Phantom v2: dual-mode architecture, security hardening, deployment management

- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phantom/playbooks/vault/tasks/install.yml

@@ -0,0 +1,101 @@
+---
+# Vaultwarden binary installation from GitHub releases
+
+- name: Install prerequisites
+  apt:
+    name:
+      - nginx
+      - certbot
+      - python3-certbot-nginx
+      - libssl-dev
+      - pkg-config
+      - curl
+      - ca-certificates
+    state: present
+    update_cache: true
+
+- name: Create vaultwarden system user
+  user:
+    name: vaultwarden
+    system: true
+    shell: /usr/sbin/nologin
+    home: /opt/vaultwarden
+    create_home: false
+
+- name: Create Vaultwarden directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: vaultwarden
+    group: vaultwarden
+    mode: "0750"
+  loop:
+    - /opt/vaultwarden
+    - /opt/vaultwarden/data
+
+- name: Detect system architecture
+  command: uname -m
+  register: system_arch
+  changed_when: false
+
+- name: Set architecture for download
+  set_fact:
+    vw_arch: "{{ 'aarch64' if system_arch.stdout == 'aarch64' else 'x86_64' }}"
+
+- name: Get latest Vaultwarden release tag
+  uri:
+    url: https://api.github.com/repos/dani-garcia/vaultwarden/releases/latest
+    return_content: true
+    headers:
+      Accept: application/vnd.github+json
+  register: vw_release
+
+- name: Set Vaultwarden version
+  set_fact:
+    vw_version: "{{ vw_release.json.tag_name }}"
+
+- name: Download Vaultwarden binary
+  get_url:
+    url: "https://github.com/dani-garcia/vaultwarden/releases/download/{{ vw_version }}/vaultwarden-{{ vw_version }}-linux-{{ vw_arch }}.tar.gz"
+    dest: "/tmp/vaultwarden-{{ vw_version }}.tar.gz"
+    mode: "0644"
+
+- name: Extract Vaultwarden binary
+  unarchive:
+    src: "/tmp/vaultwarden-{{ vw_version }}.tar.gz"
+    dest: /opt/vaultwarden/
+    remote_src: true
+    owner: vaultwarden
+    group: vaultwarden
+
+- name: Ensure binary is executable
+  file:
+    path: /opt/vaultwarden/vaultwarden
+    mode: "0755"
+    owner: vaultwarden
+    group: vaultwarden
+
+- name: Download Vaultwarden web vault
+  get_url:
+    url: "https://github.com/dani-garcia/bw_web_builds/releases/latest/download/bw_web_v2024.6.2c.tar.gz"
+    dest: /tmp/bw_web_vault.tar.gz
+    mode: "0644"
+  failed_when: false
+
+- name: Extract web vault
+  unarchive:
+    src: /tmp/bw_web_vault.tar.gz
+    dest: /opt/vaultwarden/
+    remote_src: true
+    owner: vaultwarden
+    group: vaultwarden
+  failed_when: false
+
+- name: Allow HTTP/HTTPS through UFW
+  ufw:
+    rule: allow
+    port: "{{ item }}"
+    proto: tcp
+  loop:
+    - "80"
+    - "443"