Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/email/main.yml

@@ -1,11 +1,18 @@
 ---
-# Email deployment — Coming soon
-# This is a stub playbook. Full implementation planned.
+# Mail-in-a-Box deployment — native installer script
+# MIAB manages its own nginx, TLS, DNS, and mail stack
 
-- name: Deploy Email Server
+- name: Deploy Mail-in-a-Box Email Server
   hosts: all
   become: true
+  vars:
+    miab_domain: "{{ domain }}"
+    miab_first_user: "{{ email_first_user }}"
+    target_host: "{{ target_host | default('localhost') }}"
+
   tasks:
-    - name: Placeholder
-      debug:
-        msg: "Email playbook not yet implemented. Check phantom/README.md for status."
+    - name: Include Mail-in-a-Box installation
+      include_tasks: tasks/install.yml
+
+    - name: Include Mail-in-a-Box configuration
+      include_tasks: tasks/configure.yml

phantom/playbooks/email/tasks/configure.yml

@@ -0,0 +1,45 @@
+---
+# Mail-in-a-Box non-interactive installation
+
+- name: Generate admin password
+  command: openssl rand -base64 16
+  register: miab_admin_password
+  args:
+    creates: /root/.miab_admin_password
+
+- name: Save admin password
+  copy:
+    content: "{{ miab_admin_password.stdout }}"
+    dest: /root/.miab_admin_password
+    mode: "0600"
+  when: miab_admin_password.changed
+
+- name: Read saved admin password
+  slurp:
+    src: /root/.miab_admin_password
+  register: miab_password_file
+
+- name: Clone Mail-in-a-Box repository
+  git:
+    repo: https://github.com/mail-in-a-box/mailinabox.git
+    dest: /opt/mailinabox
+    version: main
+    depth: 1
+
+- name: Run Mail-in-a-Box installer (non-interactive)
+  command: bash /opt/mailinabox/setup/start.sh
+  args:
+    creates: /etc/mailinabox.conf
+  environment:
+    NONINTERACTIVE: "1"
+    PRIMARY_HOSTNAME: "{{ miab_domain }}"
+    EMAIL_ADDR: "{{ miab_first_user }}"
+    EMAIL_PW: "{{ (miab_password_file.content | b64decode).strip() }}"
+  timeout: 600
+
+- name: Display admin credentials
+  debug:
+    msg: >
+      Mail-in-a-Box installed. Admin: {{ miab_first_user }}
+      Password saved to /root/.miab_admin_password
+      Web admin: https://{{ miab_domain }}/admin

phantom/playbooks/email/tasks/install.yml

@@ -0,0 +1,56 @@
+---
+# Mail-in-a-Box prerequisites and environment setup
+
+- name: Verify Ubuntu distribution
+  assert:
+    that:
+      - ansible_distribution == "Ubuntu"
+    fail_msg: "Mail-in-a-Box requires Ubuntu. Detected: {{ ansible_distribution }}"
+
+- name: Stop conflicting nginx (MIAB manages its own)
+  service:
+    name: nginx
+    state: stopped
+    enabled: false
+  failed_when: false
+
+- name: Set system hostname for MIAB
+  hostname:
+    name: "{{ miab_domain }}"
+
+- name: Update /etc/hostname
+  copy:
+    content: "{{ miab_domain }}\n"
+    dest: /etc/hostname
+    mode: "0644"
+
+- name: Ensure hostname in /etc/hosts
+  lineinfile:
+    path: /etc/hosts
+    regexp: '^127\.0\.1\.1'
+    line: "127.0.1.1 {{ miab_domain }}"
+
+- name: Allow mail-related ports through UFW
+  ufw:
+    rule: allow
+    port: "{{ item.port }}"
+    proto: "{{ item.proto }}"
+  loop:
+    - { port: "25", proto: "tcp" }
+    - { port: "587", proto: "tcp" }
+    - { port: "993", proto: "tcp" }
+    - { port: "465", proto: "tcp" }
+    - { port: "80", proto: "tcp" }
+    - { port: "443", proto: "tcp" }
+    - { port: "53", proto: "tcp" }
+    - { port: "53", proto: "udp" }
+    - { port: "4190", proto: "tcp" }
+
+- name: Install prerequisites
+  apt:
+    name:
+      - curl
+      - ca-certificates
+      - git
+    state: present
+    update_cache: true