Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/modules/all_in_one.py

@@ -15,9 +15,9 @@ SERVICES = [
     ("matrix", "Matrix + Element", "Encrypted messaging"),
     ("vpn", "WireGuard VPN", "Private VPN server"),
     ("dns", "Pi-hole DNS", "Ad-blocking DNS"),
-    ("cloud", "Nextcloud", "File sync (stub)"),
-    ("vault", "Vaultwarden", "Password manager (stub)"),
-    ("media", "Jellyfin", "Media server (stub)"),
+    ("cloud", "Nextcloud", "File sync"),
+    ("vault", "Vaultwarden", "Password manager"),
+    ("media", "Jellyfin", "Media server"),
 ]
 
 
@@ -66,18 +66,6 @@ def gather_config(config):
         print(f"  {RED}No services selected.{RESET}")
         return None
 
-    # Warn about stub services
-    STUB_SERVICES = {"cloud", "vault", "media", "email"}
-    stubs_selected = [s for s in selected_services if s in STUB_SERVICES]
-    if stubs_selected:
-        stub_labels = {s[0]: s[1] for s in SERVICES}
-        print(f"\n  {YELLOW}Warning: The following services are stubs (playbook not yet implemented):{RESET}")
-        for s in stubs_selected:
-            print(f"    {YELLOW}- {stub_labels.get(s, s)}{RESET}")
-        proceed = input(f"  {YELLOW}Continue anyway? [y/N]:{RESET} ").strip().lower()
-        if proceed != "y":
-            return None
-
     config["services"] = selected_services
     config["all_in_one"] = True
 
@@ -116,7 +104,7 @@ def gather_config(config):
                 if config is None:
                     return None
         except ImportError:
-            pass  # Stub module, skip
+            pass  # Module not yet loaded, skip
     # Restore base domain
     config["domain"] = base_domain
 

phantom/modules/cloud.py

@@ -1,4 +1,4 @@
-"""Nextcloud deployment module (stub — playbook TODO)."""
+"""Nextcloud deployment module — PHP-FPM + MariaDB + Redis + nginx."""
 
 CYAN = "\033[38;5;51m"
 WHITE = "\033[38;5;255m"
@@ -9,7 +9,7 @@ RESET = "\033[0m"
 def gather_config(config):
     """Gather Nextcloud configuration."""
     print(f"\n{CYAN}  ┌─ Nextcloud Configuration ─────────────────────────┐{RESET}")
-    print(f"  {CYAN}│{RESET}  {GREY}Note: Playbook coming soon{RESET}")
+    print(f"  {CYAN}│{RESET}  {GREY}PHP-FPM + MariaDB + Redis + nginx{RESET}")
 
     config["domain"] = config.get("domain") or input(
         f"  {CYAN}│{RESET}  Domain (e.g. cloud.example.com): "

phantom/modules/email.py

@@ -1,4 +1,4 @@
-"""Mail-in-a-Box deployment module (stub — playbook TODO)."""
+"""Mail-in-a-Box deployment module — native installer script."""
 
 CYAN = "\033[38;5;51m"
 WHITE = "\033[38;5;255m"
@@ -9,7 +9,7 @@ RESET = "\033[0m"
 def gather_config(config):
     """Gather Mail-in-a-Box configuration."""
     print(f"\n{CYAN}  ┌─ Mail-in-a-Box Configuration ─────────────────────┐{RESET}")
-    print(f"  {CYAN}│{RESET}  {GREY}Note: Playbook coming soon{RESET}")
+    print(f"  {CYAN}│{RESET}  {GREY}Complete mail stack — manages its own nginx/TLS/DNS{RESET}")
 
     config["domain"] = config.get("domain") or input(
         f"  {CYAN}│{RESET}  Mail domain (e.g. mail.example.com): "

phantom/modules/matrix.py

@@ -42,6 +42,8 @@ def gather_config(config):
         if config["domain"].startswith("matrix.") else config["domain"]
 
     config["matrix_signing_key"] = secrets.token_hex(32)
+    config["matrix_form_secret"] = secrets.token_hex(32)
+    config["matrix_macaroon_secret"] = secrets.token_hex(32)
 
     print(f"  {CYAN}└─────────────────────────────────────────────────────┘{RESET}")
     return config

phantom/modules/media.py

@@ -1,4 +1,4 @@
-"""Jellyfin media server deployment module (stub — playbook TODO)."""
+"""Jellyfin media server deployment module — official apt repo + nginx."""
 
 CYAN = "\033[38;5;51m"
 WHITE = "\033[38;5;255m"
@@ -9,7 +9,7 @@ RESET = "\033[0m"
 def gather_config(config):
     """Gather Jellyfin configuration."""
     print(f"\n{CYAN}  ┌─ Jellyfin Configuration ──────────────────────────┐{RESET}")
-    print(f"  {CYAN}│{RESET}  {GREY}Note: Playbook coming soon{RESET}")
+    print(f"  {CYAN}│{RESET}  {GREY}Official apt repo + nginx reverse proxy{RESET}")
 
     config["domain"] = config.get("domain") or input(
         f"  {CYAN}│{RESET}  Domain (e.g. media.example.com): "

phantom/modules/vault.py

@@ -1,4 +1,4 @@
-"""Vaultwarden (Bitwarden) deployment module (stub — playbook TODO)."""
+"""Vaultwarden (Bitwarden-compatible) deployment module — binary + systemd + nginx."""
 
 import secrets
 
@@ -11,7 +11,7 @@ RESET = "\033[0m"
 def gather_config(config):
     """Gather Vaultwarden configuration."""
     print(f"\n{CYAN}  ┌─ Vaultwarden Configuration ───────────────────────┐{RESET}")
-    print(f"  {CYAN}│{RESET}  {GREY}Note: Playbook coming soon{RESET}")
+    print(f"  {CYAN}│{RESET}  {GREY}Pre-built binary + systemd + nginx{RESET}")
 
     config["domain"] = config.get("domain") or input(
         f"  {CYAN}│{RESET}  Domain (e.g. vault.example.com): "