Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/common/tls_setup.yml

@@ -0,0 +1,59 @@
+---
+# Shared TLS setup: tries certbot, falls back to self-signed
+# Include with: include_tasks: ../common/tls_setup.yml
+# Required vars: _tls_domain (the domain to get a cert for)
+
+- name: Attempt TLS certificate from Let's Encrypt
+  command: >
+    certbot certonly --webroot -w /var/www/certbot
+    -d {{ _tls_domain }}
+    --non-interactive
+    --agree-tos
+    {% if certbot_email is defined and certbot_email %}
+    --email {{ certbot_email }}
+    {% else %}
+    --register-unsafely-without-email
+    {% endif %}
+  args:
+    creates: "/etc/letsencrypt/live/{{ _tls_domain }}/fullchain.pem"
+  register: _certbot_result
+  ignore_errors: true
+
+- name: Generate self-signed certificate (fallback)
+  command: >
+    openssl req -x509 -nodes -days 365 -newkey rsa:4096
+    -keyout /etc/ssl/private/{{ _tls_domain }}-selfsigned.key
+    -out /etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt
+    -subj "/CN={{ _tls_domain }}"
+  args:
+    creates: "/etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt"
+  when: _certbot_result is failed
+
+- name: Set cert paths (certbot)
+  set_fact:
+    _ssl_cert: "/etc/letsencrypt/live/{{ _tls_domain }}/fullchain.pem"
+    _ssl_key: "/etc/letsencrypt/live/{{ _tls_domain }}/privkey.pem"
+  when: _certbot_result is not failed
+
+- name: Set cert paths (self-signed)
+  set_fact:
+    _ssl_cert: "/etc/ssl/certs/{{ _tls_domain }}-selfsigned.crt"
+    _ssl_key: "/etc/ssl/private/{{ _tls_domain }}-selfsigned.key"
+  when: _certbot_result is failed
+
+- name: Warn about self-signed certificate
+  debug:
+    msg: "Using self-signed TLS cert. Point DNS to this server and run: certbot certonly --webroot -w /var/www/certbot -d {{ _tls_domain }}"
+  when: _certbot_result is failed
+
+- name: Create Tools directory
+  file:
+    path: /root/Tools
+    state: directory
+    mode: "0755"
+
+- name: Deploy cert setup script
+  template:
+    src: ../common/templates/setup-cert.sh.j2
+    dest: /root/Tools/setup-cert.sh
+    mode: "0700"