n0mad1k
d4b7c356dc
- wg-quick runs under set -e; any non-zero exit kills the service - 2>/dev/null only hides stderr, doesn't change exit code — need || true - Split PostUp back to multiple lines (one command per line, cleaner) - Use Jinja2 vars instead of shell heredoc for interface/subnet values (quoted heredoc 'CONFEOF' prevents shell expansion issues, PrivateKey written separately via echo since it needs shell expansion) - Use -m conntrack --ctstate instead of deprecated -m state --state - Add config dump debug task to capture generated config on failure - Separate heredoc markers (CONFEOF/CLIENTEOF) to avoid conflicts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
phantom — Privacy Server Deployer
Deploy self-hosted privacy infrastructure with a single command. Supports cloud providers, existing servers, and local deployment.
Server Types
| Service | Status | Description |
|---|---|---|
| Matrix + Element | Ready | Encrypted messaging homeserver with web client |
| WireGuard VPN | Ready | Private VPN server with client config generation |
| Pi-hole DNS | Ready | Ad-blocking DNS server (native) |
| Nextcloud | Ready | Self-hosted file sync and collaboration |
| Vaultwarden | Ready | Self-hosted Bitwarden password manager |
| Jellyfin | Ready | Self-hosted media server |
| Mail-in-a-Box | Ready | Self-hosted email |
| All-in-One | Ready | Multiple services on one server with nginx reverse proxy |
Deployment Targets
- Linode — Automated provisioning via API
- AWS EC2 — Automated provisioning via API
- FlokiNET — Register pre-provisioned server
- Existing server — Any server with SSH access
- Local — Deploy directly on the current machine
Quick Start
# Requirements
pip install ansible pyyaml # or: apt install ansible python3-yaml
# For AWS deployments:
pip install boto3
ansible-galaxy collection install amazon.aws
# Launch
python3 phantom.py
Select a service, choose a deployment target, provide configuration, and phantom handles the rest:
- Provisions infrastructure (if cloud)
- Applies base hardening (UFW, fail2ban, SSH lockdown, kernel hardening)
- Deploys the selected service
- Saves deployment info to
logs/
All-in-One Deployment
The all-in-one option deploys multiple services on a single server with:
- Nginx reverse proxy with TLS termination
- Let's Encrypt certificates via Certbot
- Per-service vhost routing
Warning: Running multiple services on one server means a compromise of one service risks all services. Use for lab/testing or personal use where convenience outweighs isolation. For production, deploy one service per server.
Local Deployment
Select "Local (this machine)" as the deployment target to install services directly on your current system. This is useful for:
- Home lab servers
- Raspberry Pi deployments
- LAN-only services
- Testing before cloud deployment
No SSH key generation or remote provisioning is needed for local deployments.
Provider Setup
Linode
- Create an API token at https://cloud.linode.com/profile/tokens
- Select "Linode" when prompted and paste your token
AWS
- Create an IAM user with EC2 permissions
- Generate access keys
- Select "AWS" when prompted and provide credentials
FlokiNET
- Provision a server through FlokiNET's control panel
- Select "FlokiNET" and provide the server IP
Project Structure
phantom/
├── phantom.py # Main CLI
├── modules/ # Per-service configuration
├── playbooks/ # Ansible playbooks
│ ├── common/ # Shared hardening
│ ├── matrix/ # Synapse + Element
│ ├── vpn/ # WireGuard
│ ├── dns/ # Pi-hole
│ ├── cloud/ # Nextcloud
│ ├── vault/ # Vaultwarden
│ ├── media/ # Jellyfin
│ ├── email/ # Mail-in-a-Box
│ └── all_in_one/ # Multi-service composer
├── providers/ # Cloud provisioning
└── logs/ # Deployment artifacts
License
MIT