phantom — Privacy Server Deployer

Deploy self-hosted privacy infrastructure with a single command. Supports cloud providers, existing servers, and local deployment.

Server Types

Service	Status	Description
Matrix + Element	Ready	Encrypted messaging homeserver with web client
WireGuard VPN	Ready	Private VPN server with client config generation
Pi-hole DNS	Ready	Ad-blocking DNS server (Docker-based)
All-in-One	Ready	Multiple services on one server with nginx reverse proxy
Nextcloud	Stub	Self-hosted file sync and collaboration
Vaultwarden	Stub	Self-hosted Bitwarden password manager
Jellyfin	Stub	Self-hosted media server
Mail-in-a-Box	Stub	Self-hosted email

Deployment Targets

Linode — Automated provisioning via API
AWS EC2 — Automated provisioning via API
FlokiNET — Register pre-provisioned server
Existing server — Any server with SSH access
Local — Deploy directly on the current machine

Quick Start

# Requirements
pip install ansible pyyaml   # or: apt install ansible python3-yaml
# For AWS deployments:
pip install boto3
ansible-galaxy collection install amazon.aws

# Launch
python3 phantom.py

Select a service, choose a deployment target, provide configuration, and phantom handles the rest:

Provisions infrastructure (if cloud)
Applies base hardening (UFW, fail2ban, SSH lockdown, kernel hardening)
Deploys the selected service
Saves deployment info to logs/

All-in-One Deployment

The all-in-one option deploys multiple services on a single server with:

Nginx reverse proxy with TLS termination
Let's Encrypt certificates via Certbot
Per-service vhost routing

Warning: Running multiple services on one server means a compromise of one service risks all services. Use for lab/testing or personal use where convenience outweighs isolation. For production, deploy one service per server.

Local Deployment

Select "Local (this machine)" as the deployment target to install services directly on your current system. This is useful for:

Home lab servers
Raspberry Pi deployments
LAN-only services
Testing before cloud deployment

No SSH key generation or remote provisioning is needed for local deployments.

Provider Setup

Linode

Create an API token at https://cloud.linode.com/profile/tokens
Select "Linode" when prompted and paste your token

AWS

Create an IAM user with EC2 permissions
Generate access keys
Select "AWS" when prompted and provide credentials

FlokiNET

Provision a server through FlokiNET's control panel
Select "FlokiNET" and provide the server IP

Project Structure

phantom/
├── phantom.py          # Main CLI
├── modules/            # Per-service configuration
├── playbooks/          # Ansible playbooks
│   ├── common/         # Shared hardening
│   ├── matrix/         # Synapse + Element
│   ├── vpn/            # WireGuard
│   ├── dns/            # Pi-hole
│   └── all_in_one/     # Multi-service composer
├── providers/          # Cloud provisioning
└── logs/               # Deployment artifacts

License

MIT

3.2 KiB Raw Blame History