SSH Hardening & Access Control

The installer disables SSH password authentication by default, enforcing key-based access. Each site gets its own Linux system user with an isolated home directory and PHP-FPM pool, preventing cross-site contamination.

SSH password authentication disabled during installation
Per-site system users with isolated home directories
SSH key management across all servers
Root SSH access required for installation

TLS Automation

LiteSoup integrates with Certbot to provision and auto-renew Let's Encrypt certificates. Four TLS modes give you flexibility: none for internal sites, self-signed for staging, Let's Encrypt for production, and custom for existing certificates.

Let's Encrypt with auto-renewal via systemd timer
Self-signed certificates for staging environments
Custom certificate upload for existing SSL
Apache HTTP/2 with automatic HTTPS redirect

PHP Isolation

Every site runs in its own PHP-FPM pool with a dedicated system user. This means a compromised WordPress plugin on one site cannot read files or access memory from another site on the same server. Pool tiers (small, medium, large, custom) let you control resource limits per site.

Per-site PHP-FPM pools with isolated system users
PHP version 8.2, 8.3, or 8.4 per site
Configurable pm.max_children, start_servers, max_requests
Ondemand, dynamic, or static process management

Infrastructure Security

The stack includes several security measures out of the box: Redis requires a password (stored in root-only file), MariaDB generates a random root password, Memcached listens on localhost only with UDP disabled, and the installer includes firewall and fail2ban configuration.

Redis with requirepass authentication
MariaDB random root password
Memcached localhost-only with UDP disabled
Firewall and fail2ban via hardening scripts