From 034137c0d96aa496a5ef4265d98f04703c7c2b97 Mon Sep 17 00:00:00 2001 From: Fabio Scotto di Santolo Date: Mon, 20 Jul 2026 14:39:16 +0200 Subject: [PATCH] Align Fedora GNOME desktop packages --- .../inventory/group_vars/desktop_gnome.yml | 20 +++++++- ansible/inventory/host_vars/nymph.yml | 7 +-- ansible/roles/packages_fedora/tasks/main.yml | 51 +++++++++++++++++++ .../profile_desktop_gnome/tasks/main.yml | 36 +++++++++---- 4 files changed, 97 insertions(+), 17 deletions(-) diff --git a/ansible/inventory/group_vars/desktop_gnome.yml b/ansible/inventory/group_vars/desktop_gnome.yml index 03e589a..8fb7b83 100644 --- a/ansible/inventory/group_vars/desktop_gnome.yml +++ b/ansible/inventory/group_vars/desktop_gnome.yml @@ -9,12 +9,14 @@ desktop_default_session: gnome fedora_desktop_packages: # Fedora equivalents of the development/tooling packages previously pulled by # the Void desktop profile. + - 7zip - nodejs-bash-language-server - bluez - bridge-utils - ctags - delve - dnsmasq + - fastfetch - poppler-glib - poppler-utils - fontconfig-devel @@ -34,26 +36,42 @@ fedora_desktop_packages: - mpv - pdfarranger - pinentry-gnome3 + - plocate - playerctl + - podman-compose - qemu - qemu-img - qemu-tools + - rclone - remmina + - ruff - rustup - rsync - shfmt - - ruff + - syncthing + - tealdeer - terminus-fonts - texlive + - tmux - ty - uv - virt-manager - virt-install - wireplumber + - yt-dlp - zstd +fedora_nerd_fonts_version: v3.3.0 +fedora_nerd_fonts: + - Hack + - UbuntuSans + - NerdFontsSymbolsOnly + fedora_flatpak_packages: + - be.alexandervanhee.gradia - ch.protonmail.protonmail-bridge + - com.spotify.Client - org.mozilla.thunderbird + - org.telegram.desktop fedora_npm_packages: "{{ ai_agents_npm_packages }}" diff --git a/ansible/inventory/host_vars/nymph.yml b/ansible/inventory/host_vars/nymph.yml index b90c57e..acfdedd 100644 --- a/ansible/inventory/host_vars/nymph.yml +++ b/ansible/inventory/host_vars/nymph.yml @@ -4,10 +4,5 @@ hostname: nymph # Fedora Workstation/GNOME laptop target. GNOME is provided by the base Fedora # Workstation install; Ansible deploys shared desktop dotfiles but leaves GNOME # settings unmanaged for now. -host_packages: - - rclone - - syncthing -host_flatpak_packages: - - com.spotify.Client - - org.telegram.desktop +host_packages: [] host_enabled_services: [] diff --git a/ansible/roles/packages_fedora/tasks/main.yml b/ansible/roles/packages_fedora/tasks/main.yml index c47d9af..758063e 100644 --- a/ansible/roles/packages_fedora/tasks/main.yml +++ b/ansible/roles/packages_fedora/tasks/main.yml @@ -178,3 +178,54 @@ remote: "{{ fedora_flatpak_remote_name | default('flathub') }}" method: system when: (packages_fedora_flatpak_packages | default([])) | length > 0 + +- name: Ensure Fedora Nerd Fonts base directory exists + tags: [packages, fonts] + ansible.builtin.file: + path: /usr/local/share/fonts/nerd-fonts + state: directory + owner: root + group: root + mode: "0755" + when: (fedora_nerd_fonts | default([])) | length > 0 + +- name: Ensure Fedora per-font Nerd Fonts directories exist + tags: [packages, fonts] + ansible.builtin.file: + path: "/usr/local/share/fonts/nerd-fonts/{{ item }}" + state: directory + owner: root + group: root + mode: "0755" + loop: "{{ fedora_nerd_fonts | default([]) }}" + +- name: Download Fedora Nerd Font archives + tags: [packages, fonts] + ansible.builtin.get_url: + url: "https://github.com/ryanoasis/nerd-fonts/releases/download/{{ fedora_nerd_fonts_version }}/{{ item }}.zip" + dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip" + owner: root + group: root + mode: "0644" + loop: "{{ fedora_nerd_fonts | default([]) }}" + loop_control: + label: "{{ item }}" + +- name: Extract Fedora Nerd Font archives + tags: [packages, fonts] + ansible.builtin.unarchive: + src: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip" + dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}" + remote_src: true + owner: root + group: root + loop: "{{ fedora_nerd_fonts | default([]) }}" + loop_control: + label: "{{ item }}" + register: fedora_nerd_fonts_extract + +- name: Refresh system font cache after installing Fedora Nerd Fonts + tags: [packages, fonts] + ansible.builtin.command: fc-cache -f + changed_when: false + when: fedora_nerd_fonts_extract is changed diff --git a/ansible/roles/profile_desktop_gnome/tasks/main.yml b/ansible/roles/profile_desktop_gnome/tasks/main.yml index 1f71670..2497ae3 100644 --- a/ansible/roles/profile_desktop_gnome/tasks/main.yml +++ b/ansible/roles/profile_desktop_gnome/tasks/main.yml @@ -99,18 +99,34 @@ or (host_sshd_allow_users | default([])) | length > 0 - not gnome_ssh_host_ed25519_key.stat.exists -- name: Require authorized SSH keys before disabling password authentication on GNOME desktop +- name: Define safe GNOME SSH daemon settings tags: [services, gnome] - ansible.builtin.assert: - that: - - (host_authorized_ssh_keys | default([])) | length > 0 - fail_msg: >- - SSH password authentication is disabled for this host, but no authorized SSH - keys are defined. Set host_authorized_ssh_keys via vault variables before - applying this configuration. + ansible.builtin.set_fact: + gnome_sshd_settings_effective: >- + {{ + host_sshd_settings | default({}) + if ( + (host_authorized_ssh_keys | default([])) | length > 0 + or (host_sshd_settings | default({})).PasswordAuthentication | default('yes') != 'no' + ) + else ( + host_sshd_settings | default({}) | dict2items + | rejectattr('key', 'in', ['PasswordAuthentication', 'KbdInteractiveAuthentication']) + | items2dict + ) + }} + +- name: Warn when keeping SSH password authentication enabled on GNOME desktop + tags: [services, gnome] + ansible.builtin.debug: + msg: >- + SSH password authentication hardening was skipped because no authorized SSH + keys are defined for this host. Set host_authorized_ssh_keys via vault + variables, then re-run the playbook to disable password authentication. when: - "'sshd' in (host_enabled_services | default([]))" - (host_sshd_settings | default({})).PasswordAuthentication | default('yes') == 'no' + - (host_authorized_ssh_keys | default([])) | length == 0 - name: Ensure GNOME desktop user authorized_keys file exists tags: [services, dotfiles, gnome] @@ -141,10 +157,10 @@ state: present validate: "sshd -t -f %s" notify: Reload SSH service - loop: "{{ host_sshd_settings | default({}) | dict2items }}" + loop: "{{ gnome_sshd_settings_effective | default({}) | dict2items }}" loop_control: label: "{{ item.key }}" - when: (host_sshd_settings | default({})) | length > 0 + when: (gnome_sshd_settings_effective | default({})) | length > 0 - name: Restrict SSH login to allowed GNOME desktop users tags: [services, gnome]