+        systemctl unmask keepalived >/dev/null 2>&1 || true
+        systemctl enable keepalived >/dev/null 2>&1 || true
+        systemctl restart keepalived
+        echo "KEEPALIVED_APPLIED_OK"
+        ;;
+
+    stop)
+        systemctl stop keepalived >/dev/null 2>&1 || true
+        systemctl disable keepalived >/dev/null 2>&1 || true
+        echo "KEEPALIVED_STOPPED_OK"
+        ;;
+
+    status)
+        if systemctl is-active --quiet keepalived 2>/dev/null; then
+            echo "RUNNING"
+        else
+            echo "STOPPED"
+        fi
+        ;;
+
+    check)
+        if pidof asterisk >/dev/null 2>&1 && /usr/sbin/asterisk -rx "core ping" 2>/dev/null | grep -q "Pong"; then
+            echo "HEALTHY"
+        else
+            echo "DEGRADED"
+        fi
+        ;;
+
+    *)
+        echo "Usage: $0 {apply|stop|status|check}"
+        exit 1
+        ;;
+esac