Align Fedora GNOME desktop packages

ansible/inventory/group_vars/desktop_gnome.yml

@@ -9,12 +9,14 @@ desktop_default_session: gnome
 fedora_desktop_packages:
   # Fedora equivalents of the development/tooling packages previously pulled by
   # the Void desktop profile.
+  - 7zip
   - nodejs-bash-language-server
   - bluez
   - bridge-utils
   - ctags
   - delve
   - dnsmasq
+  - fastfetch
   - poppler-glib
   - poppler-utils
   - fontconfig-devel
@@ -34,26 +36,42 @@ fedora_desktop_packages:
   - mpv
   - pdfarranger
   - pinentry-gnome3
+  - plocate
   - playerctl
+  - podman-compose
   - qemu
   - qemu-img
   - qemu-tools
+  - rclone
   - remmina
+  - ruff
   - rustup
   - rsync
   - shfmt
-  - ruff
+  - syncthing
+  - tealdeer
   - terminus-fonts
   - texlive
+  - tmux
   - ty
   - uv
   - virt-manager
   - virt-install
   - wireplumber
+  - yt-dlp
   - zstd
 
+fedora_nerd_fonts_version: v3.3.0
+fedora_nerd_fonts:
+  - Hack
+  - UbuntuSans
+  - NerdFontsSymbolsOnly
+
 fedora_flatpak_packages:
+  - be.alexandervanhee.gradia
   - ch.protonmail.protonmail-bridge
+  - com.spotify.Client
   - org.mozilla.thunderbird
+  - org.telegram.desktop
 
 fedora_npm_packages: "{{ ai_agents_npm_packages }}"

ansible/inventory/host_vars/nymph.yml

@@ -4,10 +4,5 @@ hostname: nymph
 # Fedora Workstation/GNOME laptop target. GNOME is provided by the base Fedora
 # Workstation install; Ansible deploys shared desktop dotfiles but leaves GNOME
 # settings unmanaged for now.
-host_packages:
-  - rclone
-  - syncthing
-host_flatpak_packages:
-  - com.spotify.Client
-  - org.telegram.desktop
+host_packages: []
 host_enabled_services: []

ansible/roles/packages_fedora/tasks/main.yml

@@ -178,3 +178,54 @@
     remote: "{{ fedora_flatpak_remote_name | default('flathub') }}"
     method: system
   when: (packages_fedora_flatpak_packages | default([])) | length > 0
+
+- name: Ensure Fedora Nerd Fonts base directory exists
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: /usr/local/share/fonts/nerd-fonts
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: (fedora_nerd_fonts | default([])) | length > 0
+
+- name: Ensure Fedora per-font Nerd Fonts directories exist
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+
+- name: Download Fedora Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.get_url:
+    url: "https://github.com/ryanoasis/nerd-fonts/releases/download/{{ fedora_nerd_fonts_version }}/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+
+- name: Extract Fedora Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.unarchive:
+    src: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    remote_src: true
+    owner: root
+    group: root
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  register: fedora_nerd_fonts_extract
+
+- name: Refresh system font cache after installing Fedora Nerd Fonts
+  tags: [packages, fonts]
+  ansible.builtin.command: fc-cache -f
+  changed_when: false
+  when: fedora_nerd_fonts_extract is changed

ansible/roles/profile_desktop_gnome/tasks/main.yml

@@ -99,18 +99,34 @@
       or (host_sshd_allow_users | default([])) | length > 0
     - not gnome_ssh_host_ed25519_key.stat.exists
 
-- name: Require authorized SSH keys before disabling password authentication on GNOME desktop
+- name: Define safe GNOME SSH daemon settings
   tags: [services, gnome]
-  ansible.builtin.assert:
-    that:
-      - (host_authorized_ssh_keys | default([])) | length > 0
-    fail_msg: >-
-      SSH password authentication is disabled for this host, but no authorized SSH
-      keys are defined. Set host_authorized_ssh_keys via vault variables before
-      applying this configuration.
+  ansible.builtin.set_fact:
+    gnome_sshd_settings_effective: >-
+      {{
+        host_sshd_settings | default({})
+        if (
+          (host_authorized_ssh_keys | default([])) | length > 0
+          or (host_sshd_settings | default({})).PasswordAuthentication | default('yes') != 'no'
+        )
+        else (
+          host_sshd_settings | default({}) | dict2items
+          | rejectattr('key', 'in', ['PasswordAuthentication', 'KbdInteractiveAuthentication'])
+          | items2dict
+        )
+      }}
+
+- name: Warn when keeping SSH password authentication enabled on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.debug:
+    msg: >-
+      SSH password authentication hardening was skipped because no authorized SSH
+      keys are defined for this host. Set host_authorized_ssh_keys via vault
+      variables, then re-run the playbook to disable password authentication.
   when:
     - "'sshd' in (host_enabled_services | default([]))"
     - (host_sshd_settings | default({})).PasswordAuthentication | default('yes') == 'no'
+    - (host_authorized_ssh_keys | default([])) | length == 0
 
 - name: Ensure GNOME desktop user authorized_keys file exists
   tags: [services, dotfiles, gnome]
@@ -141,10 +157,10 @@
     state: present
     validate: "sshd -t -f %s"
   notify: Reload SSH service
-  loop: "{{ host_sshd_settings | default({}) | dict2items }}"
+  loop: "{{ gnome_sshd_settings_effective | default({}) | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
-  when: (host_sshd_settings | default({})) | length > 0
+  when: (gnome_sshd_settings_effective | default({})) | length > 0
 
 - name: Restrict SSH login to allowed GNOME desktop users
   tags: [services, gnome]