feat: v2.5.0 - Complete Technology & Security Update

Features:
- PHP 8.4 support (from 8.3)
- WordPress 7.0 (auto-update via WP-CLI)
- Modern TLS 1.3 cipher suites (2026 best practices)
- Fail2Ban security integration (5 jails: SSH, Nginx, WordPress, recidive)
- Auto-update cron job for WordPress (weekly Minor updates)
- Debian 14 Forky support (testing)
- Ubuntu 25.04 support
- Python 3.12 in GitHub Actions

Security:
- Fail2Ban with SSH brute force protection (24h ban)
- WordPress wp-login.php protection (2h ban)
- Nginx bot scanner protection
- Recidive jail for repeat offenders (1 week ban)
- Modern TLS ciphers (AEAD only)
- HSTS 2 years for preload

Documentation:
- docs/autoupdate.md - WordPress auto-update guide
- docs/fail2ban.md - Fail2Ban configuration guide
- docs/troubleshooting.md - Updated with php_version variable

Breaking changes:
- PHP 8.4 is now the default (requires Ubuntu 20.04+ or Debian 11+)

templates/fail2ban-wordpress-filter.conf

@@ -0,0 +1,13 @@
+# Fail2Ban filter for WordPress login attempts
+# WordPress failed login attempts in Nginx access log
+
+[Definition]
+
+failregex = ^<HOST> - .* "(POST|GET) /wp-login\.php.*" (401|403|404|302)
+            ^<HOST> - .* "(POST|GET) /xmlrpc\.php.*" (401|403|404|405)
+            ^<HOST> - .* "POST /wp-admin/wp-login\.php.*" (401|403|404)
+
+ignoreregex = 
+
+# Author: Sebastian Palencsár
+# Notes: Matches wp-login.php, xmlrpc.php and wp-admin login attempts

templates/fail2ban.j2

@@ -0,0 +1,68 @@
+# Fail2Ban configuration for WordPress LEMP stack
+# Copy this to /etc/fail2ban/jail.local on your server
+
+[DEFAULT]
+# Global settings
+bantime  = 3600
+findtime = 600
+maxretry = 5
+
+# Your trusted IPs (never ban these)
+ignoreip = 127.0.0.1/8 ::1
+
+# Enable persistent database
+dbfile = /var/lib/fail2ban/fail2ban.sqlite3
+dbpurgeage = 86400
+
+# Incremental bans for repeat offenders
+bantime.increment = true
+bantime.multiplier = 2
+bantime.maxtime = 86400
+
+[sshd]
+# SSH brute force protection
+enabled  = true
+port     = ssh
+filter  = sshd
+maxretry = 3
+bantime = 86400
+findtime = 300
+
+[nginx-http-auth]
+# Nginx HTTP Basic Auth failures
+enabled  = true
+port     = http,https
+filter  = nginx-http-auth
+logpath  = /var/log/nginx/error.log
+maxretry = 5
+bantime = 3600
+findtime = 600
+
+[nginx-botsearch]
+# Bot scanners searching for vulnerable scripts
+enabled  = true
+port     = http,https
+filter  = nginx-botsearch
+logpath  = /var/log/nginx/access.log
+maxretry = 2
+bantime = 7200
+findtime = 300
+
+[wordpress-login]
+# WordPress wp-login.php protection
+enabled  = true
+port     = http,https
+filter  = wordpress-login
+logpath  = /var/log/nginx/access.log
+maxretry = 5
+bantime = 7200
+findtime = 600
+
+[recidive]
+# Ban repeat offenders for a week
+enabled  = true
+filter  = recidive
+logpath  = /var/log/fail2ban.log
+maxretry = 3
+bantime = 604800
+findtime = 86400

templates/wordpress-ssl.nginx.j2

@@ -17,15 +17,16 @@ server {
     ssl_certificate {{ ssl_cert_path | default('/etc/ssl/certs/nginx-selfsigned.crt') }};
     ssl_certificate_key {{ ssl_cert_key_path | default('/etc/ssl/private/nginx-selfsigned.key') }};
     
-    # Modern SSL configuration
+    # Modern SSL configuration (2026 best practices)
     ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
+    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
     ssl_prefer_server_ciphers off;
+    ssl_session_timeout 1d;
     ssl_session_cache shared:SSL:10m;
-    ssl_session_timeout 10m;
+    ssl_session_tickets off;
     
-    # HSTS (HTTP Strict Transport Security)
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+    # HSTS (HTTP Strict Transport Security) - 2 years for preload
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
     
     # Security headers
     add_header X-Frame-Options DENY always;

templates/wordpress.nginx.j2

@@ -26,7 +26,7 @@ server {
     # PHP-Dateien verarbeiten
     location ~ \.php$ {
         include snippets/fastcgi-php.conf;
-        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
+        fastcgi_pass unix:/var/run/php/php8.4-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         include fastcgi_params;
     }