v1.5.2: Exécution Certbot ACME avec sudo et sécurisation des droits Let's Encrypt

install.sh

@@ -88,8 +88,8 @@ if ! apt-get install -y asterisk; then
     apt-get install -y -t sid asterisk
 fi
 
-# Sons Asterisk en français (exacts de la machine de dev)
+# Sons Asterisk en français et anglais
-apt-get install -y asterisk-core-sounds-fr asterisk-core-sounds-fr-wav asterisk-core-sounds-fr-gsm 2>/dev/null || true
+apt-get install -y asterisk-core-sounds-fr asterisk-core-sounds-fr-wav asterisk-core-sounds-fr-gsm asterisk-core-sounds-en asterisk-core-sounds-en-gsm 2>/dev/null || true
 
 # Nginx, PHP-FPM et extensions requises
 apt-get install -y --no-install-recommends \
@@ -201,12 +201,17 @@ for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*
         cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
 [Service]
 ProtectSystem=false
-ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk /var/www /usr/local/bin /etc/sudoers.d
+ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk /var/www /usr/local/bin /etc/sudoers.d /etc/letsencrypt /var/lib/letsencrypt
 EOF_OVERRIDE
     fi
 done
 systemctl daemon-reload
 
+# Répertoires Let's Encrypt et permissions pour Asterisk / Web
+mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
+
 # Configuration des limites d'upload PHP (Restauration d'archives 512 Mo & Sons volumineux)
 for php_dir in /etc/php/*; do
     if [ -d "$php_dir/fpm/conf.d" ]; then
@@ -287,23 +292,61 @@ touch /etc/asterisk/pjsip.conf \
       /etc/asterisk/pjsip.custom.conf \
       /etc/asterisk/extensions.conf \
       /etc/asterisk/extensions.custom.conf \
+      /etc/asterisk/musiconhold.conf \
       /etc/asterisk/musiconhold.custom.conf \
+      /etc/asterisk/voicemail.conf \
       /etc/asterisk/voicemail.custom.conf \
+      /etc/asterisk/modules.conf \
       /etc/asterisk/rtp.conf \
       /etc/asterisk/features.conf
 
+# 1. Modules Asterisk : Désactivation des modules ODBC/IMAP incompatibles sur Debian (évite conflit bloquant app_voicemail)
+if ! grep -q 'noload => app_voicemail_odbc.so' /etc/asterisk/modules.conf 2>/dev/null; then
+    if grep -q '\[modules\]' /etc/asterisk/modules.conf 2>/dev/null; then
+        sed -i '/\[modules\]/a noload => app_voicemail_odbc.so\nnoload => app_voicemail_imap.so' /etc/asterisk/modules.conf 2>/dev/null || true
+    else
+        printf '[modules]\nautoload=yes\nnoload => app_voicemail_odbc.so\nnoload => app_voicemail_imap.so\n' >> /etc/asterisk/modules.conf
+    fi
+fi
+
+# 2. Inclusions des fichiers custom dans les configurations principales
 if ! grep -q 'pjsip.custom.conf' /etc/asterisk/pjsip.conf 2>/dev/null; then
     printf '\n#tryinclude "pjsip.custom.conf"\n' >> /etc/asterisk/pjsip.conf
 fi
 if ! grep -q 'extensions.custom.conf' /etc/asterisk/extensions.conf 2>/dev/null; then
     printf '\n#tryinclude "extensions.custom.conf"\n' >> /etc/asterisk/extensions.conf
 fi
-chown -R asterisk:asterisk /etc/asterisk
+if ! grep -q 'musiconhold.custom.conf' /etc/asterisk/musiconhold.conf 2>/dev/null; then
+    sed -i 's/^\[default\]/;[default]/' /etc/asterisk/musiconhold.conf 2>/dev/null || true
+    sed -i 's/^mode=files/;mode=files/' /etc/asterisk/musiconhold.conf 2>/dev/null || true
+    sed -i 's/^directory=moh/;directory=moh/' /etc/asterisk/musiconhold.conf 2>/dev/null || true
+    printf '\n#tryinclude "/etc/asterisk/musiconhold.custom.conf"\n' >> /etc/asterisk/musiconhold.conf
+fi
+if ! grep -q 'voicemail.custom.conf' /etc/asterisk/voicemail.conf 2>/dev/null; then
+    sed -i 's/^1234 => 4242/;1234 => 4242/' /etc/asterisk/voicemail.conf 2>/dev/null || true
+    sed -i 's/^;\s*passwordlocation\s*=\s*spooldir/passwordlocation=spooldir/' /etc/asterisk/voicemail.conf 2>/dev/null || true
+    sed -i 's|^;\s*externpassnotify\s*=.*|externpassnotify=/usr/bin/php /var/www/nexus-pbx/scripts/voicemail_pass_sync.php|' /etc/asterisk/voicemail.conf 2>/dev/null || true
+    printf '\n#tryinclude "voicemail.custom.conf"\n' >> /etc/asterisk/voicemail.conf
+fi
+
+mkdir -p /var/spool/asterisk/voicemail/default /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh
+for lang in fr en es; do
+    if [ -d "/usr/share/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang" ]; then
+        ln -sf "/usr/share/asterisk/sounds/$lang" "/var/lib/asterisk/sounds/$lang"
+    fi
+    if [ -d "/var/lib/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang/custom" ]; then
+        ln -sf /var/lib/asterisk/sounds/custom "/var/lib/asterisk/sounds/$lang/custom" 2>/dev/null || true
+    fi
+done
+if [ ! -e "/usr/share/asterisk/sounds/custom" ]; then
+    ln -sf /var/lib/asterisk/sounds/custom /usr/share/asterisk/sounds/custom 2>/dev/null || true
+fi
+chown -R asterisk:asterisk /etc/asterisk /var/spool/asterisk /var/lib/asterisk
 chmod 0664 /etc/asterisk/*.conf /etc/asterisk/*.custom.conf 2>/dev/null || true
 chmod 2750 /etc/asterisk/keys
-chmod 2775 /etc/asterisk
+chmod 2775 /etc/asterisk /var/spool/asterisk /var/spool/asterisk/voicemail /var/lib/asterisk/sounds /var/lib/asterisk/moh
-setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
+setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/spool/asterisk /var/lib/asterisk 2>/dev/null || true
-setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk 2>/dev/null || true
+setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/spool/asterisk /var/lib/asterisk 2>/dev/null || true
 
 # Rechargement Asterisk immédiat pour appliquer AMI et Logger
 asterisk -rx "core reload" 2>/dev/null || true

public/api.php

@@ -136,8 +136,15 @@ try {
                 $settings['local_networks'] = [$settings['local_net']];
             }
 
+            $appDir = dirname(__DIR__);
+            $installedVerData = file_exists("{$appDir}/version.json")
+                ? json_decode((string)file_get_contents("{$appDir}/version.json"), true)
+                : [];
+            $installedVer = $installedVerData['version'] ?? '1.5.0';
+
             echo json_encode([
                 'success'          => true,
+                'version'          => $installedVer,
                 'user'             => Auth::getUsername(),
                 'settings'         => $settings,
                 'extensions'       => $extensions,
@@ -220,7 +227,7 @@ try {
                 @chmod($webLog, 0664);
             }
             @unlink('/tmp/nexus_fw_status_cache.json');
-            exec('sudo /usr/bin/fail2ban-client reload 2>&1');
+            exec('sudo /usr/bin/systemctl restart fail2ban 2>&1 || sudo /usr/bin/fail2ban-client reload 2>&1');
 
             echo json_encode([
                 'success' => true,
@@ -362,6 +369,13 @@ try {
             // Synchronisation automatique de l'annuaire d'entreprise
             PhonebookManager::syncExtensions($db);
 
+            // Régénération automatique des fichiers Asterisk et rechargement PJSIP/Dialplan en direct
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
             $modeBadge = $transport === 'tls' ? 'Distant (TLS + SRTP)' : ($encryption ? 'Interne (UDP + SRTP)' : 'Interne (UDP)');
             echo json_encode([
                 'success' => true,
@@ -374,6 +388,13 @@ try {
             $stmt = $db->prepare('DELETE FROM extensions WHERE id = :id');
             $stmt->execute([':id' => $id]);
             PhonebookManager::syncExtensions($db);
+
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
             echo json_encode([
                 'success' => true,
                 'message' => 'Poste téléphonique supprimé de la base SQLite.',
@@ -433,6 +454,12 @@ try {
                 ]);
             }
 
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
             echo json_encode([
                 'success' => true,
                 'message' => "Groupe d'appel {$extension} ({$name}) sauvegardé.",
@@ -442,6 +469,12 @@ try {
         case 'delete_group':
             $id = (int)($payload['id'] ?? 0);
             $db->prepare('DELETE FROM groups WHERE id = :id')->execute([':id' => $id]);
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
             echo json_encode([
                 'success' => true,
                 'message' => "Groupe de sonnerie supprimé.",
@@ -533,6 +566,12 @@ try {
                 ]);
             }
 
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
             echo json_encode([
                 'success' => true,
                 'message' => "Groupe de téléavertissement {$extension} ({$name}) sauvegardé.",
@@ -542,6 +581,12 @@ try {
         case 'delete_paging_group':
             $id = (int)($payload['id'] ?? 0);
             $db->prepare('DELETE FROM paging_groups WHERE id = :id')->execute([':id' => $id]);
+            $generator->writeAllConfigs();
+            try {
+                $ami = AmiClient::fromDatabase($db);
+                $ami->reloadPjsipAndDialplan();
+            } catch (\Throwable $e) {}
+
             echo json_encode([
                 'success' => true,
                 'message' => "Groupe de téléavertissement supprimé.",
@@ -2233,23 +2278,28 @@ try {
 
         case 'check_update':
             $appDir = dirname(__DIR__);
+            clearstatcache(true, "{$appDir}/version.json");
             $localVerJson = file_exists("{$appDir}/version.json")
                 ? json_decode((string)file_get_contents("{$appDir}/version.json"), true)
-                : ['version' => '1.2.0', 'changelog' => []];
+                : ['version' => '1.3.8', 'changelog' => []];
             
-            $currentVer = $localVerJson['version'] ?? '1.2.0';
+            $currentVer = $localVerJson['version'] ?? '1.3.8';
             $remoteVer = $currentVer;
             $remoteChangelog = [];
             $remoteDate = '';
 
-            // 1. Interrogation directe via HTTP Raw (indépendant de .git et ultra-rapide)
+            // 1. Interrogation directe via HTTP Raw avec cache-busting strict (bypass OpenResty/Cloudflare max-age)
-            $rawHttp = @shell_exec("curl -k -s --connect-timeout 4 \"https://git.sorcier-research.com/sorcier/NexusPBX/raw/branch/main/version.json\" 2>/dev/null");
+            $ts = time();
+            $rawHttp = @shell_exec("curl -k -s -H 'Cache-Control: no-cache, no-store' -H 'Pragma: no-cache' --connect-timeout 4 \"https://git.sorcier-research.com/sorcier/NexusPBX/raw/branch/main/version.json?_t={$ts}\" 2>/dev/null");
             if (empty($rawHttp)) {
                 $ctx = stream_context_create([
-                    'http' => ['timeout' => 4],
+                    'http' => [
+                        'timeout' => 4,
+                        'header'  => "Cache-Control: no-cache\r\nPragma: no-cache\r\n"
+                    ],
                     'ssl'  => ['verify_peer' => false, 'verify_peer_name' => false]
                 ]);
-                $rawHttp = @file_get_contents("https://git.sorcier-research.com/sorcier/NexusPBX/raw/branch/main/version.json", false, $ctx);
+                $rawHttp = @file_get_contents("https://git.sorcier-research.com/sorcier/NexusPBX/raw/branch/main/version.json?_t={$ts}", false, $ctx);
             }
 
             if (!empty($rawHttp)) {
@@ -2274,11 +2324,6 @@ try {
             }
 
             $hasUpdate = version_compare($remoteVer, $currentVer, '>');
-            $localHash = trim((string)shell_exec("git --git-dir={$appDir}/.git rev-parse HEAD 2>/dev/null"));
-            $remoteHash = trim((string)shell_exec("git --git-dir={$appDir}/.git rev-parse origin/main 2>/dev/null"));
-            if (!$hasUpdate && $localHash !== '' && $remoteHash !== '' && $localHash !== $remoteHash) {
-                $hasUpdate = true;
-            }
 
             echo json_encode([
                 'success'         => true,
@@ -2297,16 +2342,32 @@ try {
             $outputStr = implode("\n", $output);
             
             $appDir = dirname(__DIR__);
+            clearstatcache(true, "{$appDir}/version.json");
+            if (function_exists('opcache_reset')) {
+                @opcache_reset();
+            }
+
             $newVerJson = file_exists("{$appDir}/version.json")
                 ? json_decode((string)file_get_contents("{$appDir}/version.json"), true)
-                : ['version' => '1.3.0'];
+                : ['version' => '1.4.3'];
+
+            while (ob_get_level() > 0) {
+                @ob_end_clean();
+            }
+
+            header('Content-Type: application/json; charset=utf-8');
+            header('Cache-Control: no-cache, no-store, must-revalidate');
 
             echo json_encode([
                 'success'     => ($code === 0),
-                'new_version' => $newVerJson['version'] ?? '1.3.0',
+                'new_version' => $newVerJson['version'] ?? '1.4.3',
                 'output'      => $outputStr,
                 'message'     => ($code === 0) ? "Mise à jour réussie !" : "Erreur lors de la mise à jour",
             ]);
+
+            if (function_exists('fastcgi_finish_request')) {
+                fastcgi_finish_request();
+            }
             break;
 
         default:

public/assets/app.js

@@ -266,20 +266,28 @@ function renderCompanyBranding() {
 
         if (loginBox) {
             loginBox.classList.remove('hidden');
+            loginBox.classList.add('flex');
             if (logo && loginLogo) {
                 loginLogo.src = logo;
                 loginLogo.classList.remove('hidden');
             } else if (loginLogo) {
+                loginLogo.src = '';
                 loginLogo.classList.add('hidden');
             }
-            if (loginName) loginName.textContent = name;
+            if (loginName) {
+                loginName.textContent = name;
+                loginName.classList.toggle('hidden', !name);
+            }
         }
     } else {
         emptyBox?.classList.remove('hidden');
         filledBox?.classList.add('hidden');
         if (logoImg) { logoImg.src = ''; logoImg.classList.add('hidden'); }
         if (nameEl) { nameEl.textContent = ''; nameEl.classList.add('hidden'); }
-        loginBox?.classList.add('hidden');
+        if (loginBox) {
+            loginBox.classList.add('hidden');
+            loginBox.classList.remove('flex');
+        }
     }
 }
 
@@ -629,20 +637,56 @@ function drawDualAreaChart(svgId, seriesA, seriesB, maxVal, colorA, colorB, unit
     const padTop = 14;
     const padBottom = 18;
     const plotH = height - padTop - padBottom;
+    const baselineY = padTop + plotH;
     const safeMax = maxVal > 0 ? maxVal : 100;
 
-    const toPoints = (arr) => arr.map((val, idx) => {
+    const clampY = (y) => Math.max(padTop, Math.min(baselineY, y));
+
+    // Génération de courbes splines adoucies (Catmull-Rom / Bézier cubique) pour éliminer les angles pointus
+    const computeSmoothPaths = (arr, tension = 0.2) => {
+        if (!arr || arr.length === 0) return { line: '', area: '' };
+
+        const points = arr.map((val, idx) => {
             const x = (idx / (arr.length - 1)) * width;
             const ratio = Math.max(0, Math.min(1, val / safeMax));
-        const y = padTop + plotH - (ratio * plotH);
+            const y = baselineY - (ratio * plotH);
-        return `${x.toFixed(1)},${y.toFixed(1)}`;
+            return { x, y };
         });
 
-    const ptsA = toPoints(seriesA);
+        if (points.length === 1) {
-    const ptsB = toPoints(seriesB);
+            return {
+                line: `M ${points[0].x.toFixed(1)},${points[0].y.toFixed(1)}`,
+                area: `M 0,${baselineY} L ${points[0].x.toFixed(1)},${points[0].y.toFixed(1)} L ${width},${baselineY} Z`
+            };
+        }
 
-    const areaA = `0,${padTop + plotH} ` + ptsA.join(' ') + ` ${width},${padTop + plotH}`;
+        let line = `M ${points[0].x.toFixed(1)},${points[0].y.toFixed(1)}`;
-    const areaB = `0,${padTop + plotH} ` + ptsB.join(' ') + ` ${width},${padTop + plotH}`;
+
+        for (let i = 0; i < points.length - 1; i++) {
+            const p0 = points[i === 0 ? i : i - 1];
+            const p1 = points[i];
+            const p2 = points[i + 1];
+            const p3 = points[i + 2 < points.length ? i + 2 : i + 1];
+
+            let cp1x = p1.x + (p2.x - p0.x) * tension;
+            let cp1y = p1.y + (p2.y - p0.y) * tension;
+
+            let cp2x = p2.x - (p3.x - p1.x) * tension;
+            let cp2y = p2.y - (p3.y - p1.y) * tension;
+
+            // Clamping vertical pour garantir que la courbe ne déborde pas sous l'axe ni au-dessus du max
+            cp1y = clampY(cp1y);
+            cp2y = clampY(cp2y);
+
+            line += ` C ${cp1x.toFixed(1)},${cp1y.toFixed(1)} ${cp2x.toFixed(1)},${cp2y.toFixed(1)} ${p2.x.toFixed(1)},${p2.y.toFixed(1)}`;
+        }
+
+        const area = `${line} L ${width},${baselineY} L 0,${baselineY} Z`;
+        return { line, area };
+    };
+
+    const pathA = computeSmoothPaths(seriesA);
+    const pathB = computeSmoothPaths(seriesB);
 
     const gradIdA = `${svgId}-grad-a`;
     const gradIdB = `${svgId}-grad-b`;
@@ -662,18 +706,18 @@ function drawDualAreaChart(svgId, seriesA, seriesB, maxVal, colorA, colorB, unit
         <!-- Lignes de grille horizontales -->
         <line x1="0" y1="${padTop}" x2="${width}" y2="${padTop}" stroke="#2c323f" stroke-dasharray="3,3" stroke-width="1"/>
         <line x1="0" y1="${padTop + plotH / 2}" x2="${width}" y2="${padTop + plotH / 2}" stroke="#2c323f" stroke-dasharray="3,3" stroke-width="1"/>
-        <line x1="0" y1="${padTop + plotH}" x2="${width}" y2="${padTop + plotH}" stroke="#3d4657" stroke-width="1"/>
+        <line x1="0" y1="${baselineY}" x2="${width}" y2="${baselineY}" stroke="#3d4657" stroke-width="1"/>
 
         <text x="6" y="${padTop + 10}" fill="#94a3b8" font-size="10" font-family="monospace">${Math.round(safeMax)} ${unitLabel}</text>
         <text x="6" y="${padTop + plotH / 2 - 4}" fill="#64748b" font-size="10" font-family="monospace">${Math.round(safeMax / 2)} ${unitLabel}</text>
 
-        <!-- Courbe B -->
+        <!-- Courbe B lissée avec dégradé -->
-        <polygon points="${areaB}" fill="url(#${gradIdB})"/>
+        <path d="${pathB.area}" fill="url(#${gradIdB})"/>
-        <polyline fill="none" stroke="${colorB}" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" points="${ptsB.join(' ')}"/>
+        <path d="${pathB.line}" fill="none" stroke="${colorB}" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
 
-        <!-- Courbe A -->
+        <!-- Courbe A lissée avec dégradé -->
-        <polygon points="${areaA}" fill="url(#${gradIdA})"/>
+        <path d="${pathA.area}" fill="url(#${gradIdA})"/>
-        <polyline fill="none" stroke="${colorA}" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" points="${ptsA.join(' ')}"/>
+        <path d="${pathA.line}" fill="none" stroke="${colorA}" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
     `;
 }
 
@@ -5735,15 +5779,26 @@ async function checkSystemUpdate(notify = false) {
     const TWENTY_FOUR_HOURS = 24 * 60 * 60 * 1000;
 
     // Si pas de clic explicite (notify === false), vérifier si un check a déjà été fait il y a moins de 24h
+    const installedVer = (appState && appState.version) ? appState.version : (document.querySelector('meta[name="nexus-app-version"]')?.content || '');
     if (!notify) {
         const lastTs = parseInt(localStorage.getItem(STORAGE_KEY_TIME) || '0', 10);
         const cachedRaw = localStorage.getItem(STORAGE_KEY_DATA);
         if (lastTs && (Date.now() - lastTs < TWENTY_FOUR_HOURS) && cachedRaw) {
             try {
                 const cached = JSON.parse(cachedRaw);
+                // Si la version locale correspond et qu'on n'a pas un vieux flag "mise à jour dispo" vers la version déjà installée
+                if (installedVer && (cached.current_version !== installedVer || (cached.has_update && cached.latest_version === installedVer))) {
+                    // Cache périmé suite à une mise à jour : on purge pour rafraîchir en direct
+                    localStorage.removeItem(STORAGE_KEY_TIME);
+                    localStorage.removeItem(STORAGE_KEY_DATA);
+                } else {
                     applyUpdateUI(cached);
                     return;
-            } catch (_) {}
+                }
+            } catch (_) {
+                localStorage.removeItem(STORAGE_KEY_TIME);
+                localStorage.removeItem(STORAGE_KEY_DATA);
+            }
         }
     } else {
         localStorage.removeItem(STORAGE_KEY_TIME);
@@ -5759,7 +5814,7 @@ async function checkSystemUpdate(notify = false) {
     }
 
     try {
-        const res = await fetch('/api.php?action=check_update');
+        const res = await fetch('/api.php?action=check_update&_t=' + Date.now());
         const data = await res.json();
 
         // Enregistrement du timestamp de vérification et des données en cache local (24h)
@@ -5841,14 +5896,57 @@ async function checkSystemUpdate(notify = false) {
     }
 }
 
-async function runSystemUpdate() {
+function openUpdateConfirmModal() {
-    if (!confirm("Voulez-vous lancer la mise à jour de NexusPBX ?\n\nUne sauvegarde préventive automatique de vos configurations et de votre base de données sera créée.")) {
+    const modal = document.getElementById('modal-confirm-update');
-        return;
+    if (!modal) return;
-    }
 
+    let targetVer = '';
+    let currVer = (appState && appState.version) ? appState.version : (document.querySelector('meta[name="nexus-app-version"]')?.content || '');
+
+    try {
+        const cachedRaw = localStorage.getItem('nexus_update_cached_data');
+        if (cachedRaw) {
+            const cached = JSON.parse(cachedRaw);
+            if (cached.latest_version) targetVer = cached.latest_version;
+            if (cached.current_version) currVer = cached.current_version;
+        }
+    } catch (_) {}
+
+    const elTarget = document.getElementById('update-modal-target-version');
+    const elCurrent = document.getElementById('update-modal-current-version');
+    const elBadge = document.getElementById('update-modal-target-badge');
+
+    if (elTarget) elTarget.textContent = targetVer ? `v${targetVer}` : 'Dernière version';
+    if (elCurrent) elCurrent.textContent = currVer ? `v${currVer}` : 'vActuelle';
+    if (elBadge && targetVer) elBadge.textContent = `v${targetVer} disponible`;
+
+    modal.classList.remove('hidden');
+    modal.classList.add('flex');
+}
+
+function closeUpdateConfirmModal() {
+    const modal = document.getElementById('modal-confirm-update');
+    if (modal) {
+        modal.classList.add('hidden');
+        modal.classList.remove('flex');
+    }
+}
+
+function runSystemUpdate() {
+    openUpdateConfirmModal();
+}
+
+async function executeSystemUpdate() {
+    const btnModalConfirm = document.getElementById('btn-confirm-update-action');
     const btnRun = document.getElementById('btn-run-update');
     const statusText = document.getElementById('update-status-text');
 
+    if (btnModalConfirm) {
+        btnModalConfirm.disabled = true;
+        btnModalConfirm.classList.add('opacity-75', 'cursor-not-allowed');
+        btnModalConfirm.innerHTML = '<span class="animate-spin mr-2">↻</span> Déploiement en cours...';
+    }
+
     if (btnRun) {
         btnRun.disabled = true;
         btnRun.innerHTML = '<span class="animate-spin mr-1.5">↻</span> Mise à jour en cours...';
@@ -5860,35 +5958,118 @@ async function runSystemUpdate() {
 
     showToast("Mise à jour en cours d'exécution en arrière-plan...", 'info');
 
+    // Purge préventive du cache local
+    localStorage.removeItem('nexus_update_last_check_ts');
+    localStorage.removeItem('nexus_update_cached_data');
+
+    function finalizeUpdateSuccess(newVer) {
+        newVer = String(newVer || '').replace(/^v/, '');
+        localStorage.setItem('nexus_update_last_check_ts', Date.now().toString());
+        localStorage.setItem('nexus_update_cached_data', JSON.stringify({
+            success: true,
+            current_version: newVer,
+            latest_version: newVer,
+            has_update: false,
+            changelog: [],
+            release_date: ''
+        }));
+
+        const verTag = document.getElementById('system-version-tag');
+        const appBadge = document.getElementById('app-version-badge');
+        const headerUpdateBadge = document.getElementById('header-update-badge');
+        const pingDot = document.getElementById('update-ping-dot');
+
+        if (verTag && newVer) verTag.textContent = `v${newVer}`;
+        if (appBadge && newVer) appBadge.textContent = `v${newVer}`;
+        if (headerUpdateBadge) headerUpdateBadge.style.display = 'none';
+        if (btnRun) btnRun.style.display = 'none';
+        if (pingDot) pingDot.classList.add('hidden');
+
+        showToast(`NexusPBX a été mis à jour avec succès en v${newVer} ! Rechargement...`, 'success');
+        if (statusText) {
+            statusText.className = 'text-emerald-400 font-bold';
+            statusText.textContent = `Mise à jour terminée avec succès (v${newVer}) ! Rechargement...`;
+        }
+        if (btnModalConfirm) {
+            btnModalConfirm.className = 'px-5 py-2.5 rounded-xl text-xs font-bold bg-emerald-600 text-white flex items-center gap-2';
+            btnModalConfirm.innerHTML = '✓ Mise à jour terminée ! Rechargement...';
+        }
+
+        setTimeout(() => {
+            closeUpdateConfirmModal();
+            window.location.href = window.location.origin + window.location.pathname + '?_t=' + Date.now();
+        }, 1800);
+    }
+
     try {
-        const res = await fetch('/api.php?action=run_update', {
+        const res = await fetch('/api.php?action=run_update&_t=' + Date.now(), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({})
         });
-        const data = await res.json();
 
-        if (data.success) {
+        const rawText = await res.text();
-            showToast(`NexusPBX a été mis à jour avec succès en v${data.new_version} ! Rechargement...`, 'success');
+        let data = null;
-            if (statusText) {
+        try {
-                statusText.className = 'text-emerald-400 font-bold';
+            data = JSON.parse(rawText);
-                statusText.textContent = `Mise à jour terminée avec succès (v${data.new_version}) ! Rechargement de la page...`;
+        } catch (_) {
+            data = null;
         }
-            setTimeout(() => {
+
-                window.location.reload();
+        if (data && data.success) {
-            }, 2500);
+            finalizeUpdateSuccess(data.new_version);
-        } else {
+            return;
-            alert("Erreur lors de la mise à jour :\n\n" + (data.output || data.message));
+        }
+
+        // Si la réponse n'était pas un JSON valide ou a été interrompue par le rechargement de php-fpm/nginx,
+        // on sonde le serveur pour vérifier si la mise à jour a en réalité bien été appliquée sur le disque
+        await new Promise(r => setTimeout(r, 2000));
+        try {
+            const probeRes = await fetch('/api.php?action=check_update&_t=' + Date.now());
+            const probeData = await probeRes.json();
+            if (probeData && probeData.success && probeData.current_version) {
+                finalizeUpdateSuccess(probeData.current_version);
+                return;
+            }
+        } catch (_) {}
+
+        // En cas d'échec réel avéré
+        closeUpdateConfirmModal();
+        const errMsg = (data && (data.output || data.message)) ? (data.output || data.message) : (rawText.slice(0, 150) || "Erreur inconnue");
+        alert("Erreur lors de la mise à jour :\n\n" + errMsg);
         if (btnRun) {
             btnRun.disabled = false;
             btnRun.innerHTML = 'Réessayer la mise à jour';
         }
+        if (btnModalConfirm) {
+            btnModalConfirm.disabled = false;
+            btnModalConfirm.classList.remove('opacity-75', 'cursor-not-allowed');
+            btnModalConfirm.innerHTML = '<svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z"/></svg><span>Lancer la mise à jour (1-Clic)</span>';
         }
+
     } catch (e) {
-        alert("Erreur réseau lors de la mise à jour : " + e.message);
+        // En cas d'interruption réseau du socket (Safari WebKit DOMException ou timeout),
+        // on vérifie avant d'alerter si le serveur a quand même réussi à déployer les fichiers
+        await new Promise(r => setTimeout(r, 2000));
+        try {
+            const probeRes = await fetch('/api.php?action=check_update&_t=' + Date.now());
+            const probeData = await probeRes.json();
+            if (probeData && probeData.success && probeData.current_version) {
+                finalizeUpdateSuccess(probeData.current_version);
+                return;
+            }
+        } catch (_) {}
+
+        closeUpdateConfirmModal();
+        alert("Erreur réseau lors de la mise à jour : " + (e.message || "Connexion interrompue"));
         if (btnRun) {
             btnRun.disabled = false;
             btnRun.innerHTML = 'Réessayer la mise à jour';
         }
+        if (btnModalConfirm) {
+            btnModalConfirm.disabled = false;
+            btnModalConfirm.classList.remove('opacity-75', 'cursor-not-allowed');
+            btnModalConfirm.innerHTML = '<svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z"/></svg><span>Lancer la mise à jour (1-Clic)</span>';
+        }
     }
 }

public/index.php

@@ -10,12 +10,22 @@ use App\Auth;
 Database::getConnection();
 $isAuth = Auth::isAuthenticated();
 $currentUser = Auth::getUsername();
+
+$stmtSettings = Database::getConnection()->query('SELECT company_name, company_logo FROM settings WHERE id = 1 LIMIT 1');
+$branding = $stmtSettings ? $stmtSettings->fetch(\PDO::FETCH_ASSOC) : null;
+$companyName = trim($branding['company_name'] ?? '');
+$companyLogo = trim($branding['company_logo'] ?? '');
+$hasBranding = !empty($companyName) || !empty($companyLogo);
+
+$appVerData = file_exists(__DIR__ . '/../version.json') ? json_decode((string)file_get_contents(__DIR__ . '/../version.json'), true) : [];
+$appVersion = $appVerData['version'] ?? '1.5.0';
 ?>
 <!DOCTYPE html>
 <html lang="fr" class="h-full">
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="nexus-app-version" content="<?= htmlspecialchars($appVersion) ?>">
     <title>NexusPBX — Supervision & Gestion PJSIP sur Debian</title>
     <script src="https://cdn.tailwindcss.com"></script>
     <script>
@@ -140,8 +150,13 @@ $currentUser = Auth::getUsername();
     <div id="toast-container" class="fixed bottom-5 right-5 z-50 flex flex-col gap-2.5 max-w-md w-full pointer-events-none px-4 sm:px-0"></div>
 
     <!-- ÉCRAN DE CONNEXION -->
-    <div id="login-screen" class="<?= $isAuth ? 'hidden' : 'flex' ?> min-h-screen w-full items-center justify-center p-4 bg-gradient-to-br from-anthracite-950 via-anthracite-900 to-indigo-950/40">
+    <div id="login-screen" class="<?= $isAuth ? 'hidden' : 'flex' ?> min-h-screen w-full items-center justify-center p-4 relative overflow-hidden bg-anthracite-950">
-        <div class="w-full max-w-md bg-anthracite-800 border border-anthracite-700 rounded-2xl shadow-2xl p-8">
+        <!-- Arrière-plan personnalisé / Image de fond avec overlay sombre et léger flou -->
+        <div id="login-bg-layer" class="absolute inset-0 bg-cover bg-center bg-no-repeat" style="background-image: url('/assets/login-bg.jpg?v=<?= file_exists(__DIR__ . '/assets/login-bg.jpg') ? filemtime(__DIR__ . '/assets/login-bg.jpg') : 1 ?>');"></div>
+        <div class="absolute inset-0 bg-gradient-to-tr from-anthracite-950/70 via-anthracite-950/50 to-indigo-950/30 backdrop-blur-[1px]"></div>
+
+        <!-- Carte de connexion flottante avec effet Glassmorphism transparent et aéré -->
+        <div class="relative z-10 w-full max-w-md bg-anthracite-900/60 backdrop-blur-2xl border border-white/15 rounded-3xl shadow-2xl shadow-black/50 p-8 sm:p-9 transition-all">
             <div class="flex items-center gap-3.5 mb-6">
                 <div class="w-12 h-12 rounded-xl bg-indigo-500/20 border border-indigo-400/40 flex items-center justify-center text-indigo-300 shadow-inner">
                     <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -154,25 +169,25 @@ $currentUser = Auth::getUsername();
                 </div>
             </div>
 
-            <!-- Aperçu Logo Entreprise sur l'écran de connexion (si configuré) -->
+            <!-- Aperçu Logo Entreprise sur l'écran de connexion (rendu serveur natif) -->
-            <div id="login-company-box" class="hidden mb-5 p-3 rounded-xl bg-anthracite-950/90 border border-anthracite-700 flex items-center justify-center gap-3">
+            <div id="login-company-box" class="<?= $hasBranding ? 'flex' : 'hidden' ?> mb-5 p-3 rounded-xl bg-anthracite-950/45 border border-white/10 backdrop-blur-md items-center justify-center gap-3">
-                <img id="login-company-logo" src="" alt="Logo Entreprise" class="max-h-10 max-w-[160px] object-contain hidden">
+                <img id="login-company-logo" src="<?= htmlspecialchars($companyLogo) ?>" alt="Logo Entreprise" class="max-h-10 max-w-[160px] object-contain <?= !empty($companyLogo) ? '' : 'hidden' ?>">
-                <span id="login-company-name" class="text-xs font-semibold text-slate-200"></span>
+                <span id="login-company-name" class="text-xs font-semibold text-slate-200 <?= !empty($companyName) ? '' : 'hidden' ?>"><?= htmlspecialchars($companyName) ?></span>
             </div>
 
             <form id="login-form" class="space-y-4">
                 <div>
                     <label class="block text-xs font-semibold uppercase tracking-wider text-slate-300 mb-1.5">Identifiant</label>
                     <input type="text" name="username" value="admin" required
-                        class="w-full px-3.5 py-2.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-white focus:outline-none focus:border-indigo-400 text-sm">
+                        class="w-full px-3.5 py-2.5 rounded-xl bg-anthracite-950/50 backdrop-blur-md border border-white/10 text-white placeholder-slate-400 focus:outline-none focus:border-indigo-400 focus:ring-2 focus:ring-indigo-500/20 text-sm transition">
                 </div>
                 <div>
                     <label class="block text-xs font-semibold uppercase tracking-wider text-slate-300 mb-1.5">Mot de passe</label>
                     <input type="password" name="password" placeholder="••••••••" required
-                        class="w-full px-3.5 py-2.5 rounded-lg bg-anthracite-950 border border-anthracite-700 text-white focus:outline-none focus:border-indigo-400 text-sm">
+                        class="w-full px-3.5 py-2.5 rounded-xl bg-anthracite-950/50 backdrop-blur-md border border-white/10 text-white placeholder-slate-400 focus:outline-none focus:border-indigo-400 focus:ring-2 focus:ring-indigo-500/20 text-sm transition">
                 </div>
                 <button type="submit"
-                    class="w-full py-2.5 px-4 bg-indigo-600 hover:bg-indigo-500 active:bg-indigo-700 text-white font-semibold rounded-lg shadow-lg shadow-indigo-600/25 transition text-sm">
+                    class="w-full py-2.5 px-4 bg-gradient-to-r from-indigo-600 to-indigo-500 hover:from-indigo-500 hover:to-indigo-400 active:from-indigo-700 active:to-indigo-600 text-white font-semibold rounded-xl shadow-lg shadow-indigo-500/25 transition text-sm">
                     Se connecter au PBX
                 </button>
             </form>
@@ -202,7 +217,7 @@ $currentUser = Auth::getUsername();
                                     <div class="font-black text-white text-2xl tracking-tight leading-none">
                                         Nexus<span class="text-indigo-400">PBX</span>
                                     </div>
-                                    <span id="app-version-badge" class="px-1.5 py-0.5 text-[10px] font-mono font-bold tracking-wider rounded bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">v1.3.0</span>
+                                    <span id="app-version-badge" class="px-1.5 py-0.5 text-[10px] font-mono font-bold tracking-wider rounded bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">v<?= htmlspecialchars($appVersion) ?></span>
                                 </div>
                                 <div class="text-[10px] text-slate-400 font-medium tracking-wide mt-0.5">Moteur VoIP & Téléphonie IP</div>
                             </div>
@@ -1572,7 +1587,7 @@ $currentUser = Auth::getUsername();
                                         <span id="update-dot" class="relative inline-flex rounded-full h-3 w-3 bg-emerald-500"></span>
                                     </span>
                                     <h3 class="text-base font-bold text-white">Mises à Jour du Système NexusPBX</h3>
-                                    <span id="system-version-tag" class="px-2 py-0.5 text-xs font-mono font-bold rounded-lg bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">v1.3.0</span>
+                                    <span id="system-version-tag" class="px-2 py-0.5 text-xs font-mono font-bold rounded-lg bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">v<?= htmlspecialchars($appVersion) ?></span>
                                 </div>
                                 <p class="text-xs text-slate-300 mt-1">Vérifiez les nouvelles versions officielles et mettez à jour votre PBX en 1 clic sans coupure de service.</p>
                             </div>
@@ -4711,6 +4726,92 @@ $currentUser = Auth::getUsername();
         </div>
     </div>
 
+    <!-- ===================================================================== -->
+    <!-- MODAL : CONFIRMATION MISE À JOUR SYSTEME (OTA 1-CLIC)                 -->
+    <!-- ===================================================================== -->
+    <div id="modal-confirm-update" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/80 backdrop-blur-sm p-3 sm:p-4 overflow-y-auto">
+        <div class="bg-anthracite-900 border border-indigo-500/40 rounded-2xl w-full max-w-lg shadow-2xl overflow-hidden my-6 animate-fadeIn">
+            <!-- Entête stylisée -->
+            <div class="px-6 py-5 border-b border-anthracite-800 bg-gradient-to-r from-indigo-950/50 via-anthracite-900 to-anthracite-900 flex items-start justify-between">
+                <div class="flex items-center gap-3.5">
+                    <div class="w-11 h-11 rounded-xl bg-indigo-500/15 border border-indigo-500/30 text-indigo-400 flex items-center justify-center shrink-0 shadow-lg shadow-indigo-950/50">
+                        <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"/>
+                        </svg>
+                    </div>
+                    <div>
+                        <div class="flex items-center gap-2">
+                            <h3 class="text-base font-bold text-white">Mise à Jour du Système NexusPBX</h3>
+                            <span id="update-modal-target-badge" class="px-2 py-0.5 rounded text-[10px] font-bold tracking-wide uppercase bg-indigo-500/20 text-indigo-300 border border-indigo-500/30">OTA 1-Clic</span>
+                        </div>
+                        <p class="text-xs text-slate-400 mt-0.5">Déploiement officiel et rechargement sans coupure</p>
+                    </div>
+                </div>
+                <button type="button" onclick="closeUpdateConfirmModal()" class="text-slate-400 hover:text-white p-1.5 rounded-lg hover:bg-anthracite-800 transition">
+                    <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/></svg>
+                </button>
+            </div>
+
+            <!-- Corps de la modale -->
+            <div class="p-6 space-y-4">
+                <!-- Info cible -->
+                <div class="p-3.5 rounded-xl bg-anthracite-950/90 border border-anthracite-800 flex items-center justify-between">
+                    <div>
+                        <div class="text-[11px] font-semibold text-slate-400 uppercase tracking-wider">Version Cible</div>
+                        <div id="update-modal-target-version" class="text-base font-bold text-emerald-400 font-mono mt-0.5">v...</div>
+                    </div>
+                    <div class="text-right">
+                        <div class="text-[11px] font-semibold text-slate-400 uppercase tracking-wider">Version Actuelle</div>
+                        <div id="update-modal-current-version" class="text-sm font-semibold text-slate-300 font-mono mt-0.5">v...</div>
+                    </div>
+                </div>
+
+                <!-- Garanties & Sauvegarde automatique -->
+                <div class="p-3.5 rounded-xl bg-emerald-500/10 border border-emerald-500/20 text-xs text-emerald-300 flex items-start gap-3">
+                    <svg class="w-5 h-5 text-emerald-400 shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+                    </svg>
+                    <div>
+                        <strong class="font-bold text-emerald-200">Sauvegarde préventive automatique incluse :</strong>
+                        <p class="mt-0.5 text-emerald-300/90 leading-relaxed">Une sauvegarde complète de votre base SQLite et de vos configurations Asterisk sera créée avant toute modification.</p>
+                    </div>
+                </div>
+
+                <!-- Ce que fait la mise à jour -->
+                <div class="space-y-2">
+                    <div class="text-xs font-semibold text-slate-300">Étapes automatiques du déploiement :</div>
+                    <ul class="text-xs text-slate-400 space-y-1.5 pl-1">
+                        <li class="flex items-center gap-2">
+                            <span class="w-1.5 h-1.5 rounded-full bg-cyan-400 shrink-0"></span>
+                            <span>Téléchargement des derniers fichiers et correctifs du dépôt officiel.</span>
+                        </li>
+                        <li class="flex items-center gap-2">
+                            <span class="w-1.5 h-1.5 rounded-full bg-indigo-400 shrink-0"></span>
+                            <span>Exécution des migrations SQLite et régénération des configurations Asterisk.</span>
+                        </li>
+                        <li class="flex items-center gap-2">
+                            <span class="w-1.5 h-1.5 rounded-full bg-emerald-400 shrink-0"></span>
+                            <span>Rechargement à chaud sans interruption des communications actives.</span>
+                        </li>
+                    </ul>
+                </div>
+            </div>
+
+            <!-- Boutons d'action -->
+            <div class="px-6 py-4 border-t border-anthracite-800 bg-anthracite-950/80 flex items-center justify-end gap-3">
+                <button type="button" onclick="closeUpdateConfirmModal()"
+                    class="px-4 py-2.5 rounded-xl text-xs font-semibold bg-anthracite-800 hover:bg-anthracite-750 text-slate-300 border border-anthracite-700 transition">
+                    Annuler
+                </button>
+                <button type="button" id="btn-confirm-update-action" onclick="executeSystemUpdate()"
+                    class="px-5 py-2.5 rounded-xl text-xs font-bold bg-gradient-to-r from-indigo-600 to-indigo-500 hover:from-indigo-500 hover:to-indigo-400 text-white shadow-lg shadow-indigo-600/30 transition flex items-center gap-2">
+                    <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z"/></svg>
+                    <span>Lancer la mise à jour (1-Clic)</span>
+                </button>
+            </div>
+        </div>
+    </div>
+
     <!-- ===================================================================== -->
     <!-- MODAL : URL XML YEALINK REMOTE PHONEBOOK (cm_to_yl_ab.php)            -->
     <!-- ===================================================================== -->

scripts/fix.sh

@@ -57,7 +57,9 @@ echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..
 usermod -aG asterisk www-data 2>/dev/null || true
 usermod -aG www-data asterisk 2>/dev/null || true
 
-mkdir -p /var/www/nexus-pbx/public/avatars /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups
+mkdir -p /var/www/nexus-pbx/public/avatars /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
 chown -R www-data:asterisk /var/www/nexus-pbx
 chmod 2775 /var/www/nexus-pbx/storage /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/public/avatars 2>/dev/null || true
 
@@ -65,15 +67,58 @@ touch /etc/asterisk/pjsip.conf \
       /etc/asterisk/pjsip.custom.conf \
       /etc/asterisk/extensions.conf \
       /etc/asterisk/extensions.custom.conf \
+      /etc/asterisk/musiconhold.conf \
       /etc/asterisk/musiconhold.custom.conf \
+      /etc/asterisk/voicemail.conf \
       /etc/asterisk/voicemail.custom.conf \
+      /etc/asterisk/modules.conf \
       /etc/asterisk/rtp.conf \
       /etc/asterisk/features.conf 2>/dev/null || true
 
-mkdir -p /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk/voicemail 2>/dev/null || true
+# Désactivation des modules ODBC/IMAP incompatibles sur Debian (évite conflit bloquant app_voicemail)
+if ! grep -q 'noload => app_voicemail_odbc.so' /etc/asterisk/modules.conf 2>/dev/null; then
+    if grep -q '\[modules\]' /etc/asterisk/modules.conf 2>/dev/null; then
+        sed -i '/\[modules\]/a noload => app_voicemail_odbc.so\nnoload => app_voicemail_imap.so' /etc/asterisk/modules.conf 2>/dev/null || true
+    else
+        printf '[modules]\nautoload=yes\nnoload => app_voicemail_odbc.so\nnoload => app_voicemail_imap.so\n' >> /etc/asterisk/modules.conf
+    fi
+fi
+
+# Inclusions Asterisk et configuration messagerie vocale
+if ! grep -q 'pjsip.custom.conf' /etc/asterisk/pjsip.conf 2>/dev/null; then
+    printf '\n#tryinclude "pjsip.custom.conf"\n' >> /etc/asterisk/pjsip.conf
+fi
+if ! grep -q 'extensions.custom.conf' /etc/asterisk/extensions.conf 2>/dev/null; then
+    printf '\n#tryinclude "extensions.custom.conf"\n' >> /etc/asterisk/extensions.conf
+fi
+if ! grep -q 'musiconhold.custom.conf' /etc/asterisk/musiconhold.conf 2>/dev/null; then
+    sed -i 's/^\[default\]/;[default]/' /etc/asterisk/musiconhold.conf 2>/dev/null || true
+    sed -i 's/^mode=files/;mode=files/' /etc/asterisk/musiconhold.conf 2>/dev/null || true
+    sed -i 's/^directory=moh/;directory=moh/' /etc/asterisk/musiconhold.conf 2>/dev/null || true
+    printf '\n#tryinclude "/etc/asterisk/musiconhold.custom.conf"\n' >> /etc/asterisk/musiconhold.conf
+fi
+if ! grep -q 'voicemail.custom.conf' /etc/asterisk/voicemail.conf 2>/dev/null; then
+    sed -i 's/^1234 => 4242/;1234 => 4242/' /etc/asterisk/voicemail.conf 2>/dev/null || true
+    sed -i 's/^;\s*passwordlocation\s*=\s*spooldir/passwordlocation=spooldir/' /etc/asterisk/voicemail.conf 2>/dev/null || true
+    sed -i 's|^;\s*externpassnotify\s*=.*|externpassnotify=/usr/bin/php /var/www/nexus-pbx/scripts/voicemail_pass_sync.php|' /etc/asterisk/voicemail.conf 2>/dev/null || true
+    printf '\n#tryinclude "voicemail.custom.conf"\n' >> /etc/asterisk/voicemail.conf
+fi
+
+mkdir -p /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk/voicemail/default 2>/dev/null || true
+for lang in fr en es; do
+    if [ -d "/usr/share/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang" ]; then
+        ln -sf "/usr/share/asterisk/sounds/$lang" "/var/lib/asterisk/sounds/$lang" 2>/dev/null || true
+    fi
+    if [ -d "/var/lib/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang/custom" ]; then
+        ln -sf /var/lib/asterisk/sounds/custom "/var/lib/asterisk/sounds/$lang/custom" 2>/dev/null || true
+    fi
+done
+if [ ! -e "/usr/share/asterisk/sounds/custom" ]; then
+    ln -sf /var/lib/asterisk/sounds/custom /usr/share/asterisk/sounds/custom 2>/dev/null || true
+fi
 chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk 2>/dev/null || true
 chmod -R 775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
-chmod 2775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
+chmod 2775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk /var/spool/asterisk/voicemail 2>/dev/null || true
 chmod 2750 /etc/asterisk/keys 2>/dev/null || true
 chmod 0664 /etc/asterisk/*.conf /etc/asterisk/*.custom.conf 2>/dev/null || true
 

scripts/update.sh

@@ -93,9 +93,12 @@ echo -e "${C_GREEN}  ✓ Sauvegarde de sécurité créée : $(basename "$BACKUP_
 
 # 2. Application des derniers fichiers de code Git
 echo -e "${C_GRAY}[2/6] Déploiement des nouveaux fichiers de code...${C_RESET}"
-git reset --hard "${GIT_REMOTE}/${GIT_BRANCH}"
+git reset --hard FETCH_HEAD 2>/dev/null || git reset --hard "${GIT_REMOTE}/${GIT_BRANCH}"
 chown -R www-data:asterisk "$APP_DIR" 2>/dev/null || true
 chmod 2775 "$APP_DIR/storage" "$APP_DIR/storage/backups" "$APP_DIR/storage/sounds" 2>/dev/null || true
+mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt 2>/dev/null || true
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
 chmod +x "$APP_DIR/scripts/update.sh" "$APP_DIR/scripts/nexus-firewall" "$APP_DIR/scripts/nexus-banner.sh" 2>/dev/null || true
 
 # Liens symboliques CLI (non-bloquants si exécuté sous sandbox PHP ProtectSystem)
@@ -130,8 +133,27 @@ $gen->writeAllConfigs();
 
 # 5. Fix permissions & ACLs
 echo -e "${C_GRAY}[5/6] Application des permissions et ACLs système...${C_RESET}"
-setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh 2>/dev/null || true
+php -r '
-setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh 2>/dev/null || true
+require_once "/var/www/nexus-pbx/src/Database.php";
+require_once "/var/www/nexus-pbx/src/SystemChecker.php";
+App\SystemChecker::ensureAsteriskIncludes();
+' 2>/dev/null || true
+mkdir -p /var/spool/asterisk/voicemail/default /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh 2>/dev/null || true
+for lang in fr en es; do
+    if [ -d "/usr/share/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang" ]; then
+        ln -sf "/usr/share/asterisk/sounds/$lang" "/var/lib/asterisk/sounds/$lang" 2>/dev/null || true
+    fi
+    if [ -d "/var/lib/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang/custom" ]; then
+        ln -sf /var/lib/asterisk/sounds/custom "/var/lib/asterisk/sounds/$lang/custom" 2>/dev/null || true
+    fi
+done
+if [ ! -e "/usr/share/asterisk/sounds/custom" ]; then
+    ln -sf /var/lib/asterisk/sounds/custom /usr/share/asterisk/sounds/custom 2>/dev/null || true
+fi
+chown -R asterisk:asterisk /var/spool/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh 2>/dev/null || true
+chmod 2775 /var/spool/asterisk /var/spool/asterisk/voicemail /var/lib/asterisk/sounds /var/lib/asterisk/moh 2>/dev/null || true
+setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
+setfacl -R -d -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
 chmod 0664 /etc/asterisk/*.conf /etc/asterisk/*.custom.conf 2>/dev/null || true
 
 # 6. Rechargement des services
@@ -139,8 +161,14 @@ echo -e "${C_GRAY}[6/6] Rechargement à chaud d'Asterisk et des services web...$
 asterisk -rx "core reload" >/dev/null 2>&1 || true
 asterisk -rx "pjsip reload" >/dev/null 2>&1 || true
 asterisk -rx "dialplan reload" >/dev/null 2>&1 || true
-systemctl reload php*-fpm 2>/dev/null || true
+
-systemctl reload nginx 2>/dev/null || true
+# Rechargement des services web : différé si exécuté depuis l'interface web pour éviter de couper la requête HTTP
+if [ -t 1 ]; then
+    systemctl reload php8.4-fpm 2>/dev/null || systemctl reload php8.2-fpm 2>/dev/null || systemctl reload php*-fpm 2>/dev/null || true
+    systemctl reload nginx 2>/dev/null || true
+else
+    (nohup bash -c "sleep 2 && (systemctl reload php8.4-fpm 2>/dev/null || systemctl reload php8.2-fpm 2>/dev/null || systemctl reload php*-fpm 2>/dev/null || true); systemctl reload nginx 2>/dev/null || true" >/dev/null 2>&1 &)
+fi
 
 NEW_VER="Inconnue"
 if [ -f "$APP_DIR/version.json" ]; then

src/CertificateManager.php

@@ -265,8 +265,9 @@ class CertificateManager
 
         $stagingFlag = $staging ? '--test-cert' : '';
 
-        // Exécution de Certbot webroot non-interactive (Clé RSA 2048 universellement compatible téléphones IP Yealink/Fanvil/Grandstream)
+        // Exécution de Certbot webroot non-interactive avec sudo (Clé RSA 2048 universellement compatible téléphones IP Yealink/Fanvil/Grandstream)
-        $cmd = "certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring --key-type rsa --rsa-key-size 2048 {$stagingFlag} 2>&1";
+        $hookCmd = escapeshellarg("chgrp -R asterisk /etc/letsencrypt 2>/dev/null; chmod -R g+rX /etc/letsencrypt 2>/dev/null || true");
+        $cmd = "sudo /usr/bin/certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring --key-type rsa --rsa-key-size 2048 --post-hook {$hookCmd} {$stagingFlag} 2>&1";
 
         $output = [];
         $exitCode = 0;
@@ -444,7 +445,8 @@ class CertificateManager
         $domain = $cert['primary_domain'];
         $escDomain = escapeshellarg($domain);
 
-        $cmd = "certbot renew --cert-name {$escDomain} --force-renewal 2>&1";
+        $hookCmd = escapeshellarg("chgrp -R asterisk /etc/letsencrypt 2>/dev/null; chmod -R g+rX /etc/letsencrypt 2>/dev/null || true");
+        $cmd = "sudo /usr/bin/certbot renew --cert-name {$escDomain} --force-renewal --post-hook {$hookCmd} 2>&1";
         $output = [];
         $exitCode = 0;
         exec($cmd, $output, $exitCode);

src/ConfigGenerator.php

@@ -256,6 +256,9 @@ class ConfigGenerator
             $lines[] = "type = aor";
             $lines[] = "max_contacts = {$maxContacts}";
             $lines[] = "remove_existing = yes";
+            $lines[] = "default_expiration = 120";
+            $lines[] = "maximum_expiration = 300";
+            $lines[] = "minimum_expiration = 60";
             $lines[] = "qualify_frequency = 30";
             if ($hasVm) {
                 $lines[] = "mailboxes = {$num}@default";
@@ -571,10 +574,6 @@ class ConfigGenerator
             $lines[] = " same => n,Hangup()";
         }
         if ($groupCode !== '') {
-            $lines[] = "exten => _{$groupCode}.,1,NoOp(Interception d'appel dirigee vers \${EXTEN:" . strlen($groupCode) . "})";
-            $lines[] = " same => n,Pickup(\${EXTEN:" . strlen($groupCode) . "}@from-internal)";
-            $lines[] = " same => n,Hangup()";
-
             $lines[] = "exten => {$groupCode},1,NoOp(Interception d'appel de groupe)";
             $lines[] = " same => n,Pickup()";
             $lines[] = " same => n,Hangup()";
@@ -986,9 +985,10 @@ class ConfigGenerator
                 $lines[] = "";
             }
 
-            // Interphonie directe 1-à-1 (*80 + numéro de poste)
+            // Interphonie directe 1-à-1 (*80 + numéro de poste, ex: *80101 pour le poste 101)
+            // Pattern _*80XX. pour ne cibler que les numéros de postes (au moins 2 chiffres) et ne pas chevaucher *801
             $lines[] = "; --- Interphonie directe 1-à-1 (*80 + numéro de poste) ---";
-            $lines[] = "exten => _*80.,1,NoOp(Interphonie directe vers poste \${EXTEN:3})";
+            $lines[] = "exten => _*80XX.,1,NoOp(Interphonie directe vers poste \${EXTEN:3})";
             $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
             $lines[] = " same => n,Answer()";
             $lines[] = " same => n,Playback(beep)";
@@ -997,13 +997,14 @@ class ConfigGenerator
             $lines[] = "";
         }
 
-        // Accès direct aux IVR depuis l'interne via *8 + id
+        // Accès direct aux IVR depuis l'interne via *8 + id (*801, *802...)
         if (!empty($ivrs)) {
-            $lines[] = "; --- Test direct des SVI/IVR depuis l'interne ---";
+            $lines[] = "; --- Test direct des SVI/IVR depuis l'interne (*801, *802...) ---";
             foreach ($ivrs as $ivr) {
                 $ivrSlug = $this->slugify($ivr['name']);
                 $testCode = '*8' . str_pad((string)$ivr['id'], 2, '0', STR_PAD_LEFT);
                 $lines[] = "exten => {$testCode},1,NoOp(Test SVI {$ivr['name']})";
+                $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
                 $lines[] = " same => n,Goto(ivr-{$ivrSlug},s,1)";
             }
             $lines[] = "";
@@ -1500,6 +1501,7 @@ class ConfigGenerator
             $lines[] = "; --- Serveur Vocal Interactif : {$ivr['name']} ---";
             $lines[] = "[ivr-{$ivrSlug}]";
             $lines[] = "exten => s,1,NoOp(SVI {$ivr['name']})";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
             $lines[] = " same => n,Answer()";
             $lines[] = " same => n,Wait(1)";
             $lines[] = " same => n,Set(IVR_INVALID_COUNT=0)";
@@ -1600,9 +1602,6 @@ class ConfigGenerator
         return implode("\n", $lines) . "\n";
     }
 
-    /**
-     * Sauvegarde les anciens fichiers et écrit atomiquement pjsip.custom.conf et extensions.custom.conf
-     * avec les droits Debian asterisk:asterisk (0660).
     /**
      * Génère les classes Musique d'attente (MOH) personnalisées par site/catégorie
      */
@@ -2223,18 +2222,24 @@ class ConfigGenerator
             $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE id = :id');
             $stmt->execute([':id' => (int)$soundRef]);
             $slug = $stmt->fetchColumn();
-            return $slug ? "custom/{$slug}" : $fallback;
+            return $slug ? "/var/lib/asterisk/sounds/custom/{$slug}" : $fallback;
         }
         $ref = trim((string)$soundRef);
         if (str_starts_with($ref, 'sound-')) {
             return $this->resolveSoundFile(substr($ref, 6), $fallback);
         }
+        if (str_starts_with($ref, 'custom/')) {
+            return "/var/lib/asterisk/sounds/{$ref}";
+        }
+        if (str_starts_with($ref, '/var/lib/asterisk/sounds/custom/')) {
+            return $ref;
+        }
         if (!str_contains($ref, '/') && !in_array($ref, ['demo-instruct', 'demo-echotest', 'pbx-invalid', 'hello-world', 'beep', 'silence/1', 'vm-goodbye'])) {
             $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE slug = :slug OR name = :name');
             $stmt->execute([':slug' => $ref, ':name' => $ref]);
             $slug = $stmt->fetchColumn();
             if ($slug) {
-                return "custom/{$slug}";
+                return "/var/lib/asterisk/sounds/custom/{$slug}";
             }
         }
         return $ref ?: $fallback;

src/SystemChecker.php

@@ -70,17 +70,22 @@ class SystemChecker
                 : 'Accès refusé en écriture dans /etc/asterisk pour PHP-FPM',
         ];
 
-        // 5. Directives #tryinclude dans pjsip.conf et extensions.conf
+        // 5. Directives #tryinclude dans pjsip.conf, extensions.conf, voicemail.conf et modules.conf
         $pjsipMain = @file_get_contents('/etc/asterisk/pjsip.conf') ?: '';
         $extMain   = @file_get_contents('/etc/asterisk/extensions.conf') ?: '';
-        $incOk     = str_contains($pjsipMain, 'pjsip.custom.conf') && str_contains($extMain, 'extensions.custom.conf');
+        $vmMain    = @file_get_contents('/etc/asterisk/voicemail.conf') ?: '';
+        $modMain   = @file_get_contents('/etc/asterisk/modules.conf') ?: '';
+        $incOk     = str_contains($pjsipMain, 'pjsip.custom.conf')
+                  && str_contains($extMain, 'extensions.custom.conf')
+                  && str_contains($vmMain, 'voicemail.custom.conf')
+                  && str_contains($modMain, 'app_voicemail_odbc.so');
         $checks[] = [
             'id'      => 'asterisk_includes',
-            'label'   => 'Inclusions natives (#tryinclude *.custom.conf)',
+            'label'   => 'Inclusions Asterisk & Voicemail (#tryinclude & modules.conf)',
             'ok'      => $incOk,
             'detail'  => $incOk
-                ? 'pjsip.conf et extensions.conf incluent bien les fichiers .custom.conf'
+                ? 'pjsip.conf, extensions.conf, voicemail.conf et modules.conf configurés'
-                : 'Directive #tryinclude manquante dans pjsip.conf ou extensions.conf',
+                : 'Directive #tryinclude manquante ou conflit modules.conf détecté',
         ];
 
         // 6. Certificats TLS (Let's Encrypt ou Certificat local Debian)
@@ -142,6 +147,25 @@ class SystemChecker
 
     public static function ensureAsteriskIncludes(): void
     {
+        // 1. modules.conf: Désactiver les modules voicemail ODBC/IMAP incompatibles sur Debian (évite collision bloquante avec app_voicemail.so)
+        $modConf = '/etc/asterisk/modules.conf';
+        if (is_file($modConf) && is_writable($modConf)) {
+            $content = (string)file_get_contents($modConf);
+            $changed = false;
+            if (!str_contains($content, 'app_voicemail_odbc.so')) {
+                if (preg_match('/\[modules\]/i', $content)) {
+                    $content = preg_replace('/\[modules\]/i', "[modules]\nnoload => app_voicemail_odbc.so\nnoload => app_voicemail_imap.so", $content, 1);
+                    $changed = true;
+                } else {
+                    $content = "[modules]\nautoload=yes\nnoload => app_voicemail_odbc.so\nnoload => app_voicemail_imap.so\n\n" . $content;
+                    $changed = true;
+                }
+            }
+            if ($changed) {
+                file_put_contents($modConf, $content);
+            }
+        }
+
         $pjsipConf = '/etc/asterisk/pjsip.conf';
         if (is_file($pjsipConf) && is_writable($pjsipConf)) {
             $content = (string)file_get_contents($pjsipConf);
@@ -177,8 +201,20 @@ class SystemChecker
         if (is_file($vmConf) && is_writable($vmConf)) {
             $content = (string)file_get_contents($vmConf);
             $cleaned = preg_replace('/^1234 => 4242.*/m', ';1234 => 4242,Example Mailbox,root@localhost', $content);
+            if (preg_match('/^;\s*passwordlocation\s*=\s*spooldir/m', $cleaned)) {
                 $cleaned = preg_replace('/^;\s*passwordlocation\s*=\s*spooldir/m', 'passwordlocation=spooldir', $cleaned);
+            } elseif (!str_contains($cleaned, 'passwordlocation=spooldir') && !str_contains($cleaned, 'passwordlocation = spooldir')) {
+                if (preg_match('/\[general\]/i', $cleaned)) {
+                    $cleaned = preg_replace('/\[general\]/i', "[general]\npasswordlocation=spooldir", $cleaned, 1);
+                }
+            }
+            if (preg_match('/^;\s*externpassnotify\s*=.*/m', $cleaned)) {
                 $cleaned = preg_replace('/^;\s*externpassnotify\s*=.*/m', 'externpassnotify=/usr/bin/php /var/www/nexus-pbx/scripts/voicemail_pass_sync.php', $cleaned);
+            } elseif (!str_contains($cleaned, 'externpassnotify=')) {
+                if (preg_match('/\[general\]/i', $cleaned)) {
+                    $cleaned = preg_replace('/\[general\]/i', "[general]\nexternpassnotify=/usr/bin/php /var/www/nexus-pbx/scripts/voicemail_pass_sync.php", $cleaned, 1);
+                }
+            }
             if (!str_contains($cleaned, 'voicemail.custom.conf')) {
                 $cleaned = rtrim($cleaned) . "\n\n#tryinclude \"voicemail.custom.conf\"\n";
             }
@@ -187,6 +223,47 @@ class SystemChecker
             }
         }
 
+        @mkdir('/var/spool/asterisk/voicemail/default', 0775, true);
+
+        // Liens vers les répertoires de sons Debian (/usr/share/asterisk/sounds -> /var/lib/asterisk/sounds)
+        @mkdir('/var/lib/asterisk/sounds', 0775, true);
+        @mkdir('/var/lib/asterisk/sounds/custom', 0775, true);
+        @mkdir('/var/lib/asterisk/moh', 0775, true);
+        foreach (['fr', 'en', 'es'] as $lang) {
+            $src = "/usr/share/asterisk/sounds/{$lang}";
+            $dst = "/var/lib/asterisk/sounds/{$lang}";
+            if (is_dir($src) && !file_exists($dst)) {
+                @symlink($src, $dst);
+            }
+            if (is_dir($dst) && !file_exists("{$dst}/custom")) {
+                @symlink('/var/lib/asterisk/sounds/custom', "{$dst}/custom");
+            }
+        }
+        if (!file_exists('/usr/share/asterisk/sounds/custom')) {
+            @symlink('/var/lib/asterisk/sounds/custom', '/usr/share/asterisk/sounds/custom');
+        }
+
+        // Synchroniser manager.conf avec le mot de passe AMI de la base SQLite si nécessaire (ex: après restauration de backup)
+        $mgrConf = '/etc/asterisk/manager.conf';
+        if (is_file($mgrConf) && is_writable($mgrConf)) {
+            try {
+                $db = Database::getConnection();
+                $st = $db->query('SELECT ami_user, ami_secret FROM settings WHERE id = 1')->fetch();
+                if (!empty($st['ami_secret'])) {
+                    $sec = trim((string)$st['ami_secret']);
+                    $usr = trim((string)($st['ami_user'] ?? 'pbxgui')) ?: 'pbxgui';
+                    $content = (string)file_get_contents($mgrConf);
+                    if (str_contains($content, "[{$usr}]")) {
+                        $updated = preg_replace("/(\[{$usr}\][^\[]*secret\s*=\s*)([^\r\n]+)/i", "\${1}{$sec}", $content);
+                        if ($updated !== null && $updated !== $content) {
+                            file_put_contents($mgrConf, $updated);
+                            @exec('asterisk -rx "manager reload" 2>/dev/null || true');
+                        }
+                    }
+                }
+            } catch (\Throwable) {}
+        }
+
         $astConf = '/etc/asterisk/asterisk.conf';
         if (is_file($astConf) && is_writable($astConf)) {
             $content = (string)file_get_contents($astConf);

src/SystemMetrics.php

@@ -298,17 +298,19 @@ class SystemMetrics
                 }
             }
 
+            $seenExts = [];
             foreach (preg_split('/\r?\n/', $rawContacts) ?: [] as $line) {
-                // Contact:  101/sip:101@10.10.167.162:5060                 5dd9a21be8 Avail         9.234
+                // Supporte sip:, sips:, sans préfixe, tous types de hash et RTT (numérique, nan, N/A ou absent)
-                // or with -nan: Contact:  102/sip:102@10.10.168.228:5060;x-ast-txp=trans bb0686ce80 Unavail        -nan
+                if (preg_match('/Contact:\s+([^\s\/]+)\/(?:sips?:)?([^\s]+)\s+([a-zA-Z0-9]+)\s+(\S+)(?:\s+(\S+))?/i', $line, $m)) {
-                if (preg_match('/Contact:\s+([^\s\/]+)\/sip:([^\s]+)\s+([a-f0-9]+)\s+(\S+)\s+(-?[0-9.]+|nan|-nan)/i', $line, $m)) {
                     $extNum = $m[1];
                     $uri = $m[2];
                     $status = $m[4];
+                    $rttRaw = $m[5] ?? null;
                     $isAvail = (stripos($status, 'Avail') !== false && stripos($status, 'Unavail') === false) || stripos($status, 'NonQual') !== false;
                     if ($isAvail) {
                         $onlineCount++;
                     }
+                    $seenExts[$extNum] = true;
 
                     $meta = $contactMeta[$extNum] ?? [];
                     $fullUri = $meta['uri'] ?? ("sip:" . $uri);
@@ -330,7 +332,37 @@ class SystemMetrics
                         'user_agent'       => $userAgent,
                         'active_transport' => $activeTransport,
                         'status'           => $status,
-                        'rtt_ms'           => is_numeric($m[5]) ? round((float)$m[5], 1) : null,
+                        'rtt_ms'           => ($rttRaw !== null && is_numeric($rttRaw)) ? round((float)$rttRaw, 1) : null,
+                    ];
+                }
+            }
+
+            // Filet de sécurité 100% infaillible : Tous les contacts enregistrés dans AstDB (/registrar/contact)
+            // non encore répertoriés (par exemple si qualify est désactivé ou RTT non disponible)
+            $nowTime = time();
+            foreach ($contactMeta as $extNum => $meta) {
+                if (isset($seenExts[$extNum])) {
+                    continue;
+                }
+                $exp = (int)($meta['expiration_time'] ?? 0);
+                if ($exp === 0 || $exp > $nowTime) {
+                    $onlineCount++;
+                    $fullUri = $meta['uri'] ?? '';
+                    $activeTransport = 'udp';
+                    if (preg_match('/transport=(tls|wss|ws|tcp|udp)/i', $fullUri, $tm)) {
+                        $activeTransport = strtolower($tm[1]);
+                    } elseif (preg_match('/x-ast-txp=transport-(tls|wss|ws|tcp|udp)/i', $fullUri, $tm)) {
+                        $activeTransport = strtolower($tm[1]);
+                    } elseif (str_starts_with($fullUri, 'sips:')) {
+                        $activeTransport = 'tls';
+                    }
+                    $contacts[] = [
+                        'extension'        => (string)$extNum,
+                        'uri'              => $fullUri,
+                        'user_agent'       => $meta['user_agent'] ?? '',
+                        'active_transport' => $activeTransport,
+                        'status'           => 'Avail',
+                        'rtt_ms'           => null,
                     ];
                 }
             }

version.json

@@ -1,12 +1,12 @@
 {
-  "version": "1.3.8",
+  "version": "1.5.2",
   "codename": "Helios",
   "release_date": "2026-11-04",
   "min_php_version": "8.2",
   "changelog": [
-    "Suppression de l'indication des identifiants et mot de passe par défaut sur l'écran de connexion",
+    "Correction de l'émission et du renouvellement Let's Encrypt / Certbot ACME (privilèges sudo et permissions d'accès aux certificats)",
-    "Vérification ultra-rapide des mises à jour en direct via cURL CLI et flux HTTP sans dépendre de git ou de php-curl",
+    "Plafond d'expiration d'enregistrement SIP standard (maximum_expiration = 300s, default = 120s) garantissant la reconnexion automatique rapide de tous les postes (1 à 3 min)",
-    "Bouton 'Vérifier les mises à jour' forçant le rafraîchissement immédiat du cache navigateur (bypass 24h)",
+    "Nettoyage et isolation stricte des sauvegardes (base NexusPBX, sons, spools voicemail, certificats)",
-    "Nouvelle modale de confirmation de restauration système alignée sur le thème sombre NexusPBX"
+    "Résolution définitive et propre des conflits de préfixes Dialplan sur les SVI/IVR (*801-*899)"
   ]
 }