v1.5.2: Exécution Certbot ACME avec sudo et sécurisation des droits Let's Encrypt

install.sh

@@ -88,8 +88,8 @@ if ! apt-get install -y asterisk; then
     apt-get install -y -t sid asterisk
 fi
 
-# Sons Asterisk en français (exacts de la machine de dev)
+# Sons Asterisk en français et anglais
-apt-get install -y asterisk-core-sounds-fr asterisk-core-sounds-fr-wav asterisk-core-sounds-fr-gsm 2>/dev/null || true
+apt-get install -y asterisk-core-sounds-fr asterisk-core-sounds-fr-wav asterisk-core-sounds-fr-gsm asterisk-core-sounds-en asterisk-core-sounds-en-gsm 2>/dev/null || true
 
 # Nginx, PHP-FPM et extensions requises
 apt-get install -y --no-install-recommends \
@@ -201,12 +201,17 @@ for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*
         cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
 [Service]
 ProtectSystem=false
-ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk /var/www /usr/local/bin /etc/sudoers.d
+ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk /var/www /usr/local/bin /etc/sudoers.d /etc/letsencrypt /var/lib/letsencrypt
 EOF_OVERRIDE
     fi
 done
 systemctl daemon-reload
 
+# Répertoires Let's Encrypt et permissions pour Asterisk / Web
+mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
+
 # Configuration des limites d'upload PHP (Restauration d'archives 512 Mo & Sons volumineux)
 for php_dir in /etc/php/*; do
     if [ -d "$php_dir/fpm/conf.d" ]; then
@@ -325,6 +330,17 @@ if ! grep -q 'voicemail.custom.conf' /etc/asterisk/voicemail.conf 2>/dev/null; t
 fi
 
 mkdir -p /var/spool/asterisk/voicemail/default /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh
+for lang in fr en es; do
+    if [ -d "/usr/share/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang" ]; then
+        ln -sf "/usr/share/asterisk/sounds/$lang" "/var/lib/asterisk/sounds/$lang"
+    fi
+    if [ -d "/var/lib/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang/custom" ]; then
+        ln -sf /var/lib/asterisk/sounds/custom "/var/lib/asterisk/sounds/$lang/custom" 2>/dev/null || true
+    fi
+done
+if [ ! -e "/usr/share/asterisk/sounds/custom" ]; then
+    ln -sf /var/lib/asterisk/sounds/custom /usr/share/asterisk/sounds/custom 2>/dev/null || true
+fi
 chown -R asterisk:asterisk /etc/asterisk /var/spool/asterisk /var/lib/asterisk
 chmod 0664 /etc/asterisk/*.conf /etc/asterisk/*.custom.conf 2>/dev/null || true
 chmod 2750 /etc/asterisk/keys

public/api.php

@@ -140,7 +140,7 @@ try {
             $installedVerData = file_exists("{$appDir}/version.json")
                 ? json_decode((string)file_get_contents("{$appDir}/version.json"), true)
                 : [];
-            $installedVer = $installedVerData['version'] ?? '1.4.6';
+            $installedVer = $installedVerData['version'] ?? '1.5.0';
 
             echo json_encode([
                 'success'          => true,
@@ -227,7 +227,7 @@ try {
                 @chmod($webLog, 0664);
             }
             @unlink('/tmp/nexus_fw_status_cache.json');
-            exec('sudo /usr/bin/fail2ban-client reload 2>&1');
+            exec('sudo /usr/bin/systemctl restart fail2ban 2>&1 || sudo /usr/bin/fail2ban-client reload 2>&1');
 
             echo json_encode([
                 'success' => true,

public/index.php

@@ -18,7 +18,7 @@ $companyLogo = trim($branding['company_logo'] ?? '');
 $hasBranding = !empty($companyName) || !empty($companyLogo);
 
 $appVerData = file_exists(__DIR__ . '/../version.json') ? json_decode((string)file_get_contents(__DIR__ . '/../version.json'), true) : [];
-$appVersion = $appVerData['version'] ?? '1.4.6';
+$appVersion = $appVerData['version'] ?? '1.5.0';
 ?>
 <!DOCTYPE html>
 <html lang="fr" class="h-full">

scripts/fix.sh

@@ -57,7 +57,9 @@ echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..
 usermod -aG asterisk www-data 2>/dev/null || true
 usermod -aG www-data asterisk 2>/dev/null || true
 
-mkdir -p /var/www/nexus-pbx/public/avatars /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups
+mkdir -p /var/www/nexus-pbx/public/avatars /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
 chown -R www-data:asterisk /var/www/nexus-pbx
 chmod 2775 /var/www/nexus-pbx/storage /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/public/avatars 2>/dev/null || true
 
@@ -103,6 +105,17 @@ if ! grep -q 'voicemail.custom.conf' /etc/asterisk/voicemail.conf 2>/dev/null; t
 fi
 
 mkdir -p /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk/voicemail/default 2>/dev/null || true
+for lang in fr en es; do
+    if [ -d "/usr/share/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang" ]; then
+        ln -sf "/usr/share/asterisk/sounds/$lang" "/var/lib/asterisk/sounds/$lang" 2>/dev/null || true
+    fi
+    if [ -d "/var/lib/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang/custom" ]; then
+        ln -sf /var/lib/asterisk/sounds/custom "/var/lib/asterisk/sounds/$lang/custom" 2>/dev/null || true
+    fi
+done
+if [ ! -e "/usr/share/asterisk/sounds/custom" ]; then
+    ln -sf /var/lib/asterisk/sounds/custom /usr/share/asterisk/sounds/custom 2>/dev/null || true
+fi
 chown -R asterisk:asterisk /etc/asterisk /var/lib/asterisk /var/spool/asterisk /var/log/asterisk 2>/dev/null || true
 chmod -R 775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true
 chmod 2775 /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh /var/spool/asterisk /var/spool/asterisk/voicemail 2>/dev/null || true

scripts/update.sh

@@ -96,6 +96,9 @@ echo -e "${C_GRAY}[2/6] Déploiement des nouveaux fichiers de code...${C_RESET}"
 git reset --hard FETCH_HEAD 2>/dev/null || git reset --hard "${GIT_REMOTE}/${GIT_BRANCH}"
 chown -R www-data:asterisk "$APP_DIR" 2>/dev/null || true
 chmod 2775 "$APP_DIR/storage" "$APP_DIR/storage/backups" "$APP_DIR/storage/sounds" 2>/dev/null || true
+mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt 2>/dev/null || true
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
 chmod +x "$APP_DIR/scripts/update.sh" "$APP_DIR/scripts/nexus-firewall" "$APP_DIR/scripts/nexus-banner.sh" 2>/dev/null || true
 
 # Liens symboliques CLI (non-bloquants si exécuté sous sandbox PHP ProtectSystem)
@@ -136,6 +139,17 @@ require_once "/var/www/nexus-pbx/src/SystemChecker.php";
 App\SystemChecker::ensureAsteriskIncludes();
 ' 2>/dev/null || true
 mkdir -p /var/spool/asterisk/voicemail/default /var/lib/asterisk/sounds/custom /var/lib/asterisk/moh 2>/dev/null || true
+for lang in fr en es; do
+    if [ -d "/usr/share/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang" ]; then
+        ln -sf "/usr/share/asterisk/sounds/$lang" "/var/lib/asterisk/sounds/$lang" 2>/dev/null || true
+    fi
+    if [ -d "/var/lib/asterisk/sounds/$lang" ] && [ ! -e "/var/lib/asterisk/sounds/$lang/custom" ]; then
+        ln -sf /var/lib/asterisk/sounds/custom "/var/lib/asterisk/sounds/$lang/custom" 2>/dev/null || true
+    fi
+done
+if [ ! -e "/usr/share/asterisk/sounds/custom" ]; then
+    ln -sf /var/lib/asterisk/sounds/custom /usr/share/asterisk/sounds/custom 2>/dev/null || true
+fi
 chown -R asterisk:asterisk /var/spool/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh 2>/dev/null || true
 chmod 2775 /var/spool/asterisk /var/spool/asterisk/voicemail /var/lib/asterisk/sounds /var/lib/asterisk/moh 2>/dev/null || true
 setfacl -R -m u:www-data:rwx,g:asterisk:rwx /etc/asterisk /var/lib/asterisk/sounds /var/lib/asterisk/moh /var/spool/asterisk 2>/dev/null || true

src/CertificateManager.php

@@ -265,8 +265,9 @@ class CertificateManager
 
         $stagingFlag = $staging ? '--test-cert' : '';
 
-        // Exécution de Certbot webroot non-interactive (Clé RSA 2048 universellement compatible téléphones IP Yealink/Fanvil/Grandstream)
+        // Exécution de Certbot webroot non-interactive avec sudo (Clé RSA 2048 universellement compatible téléphones IP Yealink/Fanvil/Grandstream)
-        $cmd = "certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring --key-type rsa --rsa-key-size 2048 {$stagingFlag} 2>&1";
+        $hookCmd = escapeshellarg("chgrp -R asterisk /etc/letsencrypt 2>/dev/null; chmod -R g+rX /etc/letsencrypt 2>/dev/null || true");
+        $cmd = "sudo /usr/bin/certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring --key-type rsa --rsa-key-size 2048 --post-hook {$hookCmd} {$stagingFlag} 2>&1";
 
         $output = [];
         $exitCode = 0;
@@ -444,7 +445,8 @@ class CertificateManager
         $domain = $cert['primary_domain'];
         $escDomain = escapeshellarg($domain);
 
-        $cmd = "certbot renew --cert-name {$escDomain} --force-renewal 2>&1";
+        $hookCmd = escapeshellarg("chgrp -R asterisk /etc/letsencrypt 2>/dev/null; chmod -R g+rX /etc/letsencrypt 2>/dev/null || true");
+        $cmd = "sudo /usr/bin/certbot renew --cert-name {$escDomain} --force-renewal --post-hook {$hookCmd} 2>&1";
         $output = [];
         $exitCode = 0;
         exec($cmd, $output, $exitCode);

src/ConfigGenerator.php

@@ -256,6 +256,9 @@ class ConfigGenerator
             $lines[] = "type = aor";
             $lines[] = "max_contacts = {$maxContacts}";
             $lines[] = "remove_existing = yes";
+            $lines[] = "default_expiration = 120";
+            $lines[] = "maximum_expiration = 300";
+            $lines[] = "minimum_expiration = 60";
             $lines[] = "qualify_frequency = 30";
             if ($hasVm) {
                 $lines[] = "mailboxes = {$num}@default";
@@ -571,10 +574,6 @@ class ConfigGenerator
             $lines[] = " same => n,Hangup()";
         }
         if ($groupCode !== '') {
-            $lines[] = "exten => _{$groupCode}.,1,NoOp(Interception d'appel dirigee vers \${EXTEN:" . strlen($groupCode) . "})";
-            $lines[] = " same => n,Pickup(\${EXTEN:" . strlen($groupCode) . "}@from-internal)";
-            $lines[] = " same => n,Hangup()";
-
             $lines[] = "exten => {$groupCode},1,NoOp(Interception d'appel de groupe)";
             $lines[] = " same => n,Pickup()";
             $lines[] = " same => n,Hangup()";
@@ -986,9 +985,10 @@ class ConfigGenerator
                 $lines[] = "";
             }
 
-            // Interphonie directe 1-à-1 (*80 + numéro de poste)
+            // Interphonie directe 1-à-1 (*80 + numéro de poste, ex: *80101 pour le poste 101)
+            // Pattern _*80XX. pour ne cibler que les numéros de postes (au moins 2 chiffres) et ne pas chevaucher *801
             $lines[] = "; --- Interphonie directe 1-à-1 (*80 + numéro de poste) ---";
-            $lines[] = "exten => _*80.,1,NoOp(Interphonie directe vers poste \${EXTEN:3})";
+            $lines[] = "exten => _*80XX.,1,NoOp(Interphonie directe vers poste \${EXTEN:3})";
             $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
             $lines[] = " same => n,Answer()";
             $lines[] = " same => n,Playback(beep)";
@@ -997,13 +997,14 @@ class ConfigGenerator
             $lines[] = "";
         }
 
-        // Accès direct aux IVR depuis l'interne via *8 + id
+        // Accès direct aux IVR depuis l'interne via *8 + id (*801, *802...)
         if (!empty($ivrs)) {
-            $lines[] = "; --- Test direct des SVI/IVR depuis l'interne ---";
+            $lines[] = "; --- Test direct des SVI/IVR depuis l'interne (*801, *802...) ---";
             foreach ($ivrs as $ivr) {
                 $ivrSlug = $this->slugify($ivr['name']);
                 $testCode = '*8' . str_pad((string)$ivr['id'], 2, '0', STR_PAD_LEFT);
                 $lines[] = "exten => {$testCode},1,NoOp(Test SVI {$ivr['name']})";
+                $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
                 $lines[] = " same => n,Goto(ivr-{$ivrSlug},s,1)";
             }
             $lines[] = "";
@@ -1500,6 +1501,7 @@ class ConfigGenerator
             $lines[] = "; --- Serveur Vocal Interactif : {$ivr['name']} ---";
             $lines[] = "[ivr-{$ivrSlug}]";
             $lines[] = "exten => s,1,NoOp(SVI {$ivr['name']})";
+            $lines[] = " same => n,Set(CHANNEL(language)={$sysLang})";
             $lines[] = " same => n,Answer()";
             $lines[] = " same => n,Wait(1)";
             $lines[] = " same => n,Set(IVR_INVALID_COUNT=0)";
@@ -1600,9 +1602,6 @@ class ConfigGenerator
         return implode("\n", $lines) . "\n";
     }
 
-    /**
-     * Sauvegarde les anciens fichiers et écrit atomiquement pjsip.custom.conf et extensions.custom.conf
-     * avec les droits Debian asterisk:asterisk (0660).
     /**
      * Génère les classes Musique d'attente (MOH) personnalisées par site/catégorie
      */
@@ -2223,18 +2222,24 @@ class ConfigGenerator
             $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE id = :id');
             $stmt->execute([':id' => (int)$soundRef]);
             $slug = $stmt->fetchColumn();
-            return $slug ? "custom/{$slug}" : $fallback;
+            return $slug ? "/var/lib/asterisk/sounds/custom/{$slug}" : $fallback;
         }
         $ref = trim((string)$soundRef);
         if (str_starts_with($ref, 'sound-')) {
             return $this->resolveSoundFile(substr($ref, 6), $fallback);
         }
+        if (str_starts_with($ref, 'custom/')) {
+            return "/var/lib/asterisk/sounds/{$ref}";
+        }
+        if (str_starts_with($ref, '/var/lib/asterisk/sounds/custom/')) {
+            return $ref;
+        }
         if (!str_contains($ref, '/') && !in_array($ref, ['demo-instruct', 'demo-echotest', 'pbx-invalid', 'hello-world', 'beep', 'silence/1', 'vm-goodbye'])) {
             $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE slug = :slug OR name = :name');
             $stmt->execute([':slug' => $ref, ':name' => $ref]);
             $slug = $stmt->fetchColumn();
             if ($slug) {
-                return "custom/{$slug}";
+                return "/var/lib/asterisk/sounds/custom/{$slug}";
             }
         }
         return $ref ?: $fallback;

src/SystemChecker.php

@@ -225,6 +225,45 @@ class SystemChecker
 
         @mkdir('/var/spool/asterisk/voicemail/default', 0775, true);
 
+        // Liens vers les répertoires de sons Debian (/usr/share/asterisk/sounds -> /var/lib/asterisk/sounds)
+        @mkdir('/var/lib/asterisk/sounds', 0775, true);
+        @mkdir('/var/lib/asterisk/sounds/custom', 0775, true);
+        @mkdir('/var/lib/asterisk/moh', 0775, true);
+        foreach (['fr', 'en', 'es'] as $lang) {
+            $src = "/usr/share/asterisk/sounds/{$lang}";
+            $dst = "/var/lib/asterisk/sounds/{$lang}";
+            if (is_dir($src) && !file_exists($dst)) {
+                @symlink($src, $dst);
+            }
+            if (is_dir($dst) && !file_exists("{$dst}/custom")) {
+                @symlink('/var/lib/asterisk/sounds/custom', "{$dst}/custom");
+            }
+        }
+        if (!file_exists('/usr/share/asterisk/sounds/custom')) {
+            @symlink('/var/lib/asterisk/sounds/custom', '/usr/share/asterisk/sounds/custom');
+        }
+
+        // Synchroniser manager.conf avec le mot de passe AMI de la base SQLite si nécessaire (ex: après restauration de backup)
+        $mgrConf = '/etc/asterisk/manager.conf';
+        if (is_file($mgrConf) && is_writable($mgrConf)) {
+            try {
+                $db = Database::getConnection();
+                $st = $db->query('SELECT ami_user, ami_secret FROM settings WHERE id = 1')->fetch();
+                if (!empty($st['ami_secret'])) {
+                    $sec = trim((string)$st['ami_secret']);
+                    $usr = trim((string)($st['ami_user'] ?? 'pbxgui')) ?: 'pbxgui';
+                    $content = (string)file_get_contents($mgrConf);
+                    if (str_contains($content, "[{$usr}]")) {
+                        $updated = preg_replace("/(\[{$usr}\][^\[]*secret\s*=\s*)([^\r\n]+)/i", "\${1}{$sec}", $content);
+                        if ($updated !== null && $updated !== $content) {
+                            file_put_contents($mgrConf, $updated);
+                            @exec('asterisk -rx "manager reload" 2>/dev/null || true');
+                        }
+                    }
+                }
+            } catch (\Throwable) {}
+        }
+
         $astConf = '/etc/asterisk/asterisk.conf';
         if (is_file($astConf) && is_writable($astConf)) {
             $content = (string)file_get_contents($astConf);

src/SystemMetrics.php

@@ -298,17 +298,19 @@ class SystemMetrics
                 }
             }
 
+            $seenExts = [];
             foreach (preg_split('/\r?\n/', $rawContacts) ?: [] as $line) {
-                // Contact:  101/sip:101@10.10.167.162:5060                 5dd9a21be8 Avail         9.234
+                // Supporte sip:, sips:, sans préfixe, tous types de hash et RTT (numérique, nan, N/A ou absent)
-                // or with -nan: Contact:  102/sip:102@10.10.168.228:5060;x-ast-txp=trans bb0686ce80 Unavail        -nan
+                if (preg_match('/Contact:\s+([^\s\/]+)\/(?:sips?:)?([^\s]+)\s+([a-zA-Z0-9]+)\s+(\S+)(?:\s+(\S+))?/i', $line, $m)) {
-                if (preg_match('/Contact:\s+([^\s\/]+)\/sip:([^\s]+)\s+([a-f0-9]+)\s+(\S+)\s+(-?[0-9.]+|nan|-nan)/i', $line, $m)) {
                     $extNum = $m[1];
                     $uri = $m[2];
                     $status = $m[4];
+                    $rttRaw = $m[5] ?? null;
                     $isAvail = (stripos($status, 'Avail') !== false && stripos($status, 'Unavail') === false) || stripos($status, 'NonQual') !== false;
                     if ($isAvail) {
                         $onlineCount++;
                     }
+                    $seenExts[$extNum] = true;
 
                     $meta = $contactMeta[$extNum] ?? [];
                     $fullUri = $meta['uri'] ?? ("sip:" . $uri);
@@ -330,7 +332,37 @@ class SystemMetrics
                         'user_agent'       => $userAgent,
                         'active_transport' => $activeTransport,
                         'status'           => $status,
-                        'rtt_ms'           => is_numeric($m[5]) ? round((float)$m[5], 1) : null,
+                        'rtt_ms'           => ($rttRaw !== null && is_numeric($rttRaw)) ? round((float)$rttRaw, 1) : null,
+                    ];
+                }
+            }
+
+            // Filet de sécurité 100% infaillible : Tous les contacts enregistrés dans AstDB (/registrar/contact)
+            // non encore répertoriés (par exemple si qualify est désactivé ou RTT non disponible)
+            $nowTime = time();
+            foreach ($contactMeta as $extNum => $meta) {
+                if (isset($seenExts[$extNum])) {
+                    continue;
+                }
+                $exp = (int)($meta['expiration_time'] ?? 0);
+                if ($exp === 0 || $exp > $nowTime) {
+                    $onlineCount++;
+                    $fullUri = $meta['uri'] ?? '';
+                    $activeTransport = 'udp';
+                    if (preg_match('/transport=(tls|wss|ws|tcp|udp)/i', $fullUri, $tm)) {
+                        $activeTransport = strtolower($tm[1]);
+                    } elseif (preg_match('/x-ast-txp=transport-(tls|wss|ws|tcp|udp)/i', $fullUri, $tm)) {
+                        $activeTransport = strtolower($tm[1]);
+                    } elseif (str_starts_with($fullUri, 'sips:')) {
+                        $activeTransport = 'tls';
+                    }
+                    $contacts[] = [
+                        'extension'        => (string)$extNum,
+                        'uri'              => $fullUri,
+                        'user_agent'       => $meta['user_agent'] ?? '',
+                        'active_transport' => $activeTransport,
+                        'status'           => 'Avail',
+                        'rtt_ms'           => null,
                     ];
                 }
             }

version.json

@@ -1,13 +1,12 @@
 {
-  "version": "1.4.6",
+  "version": "1.5.2",
   "codename": "Helios",
   "release_date": "2026-11-04",
   "min_php_version": "8.2",
   "changelog": [
-    "Fiabilisation clé en main de la messagerie vocale (*97 / *98) sur toute installation fraîche Debian (install.sh & fix.sh)",
+    "Correction de l'émission et du renouvellement Let's Encrypt / Certbot ACME (privilèges sudo et permissions d'accès aux certificats)",
-    "Neutralisation préventive des modules voicemail ODBC/IMAP incompatibles sur Debian (évite les conflits bloquant app_voicemail)",
+    "Plafond d'expiration d'enregistrement SIP standard (maximum_expiration = 300s, default = 120s) garantissant la reconnexion automatique rapide de tous les postes (1 à 3 min)",
-    "Inclusion automatique de voicemail.custom.conf et musiconhold.custom.conf dès l'installation",
+    "Nettoyage et isolation stricte des sauvegardes (base NexusPBX, sons, spools voicemail, certificats)",
-    "Génération et permissions strictes sur les répertoires de spool voicemail (/var/spool/asterisk/voicemail)",
+    "Résolution définitive et propre des conflits de préfixes Dialplan sur les SVI/IVR (*801-*899)"
-    "Contrôle d'intégrité renforcé dans le diagnostic système (SystemChecker)"
   ]
 }