Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection) - SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts - Ansible output streaming with filtered console + full log capture - Deployment management menu: discover, SSH, teardown existing deployments - Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs - Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers - Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails - Add-matrix-user helper script deployed to all Matrix servers - .env support for standalone credential storage - Config key rename: deploy_id → deployment_id (with backward compat) - Provider cleanup playbooks for teardown - Test suite with 50 tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 15:45:24 -04:00
parent 973cede31f
commit 7484a0e034
44 changed files with 3167 additions and 381 deletions
@@ -1,5 +1,5 @@
 ---
-# Pi-hole DNS server deployment (Docker-based)
+# Pi-hole DNS server deployment (native installer)

 - name: Deploy Pi-hole DNS Server
  hosts: all
@@ -16,3 +16,9 @@

    - name: Include Pi-hole configuration
      include_tasks: tasks/configure.yml
+
+  handlers:
+    - name: restart pihole-FTL
+      service:
+        name: pihole-FTL
+        state: restarted
@@ -1,66 +1,66 @@
 ---
-# Pi-hole Docker configuration and launch
-
- name: Create Pi-hole directories
-  file:
-    path: "{{ item }}"
-    state: directory
-    mode: "0755"
-  loop:
-    - /opt/pihole
-    - /opt/pihole/etc-pihole
-    - /opt/pihole/etc-dnsmasq.d
+# Pi-hole native configuration

 - name: Generate Pi-hole admin password
-  shell: "openssl rand -base64 16"
-  register: pihole_password
+  command: openssl rand -base64 16
+  register: pihole_password_gen
  args:
-    creates: /opt/pihole/.password
+    creates: /etc/pihole/.phantom_password

 - name: Save admin password
  copy:
-    content: "{{ pihole_password.stdout }}"
-    dest: /opt/pihole/.password
+    content: "{{ pihole_password_gen.stdout }}"
+    dest: /etc/pihole/.phantom_password
    mode: "0600"
-  when: pihole_password.changed
+  when: pihole_password_gen.changed

- name: Deploy Pi-hole Docker Compose
-  copy:
-    dest: /opt/pihole/docker-compose.yml
-    content: |
-      services:
-        pihole:
-          container_name: pihole
-          image: pihole/pihole:latest
-          ports:
-            - "53:53/tcp"
-            - "53:53/udp"
-            - "80:80/tcp"
-          environment:
-            TZ: UTC
-            WEBPASSWORD_FILE: /run/secrets/webpassword
-            PIHOLE_DNS_: "{{ pihole_upstream }}"
-            DNSSEC: "true"
-            QUERY_LOGGING: "false"
-          volumes:
-            - /opt/pihole/etc-pihole:/etc/pihole
-            - /opt/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
-          secrets:
-            - webpassword
-          restart: unless-stopped
-          dns:
-            - 127.0.0.1
-            - 9.9.9.9
-      secrets:
-        webpassword:
-          file: /opt/pihole/.password
-    mode: "0644"
+- name: Read saved password
+  slurp:
+    src: /etc/pihole/.phantom_password
+  register: pihole_password_file

- name: Start Pi-hole
-  shell: cd /opt/pihole && docker compose up -d
-  args:
-    creates: /opt/pihole/etc-pihole/pihole-FTL.db
+- name: Set Pi-hole admin password
+  command: "pihole -a -p {{ (pihole_password_file.content | b64decode).strip() }}"
+  changed_when: true

- name: Display admin password
+- name: Set upstream DNS servers
+  command: "pihole -a setdns {{ pihole_upstream | replace(';', ' ') }}"
+  changed_when: true
+
+- name: Configure blocklist level
+  block:
+    - name: Update gravity (standard blocklist)
+      command: pihole -g
+      changed_when: true
+      when: pihole_blocklist == "standard"
+
+    - name: Add aggressive blocklists
+      lineinfile:
+        path: /etc/pihole/adlists.list
+        line: "{{ item }}"
+        create: true
+        mode: "0644"
+      loop:
+        - "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
+        - "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt"
+      when: pihole_blocklist == "aggressive"
+      notify: update gravity
+
+    - name: Update gravity after blocklist changes
+      command: pihole -g
+      changed_when: true
+      when: pihole_blocklist == "aggressive"
+
+- name: Enable DNSSEC
+  command: pihole -a dnssec on
+  changed_when: true
+
+- name: Ensure pihole-FTL is running
+  service:
+    name: pihole-FTL
+    state: started
+    enabled: true
+
+- name: Display admin credentials
  debug:
-    msg: "Pi-hole admin password: {{ pihole_password.stdout | default('(see /opt/pihole/.password)') }}"
+    msg: "Pi-hole admin password saved to /etc/pihole/.phantom_password — access admin at http://{{ ansible_default_ipv4.address | default('server_ip') }}/admin"
@@ -1,40 +1,17 @@
 ---
-# Pi-hole installation via Docker
+# Pi-hole native installation (no Docker)

- name: Install Docker prerequisites
+- name: Install Pi-hole prerequisites
  apt:
    name:
-      - apt-transport-https
-      - ca-certificates
      - curl
-      - gnupg
-      - lsb-release
+      - git
+      - iproute2
+      - whiptail
+      - ca-certificates
+      - cron
    state: present
-
- name: Add Docker GPG key
-  apt_key:
-    url: https://download.docker.com/linux/{{ ansible_distribution | lower }}/gpg
-    state: present
-
- name: Add Docker repository
-  apt_repository:
-    repo: "deb https://download.docker.com/linux/{{ ansible_distribution | lower }} {{ ansible_distribution_release }} stable"
-    state: present
-
- name: Install Docker
-  apt:
-    name:
-      - docker-ce
-      - docker-ce-cli
-      - containerd.io
-      - docker-compose-plugin
-    state: present
-
- name: Enable Docker service
-  service:
-    name: docker
-    state: started
-    enabled: true
+    update_cache: true

 - name: Stop systemd-resolved (conflicts with Pi-hole on port 53)
  service:
@@ -43,7 +20,7 @@
    enabled: false
  failed_when: false

- name: Set DNS fallback
+- name: Set DNS fallback for installation
  copy:
    dest: /etc/resolv.conf
    content: |
@@ -51,6 +28,45 @@
      nameserver 1.1.1.1
    mode: "0644"

+- name: Create Pi-hole config directory
+  file:
+    path: /etc/pihole
+    state: directory
+    mode: "0755"
+
+- name: Deploy setupVars.conf for unattended install
+  copy:
+    dest: /etc/pihole/setupVars.conf
+    content: |
+      PIHOLE_INTERFACE={{ ansible_default_ipv4.interface | default('eth0') }}
+      PIHOLE_DNS_1={{ pihole_upstream.split(';')[0] | default('9.9.9.9') }}
+      PIHOLE_DNS_2={{ pihole_upstream.split(';')[1] | default('149.112.112.112') }}
+      QUERY_LOGGING=false
+      INSTALL_WEB_SERVER=true
+      INSTALL_WEB_INTERFACE=true
+      LIGHTTPD_ENABLED=false
+      CACHE_SIZE=10000
+      DNS_FQDN_REQUIRED=true
+      DNS_BOGUS_PRIV=true
+      DNSSEC=true
+      BLOCKING_ENABLED=true
+      WEBPASSWORD=
+    mode: "0644"
+
+- name: Clone Pi-hole repository
+  git:
+    repo: https://github.com/pi-hole/pi-hole.git
+    dest: /opt/pihole-install
+    version: master
+    depth: 1
+
+- name: Run Pi-hole installer (unattended)
+  command: bash /opt/pihole-install/automated\ install/basic-install.sh --unattended
+  args:
+    creates: /usr/local/bin/pihole
+  environment:
+    PIHOLE_SKIP_OS_CHECK: "true"
+
 - name: Allow DNS through UFW
  ufw:
    rule: allow
@@ -59,4 +75,14 @@
  loop:
    - { port: "53", proto: "tcp" }
    - { port: "53", proto: "udp" }
-    - { port: "80", proto: "tcp" }
+
+- name: Allow Pi-hole admin from private networks only
+  ufw:
+    rule: allow
+    port: "80"
+    proto: tcp
+    from_ip: "{{ item }}"
+  loop:
+    - "10.0.0.0/8"
+    - "172.16.0.0/12"
+    - "192.168.0.0/16"