=== Main server security ===
fail2ban runs with the default conf (few minutes blocking for users with frequent failed logins); certain ips are exempted.

The apache server hs snakeoil certs.

certbot is installed but not activeated yet (2018, Nov 1st).