Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection) - SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts - Ansible output streaming with filtered console + full log capture - Deployment management menu: discover, SSH, teardown existing deployments - Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs - Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers - Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails - Add-matrix-user helper script deployed to all Matrix servers - .env support for standalone credential storage - Config key rename: deploy_id → deployment_id (with backward compat) - Provider cleanup playbooks for teardown - Test suite with 50 tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 15:45:24 -04:00
parent 973cede31f
commit 7484a0e034
44 changed files with 3167 additions and 381 deletions
@@ -1,11 +1,42 @@
 ---
-# Cloud deployment — Coming soon
-# This is a stub playbook. Full implementation planned.
+# Nextcloud deployment — PHP-FPM + MariaDB + Redis + nginx

- name: Deploy Cloud Server
+- name: Deploy Nextcloud Server
  hosts: all
  become: true
+  vars:
+    nextcloud_domain: "{{ domain }}"
+    nextcloud_admin: "{{ cloud_admin_user | default('admin') }}"
+    nextcloud_storage_gb: "{{ cloud_storage_gb | default('10') }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
  tasks:
-    - name: Placeholder
-      debug:
-        msg: "Cloud playbook not yet implemented. Check phantom/README.md for status."
+    - name: Include Nextcloud installation
+      include_tasks: tasks/install.yml
+
+    - name: Include Nextcloud configuration
+      include_tasks: tasks/configure.yml
+
+    - name: Include Nextcloud nginx reverse proxy
+      include_tasks: tasks/nginx.yml
+
+  handlers:
+    - name: reload nginx
+      service:
+        name: nginx
+        state: reloaded
+
+    - name: restart php-fpm
+      service:
+        name: php8.2-fpm
+        state: restarted
+
+    - name: restart mariadb
+      service:
+        name: mariadb
+        state: restarted
+
+    - name: restart redis
+      service:
+        name: redis-server
+        state: restarted
@@ -0,0 +1,180 @@
+---
+# Nextcloud database, app, and service configuration
+
+- name: Generate MariaDB password for Nextcloud
+  command: openssl rand -base64 24
+  register: nc_db_password_gen
+  args:
+    creates: /var/www/nextcloud/.db_password
+
+- name: Save DB password
+  copy:
+    content: "{{ nc_db_password_gen.stdout }}"
+    dest: /var/www/nextcloud/.db_password
+    owner: www-data
+    group: www-data
+    mode: "0600"
+  when: nc_db_password_gen.changed
+
+- name: Read saved DB password
+  slurp:
+    src: /var/www/nextcloud/.db_password
+  register: nc_db_password_file
+
+- name: Set DB password fact
+  set_fact:
+    nc_db_pass: "{{ (nc_db_password_file.content | b64decode).strip() }}"
+
+- name: Create Nextcloud MariaDB database
+  mysql_db:
+    name: nextcloud
+    state: present
+    encoding: utf8mb4
+    collation: utf8mb4_general_ci
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+
+- name: Create Nextcloud MariaDB user
+  mysql_user:
+    name: nextcloud
+    password: "{{ nc_db_pass }}"
+    priv: "nextcloud.*:ALL"
+    host: localhost
+    state: present
+    login_unix_socket: /var/run/mysqld/mysqld.sock
+
+- name: Generate admin password
+  command: openssl rand -base64 16
+  register: nc_admin_password_gen
+  args:
+    creates: /var/www/nextcloud/.admin_password
+
+- name: Save admin password
+  copy:
+    content: "{{ nc_admin_password_gen.stdout }}"
+    dest: /var/www/nextcloud/.admin_password
+    owner: www-data
+    group: www-data
+    mode: "0600"
+  when: nc_admin_password_gen.changed
+
+- name: Read saved admin password
+  slurp:
+    src: /var/www/nextcloud/.admin_password
+  register: nc_admin_password_file
+
+- name: Configure PHP-FPM pool for Nextcloud
+  copy:
+    dest: /etc/php/8.2/fpm/pool.d/nextcloud.conf
+    content: |
+      [nextcloud]
+      user = www-data
+      group = www-data
+      listen = /run/php/php8.2-fpm-nextcloud.sock
+      listen.owner = www-data
+      listen.group = www-data
+      pm = dynamic
+      pm.max_children = 16
+      pm.start_servers = 4
+      pm.min_spare_servers = 2
+      pm.max_spare_servers = 8
+      pm.max_requests = 500
+      env[HOSTNAME] = $HOSTNAME
+      env[TMP] = /tmp
+      env[TMPDIR] = /tmp
+      env[TEMP] = /tmp
+      php_value[upload_max_filesize] = 10G
+      php_value[post_max_size] = 10G
+      php_value[memory_limit] = 512M
+      php_value[max_execution_time] = 3600
+      php_value[max_input_time] = 3600
+      php_value[opcache.enable] = 1
+      php_value[opcache.memory_consumption] = 128
+      php_value[opcache.interned_strings_buffer] = 16
+      php_value[opcache.max_accelerated_files] = 10000
+      php_value[opcache.revalidate_freq] = 1
+    mode: "0644"
+  notify: restart php-fpm
+
+- name: Flush handlers to restart PHP-FPM
+  meta: flush_handlers
+
+- name: Install Nextcloud via occ
+  become_user: www-data
+  command: >
+    php /var/www/nextcloud/occ maintenance:install
+    --database mysql
+    --database-name nextcloud
+    --database-user nextcloud
+    --database-pass "{{ nc_db_pass }}"
+    --admin-user "{{ nextcloud_admin }}"
+    --admin-pass "{{ (nc_admin_password_file.content | b64decode).strip() }}"
+    --data-dir /var/www/nextcloud/data
+  args:
+    creates: /var/www/nextcloud/config/config.php
+
+- name: Set trusted domain
+  become_user: www-data
+  command: "php /var/www/nextcloud/occ config:system:set trusted_domains 0 --value={{ nextcloud_domain }}"
+  changed_when: true
+
+- name: Set overwrite.cli.url
+  become_user: www-data
+  command: "php /var/www/nextcloud/occ config:system:set overwrite.cli.url --value=https://{{ nextcloud_domain }}"
+  changed_when: true
+
+- name: Configure Redis caching
+  become_user: www-data
+  command: "php /var/www/nextcloud/occ config:system:set {{ item.key }} --value={{ item.value }} {{ item.type | default('') }}"
+  loop:
+    - { key: "memcache.local", value: "\\OC\\Memcache\\APCu" }
+    - { key: "memcache.distributed", value: "\\OC\\Memcache\\Redis" }
+    - { key: "memcache.locking", value: "\\OC\\Memcache\\Redis" }
+    - { key: "redis host", value: "localhost" }
+    - { key: "redis port", value: "6379", type: "--type=integer" }
+  changed_when: true
+
+- name: Set default phone region
+  become_user: www-data
+  command: "php /var/www/nextcloud/occ config:system:set default_phone_region --value=US"
+  changed_when: true
+
+- name: Deploy Nextcloud cron systemd timer
+  copy:
+    dest: /etc/systemd/system/nextcloud-cron.service
+    content: |
+      [Unit]
+      Description=Nextcloud cron.php
+      After=network.target
+
+      [Service]
+      User=www-data
+      ExecStart=/usr/bin/php /var/www/nextcloud/cron.php
+      Type=oneshot
+    mode: "0644"
+
+- name: Deploy Nextcloud cron timer
+  copy:
+    dest: /etc/systemd/system/nextcloud-cron.timer
+    content: |
+      [Unit]
+      Description=Run Nextcloud cron.php every 5 minutes
+
+      [Timer]
+      OnBootSec=5min
+      OnUnitActiveSec=5min
+      Unit=nextcloud-cron.service
+
+      [Install]
+      WantedBy=timers.target
+    mode: "0644"
+
+- name: Enable Nextcloud cron timer
+  systemd:
+    name: nextcloud-cron.timer
+    state: started
+    enabled: true
+    daemon_reload: true
+
+- name: Display admin credentials
+  debug:
+    msg: "Nextcloud admin credentials saved to /var/www/nextcloud/.admin_password — access at https://{{ nextcloud_domain }}"
@@ -0,0 +1,96 @@
+---
+# Nextcloud package and dependency installation
+
+- name: Install Nextcloud dependencies
+  apt:
+    name:
+      - php8.2-fpm
+      - php8.2-xml
+      - php8.2-mbstring
+      - php8.2-gd
+      - php8.2-curl
+      - php8.2-zip
+      - php8.2-intl
+      - php8.2-mysql
+      - php8.2-redis
+      - php8.2-apcu
+      - php8.2-imagick
+      - php8.2-bcmath
+      - php8.2-gmp
+      - mariadb-server
+      - redis-server
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - unzip
+      - curl
+      - ca-certificates
+    state: present
+    update_cache: true
+
+- name: Enable and start MariaDB
+  service:
+    name: mariadb
+    state: started
+    enabled: true
+
+- name: Enable and start Redis
+  service:
+    name: redis-server
+    state: started
+    enabled: true
+
+- name: Enable and start PHP-FPM
+  service:
+    name: php8.2-fpm
+    state: started
+    enabled: true
+
+- name: Get latest Nextcloud version
+  uri:
+    url: https://download.nextcloud.com/server/releases/latest.tar.bz2.sha256
+    return_content: true
+  register: nc_checksum_response
+
+- name: Parse Nextcloud checksum
+  set_fact:
+    nc_checksum: "{{ nc_checksum_response.content.split()[0] }}"
+
+- name: Download Nextcloud tarball
+  get_url:
+    url: https://download.nextcloud.com/server/releases/latest.tar.bz2
+    dest: /tmp/nextcloud.tar.bz2
+    checksum: "sha256:{{ nc_checksum }}"
+    mode: "0644"
+
+- name: Extract Nextcloud
+  unarchive:
+    src: /tmp/nextcloud.tar.bz2
+    dest: /var/www/
+    remote_src: true
+    creates: /var/www/nextcloud/index.php
+
+- name: Set Nextcloud ownership
+  file:
+    path: /var/www/nextcloud
+    state: directory
+    owner: www-data
+    group: www-data
+    recurse: true
+
+- name: Create Nextcloud data directory
+  file:
+    path: /var/www/nextcloud/data
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: "0770"
+
+- name: Allow HTTP/HTTPS through UFW
+  ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - "80"
+    - "443"
@@ -0,0 +1,109 @@
+---
+# Nginx reverse proxy for Nextcloud
+
+- name: Create certbot webroot
+  file:
+    path: /var/www/certbot
+    state: directory
+    owner: www-data
+    group: www-data
+    mode: "0755"
+
+- name: Deploy HTTP-only nginx config (for certbot)
+  copy:
+    dest: /etc/nginx/sites-available/nextcloud
+    content: |
+      server {
+          listen 80;
+          server_name {{ nextcloud_domain }};
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
+      }
+    mode: "0644"
+  notify: reload nginx
+
+- name: Enable Nextcloud nginx site
+  file:
+    src: /etc/nginx/sites-available/nextcloud
+    dest: /etc/nginx/sites-enabled/nextcloud
+    state: link
+  notify: reload nginx
+
+- name: Flush handlers to apply HTTP config
+  meta: flush_handlers
+
+- name: Setup TLS (certbot with self-signed fallback)
+  include_tasks: ../../common/tls_setup.yml
+  vars:
+    _tls_domain: "{{ nextcloud_domain }}"
+
+- name: Deploy SSL nginx config
+  copy:
+    dest: /etc/nginx/sites-available/nextcloud
+    content: |
+      upstream php-handler {
+          server unix:/run/php/php8.2-fpm-nextcloud.sock;
+      }
+
+      server {
+          listen 80;
+          server_name {{ nextcloud_domain }};
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 301 https://$host$request_uri; }
+      }
+
+      server {
+          listen 443 ssl http2;
+          server_name {{ nextcloud_domain }};
+
+          ssl_certificate {{ _ssl_cert }};
+          ssl_certificate_key {{ _ssl_key }};
+          ssl_protocols TLSv1.2 TLSv1.3;
+          ssl_ciphers HIGH:!aNULL:!MD5;
+          ssl_prefer_server_ciphers on;
+
+          server_tokens off;
+          add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
+          add_header X-Content-Type-Options nosniff always;
+          add_header X-Frame-Options SAMEORIGIN always;
+          add_header X-Robots-Tag "noindex, nofollow" always;
+          add_header Referrer-Policy no-referrer always;
+
+          client_max_body_size 10G;
+          client_body_timeout 3600s;
+          fastcgi_buffers 64 4K;
+
+          root /var/www/nextcloud;
+
+          location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; }
+          location = /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; }
+          location = /.well-known/webfinger { return 301 $scheme://$host/index.php/.well-known/webfinger; }
+          location = /.well-known/nodeinfo { return 301 $scheme://$host/index.php/.well-known/nodeinfo; }
+
+          location / { rewrite ^ /index.php; }
+
+          location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ { deny all; }
+          location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) { deny all; }
+
+          location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+)\.php(?:$|\/) {
+              fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
+              set $path_info $fastcgi_path_info;
+              try_files $fastcgi_script_name =404;
+              include fastcgi_params;
+              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+              fastcgi_param PATH_INFO $path_info;
+              fastcgi_param HTTPS on;
+              fastcgi_param modHeadersAvailable true;
+              fastcgi_param front_controller_active true;
+              fastcgi_pass php-handler;
+              fastcgi_intercept_errors on;
+              fastcgi_request_buffering off;
+              fastcgi_read_timeout 3600;
+          }
+
+          location ~ ^\/(?:updater|ocs-provider)(?:$|\/) { try_files $uri/ =404; index index.php; }
+          location ~ \.(?:css|js|woff2?|svg|gif|map)$ { try_files $uri /index.php$request_uri; add_header Cache-Control "public, max-age=15778463"; access_log off; }
+          location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ { try_files $uri /index.php$request_uri; access_log off; }
+      }
+    mode: "0644"
+  notify: reload nginx