<?php
declare(strict_types=1);

namespace App;

use PDO;
use Exception;
use RuntimeException;
use InvalidArgumentException;

class FirewallManager
{
    public const JAIL_LOCAL_PATH = '/etc/fail2ban/jail.local';
    public const NGINX_CONF_PATH = '/etc/nginx/sites-available/nexus-pbx';
    public const WEB_FILTER_PATH = '/etc/fail2ban/filter.d/nexus-web.conf';
    public const UCP_FILTER_PATH = '/etc/fail2ban/filter.d/nexus-ucp.conf';
    public const UCP_SECURITY_LOG = '/var/log/nexus_ucp_security.log';
    public const UCP_ROOT_DIR = '/var/www/nexus-pbx/ucp';

    /**
     * Récupère la configuration actuelle du pare-feu et de Fail2ban depuis SQLite.
     */
    public static function getSettings(): array
    {
        $db = Database::getConnection();
        $stmt = $db->query("SELECT 
            firewall_enabled, admin_https_port, certbot_strict_port80,
            fail2ban_sip_maxretry, fail2ban_sip_findtime, fail2ban_sip_bantime,
            fail2ban_web_maxretry, fail2ban_web_bantime, fail2ban_whitelist_ips,
            ucp_enabled, ucp_https_port, ucp_http_port,
            fail2ban_ucp_maxretry, fail2ban_ucp_bantime
            FROM settings WHERE id = 1");
        $row = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$row) {
            return [
                'firewall_enabled' => 1,
                'admin_https_port' => 8443,
                'certbot_strict_port80' => 0,
                'fail2ban_sip_maxretry' => 3,
                'fail2ban_sip_findtime' => 600,
                'fail2ban_sip_bantime' => 3600,
                'fail2ban_web_maxretry' => 3,
                'fail2ban_web_bantime' => 3600,
                'fail2ban_whitelist_ips' => '127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 82.122.84.60',
                'ucp_enabled' => 1,
                'ucp_https_port' => 8444,
                'ucp_http_port' => 8084,
                'fail2ban_ucp_maxretry' => 3,
                'fail2ban_ucp_bantime' => 3600,
            ];
        }

        return [
            'firewall_enabled' => (int)($row['firewall_enabled'] ?? 1),
            'admin_https_port' => (int)($row['admin_https_port'] ?? 8443),
            'certbot_strict_port80' => (int)($row['certbot_strict_port80'] ?? 0),
            'fail2ban_sip_maxretry' => (int)($row['fail2ban_sip_maxretry'] ?? 3),
            'fail2ban_sip_findtime' => (int)($row['fail2ban_sip_findtime'] ?? 600),
            'fail2ban_sip_bantime' => (int)($row['fail2ban_sip_bantime'] ?? 3600),
            'fail2ban_web_maxretry' => (int)($row['fail2ban_web_maxretry'] ?? 3),
            'fail2ban_web_bantime' => (int)($row['fail2ban_web_bantime'] ?? 3600),
            'fail2ban_whitelist_ips' => (string)($row['fail2ban_whitelist_ips'] ?? '127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 82.122.84.60'),
            'ucp_enabled' => (int)($row['ucp_enabled'] ?? 1),
            'ucp_https_port' => (int)($row['ucp_https_port'] ?? 8444),
            'ucp_http_port' => (int)($row['ucp_http_port'] ?? 8084),
            'fail2ban_ucp_maxretry' => (int)($row['fail2ban_ucp_maxretry'] ?? 3),
            'fail2ban_ucp_bantime' => (int)($row['fail2ban_ucp_bantime'] ?? 3600),
        ];
    }

    /**
     * Retourne l'état complet en direct de Fail2ban et les IPs bannies.
     * Utilise un cache rapide de 4 secondes pour soulager le tableau de bord temps réel.
     */
    public static function getStatus(bool $forceFresh = false): array
    {
        $cacheFile = '/tmp/nexus_fw_status_cache.json';
        if (!$forceFresh && file_exists($cacheFile)) {
            $mtime = @filemtime($cacheFile);
            if ($mtime && (time() - $mtime) < 4) {
                $cached = json_decode((string)file_get_contents($cacheFile), true);
                if (is_array($cached)) {
                    return $cached;
                }
            }
        }

        $settings = self::getSettings();

        // 1. Détection service Fail2ban (Statut Systemd + vérification socket ping)
        $sysActive = trim((string)@shell_exec('systemctl is-active fail2ban 2>/dev/null')) === 'active';
        $pingCode = -1;
        $pingOut = [];
        if ($sysActive) {
            exec('timeout 2 sudo -n /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode);
        }
        $pingOk = ($pingCode === 0 && str_contains(implode(' ', $pingOut), 'Server replied: pong'));
        $isRunning = $sysActive || $pingOk;

        $jails = [];
        $bannedList = [];
        $totalBannedCount = 0;

        if ($isRunning && $pingOk) {
            exec('timeout 2 sudo -n /usr/bin/fail2ban-client status 2>&1', $statOut);
            $statStr = implode("\n", $statOut);

            // Extraction des prisons actives
            if (preg_match('/Jail list:\s+(.+)$/m', $statStr, $m)) {
                $jailNames = array_map('trim', explode(',', $m[1]));
                foreach ($jailNames as $jName) {
                    if ($jName === '') continue;
                    $jStatus = self::getJailDetails($jName);
                    $jails[$jName] = $jStatus;

                    foreach ($jStatus['banned_ips'] as $bIp) {
                        $bannedList[] = [
                            'ip' => $bIp,
                            'jail' => $jName,
                            'jail_label' => self::formatJailName($jName),
                        ];
                        $totalBannedCount++;
                    }
                }
            }
        }

        // IP actuelle du client (avec résolution reverse proxy si proxy privé/local)
        $currentIp = self::resolveClientIp();

        $status = [
            'is_running' => $isRunning,
            'settings' => $settings,
            'jails' => $jails,
            'banned_ips' => $bannedList,
            'total_banned' => $totalBannedCount,
            'client_ip' => $currentIp,
        ];

        @file_put_contents($cacheFile, json_encode($status));
        return $status;
    }

    /**
     * Débannit une adresse IP d'une prison ou de toutes les prisons.
     */
    public static function unbanIp(string $ip, string $jail = ''): array
    {
        $ip = trim($ip);
        if ($ip === '' || (!filter_var($ip, FILTER_VALIDATE_IP) && !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
            throw new InvalidArgumentException("Adresse IP invalide : {$ip}");
        }

        $jail = trim($jail);
        $unbannedFrom = [];

        if ($jail !== '' && $jail !== 'all') {
            $cmd = "timeout 2 sudo -n /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1";
            exec($cmd, $out, $code);
            if ($code === 0) {
                $unbannedFrom[] = $jail;
            }
        } else {
            // Débannir de toutes les prisons connues
            foreach (['asterisk', 'nexus-web', 'nexus-ucp', 'sshd'] as $j) {
                $cmd = "timeout 2 sudo -n /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1";
                exec($cmd, $out, $code);
                if ($code === 0) {
                    $unbannedFrom[] = $j;
                }
            }
        }

        @unlink('/tmp/nexus_fw_status_cache.json');

        return [
            'success' => count($unbannedFrom) > 0,
            'message' => count($unbannedFrom) > 0
                ? "L'adresse IP {$ip} a été débannie avec succès (" . implode(', ', $unbannedFrom) . ")."
                : "L'adresse IP {$ip} n'a pas été trouvée dans les listes de bannissement actives.",
        ];
    }

    /**
     * Bannit manuellement une adresse IP.
     */
    public static function banIp(string $ip, string $jail = 'asterisk'): array
    {
        $ip = trim($ip);
        if ($ip === '' || (!filter_var($ip, FILTER_VALIDATE_IP) && !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
            throw new InvalidArgumentException("Adresse IP invalide : {$ip}");
        }

        $jail = trim($jail) ?: 'asterisk';
        $cmd = "timeout 2 sudo -n /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1";
        exec($cmd, $out, $code);
        @unlink('/tmp/nexus_fw_status_cache.json');

        return [
            'success' => $code === 0,
            'message' => $code === 0
                ? "L'adresse IP {$ip} a été bannie sur la règle {$jail}."
                : "Échec du bannissement : " . implode("\n", $out),
        ];
    }

    /**
     * Enregistre les paramètres du pare-feu, régénère jail.local et la configuration Nginx.
     */
    public static function saveSettings(array $data): array
    {
        $db = Database::getConnection();

        $oldSettings = self::getSettings();
        $strictPort80 = !empty($data['certbot_strict_port80']) ? 1 : 0;
        $firewallEnabled = isset($data['firewall_enabled']) ? (!empty($data['firewall_enabled']) ? 1 : 0) : 1;
        $adminPort = max(1, min(65535, (int)($data['admin_https_port'] ?? 8443)));
        $sipMaxRetry = max(1, min(20, (int)($data['fail2ban_sip_maxretry'] ?? 3)));
        $sipFindTime = max(60, min(86400, (int)($data['fail2ban_sip_findtime'] ?? 600)));
        $sipBanTime = max(60, min(31536000, (int)($data['fail2ban_sip_bantime'] ?? 3600)));
        $webMaxRetry = max(1, min(20, (int)($data['fail2ban_web_maxretry'] ?? 3)));
        $webBanTime = max(60, min(31536000, (int)($data['fail2ban_web_bantime'] ?? 3600)));

        $ucpEnabled     = isset($data['ucp_enabled']) ? (!empty($data['ucp_enabled']) ? 1 : 0) : (int)$oldSettings['ucp_enabled'];
        $ucpHttpsPort   = isset($data['ucp_https_port']) ? max(0, min(65535, (int)$data['ucp_https_port'])) : (int)$oldSettings['ucp_https_port'];
        $ucpHttpPort    = isset($data['ucp_http_port']) ? max(0, min(65535, (int)$data['ucp_http_port'])) : (int)$oldSettings['ucp_http_port'];
        $ucpMaxRetry    = isset($data['fail2ban_ucp_maxretry']) ? max(1, min(20, (int)$data['fail2ban_ucp_maxretry'])) : (int)$oldSettings['fail2ban_ucp_maxretry'];
        $ucpBanTime     = isset($data['fail2ban_ucp_bantime']) ? max(60, min(31536000, (int)$data['fail2ban_ucp_bantime'])) : (int)$oldSettings['fail2ban_ucp_bantime'];

        if ($ucpEnabled === 1 && $ucpHttpsPort === 0 && $ucpHttpPort === 0) {
            throw new InvalidArgumentException("Lorsque l'UCP est activé, au moins un port (HTTPS ou HTTP) doit être supérieur à 0.");
        }
        $reservedPorts = [80, 443, 8080, $adminPort, 5060, 5061];
        if ($ucpHttpsPort > 0 && in_array($ucpHttpsPort, $reservedPorts, true)) {
            throw new InvalidArgumentException("Le port HTTPS UCP ({$ucpHttpsPort}) entre en conflit avec un port réservé (Admin/SIP/ACME).");
        }
        if ($ucpHttpPort > 0 && in_array($ucpHttpPort, $reservedPorts, true)) {
            throw new InvalidArgumentException("Le port HTTP UCP ({$ucpHttpPort}) entre en conflit avec un port réservé (Admin/SIP/ACME).");
        }
        if ($ucpHttpsPort > 0 && $ucpHttpPort > 0 && $ucpHttpsPort === $ucpHttpPort) {
            throw new InvalidArgumentException("Les ports HTTPS et HTTP de l'UCP doivent être différents.");
        }

        $whitelist = trim((string)($data['fail2ban_whitelist_ips'] ?? ''));
        $cleanTokens = array_values(array_filter(preg_split('/\s+/', $whitelist)));
        
        // Toujours préserver l'adresse de bouclage locale pour les processus internes
        if (!in_array('127.0.0.1/8', $cleanTokens, true)) {
            array_unshift($cleanTokens, '127.0.0.1/8');
        }
        if (!in_array('::1', $cleanTokens, true)) {
            $cleanTokens[] = '::1';
        }

        $finalWhitelist = implode(' ', array_unique($cleanTokens));

        // 1. Sauvegarde dans la base SQLite
        $stmt = $db->prepare("UPDATE settings SET
            firewall_enabled = :fe,
            admin_https_port = :ap,
            certbot_strict_port80 = :sp80,
            fail2ban_sip_maxretry = :smr,
            fail2ban_sip_findtime = :sft,
            fail2ban_sip_bantime = :sbt,
            fail2ban_web_maxretry = :wmr,
            fail2ban_web_bantime = :wbt,
            fail2ban_whitelist_ips = :wl,
            ucp_enabled = :ue,
            ucp_https_port = :uhs,
            ucp_http_port = :uhp,
            fail2ban_ucp_maxretry = :umr,
            fail2ban_ucp_bantime = :ubt,
            updated_at = CURRENT_TIMESTAMP
            WHERE id = 1");

        $stmt->execute([
            ':fe'   => $firewallEnabled,
            ':ap'   => $adminPort,
            ':sp80' => $strictPort80,
            ':smr'  => $sipMaxRetry,
            ':sft'  => $sipFindTime,
            ':sbt'  => $sipBanTime,
            ':wmr'  => $webMaxRetry,
            ':wbt'  => $webBanTime,
            ':wl'   => $finalWhitelist,
            ':ue'   => $ucpEnabled,
            ':uhs'  => $ucpHttpsPort,
            ':uhp'  => $ucpHttpPort,
            ':umr'  => $ucpMaxRetry,
            ':ubt'  => $ucpBanTime,
        ]);

        // 2. Garantir la présence du filtre & journal Fail2ban UCP puis générer /etc/fail2ban/jail.local
        self::ensureUcpFail2banArtifacts();
        self::generateJailLocal(
            $finalWhitelist,
            $sipMaxRetry,
            $sipFindTime,
            $sipBanTime,
            $webMaxRetry,
            $webBanTime,
            $adminPort,
            $ucpEnabled,
            $ucpHttpsPort,
            $ucpHttpPort,
            $ucpMaxRetry,
            $ucpBanTime
        );

        // 3. Rechargement / Redémarrage propre de Fail2ban
        exec('timeout 3 sudo -n /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode);
        if ($f2bCode !== 0) {
            exec('timeout 5 sudo -n /usr/bin/systemctl restart fail2ban 2>&1');
        }

        // 4. Mise à jour de la configuration Nginx & ouverture/fermeture dynamique des ports UCP
        self::applyNginxConfig($adminPort, $strictPort80, $ucpEnabled, $ucpHttpsPort, $ucpHttpPort);
        self::syncUcpFirewallPorts($oldSettings, [
            'ucp_enabled'    => $ucpEnabled,
            'ucp_https_port' => $ucpHttpsPort,
            'ucp_http_port'  => $ucpHttpPort,
        ]);

        @unlink('/tmp/nexus_fw_status_cache.json');

        return [
            'success' => true,
            'message' => 'Configuration Pare-feu, UCP & Fail2ban appliquée avec succès ! Nginx et Fail2ban rechargés.',
            'settings' => self::getSettings(),
        ];
    }

    /**
     * Écrit le fichier /etc/fail2ban/jail.local
     */
    public static function generateJailLocal(
        string $whitelist,
        int $sipMaxRetry,
        int $sipFindTime,
        int $sipBanTime,
        int $webMaxRetry,
        int $webBanTime,
        int $adminPort,
        ?int $ucpEnabled = null,
        ?int $ucpHttpsPort = null,
        ?int $ucpHttpPort = null,
        ?int $ucpMaxRetry = null,
        ?int $ucpBanTime = null
    ): void {
        if ($ucpEnabled === null || $ucpHttpsPort === null || $ucpHttpPort === null || $ucpMaxRetry === null || $ucpBanTime === null) {
            $st = self::getSettings();
            $ucpEnabled   = $ucpEnabled   ?? $st['ucp_enabled'];
            $ucpHttpsPort = $ucpHttpsPort ?? $st['ucp_https_port'];
            $ucpHttpPort  = $ucpHttpPort  ?? $st['ucp_http_port'];
            $ucpMaxRetry  = $ucpMaxRetry  ?? $st['fail2ban_ucp_maxretry'];
            $ucpBanTime   = $ucpBanTime   ?? $st['fail2ban_ucp_bantime'];
        }

        self::ensureUcpFail2banArtifacts();

        $portsWeb = "http,https,{$adminPort}";
        $ucpPortsList = [];
        if ($ucpHttpsPort > 0) $ucpPortsList[] = (string)$ucpHttpsPort;
        if ($ucpHttpPort > 0)  $ucpPortsList[] = (string)$ucpHttpPort;
        $ucpJailEnabled = ($ucpEnabled === 1 && !empty($ucpPortsList)) ? 'true' : 'false';
        $portsUcp = !empty($ucpPortsList) ? implode(',', $ucpPortsList) : '8444';

        $conf = <<<EOF
# Fichier généré automatiquement par NexusPBX
# Ne pas modifier manuellement - éditable depuis l'interface Web

[DEFAULT]
ignoreip = {$whitelist}
findtime = {$sipFindTime}
bantime = {$sipBanTime}
maxretry = {$sipMaxRetry}
usedns = no

[sshd]
enabled = true
port = ssh
mode = aggressive
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
bantime = 3600

[asterisk]
enabled = true
filter = asterisk
logpath = /var/log/asterisk/messages
maxretry = {$sipMaxRetry}
findtime = {$sipFindTime}
bantime = {$sipBanTime}
port = 5060,5061
protocol = udp

[nexus-web]
enabled = true
filter = nexus-web
logpath = /var/log/nexus_security.log
maxretry = {$webMaxRetry}
findtime = 600
bantime = {$webBanTime}
port = {$portsWeb}
protocol = tcp

[nexus-ucp]
enabled = {$ucpJailEnabled}
filter = nexus-ucp
logpath = /var/log/nexus_ucp_security.log
maxretry = {$ucpMaxRetry}
findtime = 600
bantime = {$ucpBanTime}
port = {$portsUcp}
protocol = tcp

EOF;

        file_put_contents(self::JAIL_LOCAL_PATH, $conf);
        @chgrp(self::JAIL_LOCAL_PATH, 'asterisk');
        @chmod(self::JAIL_LOCAL_PATH, 0664);
    }

    /**
     * Met à jour Nginx pour séparer le port 80 (Certbot/ACME), le port d'admin et les VHosts isolés de l'UCP.
     */
    public static function applyNginxConfig(
        int $adminHttpsPort,
        int $strictPort80,
        ?int $ucpEnabled = null,
        ?int $ucpHttpsPort = null,
        ?int $ucpHttpPort = null
    ): void {
        if ($ucpEnabled === null || $ucpHttpsPort === null || $ucpHttpPort === null) {
            $st = self::getSettings();
            $ucpEnabled   = $ucpEnabled   ?? $st['ucp_enabled'];
            $ucpHttpsPort = $ucpHttpsPort ?? $st['ucp_https_port'];
            $ucpHttpPort  = $ucpHttpPort  ?? $st['ucp_http_port'];
        }

        $phpSock = '/run/php/php8.4-fpm.sock';
        if (!file_exists($phpSock)) {
            $found = glob('/run/php/php*-fpm.sock');
            if (!empty($found)) {
                $phpSock = $found[0];
            }
        }

        // Configuration Port 80 (HTTP)
        if ($strictPort80 === 1) {
            // Mode Strict : Le port 80 sert UNIQUEMENT aux challenges ACME Certbot
            $port80Block = <<<EOF
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    # Challenge ACME Let's Encrypt (Certbot) UNIQUEMENT
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/nexus-pbx/public;
        try_files \$uri =404;
    }

    # Tout le reste est strictement bloqué sur le port 80
    location / {
        return 404;
    }
}
EOF;
        } else {
            // Mode Normal : Port 80 sert l'application (et les challenges ACME)
            $port80Block = <<<EOF
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    client_max_body_size 512M;

    root /var/www/nexus-pbx/public;
    index index.php;

    access_log /var/log/nginx/nexus-pbx.access.log;
    error_log  /var/log/nginx/nexus-pbx.error.log;

    location / {
        try_files \$uri \$uri/ /index.php?\$query_string;
    }

    location ~* \.(?:css|js)$ {
        expires -1;
        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
        try_files \$uri =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:{$phpSock};
        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}
EOF;
        }

        // Configuration HTTPS : écoute sur port 443 ET sur le port admin custom si différent de 443
        $listenCustom = "";
        if ($adminHttpsPort !== 443 && $adminHttpsPort > 0) {
            $listenCustom = "\n    listen {$adminHttpsPort} ssl;\n    listen [::]:{$adminHttpsPort} ssl;";
        }

        $httpsBlock = <<<EOF
server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;{$listenCustom}
    server_name _;

    ssl_certificate /etc/asterisk/keys/active_cert.crt;
    ssl_certificate_key /etc/asterisk/keys/active_key.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    client_max_body_size 512M;

    root /var/www/nexus-pbx/public;
    index index.php;

    access_log /var/log/nginx/nexus-pbx.ssl.access.log;
    error_log  /var/log/nginx/nexus-pbx.ssl.error.log;

    location / {
        try_files \$uri \$uri/ /index.php?\$query_string;
    }

    location ~* \.(?:css|js)$ {
        expires -1;
        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
        try_files \$uri =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:{$phpSock};
        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}
EOF;

        // Configuration Port 8080 : Annuaire XML pour téléphones IP (Yealink, Fanvil, Grandstream, etc.)
        $phonebookBlock = <<<EOF
server {
    listen 8080;
    listen [::]:8080;
    server_name _;
    root /var/www/nexus-pbx/public;

    # Annuaire XML pour postes IP (phonebook.php)
    location = /phonebook.php {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:{$phpSock};
        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
    }

    # Avatars / Photos de contacts pour téléphones IP
    location ^~ /avatars/ {
        try_files \$uri =404;
    }

    location / {
        return 404;
    }
}
EOF;

        $blocks = [$port80Block, $phonebookBlock, $httpsBlock];

        // VirtualHosts Nginx totalement isolés pour l'UCP (/var/www/nexus-pbx/ucp)
        if ($ucpEnabled === 1 && is_dir(self::UCP_ROOT_DIR)) {
            if ($ucpHttpsPort > 0) {
                $blocks[] = self::buildUcpServerBlock($ucpHttpsPort, true, $phpSock);
            }
            if ($ucpHttpPort > 0) {
                $blocks[] = self::buildUcpServerBlock($ucpHttpPort, false, $phpSock);
            }
        }

        $fullNginxConfig = implode("\n\n", $blocks) . "\n";
        file_put_contents(self::NGINX_CONF_PATH, $fullNginxConfig);
        @chgrp(self::NGINX_CONF_PATH, 'asterisk');
        @chmod(self::NGINX_CONF_PATH, 0664);

        // Test de syntaxe
        exec('sudo -n /usr/sbin/nginx -t 2>&1', $tOut, $tCode);
        if ($tCode !== 0) {
            throw new RuntimeException("Erreur de syntaxe Nginx : " . implode("\n", $tOut));
        }

        // Rechargement Nginx sans coupure
        exec('sudo -n /usr/bin/systemctl reload nginx 2>&1');
    }

    private static function buildUcpServerBlock(int $port, bool $ssl, string $phpSock): string
    {
        $ucpRoot = self::UCP_ROOT_DIR;
        $listenDirectives = $ssl
            ? "listen {$port} ssl;\n    listen [::]:{$port} ssl;"
            : "listen {$port};\n    listen [::]:{$port};";

        $sslDirectives = $ssl ? <<<SSL

    ssl_certificate /etc/asterisk/keys/active_cert.crt;
    ssl_certificate_key /etc/asterisk/keys/active_key.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
SSL : '';

        $logPrefix = $ssl ? 'nexus-ucp.ssl' : 'nexus-ucp';

        return <<<EOF
server {
    {$listenDirectives}
    server_name _;{$sslDirectives}

    client_max_body_size 16M;

    root {$ucpRoot};
    index index.php;

    access_log /var/log/nginx/{$logPrefix}.access.log;
    error_log  /var/log/nginx/{$logPrefix}.error.log;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        try_files \$uri \$uri/ /index.php?\$query_string;
    }

    location ~* \.(?:css|js)$ {
        expires -1;
        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
        try_files \$uri =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:{$phpSock};
        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
    }

    location ~ /\. {
        deny all;
    }
}
EOF;
    }

    /**
     * Crée le filtre et le fichier de log Fail2ban dédiés au portail UCP.
     */
    public static function ensureUcpFail2banArtifacts(): void
    {
        $filterContent = "[Definition]\nfailregex = ^.*\\[NEXUS-UCP-AUTH-FAIL\\]:\\s*<HOST>.*$\nignoreregex =\n";
        $isNonRoot = function_exists('posix_geteuid') && posix_geteuid() !== 0;

        if (!file_exists(self::UCP_FILTER_PATH) || @file_get_contents(self::UCP_FILTER_PATH) !== $filterContent) {
            if (@file_put_contents(self::UCP_FILTER_PATH, $filterContent) !== false) {
                @chmod(self::UCP_FILTER_PATH, 0644);
            } elseif ($isNonRoot) {
                @exec('sudo -n /var/www/nexus-pbx/scripts/nexus-firewall init-ucp >/dev/null 2>&1');
                return;
            }
        }
        if (!file_exists(self::UCP_SECURITY_LOG)) {
            if (@touch(self::UCP_SECURITY_LOG) === false && $isNonRoot) {
                @exec('sudo -n /var/www/nexus-pbx/scripts/nexus-firewall init-ucp >/dev/null 2>&1');
                return;
            }
        }
        @chown(self::UCP_SECURITY_LOG, 'www-data');
        @chgrp(self::UCP_SECURITY_LOG, 'asterisk');
        @chmod(self::UCP_SECURITY_LOG, 0664);
    }

    /**
     * Auto-déploie les VHosts Nginx UCP et le filtre Fail2ban si absents (ex. après git pull).
     */
    public static function ensureUcpDeployed(): void
    {
        $st = self::getSettings();
        if (empty($st['ucp_enabled'])) {
            return;
        }
        $httpsPort = (int)($st['ucp_https_port'] ?? 8444);
        $httpPort  = (int)($st['ucp_http_port'] ?? 8084);
        if ($httpsPort <= 0 && $httpPort <= 0) {
            return;
        }

        $nginxFile   = '/etc/nginx/sites-available/nexus-pbx';
        $nginxConf   = is_readable($nginxFile) ? (string)@file_get_contents($nginxFile) : '';
        $hasNginxUcp = str_contains($nginxConf, self::UCP_ROOT_DIR);
        $hasFilter   = file_exists(self::UCP_FILTER_PATH);
        $hasLog      = file_exists(self::UCP_SECURITY_LOG);

        if ($hasNginxUcp && $hasFilter && $hasLog) {
            return;
        }

        if (function_exists('posix_geteuid') && posix_geteuid() !== 0) {
            exec('sudo -n /var/www/nexus-pbx/scripts/nexus-firewall init-ucp 2>&1', $out, $code);
            if ($code === 0) {
                return;
            }
        }

        self::saveSettings($st);
    }

    /**
     * Ouvre/ferme les ports UCP configurés dans UFW / iptables uniquement si un filtrage actif existe.
     */
    private static function syncUcpFirewallPorts(array $oldSettings, array $newSettings): void
    {
        $oldPorts = [];
        if (!empty($oldSettings['ucp_enabled'])) {
            if ((int)($oldSettings['ucp_https_port'] ?? 0) > 0) $oldPorts[] = (int)$oldSettings['ucp_https_port'];
            if ((int)($oldSettings['ucp_http_port'] ?? 0) > 0)  $oldPorts[] = (int)$oldSettings['ucp_http_port'];
        }
        $newPorts = [];
        if (!empty($newSettings['ucp_enabled'])) {
            if ((int)($newSettings['ucp_https_port'] ?? 0) > 0) $newPorts[] = (int)$newSettings['ucp_https_port'];
            if ((int)($newSettings['ucp_http_port'] ?? 0) > 0)  $newPorts[] = (int)$newSettings['ucp_http_port'];
        }

        $toRemove = array_diff(array_unique($oldPorts), array_unique($newPorts));
        $toAdd    = array_diff(array_unique($newPorts), array_unique($oldPorts));

        // UFW si installé et actif
        $ufwStatus = trim((string)@shell_exec('sudo -n /usr/sbin/ufw status 2>/dev/null'));
        if ($ufwStatus !== '' && stripos($ufwStatus, 'Status: active') !== false) {
            foreach ($toRemove as $p) {
                @shell_exec('sudo -n /usr/sbin/ufw delete allow ' . (int)$p . '/tcp >/dev/null 2>&1');
            }
            foreach ($newPorts as $p) {
                @shell_exec('sudo -n /usr/sbin/ufw allow ' . (int)$p . '/tcp >/dev/null 2>&1');
            }
        }

        // iptables si la politique INPUT par défaut bloque le trafic (DROP/REJECT)
        $iptPolicy = trim((string)@shell_exec("sudo -n /usr/sbin/iptables -S INPUT 2>/dev/null | head -n 1"));
        if (str_contains($iptPolicy, 'DROP') || str_contains($iptPolicy, 'REJECT')) {
            foreach ($toRemove as $p) {
                @shell_exec("sudo -n /usr/sbin/iptables -D INPUT -p tcp --dport " . (int)$p . " -j ACCEPT >/dev/null 2>&1");
            }
            foreach ($toAdd as $p) {
                @shell_exec("sudo -n /usr/sbin/iptables -C INPUT -p tcp --dport " . (int)$p . " -j ACCEPT >/dev/null 2>&1 || sudo -n /usr/sbin/iptables -I INPUT -p tcp --dport " . (int)$p . " -j ACCEPT >/dev/null 2>&1");
            }
        }
    }

    /**
     * Résout l'IP réelle du client en tenant compte d'un reverse proxy local / RFC1918 de confiance.
     */
    public static function resolveClientIp(): string
    {
        $remote = trim((string)($_SERVER['REMOTE_ADDR'] ?? '127.0.0.1'));
        if ($remote === '' || !filter_var($remote, FILTER_VALIDATE_IP)) {
            return '127.0.0.1';
        }

        // Ne faire confiance aux en-têtes proxy que si la connexion TCP provient d'un réseau privé ou loopback
        $isTrustedProxy = (
            filter_var($remote, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false
        );

        if ($isTrustedProxy) {
            $candidates = [];
            if (!empty($_SERVER['HTTP_X_REAL_IP'])) {
                $candidates[] = trim((string)$_SERVER['HTTP_X_REAL_IP']);
            }
            if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
                foreach (explode(',', (string)$_SERVER['HTTP_X_FORWARDED_FOR']) as $part) {
                    $candidates[] = trim($part);
                }
            }
            foreach ($candidates as $cand) {
                if ($cand !== '' && filter_var($cand, FILTER_VALIDATE_IP)) {
                    return $cand;
                }
            }
        }

        return $remote;
    }

    private static function getJailDetails(string $jail): array
    {
        exec('timeout 2 sudo -n /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out);
        $str = implode("\n", $out);

        $currentlyFailed = 0;
        $totalFailed = 0;
        $currentlyBanned = 0;
        $totalBanned = 0;
        $bannedIps = [];

        if (preg_match('/Currently failed:\s+(\d+)/', $str, $m)) {
            $currentlyFailed = (int)$m[1];
        }
        if (preg_match('/Total failed:\s+(\d+)/', $str, $m)) {
            $totalFailed = (int)$m[1];
        }

        // Intégrer également les événements consignés dans le journal physique
        if ($jail === 'asterisk') {
            $logIncidents = is_readable('/var/log/asterisk/security.log')
                ? (int)shell_exec("grep -c -E 'ChallengeResponseFailed|InvalidAccountID|FailedAuth' /var/log/asterisk/security.log 2>/dev/null")
                : 0;
            $totalFailed = max($totalFailed, $logIncidents);
        } elseif ($jail === 'nexus-web') {
            $logIncidents = is_readable('/var/log/nexus_security.log')
                ? (int)shell_exec("grep -c -E 'NEXUS-WEB-AUTH-FAIL|FailedLogin' /var/log/nexus_security.log 2>/dev/null")
                : 0;
            $totalFailed = max($totalFailed, $logIncidents);
        } elseif ($jail === 'nexus-ucp') {
            $logIncidents = is_readable(self::UCP_SECURITY_LOG)
                ? (int)shell_exec("grep -c 'NEXUS-UCP-AUTH-FAIL' " . escapeshellarg(self::UCP_SECURITY_LOG) . " 2>/dev/null")
                : 0;
            $totalFailed = max($totalFailed, $logIncidents);
        }
        if (preg_match('/Currently banned:\s+(\d+)/', $str, $m)) {
            $currentlyBanned = (int)$m[1];
        }
        if (preg_match('/Total banned:\s+(\d+)/', $str, $m)) {
            $totalBanned = (int)$m[1];
        }
        if (preg_match('/Banned IP list:\s*(.*)$/m', $str, $m)) {
            $rawIps = trim($m[1]);
            if ($rawIps !== '') {
                $bannedIps = array_values(array_filter(preg_split('/\s+/', $rawIps)));
            }
        }

        return [
            'name' => $jail,
            'currently_failed' => $currentlyFailed,
            'total_failed' => $totalFailed,
            'currently_banned' => $currentlyBanned,
            'total_banned' => $totalBanned,
            'banned_ips' => $bannedIps,
        ];
    }

    private static function formatJailName(string $jail): string
    {
        return match ($jail) {
            'asterisk' => 'Téléphonie SIP (PJSIP)',
            'nexus-web' => 'Interface Web Admin',
            'nexus-ucp' => 'Portail Utilisateur (UCP)',
            'sshd' => 'Accès Console SSH',
            default => ucfirst($jail),
        };
    }
}