One-click apps ship with a fairly default configuration to ensure compatibility with tutorials written for the distribution shipped packages.

The LEMP package for the most part follows the same steps included in the tutorials we provide. On first boot a MySQL user is created with a random password that is stored in a text file in your home directory and PHP-FPM is configured in Nginx but otherwise the result is pretty much what you would get by just installing the packages.

Our internal one-click build scripts are not currently public but we do have some cloud-init user-data scripts that reproduce this stack that you can review here.

Hi there
I just deployed a oneclick lemp droplet.
The most important questions I have at the moment are:

1. Does any of the installed software, including OS and all of the elements of the stack get autoupdated by default.
2. How secure is the image? Does a firewall get installed? How about Fail2ban?

Thank you

I ended up going the route of www.runcloud.io (I looked at ServerPilot etc) but RunCloud seemed the best option. I am really happy with it and works well. My only moan about them is the black box of updates, i have no idea when they do updates and what is updated, their logging around this is not great. However 10x easier than trying to do yourself on a regular basis and better than shared hosting.