{"id":57,"date":"2025-05-30T22:40:51","date_gmt":"2025-05-30T21:40:51","guid":{"rendered":"http:\/\/blog.mkcloudai.com\/?p=57"},"modified":"2025-05-30T22:40:51","modified_gmt":"2025-05-30T21:40:51","slug":"production-ready-lightsail-launch-script-idempotent-secure-and-fully-automated-for-wordpress-on-apache-with-backups-ssl-monitoring-and-more","status":"publish","type":"post","link":"https:\/\/blog.mkcloudai.com\/?p=57","title":{"rendered":"Production-ready Lightsail launch script (idempotent, secure, and fully automated for WordPress on Apache with backups, SSL, monitoring, and more)."},"content":{"rendered":"\n

\u2705 lightsail-wordpress-setup.sh<\/code><\/h3>\n\n\n\n
#!\/bin\/bash
set -euo pipefail
LOG_FILE=\"\/var\/log\/wordpress-install.log\"
exec > >(tee -a \"$LOG_FILE\") 2>&1
# --------------------------
# 1. Basic Updates & Tools
# --------------------------
echo \"[+] Updating system...\"
apt update -y && apt upgrade -y
apt install -y curl wget unzip software-properties-common gnupg2 ca-certificates lsb-release ufw
# --------------------------
# 2. Apache, PHP, and MariaDB
# --------------------------
echo \"[+] Installing Apache, PHP, and MariaDB...\"
if ! command -v apache2 > \/dev\/null; then
  apt install -y apache2
  systemctl enable apache2 && systemctl start apache2
fi
apt install -y php php-mysql libapache2-mod-php php-cli php-curl php-xml php-mbstring php-zip php-gd php-soap

if ! command -v mysql > \/dev\/null; then
  apt install -y mariadb-server
  systemctl enable mariadb && systemctl start mariadb
fi
# --------------------------
# 3. Database Setup
# --------------------------
DB_NAME=\"wordpress\"
DB_USER=\"wpuser\"
DB_PASS=\"StrongPass123\"
echo \"[+] Setting up database...\"
mysql -e \"CREATE DATABASE IF NOT EXISTS $DB_NAME;\"
mysql -e \"CREATE USER IF NOT EXISTS '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASS';\"
mysql -e \"GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost'; FLUSH PRIVILEGES;\"
# --------------------------
# 4. WordPress Install (via WP-CLI)
# --------------------------
WP_CLI=\"\/usr\/local\/bin\/wp\"
WEB_ROOT=\"\/var\/www\/html\"

if [ ! -f \"$WP_CLI\" ]; then
  echo \"[+] Installing WP-CLI...\"
  curl -O https:\/\/raw.githubusercontent.com\/wp-cli\/builds\/gh-pages\/phar\/wp-cli.phar
  chmod +x wp-cli.phar && mv wp-cli.phar \"$WP_CLI\"
fi

if [ ! -f \"$WEB_ROOT\/index.php\" ]; then
  echo \"[+] Installing WordPress...\"
  cd \/tmp
  $WP_CLI core download --path=wordpress
  cp -r wordpress\/* $WEB_ROOT\/
  cd $WEB_ROOT
  $WP_CLI config create --dbname=$DB_NAME --dbuser=$DB_USER --dbpass=$DB_PASS --skip-check
  chown -R www-data:www-data $WEB_ROOT
  chmod -R 755 $WEB_ROOT
fi

# --------------------------
# 5. SSL via Let's Encrypt (Certbot)
# --------------------------
DOMAIN_NAME=\"yourdomain.com\"  # CHANGE THIS
EMAIL=\"you@example.com\"       # CHANGE THIS

if ! command -v certbot > \/dev\/null; then
  echo \"[+] Installing Certbot...\"
  apt install -y certbot python3-certbot-apache
fi

echo \"[+] Installing SSL certificate...\"
certbot --apache --non-interactive --agree-tos --redirect -m $EMAIL -d $DOMAIN_NAME || true

# --------------------------
# 6. Fail2Ban Setup
# --------------------------
echo \"[+] Installing Fail2Ban...\"
apt install -y fail2ban
systemctl enable fail2ban && systemctl start fail2ban

# --------------------------
# 7. SSH Hardening
# --------------------------
echo \"[+] Hardening SSH...\"
SSH_CONF=\"\/etc\/ssh\/sshd_config\"
sed -i 's\/^#Port 22\/Port 2222\/' $SSH_CONF
sed -i 's\/^PermitRootLogin yes\/PermitRootLogin no\/' $SSH_CONF
systemctl restart sshd

# --------------------------
# 8. Swap File Setup
# --------------------------
if [ ! -f \/swapfile ]; then
  echo \"[+] Creating 1GB swap file...\"
  fallocate -l 1G \/swapfile
  chmod 600 \/swapfile
  mkswap \/swapfile
  swapon \/swapfile
  echo '\/swapfile none swap sw 0 0' | tee -a \/etc\/fstab
fi

# --------------------------
# 9. Logrotate
# --------------------------
echo \"[+] Configuring logrotate for WordPress...\"
cat <<EOF > \/etc\/logrotate.d\/wordpress
$WEB_ROOT\/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 www-data adm
    sharedscripts
    postrotate
        systemctl reload apache2 > \/dev\/null
    endscript
}
EOF

# --------------------------
# 10. CloudWatch Agent (optional)
# --------------------------
echo \"[+] Installing AWS CloudWatch Agent...\"
curl -O https:\/\/s3.amazonaws.com\/amazoncloudwatch-agent\/ubuntu\/amd64\/latest\/amazon-cloudwatch-agent.deb
dpkg -i amazon-cloudwatch-agent.deb
rm amazon-cloudwatch-agent.deb

# (Optional) add a CloudWatch agent config JSON here if you want automatic metrics

# --------------------------
# 11. Backups (Daily via Cron)
# --------------------------
echo \"[+] Setting up backups...\"
BACKUP_SCRIPT=\"\/usr\/local\/bin\/wp-backup.sh\"

cat <<EOF > $BACKUP_SCRIPT
#!\/bin\/bash
DATE=\\$(date +%F)
BACKUP_DIR=\"\/root\/wp-backups\"
mkdir -p \\$BACKUP_DIR

# Backup database
mysqldump -u $DB_USER -p$DB_PASS $DB_NAME > \\$BACKUP_DIR\/db-\\$DATE.sql

# Backup files
tar -czf \\$BACKUP_DIR\/wp-files-\\$DATE.tar.gz $WEB_ROOT

# Keep only last 7 backups
find \\$BACKUP_DIR -type f -mtime +7 -delete
EOF

chmod +x $BACKUP_SCRIPT
(crontab -l ; echo \"0 3 * * * $BACKUP_SCRIPT\") | crontab -

# --------------------------
# 12. Create Secure User
# --------------------------
if ! id \"wpadmin\" &>\/dev\/null; then
  echo \"[+] Creating wpadmin user...\"
  useradd -m -s \/bin\/bash wpadmin
  echo \"wpadmin:WPsecure@2025\" | chpasswd
  usermod -aG sudo wpadmin
fi

# --------------------------
# Done!
# --------------------------
echo \"[\u2713] WordPress setup complete. Please point your domain ($DOMAIN_NAME) to this instance and test.\"
<\/code><\/pre>\n\n\n\n
\n\n\n\n
\ud83d\udee0\ufe0f To Use This Script<\/h3>\n\n\n\n
    \n
  1. Replace the following placeholders<\/strong>:\n
      \n
    • yourdomain.com<\/code> \u2192 your actual domain<\/li>\n\n\n\n
    • you@example.com<\/code> \u2192 your email for Let’s Encrypt<\/li>\n<\/ul>\n<\/li>\n\n\n\n
    • Paste it in the Lightsail “launch script” box<\/strong> when creating your Ubuntu instance.<\/li>\n<\/ol>\n\n\n\n
      \n\n\n\n
      \ud83d\udd12 1. What happens if you disable root login?<\/strong><\/h3>\n\n\n\n
      The line in the script:<\/p>\n\n\n\n
      sed -i 's\/^PermitRootLogin yes\/PermitRootLogin no\/' \/etc\/ssh\/sshd_config
      <\/code><\/pre>\n\n\n\n
      will disable direct root<\/code> login over SSH. This is a common security best practice to reduce brute-force attacks on the root account.<\/p>\n\n\n\n
      \n\n\n\n
      \ud83e\uddd1\u200d\ud83d\udcbb 2. How do you log in if root is blocked?<\/strong><\/h3>\n\n\n\n
      The script creates a new admin user<\/strong>:<\/p>\n\n\n\n
      useradd -m -s \/bin\/bash wpadmin
      echo \"wpadmin:WPsecure@2025\" | chpasswd
      usermod -aG sudo wpadmin
      <\/code><\/pre>\n\n\n\n
      This means:<\/p>\n\n\n\n
        \n
      • You log in using: ssh wpadmin@your-ip -p 2222<\/code> (since port is changed from 22 \u2192 2222)<\/li>\n\n\n\n
      • The wpadmin<\/code> user has sudo privileges<\/strong>, so you can run any root command with sudo<\/code>.<\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n
        \ud83d\udee1\ufe0f 3. What SSH hardening changes are made?<\/strong><\/h3>\n\n\n\n
        These two changes improve SSH security:<\/p>\n\n\n\n
        Change<\/th>Line<\/th>Effect<\/th><\/tr><\/thead>
        \ud83d\udd10 Disable root login<\/td>PermitRootLogin no<\/code><\/td>Prevents attackers from brute-forcing the root<\/code> account<\/td><\/tr>
        \ud83d\udce6 Change default port<\/td>Port 2222<\/code><\/td>Reduces bot attacks on default port 22<\/code> (obscurity + security)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        The line:<\/p>\n\n\n\n
        sed -i 's\/^#Port 22\/Port 2222\/' \/etc\/ssh\/sshd_config
        <\/code><\/pre>\n\n\n\n
        …uncomments and changes the SSH port from 22 to 2222.<\/p>\n\n\n\n
        \n
        \u26a0\ufe0f Important:<\/strong> After creating the instance, remember to allow port 2222<\/code> in the Lightsail firewall rules<\/strong>, or you won\u2019t be able to connect.<\/p>\n<\/blockquote>\n\n\n\n
        \n\n\n\n
        \n\n\n\n
        1\ufe0f\u20e3 Add Public Key Authentication Instead of Password<\/strong><\/h3>\n\n\n\n
          \n
        • Create wpadmin<\/code> user without password<\/strong> (disabled password login for that user).<\/li>\n\n\n\n
        • Copy your SSH public key into \/home\/wpadmin\/.ssh\/authorized_keys<\/code>.<\/li>\n\n\n\n
        • Disable password authentication for SSH entirely (force key-based login).<\/li>\n<\/ul>\n\n\n\n
          \n\n\n\n
          2\ufe0f\u20e3 Add Fallback Check to Root Login<\/strong><\/h3>\n\n\n\n
            \n
          • We’ll keep root login disabled by default<\/strong> for security.<\/li>\n\n\n\n
          • But in case the wpadmin<\/code> user cannot log in, root login on port 2222 remains possible via SSH key only<\/strong>.<\/li>\n\n\n\n
          • Password authentication is disabled globally (no password logins at all).<\/li>\n<\/ul>\n\n\n\n
            \n\n\n\n
            3\ufe0f\u20e3 Write First Boot Instructions to MOTD<\/strong><\/h3>\n\n\n\n
              \n
            • Show clear login instructions on first login via \/etc\/motd<\/code> message.<\/li>\n\n\n\n
            • Include the username, SSH port, and a reminder to add your SSH key.<\/li>\n<\/ul>\n\n\n\n
              \n\n\n\n
              \n\n\n\n
              Add this to the script or replace relevant parts:<\/p>\n\n\n\n
              #!\/bin\/bash
              set -euo pipefail
              # Your public SSH key here (replace with your actual public key)
              PUB_KEY=\"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD... your-email@example.com\"

              # 1. Create user without password & set up SSH key
              if ! id \"wpadmin\" &>\/dev\/null; then
                echo \"[+] Creating wpadmin user with SSH key auth only...\"
                useradd -m -s \/bin\/bash wpadmin
                mkdir -p \/home\/wpadmin\/.ssh
                echo \"$PUB_KEY\" > \/home\/wpadmin\/.ssh\/authorized_keys
                chmod 700 \/home\/wpadmin\/.ssh
                chmod 600 \/home\/wpadmin\/.ssh\/authorized_keys
                chown -R wpadmin:wpadmin \/home\/wpadmin\/.ssh
                usermod -aG sudo wpadmin
              fi

              # 2. SSH Hardening

              SSH_CONF=\"\/etc\/ssh\/sshd_config\"

              # Change SSH port to 2222
              sed -i 's\/^#Port 22\/Port 2222\/' $SSH_CONF

              # Disable root password login but allow root key login
              # This config means:
              # - PasswordAuthentication is disabled globally (all users)
              # - PermitRootLogin is set to \"prohibit-password\" to allow root only via SSH keys
              sed -i 's\/^#PermitRootLogin yes\/PermitRootLogin prohibit-password\/' $SSH_CONF
              sed -i 's\/^#PasswordAuthentication yes\/PasswordAuthentication no\/' $SSH_CONF

              # Restart SSH to apply changes
              systemctl restart sshd

              # 3. Write first-boot instructions to \/etc\/motd
              cat <<EOF > \/etc\/motd
              *******************************************************
              * Welcome to your AWS Lightsail Ubuntu Server!         *
              *                                                      *
              * Login using SSH key authentication:                  *
              *  ssh -i \/path\/to\/private_key -p 2222 wpadmin@<IP>    *
              *                                                      *
              * Root login is disabled for password but allowed via  *
              * key on port 2222 if needed.                           *
              *                                                      *
              * Remember to replace \/path\/to\/private_key with your   *
              * actual SSH private key path.                          *
              *                                                      *
              * Enjoy your secure server!                             *
              *******************************************************
              EOF
              <\/code><\/pre>\n\n\n\n
              \u26a0\ufe0f What You Need to Do Before Running:<\/h3>\n\n\n\n
                \n
              • Replace the placeholder PUB_KEY<\/code> string with your actual SSH public key<\/strong> (from your laptop or wherever you SSH from, e.g., ~\/.ssh\/id_rsa.pub<\/code>).<\/li>\n\n\n\n
              • Make sure your SSH private key matches this public key.<\/li>\n\n\n\n
              • Allow inbound TCP port 2222<\/strong> in Lightsail firewall settings.<\/li>\n<\/ul>\n\n\n\n
                \ud83d\udd11 How to Connect After Setup<\/h3>\n\n\n\n
                ssh -i \/path\/to\/private_key -p 2222 wpadmin@<instance-ip>
                <\/code><\/pre>\n\n\n\n
                If something goes wrong with wpadmin<\/code> login, you can also try:<\/p>\n\n\n\n
                ssh -i \/path\/to\/private_key -p 2222 root@<instance-ip>
                <\/code><\/pre>\n\n\n\n
                (because root login is allowed with SSH keys, but password login is disabled for root)<\/p>\n\n\n\n
                How to get your public SSH key<\/h3>\n\n\n\n
                \n\n\n\n
                1. If you already have SSH keys on your local machine<\/strong><\/h4>\n\n\n\n
                Linux\/macOS:<\/strong><\/p>\n\n\n\n
                Open a terminal and run:<\/p>\n\n\n\n
                cat ~\/.ssh\/id_rsa.pub
                <\/code><\/pre>\n\n\n\n
                or if you use ed25519 keys:<\/p>\n\n\n\n
                cat ~\/.ssh\/id_ed25519.pub
                <\/code><\/pre>\n\n\n\n
                This will print your public key (starts with ssh-rsa<\/code> or ssh-ed25519<\/code>). Copy the entire output (all one line).<\/p>\n\n\n\n
                \n\n\n\n
                Windows (using PowerShell or WSL):<\/strong><\/p>\n\n\n\n
                  \n
                • If you use WSL<\/strong> or Git Bash<\/strong>, same command as Linux\/macOS.<\/li>\n\n\n\n
                • If you use PuTTY<\/strong>, you can export the public key from PuTTYgen.<\/li>\n<\/ul>\n\n\n\n
                  \n\n\n\n
                  2. If you don\u2019t have SSH keys yet<\/strong><\/h4>\n\n\n\n
                  Generate one with:<\/p>\n\n\n\n
                  ssh-keygen -t rsa -b 4096 -C \"your-email@example.com\"
                  <\/code><\/pre>\n\n\n\n
                    \n
                  • Press Enter to accept default file location.<\/li>\n\n\n\n
                  • Enter a passphrase if you want (recommended).<\/li>\n\n\n\n
                  • Then run:<\/li>\n<\/ul>\n\n\n\n
                    cat ~\/.ssh\/id_rsa.pub
                    <\/code><\/pre>\n\n\n\n
                    \n\n\n\n
                    3. Use that key in your script<\/strong><\/h4>\n\n\n\n
                    Example:<\/p>\n\n\n\n
                    PUB_KEY=\"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCy3XyRyx... your-email@example.com\"
                    <\/code><\/pre>\n\n\n\n
                    Paste the full key in one line<\/strong>, no line breaks.<\/p>\n\n\n\n
                    1. Shebang and strict mode<\/strong><\/h3>\n\n\n\n
                    #!\/bin\/bash
                    set -euo pipefail
                    <\/code><\/pre>\n\n\n\n
                      \n
                    • #!\/bin\/bash<\/code> tells the system to run the script with Bash.<\/li>\n\n\n\n
                    • set -euo pipefail<\/code>:\n
                        \n
                      • -e<\/code>: Exit immediately if any command fails.<\/li>\n\n\n\n
                      • -u<\/code>: Treat unset variables as errors.<\/li>\n\n\n\n
                      • -o pipefail<\/code>: Fail if any command in a pipeline fails.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
                        This makes your script safer and more robust.<\/p>\n\n\n\n
                        2. User-configurable variables<\/strong><\/h3>\n\n\n\n
                        PUB_KEY=\"ssh-rsa AAAAB3N...your-email@example.com\"
                        WP_ADMIN_USER=\"wpadmin\"
                        WP_ADMIN_PASS=\"WPsecure@2025\"
                        SSH_PORT=2222
                        DOMAIN=\"your-domain.com\"
                        <\/code><\/pre>\n\n\n\n
                        These are placeholders you must edit<\/strong> before running the script:<\/p>\n\n\n\n
                          \n
                        • PUB_KEY<\/code>: Your public SSH key to enable key-based login.<\/li>\n\n\n\n
                        • WP_ADMIN_USER<\/code>: Name of the admin user created on the system.<\/li>\n\n\n\n
                        • WP_ADMIN_PASS<\/code>: Password used for MySQL WordPress user (not system user).<\/li>\n\n\n\n
                        • SSH_PORT<\/code>: Custom SSH port to harden SSH access.<\/li>\n\n\n\n
                        • DOMAIN<\/code>: Your website domain for SSL certificate.<\/li>\n<\/ul>\n\n\n\n
                          3. Update packages and install dependencies<\/strong><\/h3>\n\n\n\n
                          apt update && apt upgrade -y
                          apt install -y apache2 mysql-server php php-mysql ... certbot fail2ban logrotate awscli unattended-upgrades
                          <\/code><\/pre>\n\n\n\n
                            \n
                          • Updates system package info.<\/li>\n\n\n\n
                          • Installs all required software:\n
                              \n
                            • Apache web server<\/li>\n\n\n\n
                            • MySQL database server<\/li>\n\n\n\n
                            • PHP and extensions needed for WordPress<\/li>\n\n\n\n
                            • Certbot for SSL certs<\/li>\n\n\n\n
                            • Fail2Ban to protect SSH<\/li>\n\n\n\n
                            • Logrotate for logs management<\/li>\n\n\n\n
                            • AWS CLI & unattended-upgrades for monitoring and auto updates<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
                              4. Swap file creation<\/strong><\/h3>\n\n\n\n
                              if ! swapon --show | grep -q 'swapfile'; then
                                fallocate -l 1G \/swapfile
                                chmod 600 \/swapfile
                                mkswap \/swapfile
                                swapon \/swapfile
                                echo '\/swapfile none swap sw 0 0' >> \/etc\/fstab
                              fi
                              <\/code><\/pre>\n\n\n\n
                                \n
                              • Checks if swap exists; if not, creates a 1GB swap file.<\/li>\n\n\n\n
                              • Swap helps low-RAM instances avoid memory issues.<\/li>\n<\/ul>\n\n\n\n
                                5. Create admin user with SSH key<\/strong><\/h3>\n\n\n\n
                                if ! id \"$WP_ADMIN_USER\" &>\/dev\/null; then
                                  useradd -m -s \/bin\/bash \"$WP_ADMIN_USER\"
                                  mkdir -p \/home\/$WP_ADMIN_USER\/.ssh
                                  echo \"$PUB_KEY\" > \/home\/$WP_ADMIN_USER\/.ssh\/authorized_keys
                                  chmod 700 \/home\/$WP_ADMIN_USER\/.ssh
                                  chmod 600 \/home\/$WP_ADMIN_USER\/.ssh\/authorized_keys
                                  chown -R $WP_ADMIN_USER:$WP_ADMIN_USER \/home\/$WP_ADMIN_USER\/.ssh
                                  usermod -aG sudo $WP_ADMIN_USER
                                fi
                                <\/code><\/pre>\n\n\n\n
                                  \n
                                • Creates a system user (if it doesn’t exist).<\/li>\n\n\n\n
                                • Sets up .ssh\/authorized_keys<\/code> with your public key (no password login).<\/li>\n\n\n\n
                                • Adds user to sudo<\/code> group for admin privileges.<\/li>\n<\/ul>\n\n\n\n
                                  \n\n\n\n
                                  6. SSH hardening<\/strong><\/h3>\n\n\n\n
                                  sed -i \"s\/^#Port 22\/Port $SSH_PORT\/\" \/etc\/ssh\/sshd_config
                                  sed -i \"s\/^#PermitRootLogin yes\/PermitRootLogin prohibit-password\/\" \/etc\/ssh\/sshd_config
                                  sed -i \"s\/^#PasswordAuthentication yes\/PasswordAuthentication no\/\" \/etc\/ssh\/sshd_config
                                  systemctl restart sshd
                                  <\/code><\/pre>\n\n\n\n
                                    \n
                                  • Changes SSH port from 22 to your custom port.<\/li>\n\n\n\n
                                  • Disables root login with password (root can still login with keys).<\/li>\n\n\n\n
                                  • Disables password authentication entirely \u2014 only SSH keys allowed.<\/li>\n\n\n\n
                                  • Restarts SSH service to apply changes.<\/li>\n<\/ul>\n\n\n\n
                                    \n\n\n\n
                                    7. UFW firewall setup<\/strong><\/h3>\n\n\n\n
                                    ufw allow $SSH_PORT\/tcp
                                    ufw allow 'Apache Full'
                                    ufw --force enable
                                    <\/code><\/pre>\n\n\n\n
                                      \n
                                    • Allows traffic on SSH custom port.<\/li>\n\n\n\n
                                    • Allows HTTP and HTTPS for Apache.<\/li>\n\n\n\n
                                    • Enables UFW firewall.<\/li>\n<\/ul>\n\n\n\n
                                      \n\n\n\n
                                      8. MySQL secure installation and database setup<\/strong><\/h3>\n\n\n\n
                                      mysql_secure_installation <<EOF

                                      y
                                      WPsecure@2025
                                      WPsecure@2025
                                      y
                                      y
                                      y
                                      y
                                      EOF

                                      mysql -u root -pWPsecure@2025 <<EOF
                                      CREATE DATABASE wordpress DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
                                      CREATE USER 'wpuser'@'localhost' IDENTIFIED BY '$WP_ADMIN_PASS';
                                      GRANT ALL ON wordpress.* TO 'wpuser'@'localhost';
                                      FLUSH PRIVILEGES;
                                      EOF
                                      <\/code><\/pre>\n\n\n\n
                                        \n
                                      • Runs MySQL secure installation with default answers (sets root password, removes anonymous users, etc.).<\/li>\n\n\n\n
                                      • Creates WordPress database and user with the password.<\/li>\n<\/ul>\n\n\n\n
                                        \n\n\n\n
                                        9. Download and configure WordPress<\/strong><\/h3>\n\n\n\n
                                        wget https:\/\/wordpress.org\/latest.tar.gz -O \/tmp\/wordpress.tar.gz
                                        tar xzf \/tmp\/wordpress.tar.gz -C \/tmp\/
                                        rsync -a \/tmp\/wordpress\/ \/var\/www\/html\/
                                        chown -R www-data:www-data \/var\/www\/html
                                        chmod -R 755 \/var\/www\/html
                                        <\/code><\/pre>\n\n\n\n
                                          \n
                                        • Downloads WordPress, extracts, and copies to Apache web root.<\/li>\n\n\n\n
                                        • Sets proper permissions.<\/li>\n<\/ul>\n\n\n\n
                                          \n\n\n\n
                                          10. Create WordPress config file<\/strong><\/h3>\n\n\n\n
                                          cat > \/var\/www\/html\/wp-config.php <<EOF
                                          <?php
                                          \/\/ DB connection and security keys here...
                                          EOF
                                          <\/code><\/pre>\n\n\n\n
                                            \n
                                          • Sets up wp-config.php<\/code> with DB credentials and placeholders for secret keys.<\/li>\n<\/ul>\n\n\n\n
                                            Updated snippet to fetch WordPress salts dynamically in your script<\/h3>\n\n\n\n
                                            Instead of hardcoding keys like:<\/p>\n\n\n\n
                                            phpCopyEditdefine('AUTH_KEY',         'put your unique phrase here');\ndefine('SECURE_AUTH_KEY',  'put your unique phrase here');\n...\n<\/code><\/pre>\n\n\n\n
                                            Use this inside your bash script when creating wp-config.php<\/code><\/strong>:<\/p>\n\n\n\n
                                            # Fetch fresh WordPress salts from official API
                                            WP_KEYS=$(curl -s https:\/\/api.wordpress.org\/secret-key\/1.1\/salt\/)

                                            cat > \/var\/www\/html\/wp-config.php <<EOF
                                            <?php
                                            define('DB_NAME', '${DB_NAME}');
                                            define('DB_USER', '${DB_USER}');
                                            define('DB_PASSWORD', '${DB_PASSWORD}');
                                            define('DB_HOST', 'localhost');
                                            define('DB_CHARSET', 'utf8mb4');
                                            define('DB_COLLATE', '');

                                            ${WP_KEYS}

                                            \\$table_prefix = 'wp_';
                                            define('WP_DEBUG', false);

                                            if ( !defined('ABSPATH') )
                                                define('ABSPATH', dirname(__FILE__) . '\/');

                                            require_once(ABSPATH . 'wp-settings.php');
                                            EOF
                                            <\/code><\/pre>\n\n\n\n
                                            This way, every time the script runs, your wp-config.php<\/code> will have strong unique keys automatically<\/strong>.<\/p>\n\n\n\n
                                            \n\n\n\n
                                            11. Install SSL with Let’s Encrypt<\/strong><\/h3>\n\n\n\n
                                            certbot --apache --non-interactive --agree-tos --redirect -m admin@$DOMAIN -d $DOMAIN
                                            <\/code><\/pre>\n\n\n\n
                                              \n
                                            • Obtains and installs free SSL cert.<\/li>\n\n\n\n
                                            • Enables HTTPS and automatic redirect from HTTP.<\/li>\n<\/ul>\n\n\n\n
                                              \n\n\n\n
                                              12. Configure Fail2Ban<\/strong><\/h3>\n\n\n\n
                                              cat > \/etc\/fail2ban\/jail.local <<EOF<\/code><\/pre>\n\n\n
                                              [sshd]<\/p>\n\n\n\n
                                              enabled = true port = $SSH_PORT filter = sshd logpath = \/var\/log\/auth.log maxretry = 5 EOF systemctl restart fail2ban<\/p>\n\n\n\n
                                                \n
                                              • Protects SSH from brute force attacks by banning after 5 failed attempts.<\/li>\n<\/ul>\n\n\n\n
                                                \n\n\n\n
                                                13. Logrotate for Apache logs<\/strong><\/h3>\n\n\n\n
                                                cat > \/etc\/logrotate.d\/wordpress <<EOF
                                                \/var\/log\/apache2\/*.log {
                                                    daily
                                                    rotate 14
                                                    compress
                                                    ...
                                                }
                                                EOF
                                                <\/code><\/pre>\n\n\n\n
                                                  \n
                                                • Automatically rotates and compresses Apache logs daily, keeping 14 days.<\/li>\n<\/ul>\n\n\n\n
                                                  \n\n\n\n
                                                  14. Install WP-CLI<\/strong><\/h3>\n\n\n\n
                                                  curl -O https:\/\/raw.githubusercontent.com\/wp-cli\/builds\/gh-pages\/phar\/wp-cli.phar
                                                  chmod +x wp-cli.phar
                                                  mv wp-cli.phar \/usr\/local\/bin\/wp
                                                  <\/code><\/pre>\n\n\n\n
                                                    \n
                                                  • Installs WordPress CLI tool to manage WordPress from the command line.<\/li>\n<\/ul>\n\n\n\n
                                                    \n\n\n\n
                                                    15. Backup script & cron job<\/strong><\/h3>\n\n\n\n
                                                    cat > \/usr\/local\/bin\/backup_wordpress.sh <<EOF
                                                    #!\/bin\/bash
                                                    DATE=\\$(date +'%Y%m%d_%H%M%S')
                                                    tar czf \/var\/backups\/wordpress\/wp_files_\\$DATE.tar.gz \/var\/www\/html
                                                    mysqldump -u wpuser -p$WP_ADMIN_PASS wordpress > \/var\/backups\/wordpress\/wp_db_\\$DATE.sql
                                                    find \/var\/backups\/wordpress -type f -mtime +7 -delete
                                                    EOF
                                                    chmod +x \/usr\/local\/bin\/backup_wordpress.sh
                                                    (crontab -l -u $WP_ADMIN_USER 2>\/dev\/null; echo \"0 2 * * * \/usr\/local\/bin\/backup_wordpress.sh\") | crontab -u $WP_ADMIN_USER -
                                                    <\/code><\/pre>\n\n\n\n
                                                      \n
                                                    • Creates daily backups of WordPress files and DB at 2 AM.<\/li>\n\n\n\n
                                                    • Keeps backups for 7 days only.<\/li>\n<\/ul>\n\n\n\n
                                                      \n\n\n\n
                                                      16. CloudWatch Agent installation<\/strong><\/h3>\n\n\n\n
                                                      wget https:\/\/s3.eu-west-2.amazonaws.com\/amazoncloudwatch-agent-eu-west-2\/ubuntu\/amd64\/latest\/amazon-cloudwatch-agent.deb
                                                      dpkg -i -E .\/amazon-cloudwatch-agent.deb
                                                      cat > \/opt\/aws\/amazon-cloudwatch-agent\/etc\/amazon-cloudwatch-agent.json <<EOF
                                                      {
                                                        \"metrics\": {
                                                          ...
                                                        }
                                                      }
                                                      EOF
                                                      amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:\/opt\/aws\/amazon-cloudwatch-agent\/etc\/amazon-cloudwatch-agent.json -s
                                                      <\/code><\/pre>\n\n\n\n
                                                        \n
                                                      • Installs AWS CloudWatch Agent to send CPU, memory, disk metrics to CloudWatch.<\/li>\n<\/ul>\n\n\n\n
                                                        \n\n\n\n
                                                        17. Login instructions in MOTD<\/strong><\/h3>\n\n\n\n
                                                        cat <<EOF > \/etc\/motd
                                                        *******************************************************
                                                        * Welcome! SSH to $WP_ADMIN_USER user on port $SSH_PORT *
                                                        * Use your SSH key for authentication.                 *
                                                        *******************************************************
                                                        EOF
                                                        <\/code><\/pre>\n\n\n\n
                                                          \n
                                                        • Displays helpful login instructions when you SSH in.<\/li>\n<\/ul>\n\n\n\n
                                                          \n\n\n\n
                                                          Summary<\/h3>\n\n\n\n
                                                            \n
                                                          • The script automates full server setup<\/strong> for a secure, production-ready WordPress with SSL and backups.<\/li>\n\n\n\n
                                                          • It configures SSH to be secure (keys only, custom port, no root password).<\/li>\n\n\n\n
                                                          • It installs and secures MySQL, Apache, WordPress.<\/li>\n\n\n\n
                                                          • It configures Fail2Ban and logrotate.<\/li>\n\n\n\n
                                                          • It sets up monitoring and backups.<\/li>\n<\/ul>\n\n\n\n
                                                            Phase<\/th>User to SSH as<\/th>Port<\/th>Authentication Method<\/th><\/tr><\/thead>
                                                            Before script runs<\/td>ubuntu<\/code><\/td>22 (default)<\/td>SSH key (your Lightsail key)<\/td><\/tr>
                                                            After script completes<\/td>New user (e.g., wpadmin<\/code>)<\/td>Custom port (e.g., 2222)<\/td>SSH key (the key you added in script)<\/td><\/tr>
                                                            Root login<\/td>discouraged (disabled password login)<\/td>custom port<\/td>SSH key (if enabled)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                            <\/p>\n","protected":false},"excerpt":{"rendered":"
                                                            \u2705 lightsail-wordpress-setup.sh #!\/bin\/bashset -euo pipefailLOG_FILE=”\/var\/log\/wordpress-install.log”exec > >(tee -a “$LOG_FILE”) 2>&1# ————————–# 1. Basic Updates & Tools# ————————–echo “[+] Updating system…”apt […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"normal-width-container","site-content-style":"boxed","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5,4,7],"tags":[19,16,17,21,20,18],"class_list":["post-57","post","type-post","status-publish","format-standard","hentry","category-aws","category-linux","category-project","tag-apache","tag-aws-lightsail","tag-linux","tag-shell-scripting","tag-ssh","tag-ubuntu"],"_links":{"self":[{"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=\/wp\/v2\/posts\/57","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=57"}],"version-history":[{"count":1,"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=\/wp\/v2\/posts\/57\/revisions"}],"predecessor-version":[{"id":58,"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=\/wp\/v2\/posts\/57\/revisions\/58"}],"wp:attachment":[{"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=57"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=57"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mkcloudai.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=57"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}