repository·master·Indexed 25 days ago
https://github.com/roots/trellisAn Ansible-powered LEMP stack automation tool for WordPress. Trellis provides infrastructure automation for local development using Lima VMs and high-performance production servers with zero-downtime deployments for Bedrock-based sites. It includes specialized Ansible roles for Fail2ban, firewall management via ansible-ferm, Let's Encrypt SSL certificates via acme-tiny, and SSH configuration.
acme-tiny. It is designed to automate the process of obtaining and managing SSL/TLS certificates via the ACME protocol.iptables using the ferm tool. Instead of executing individual allow/deny commands (like the ufw module), it uses a template-based approach to manage firewall rules, which promotes a more idempotent setup.Trellis is a collection of Ansible playbooks designed to set up a LEMP (Linux, Nginx, MySQL, PHP) stack specifically optimized for WordPress. It provides infrastructure automation for various environments, including:
For easier management of these tasks, it is recommended to use trellis-cli.
The sshd role omits options from the configuration files if the system defaults are secure. To see the full, active configuration currently in effect on your server, use the following commands:
sshd_config): sshd -Tssh_config): ssh -G example.comTo use a custom filter with a service, you must place a .conf.j2 file in the directory specified by fail2ban_filter_templates_path (defaults to fail2ban_filters located next to your group_vars folder).
If you are using filters provided by plugins that end in .conf, you can simply append .j2 to the filename to make it compatible with Trellis.
For logic implementation, refer to the official Fail2ban documentation on Developing Filters.
To begin using Trellis, you must follow the official installation documentation. The setup process involves configuring Ansible to provision your LEMP stack environments.
See the [Trellis installation documentation](https://roots.io/trellis/docs/installation/).By default, Trellis only monitors SSH connections. To monitor additional services, define a list in fail2ban_services_custom within your group_vars (e.g., group_vars/all/security.yml).
Each service in the list requires a name, port, filter, and logpath. You can optionally override protocol, maxretry, action, and banaction for specific services.
Note: enabled must be a string (e.g., "true").
fail2ban_services_custom:
- name: wordpress
filter: wordpress
logpath: /var/log/auth.log
maxretry: 2You can override default SSH settings by redefining variables in your Ansible group variables (e.g., group_vars/all/main.yml).
templates/sshd_config.j2 or templates/ssh_config.j2.ssh_<varname> variables default to the value of their sshd_<varname> counterpart to avoid duplication.AcceptEnvTo allow specific environment variables in the SSH server, redefine sshd_accept_env as a list:
# group_vars/all/main.yml
sshd_accept_env:
- LANG
- LC_*When modifying SSH configurations, you risk blocking future access. Before running the sshd role, open a backup SSH connection in a separate terminal. Use the ServerAliveInterval option to prevent the connection from being pruned by the server or NAT routers.
If using PuTTY or WinSCP, set "Seconds between keepalives" to 60.
ssh -o ServerAliveInterval=60 root@12.34.56.78If a setting is not exposed via a variable, you can create a child Jinja2 template to override the default behavior.
In your group_vars/all/main.yml, point the sshd_config and ssh_config variables to your new template paths (relative to the playbook directory):
# group_vars/all/main.yml
sshd_config: "{{ playbook_dir }}/templates/sshd_config.j2"
ssh_config: "{{ playbook_dir }}/templates/ssh_config.j2"Your template must {% extends %} the base role template and use {% block %} to inject content. Use {{ super() }} to include the original content from the base template.
Example: Adding SFTP settings to sshd_config
{% extends 'roles/sshd/templates/sshd_config.j2' %}
{% block main %}
{{ super() }}
Match Group sftponly
AllowAgentForwarding no
ChrootDirectory /home/%u
ForceCommand internal-sftp
PermitRootLogin no
{%- endblock %}Example: Adding host-specific options to the start of ssh_config
{% extends 'roles/sshd/templates/ssh_config.j2' %}
{% block main %}
# Host-specific configuration
Host example.com example2.com
Port 2222
ForwardAgent yes
# Global defaults for all Hosts
{{ super() }}
{%- endblock %}Use the following variables to configure the global behavior of Fail2ban, such as logging, banning duration, and default actions.
| Variable | Description | Default |
|---|---|---|
fail2ban_loglevel | Log level (CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG) | INFO |
fail2ban_logtarget | Destination for log outputs (SYSLOG, STDERR, STDOUT, or a file path) | /var/log/fail2ban.log |
fail2ban_socket | Path where the socket should be created | /var/run/fail2ban/fail2ban.sock |
fail2ban_ignoreip | IP address, CIDR mark, or DNS host to ignore | 127.0.0.1/8 |
fail2ban_bantime | Ban duration in seconds | 600 |
fail2ban_maxretry | Number of failed attempts before a ban | 6 |
fail2ban_backend | Method to detect file changes (gamin, polling, auto) | polling |
fail2ban_destemail | Email address for reports | root@localhost |
fail2ban_banaction | How the ban is applied (e.g., iptables, iptables-new, iptables-multiport) | iptables-multiport |
fail2ban_mta | Mail transfer agent to use (sendmail or mail) | sendmail |
fail2ban_protocol | Default protocol (tcp or udp) | tcp |
fail2ban_chain | The iptables chain where JUMPs are added | INPUT |
fail2ban_action | The default ban action (action_, action_mw, action_mwl) | action_ |
The vars callback plugin is a Trellis-specific Ansible plugin designed to modify play and host variables during execution. It performs two primary functions:
raw_vars list and wraps them using wrap_var. This is used to handle specific raw variable processing.To use this, ensure the vars callback plugin is enabled in your ansible.cfg.