All releases of LiteSoup. The project follows SemVer.

v0.10.10 — SSH lockout fix survives reboot (mask + boot-time guard)

2026-08-22

  • SSH lockout fix now survives a reboot — the v0.10.9 fix used systemctl disable --now ssh.socket, but disable only removes the wants-symlinks; a reboot or unattended-upgrades kernel update re-enables the socket, re-breaking SSH on a non-standard port. harden-ssh.sh now masks ssh.socket (symlinks it to /dev/null), so no package script or reboot can re-enable it. The check also uses is-enabled (not just is-active) so an enabled-but-inactive socket after reboot is caught.
  • Boot-time guard — harden-ssh installs a systemd oneshot (litesoup-ssh-guard.service) that runs at every boot to re-mask ssh.socket, ensure standalone ssh.service is running, and assert sshd is listening on the configured port, so the lockout cannot silently recur. New harden/ssh-guard.sh.
  • verify_ssh_access now asserts the masked state — flags an enabled-but-inactive socket (the exact pre-reboot state that caused the lockout), not just an active one.

v0.10.9 — install-stack SSH lockout fix (socket activation)

2026-08-21

  • install-stack no longer locks out SSH on Ubuntu 24.04 with a non-standard port — install-stack.sh now runs harden-ssh.sh as the first hardening stage, before harden-firewall.sh. Ubuntu 24.04 ships socket-activated SSH (ssh.socket), which binds the default port regardless of the Port directive; previously the firewall opened the configured port (where nothing listened) while blocking the socket port (where sshd actually listened) → operator locked out, console recovery required.
  • harden-ssh.sh disables ssh.socket on every run — switches to standalone ssh.service which binds the configured port. Idempotent; catches a package upgrade that re-enables the socket on re-run.
  • Post-install SSH access verification — after hardening, install-stack.sh runs verify_ssh_access, confirming sshd is listening on the configured port, UFW allows it, and ssh.socket is disabled. Aborts rather than declaring success if the operator is about to be locked out.

v0.10.8 — Decouple site directory name from domain

2026-08-03

  • --name flag on site-create — now required. The docroot directory, DB name, cache keys and log files all derive from the stable application --name instead of the domain, so the domain can change later without touching the filesystem
  • New site set-domain — change an existing site's domain (ServerName, TLS cert, and the WordPress site/home URLs) without moving or renaming anything on disk. Identifies the site by --name (or --domain for backward compat).
  • Downstream commands accept --name — set-php, set-tls, set-webhook, delete, import resolve the app --name to the site's current domain via vhost metadata; --domain is kept as a backward-compatible alias.
  • Vhost metadata now stores SITE_NAME + DOMAIN so backup scripts and set-domain can resolve name → domain → owner → docroot.
  • Breaking change: --name is now required on site create. Pass --name=<current-domain> when upgrading to preserve the existing directory structure.

v0.10.7 — Backup fixes: timeout, permission, vhost metadata

2026-07-30

  • backup-site.sh timeout loses function context — timeout 300 bash -c "backup_dump_db ..." creates a new subshell that doesn't inherit bash functions from common.sh. Fix: source common.sh inside the subshell via REPO_ROOT
  • Permission denied on wp db export — mkdir -p creates backup dir as root, then wp db export runs as site user who can't write to root-owned directory. Fix: chown backup dir to site user before export
  • Missing /etc/litesoup/vhost/ directory — Backup scripts read vhost metadata from /etc/litesoup/vhost/<domain>.conf but this directory was never created during site creation. Fix: write_vhost() now writes SITE_USER + DOCROOT metadata after Apache configtest passes

v0.10.6 — CI fixes

2026-07-22

  • Fixed bats unit test 79 (restart guard) — # Force restart comment marker now on same line as systemctl restart ssh so the grep -v exception filter works
  • Fixed shellcheck CI — added SC2016 and SC1090 exceptions for intentional shell patterns in site/site-import.sh

v0.10.5 — 6G WAF + security hardening

2026-07-21

  • 6G firewall (WAF) — New --waf flag on site-create.sh blocks exploit scanners, AI crawlers, bad request methods, and spam referers via Apache-level rules; exempts wp-admin and wp-json
  • SSH socket activation fix — harden-ssh.sh detects ssh.socket (Ubuntu 24.04) and switches to standalone sshd to prevent silent port 22 drop after systemctl daemon-reload
  • .git/ probing blocked — Apache returns 404 for .git/, .svn/, .hg/, and .env paths
  • uploads PHP execution blocked — wp-content/uploads/*.php returns 403 (mitigates file-upload RCE)
  • debug.log access blocked — direct reads of wp-content/debug.log return 403
  • New apache-badbots jail in fail2ban for scanner user agents

v0.10.4 — Backup unit tests

2026-07-19

  • Self-copy guard detection, --help smoke tests for backup-restore and backup-stagger, root-error assertion for restore dry-run

v0.10.3 — backup-install self-copy fix

2026-07-19

  • When litesoup backup configure runs from /usr/lib/litesoup/, source and destination were the same directory. Fix compares resolved paths and skips the copy

v0.10.2 — harden-ssh health check false-positive fix

2026-07-19

  • Increased health check poll from 3×2s to 6×2s to avoid false-positives on busy systems. If sshd process is alive but port not bound, log warning and proceed — only revert if sshd is completely dead

v0.10.1 — harden-ssh health check + NodeSource GPG fix

2026-07-18

  • Post-reload health check — harden-ssh.sh verifies sshd is listening after reload; auto-rollback on failure prevents permanent lockout
  • SSH hardening moved to post-install — harden-ssh.sh is no longer called during install-stack.sh; run manually when ready
  • NodeSource GPG key fixed — stage 10 uses the official setup script for Node.js 22.x, works on Ubuntu 24.04

v0.10.0 — litesoup SSH user + backup stagger/timeout

2026-07-15

  • litesoup operator user — replaces direct root SSH via harden/harden-user.sh with SSH key, passwordless sudo, optional root lock
  • Backup stagger runner — backup/backup-stagger.sh prevents thundering herd across multi-site backups with configurable delay
  • Backup concurrency protection — flock lock + per-step timeout prevents duplicate/hung backups
  • install-stack.sh --ssh-key=... provisions SSH key during install

v0.9.2 — Landing page for default vhost

2026-07-15

  • LiteSoup landing page replaces Apache default page for direct IP access
  • Shows LiteSoup icon, tagline, buttons, GitHub link, credits

v0.9.1 — Bug fixes from TSTT Laravel deployment

2026-07-15

  • Fixed missing default vhost — 000-default.conf returning 404 for IP access
  • Fixed --git-repo timeout — shallow clone + 120s timeout
  • Fixed PHP-FPM pool exhaustion — default tier changed from small to medium
  • Fixed VHOST_DOCROOT unbound error in site-set-tls and site-set-php
  • Fixed repo_root unbound error with --skip-hardening

v0.9.0 — Backup system + scheduling

2026-07-14

  • Per-site backup system: files + DB snapshots, local + S3-compatible storage
  • Restore from any backup timestamp
  • Scheduling via systemd timers (daily, weekly, custom)
  • Email + syslog notification on backup failure

v0.8.3

2026-07-14

  • Fixed SSH lockout on fresh Ubuntu 24.04 VPS with non-standard SSH ports via sshd_config.d/ drop-ins

v0.8.2

2026-07-13

  • Fixed per-user PHP-FPM pools — created for every installed PHP version
  • Fixed Apache .well-known/acme-challenge directory permissions

v0.8.1 — CLI dispatcher architecture

2026-05-14

  • New litesoup CLI dispatcher — single entry point for all commands
  • install-stack.sh now installs itself to /usr/lib/litesoup/
  • Subcommands: stack, site, backup, harden, audit

v0.7.1 — harden-ssh safer defaults

2026-05-03

  • SSH password auth stays enabled by default (opt-in to disable)

v0.7.0 — Wave 2: harden-ssh + harden-apache + harden-php

2026-05-03

  • Per-service hardening for sshd, Apache, and PHP (global ini level)
  • Wired into install-stack.sh as optional stages (skipped with --skip-hardening)

v0.6.0 — Wave 1: harden/ + audit/ packages

2026-05-03

  • New harden/ and audit/ script packages
  • SSH hardening, kernel sysctl hardening, Apache/NGINX config audit

View all releases on GitHub