Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/matrix/tasks/nginx.yml

@@ -1,6 +1,5 @@
 ---
 # Nginx reverse proxy for Matrix + Element
-# Two-phase: HTTP-only first for certbot, then full SSL config
 
 - name: Create certbot webroot
   file:
@@ -17,15 +16,8 @@
       server {
           listen 80;
           server_name {{ matrix_domain }};
-
-          location /.well-known/acme-challenge/ {
-              root /var/www/certbot;
-          }
-
-          location / {
-              return 200 'phantom setup in progress';
-              add_header Content-Type text/plain;
-          }
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
       }
     mode: "0644"
   notify: reload nginx
@@ -40,35 +32,38 @@
 - name: Flush handlers to apply HTTP config
   meta: flush_handlers
 
-- name: Obtain TLS certificate
-  command: >
-    certbot certonly --webroot -w /var/www/certbot
-    -d {{ matrix_domain }}
-    --non-interactive
-    --agree-tos
-    {% if certbot_email is defined and certbot_email %}
-    --email {{ certbot_email }}
-    {% else %}
-    --register-unsafely-without-email
-    {% endif %}
-  args:
-    creates: "/etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem"
+- name: Setup TLS (certbot with self-signed fallback)
+  include_tasks: ../../common/tls_setup.yml
+  vars:
+    _tls_domain: "{{ matrix_domain }}"
 
-- name: Deploy full SSL nginx config
+- name: Disable server tokens in nginx
+  lineinfile:
+    path: /etc/nginx/nginx.conf
+    regexp: "^\\s*#?\\s*server_tokens"
+    line: "\tserver_tokens off;"
+    insertafter: "sendfile on;"
+  notify: reload nginx
+
+- name: Remove default nginx site
+  file:
+    path: /etc/nginx/sites-enabled/default
+    state: absent
+  notify: reload nginx
+
+- name: Deploy hardened SSL nginx config
   copy:
     dest: /etc/nginx/sites-available/matrix
     content: |
+      # Rate limiting zones
+      limit_req_zone $binary_remote_addr zone=matrix_login:10m rate=3r/m;
+      limit_req_zone $binary_remote_addr zone=matrix_general:10m rate=10r/s;
+
       server {
           listen 80;
           server_name {{ matrix_domain }};
-
-          location /.well-known/acme-challenge/ {
-              root /var/www/certbot;
-          }
-
-          location / {
-              return 301 https://$host$request_uri;
-          }
+          location /.well-known/acme-challenge/ { root /var/www/certbot; }
+          location / { return 301 https://$host$request_uri; }
       }
 
       server {
@@ -76,24 +71,51 @@
           listen 8448 ssl http2;
           server_name {{ matrix_domain }};
 
-          ssl_certificate /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
-          ssl_certificate_key /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
-
+          # TLS
+          ssl_certificate {{ _ssl_cert }};
+          ssl_certificate_key {{ _ssl_key }};
           ssl_protocols TLSv1.2 TLSv1.3;
-          ssl_ciphers HIGH:!aNULL:!MD5;
-          ssl_prefer_server_ciphers on;
+          ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
+          ssl_prefer_server_ciphers off;
+          ssl_session_timeout 1d;
+          ssl_session_cache shared:SSL:10m;
+          ssl_session_tickets off;
+
+          # Security headers
+          add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+          add_header X-Frame-Options "SAMEORIGIN" always;
+          add_header X-Content-Type-Options "nosniff" always;
+          add_header X-XSS-Protection "1; mode=block" always;
+          add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+          add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
 
           client_max_body_size 50m;
 
-          # Synapse
-          location ~* ^(\/_matrix|\/_synapse\/client) {
+          # Block Synapse admin API from external access
+          location /_synapse/admin {
+              return 403;
+          }
+
+          # Login endpoint — strict rate limit
+          location /_matrix/client/v3/login {
+              limit_req zone=matrix_login burst=3 nodelay;
               proxy_pass http://127.0.0.1:8008;
               proxy_set_header X-Forwarded-For $remote_addr;
               proxy_set_header X-Forwarded-Proto $scheme;
               proxy_set_header Host $host;
           }
 
-          # .well-known delegation
+          # Matrix client + federation API
+          location ~* ^(\/_matrix|\/_synapse\/client) {
+              limit_req zone=matrix_general burst=20 nodelay;
+              proxy_pass http://127.0.0.1:8008;
+              proxy_set_header X-Forwarded-For $remote_addr;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              proxy_set_header Host $host;
+              proxy_read_timeout 600s;
+              proxy_send_timeout 600s;
+          }
+
           location /.well-known/matrix/server {
               return 200 '{"m.server": "{{ matrix_domain }}:443"}';
               add_header Content-Type application/json;
@@ -105,10 +127,11 @@
               add_header Access-Control-Allow-Origin *;
           }
 
-          # Element Web (if enabled)
+          # Element Web
           location / {
               root /var/www/element;
               try_files $uri $uri/ /index.html;
+              add_header Content-Security-Policy "frame-ancestors 'self'" always;
           }
       }
     mode: "0644"

phantom/playbooks/matrix/tasks/synapse.yml

@@ -1,5 +1,6 @@
 ---
 # Synapse homeserver installation and configuration
+# Uses SQLite3 (matches c2itall chat-server pattern — no PostgreSQL needed)
 
 - name: Install dependencies
   apt:
@@ -7,24 +8,25 @@
       - python3
       - python3-pip
       - python3-venv
-      - libpq-dev
-      - postgresql
-      - postgresql-contrib
       - nginx
       - certbot
       - python3-certbot-nginx
+      - curl
+      - wget
+      - gnupg
+      - lsb-release
     state: present
 
-- name: Add Matrix Synapse apt repository key
-  apt_key:
-    url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
-    state: present
+- name: Add Matrix Synapse GPG key and repository
+  shell: |
+    wget -qO /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+    echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/matrix-org.list
+  args:
+    creates: /etc/apt/sources.list.d/matrix-org.list
 
-- name: Add Matrix Synapse apt repository
-  apt_repository:
-    repo: "deb https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main"
-    state: present
-    filename: matrix-org
+- name: Update apt cache after adding Matrix repo
+  apt:
+    update_cache: true
 
 - name: Install Synapse
   apt:
@@ -33,22 +35,17 @@
   environment:
     DEBIAN_FRONTEND: noninteractive
 
-- name: Create PostgreSQL database
-  become_user: postgres
-  postgresql_db:
-    name: synapse
-    encoding: UTF-8
-    lc_collate: C
-    lc_ctype: C
-    template: template0
-
-- name: Create PostgreSQL user
-  become_user: postgres
-  postgresql_user:
-    name: synapse
-    password: "{{ matrix_signing_key[:32] }}"
-    db: synapse
-    priv: ALL
+- name: Set correct ownership for Matrix directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: matrix-synapse
+    group: matrix-synapse
+    mode: "0750"
+    recurse: true
+  loop:
+    - /var/lib/matrix-synapse
+    - /var/log/matrix-synapse
 
 - name: Deploy Synapse homeserver config
   template:
@@ -59,6 +56,11 @@
     mode: "0640"
   notify: restart synapse
 
+- name: Clear conflicting conf.d configurations
+  shell: |
+    rm -f /etc/matrix-synapse/conf.d/*.yaml 2>/dev/null || true
+  changed_when: false
+
 - name: Allow Matrix federation port through UFW
   ufw:
     rule: allow
@@ -77,23 +79,25 @@
 - name: Enable and start Synapse
   service:
     name: matrix-synapse
-    state: started
+    state: restarted
     enabled: true
 
 - name: Wait for Synapse to be ready
   wait_for:
     port: 8008
     host: 127.0.0.1
-    timeout: 30
+    delay: 5
+    timeout: 60
 
 - name: Create admin user
-  command: >
-    register_new_matrix_user
-    -u {{ matrix_admin }}
-    -p {{ matrix_admin_pass }}
-    -a
-    -c /etc/matrix-synapse/homeserver.yaml
-    http://localhost:8008
+  shell: |
+    /opt/venvs/matrix-synapse/bin/register_new_matrix_user \
+      -c /etc/matrix-synapse/homeserver.yaml \
+      -u {{ matrix_admin }} \
+      -p {{ matrix_admin_pass }} \
+      -a
   register: admin_create
-  failed_when: false
-  changed_when: admin_create.rc == 0
+  failed_when:
+    - admin_create.rc != 0
+    - "'User ID already taken' not in admin_create.stderr"
+  changed_when: "'User ID already taken' not in admin_create.stderr"