Phantom v2: dual-mode architecture, security hardening, deployment management
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
n0mad1k
@@ -0,0 +1,73 @@
|
||||
---
|
||||
# Vaultwarden service configuration
|
||||
|
||||
- name: Deploy Vaultwarden environment file
|
||||
copy:
|
||||
dest: /opt/vaultwarden/.env
|
||||
content: |
|
||||
DOMAIN=https://{{ vaultwarden_domain }}
|
||||
SIGNUPS_ALLOWED={{ vaultwarden_signups | lower }}
|
||||
ADMIN_TOKEN={{ vaultwarden_admin_token }}
|
||||
ROCKET_ADDRESS=127.0.0.1
|
||||
ROCKET_PORT=8081
|
||||
DATA_FOLDER=/opt/vaultwarden/data
|
||||
WEB_VAULT_FOLDER=/opt/vaultwarden/web-vault
|
||||
LOG_FILE=/opt/vaultwarden/data/vaultwarden.log
|
||||
LOG_LEVEL=warn
|
||||
SENDS_ALLOWED=true
|
||||
EMERGENCY_ACCESS_ALLOWED=true
|
||||
WEBSOCKET_ENABLED=true
|
||||
WEBSOCKET_ADDRESS=127.0.0.1
|
||||
WEBSOCKET_PORT=3012
|
||||
owner: vaultwarden
|
||||
group: vaultwarden
|
||||
mode: "0600"
|
||||
notify: restart vaultwarden
|
||||
|
||||
- name: Deploy Vaultwarden systemd unit
|
||||
copy:
|
||||
dest: /etc/systemd/system/vaultwarden.service
|
||||
content: |
|
||||
[Unit]
|
||||
Description=Vaultwarden (Bitwarden-compatible server)
|
||||
Documentation=https://github.com/dani-garcia/vaultwarden
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
User=vaultwarden
|
||||
Group=vaultwarden
|
||||
EnvironmentFile=/opt/vaultwarden/.env
|
||||
ExecStart=/opt/vaultwarden/vaultwarden
|
||||
WorkingDirectory=/opt/vaultwarden
|
||||
|
||||
# Hardening
|
||||
ProtectSystem=strict
|
||||
ProtectHome=true
|
||||
PrivateTmp=true
|
||||
PrivateDevices=true
|
||||
NoNewPrivileges=true
|
||||
ReadWritePaths=/opt/vaultwarden/data
|
||||
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
mode: "0644"
|
||||
|
||||
- name: Reload systemd daemon
|
||||
systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Enable and start Vaultwarden
|
||||
service:
|
||||
name: vaultwarden
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Wait for Vaultwarden to be ready
|
||||
wait_for:
|
||||
port: 8081
|
||||
host: 127.0.0.1
|
||||
delay: 3
|
||||
timeout: 30
|
||||
@@ -0,0 +1,101 @@
|
||||
---
|
||||
# Vaultwarden binary installation from GitHub releases
|
||||
|
||||
- name: Install prerequisites
|
||||
apt:
|
||||
name:
|
||||
- nginx
|
||||
- certbot
|
||||
- python3-certbot-nginx
|
||||
- libssl-dev
|
||||
- pkg-config
|
||||
- curl
|
||||
- ca-certificates
|
||||
state: present
|
||||
update_cache: true
|
||||
|
||||
- name: Create vaultwarden system user
|
||||
user:
|
||||
name: vaultwarden
|
||||
system: true
|
||||
shell: /usr/sbin/nologin
|
||||
home: /opt/vaultwarden
|
||||
create_home: false
|
||||
|
||||
- name: Create Vaultwarden directories
|
||||
file:
|
||||
path: "{{ item }}"
|
||||
state: directory
|
||||
owner: vaultwarden
|
||||
group: vaultwarden
|
||||
mode: "0750"
|
||||
loop:
|
||||
- /opt/vaultwarden
|
||||
- /opt/vaultwarden/data
|
||||
|
||||
- name: Detect system architecture
|
||||
command: uname -m
|
||||
register: system_arch
|
||||
changed_when: false
|
||||
|
||||
- name: Set architecture for download
|
||||
set_fact:
|
||||
vw_arch: "{{ 'aarch64' if system_arch.stdout == 'aarch64' else 'x86_64' }}"
|
||||
|
||||
- name: Get latest Vaultwarden release tag
|
||||
uri:
|
||||
url: https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest
|
||||
return_content: true
|
||||
headers:
|
||||
Accept: application/vnd.github+json
|
||||
register: vw_release
|
||||
|
||||
- name: Set Vaultwarden version
|
||||
set_fact:
|
||||
vw_version: "{{ vw_release.json.tag_name }}"
|
||||
|
||||
- name: Download Vaultwarden binary
|
||||
get_url:
|
||||
url: "https://github.com/dani-garcia/vaultwarden/releases/download/{{ vw_version }}/vaultwarden-{{ vw_version }}-linux-{{ vw_arch }}.tar.gz"
|
||||
dest: "/tmp/vaultwarden-{{ vw_version }}.tar.gz"
|
||||
mode: "0644"
|
||||
|
||||
- name: Extract Vaultwarden binary
|
||||
unarchive:
|
||||
src: "/tmp/vaultwarden-{{ vw_version }}.tar.gz"
|
||||
dest: /opt/vaultwarden/
|
||||
remote_src: true
|
||||
owner: vaultwarden
|
||||
group: vaultwarden
|
||||
|
||||
- name: Ensure binary is executable
|
||||
file:
|
||||
path: /opt/vaultwarden/vaultwarden
|
||||
mode: "0755"
|
||||
owner: vaultwarden
|
||||
group: vaultwarden
|
||||
|
||||
- name: Download Vaultwarden web vault
|
||||
get_url:
|
||||
url: "https://github.com/dani-garcia/bw_web_builds/releases/latest/download/bw_web_v2024.6.2c.tar.gz"
|
||||
dest: /tmp/bw_web_vault.tar.gz
|
||||
mode: "0644"
|
||||
failed_when: false
|
||||
|
||||
- name: Extract web vault
|
||||
unarchive:
|
||||
src: /tmp/bw_web_vault.tar.gz
|
||||
dest: /opt/vaultwarden/
|
||||
remote_src: true
|
||||
owner: vaultwarden
|
||||
group: vaultwarden
|
||||
failed_when: false
|
||||
|
||||
- name: Allow HTTP/HTTPS through UFW
|
||||
ufw:
|
||||
rule: allow
|
||||
port: "{{ item }}"
|
||||
proto: tcp
|
||||
loop:
|
||||
- "80"
|
||||
- "443"
|
||||
@@ -0,0 +1,96 @@
|
||||
---
|
||||
# Nginx reverse proxy for Vaultwarden
|
||||
|
||||
- name: Create certbot webroot
|
||||
file:
|
||||
path: /var/www/certbot
|
||||
state: directory
|
||||
owner: www-data
|
||||
group: www-data
|
||||
mode: "0755"
|
||||
|
||||
- name: Deploy HTTP-only nginx config (for certbot)
|
||||
copy:
|
||||
dest: /etc/nginx/sites-available/vaultwarden
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ vaultwarden_domain }};
|
||||
location /.well-known/acme-challenge/ { root /var/www/certbot; }
|
||||
location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
|
||||
}
|
||||
mode: "0644"
|
||||
notify: reload nginx
|
||||
|
||||
- name: Enable Vaultwarden nginx site
|
||||
file:
|
||||
src: /etc/nginx/sites-available/vaultwarden
|
||||
dest: /etc/nginx/sites-enabled/vaultwarden
|
||||
state: link
|
||||
notify: reload nginx
|
||||
|
||||
- name: Flush handlers to apply HTTP config
|
||||
meta: flush_handlers
|
||||
|
||||
- name: Setup TLS (certbot with self-signed fallback)
|
||||
include_tasks: ../../common/tls_setup.yml
|
||||
vars:
|
||||
_tls_domain: "{{ vaultwarden_domain }}"
|
||||
|
||||
- name: Deploy SSL nginx config
|
||||
copy:
|
||||
dest: /etc/nginx/sites-available/vaultwarden
|
||||
content: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name {{ vaultwarden_domain }};
|
||||
location /.well-known/acme-challenge/ { root /var/www/certbot; }
|
||||
location / { return 301 https://$host$request_uri; }
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name {{ vaultwarden_domain }};
|
||||
|
||||
ssl_certificate {{ _ssl_cert }};
|
||||
ssl_certificate_key {{ _ssl_key }};
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
ssl_prefer_server_ciphers on;
|
||||
|
||||
server_tokens off;
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
|
||||
add_header X-Content-Type-Options nosniff always;
|
||||
add_header X-Frame-Options DENY always;
|
||||
|
||||
client_max_body_size 525m;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8081;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /notifications/hub {
|
||||
proxy_pass http://127.0.0.1:3012;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
|
||||
location /notifications/hub/negotiate {
|
||||
proxy_pass http://127.0.0.1:8081;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
mode: "0644"
|
||||
notify: reload nginx
|
||||
Reference in New Issue
Block a user