Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/matrix/main.yml

@@ -26,6 +26,18 @@
     - name: Include nginx reverse proxy tasks
       include_tasks: tasks/nginx.yml
 
+    - name: Create Tools directory
+      file:
+        path: /root/Tools
+        state: directory
+        mode: "0755"
+
+    - name: Deploy Matrix user creation script
+      template:
+        src: ../common/templates/add-matrix-user.sh.j2
+        dest: /root/Tools/add-matrix-user.sh
+        mode: "0700"
+
   handlers:
     - name: restart synapse
       service:

phantom/playbooks/matrix/tasks/nginx.yml

@@ -1,6 +1,5 @@
 ---
 # Nginx reverse proxy for Matrix + Element
-# Two-phase: HTTP-only first for certbot, then full SSL config
 
 - name: Create certbot webroot
   file:
@@ -17,15 +16,8 @@
       server {
           listen 80;
           server_name {{ matrix_domain }};
-
-          location /.well-known/acme-challenge/ {
-              root /var/www/certbot;
-          }
-
-          location / {
-              return 200 'phantom setup in progress';
-              add_header Content-Type text/plain;
-          }
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
       }
     mode: "0644"
   notify: reload nginx
@@ -40,35 +32,38 @@
 - name: Flush handlers to apply HTTP config
   meta: flush_handlers
 
-- name: Obtain TLS certificate
-  command: >
-    certbot certonly --webroot -w /var/www/certbot
-    -d {{ matrix_domain }}
-    --non-interactive
-    --agree-tos
-    {% if certbot_email is defined and certbot_email %}
-    --email {{ certbot_email }}
-    {% else %}
-    --register-unsafely-without-email
-    {% endif %}
-  args:
-    creates: "/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem"
+- name: Setup TLS (certbot with self-signed fallback)
+  include_tasks: ../../common/tls_setup.yml
+  vars:
+    _tls_domain: "{{ matrix_domain }}"
 
-- name: Deploy full SSL nginx config
+- name: Disable server tokens in nginx
+  lineinfile:
+    path: /etc/nginx/nginx.conf
+    regexp: "^\\s*#?\\s*server_tokens"
+    line: "\tserver_tokens off;"
+    insertafter: "sendfile on;"
+  notify: reload nginx
+
+- name: Remove default nginx site
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+  notify: reload nginx
+
+- name: Deploy hardened SSL nginx config
   copy:
     dest: /etc/nginx/sites-available/matrix
     content: |
+      # Rate limiting zones
+      limit_req_zone $binary_remote_addr zone=matrix_login:10m rate=3r/m;
+      limit_req_zone $binary_remote_addr zone=matrix_general:10m rate=10r/s;
+
       server {
           listen 80;
           server_name {{ matrix_domain }};
-
-          location /.well-known/acme-challenge/ {
-              root /var/www/certbot;
-          }
-
-          location / {
-              return 301 https://$host$request_uri;
-          }
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 301 https://$host$request_uri; }
       }
 
       server {
@@ -76,24 +71,51 @@
           listen 8448 ssl http2;
           server_name {{ matrix_domain }};
 
-          ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
-          ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
-
+          # TLS
+          ssl_certificate {{ _ssl_cert }};
+          ssl_certificate_key {{ _ssl_key }};
           ssl_protocols TLSv1.2 TLSv1.3;
-          ssl_ciphers HIGH:!aNULL:!MD5;
-          ssl_prefer_server_ciphers on;
+          ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+          ssl_prefer_server_ciphers off;
+          ssl_session_timeout 1d;
+          ssl_session_cache shared:SSL:10m;
+          ssl_session_tickets off;
+
+          # Security headers
+          add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+          add_header X-Frame-Options "SAMEORIGIN" always;
+          add_header X-Content-Type-Options "nosniff" always;
+          add_header X-XSS-Protection "1; mode=block" always;
+          add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+          add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
 
           client_max_body_size 50m;
 
-          # Synapse
-          location ~* ^(\/_matrix|\/_synapse\/client) {
+          # Block Synapse admin API from external access
+          location /_synapse/admin {
+              return 403;
+          }
+
+          # Login endpoint — strict rate limit
+          location /_matrix/client/v3/login {
+              limit_req zone=matrix_login burst=3 nodelay;
               proxy_pass http://127.0.0.1:8008;
               proxy_set_header X-Forwarded-For $remote_addr;
               proxy_set_header X-Forwarded-Proto $scheme;
               proxy_set_header Host $host;
           }
 
-          # .well-known delegation
+          # Matrix client + federation API
+          location ~* ^(\/_matrix|\/_synapse\/client) {
+              limit_req zone=matrix_general burst=20 nodelay;
+              proxy_pass http://127.0.0.1:8008;
+              proxy_set_header X-Forwarded-For $remote_addr;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_set_header Host $host;
+              proxy_read_timeout 600s;
+              proxy_send_timeout 600s;
+          }
+
           location /.well-known/matrix/server {
               return 200 '{"m.server": "{{ matrix_domain }}:443"}';
               add_header Content-Type application/json;
@@ -105,10 +127,11 @@
               add_header Access-Control-Allow-Origin *;
           }
 
-          # Element Web (if enabled)
+          # Element Web
           location / {
               root /var/www/element;
               try_files $uri $uri/ /index.html;
+              add_header Content-Security-Policy "frame-ancestors 'self'" always;
           }
       }
     mode: "0644"

phantom/playbooks/matrix/tasks/synapse.yml

@@ -1,5 +1,6 @@
 ---
 # Synapse homeserver installation and configuration
+# Uses SQLite3 (matches c2itall chat-server pattern — no PostgreSQL needed)
 
 - name: Install dependencies
   apt:
@@ -7,24 +8,25 @@
       - python3
       - python3-pip
       - python3-venv
-      - libpq-dev
-      - postgresql
-      - postgresql-contrib
       - nginx
       - certbot
       - python3-certbot-nginx
+      - curl
+      - wget
+      - gnupg
+      - lsb-release
     state: present
 
-- name: Add Matrix Synapse apt repository key
-  apt_key:
-    url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
-    state: present
+- name: Add Matrix Synapse GPG key and repository
+  shell: |
+    wget -qO /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+    echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/matrix-org.list
+  args:
+    creates: /etc/apt/sources.list.d/matrix-org.list
 
-- name: Add Matrix Synapse apt repository
-  apt_repository:
-    repo: "deb https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main"
-    state: present
-    filename: matrix-org
+- name: Update apt cache after adding Matrix repo
+  apt:
+    update_cache: true
 
 - name: Install Synapse
   apt:
@@ -33,22 +35,17 @@
   environment:
     DEBIAN_FRONTEND: noninteractive
 
-- name: Create PostgreSQL database
-  become_user: postgres
-  postgresql_db:
-    name: synapse
-    encoding: UTF-8
-    lc_collate: C
-    lc_ctype: C
-    template: template0
-
-- name: Create PostgreSQL user
-  become_user: postgres
-  postgresql_user:
-    name: synapse
-    password: "{{ matrix_signing_key[:32] }}"
-    db: synapse
-    priv: ALL
+- name: Set correct ownership for Matrix directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: matrix-synapse
+    group: matrix-synapse
+    mode: "0750"
+    recurse: true
+  loop:
+    - /var/lib/matrix-synapse
+    - /var/log/matrix-synapse
 
 - name: Deploy Synapse homeserver config
   template:
@@ -59,6 +56,11 @@
     mode: "0640"
   notify: restart synapse
 
+- name: Clear conflicting conf.d configurations
+  shell: |
+    rm -f /etc/matrix-synapse/conf.d/*.yaml 2>/dev/null || true
+  changed_when: false
+
 - name: Allow Matrix federation port through UFW
   ufw:
     rule: allow
@@ -77,23 +79,25 @@
 - name: Enable and start Synapse
   service:
     name: matrix-synapse
-    state: started
+    state: restarted
     enabled: true
 
 - name: Wait for Synapse to be ready
   wait_for:
     port: 8008
     host: 127.0.0.1
-    timeout: 30
+    delay: 5
+    timeout: 60
 
 - name: Create admin user
-  command: >
-    register_new_matrix_user
-    -u {{ matrix_admin }}
-    -p {{ matrix_admin_pass }}
-    -a
-    -c /etc/matrix-synapse/homeserver.yaml
-    http://localhost:8008
+  shell: |
+    /opt/venvs/matrix-synapse/bin/register_new_matrix_user \
+      -c /etc/matrix-synapse/homeserver.yaml \
+      -u {{ matrix_admin }} \
+      -p {{ matrix_admin_pass }} \
+      -a
   register: admin_create
-  failed_when: false
-  changed_when: admin_create.rc == 0
+  failed_when:
+    - admin_create.rc != 0
+    - "'User ID already taken' not in admin_create.stderr"
+  changed_when: "'User ID already taken' not in admin_create.stderr"

phantom/playbooks/matrix/templates/homeserver.yaml.j2

@@ -2,43 +2,83 @@
 ## Generated by phantom
 
 server_name: "{{ matrix_server_name }}"
-pid_file: /run/matrix-synapse.pid
+public_baseurl: "https://{{ matrix_domain }}/"
+pid_file: /var/run/matrix-synapse.pid
 
 listeners:
   - port: 8008
     tls: false
     type: http
     x_forwarded: true
+    bind_addresses:
+      - '127.0.0.1'
     resources:
       - names: [client, federation]
         compress: false
 
 database:
-  name: psycopg2
+  name: sqlite3
   args:
-    user: synapse
-    password: "{{ matrix_signing_key[:32] }}"
-    database: synapse
-    host: localhost
-    cp_min: 5
-    cp_max: 10
+    database: /var/lib/matrix-synapse/homeserver.db
 
 log_config: "/etc/matrix-synapse/log.yaml"
 media_store_path: /var/lib/matrix-synapse/media
-signing_key_path: "/etc/matrix-synapse/{{ matrix_server_name }}.signing.key"
+signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
 
+registration_shared_secret: "{{ matrix_signing_key }}"
 enable_registration: {{ matrix_registration_enabled | lower }}
 {% if not matrix_registration_enabled %}
 enable_registration_without_verification: false
 {% endif %}
+allow_guest_access: false
 
-suppress_key_server_warning: true
+form_secret: "{{ matrix_form_secret | default(matrix_signing_key[:28]) }}"
+macaroon_secret_key: "{{ matrix_macaroon_secret | default(matrix_signing_key[:30]) }}"
 
 trusted_key_servers:
   - server_name: "matrix.org"
 
-max_upload_size: 50M
+# Rate limiting
+rc_message:
+  per_second: 0.2
+  burst_count: 10
+rc_login:
+  address:
+    per_second: 0.17
+    burst_count: 3
+  account:
+    per_second: 0.17
+    burst_count: 3
+rc_registration:
+  per_second: 0.17
+  burst_count: 3
+rc_admin_redaction:
+  per_second: 1
+  burst_count: 50
 
+# Privacy / access control
+require_auth_for_profile_requests: true
+limit_profile_requests_to_users_who_share_rooms: true
+allow_public_rooms_without_auth: false
+allow_public_rooms_over_federation: false
+
+# Media
+enable_media_repo: true
+max_upload_size: 50M
+max_image_pixels: 32M
+
+# Telemetry
+enable_metrics: false
+report_stats: false
+
+# Session / auth hardening
+session_lifetime: 24h
+bcrypt_rounds: 12
+
+# Federation TLS
+federation_client_minimum_tls_version: 1.2
+
+# URL preview with SSRF protection
 url_preview_enabled: true
 url_preview_ip_range_blacklist:
   - '127.0.0.0/8'
@@ -46,8 +86,9 @@ url_preview_ip_range_blacklist:
   - '172.16.0.0/12'
   - '192.168.0.0/16'
   - '100.64.0.0/10'
-  - '192.0.0.0/24'
   - '169.254.0.0/16'
   - '::1/128'
   - 'fe80::/10'
   - 'fc00::/7'
+
+suppress_key_server_warning: true