Skip to content

Trellis Docs



Golden rule to debugging any failed command with Ansible:

  1. Read the output logs and find the failed task.
  2. Read through error message for the exact issue.
  3. Re-run the command in verbose mode ansible-playbook deploy.yml -vvvv -e "site=<domain> env=<environment>" if necessary to get more details.
  4. SSH into your server and manually run the command where Ansible failed.

Example: if a Git clone task failed during deploys, then SSH into the server as the web user (which is what deploys use) and run the manual command such as git clone <repo>. This will give you a much better clue as to what's going wrong.


If you are running into ERR_EMPTY_RESPONSE when trying to access your local development site:


Then run:

Unresponsive machines or 404s

Halt all VMs and remove VM-related entries from your /etc/hosts file, particularly entries similar to the example below. You may want to backup the hosts file before editing.

Then vagrant up any VMs you need running and double-check that appropriate entries appear in your hosts file.

A tidy hosts file would reduce the likelihood of 404s, although it's not a guarantee.

Sequel Pro permission denied error

Are you getting Permission denied (publickey) when trying to connect to your Vagrant box with Sequel Pro?

Use the insecure private key inside the .vagrant folder. See thread on Roots Discourse.

Let's Encrypt SSL certificates

See Troubleshooting Let's Encrypt.

There was an error while executing VBoxManage, a CLI used by Vagrant

Error message looks something like:

The solution is to open up your Activity Monitor and quit any vagrant or ruby processes.

Composer install: host key verification failed

Sometimes a task that installs Composer dependencies gives an error host key verification failed. This can happen when the known_hosts file on your Vagrant VM or remote host is missing a key for one of the host repositories in the related composer.json file. Ensure that each host from composer.json has a key listed in group_vars/all/known_hosts.yml then try your vagrant provision or ./bin/ command again.

SSH connections

If you have trouble with SSH connections to your server, consider the tips below. You may also want to review information about disabling root login and how to configure your server's SSH settings via the sshd role.

SSH keys

SSH will automatically look for and try a default set of SSH keys, along with keys loaded in your ssh-agent. However, the SSH server will only let your SSH client try a limited number of keys before disconnecting (default: 6). If you have many SSH keys and the correct key is not being selected, you can force your SSH client to try only the correct key. Add this to your ~/.ssh/config (with the correct path to your key):

Host key change

Your server may occasionally offer a different host key than what your local machine has on record in known_hosts. This could happen if you rebuild your server or if the sshd role configures your server to offer a stronger key.

Example 1

Example 2

If this change in host keys is expected, then clear the old host key from your known_hosts by running the following command (with your real IP or host name).

Then try your Trellis playbook or SSH connection again.

If the host key change is unexpected, cautiously consider why the host identification may have changed and whether you may be victim to a man-in-the-middle attack.

git clone or composer install task hangs or fails

The sshd role may cause your server's SSH client to request stronger host keys from hosts of git repos or composer packages. This could create the host-key-change problem, but this time on your server instead of your local machine. Follow the same remediation steps, but on the server.

Similarly, the sshd role may cause your server's SSH client to require stronger ciphers, kex algorithms, and MACs than previously. If your git clone or composer install connections involve older systems that do not support the stronger protocols, you may need to add more options to ssh_ciphers_extra, ssh_kex_algorithms_extra, or ssh_macs_extra.

Verbose output

SSH connection issues are often difficult to resolve without verbose output. Use the -vvvv option with your ansible-playbook command:

You may also use -v, -vv, and -vvv with manual SSH connections:

Manual SSH

If your ansible-playbook command is failing its SSH connection, it can be helpful to try a manual SSH connection to narrow down the problem. If manual SSH fails, try again with -v for verbose output.

Ciphers, KexAlgorithms, or MACs

The sshd role will most likely cause your SSH server to discontinue using some older and weaker protocols. If your connections involve older systems that do not support the stronger protocols configured by the sshd role, see Ciphers, KexAlgorithms, and MACs for how to add back in any protocols you need.


If you are running Trellis on MacOS and receiving a NET::ERR_CERT_INVALID error on your local dev domain, you may want to try using the vagrant-trellis-cert plugin using the following commands:


Getting Started