529 lines
20 KiB
PHP
529 lines
20 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
namespace App;
|
|
|
|
use PDO;
|
|
use RuntimeException;
|
|
use InvalidArgumentException;
|
|
|
|
/**
|
|
* ClusterManager - Gestionnaire de Haute Disponibilité (Cluster HA Actif/Passif)
|
|
* Orchestration Keepalived (VRRP), IP Flottante (VIP) et réplication temps réel.
|
|
*/
|
|
class ClusterManager
|
|
{
|
|
private PDO $db;
|
|
public const KEEPALIVED_CONF_PATH = '/etc/keepalived/keepalived.conf';
|
|
public const CLUSTER_LOG_PATH = '/var/log/nexus_cluster.log';
|
|
|
|
public function __construct(?PDO $db = null)
|
|
{
|
|
$this->db = $db ?? Database::getConnection();
|
|
}
|
|
|
|
/**
|
|
* Récupère la configuration actuelle du Cluster
|
|
*/
|
|
public function getSettings(): array
|
|
{
|
|
$stmt = $this->db->query('SELECT * FROM cluster_settings WHERE id = 1');
|
|
$row = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
if (!$row) {
|
|
return [
|
|
'enabled' => 0,
|
|
'role' => 'master',
|
|
'virtual_ip' => '',
|
|
'virtual_netmask' => '24',
|
|
'interface' => 'eth0',
|
|
'peer_ip' => '',
|
|
'cluster_secret' => bin2hex(random_bytes(16)),
|
|
'vrid' => 51,
|
|
'priority' => 100,
|
|
'sync_interval' => 15,
|
|
'auto_sync' => 1,
|
|
'last_sync_at' => null,
|
|
'last_sync_status' => 'none',
|
|
'last_sync_message' => '',
|
|
];
|
|
}
|
|
return $row;
|
|
}
|
|
|
|
/**
|
|
* Sauvegarde la configuration du cluster
|
|
*/
|
|
public function saveSettings(array $data): array
|
|
{
|
|
$enabled = !empty($data['enabled']) ? 1 : 0;
|
|
$role = in_array($data['role'] ?? '', ['master', 'backup'], true) ? $data['role'] : 'master';
|
|
$virtualIp = trim((string)($data['virtual_ip'] ?? ''));
|
|
$virtualNetmask = preg_replace('/[^0-9]/', '', (string)($data['virtual_netmask'] ?? '24')) ?: '24';
|
|
$interface = preg_replace('/[^a-zA-Z0-9_\-\.]/', '', trim((string)($data['interface'] ?? 'eth0'))) ?: 'eth0';
|
|
$peerIp = trim((string)($data['peer_ip'] ?? ''));
|
|
$clusterSecret = trim((string)($data['cluster_secret'] ?? ''));
|
|
$vrid = max(1, min(255, (int)($data['vrid'] ?? 51)));
|
|
$priority = max(1, min(254, (int)($data['priority'] ?? ($role === 'master' ? 100 : 90))));
|
|
$syncInterval = max(5, min(3600, (int)($data['sync_interval'] ?? 15)));
|
|
$autoSync = !empty($data['auto_sync']) ? 1 : 0;
|
|
|
|
if ($clusterSecret === '') {
|
|
$clusterSecret = bin2hex(random_bytes(16));
|
|
}
|
|
|
|
if ($enabled && $virtualIp === '') {
|
|
throw new InvalidArgumentException("L'adresse IP Virtuelle partagée (VIP) est requise pour activer le cluster HA.");
|
|
}
|
|
|
|
$stmt = $this->db->prepare('
|
|
UPDATE cluster_settings SET
|
|
enabled = :enabled,
|
|
role = :role,
|
|
virtual_ip = :vip,
|
|
virtual_netmask = :vmask,
|
|
interface = :iface,
|
|
peer_ip = :peer,
|
|
cluster_secret = :secret,
|
|
vrid = :vrid,
|
|
priority = :prio,
|
|
sync_interval = :sync_int,
|
|
auto_sync = :auto_sync,
|
|
updated_at = CURRENT_TIMESTAMP
|
|
WHERE id = 1
|
|
');
|
|
|
|
$stmt->execute([
|
|
':enabled' => $enabled,
|
|
':role' => $role,
|
|
':vip' => $virtualIp,
|
|
':vmask' => $virtualNetmask,
|
|
':iface' => $interface,
|
|
':peer' => $peerIp,
|
|
':secret' => $clusterSecret,
|
|
':vrid' => $vrid,
|
|
':prio' => $priority,
|
|
':sync_int' => $syncInterval,
|
|
':auto_sync' => $autoSync,
|
|
]);
|
|
|
|
// Application automatique de la configuration Keepalived si demandé
|
|
$applyResult = $this->applyKeepalivedConfig();
|
|
|
|
return [
|
|
'success' => true,
|
|
'message' => 'Configuration Haute Disponibilité enregistrée.',
|
|
'apply_result' => $applyResult,
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Détecte les interfaces réseau physiques et virtuelles locales avec leurs IP
|
|
*/
|
|
public function detectNetworkInterfaces(): array
|
|
{
|
|
$interfaces = [];
|
|
$output = shell_exec('ip -o -4 addr show 2>/dev/null') ?: '';
|
|
|
|
foreach (preg_split('/\r?\n/', $output) ?: [] as $line) {
|
|
$line = trim($line);
|
|
if ($line === '') {
|
|
continue;
|
|
}
|
|
// Format typique ip -o: "2: eth0 inet 10.10.0.4/16 brd 10.10.255.255 scope global eth0\..."
|
|
if (preg_match('/^\d+:\s+([a-zA-Z0-9_\-\.]+)\s+inet\s+([0-9.]+)\/(\d+)/', $line, $matches)) {
|
|
$iface = $matches[1];
|
|
$ip = $matches[2];
|
|
$mask = $matches[3];
|
|
|
|
if ($iface === 'lo') {
|
|
continue; // Ignorer loopback
|
|
}
|
|
|
|
if (!isset($interfaces[$iface])) {
|
|
$interfaces[$iface] = [
|
|
'name' => $iface,
|
|
'ips' => [],
|
|
'primary' => $ip,
|
|
'netmask' => $mask,
|
|
];
|
|
}
|
|
$interfaces[$iface]['ips'][] = "{$ip}/{$mask}";
|
|
}
|
|
}
|
|
|
|
return array_values($interfaces);
|
|
}
|
|
|
|
/**
|
|
* Vérifie si l'adresse IP Virtuelle (VIP) est actuellement active sur cette machine locale
|
|
*/
|
|
public function isVirtualIpActive(string $vip): bool
|
|
{
|
|
if ($vip === '') {
|
|
return false;
|
|
}
|
|
$escapedVip = escapeshellarg($vip);
|
|
$output = shell_exec("ip addr show 2>/dev/null | grep -F " . $escapedVip) ?: '';
|
|
return trim($output) !== '';
|
|
}
|
|
|
|
/**
|
|
* Retourne l'état complet en temps réel du Cluster
|
|
*/
|
|
public function getClusterStatus(): array
|
|
{
|
|
$settings = $this->getSettings();
|
|
$vip = $settings['virtual_ip'] ?? '';
|
|
$peerIp = $settings['peer_ip'] ?? '';
|
|
$isVipActive = $this->isVirtualIpActive($vip);
|
|
|
|
// 1. Vérification de Keepalived
|
|
$keepalivedInstalled = !empty(shell_exec('command -v keepalived 2>/dev/null'));
|
|
$keepalivedRunning = false;
|
|
if ($keepalivedInstalled) {
|
|
$psOut = shell_exec('pidof keepalived 2>/dev/null') ?: '';
|
|
$keepalivedRunning = trim($psOut) !== '';
|
|
}
|
|
|
|
// 2. Vérification d'Asterisk
|
|
$asteriskRunning = trim((string)shell_exec('pidof asterisk 2>/dev/null')) !== '';
|
|
$asteriskPing = false;
|
|
if ($asteriskRunning) {
|
|
$pingOut = shell_exec("asterisk -rx 'core ping' 2>/dev/null") ?: '';
|
|
$asteriskPing = str_contains($pingOut, 'Pong');
|
|
}
|
|
|
|
// 3. Test de connectivité vers le nœud pair (Peer Ping)
|
|
$peerReachable = false;
|
|
$peerPingMs = null;
|
|
if ($peerIp !== '') {
|
|
$escapedPeer = escapeshellarg($peerIp);
|
|
$pingOut = shell_exec("ping -c 1 -W 1 {$escapedPeer} 2>&1") ?: '';
|
|
if (preg_match('/time=([0-9.]+)\s*ms/', $pingOut, $pm)) {
|
|
$peerReachable = true;
|
|
$peerPingMs = (float)$pm[1];
|
|
} elseif (str_contains($pingOut, '1 received') || str_contains($pingOut, '1 packets received')) {
|
|
$peerReachable = true;
|
|
}
|
|
}
|
|
|
|
// Rôle réel effectif
|
|
$effectiveState = 'STANDALONE';
|
|
if (!empty($settings['enabled'])) {
|
|
if ($isVipActive) {
|
|
$effectiveState = 'MASTER';
|
|
} else {
|
|
$effectiveState = 'BACKUP';
|
|
}
|
|
}
|
|
|
|
// Dernières lignes du log cluster
|
|
$recentLogs = [];
|
|
if (file_exists(self::CLUSTER_LOG_PATH)) {
|
|
$lines = file(self::CLUSTER_LOG_PATH, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [];
|
|
$recentLogs = array_slice($lines, -15);
|
|
}
|
|
|
|
return [
|
|
'enabled' => (bool)$settings['enabled'],
|
|
'configured_role' => $settings['role'],
|
|
'effective_state' => $effectiveState,
|
|
'virtual_ip' => $vip,
|
|
'virtual_ip_active' => $isVipActive,
|
|
'interface' => $settings['interface'],
|
|
'peer_ip' => $peerIp,
|
|
'peer_reachable' => $peerReachable,
|
|
'peer_ping_ms' => $peerPingMs,
|
|
'keepalived_installed' => $keepalivedInstalled,
|
|
'keepalived_running' => $keepalivedRunning,
|
|
'asterisk_running' => $asteriskRunning,
|
|
'asterisk_healthy' => $asteriskPing,
|
|
'last_sync_at' => $settings['last_sync_at'],
|
|
'last_sync_status' => $settings['last_sync_status'],
|
|
'last_sync_message' => $settings['last_sync_message'],
|
|
'cluster_secret' => $settings['cluster_secret'],
|
|
'recent_logs' => array_reverse($recentLogs),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Génère la configuration officielle /etc/keepalived/keepalived.conf
|
|
*/
|
|
public function generateKeepalivedConfig(): string
|
|
{
|
|
$settings = $this->getSettings();
|
|
$role = strtoupper($settings['role'] ?? 'MASTER');
|
|
$iface = $settings['interface'] ?? 'eth0';
|
|
$vip = $settings['virtual_ip'] ?? '';
|
|
$vmask = $settings['virtual_netmask'] ?? '24';
|
|
$vrid = (int)($settings['vrid'] ?? 51);
|
|
$prio = (int)($settings['priority'] ?? ($role === 'MASTER' ? 100 : 90));
|
|
$secret = substr($settings['cluster_secret'] ?? 'NexusPBX', 0, 8); // Keepalived max 8 chars auth_pass
|
|
|
|
$conf = [];
|
|
$conf[] = "! ==============================================================================";
|
|
$conf[] = "! Configuration Keepalived générée automatiquement par NexusPBX HA";
|
|
$conf[] = "! Date de génération : " . date('Y-m-d H:i:s');
|
|
$conf[] = "! ==============================================================================";
|
|
$conf[] = "";
|
|
$conf[] = "global_defs {";
|
|
$conf[] = " router_id NEXUS_PBX_" . ($role === 'MASTER' ? '1' : '2');
|
|
$conf[] = " enable_script_security";
|
|
$conf[] = " script_user root";
|
|
$conf[] = "}";
|
|
$conf[] = "";
|
|
$conf[] = "vrrp_script chk_asterisk {";
|
|
$conf[] = " script \"/var/www/nexus-pbx/scripts/cluster/check_asterisk.sh\"";
|
|
$conf[] = " interval 2";
|
|
$conf[] = " weight 2";
|
|
$conf[] = " fall 2";
|
|
$conf[] = " rise 2";
|
|
$conf[] = "}";
|
|
$conf[] = "";
|
|
$conf[] = "vrrp_instance VI_NEXUS {";
|
|
$conf[] = " state {$role}";
|
|
$conf[] = " interface {$iface}";
|
|
$conf[] = " virtual_router_id {$vrid}";
|
|
$conf[] = " priority {$prio}";
|
|
$conf[] = " advert_int 1";
|
|
$conf[] = "";
|
|
$conf[] = " authentication {";
|
|
$conf[] = " auth_type PASS";
|
|
$conf[] = " auth_pass {$secret}";
|
|
$conf[] = " }";
|
|
$conf[] = "";
|
|
$conf[] = " virtual_ipaddress {";
|
|
$conf[] = " {$vip}/{$vmask} dev {$iface}";
|
|
$conf[] = " }";
|
|
$conf[] = "";
|
|
$conf[] = " track_script {";
|
|
$conf[] = " chk_asterisk";
|
|
$conf[] = " }";
|
|
$conf[] = "";
|
|
$conf[] = " notify_master \"/var/www/nexus-pbx/scripts/cluster/notify_master.sh\"";
|
|
$conf[] = " notify_backup \"/var/www/nexus-pbx/scripts/cluster/notify_backup.sh\"";
|
|
$conf[] = " notify_fault \"/var/www/nexus-pbx/scripts/cluster/notify_fault.sh\"";
|
|
$conf[] = "}";
|
|
$conf[] = "";
|
|
|
|
return implode("\n", $conf);
|
|
}
|
|
|
|
/**
|
|
* Applique la configuration Keepalived sur le système Linux
|
|
*/
|
|
public function applyKeepalivedConfig(): array
|
|
{
|
|
$settings = $this->getSettings();
|
|
$enabled = !empty($settings['enabled']);
|
|
|
|
if (!$enabled) {
|
|
// Désactivation du service Keepalived si le cluster est désactivé
|
|
shell_exec('systemctl stop keepalived 2>/dev/null || true');
|
|
shell_exec('systemctl disable keepalived 2>/dev/null || true');
|
|
return [
|
|
'status' => 'disabled',
|
|
'message' => 'Cluster HA désactivé (service Keepalived stoppé).',
|
|
];
|
|
}
|
|
|
|
if (empty($settings['virtual_ip'])) {
|
|
return [
|
|
'status' => 'error',
|
|
'message' => 'IP Virtuelle (VIP) non renseignée.',
|
|
];
|
|
}
|
|
|
|
$confContent = $this->generateKeepalivedConfig();
|
|
if (!is_dir('/etc/keepalived')) {
|
|
mkdir('/etc/keepalived', 0755, true);
|
|
}
|
|
|
|
file_put_contents(self::KEEPALIVED_CONF_PATH, $confContent);
|
|
chmod(self::KEEPALIVED_CONF_PATH, 0600);
|
|
|
|
// S'assure que les scripts de cluster sont bien exécutables
|
|
shell_exec('chmod +x /var/www/nexus-pbx/scripts/cluster/*.sh 2>/dev/null || true');
|
|
|
|
// Activation et rechargement / démarrage de Keepalived
|
|
shell_exec('systemctl enable keepalived 2>/dev/null || true');
|
|
shell_exec('systemctl restart keepalived 2>/dev/null || true');
|
|
|
|
return [
|
|
'status' => 'active',
|
|
'message' => 'Configuration Keepalived générée et service redémarré avec succès.',
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Pousse la synchronisation complète (SQLite + Custom Sounds) vers le Nœud pair
|
|
*/
|
|
public function pushSyncToPeer(): array
|
|
{
|
|
$settings = $this->getSettings();
|
|
$peerIp = trim((string)($settings['peer_ip'] ?? ''));
|
|
$secret = trim((string)($settings['cluster_secret'] ?? ''));
|
|
|
|
if ($peerIp === '') {
|
|
throw new RuntimeException("L'adresse IP du Nœud pair (Peer IP) n'est pas configurée.");
|
|
}
|
|
|
|
// Création du paquet de données en mémoire ou fichier temporaire
|
|
$dbPath = Database::getDatabasePath();
|
|
if (!file_exists($dbPath)) {
|
|
throw new RuntimeException("Fichier de base de données introuvable : {$dbPath}");
|
|
}
|
|
|
|
// Forcer le checkpoint SQLite WAL pour avoir un dump 100% à jour
|
|
$this->db->exec('PRAGMA wal_checkpoint(FULL);');
|
|
|
|
$tmpArchive = '/tmp/nexus_cluster_sync_' . time() . '.tar.gz';
|
|
$cmd = "tar -czf " . escapeshellarg($tmpArchive) . " -C /var/www/nexus-pbx/storage database.sqlite";
|
|
if (is_dir('/var/lib/asterisk/sounds/custom')) {
|
|
$cmd .= " -C /var/lib/asterisk/sounds custom";
|
|
}
|
|
shell_exec($cmd);
|
|
|
|
if (!file_exists($tmpArchive) || filesize($tmpArchive) === 0) {
|
|
@unlink($tmpArchive);
|
|
throw new RuntimeException("Échec de génération de l'archive de réplication.");
|
|
}
|
|
|
|
$archiveData = file_get_contents($tmpArchive);
|
|
@unlink($tmpArchive);
|
|
|
|
$payload = [
|
|
'timestamp' => time(),
|
|
'archive_b64' => base64_encode($archiveData),
|
|
];
|
|
|
|
$signature = hash_hmac('sha256', json_encode($payload), $secret);
|
|
|
|
$ch = curl_init("http://{$peerIp}/api.php?action=cluster_receive_sync");
|
|
curl_setopt($ch, CURLOPT_POST, true);
|
|
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
|
|
curl_setopt($ch, CURLOPT_HTTPHEADER, [
|
|
'Content-Type: application/json',
|
|
'X-Nexus-Cluster-Signature: ' . $signature,
|
|
]);
|
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
|
|
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
|
|
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
|
|
|
|
$response = curl_exec($ch);
|
|
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
|
$err = curl_error($ch);
|
|
curl_close($ch);
|
|
|
|
if ($httpCode !== 200 || !empty($err)) {
|
|
$errorMsg = "Échec d'envoi vers le pair {$peerIp} (HTTP {$httpCode}) : {$err}";
|
|
$this->updateSyncStatus('error', $errorMsg);
|
|
throw new RuntimeException($errorMsg);
|
|
}
|
|
|
|
$resJson = json_decode((string)$response, true);
|
|
if (empty($resJson['success'])) {
|
|
$errorMsg = "Le pair a rejeté la réplication : " . ($resJson['error'] ?? 'Erreur inconnue');
|
|
$this->updateSyncStatus('error', $errorMsg);
|
|
throw new RuntimeException($errorMsg);
|
|
}
|
|
|
|
$this->updateSyncStatus('success', "Synchronisation réussie avec le nœud {$peerIp}");
|
|
|
|
return [
|
|
'success' => true,
|
|
'message' => "Réplication transmise et appliquée sur le nœud pair {$peerIp} avec succès.",
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Réception et application du paquet de synchronisation envoyé par le pair
|
|
*/
|
|
public function receiveSyncPayload(string $rawBody, string $providedSignature): array
|
|
{
|
|
$settings = $this->getSettings();
|
|
$secret = trim((string)($settings['cluster_secret'] ?? ''));
|
|
|
|
if ($secret === '') {
|
|
throw new RuntimeException("Le secret de cluster n'est pas configuré sur ce serveur.");
|
|
}
|
|
|
|
// Vérification signature HMAC
|
|
$expectedSignature = hash_hmac('sha256', $rawBody, $secret);
|
|
if (!hash_equals($expectedSignature, $providedSignature)) {
|
|
throw new RuntimeException("Signature de cluster invalide (accès refusé).");
|
|
}
|
|
|
|
$data = json_decode($rawBody, true);
|
|
if (empty($data['archive_b64'])) {
|
|
throw new RuntimeException("Paquet de réplication vide ou corrompu.");
|
|
}
|
|
|
|
$archiveRaw = base64_decode($data['archive_b64']);
|
|
$tmpArchive = '/tmp/nexus_cluster_recv_' . time() . '.tar.gz';
|
|
file_put_contents($tmpArchive, $archiveRaw);
|
|
|
|
// Sauvegarde d'urgence de la DB actuelle avant écrasement
|
|
$dbPath = Database::getDatabasePath();
|
|
if (file_exists($dbPath)) {
|
|
copy($dbPath, $dbPath . '.pre_cluster_sync.bak');
|
|
}
|
|
|
|
// Fermeture de la connexion PDO pour libérer les verrous SQLite
|
|
Database::resetConnection();
|
|
|
|
// Extraction de l'archive
|
|
shell_exec("tar -xzf " . escapeshellarg($tmpArchive) . " -C /var/www/nexus-pbx/storage database.sqlite 2>/dev/null || true");
|
|
if (is_dir('/var/lib/asterisk/sounds')) {
|
|
shell_exec("tar -xzf " . escapeshellarg($tmpArchive) . " -C /var/lib/asterisk/sounds custom 2>/dev/null || true");
|
|
}
|
|
@unlink($tmpArchive);
|
|
|
|
// Réouverture de la connexion DB et régénération des configs Asterisk
|
|
$newDb = Database::getConnection();
|
|
$this->db = $newDb;
|
|
|
|
// Préserver le rôle local configuré (pour ne pas qu'un master force l'esclave à se croire master)
|
|
$localRole = $settings['role'] ?? 'backup';
|
|
$newDb->exec("UPDATE cluster_settings SET role = '{$localRole}', last_sync_at = CURRENT_TIMESTAMP, last_sync_status = 'synced', last_sync_message = 'Base et sons synchronisés depuis le Master' WHERE id = 1");
|
|
|
|
// Régénérer les configurations PJSIP et Asterisk
|
|
$generator = new ConfigGenerator($newDb);
|
|
$generator->generateAndApply();
|
|
|
|
return [
|
|
'success' => true,
|
|
'message' => 'Base de données et fichiers audio appliqués avec succès.',
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Bascule manuelle de rôle (Switchover)
|
|
*/
|
|
public function triggerSwitchover(): array
|
|
{
|
|
$settings = $this->getSettings();
|
|
$currentRole = $settings['role'] ?? 'master';
|
|
$newRole = ($currentRole === 'master') ? 'backup' : 'master';
|
|
$newPrio = ($newRole === 'master') ? 100 : 90;
|
|
|
|
$settings['role'] = $newRole;
|
|
$settings['priority'] = $newPrio;
|
|
|
|
return $this->saveSettings($settings);
|
|
}
|
|
|
|
private function updateSyncStatus(string $status, string $message): void
|
|
{
|
|
$stmt = $this->db->prepare('
|
|
UPDATE cluster_settings SET
|
|
last_sync_at = CURRENT_TIMESTAMP,
|
|
last_sync_status = :status,
|
|
last_sync_message = :msg
|
|
WHERE id = 1
|
|
');
|
|
$stmt->execute([':status' => $status, ':msg' => $message]);
|
|
}
|
|
}
|
|
|