v1.5.2: Exécution Certbot ACME avec sudo et sécurisation des droits Let's Encrypt

install.sh

@@ -201,12 +201,17 @@ for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*
         cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
 [Service]
 ProtectSystem=false
-ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk /var/www /usr/local/bin /etc/sudoers.d
+ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk /var/www /usr/local/bin /etc/sudoers.d /etc/letsencrypt /var/lib/letsencrypt
 EOF_OVERRIDE
     fi
 done
 systemctl daemon-reload
 
+# Répertoires Let's Encrypt et permissions pour Asterisk / Web
+mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
+
 # Configuration des limites d'upload PHP (Restauration d'archives 512 Mo & Sons volumineux)
 for php_dir in /etc/php/*; do
     if [ -d "$php_dir/fpm/conf.d" ]; then

public/api.php

@@ -140,7 +140,7 @@ try {
             $installedVerData = file_exists("{$appDir}/version.json")
                 ? json_decode((string)file_get_contents("{$appDir}/version.json"), true)
                 : [];
-            $installedVer = $installedVerData['version'] ?? '1.4.9';
+            $installedVer = $installedVerData['version'] ?? '1.5.0';
 
             echo json_encode([
                 'success'          => true,

public/index.php

@@ -18,7 +18,7 @@ $companyLogo = trim($branding['company_logo'] ?? '');
 $hasBranding = !empty($companyName) || !empty($companyLogo);
 
 $appVerData = file_exists(__DIR__ . '/../version.json') ? json_decode((string)file_get_contents(__DIR__ . '/../version.json'), true) : [];
-$appVersion = $appVerData['version'] ?? '1.4.9';
+$appVersion = $appVerData['version'] ?? '1.5.0';
 ?>
 <!DOCTYPE html>
 <html lang="fr" class="h-full">

scripts/fix.sh

@@ -57,7 +57,9 @@ echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..
 usermod -aG asterisk www-data 2>/dev/null || true
 usermod -aG www-data asterisk 2>/dev/null || true
 
-mkdir -p /var/www/nexus-pbx/public/avatars /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups
+mkdir -p /var/www/nexus-pbx/public/avatars /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
 chown -R www-data:asterisk /var/www/nexus-pbx
 chmod 2775 /var/www/nexus-pbx/storage /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/public/avatars 2>/dev/null || true
 

scripts/update.sh

@@ -96,6 +96,9 @@ echo -e "${C_GRAY}[2/6] Déploiement des nouveaux fichiers de code...${C_RESET}"
 git reset --hard FETCH_HEAD 2>/dev/null || git reset --hard "${GIT_REMOTE}/${GIT_BRANCH}"
 chown -R www-data:asterisk "$APP_DIR" 2>/dev/null || true
 chmod 2775 "$APP_DIR/storage" "$APP_DIR/storage/backups" "$APP_DIR/storage/sounds" 2>/dev/null || true
+mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt 2>/dev/null || true
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
 chmod +x "$APP_DIR/scripts/update.sh" "$APP_DIR/scripts/nexus-firewall" "$APP_DIR/scripts/nexus-banner.sh" 2>/dev/null || true
 
 # Liens symboliques CLI (non-bloquants si exécuté sous sandbox PHP ProtectSystem)

src/CertificateManager.php

@@ -265,8 +265,9 @@ class CertificateManager
 
         $stagingFlag = $staging ? '--test-cert' : '';
 
-        // Exécution de Certbot webroot non-interactive (Clé RSA 2048 universellement compatible téléphones IP Yealink/Fanvil/Grandstream)
+        // Exécution de Certbot webroot non-interactive avec sudo (Clé RSA 2048 universellement compatible téléphones IP Yealink/Fanvil/Grandstream)
-        $cmd = "certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring --key-type rsa --rsa-key-size 2048 {$stagingFlag} 2>&1";
+        $hookCmd = escapeshellarg("chgrp -R asterisk /etc/letsencrypt 2>/dev/null; chmod -R g+rX /etc/letsencrypt 2>/dev/null || true");
+        $cmd = "sudo /usr/bin/certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring --key-type rsa --rsa-key-size 2048 --post-hook {$hookCmd} {$stagingFlag} 2>&1";
 
         $output = [];
         $exitCode = 0;
@@ -444,7 +445,8 @@ class CertificateManager
         $domain = $cert['primary_domain'];
         $escDomain = escapeshellarg($domain);
 
-        $cmd = "certbot renew --cert-name {$escDomain} --force-renewal 2>&1";
+        $hookCmd = escapeshellarg("chgrp -R asterisk /etc/letsencrypt 2>/dev/null; chmod -R g+rX /etc/letsencrypt 2>/dev/null || true");
+        $cmd = "sudo /usr/bin/certbot renew --cert-name {$escDomain} --force-renewal --post-hook {$hookCmd} 2>&1";
         $output = [];
         $exitCode = 0;
         exec($cmd, $output, $exitCode);

src/ConfigGenerator.php

@@ -256,6 +256,9 @@ class ConfigGenerator
             $lines[] = "type = aor";
             $lines[] = "max_contacts = {$maxContacts}";
             $lines[] = "remove_existing = yes";
+            $lines[] = "default_expiration = 120";
+            $lines[] = "maximum_expiration = 300";
+            $lines[] = "minimum_expiration = 60";
             $lines[] = "qualify_frequency = 30";
             if ($hasVm) {
                 $lines[] = "mailboxes = {$num}@default";
@@ -2219,18 +2222,24 @@ class ConfigGenerator
             $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE id = :id');
             $stmt->execute([':id' => (int)$soundRef]);
             $slug = $stmt->fetchColumn();
-            return $slug ? "custom/{$slug}" : $fallback;
+            return $slug ? "/var/lib/asterisk/sounds/custom/{$slug}" : $fallback;
         }
         $ref = trim((string)$soundRef);
         if (str_starts_with($ref, 'sound-')) {
             return $this->resolveSoundFile(substr($ref, 6), $fallback);
         }
+        if (str_starts_with($ref, 'custom/')) {
+            return "/var/lib/asterisk/sounds/{$ref}";
+        }
+        if (str_starts_with($ref, '/var/lib/asterisk/sounds/custom/')) {
+            return $ref;
+        }
         if (!str_contains($ref, '/') && !in_array($ref, ['demo-instruct', 'demo-echotest', 'pbx-invalid', 'hello-world', 'beep', 'silence/1', 'vm-goodbye'])) {
             $stmt = $this->db->prepare('SELECT slug FROM sounds WHERE slug = :slug OR name = :name');
             $stmt->execute([':slug' => $ref, ':name' => $ref]);
             $slug = $stmt->fetchColumn();
             if ($slug) {
-                return "custom/{$slug}";
+                return "/var/lib/asterisk/sounds/custom/{$slug}";
             }
         }
         return $ref ?: $fallback;

version.json

@@ -1,12 +1,12 @@
 {
-  "version": "1.4.9",
+  "version": "1.5.2",
   "codename": "Helios",
   "release_date": "2026-11-04",
   "min_php_version": "8.2",
   "changelog": [
-    "Résolution du chemin audio des annonces personnalisées SVI sous Debian (/sounds/fr/custom/)",
+    "Correction de l'émission et du renouvellement Let's Encrypt / Certbot ACME (privilèges sudo et permissions d'accès aux certificats)",
-    "Restauration instantanée du statut en ligne des postes après restauration de sauvegarde (sans délai de Qualify)",
+    "Plafond d'expiration d'enregistrement SIP standard (maximum_expiration = 300s, default = 120s) garantissant la reconnexion automatique rapide de tous les postes (1 à 3 min)",
-    "Correction des conflits de préfixes Dialplan (*801-*899 vs *8 / *80)",
+    "Nettoyage et isolation stricte des sauvegardes (base NexusPBX, sons, spools voicemail, certificats)",
-    "Code propre, robuste et optimisé sans surcharge"
+    "Résolution définitive et propre des conflits de préfixes Dialplan sur les SVI/IVR (*801-*899)"
   ]
 }