CoM-ghost_protocol/phantom

phantom — Privacy Server Deployer

Deploy self-hosted privacy infrastructure with a single command. Supports cloud providers, existing servers, and local deployment.

Server Types

Service	Status	Description
Matrix + Element	Ready	Encrypted messaging homeserver with web client
WireGuard VPN	Ready	Private VPN server with client config generation
Pi-hole DNS	Ready	Ad-blocking DNS server (native)
Nextcloud	Ready	Self-hosted file sync and collaboration
Vaultwarden	Ready	Self-hosted Bitwarden password manager
Jellyfin	Ready	Self-hosted media server
Mail-in-a-Box	Ready	Self-hosted email
All-in-One	Ready	Multiple services on one server with nginx reverse proxy

Deployment Targets

• Linode — Automated provisioning via API
• AWS EC2 — Automated provisioning via API
• FlokiNET — Register pre-provisioned server
• Existing server — Any server with SSH access
• Local — Deploy directly on the current machine

Quick Start

# Requirements
pip install ansible pyyaml   # or: apt install ansible python3-yaml
# For AWS deployments:
pip install boto3
ansible-galaxy collection install amazon.aws

# Launch
python3 phantom.py

Select a service, choose a deployment target, provide configuration, and phantom handles the rest:

1. Provisions infrastructure (if cloud)
2. Applies base hardening (UFW, fail2ban, SSH lockdown, kernel hardening)
3. Deploys the selected service
4. Saves deployment info to logs/

All-in-One Deployment

The all-in-one option deploys multiple services on a single server with:

• Nginx reverse proxy with TLS termination
• Let's Encrypt certificates via Certbot
• Per-service vhost routing

Warning: Running multiple services on one server means a compromise of one service risks all services. Use for lab/testing or personal use where convenience outweighs isolation. For production, deploy one service per server.

Local Deployment

Select "Local (this machine)" as the deployment target to install services directly on your current system. This is useful for:

• Home lab servers
• Raspberry Pi deployments
• LAN-only services
• Testing before cloud deployment

No SSH key generation or remote provisioning is needed for local deployments.

Provider Setup

Linode

1. Create an API token at https://cloud.linode.com/profile/tokens
2. Select "Linode" when prompted and paste your token

AWS

1. Create an IAM user with EC2 permissions
2. Generate access keys
3. Select "AWS" when prompted and provide credentials

FlokiNET

1. Provision a server through FlokiNET's control panel
2. Select "FlokiNET" and provide the server IP

Project Structure

phantom/
├── phantom.py          # Main CLI
├── modules/            # Per-service configuration
├── playbooks/          # Ansible playbooks
│   ├── common/         # Shared hardening
│   ├── matrix/         # Synapse + Element
│   ├── vpn/            # WireGuard
│   ├── dns/            # Pi-hole
│   ├── cloud/          # Nextcloud
│   ├── vault/          # Vaultwarden
│   ├── media/          # Jellyfin
│   ├── email/          # Mail-in-a-Box
│   └── all_in_one/     # Multi-service composer
├── providers/          # Cloud provisioning
└── logs/               # Deployment artifacts

License

MIT