feat: add Aegis Fedora CoreOS profile

ansible/bootstrap/aegis.bu

@@ -0,0 +1,16 @@
+# Bootstrap monouso per Fedora CoreOS su Aegis.
+# Sostituire la chiave SSH prima di generare Ignition con butane --strict.
+variant: fcos
+version: 1.6.0
+passwd:
+  users:
+    - name: core
+      ssh_authorized_keys:
+        - "ssh-ed25519 CHANGEME_AEGIS_SSH_PUBLIC_KEY"
+storage:
+  files:
+    - path: /etc/hostname
+      mode: 0644
+      contents:
+        inline: |
+          aegis

ansible/inventory/group_vars/platform_fedora_coreos.yml

@@ -0,0 +1,2 @@
+---
+# Fedora CoreOS is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/host_vars/aegis.yml

@@ -0,0 +1,8 @@
+---
+ansible_host: aegis
+ansible_connection: ssh
+ansible_user: core
+ansible_become: true
+ansible_python_interpreter: /usr/bin/python3
+
+aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"

ansible/inventory/hosts.yml

@@ -13,6 +13,10 @@ all:
         deadalus:
           ansible_connection: local
 
+    platform_fedora_coreos:
+      hosts:
+        aegis:
+
     platform_rocky:
       hosts:
         atlas:
@@ -24,6 +28,7 @@ all:
     fedora:
       children:
         platform_fedora:
+        platform_fedora_coreos:
 
     rocky:
       children:
@@ -45,6 +50,10 @@ all:
         ikaros:
           ansible_connection: local
 
+    role_aegis:
+      hosts:
+        aegis:
+
     desktop_sway:
       hosts: {}
 

ansible/roles/profile_aegis/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+aegis_hostname: aegis
+aegis_adguard_image: docker.io/adguard/adguardhome:latest
+aegis_icloudpd_image: docker.io/boredazfcuk/icloudpd:latest
+aegis_icloudpd_folder_structure: '{:%Y/%m/%d}'
+aegis_icloudpd_synchronisation_interval: 86400
+aegis_icloudpd_apple_id: ""
+aegis_ikaros_mac_address: aa:bb:cc:dd:ee:ff
+aegis_wol_port: 9

ansible/roles/profile_aegis/handlers/main.yml

@@ -0,0 +1,11 @@
+---
+- name: Restart Aegis Quadlet services
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    state: restarted
+    daemon_reload: true
+  loop:
+    - adguardhome.service
+    - icloudpd.service
+  loop_control:
+    label: "{{ item }}"

ansible/roles/profile_aegis/tasks/main.yml

@@ -0,0 +1,77 @@
+---
+- name: Require Aegis iCloudPD Apple ID
+  tags: [aegis, icloudpd]
+  ansible.builtin.assert:
+    that:
+      - aegis_icloudpd_apple_id | length > 0
+    fail_msg: Define vault_aegis_icloudpd_apple_id before applying the Aegis profile.
+  no_log: true
+
+- name: Set Aegis hostname
+  tags: [aegis, services]
+  ansible.builtin.hostname:
+    name: "{{ aegis_hostname }}"
+
+- name: Create Aegis persistent container directories
+  tags: [aegis, containers]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - /var/lib/adguard/work
+    - /var/lib/adguard/conf
+    - /var/lib/icloudpd/data
+    - /var/lib/icloudpd/config
+
+- name: Create Quadlet configuration directory
+  tags: [aegis, containers]
+  ansible.builtin.file:
+    path: /etc/containers/systemd
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Render Aegis Quadlet units
+  tags: [aegis, containers]
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "/etc/containers/systemd/{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - src: adguardhome.container.j2
+      dest: adguardhome.container
+    - src: icloudpd.container.j2
+      dest: icloudpd.container
+  loop_control:
+    label: "{{ item.dest }}"
+  no_log: "{{ item.dest == 'icloudpd.container' }}"
+  notify: Restart Aegis Quadlet services
+
+- name: Install Wake-on-LAN helper for Ikaros
+  tags: [aegis, wol]
+  ansible.builtin.template:
+    src: wake-ikaros.j2
+    dest: /usr/local/bin/wake-ikaros
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Enable Aegis Quadlet services and automatic updates
+  tags: [aegis, containers, services]
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+    daemon_reload: true
+  loop:
+    - adguardhome.service
+    - icloudpd.service
+    - podman-auto-update.timer
+  loop_control:
+    label: "{{ item }}"

ansible/roles/profile_aegis/templates/adguardhome.container.j2

@@ -0,0 +1,18 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=AdGuard Home DNS sinkhole
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image={{ aegis_adguard_image }}
+Network=host
+Volume=/var/lib/adguard/work:/opt/adguardhome/work:Z
+Volume=/var/lib/adguard/conf:/opt/adguardhome/conf:Z
+AutoUpdate=registry
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_aegis/templates/icloudpd.container.j2

@@ -0,0 +1,20 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=iCloud Photos Downloader
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image={{ aegis_icloudpd_image }}
+Environment=apple_id={{ aegis_icloudpd_apple_id }}
+Environment=folder_structure={{ aegis_icloudpd_folder_structure }}
+Environment=synchronisation_interval={{ aegis_icloudpd_synchronisation_interval }}
+Volume=/var/lib/icloudpd/data:/home/root/iCloud:Z
+Volume=/var/lib/icloudpd/config:/config:Z
+AutoUpdate=registry
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_aegis/templates/wake-ikaros.j2

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Managed by Ansible. Do not edit manually.
+set -euo pipefail
+
+mac='{{ aegis_ikaros_mac_address }}'
+port='{{ aegis_wol_port }}'
+mac_hex="${mac//:/}"
+
+if [[ ! $mac_hex =~ ^[[:xdigit:]]{12}$ ]]; then
+  printf 'Indirizzo MAC non valido: %s\n' "$mac" >&2
+  exit 1
+fi
+
+packet='\xFF\xFF\xFF\xFF\xFF\xFF'
+for _ in {1..16}; do
+  packet+="$(printf '\\x%s\\x%s\\x%s\\x%s\\x%s\\x%s' \
+    "${mac_hex:0:2}" "${mac_hex:2:2}" "${mac_hex:4:2}" \
+    "${mac_hex:6:2}" "${mac_hex:8:2}" "${mac_hex:10:2}")"
+done
+
+printf '%b' "$packet" > "/dev/udp/255.255.255.255/${port}"

ansible/site.yml

@@ -33,7 +33,9 @@
 
   roles:
     - role: dotfiles_common
-      when: "'platform_rocky' not in group_names"
+      when:
+        - "'platform_rocky' not in group_names"
+        - "'platform_fedora_coreos' not in group_names"
 
 - name: Configure Void platform
   hosts: platform_void
@@ -69,6 +71,13 @@
     - packages_rocky
     - services_systemd
 
+- name: Configure Aegis Fedora CoreOS profile
+  hosts: role_aegis
+  become: true
+
+  roles:
+    - profile_aegis
+
 - name: Configure Atlas NAS profile
   hosts: atlas
   become: true