feat: v2.5.0 - Complete Technology & Security Update

Features:
- PHP 8.4 support (from 8.3)
- WordPress 7.0 (auto-update via WP-CLI)
- Modern TLS 1.3 cipher suites (2026 best practices)
- Fail2Ban security integration (5 jails: SSH, Nginx, WordPress, recidive)
- Auto-update cron job for WordPress (weekly Minor updates)
- Debian 14 Forky support (testing)
- Ubuntu 25.04 support
- Python 3.12 in GitHub Actions

Security:
- Fail2Ban with SSH brute force protection (24h ban)
- WordPress wp-login.php protection (2h ban)
- Nginx bot scanner protection
- Recidive jail for repeat offenders (1 week ban)
- Modern TLS ciphers (AEAD only)
- HSTS 2 years for preload

Documentation:
- docs/autoupdate.md - WordPress auto-update guide
- docs/fail2ban.md - Fail2Ban configuration guide
- docs/troubleshooting.md - Updated with php_version variable

Breaking changes:
- PHP 8.4 is now the default (requires Ubuntu 20.04+ or Debian 11+)
This commit is contained in:
Sebastian Palencsar
2026-05-04 19:37:27 +02:00
parent 2045307d1d
commit dffd8e3b76
41 changed files with 754 additions and 74 deletions

33
vars/debian-family.yml Normal file → Executable file
View File

@@ -4,32 +4,33 @@
packages:
- nginx
- mysql-server
- php8.3-fpm
- php8.3-mysql
- php8.3-curl
- php8.3-gd
- php8.3-intl
- php8.3-mbstring
- php8.3-soap
- php8.3-xml
- php8.3-xmlrpc
- php8.3-zip
- php8.4-fpm
- php8.4-mysql
- php8.4-curl
- php8.4-gd
- php8.4-intl
- php8.4-mbstring
- php8.4-soap
- php8.4-xml
- php8.4-xmlrpc
- php8.4-zip
- python3-pymysql
- unzip
- fail2ban
# Service names
mysql_service: mysql
nginx_service: nginx
php_fpm_service: php8.3-fpm
php_fpm_service: php8.4-fpm
# Package manager
package_manager: apt
# PHP paths
php_fpm_config_path: /etc/php/8.3/fpm
php_cli_config_path: /etc/php/8.3/cli
php_fpm_pool_path: /etc/php/8.3/fpm/pool.d
php_fpm_socket: /run/php/php8.3-fpm.sock
php_fpm_config_path: /etc/php/8.4/fpm
php_cli_config_path: /etc/php/8.4/cli
php_fpm_pool_path: /etc/php/8.4/fpm/pool.d
php_fpm_socket: /run/php/php8.4-fpm.sock
# Nginx paths
nginx_config_path: /etc/nginx
@@ -46,7 +47,7 @@ mysql_log_error: /var/log/mysql/error.log
nginx_user: www-data
# Default PHP version
php_version: "8.3"
php_version: "8.4"
# System paths
web_root: /var/www/html