Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/matrix/templates/homeserver.yaml.j2

@@ -2,43 +2,83 @@
 ## Generated by phantom
 
 server_name: "{{ matrix_server_name }}"
-pid_file: /run/matrix-synapse.pid
+public_baseurl: "https://{{ matrix_domain }}/"
+pid_file: /var/run/matrix-synapse.pid
 
 listeners:
   - port: 8008
     tls: false
     type: http
     x_forwarded: true
+    bind_addresses:
+      - '127.0.0.1'
     resources:
       - names: [client, federation]
         compress: false
 
 database:
-  name: psycopg2
+  name: sqlite3
   args:
-    user: synapse
-    password: "{{ matrix_signing_key[:32] }}"
-    database: synapse
-    host: localhost
-    cp_min: 5
-    cp_max: 10
+    database: /var/lib/matrix-synapse/homeserver.db
 
 log_config: "/etc/matrix-synapse/log.yaml"
 media_store_path: /var/lib/matrix-synapse/media
-signing_key_path: "/etc/matrix-synapse/{{ matrix_server_name }}.signing.key"
+signing_key_path: "/etc/matrix-synapse/homeserver.signing.key"
 
+registration_shared_secret: "{{ matrix_signing_key }}"
 enable_registration: {{ matrix_registration_enabled | lower }}
 {% if not matrix_registration_enabled %}
 enable_registration_without_verification: false
 {% endif %}
+allow_guest_access: false
 
-suppress_key_server_warning: true
+form_secret: "{{ matrix_form_secret | default(matrix_signing_key[:28]) }}"
+macaroon_secret_key: "{{ matrix_macaroon_secret | default(matrix_signing_key[:30]) }}"
 
 trusted_key_servers:
   - server_name: "matrix.org"
 
-max_upload_size: 50M
+# Rate limiting
+rc_message:
+  per_second: 0.2
+  burst_count: 10
+rc_login:
+  address:
+    per_second: 0.17
+    burst_count: 3
+  account:
+    per_second: 0.17
+    burst_count: 3
+rc_registration:
+  per_second: 0.17
+  burst_count: 3
+rc_admin_redaction:
+  per_second: 1
+  burst_count: 50
 
+# Privacy / access control
+require_auth_for_profile_requests: true
+limit_profile_requests_to_users_who_share_rooms: true
+allow_public_rooms_without_auth: false
+allow_public_rooms_over_federation: false
+
+# Media
+enable_media_repo: true
+max_upload_size: 50M
+max_image_pixels: 32M
+
+# Telemetry
+enable_metrics: false
+report_stats: false
+
+# Session / auth hardening
+session_lifetime: 24h
+bcrypt_rounds: 12
+
+# Federation TLS
+federation_client_minimum_tls_version: 1.2
+
+# URL preview with SSRF protection
 url_preview_enabled: true
 url_preview_ip_range_blacklist:
   - '127.0.0.0/8'
@@ -46,8 +86,9 @@ url_preview_ip_range_blacklist:
   - '172.16.0.0/12'
   - '192.168.0.0/16'
   - '100.64.0.0/10'
-  - '192.0.0.0/24'
   - '169.254.0.0/16'
   - '::1/128'
   - 'fe80::/10'
   - 'fc00::/7'
+
+suppress_key_server_warning: true