Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/all_in_one/main.yml

@@ -5,6 +5,7 @@
 #
 # NOTE: This playbook includes task files directly rather than
 # importing full playbooks, to allow conditional composition.
+# NOTE: Email (MIAB) is excluded — it manages its own nginx/DNS/TLS.
 
 - name: All-in-One Privacy Server
   hosts: all
@@ -41,6 +42,8 @@
         - "443"
 
     # ─── Deploy Individual Services (task files, not full playbooks) ──
+
+    # Matrix
     - name: Deploy Matrix — Synapse
       include_tasks: "{{ playbook_dir }}/../matrix/tasks/synapse.yml"
       when: "'matrix' in selected_services"
@@ -53,6 +56,14 @@
       include_tasks: "{{ playbook_dir }}/../matrix/tasks/nginx.yml"
       when: "'matrix' in selected_services"
 
+    - name: Deploy Matrix user creation script
+      template:
+        src: "{{ playbook_dir }}/../common/templates/add-matrix-user.sh.j2"
+        dest: /root/Tools/add-matrix-user.sh
+        mode: "0700"
+      when: "'matrix' in selected_services"
+
+    # WireGuard VPN
     - name: Deploy WireGuard — Install
       include_tasks: "{{ playbook_dir }}/../vpn/tasks/install.yml"
       when: "'vpn' in selected_services"
@@ -61,6 +72,7 @@
       include_tasks: "{{ playbook_dir }}/../vpn/tasks/configure.yml"
       when: "'vpn' in selected_services"
 
+    # Pi-hole DNS
     - name: Deploy Pi-hole — Install
       include_tasks: "{{ playbook_dir }}/../dns/tasks/install.yml"
       when: "'dns' in selected_services"
@@ -69,11 +81,44 @@
       include_tasks: "{{ playbook_dir }}/../dns/tasks/configure.yml"
       when: "'dns' in selected_services"
 
-    # Stub services — print notice
-    - name: Notice for stub services
-      debug:
-        msg: "Service '{{ item }}' playbook not yet implemented — skipping"
-      loop: "{{ selected_services | select('in', ['cloud', 'vault', 'media', 'email']) | list }}"
+    # Nextcloud
+    - name: Deploy Nextcloud — Install
+      include_tasks: "{{ playbook_dir }}/../cloud/tasks/install.yml"
+      when: "'cloud' in selected_services"
+
+    - name: Deploy Nextcloud — Configure
+      include_tasks: "{{ playbook_dir }}/../cloud/tasks/configure.yml"
+      when: "'cloud' in selected_services"
+
+    - name: Deploy Nextcloud — Nginx vhost
+      include_tasks: "{{ playbook_dir }}/../cloud/tasks/nginx.yml"
+      when: "'cloud' in selected_services"
+
+    # Vaultwarden
+    - name: Deploy Vaultwarden — Install
+      include_tasks: "{{ playbook_dir }}/../vault/tasks/install.yml"
+      when: "'vault' in selected_services"
+
+    - name: Deploy Vaultwarden — Configure
+      include_tasks: "{{ playbook_dir }}/../vault/tasks/configure.yml"
+      when: "'vault' in selected_services"
+
+    - name: Deploy Vaultwarden — Nginx vhost
+      include_tasks: "{{ playbook_dir }}/../vault/tasks/nginx.yml"
+      when: "'vault' in selected_services"
+
+    # Jellyfin
+    - name: Deploy Jellyfin — Install
+      include_tasks: "{{ playbook_dir }}/../media/tasks/install.yml"
+      when: "'media' in selected_services"
+
+    - name: Deploy Jellyfin — Configure
+      include_tasks: "{{ playbook_dir }}/../media/tasks/configure.yml"
+      when: "'media' in selected_services"
+
+    - name: Deploy Jellyfin — Nginx vhost
+      include_tasks: "{{ playbook_dir }}/../media/tasks/nginx.yml"
+      when: "'media' in selected_services"
 
   handlers:
     - name: reload nginx
@@ -86,6 +131,36 @@
         name: matrix-synapse
         state: restarted
 
+    - name: restart php-fpm
+      service:
+        name: php8.2-fpm
+        state: restarted
+
+    - name: restart mariadb
+      service:
+        name: mariadb
+        state: restarted
+
+    - name: restart redis
+      service:
+        name: redis-server
+        state: restarted
+
+    - name: restart vaultwarden
+      service:
+        name: vaultwarden
+        state: restarted
+
+    - name: restart jellyfin
+      service:
+        name: jellyfin
+        state: restarted
+
+    - name: restart pihole-FTL
+      service:
+        name: pihole-FTL
+        state: restarted
+
     - name: restart sshd
       service:
         name: sshd

phantom/playbooks/cloud/main.yml

@@ -1,11 +1,42 @@
 ---
-# Cloud deployment — Coming soon
-# This is a stub playbook. Full implementation planned.
+# Nextcloud deployment — PHP-FPM + MariaDB + Redis + nginx
 
-- name: Deploy Cloud Server
+- name: Deploy Nextcloud Server
   hosts: all
   become: true
+  vars:
+    nextcloud_domain: "{{ domain }}"
+    nextcloud_admin: "{{ cloud_admin_user | default('admin') }}"
+    nextcloud_storage_gb: "{{ cloud_storage_gb | default('10') }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
   tasks:
-    - name: Placeholder
-      debug:
-        msg: "Cloud playbook not yet implemented. Check phantom/README.md for status."
+    - name: Include Nextcloud installation
+      include_tasks: tasks/install.yml
+
+    - name: Include Nextcloud configuration
+      include_tasks: tasks/configure.yml
+
+    - name: Include Nextcloud nginx reverse proxy
+      include_tasks: tasks/nginx.yml
+
+  handlers:
+    - name: reload nginx
+      service:
+        name: nginx
+        state: reloaded
+
+    - name: restart php-fpm
+      service:
+        name: php8.2-fpm
+        state: restarted
+
+    - name: restart mariadb
+      service:
+        name: mariadb
+        state: restarted
+
+    - name: restart redis
+      service:
+        name: redis-server
+        state: restarted

phantom/playbooks/cloud/tasks/configure.yml

@@ -0,0 +1,180 @@
+---
+# Nextcloud database, app, and service configuration
+
+- name: Generate MariaDB password for Nextcloud
+  command: openssl rand -base64 24
+  register: nc_db_password_gen
+  args:
+    creates: /var/www/nextcloud/.db_password
+
+- name: Save DB password
+  copy:
+    content: "{{ nc_db_password_gen.stdout }}"
+    dest: /var/www/nextcloud/.db_password
+    owner: www-data
+    group: www-data
+    mode: "0600"
+  when: nc_db_password_gen.changed
+
+- name: Read saved DB password
+  slurp:
+    src: /var/www/nextcloud/.db_password
+  register: nc_db_password_file
+
+- name: Set DB password fact
+  set_fact:
+    nc_db_pass: "{{ (nc_db_password_file.content | b64decode).strip() }}"
+
+- name: Create Nextcloud MariaDB database
+  mysql_db:
+    name: nextcloud
+    state: present
+    encoding: utf8mb4
+    collation: utf8mb4_general_ci
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+
+- name: Create Nextcloud MariaDB user
+  mysql_user:
+    name: nextcloud
+    password: "{{ nc_db_pass }}"
+    priv: "nextcloud.*:ALL"
+    host: localhost
+    state: present
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+
+- name: Generate admin password
+  command: openssl rand -base64 16
+  register: nc_admin_password_gen
+  args:
+    creates: /var/www/nextcloud/.admin_password
+
+- name: Save admin password
+  copy:
+    content: "{{ nc_admin_password_gen.stdout }}"
+    dest: /var/www/nextcloud/.admin_password
+    owner: www-data
+    group: www-data
+    mode: "0600"
+  when: nc_admin_password_gen.changed
+
+- name: Read saved admin password
+  slurp:
+    src: /var/www/nextcloud/.admin_password
+  register: nc_admin_password_file
+
+- name: Configure PHP-FPM pool for Nextcloud
+  copy:
+    dest: /etc/php/8.2/fpm/pool.d/nextcloud.conf
+    content: |
+      [nextcloud]
+      user = www-data
+      group = www-data
+      listen = /run/php/php8.2-fpm-nextcloud.sock
+      listen.owner = www-data
+      listen.group = www-data
+      pm = dynamic
+      pm.max_children = 16
+      pm.start_servers = 4
+      pm.min_spare_servers = 2
+      pm.max_spare_servers = 8
+      pm.max_requests = 500
+      env[HOSTNAME] = $HOSTNAME
+      env[TMP] = /tmp
+      env[TMPDIR] = /tmp
+      env[TEMP] = /tmp
+      php_value[upload_max_filesize] = 10G
+      php_value[post_max_size] = 10G
+      php_value[memory_limit] = 512M
+      php_value[max_execution_time] = 3600
+      php_value[max_input_time] = 3600
+      php_value[opcache.enable] = 1
+      php_value[opcache.memory_consumption] = 128
+      php_value[opcache.interned_strings_buffer] = 16
+      php_value[opcache.max_accelerated_files] = 10000
+      php_value[opcache.revalidate_freq] = 1
+    mode: "0644"
+  notify: restart php-fpm
+
+- name: Flush handlers to restart PHP-FPM
+  meta: flush_handlers
+
+- name: Install Nextcloud via occ
+  become_user: www-data
+  command: >
+    php /var/www/nextcloud/occ maintenance:install
+    --database mysql
+    --database-name nextcloud
+    --database-user nextcloud
+    --database-pass "{{ nc_db_pass }}"
+    --admin-user "{{ nextcloud_admin }}"
+    --admin-pass "{{ (nc_admin_password_file.content | b64decode).strip() }}"
+    --data-dir /var/www/nextcloud/data
+  args:
+    creates: /var/www/nextcloud/config/config.php
+
+- name: Set trusted domain
+  become_user: www-data
+  command: "php /var/www/nextcloud/occ config:system:set trusted_domains 0 --value={{ nextcloud_domain }}"
+  changed_when: true
+
+- name: Set overwrite.cli.url
+  become_user: www-data
+  command: "php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value=https://{{ nextcloud_domain }}"
+  changed_when: true
+
+- name: Configure Redis caching
+  become_user: www-data
+  command: "php /var/www/nextcloud/occ config:system:set {{ item.key }} --value={{ item.value }} {{ item.type | default('') }}"
+  loop:
+    - { key: "memcache.local", value: "\\OC\\Memcache\\APCu" }
+    - { key: "memcache.distributed", value: "\\OC\\Memcache\\Redis" }
+    - { key: "memcache.locking", value: "\\OC\\Memcache\\Redis" }
+    - { key: "redis host", value: "localhost" }
+    - { key: "redis port", value: "6379", type: "--type=integer" }
+  changed_when: true
+
+- name: Set default phone region
+  become_user: www-data
+  command: "php /var/www/nextcloud/occ config:system:set default_phone_region --value=US"
+  changed_when: true
+
+- name: Deploy Nextcloud cron systemd timer
+  copy:
+    dest: /etc/systemd/system/nextcloud-cron.service
+    content: |
+      [Unit]
+      Description=Nextcloud cron.php
+      After=network.target
+
+      [Service]
+      User=www-data
+      ExecStart=/usr/bin/php /var/www/nextcloud/cron.php
+      Type=oneshot
+    mode: "0644"
+
+- name: Deploy Nextcloud cron timer
+  copy:
+    dest: /etc/systemd/system/nextcloud-cron.timer
+    content: |
+      [Unit]
+      Description=Run Nextcloud cron.php every 5 minutes
+
+      [Timer]
+      OnBootSec=5min
+      OnUnitActiveSec=5min
+      Unit=nextcloud-cron.service
+
+      [Install]
+      WantedBy=timers.target
+    mode: "0644"
+
+- name: Enable Nextcloud cron timer
+  systemd:
+    name: nextcloud-cron.timer
+    state: started
+    enabled: true
+    daemon_reload: true
+
+- name: Display admin credentials
+  debug:
+    msg: "Nextcloud admin credentials saved to /var/www/nextcloud/.admin_password — access at https://{{ nextcloud_domain }}"

phantom/playbooks/cloud/tasks/install.yml

@@ -0,0 +1,96 @@
+---
+# Nextcloud package and dependency installation
+
+- name: Install Nextcloud dependencies
+  apt:
+    name:
+      - php8.2-fpm
+      - php8.2-xml
+      - php8.2-mbstring
+      - php8.2-gd
+      - php8.2-curl
+      - php8.2-zip
+      - php8.2-intl
+      - php8.2-mysql
+      - php8.2-redis
+      - php8.2-apcu
+      - php8.2-imagick
+      - php8.2-bcmath
+      - php8.2-gmp
+      - mariadb-server
+      - redis-server
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - unzip
+      - curl
+      - ca-certificates
+    state: present
+    update_cache: true
+
+- name: Enable and start MariaDB
+  service:
+    name: mariadb
+    state: started
+    enabled: true
+
+- name: Enable and start Redis
+  service:
+    name: redis-server
+    state: started
+    enabled: true
+
+- name: Enable and start PHP-FPM
+  service:
+    name: php8.2-fpm
+    state: started
+    enabled: true
+
+- name: Get latest Nextcloud version
+  uri:
+    url: https://download.nextcloud.com/server/releases/latest.tar.bz2.sha256
+    return_content: true
+  register: nc_checksum_response
+
+- name: Parse Nextcloud checksum
+  set_fact:
+    nc_checksum: "{{ nc_checksum_response.content.split()[0] }}"
+
+- name: Download Nextcloud tarball
+  get_url:
+    url: https://download.nextcloud.com/server/releases/latest.tar.bz2
+    dest: /tmp/nextcloud.tar.bz2
+    checksum: "sha256:{{ nc_checksum }}"
+    mode: "0644"
+
+- name: Extract Nextcloud
+  unarchive:
+    src: /tmp/nextcloud.tar.bz2
+    dest: /var/www/
+    remote_src: true
+    creates: /var/www/nextcloud/index.php
+
+- name: Set Nextcloud ownership
+  file:
+    path: /var/www/nextcloud
+    state: directory
+    owner: www-data
+    group: www-data
+    recurse: true
+
+- name: Create Nextcloud data directory
+  file:
+    path: /var/www/nextcloud/data
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: "0770"
+
+- name: Allow HTTP/HTTPS through UFW
+  ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - "80"
+    - "443"

phantom/playbooks/cloud/tasks/nginx.yml

@@ -0,0 +1,109 @@
+---
+# Nginx reverse proxy for Nextcloud
+
+- name: Create certbot webroot
+  file:
+    path: /var/www/certbot
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: "0755"
+
+- name: Deploy HTTP-only nginx config (for certbot)
+  copy:
+    dest: /etc/nginx/sites-available/nextcloud
+    content: |
+      server {
+          listen 80;
+          server_name {{ nextcloud_domain }};
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
+      }
+    mode: "0644"
+  notify: reload nginx
+
+- name: Enable Nextcloud nginx site
+  file:
+    src: /etc/nginx/sites-available/nextcloud
+    dest: /etc/nginx/sites-enabled/nextcloud
+    state: link
+  notify: reload nginx
+
+- name: Flush handlers to apply HTTP config
+  meta: flush_handlers
+
+- name: Setup TLS (certbot with self-signed fallback)
+  include_tasks: ../../common/tls_setup.yml
+  vars:
+    _tls_domain: "{{ nextcloud_domain }}"
+
+- name: Deploy SSL nginx config
+  copy:
+    dest: /etc/nginx/sites-available/nextcloud
+    content: |
+      upstream php-handler {
+          server unix:/run/php/php8.2-fpm-nextcloud.sock;
+      }
+
+      server {
+          listen 80;
+          server_name {{ nextcloud_domain }};
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 301 https://$host$request_uri; }
+      }
+
+      server {
+          listen 443 ssl http2;
+          server_name {{ nextcloud_domain }};
+
+          ssl_certificate {{ _ssl_cert }};
+          ssl_certificate_key {{ _ssl_key }};
+          ssl_protocols TLSv1.2 TLSv1.3;
+          ssl_ciphers HIGH:!aNULL:!MD5;
+          ssl_prefer_server_ciphers on;
+
+          server_tokens off;
+          add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+          add_header X-Content-Type-Options nosniff always;
+          add_header X-Frame-Options SAMEORIGIN always;
+          add_header X-Robots-Tag "noindex, nofollow" always;
+          add_header Referrer-Policy no-referrer always;
+
+          client_max_body_size 10G;
+          client_body_timeout 3600s;
+          fastcgi_buffers 64 4K;
+
+          root /var/www/nextcloud;
+
+          location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; }
+          location = /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; }
+          location = /.well-known/webfinger { return 301 $scheme://$host/index.php/.well-known/webfinger; }
+          location = /.well-known/nodeinfo { return 301 $scheme://$host/index.php/.well-known/nodeinfo; }
+
+          location / { rewrite ^ /index.php; }
+
+          location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { deny all; }
+          location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { deny all; }
+
+          location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+)\.php(?:$|\/) {
+              fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+              set $path_info $fastcgi_path_info;
+              try_files $fastcgi_script_name =404;
+              include fastcgi_params;
+              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+              fastcgi_param PATH_INFO $path_info;
+              fastcgi_param HTTPS on;
+              fastcgi_param modHeadersAvailable true;
+              fastcgi_param front_controller_active true;
+              fastcgi_pass php-handler;
+              fastcgi_intercept_errors on;
+              fastcgi_request_buffering off;
+              fastcgi_read_timeout 3600;
+          }
+
+          location ~ ^\/(?:updater|ocs-provider)(?:$|\/) { try_files $uri/ =404; index index.php; }
+          location ~ \.(?:css|js|woff2?|svg|gif|map)$ { try_files $uri /index.php$request_uri; add_header Cache-Control "public, max-age=15778463"; access_log off; }
+          location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ { try_files $uri /index.php$request_uri; access_log off; }
+      }
+    mode: "0644"
+  notify: reload nginx

phantom/playbooks/common/base_hardening.yml

@@ -6,7 +6,7 @@
   hosts: all
   become: true
   vars:
-    ssh_port: "{{ ssh_port | default(22) }}"
+    _ssh_port: "{{ ssh_port | default('22') }}"
     ssh_allow_password: false
 
   tasks:
@@ -51,7 +51,7 @@
     - name: Allow SSH through UFW
       ufw:
         rule: allow
-        port: "{{ ssh_port }}"
+        port: "{{ _ssh_port }}"
         proto: tcp
 
     - name: Enable UFW
@@ -59,18 +59,45 @@
         state: enabled
 
     # ─── Fail2ban ───────────────────────────────────────────────────────
-    - name: Configure fail2ban SSH jail
+    - name: Configure fail2ban jails
       copy:
         dest: /etc/fail2ban/jail.local
         content: |
-          [sshd]
-          enabled = true
-          port = {{ ssh_port }}
-          filter = sshd
-          logpath = /var/log/auth.log
-          maxretry = 5
+          [DEFAULT]
           bantime = 3600
           findtime = 600
+          maxretry = 5
+          banaction = ufw
+
+          [sshd]
+          enabled = true
+          port = {{ _ssh_port }}
+          filter = sshd
+          backend = systemd
+          maxretry = 3
+          bantime = 7200
+
+          [nginx-http-auth]
+          enabled = true
+          port = http,https
+          filter = nginx-http-auth
+          logpath = /var/log/nginx/error.log
+          maxretry = 3
+
+          [nginx-botsearch]
+          enabled = true
+          port = http,https
+          filter = nginx-botsearch
+          logpath = /var/log/nginx/access.log
+          maxretry = 5
+
+          [nginx-limit-req]
+          enabled = true
+          port = http,https
+          filter = nginx-limit-req
+          logpath = /var/log/nginx/error.log
+          maxretry = 5
+          bantime = 3600
         mode: "0644"
       notify: restart fail2ban
 
@@ -103,6 +130,41 @@
         line: "X11Forwarding no"
       notify: restart sshd
 
+    - name: Set SSH MaxAuthTries
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?MaxAuthTries"
+        line: "MaxAuthTries 3"
+      notify: restart sshd
+
+    - name: Set SSH ClientAliveInterval
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?ClientAliveInterval"
+        line: "ClientAliveInterval 300"
+      notify: restart sshd
+
+    - name: Set SSH ClientAliveCountMax
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?ClientAliveCountMax"
+        line: "ClientAliveCountMax 2"
+      notify: restart sshd
+
+    - name: Set SSH MaxStartups
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?MaxStartups"
+        line: "MaxStartups 10:30:100"
+      notify: restart sshd
+
+    - name: Set SSH LoginGraceTime
+      lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: "^#?LoginGraceTime"
+        line: "LoginGraceTime 60"
+      notify: restart sshd
+
     # ─── Automatic Security Updates ─────────────────────────────────────
     - name: Enable unattended upgrades for security
       copy:

phantom/playbooks/common/templates/add-matrix-user.sh.j2

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Phantom — Matrix User Registration
+# Creates a new user on this Synapse homeserver
+set -euo pipefail
+
+SERVER_NAME=$(grep '^server_name:' /etc/matrix-synapse/homeserver.yaml | awk '{print $2}' | tr -d '"')
+SECRET=$(grep 'registration_shared_secret:' /etc/matrix-synapse/homeserver.yaml | awk '{print $2}' | tr -d '"')
+
+echo "============================================"
+echo "  Matrix — Add User"
+echo "  Server: ${SERVER_NAME}"
+echo "============================================"
+echo ""
+
+register_new_matrix_user \
+    --shared-secret "${SECRET}" \
+    http://localhost:8008

phantom/playbooks/common/templates/setup-cert.sh.j2

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Phantom — Let's Encrypt Certificate Setup
+# Deployed by phantom to {{ ansible_host | default('this server') }}
+# Run this script after DNS has propagated to this server's IP.
+set -euo pipefail
+
+DOMAIN="{{ _tls_domain }}"
+SERVER_IP=$(hostname -I | awk '{print $1}')
+
+echo "============================================"
+echo "  Phantom — Certificate Setup"
+echo "============================================"
+echo "  Domain:    ${DOMAIN}"
+echo "  Server IP: ${SERVER_IP}"
+echo ""
+
+# ── DNS Validation ──────────────────────────────────────────────────────
+echo "[*] Checking DNS resolution for ${DOMAIN}..."
+DNS_IP=$(dig +short "${DOMAIN}" @1.1.1.1 2>/dev/null | tail -1)
+
+if [ -z "${DNS_IP}" ]; then
+    echo "[-] DNS lookup failed — ${DOMAIN} does not resolve."
+    echo "    Point your DNS A record to: ${SERVER_IP}"
+    exit 1
+fi
+
+if [ "${DNS_IP}" != "${SERVER_IP}" ]; then
+    echo "[-] DNS mismatch!"
+    echo "    ${DOMAIN} resolves to: ${DNS_IP}"
+    echo "    This server's IP:      ${SERVER_IP}"
+    echo "    Update your DNS A record to point to ${SERVER_IP}"
+    exit 1
+fi
+
+echo "[+] DNS OK — ${DOMAIN} → ${DNS_IP}"
+
+# ── HTTP Reachability Check ─────────────────────────────────────────────
+echo "[*] Verifying HTTP reachability..."
+HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "http://${DOMAIN}/" --max-time 10 2>/dev/null || echo "000")
+
+if [ "${HTTP_CODE}" = "000" ]; then
+    echo "[!] Warning: HTTP request to ${DOMAIN} failed (timeout or connection refused)"
+    echo "    Certbot may fail if port 80 is not reachable."
+    read -rp "    Continue anyway? [y/N] " CONT
+    [ "${CONT}" = "y" ] || exit 1
+else
+    echo "[+] HTTP reachable (status ${HTTP_CODE})"
+fi
+
+# ── Certbot ─────────────────────────────────────────────────────────────
+echo ""
+echo "[*] Running certbot for ${DOMAIN}..."
+
+# Check if nginx is running — use webroot if so, standalone otherwise
+if systemctl is-active --quiet nginx 2>/dev/null; then
+    echo "    Using webroot mode (nginx running)"
+    mkdir -p /var/www/certbot
+    certbot certonly --webroot -w /var/www/certbot \
+        -d "${DOMAIN}" \
+        --non-interactive \
+        --agree-tos \
+{% if certbot_email is defined and certbot_email %}
+        --email "{{ certbot_email }}" \
+{% else %}
+        --register-unsafely-without-email \
+{% endif %}
+        --force-renewal
+else
+    echo "    Using standalone mode (nginx not running)"
+    certbot certonly --standalone \
+        -d "${DOMAIN}" \
+        --non-interactive \
+        --agree-tos \
+{% if certbot_email is defined and certbot_email %}
+        --email "{{ certbot_email }}" \
+{% else %}
+        --register-unsafely-without-email \
+{% endif %}
+        --force-renewal
+fi
+
+if [ ! -f "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" ]; then
+    echo "[-] Certbot failed — certificate not found."
+    exit 1
+fi
+
+echo "[+] Certificate obtained successfully."
+
+# ── Update nginx to use LE cert ─────────────────────────────────────────
+echo "[*] Updating nginx configuration..."
+
+SELF_CERT="/etc/ssl/certs/${DOMAIN}-selfsigned.crt"
+SELF_KEY="/etc/ssl/private/${DOMAIN}-selfsigned.key"
+LE_CERT="/etc/letsencrypt/live/${DOMAIN}/fullchain.pem"
+LE_KEY="/etc/letsencrypt/live/${DOMAIN}/privkey.pem"
+
+# Replace self-signed cert paths with LE cert paths in all nginx configs
+for CONF in /etc/nginx/sites-enabled/* /etc/nginx/conf.d/*; do
+    [ -f "${CONF}" ] || continue
+    if grep -q "${SELF_CERT}" "${CONF}" 2>/dev/null; then
+        sed -i "s|${SELF_CERT}|${LE_CERT}|g" "${CONF}"
+        sed -i "s|${SELF_KEY}|${LE_KEY}|g" "${CONF}"
+        echo "    Updated: ${CONF}"
+    fi
+done
+
+# Test and reload nginx
+if nginx -t 2>/dev/null; then
+    systemctl reload nginx
+    echo "[+] nginx reloaded with Let's Encrypt certificate."
+else
+    echo "[-] nginx config test failed — check configuration manually."
+    exit 1
+fi
+
+echo ""
+echo "============================================"
+echo "  Certificate setup complete!"
+echo "  Domain: https://${DOMAIN}"
+echo "============================================"

phantom/playbooks/common/tls_setup.yml

@@ -0,0 +1,59 @@
+---
+# Shared TLS setup: tries certbot, falls back to self-signed
+# Include with: include_tasks: ../common/tls_setup.yml
+# Required vars: _tls_domain (the domain to get a cert for)
+
+- name: Attempt TLS certificate from Let's Encrypt
+  command: >
+    certbot certonly --webroot -w /var/www/certbot
+    -d {{ _tls_domain }}
+    --non-interactive
+    --agree-tos
+    {% if certbot_email is defined and certbot_email %}
+    --email {{ certbot_email }}
+    {% else %}
+    --register-unsafely-without-email
+    {% endif %}
+  args:
+    creates: "/etc/letsencrypt/live/{{ _tls_domain }}/fullchain.pem"
+  register: _certbot_result
+  ignore_errors: true
+
+- name: Generate self-signed certificate (fallback)
+  command: >
+    openssl req -x509 -nodes -days 365 -newkey rsa:4096
+    -keyout /etc/ssl/private/{{ _tls_domain }}-selfsigned.key
+    -out /etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt
+    -subj "/CN={{ _tls_domain }}"
+  args:
+    creates: "/etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt"
+  when: _certbot_result is failed
+
+- name: Set cert paths (certbot)
+  set_fact:
+    _ssl_cert: "/etc/letsencrypt/live/{{ _tls_domain }}/fullchain.pem"
+    _ssl_key: "/etc/letsencrypt/live/{{ _tls_domain }}/privkey.pem"
+  when: _certbot_result is not failed
+
+- name: Set cert paths (self-signed)
+  set_fact:
+    _ssl_cert: "/etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt"
+    _ssl_key: "/etc/ssl/private/{{ _tls_domain }}-selfsigned.key"
+  when: _certbot_result is failed
+
+- name: Warn about self-signed certificate
+  debug:
+    msg: "Using self-signed TLS cert. Point DNS to this server and run: certbot certonly --webroot -w /var/www/certbot -d {{ _tls_domain }}"
+  when: _certbot_result is failed
+
+- name: Create Tools directory
+  file:
+    path: /root/Tools
+    state: directory
+    mode: "0755"
+
+- name: Deploy cert setup script
+  template:
+    src: ../common/templates/setup-cert.sh.j2
+    dest: /root/Tools/setup-cert.sh
+    mode: "0700"

phantom/playbooks/dns/main.yml

@@ -1,5 +1,5 @@
 ---
-# Pi-hole DNS server deployment (Docker-based)
+# Pi-hole DNS server deployment (native installer)
 
 - name: Deploy Pi-hole DNS Server
   hosts: all
@@ -16,3 +16,9 @@
 
     - name: Include Pi-hole configuration
       include_tasks: tasks/configure.yml
+
+  handlers:
+    - name: restart pihole-FTL
+      service:
+        name: pihole-FTL
+        state: restarted

phantom/playbooks/dns/tasks/configure.yml

@@ -1,66 +1,66 @@
 ---
-# Pi-hole Docker configuration and launch
-
-- name: Create Pi-hole directories
-  file:
-    path: "{{ item }}"
-    state: directory
-    mode: "0755"
-  loop:
-    - /opt/pihole
-    - /opt/pihole/etc-pihole
-    - /opt/pihole/etc-dnsmasq.d
+# Pi-hole native configuration
 
 - name: Generate Pi-hole admin password
-  shell: "openssl rand -base64 16"
-  register: pihole_password
+  command: openssl rand -base64 16
+  register: pihole_password_gen
   args:
-    creates: /opt/pihole/.password
+    creates: /etc/pihole/.phantom_password
 
 - name: Save admin password
   copy:
-    content: "{{ pihole_password.stdout }}"
-    dest: /opt/pihole/.password
+    content: "{{ pihole_password_gen.stdout }}"
+    dest: /etc/pihole/.phantom_password
     mode: "0600"
-  when: pihole_password.changed
+  when: pihole_password_gen.changed
 
-- name: Deploy Pi-hole Docker Compose
-  copy:
-    dest: /opt/pihole/docker-compose.yml
-    content: |
-      services:
-        pihole:
-          container_name: pihole
-          image: pihole/pihole:latest
-          ports:
-            - "53:53/tcp"
-            - "53:53/udp"
-            - "80:80/tcp"
-          environment:
-            TZ: UTC
-            WEBPASSWORD_FILE: /run/secrets/webpassword
-            PIHOLE_DNS_: "{{ pihole_upstream }}"
-            DNSSEC: "true"
-            QUERY_LOGGING: "false"
-          volumes:
-            - /opt/pihole/etc-pihole:/etc/pihole
-            - /opt/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
-          secrets:
-            - webpassword
-          restart: unless-stopped
-          dns:
-            - 127.0.0.1
-            - 9.9.9.9
-      secrets:
-        webpassword:
-          file: /opt/pihole/.password
-    mode: "0644"
+- name: Read saved password
+  slurp:
+    src: /etc/pihole/.phantom_password
+  register: pihole_password_file
 
-- name: Start Pi-hole
-  shell: cd /opt/pihole && docker compose up -d
-  args:
-    creates: /opt/pihole/etc-pihole/pihole-FTL.db
+- name: Set Pi-hole admin password
+  command: "pihole -a -p {{ (pihole_password_file.content | b64decode).strip() }}"
+  changed_when: true
 
-- name: Display admin password
+- name: Set upstream DNS servers
+  command: "pihole -a setdns {{ pihole_upstream | replace(';', ' ') }}"
+  changed_when: true
+
+- name: Configure blocklist level
+  block:
+    - name: Update gravity (standard blocklist)
+      command: pihole -g
+      changed_when: true
+      when: pihole_blocklist == "standard"
+
+    - name: Add aggressive blocklists
+      lineinfile:
+        path: /etc/pihole/adlists.list
+        line: "{{ item }}"
+        create: true
+        mode: "0644"
+      loop:
+        - "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
+        - "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt"
+      when: pihole_blocklist == "aggressive"
+      notify: update gravity
+
+    - name: Update gravity after blocklist changes
+      command: pihole -g
+      changed_when: true
+      when: pihole_blocklist == "aggressive"
+
+- name: Enable DNSSEC
+  command: pihole -a dnssec on
+  changed_when: true
+
+- name: Ensure pihole-FTL is running
+  service:
+    name: pihole-FTL
+    state: started
+    enabled: true
+
+- name: Display admin credentials
   debug:
-    msg: "Pi-hole admin password: {{ pihole_password.stdout | default('(see /opt/pihole/.password)') }}"
+    msg: "Pi-hole admin password saved to /etc/pihole/.phantom_password — access admin at http://{{ ansible_default_ipv4.address | default('server_ip') }}/admin"

phantom/playbooks/dns/tasks/install.yml

@@ -1,40 +1,17 @@
 ---
-# Pi-hole installation via Docker
+# Pi-hole native installation (no Docker)
 
-- name: Install Docker prerequisites
+- name: Install Pi-hole prerequisites
   apt:
     name:
-      - apt-transport-https
-      - ca-certificates
       - curl
-      - gnupg
-      - lsb-release
+      - git
+      - iproute2
+      - whiptail
+      - ca-certificates
+      - cron
     state: present
-
-- name: Add Docker GPG key
-  apt_key:
-    url: https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg
-    state: present
-
-- name: Add Docker repository
-  apt_repository:
-    repo: "deb https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
-    state: present
-
-- name: Install Docker
-  apt:
-    name:
-      - docker-ce
-      - docker-ce-cli
-      - containerd.io
-      - docker-compose-plugin
-    state: present
-
-- name: Enable Docker service
-  service:
-    name: docker
-    state: started
-    enabled: true
+    update_cache: true
 
 - name: Stop systemd-resolved (conflicts with Pi-hole on port 53)
   service:
@@ -43,7 +20,7 @@
     enabled: false
   failed_when: false
 
-- name: Set DNS fallback
+- name: Set DNS fallback for installation
   copy:
     dest: /etc/resolv.conf
     content: |
@@ -51,6 +28,45 @@
       nameserver 1.1.1.1
     mode: "0644"
 
+- name: Create Pi-hole config directory
+  file:
+    path: /etc/pihole
+    state: directory
+    mode: "0755"
+
+- name: Deploy setupVars.conf for unattended install
+  copy:
+    dest: /etc/pihole/setupVars.conf
+    content: |
+      PIHOLE_INTERFACE={{ ansible_default_ipv4.interface | default('eth0') }}
+      PIHOLE_DNS_1={{ pihole_upstream.split(';')[0] | default('9.9.9.9') }}
+      PIHOLE_DNS_2={{ pihole_upstream.split(';')[1] | default('149.112.112.112') }}
+      QUERY_LOGGING=false
+      INSTALL_WEB_SERVER=true
+      INSTALL_WEB_INTERFACE=true
+      LIGHTTPD_ENABLED=false
+      CACHE_SIZE=10000
+      DNS_FQDN_REQUIRED=true
+      DNS_BOGUS_PRIV=true
+      DNSSEC=true
+      BLOCKING_ENABLED=true
+      WEBPASSWORD=
+    mode: "0644"
+
+- name: Clone Pi-hole repository
+  git:
+    repo: https://github.com/pi-hole/pi-hole.git
+    dest: /opt/pihole-install
+    version: master
+    depth: 1
+
+- name: Run Pi-hole installer (unattended)
+  command: bash /opt/pihole-install/automated\ install/basic-install.sh --unattended
+  args:
+    creates: /usr/local/bin/pihole
+  environment:
+    PIHOLE_SKIP_OS_CHECK: "true"
+
 - name: Allow DNS through UFW
   ufw:
     rule: allow
@@ -59,4 +75,14 @@
   loop:
     - { port: "53", proto: "tcp" }
     - { port: "53", proto: "udp" }
-    - { port: "80", proto: "tcp" }
+
+- name: Allow Pi-hole admin from private networks only
+  ufw:
+    rule: allow
+    port: "80"
+    proto: tcp
+    from_ip: "{{ item }}"
+  loop:
+    - "10.0.0.0/8"
+    - "172.16.0.0/12"
+    - "192.168.0.0/16"

phantom/playbooks/email/main.yml

@@ -1,11 +1,18 @@
 ---
-# Email deployment — Coming soon
-# This is a stub playbook. Full implementation planned.
+# Mail-in-a-Box deployment — native installer script
+# MIAB manages its own nginx, TLS, DNS, and mail stack
 
-- name: Deploy Email Server
+- name: Deploy Mail-in-a-Box Email Server
   hosts: all
   become: true
+  vars:
+    miab_domain: "{{ domain }}"
+    miab_first_user: "{{ email_first_user }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
   tasks:
-    - name: Placeholder
-      debug:
-        msg: "Email playbook not yet implemented. Check phantom/README.md for status."
+    - name: Include Mail-in-a-Box installation
+      include_tasks: tasks/install.yml
+
+    - name: Include Mail-in-a-Box configuration
+      include_tasks: tasks/configure.yml

phantom/playbooks/email/tasks/configure.yml

@@ -0,0 +1,45 @@
+---
+# Mail-in-a-Box non-interactive installation
+
+- name: Generate admin password
+  command: openssl rand -base64 16
+  register: miab_admin_password
+  args:
+    creates: /root/.miab_admin_password
+
+- name: Save admin password
+  copy:
+    content: "{{ miab_admin_password.stdout }}"
+    dest: /root/.miab_admin_password
+    mode: "0600"
+  when: miab_admin_password.changed
+
+- name: Read saved admin password
+  slurp:
+    src: /root/.miab_admin_password
+  register: miab_password_file
+
+- name: Clone Mail-in-a-Box repository
+  git:
+    repo: https://github.com/mail-in-a-box/mailinabox.git
+    dest: /opt/mailinabox
+    version: main
+    depth: 1
+
+- name: Run Mail-in-a-Box installer (non-interactive)
+  command: bash /opt/mailinabox/setup/start.sh
+  args:
+    creates: /etc/mailinabox.conf
+  environment:
+    NONINTERACTIVE: "1"
+    PRIMARY_HOSTNAME: "{{ miab_domain }}"
+    EMAIL_ADDR: "{{ miab_first_user }}"
+    EMAIL_PW: "{{ (miab_password_file.content | b64decode).strip() }}"
+  timeout: 600
+
+- name: Display admin credentials
+  debug:
+    msg: >
+      Mail-in-a-Box installed. Admin: {{ miab_first_user }}
+      Password saved to /root/.miab_admin_password
+      Web admin: https://{{ miab_domain }}/admin

phantom/playbooks/email/tasks/install.yml

@@ -0,0 +1,56 @@
+---
+# Mail-in-a-Box prerequisites and environment setup
+
+- name: Verify Ubuntu distribution
+  assert:
+    that:
+      - ansible_distribution == "Ubuntu"
+    fail_msg: "Mail-in-a-Box requires Ubuntu. Detected: {{ ansible_distribution }}"
+
+- name: Stop conflicting nginx (MIAB manages its own)
+  service:
+    name: nginx
+    state: stopped
+    enabled: false
+  failed_when: false
+
+- name: Set system hostname for MIAB
+  hostname:
+    name: "{{ miab_domain }}"
+
+- name: Update /etc/hostname
+  copy:
+    content: "{{ miab_domain }}\n"
+    dest: /etc/hostname
+    mode: "0644"
+
+- name: Ensure hostname in /etc/hosts
+  lineinfile:
+    path: /etc/hosts
+    regexp: '^127\.0\.1\.1'
+    line: "127.0.1.1 {{ miab_domain }}"
+
+- name: Allow mail-related ports through UFW
+  ufw:
+    rule: allow
+    port: "{{ item.port }}"
+    proto: "{{ item.proto }}"
+  loop:
+    - { port: "25", proto: "tcp" }
+    - { port: "587", proto: "tcp" }
+    - { port: "993", proto: "tcp" }
+    - { port: "465", proto: "tcp" }
+    - { port: "80", proto: "tcp" }
+    - { port: "443", proto: "tcp" }
+    - { port: "53", proto: "tcp" }
+    - { port: "53", proto: "udp" }
+    - { port: "4190", proto: "tcp" }
+
+- name: Install prerequisites
+  apt:
+    name:
+      - curl
+      - ca-certificates
+      - git
+    state: present
+    update_cache: true

phantom/playbooks/matrix/main.yml

@@ -26,6 +26,18 @@
     - name: Include nginx reverse proxy tasks
       include_tasks: tasks/nginx.yml
 
+    - name: Create Tools directory
+      file:
+        path: /root/Tools
+        state: directory
+        mode: "0755"
+
+    - name: Deploy Matrix user creation script
+      template:
+        src: ../common/templates/add-matrix-user.sh.j2
+        dest: /root/Tools/add-matrix-user.sh
+        mode: "0700"
+
   handlers:
     - name: restart synapse
       service:

phantom/playbooks/matrix/tasks/nginx.yml

@@ -1,6 +1,5 @@
 ---
 # Nginx reverse proxy for Matrix + Element
-# Two-phase: HTTP-only first for certbot, then full SSL config
 
 - name: Create certbot webroot
   file:
@@ -17,15 +16,8 @@
       server {
           listen 80;
           server_name {{ matrix_domain }};
-
-          location /.well-known/acme-challenge/ {
-              root /var/www/certbot;
-          }
-
-          location / {
-              return 200 'phantom setup in progress';
-              add_header Content-Type text/plain;
-          }
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
       }
     mode: "0644"
   notify: reload nginx
@@ -40,35 +32,38 @@
 - name: Flush handlers to apply HTTP config
   meta: flush_handlers
 
-- name: Obtain TLS certificate
-  command: >
-    certbot certonly --webroot -w /var/www/certbot
-    -d {{ matrix_domain }}
-    --non-interactive
-    --agree-tos
-    {% if certbot_email is defined and certbot_email %}
-    --email {{ certbot_email }}
-    {% else %}
-    --register-unsafely-without-email
-    {% endif %}
-  args:
-    creates: "/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem"
+- name: Setup TLS (certbot with self-signed fallback)
+  include_tasks: ../../common/tls_setup.yml
+  vars:
+    _tls_domain: "{{ matrix_domain }}"
 
-- name: Deploy full SSL nginx config
+- name: Disable server tokens in nginx
+  lineinfile:
+    path: /etc/nginx/nginx.conf
+    regexp: "^\\s*#?\\s*server_tokens"
+    line: "\tserver_tokens off;"
+    insertafter: "sendfile on;"
+  notify: reload nginx
+
+- name: Remove default nginx site
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+  notify: reload nginx
+
+- name: Deploy hardened SSL nginx config
   copy:
     dest: /etc/nginx/sites-available/matrix
     content: |
+      # Rate limiting zones
+      limit_req_zone $binary_remote_addr zone=matrix_login:10m rate=3r/m;
+      limit_req_zone $binary_remote_addr zone=matrix_general:10m rate=10r/s;
+
       server {
           listen 80;
           server_name {{ matrix_domain }};
-
-          location /.well-known/acme-challenge/ {
-              root /var/www/certbot;
-          }
-
-          location / {
-              return 301 https://$host$request_uri;
-          }
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 301 https://$host$request_uri; }
       }
 
       server {
@@ -76,24 +71,51 @@
           listen 8448 ssl http2;
           server_name {{ matrix_domain }};
 
-          ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
-          ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
-
+          # TLS
+          ssl_certificate {{ _ssl_cert }};
+          ssl_certificate_key {{ _ssl_key }};
           ssl_protocols TLSv1.2 TLSv1.3;
-          ssl_ciphers HIGH:!aNULL:!MD5;
-          ssl_prefer_server_ciphers on;
+          ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+          ssl_prefer_server_ciphers off;
+          ssl_session_timeout 1d;
+          ssl_session_cache shared:SSL:10m;
+          ssl_session_tickets off;
+
+          # Security headers
+          add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+          add_header X-Frame-Options "SAMEORIGIN" always;
+          add_header X-Content-Type-Options "nosniff" always;
+          add_header X-XSS-Protection "1; mode=block" always;
+          add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+          add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
 
           client_max_body_size 50m;
 
-          # Synapse
-          location ~* ^(\/_matrix|\/_synapse\/client) {
+          # Block Synapse admin API from external access
+          location /_synapse/admin {
+              return 403;
+          }
+
+          # Login endpoint — strict rate limit
+          location /_matrix/client/v3/login {
+              limit_req zone=matrix_login burst=3 nodelay;
               proxy_pass http://127.0.0.1:8008;
               proxy_set_header X-Forwarded-For $remote_addr;
               proxy_set_header X-Forwarded-Proto $scheme;
               proxy_set_header Host $host;
           }
 
-          # .well-known delegation
+          # Matrix client + federation API
+          location ~* ^(\/_matrix|\/_synapse\/client) {
+              limit_req zone=matrix_general burst=20 nodelay;
+              proxy_pass http://127.0.0.1:8008;
+              proxy_set_header X-Forwarded-For $remote_addr;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_set_header Host $host;
+              proxy_read_timeout 600s;
+              proxy_send_timeout 600s;
+          }
+
           location /.well-known/matrix/server {
               return 200 '{"m.server": "{{ matrix_domain }}:443"}';
               add_header Content-Type application/json;
@@ -105,10 +127,11 @@
               add_header Access-Control-Allow-Origin *;
           }
 
-          # Element Web (if enabled)
+          # Element Web
           location / {
               root /var/www/element;
               try_files $uri $uri/ /index.html;
+              add_header Content-Security-Policy "frame-ancestors 'self'" always;
           }
       }
     mode: "0644"

phantom/playbooks/matrix/tasks/synapse.yml

@@ -1,5 +1,6 @@
 ---
 # Synapse homeserver installation and configuration
+# Uses SQLite3 (matches c2itall chat-server pattern — no PostgreSQL needed)
 
 - name: Install dependencies
   apt:
@@ -7,24 +8,25 @@
       - python3
       - python3-pip
       - python3-venv
-      - libpq-dev
-      - postgresql
-      - postgresql-contrib
       - nginx
       - certbot
       - python3-certbot-nginx
+      - curl
+      - wget
+      - gnupg
+      - lsb-release
     state: present
 
-- name: Add Matrix Synapse apt repository key
-  apt_key:
-    url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
-    state: present
+- name: Add Matrix Synapse GPG key and repository
+  shell: |
+    wget -qO /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+    echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/matrix-org.list
+  args:
+    creates: /etc/apt/sources.list.d/matrix-org.list
 
-- name: Add Matrix Synapse apt repository
-  apt_repository:
-    repo: "deb https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main"
-    state: present
-    filename: matrix-org
+- name: Update apt cache after adding Matrix repo
+  apt:
+    update_cache: true
 
 - name: Install Synapse
   apt:
@@ -33,22 +35,17 @@
   environment:
     DEBIAN_FRONTEND: noninteractive
 
-- name: Create PostgreSQL database
-  become_user: postgres
-  postgresql_db:
-    name: synapse
-    encoding: UTF-8
-    lc_collate: C
-    lc_ctype: C
-    template: template0
-
-- name: Create PostgreSQL user
-  become_user: postgres
-  postgresql_user:
-    name: synapse
-    password: "{{ matrix_signing_key[:32] }}"
-    db: synapse
-    priv: ALL
+- name: Set correct ownership for Matrix directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: matrix-synapse
+    group: matrix-synapse
+    mode: "0750"
+    recurse: true
+  loop:
+    - /var/lib/matrix-synapse
+    - /var/log/matrix-synapse
 
 - name: Deploy Synapse homeserver config
   template:
@@ -59,6 +56,11 @@
     mode: "0640"
   notify: restart synapse
 
+- name: Clear conflicting conf.d configurations
+  shell: |
+    rm -f /etc/matrix-synapse/conf.d/*.yaml 2>/dev/null || true
+  changed_when: false
+
 - name: Allow Matrix federation port through UFW
   ufw:
     rule: allow
@@ -77,23 +79,25 @@
 - name: Enable and start Synapse
   service:
     name: matrix-synapse
-    state: started
+    state: restarted
     enabled: true
 
 - name: Wait for Synapse to be ready
   wait_for:
     port: 8008
     host: 127.0.0.1
-    timeout: 30
+    delay: 5
+    timeout: 60
 
 - name: Create admin user
-  command: >
-    register_new_matrix_user
-    -u {{ matrix_admin }}
-    -p {{ matrix_admin_pass }}
-    -a
-    -c /etc/matrix-synapse/homeserver.yaml
-    http://localhost:8008
+  shell: |
+    /opt/venvs/matrix-synapse/bin/register_new_matrix_user \
+      -c /etc/matrix-synapse/homeserver.yaml \
+      -u {{ matrix_admin }} \
+      -p {{ matrix_admin_pass }} \
+      -a
   register: admin_create
-  failed_when: false
-  changed_when: admin_create.rc == 0
+  failed_when:
+    - admin_create.rc != 0
+    - "'User ID already taken' not in admin_create.stderr"
+  changed_when: "'User ID already taken' not in admin_create.stderr"

phantom/playbooks/matrix/templates/homeserver.yaml.j2

@@ -2,43 +2,83 @@
 ## Generated by phantom
 
 server_name: "{{ matrix_server_name }}"
-pid_file: /run/matrix-synapse.pid
+public_baseurl: "https://{{ matrix_domain }}/"
+pid_file: /var/run/matrix-synapse.pid
 
 listeners:
   - port: 8008
     tls: false
     type: http
     x_forwarded: true
+    bind_addresses:
+      - '127.0.0.1'
     resources:
       - names: [client, federation]
         compress: false
 
 database:
-  name: psycopg2
+  name: sqlite3
   args:
-    user: synapse
-    password: "{{ matrix_signing_key[:32] }}"
-    database: synapse
-    host: localhost
-    cp_min: 5
-    cp_max: 10
+    database: /var/lib/matrix-synapse/homeserver.db
 
 log_config: "/etc/matrix-synapse/log.yaml"
 media_store_path: /var/lib/matrix-synapse/media
-signing_key_path: "/etc/matrix-synapse/{{ matrix_server_name }}.signing.key"
+signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
 
+registration_shared_secret: "{{ matrix_signing_key }}"
 enable_registration: {{ matrix_registration_enabled | lower }}
 {% if not matrix_registration_enabled %}
 enable_registration_without_verification: false
 {% endif %}
+allow_guest_access: false
 
-suppress_key_server_warning: true
+form_secret: "{{ matrix_form_secret | default(matrix_signing_key[:28]) }}"
+macaroon_secret_key: "{{ matrix_macaroon_secret | default(matrix_signing_key[:30]) }}"
 
 trusted_key_servers:
   - server_name: "matrix.org"
 
-max_upload_size: 50M
+# Rate limiting
+rc_message:
+  per_second: 0.2
+  burst_count: 10
+rc_login:
+  address:
+    per_second: 0.17
+    burst_count: 3
+  account:
+    per_second: 0.17
+    burst_count: 3
+rc_registration:
+  per_second: 0.17
+  burst_count: 3
+rc_admin_redaction:
+  per_second: 1
+  burst_count: 50
 
+# Privacy / access control
+require_auth_for_profile_requests: true
+limit_profile_requests_to_users_who_share_rooms: true
+allow_public_rooms_without_auth: false
+allow_public_rooms_over_federation: false
+
+# Media
+enable_media_repo: true
+max_upload_size: 50M
+max_image_pixels: 32M
+
+# Telemetry
+enable_metrics: false
+report_stats: false
+
+# Session / auth hardening
+session_lifetime: 24h
+bcrypt_rounds: 12
+
+# Federation TLS
+federation_client_minimum_tls_version: 1.2
+
+# URL preview with SSRF protection
 url_preview_enabled: true
 url_preview_ip_range_blacklist:
   - '127.0.0.0/8'
@@ -46,8 +86,9 @@ url_preview_ip_range_blacklist:
   - '172.16.0.0/12'
   - '192.168.0.0/16'
   - '100.64.0.0/10'
-  - '192.0.0.0/24'
   - '169.254.0.0/16'
   - '::1/128'
   - 'fe80::/10'
   - 'fc00::/7'
+
+suppress_key_server_warning: true

phantom/playbooks/media/main.yml

@@ -1,11 +1,31 @@
 ---
-# Media deployment — Coming soon
-# This is a stub playbook. Full implementation planned.
+# Jellyfin media server deployment (native package from official repo)
 
-- name: Deploy Media Server
+- name: Deploy Jellyfin Media Server
   hosts: all
   become: true
+  vars:
+    jellyfin_domain: "{{ domain }}"
+    jellyfin_library: "{{ media_library_path | default('/srv/media') }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
   tasks:
-    - name: Placeholder
-      debug:
-        msg: "Media playbook not yet implemented. Check phantom/README.md for status."
+    - name: Include Jellyfin installation
+      include_tasks: tasks/install.yml
+
+    - name: Include Jellyfin configuration
+      include_tasks: tasks/configure.yml
+
+    - name: Include Jellyfin nginx reverse proxy
+      include_tasks: tasks/nginx.yml
+
+  handlers:
+    - name: reload nginx
+      service:
+        name: nginx
+        state: reloaded
+
+    - name: restart jellyfin
+      service:
+        name: jellyfin
+        state: restarted

phantom/playbooks/media/tasks/configure.yml

@@ -0,0 +1,33 @@
+---
+# Jellyfin service configuration
+
+- name: Create media library directory
+  file:
+    path: "{{ jellyfin_library }}"
+    state: directory
+    owner: jellyfin
+    group: jellyfin
+    mode: "0755"
+
+- name: Ensure Jellyfin binds to localhost only
+  lineinfile:
+    path: /etc/jellyfin/network.xml
+    regexp: '<LocalNetworkAddresses>'
+    line: '    <LocalNetworkAddresses><string>127.0.0.1</string></LocalNetworkAddresses>'
+    create: true
+    mode: "0644"
+  notify: restart jellyfin
+  failed_when: false
+
+- name: Enable and start Jellyfin service
+  service:
+    name: jellyfin
+    state: started
+    enabled: true
+
+- name: Wait for Jellyfin to be ready
+  wait_for:
+    port: 8096
+    host: 127.0.0.1
+    delay: 5
+    timeout: 60

phantom/playbooks/media/tasks/install.yml

@@ -0,0 +1,41 @@
+---
+# Jellyfin installation from official apt repository
+
+- name: Install prerequisites
+  apt:
+    name:
+      - curl
+      - gnupg
+      - ca-certificates
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+    state: present
+    update_cache: true
+
+- name: Add Jellyfin GPG signing key
+  ansible.builtin.get_url:
+    url: https://repo.jellyfin.org/jellyfin_team.gpg.key
+    dest: /usr/share/keyrings/jellyfin-archive-keyring.asc
+    mode: "0644"
+
+- name: Add Jellyfin apt repository
+  apt_repository:
+    repo: "deb [signed-by=/usr/share/keyrings/jellyfin-archive-keyring.asc] https://repo.jellyfin.org/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} main"
+    state: present
+    filename: jellyfin
+
+- name: Install Jellyfin
+  apt:
+    name: jellyfin
+    state: present
+    update_cache: true
+
+- name: Allow HTTP/HTTPS through UFW
+  ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - "80"
+    - "443"

phantom/playbooks/media/tasks/nginx.yml

@@ -0,0 +1,91 @@
+---
+# Nginx reverse proxy for Jellyfin
+
+- name: Create certbot webroot
+  file:
+    path: /var/www/certbot
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: "0755"
+
+- name: Deploy HTTP-only nginx config (for certbot)
+  copy:
+    dest: /etc/nginx/sites-available/jellyfin
+    content: |
+      server {
+          listen 80;
+          server_name {{ jellyfin_domain }};
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
+      }
+    mode: "0644"
+  notify: reload nginx
+
+- name: Enable Jellyfin nginx site
+  file:
+    src: /etc/nginx/sites-available/jellyfin
+    dest: /etc/nginx/sites-enabled/jellyfin
+    state: link
+  notify: reload nginx
+
+- name: Flush handlers to apply HTTP config
+  meta: flush_handlers
+
+- name: Setup TLS (certbot with self-signed fallback)
+  include_tasks: ../../common/tls_setup.yml
+  vars:
+    _tls_domain: "{{ jellyfin_domain }}"
+
+- name: Deploy SSL nginx config
+  copy:
+    dest: /etc/nginx/sites-available/jellyfin
+    content: |
+      server {
+          listen 80;
+          server_name {{ jellyfin_domain }};
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 301 https://$host$request_uri; }
+      }
+
+      server {
+          listen 443 ssl http2;
+          server_name {{ jellyfin_domain }};
+
+          ssl_certificate {{ _ssl_cert }};
+          ssl_certificate_key {{ _ssl_key }};
+          ssl_protocols TLSv1.2 TLSv1.3;
+          ssl_ciphers HIGH:!aNULL:!MD5;
+          ssl_prefer_server_ciphers on;
+
+          server_tokens off;
+          add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+          add_header X-Content-Type-Options nosniff always;
+          add_header X-Frame-Options SAMEORIGIN always;
+
+          client_max_body_size 100m;
+
+          location / {
+              proxy_pass http://127.0.0.1:8096;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+          }
+
+          location /socket {
+              proxy_pass http://127.0.0.1:8096;
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+          }
+      }
+    mode: "0644"
+  notify: reload nginx

phantom/playbooks/vault/main.yml

@@ -1,11 +1,32 @@
 ---
-# Vault deployment — Coming soon
-# This is a stub playbook. Full implementation planned.
+# Vaultwarden (Bitwarden-compatible) deployment — pre-built binary + systemd
 
-- name: Deploy Vault Server
+- name: Deploy Vaultwarden Password Manager
   hosts: all
   become: true
+  vars:
+    vaultwarden_domain: "{{ domain }}"
+    vaultwarden_admin_token: "{{ vault_admin_token }}"
+    vaultwarden_signups: "{{ vault_signups_allowed | default(false) }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
   tasks:
-    - name: Placeholder
-      debug:
-        msg: "Vault playbook not yet implemented. Check phantom/README.md for status."
+    - name: Include Vaultwarden installation
+      include_tasks: tasks/install.yml
+
+    - name: Include Vaultwarden configuration
+      include_tasks: tasks/configure.yml
+
+    - name: Include Vaultwarden nginx reverse proxy
+      include_tasks: tasks/nginx.yml
+
+  handlers:
+    - name: reload nginx
+      service:
+        name: nginx
+        state: reloaded
+
+    - name: restart vaultwarden
+      service:
+        name: vaultwarden
+        state: restarted

phantom/playbooks/vault/tasks/configure.yml

@@ -0,0 +1,73 @@
+---
+# Vaultwarden service configuration
+
+- name: Deploy Vaultwarden environment file
+  copy:
+    dest: /opt/vaultwarden/.env
+    content: |
+      DOMAIN=https://{{ vaultwarden_domain }}
+      SIGNUPS_ALLOWED={{ vaultwarden_signups | lower }}
+      ADMIN_TOKEN={{ vaultwarden_admin_token }}
+      ROCKET_ADDRESS=127.0.0.1
+      ROCKET_PORT=8081
+      DATA_FOLDER=/opt/vaultwarden/data
+      WEB_VAULT_FOLDER=/opt/vaultwarden/web-vault
+      LOG_FILE=/opt/vaultwarden/data/vaultwarden.log
+      LOG_LEVEL=warn
+      SENDS_ALLOWED=true
+      EMERGENCY_ACCESS_ALLOWED=true
+      WEBSOCKET_ENABLED=true
+      WEBSOCKET_ADDRESS=127.0.0.1
+      WEBSOCKET_PORT=3012
+    owner: vaultwarden
+    group: vaultwarden
+    mode: "0600"
+  notify: restart vaultwarden
+
+- name: Deploy Vaultwarden systemd unit
+  copy:
+    dest: /etc/systemd/system/vaultwarden.service
+    content: |
+      [Unit]
+      Description=Vaultwarden (Bitwarden-compatible server)
+      Documentation=https://github.com/dani-garcia/vaultwarden
+      After=network.target
+
+      [Service]
+      User=vaultwarden
+      Group=vaultwarden
+      EnvironmentFile=/opt/vaultwarden/.env
+      ExecStart=/opt/vaultwarden/vaultwarden
+      WorkingDirectory=/opt/vaultwarden
+
+      # Hardening
+      ProtectSystem=strict
+      ProtectHome=true
+      PrivateTmp=true
+      PrivateDevices=true
+      NoNewPrivileges=true
+      ReadWritePaths=/opt/vaultwarden/data
+
+      Restart=on-failure
+      RestartSec=5
+
+      [Install]
+      WantedBy=multi-user.target
+    mode: "0644"
+
+- name: Reload systemd daemon
+  systemd:
+    daemon_reload: true
+
+- name: Enable and start Vaultwarden
+  service:
+    name: vaultwarden
+    state: started
+    enabled: true
+
+- name: Wait for Vaultwarden to be ready
+  wait_for:
+    port: 8081
+    host: 127.0.0.1
+    delay: 3
+    timeout: 30

phantom/playbooks/vault/tasks/install.yml

@@ -0,0 +1,101 @@
+---
+# Vaultwarden binary installation from GitHub releases
+
+- name: Install prerequisites
+  apt:
+    name:
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - libssl-dev
+      - pkg-config
+      - curl
+      - ca-certificates
+    state: present
+    update_cache: true
+
+- name: Create vaultwarden system user
+  user:
+    name: vaultwarden
+    system: true
+    shell: /usr/sbin/nologin
+    home: /opt/vaultwarden
+    create_home: false
+
+- name: Create Vaultwarden directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: vaultwarden
+    group: vaultwarden
+    mode: "0750"
+  loop:
+    - /opt/vaultwarden
+    - /opt/vaultwarden/data
+
+- name: Detect system architecture
+  command: uname -m
+  register: system_arch
+  changed_when: false
+
+- name: Set architecture for download
+  set_fact:
+    vw_arch: "{{ 'aarch64' if system_arch.stdout == 'aarch64' else 'x86_64' }}"
+
+- name: Get latest Vaultwarden release tag
+  uri:
+    url: https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest
+    return_content: true
+    headers:
+      Accept: application/vnd.github+json
+  register: vw_release
+
+- name: Set Vaultwarden version
+  set_fact:
+    vw_version: "{{ vw_release.json.tag_name }}"
+
+- name: Download Vaultwarden binary
+  get_url:
+    url: "https://github.com/dani-garcia/vaultwarden/releases/download/{{ vw_version }}/vaultwarden-{{ vw_version }}-linux-{{ vw_arch }}.tar.gz"
+    dest: "/tmp/vaultwarden-{{ vw_version }}.tar.gz"
+    mode: "0644"
+
+- name: Extract Vaultwarden binary
+  unarchive:
+    src: "/tmp/vaultwarden-{{ vw_version }}.tar.gz"
+    dest: /opt/vaultwarden/
+    remote_src: true
+    owner: vaultwarden
+    group: vaultwarden
+
+- name: Ensure binary is executable
+  file:
+    path: /opt/vaultwarden/vaultwarden
+    mode: "0755"
+    owner: vaultwarden
+    group: vaultwarden
+
+- name: Download Vaultwarden web vault
+  get_url:
+    url: "https://github.com/dani-garcia/bw_web_builds/releases/latest/download/bw_web_v2024.6.2c.tar.gz"
+    dest: /tmp/bw_web_vault.tar.gz
+    mode: "0644"
+  failed_when: false
+
+- name: Extract web vault
+  unarchive:
+    src: /tmp/bw_web_vault.tar.gz
+    dest: /opt/vaultwarden/
+    remote_src: true
+    owner: vaultwarden
+    group: vaultwarden
+  failed_when: false
+
+- name: Allow HTTP/HTTPS through UFW
+  ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - "80"
+    - "443"

phantom/playbooks/vault/tasks/nginx.yml

@@ -0,0 +1,96 @@
+---
+# Nginx reverse proxy for Vaultwarden
+
+- name: Create certbot webroot
+  file:
+    path: /var/www/certbot
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: "0755"
+
+- name: Deploy HTTP-only nginx config (for certbot)
+  copy:
+    dest: /etc/nginx/sites-available/vaultwarden
+    content: |
+      server {
+          listen 80;
+          server_name {{ vaultwarden_domain }};
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
+      }
+    mode: "0644"
+  notify: reload nginx
+
+- name: Enable Vaultwarden nginx site
+  file:
+    src: /etc/nginx/sites-available/vaultwarden
+    dest: /etc/nginx/sites-enabled/vaultwarden
+    state: link
+  notify: reload nginx
+
+- name: Flush handlers to apply HTTP config
+  meta: flush_handlers
+
+- name: Setup TLS (certbot with self-signed fallback)
+  include_tasks: ../../common/tls_setup.yml
+  vars:
+    _tls_domain: "{{ vaultwarden_domain }}"
+
+- name: Deploy SSL nginx config
+  copy:
+    dest: /etc/nginx/sites-available/vaultwarden
+    content: |
+      server {
+          listen 80;
+          server_name {{ vaultwarden_domain }};
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 301 https://$host$request_uri; }
+      }
+
+      server {
+          listen 443 ssl http2;
+          server_name {{ vaultwarden_domain }};
+
+          ssl_certificate {{ _ssl_cert }};
+          ssl_certificate_key {{ _ssl_key }};
+          ssl_protocols TLSv1.2 TLSv1.3;
+          ssl_ciphers HIGH:!aNULL:!MD5;
+          ssl_prefer_server_ciphers on;
+
+          server_tokens off;
+          add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+          add_header X-Content-Type-Options nosniff always;
+          add_header X-Frame-Options DENY always;
+
+          client_max_body_size 525m;
+
+          location / {
+              proxy_pass http://127.0.0.1:8081;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+          }
+
+          location /notifications/hub {
+              proxy_pass http://127.0.0.1:3012;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+          }
+
+          location /notifications/hub/negotiate {
+              proxy_pass http://127.0.0.1:8081;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Proto $scheme;
+          }
+      }
+    mode: "0644"
+  notify: reload nginx