LAN/local deployment support, OS compat, Cloudflare Tunnel

- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN,
  HSTS max-age=0 for self-signed certs, split LAN vs public messages
- Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact
- Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream)
- Module prompts: accept IPs for matrix/cloud/vault/media, hard error
  on email with IP, all_in_one skips certbot email for LAN
- Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name
- OS family guards: ansible_os_family == Debian on all apt tasks
- SSH key path: expanduser().resolve() on user-provided key paths
- Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API
  token — no browser auth needed, creates tunnel + credentials + DNS + systemd

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/cloud/main.yml

@@ -28,7 +28,7 @@
 
     - name: restart php-fpm
       service:
-        name: php8.2-fpm
+        name: "php{{ php_ver }}-fpm"
         state: restarted
 
     - name: restart mariadb

phantom/playbooks/cloud/tasks/configure.yml

@@ -64,12 +64,12 @@
 
 - name: Configure PHP-FPM pool for Nextcloud
   copy:
-    dest: /etc/php/8.2/fpm/pool.d/nextcloud.conf
+    dest: "/etc/php/{{ php_ver }}/fpm/pool.d/nextcloud.conf"
     content: |
       [nextcloud]
       user = www-data
       group = www-data
-      listen = /run/php/php8.2-fpm-nextcloud.sock
+      listen = /run/php/php{{ php_ver }}-fpm-nextcloud.sock
       listen.owner = www-data
       listen.group = www-data
       pm = dynamic

phantom/playbooks/cloud/tasks/install.yml

@@ -4,19 +4,19 @@
 - name: Install Nextcloud dependencies
   apt:
     name:
-      - php8.2-fpm
-      - php8.2-xml
-      - php8.2-mbstring
-      - php8.2-gd
-      - php8.2-curl
-      - php8.2-zip
-      - php8.2-intl
-      - php8.2-mysql
-      - php8.2-redis
-      - php8.2-apcu
-      - php8.2-imagick
-      - php8.2-bcmath
-      - php8.2-gmp
+      - php-fpm
+      - php-xml
+      - php-mbstring
+      - php-gd
+      - php-curl
+      - php-zip
+      - php-intl
+      - php-mysql
+      - php-redis
+      - php-apcu
+      - php-imagick
+      - php-bcmath
+      - php-gmp
       - mariadb-server
       - redis-server
       - nginx
@@ -27,6 +27,16 @@
       - ca-certificates
     state: present
     update_cache: true
+  when: ansible_os_family == "Debian"
+
+- name: Detect installed PHP version
+  command: php -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;'
+  register: _php_ver_result
+  changed_when: false
+
+- name: Set PHP version fact
+  set_fact:
+    php_ver: "{{ _php_ver_result.stdout }}"
 
 - name: Enable and start MariaDB
   service:
@@ -42,7 +52,7 @@
 
 - name: Enable and start PHP-FPM
   service:
-    name: php8.2-fpm
+    name: "php{{ php_ver }}-fpm"
     state: started
     enabled: true
 

phantom/playbooks/cloud/tasks/nginx.yml

@@ -42,7 +42,7 @@
     dest: /etc/nginx/sites-available/nextcloud
     content: |
       upstream php-handler {
-          server unix:/run/php/php8.2-fpm-nextcloud.sock;
+          server unix:/run/php/php{{ php_ver }}-fpm-nextcloud.sock;
       }
 
       server {
@@ -63,7 +63,11 @@
           ssl_prefer_server_ciphers on;
 
           server_tokens off;
+          {% if _is_selfsigned | default(false) | bool %}
+          add_header Strict-Transport-Security "max-age=0" always;
+          {% else %}
           add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+          {% endif %}
           add_header X-Content-Type-Options nosniff always;
           add_header X-Frame-Options SAMEORIGIN always;
           add_header X-Robots-Tag "noindex, nofollow" always;