Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/matrix/tasks/synapse.yml

@@ -1,5 +1,6 @@
 ---
 # Synapse homeserver installation and configuration
+# Uses SQLite3 (matches c2itall chat-server pattern — no PostgreSQL needed)
 
 - name: Install dependencies
   apt:
@@ -7,24 +8,25 @@
       - python3
       - python3-pip
       - python3-venv
-      - libpq-dev
-      - postgresql
-      - postgresql-contrib
       - nginx
       - certbot
       - python3-certbot-nginx
+      - curl
+      - wget
+      - gnupg
+      - lsb-release
     state: present
 
-- name: Add Matrix Synapse apt repository key
-  apt_key:
-    url: https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
-    state: present
+- name: Add Matrix Synapse GPG key and repository
+  shell: |
+    wget -qO /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
+    echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" | tee /etc/apt/sources.list.d/matrix-org.list
+  args:
+    creates: /etc/apt/sources.list.d/matrix-org.list
 
-- name: Add Matrix Synapse apt repository
-  apt_repository:
-    repo: "deb https://packages.matrix.org/debian/ {{ ansible_distribution_release }} main"
-    state: present
-    filename: matrix-org
+- name: Update apt cache after adding Matrix repo
+  apt:
+    update_cache: true
 
 - name: Install Synapse
   apt:
@@ -33,22 +35,17 @@
   environment:
     DEBIAN_FRONTEND: noninteractive
 
-- name: Create PostgreSQL database
-  become_user: postgres
-  postgresql_db:
-    name: synapse
-    encoding: UTF-8
-    lc_collate: C
-    lc_ctype: C
-    template: template0
-
-- name: Create PostgreSQL user
-  become_user: postgres
-  postgresql_user:
-    name: synapse
-    password: "{{ matrix_signing_key[:32] }}"
-    db: synapse
-    priv: ALL
+- name: Set correct ownership for Matrix directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: matrix-synapse
+    group: matrix-synapse
+    mode: "0750"
+    recurse: true
+  loop:
+    - /var/lib/matrix-synapse
+    - /var/log/matrix-synapse
 
 - name: Deploy Synapse homeserver config
   template:
@@ -59,6 +56,11 @@
     mode: "0640"
   notify: restart synapse
 
+- name: Clear conflicting conf.d configurations
+  shell: |
+    rm -f /etc/matrix-synapse/conf.d/*.yaml 2>/dev/null || true
+  changed_when: false
+
 - name: Allow Matrix federation port through UFW
   ufw:
     rule: allow
@@ -77,23 +79,25 @@
 - name: Enable and start Synapse
   service:
     name: matrix-synapse
-    state: started
+    state: restarted
     enabled: true
 
 - name: Wait for Synapse to be ready
   wait_for:
     port: 8008
     host: 127.0.0.1
-    timeout: 30
+    delay: 5
+    timeout: 60
 
 - name: Create admin user
-  command: >
-    register_new_matrix_user
-    -u {{ matrix_admin }}
-    -p {{ matrix_admin_pass }}
-    -a
-    -c /etc/matrix-synapse/homeserver.yaml
-    http://localhost:8008
+  shell: |
+    /opt/venvs/matrix-synapse/bin/register_new_matrix_user \
+      -c /etc/matrix-synapse/homeserver.yaml \
+      -u {{ matrix_admin }} \
+      -p {{ matrix_admin_pass }} \
+      -a
   register: admin_create
-  failed_when: false
-  changed_when: admin_create.rc == 0
+  failed_when:
+    - admin_create.rc != 0
+    - "'User ID already taken' not in admin_create.stderr"
+  changed_when: "'User ID already taken' not in admin_create.stderr"