Lightsail WordPress Migrator

Automated Bitnami to Native Blueprint Migration & Security Hardening

View Tool on GitHub Open Source Tools Back to Home

1-Click End-to-End Migration

Direct S3 Presigned URL Transfer

100% Collation Translation

3 Jails Fail2ban Hardening

The Challenge: Moving Off Legacy Bitnami Stacks

Thousands of organizations host WordPress on AWS Lightsail using pre-packaged Bitnami images. Over time, these legacy deployments become technical debt:

Proprietary Directory Layouts: Bitnami uses non-standard paths (/opt/bitnami/) and custom control scripts (ctlscript.sh) that break standard Linux administration tools and tutorials.
Resource Bloat: Custom daemon wrappers consume excessive RAM and CPU on entry-tier Lightsail instances ($3.50/mo – $5.00/mo bundles).
Collation Incompatibilities: Migrating between MySQL 8 (Bitnami default) and MariaDB (native distro default) frequently fails due to character set mismatches like utf8mb4_0900_ai_ci.
Manual Cutover Risk: Managing database dumps, asset tarballs, static IP reassociations, Apache rewrite rules, and security hardening manually introduces downtime and human error.

Automated Capabilities

Direct S3 Streaming

Generates presigned S3 URLs to stream database dumps and wp-content archives directly between instances without storing large intermediate tarballs on your local machine.

Automatic Collation Translation

Detects and converts incompatible MySQL 8 collations (utf8mb4_0900_ai_ci / utf8mb4_0900_as_cs) to MariaDB-compatible utf8mb4_unicode_520_ci during transfer.

Automated Static IP Cutover

Discovers the attached Lightsail Static IP on the source instance, detaches it upon successful data migration, reassigns it to the target, and updates WordPress site URLs for seamless DNS cutover.

Apache .htaccess & Permalinks

Automatically configures standard WordPress rewrite directives, sets proper www-data file permissions, and verifies subpage permalink routing immediately.

Pre-Migration Snapshots

Automatically creates a point-in-time Lightsail disk snapshot of the source instance before executing any export operations, guaranteeing an instant rollback path.

Optional CloudWatch Integration

Provisions a dedicated least-privilege IAM user and installs amazon-cloudwatch-agent to stream Apache access/error logs, PHP-FPM logs, and Fail2ban alerts to CloudWatch.

Migration Architecture & Data Flow

The migrator automates the entire migration sequence via the AWS SDK (boto3) and SSH automation (paramiko):

┌──────────────────────────┐ │ S3 Staging Bucket │ │ (Presigned Direct Links) │ └─────────────▲────────────┘ │ 1. Export DB & Assets │ 2. Direct S3 Pull │ ┌───────────────────────────────┐ │ ┌───────────────────────────────┐ │ Source Lightsail Host │───────────────┴─────────────▶│ Target Lightsail Host │ │ (Legacy Bitnami / MySQL) │ │ (Native AL2023/Debian/Maria) │ │ │ │ │ │ • Bitnami stack detection │ │ • Collation normalization │ │ • Database dump via socket/TCP│ │ • Apache .htaccess generation │ │ • wp-content tarball │ │ • File permissions (www-data) │ │ • Pre-migration snapshot │ │ • Static IP cutover │ │ • Attached Static IP discovery│ │ • Fail2ban & Security tuning │ └───────────────────────────────┘ │ • CloudWatch Logs agent │ └───────────────────────────────┘

Integrated Security Hardening

When running with security hardening enabled (--harden-security, enabled by default), the tool automatically provisions defense-in-depth protection:

Fail2ban SSH & Login Defense

Enforces systemd-backed rate limiting on SSH (max 5 retries -> 1h ban) and defends wp-login.php / xmlrpc.php against credential brute force (max 8 attempts in 5m -> 1h ban).

Automated Scanner Blocker

Monitors access logs and automatically bans automated threat scanners querying .env, .git, wp-config.php, phpmyadmin, or attempting directory traversal.

Apache Availability Tuning

Deploys connection and keepalive limits (Timeout 60, KeepAliveTimeout 2, MaxKeepAliveRequests 50) to protect small Lightsail instances from slowloris exhaustion.

Quick Start & CLI Reference

Interactive Wizard (Discovers instances & prompts for confirmation):

python migrate.py

Non-Interactive CLI Command with Static IP Cutover & Hardening:

python migrate.py \
  --source "MyBitnamiInstance" \
  --target "MyNativeInstance" \
  --profile default \
  --region us-east-1 \
  --reassign-static-ip \
  --harden-security \
  --cloudwatch \
  --yes
        

Pre-Flight Dry-Run Validation:

python migrate.py --source "MyBitnamiInstance" --target "MyNativeInstance" --dry-run
        

Technology Stack

AWS Lightsail Python 3.9+ AWS SDK (boto3) Paramiko (SSH Automation) MariaDB & MySQL Fail2ban Amazon S3 Amazon CloudWatch Logs WordPress

View Tool on GitHub Back to Open Source Tools Back to Home