mirror of
https://github.com/fscotto/infra.git
synced 2026-07-29 16:20:01 +00:00
Migrate ikaros to Fedora Workstation
This commit is contained in:
Fabio Scotto di Santolo
16
AGENTS.md
16
AGENTS.md
@@ -1,6 +1,6 @@
|
||||
# AGENTS.md
|
||||
|
||||
Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux Mint and FreeBSD transition targets, Linux workstations, WSL, and an Ubuntu server.
|
||||
Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux Mint and FreeBSD transition targets, WSL, and an Ubuntu server.
|
||||
|
||||
## Source Of Truth
|
||||
- Main orchestration: `ansible/site.yml`
|
||||
@@ -11,11 +11,10 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
|
||||
- Codex config is rendered from `dotfiles/common/.codex/config.toml.j2` so `model_instructions_file` points to the deployed `~/.config/ai/bootstrap.md`.
|
||||
|
||||
## Topology
|
||||
- Current personal desktop: `ikaros = platform_mint + role_personal_workstation + desktop_cinnamon`
|
||||
- Current personal desktop: `ikaros = platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome`
|
||||
- Current laptop: `nymph = platform_fedora + graphical_desktop + desktop_gnome`
|
||||
- Void desktop profile is also the base for other future/reference hosts via `platform_void + graphical_desktop`
|
||||
- Native Linux workstation: `deadalus-fedora`
|
||||
- WSL dev: `deadalus-wsl`
|
||||
- Workstation: `deadalus` is Windows + WSL; Ansible target is `deadalus-wsl`
|
||||
- Ubuntu server: `prometheus`
|
||||
- Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
|
||||
- Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
|
||||
@@ -37,9 +36,8 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
|
||||
- `ansible-lint ansible/roles`
|
||||
- `yamllint ansible/`
|
||||
- Host-focused dry runs:
|
||||
- Mint desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff`
|
||||
- Fedora desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff`
|
||||
- Fedora laptop work: `ansible-playbook ansible/site.yml --limit nymph --check --diff`
|
||||
- Fedora workstation: `ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff`
|
||||
- WSL dev: `ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff`
|
||||
- Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
|
||||
- Focused checks:
|
||||
@@ -67,7 +65,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
|
||||
- `dotfiles/desktop/.config/hypr/hyprland.conf` plus `host.conf` and `session-env` deployed via `host_hyprland_dotfiles` (Hyprland / Wayland)
|
||||
- `dotfiles/desktop/.config/niri/config.kdl` and `session-env` deployed via `desktop_niri_dotfiles` (Niri / Wayland)
|
||||
- Void Niri lives in `profile_desktop_niri`, gated on `'niri' in desktop_sessions_enabled`; it installs the `emptty` `niri.desktop` session, the `/usr/local/bin/start-niri` launcher, and the xdg-desktop-portal config, mirroring `profile_desktop_sway`.
|
||||
- Fedora GNOME (`desktop_gnome`) assumes GNOME comes from the Fedora Workstation base install; Ansible only deploys shared desktop dotfiles and git/GPG config for `nymph`, not GNOME settings.
|
||||
- Fedora GNOME (`desktop_gnome`) assumes GNOME comes from the Fedora Workstation base install; Ansible deploys shared desktop dotfiles and git/GPG config for `ikaros` and `nymph`, not GNOME settings.
|
||||
- FreeBSD Niri (dormant; `platform_freebsd` currently has no hosts) must keep FreeBSD-specific package, rc, DBus, seat, portal, and launcher behavior in `profile_desktop_niri_freebsd` or FreeBSD platform vars.
|
||||
- Do not switch or restart a display manager during a playbook run from an active graphical session. Changing among `emptty`, LightDM, and SDDM requires an explicit run from another TTY/SSH session with `desktop_allow_display_manager_switch=true`. Apply managed XFCE XML while logged out of XFCE so `xfconfd` cannot overwrite it from its in-memory state.
|
||||
- `nymph` is the Fedora/GNOME laptop target; keep GNOME settings unmanaged for now and add host-specific tuning only after real use.
|
||||
@@ -83,8 +81,8 @@ The Void desktop package lists in `ansible/inventory/group_vars/void.yml` are ke
|
||||
The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-independent content, `desktop_minimal_dotfiles` carries Thunar, Udiskie, and minimal MIME defaults, and `desktop_xfce_dotfiles` carries XFCE state. KDE uses its own MIME defaults. `desktop_void_dotfiles` remains reserved for files that need the Void runtime.
|
||||
|
||||
## Workstation Notes
|
||||
- Native Linux workstation hosts can combine `workstation_host_linux` with an OS-specific dev group.
|
||||
- `deadalus-fedora` keeps GNOME managed settings in `ansible/inventory/host_vars/deadalus-fedora.yml`.
|
||||
- `deadalus` is modeled as Windows + WSL; keep Linux dev automation on `deadalus-wsl`.
|
||||
- Native Linux workstation groups remain available for future hosts but have no current host in the main inventory.
|
||||
|
||||
## Coding Agent Notes
|
||||
- Shared agent packages live in `ai_agents_npm_packages` in `ansible/inventory/group_vars/all.yml`.
|
||||
|
||||
@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
|
||||
|
||||
## What this repo is
|
||||
|
||||
Ansible-driven personal infrastructure as code for Void Linux desktops (`ikaros`, `nymph`), Linux workstations (`deadalus-fedora`, `deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions.
|
||||
Ansible-driven personal infrastructure as code for Fedora desktops (`ikaros`, `nymph`), WSL development (`deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions.
|
||||
|
||||
## Validation commands
|
||||
|
||||
@@ -15,7 +15,6 @@ ansible-playbook ansible/site.yml --syntax-check
|
||||
# Dry-run per host
|
||||
ansible-playbook ansible/site.yml --limit ikaros --check --diff
|
||||
ansible-playbook ansible/site.yml --limit nymph --check --diff
|
||||
ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff
|
||||
ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
|
||||
ansible-playbook ansible/site.yml --limit prometheus --check --diff
|
||||
|
||||
|
||||
31
README.md
31
README.md
@@ -70,7 +70,7 @@ Matrice target:
|
||||
|
||||
| Host | Platform | Role | Desktop |
|
||||
| -------------- | ---------- | -------------------- | --------------------------------- |
|
||||
| ikaros | Linux Mint | Personal workstation | Cinnamon |
|
||||
| ikaros | Fedora | Personal workstation | GNOME |
|
||||
| nymph | Fedora | Desktop laptop | GNOME |
|
||||
| void-reference | Void Linux | Lab/reference | Current preserved desktop profile |
|
||||
|
||||
@@ -81,8 +81,8 @@ ikaros must be boring
|
||||
nymph is allowed to break
|
||||
```
|
||||
|
||||
`ikaros` usa il target stabile Linux Mint/Cinnamon; `nymph` usa il target
|
||||
Fedora Workstation/GNOME. I gruppi legacy `void` e `desktop` restano alias di
|
||||
`ikaros` usa Fedora Workstation/GNOME come desktop personale stabile; `nymph` usa lo stesso
|
||||
target Fedora Workstation/GNOME come laptop. I gruppi legacy `void` e `desktop` restano alias di
|
||||
compatibilita per eventuali host Void futuri mentre i nuovi assi sono
|
||||
`platform_*`, `role_*` e `desktop_*`.
|
||||
|
||||
@@ -96,8 +96,7 @@ git tag void-desktop-before-platform-refactor
|
||||
|
||||
Nota sullo stato attuale del playbook principale:
|
||||
|
||||
- `ansible/site.yml` applica oggi in automatico Cinnamon su Linux Mint e Niri su FreeBSD
|
||||
- `ansible/site.yml` applica la workstation Linux nativa separando il layer dev comune dal layer host GNOME
|
||||
- `ansible/site.yml` applica oggi in automatico GNOME su Fedora e Niri su FreeBSD
|
||||
- `ansible/site.yml` applica anche il ramo `workstation_dev_wsl` per il modello dev in WSL
|
||||
- `ansible/site.yml` applica anche il profilo `ubuntu_server` con baseline apt, systemd, dotfiles server e firewall UFW
|
||||
|
||||
@@ -105,7 +104,7 @@ Nota sullo stato attuale del playbook principale:
|
||||
|
||||
Target operativi:
|
||||
|
||||
- `ikaros`: Linux Mint + Cinnamon, desktop personale stabile/floating.
|
||||
- `ikaros`: Fedora Workstation + GNOME, desktop personale stabile/floating.
|
||||
- `nymph`: Fedora Workstation + GNOME, laptop desktop con dotfiles desktop condivisi e GNOME lasciato al default Fedora.
|
||||
|
||||
Il profilo Void desktop resta disponibile come modello riutilizzabile per host
|
||||
@@ -150,8 +149,7 @@ Desktop environment host Linux:
|
||||
|
||||
Macchine attuali:
|
||||
|
||||
- `deadalus-fedora` come workstation Fedora nativa
|
||||
- `deadalus-wsl` come ambiente dev Ubuntu in WSL
|
||||
- `deadalus-wsl` come ambiente dev Ubuntu in WSL sulla workstation Windows `deadalus`
|
||||
|
||||
Questo profilo è pensato per sviluppo e lavoro, con separazione tra layer host e layer dev.
|
||||
|
||||
@@ -160,8 +158,8 @@ Nel modello Ansible usato qui, un singolo inventory host puo appartenere intenzi
|
||||
Il profilo workstation e agganciato al playbook principale e ora distingue:
|
||||
|
||||
- layer dev Ubuntu condiviso tra WSL e server
|
||||
- layer dev Fedora nativo
|
||||
- layer host Linux GNOME
|
||||
- layer dev Fedora nativo disponibile per host futuri
|
||||
- layer host Linux GNOME disponibile per host futuri
|
||||
- layer WSL dedicato per sviluppo con `systemd`
|
||||
|
||||
Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `workstation_dev_fedora`, a seconda del layering che vuoi comporre.
|
||||
@@ -175,8 +173,7 @@ Lo stato attuale del profilo workstation include:
|
||||
- installazione di Google Chrome su Fedora, `VS Code` su Fedora via repository RPM Microsoft, `IntelliJ IDEA Ultimate` su Fedora via COPR RPM, e applicazioni workstation residue su Fedora via Flatpak
|
||||
- estensioni GNOME sul solo host Linux nativo
|
||||
- preparazione del ramo WSL Ubuntu con `systemd` per il toolchain di sviluppo
|
||||
- attivazione del firewall `firewalld` su Fedora nativa
|
||||
- gestione di `gsettings` GNOME host-specifici su `deadalus-fedora`, inclusi shell, Files/Nautilus, file chooser GTK e GNOME Text Editor, allineati allo stato reale della macchina
|
||||
- attivazione del firewall `firewalld` su Fedora
|
||||
|
||||
Workflow WSL previsto:
|
||||
|
||||
@@ -251,7 +248,7 @@ common configuration
|
||||
Esempi correnti:
|
||||
|
||||
```text
|
||||
ikaros -> common + platform_mint + role_personal_workstation + desktop_cinnamon + ikaros
|
||||
ikaros -> common + platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome + ikaros
|
||||
nymph -> common + platform_fedora + graphical_desktop + desktop_gnome + nymph
|
||||
```
|
||||
|
||||
@@ -313,6 +310,7 @@ platform_freebsd -> packages_freebsd + services_freebsd
|
||||
platform_freebsd & role_lab -> profile_lab
|
||||
platform_freebsd & desktop_niri -> profile_desktop_niri_freebsd
|
||||
platform_fedora -> packages_fedora + services_systemd
|
||||
platform_fedora & role_personal_workstation -> profile_personal_workstation
|
||||
platform_fedora & desktop_gnome -> profile_desktop_gnome
|
||||
workstation_dev_fedora -> profile_workstation_dev_common
|
||||
workstation_host_linux -> profile_workstation_gnome
|
||||
@@ -322,10 +320,9 @@ ubuntu_server -> packages_ubuntu + services_systemd + profile_server
|
||||
|
||||
Questo significa che, allo stato attuale:
|
||||
|
||||
- `ikaros` riceve Linux Mint/Cinnamon come target stabile
|
||||
- `ikaros` riceve Fedora Workstation/GNOME come target desktop personale stabile
|
||||
- `nymph` riceve Fedora Workstation/GNOME come target laptop
|
||||
- il profilo Void resta selezionabile tramite `platform_void + graphical_desktop` per host futuri
|
||||
- la workstation Fedora (`deadalus-fedora`) usa il principio di composizione a gruppi con il ramo Fedora dedicato e con `gsettings` host-specifici dichiarati in inventory
|
||||
- il ramo WSL (`deadalus-wsl`) e predisposto con play dev dedicato
|
||||
- il server Ubuntu (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewall
|
||||
- lo stack container server include `navidrome`, `postgres`, `gitea`, `nginx-proxy-manager` e `syncthing`, con GUI Syncthing raggiungibile tramite la rete Docker `web`
|
||||
@@ -417,7 +414,6 @@ ansible-playbook ansible/site.yml --syntax-check
|
||||
ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff
|
||||
ansible-playbook ansible/site.yml --limit ikaros --check --diff
|
||||
ansible-playbook ansible/site.yml --limit nymph --check --diff
|
||||
ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff
|
||||
ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
|
||||
ansible-playbook ansible/site.yml --limit prometheus --check --diff
|
||||
ansible-lint ansible/site.yml
|
||||
@@ -488,8 +484,7 @@ Esempi pratici:
|
||||
|
||||
```bash
|
||||
ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,niri --check --diff
|
||||
ansible-playbook ansible/site.yml --limit ikaros --tags cinnamon --check --diff
|
||||
ansible-playbook ansible/site.yml --limit deadalus-fedora --tags packages,vscode --check --diff
|
||||
ansible-playbook ansible/site.yml --limit ikaros --tags gnome --check --diff
|
||||
ansible-playbook ansible/site.yml --limit prometheus --tags services,dotfiles:server --check --diff
|
||||
```
|
||||
|
||||
|
||||
@@ -19,6 +19,7 @@ fedora_desktop_packages:
|
||||
- poppler-utils
|
||||
- fontconfig-devel
|
||||
- freetype-devel
|
||||
- gh
|
||||
- golang
|
||||
- golangci-lint
|
||||
- gopls
|
||||
|
||||
@@ -1,177 +0,0 @@
|
||||
---
|
||||
hostname: deadalus-fedora
|
||||
|
||||
host_packages: []
|
||||
host_enabled_services:
|
||||
- docker
|
||||
workstation_firewall_backend: firewalld
|
||||
|
||||
workstation_host_vscode_extensions:
|
||||
- ms-vscode-remote.remote-containers
|
||||
- ms-vscode-remote.remote-ssh
|
||||
- ms-azuretools.vscode-docker
|
||||
- redhat.vscode-yaml
|
||||
- redhat.ansible
|
||||
|
||||
workstation_gnome_managed_settings:
|
||||
- schema: org.gnome.shell
|
||||
key: favorite-apps
|
||||
value: "['google-chrome.desktop', 'org.gnome.Nautilus.desktop', 'com.spotify.Client.desktop', 'org.mozilla.Thunderbird.desktop', 'org.telegram.desktop.desktop', 'code.desktop', 'intellij-idea-ultimate.desktop', 'io.dbeaver.DBeaverCommunity.desktop', 'com.getpostman.Postman.desktop', 'org.gnome.Ptyxis.desktop']"
|
||||
- schema: org.gnome.shell
|
||||
key: app-picker-layout
|
||||
value: "[{'6f4bfcaf-700e-4fe3-8fd2-4a3e6fc46bcf': <{'position': <0>}>, 'System': <{'position': <1>}>, 'Utilities': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Weather.desktop': <{'position': <4>}>, 'org.gnome.clocks.desktop': <{'position': <5>}>, 'org.gnome.Maps.desktop': <{'position': <6>}>, 'org.gnome.SimpleScan.desktop': <{'position': <7>}>, 'org.gnome.Settings.desktop': <{'position': <8>}>, 'org.gnome.Boxes.desktop': <{'position': <9>}>, 'org.gnome.Showtime.desktop': <{'position': <10>}>, 'org.gnome.Snapshot.desktop': <{'position': <11>}>, 'org.gnome.Characters.desktop': <{'position': <12>}>, 'org.gnome.Calculator.desktop': <{'position': <13>}>, 'org.gnome.Calendar.desktop': <{'position': <14>}>, 'org.gnome.TextEditor.desktop': <{'position': <15>}>, 'org.gnome.Meld.desktop': <{'position': <16>}>, 'org.gnome.tweaks.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>}]"
|
||||
- schema: org.gnome.desktop.input-sources
|
||||
key: sources
|
||||
value: "[('xkb', 'us')]"
|
||||
- schema: org.gnome.desktop.interface
|
||||
key: color-scheme
|
||||
value: "'prefer-dark'"
|
||||
- schema: org.gnome.desktop.privacy
|
||||
key: report-technical-problems
|
||||
value: "false"
|
||||
- schema: org.gnome.desktop.wm.preferences
|
||||
key: button-layout
|
||||
value: "'appmenu:minimize,maximize,close'"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: click-policy
|
||||
value: "'double'"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: date-time-format
|
||||
value: "'simple'"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: default-folder-viewer
|
||||
value: "'icon-view'"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: default-sort-order
|
||||
value: "'name'"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: recursive-search
|
||||
value: "'local-only'"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: show-create-link
|
||||
value: "true"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: show-delete-permanently
|
||||
value: "true"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: show-directory-item-counts
|
||||
value: "'local-only'"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: show-hidden-files
|
||||
value: "false"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: show-image-thumbnails
|
||||
value: "'local-only'"
|
||||
- schema: org.gnome.nautilus.preferences
|
||||
key: thumbnail-limit
|
||||
value: "uint64 50"
|
||||
- schema: org.gnome.nautilus.icon-view
|
||||
key: captions
|
||||
value: "['none', 'none', 'none']"
|
||||
- schema: org.gnome.nautilus.icon-view
|
||||
key: default-zoom-level
|
||||
value: "'medium'"
|
||||
- schema: org.gtk.Settings.FileChooser
|
||||
key: clock-format
|
||||
value: "'24h'"
|
||||
- schema: org.gtk.Settings.FileChooser
|
||||
key: date-format
|
||||
value: "'regular'"
|
||||
- schema: org.gtk.Settings.FileChooser
|
||||
key: location-mode
|
||||
value: "'path-bar'"
|
||||
- schema: org.gtk.Settings.FileChooser
|
||||
key: show-hidden
|
||||
value: "false"
|
||||
- schema: org.gtk.Settings.FileChooser
|
||||
key: show-size-column
|
||||
value: "true"
|
||||
- schema: org.gtk.Settings.FileChooser
|
||||
key: show-type-column
|
||||
value: "true"
|
||||
- schema: org.gtk.Settings.FileChooser
|
||||
key: sort-column
|
||||
value: "'name'"
|
||||
- schema: org.gtk.gtk4.Settings.FileChooser
|
||||
key: clock-format
|
||||
value: "'24h'"
|
||||
- schema: org.gtk.gtk4.Settings.FileChooser
|
||||
key: date-format
|
||||
value: "'regular'"
|
||||
- schema: org.gtk.gtk4.Settings.FileChooser
|
||||
key: location-mode
|
||||
value: "'path-bar'"
|
||||
- schema: org.gtk.gtk4.Settings.FileChooser
|
||||
key: show-hidden
|
||||
value: "false"
|
||||
- schema: org.gtk.gtk4.Settings.FileChooser
|
||||
key: show-size-column
|
||||
value: "true"
|
||||
- schema: org.gtk.gtk4.Settings.FileChooser
|
||||
key: show-type-column
|
||||
value: "true"
|
||||
- schema: org.gtk.gtk4.Settings.FileChooser
|
||||
key: sort-column
|
||||
value: "'name'"
|
||||
- schema: org.gtk.gtk4.Settings.FileChooser
|
||||
key: sort-directories-first
|
||||
value: "true"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: auto-indent
|
||||
value: "true"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: highlight-matching-brackets
|
||||
value: "true"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: indent-style
|
||||
value: "'tab'"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: keybindings
|
||||
value: "'default'"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: restore-session
|
||||
value: "true"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: show-line-numbers
|
||||
value: "false"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: spellcheck
|
||||
value: "true"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: style-scheme
|
||||
value: "'Adwaita'"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: style-variant
|
||||
value: "'follow'"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: use-system-font
|
||||
value: "true"
|
||||
- schema: org.gnome.TextEditor
|
||||
key: wrap-text
|
||||
value: "true"
|
||||
- schema: org.gnome.desktop.background
|
||||
key: picture-uri
|
||||
value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-l.jxl'"
|
||||
- schema: org.gnome.desktop.background
|
||||
key: picture-uri-dark
|
||||
value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-d.jxl'"
|
||||
|
||||
workstation_gnome_extension_dconf_settings:
|
||||
- path: /org/gnome/shell/extensions/paperwm/
|
||||
key: selection-border-radius-bottom
|
||||
value: "15"
|
||||
- path: /org/gnome/shell/extensions/paperwm/
|
||||
key: selection-border-radius-top
|
||||
value: "15"
|
||||
- path: /org/gnome/shell/extensions/paperwm/
|
||||
key: selection-border-size
|
||||
value: "5"
|
||||
- path: /org/gnome/shell/extensions/paperwm/
|
||||
key: show-window-position-bar
|
||||
value: "false"
|
||||
- path: /org/gnome/shell/extensions/paperwm/
|
||||
key: show-workspace-indicator
|
||||
value: "false"
|
||||
- path: /org/gnome/shell/extensions/paperwm/
|
||||
key: window-gap
|
||||
value: "10"
|
||||
@@ -2,16 +2,12 @@
|
||||
hostname: ikaros
|
||||
|
||||
host_packages:
|
||||
- openssh-client
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- mesa-vulkan-drivers
|
||||
- xserver-xorg-video-amdgpu
|
||||
|
||||
host_ufw_rules:
|
||||
- rule: allow
|
||||
port: "22"
|
||||
proto: tcp
|
||||
src: "192.168.0.0/24"
|
||||
host_firewalld_rich_rules:
|
||||
- rule family="ipv4" source address="192.168.0.0/24" service name="ssh" accept
|
||||
|
||||
host_sshd_settings:
|
||||
PermitRootLogin: "no"
|
||||
@@ -25,4 +21,4 @@ host_sshd_allow_users:
|
||||
host_authorized_ssh_keys: "{{ vault_ikaros_authorized_ssh_keys | default([]) }}"
|
||||
|
||||
host_enabled_services:
|
||||
- ssh
|
||||
- sshd
|
||||
|
||||
@@ -6,15 +6,13 @@ all:
|
||||
|
||||
platform_fedora:
|
||||
hosts:
|
||||
nymph:
|
||||
ikaros:
|
||||
ansible_connection: local
|
||||
deadalus-fedora:
|
||||
nymph:
|
||||
ansible_connection: local
|
||||
|
||||
platform_mint:
|
||||
hosts:
|
||||
ikaros:
|
||||
ansible_connection: local
|
||||
hosts: {}
|
||||
|
||||
platform_freebsd:
|
||||
hosts: {}
|
||||
@@ -57,13 +55,13 @@ all:
|
||||
|
||||
desktop_gnome:
|
||||
hosts:
|
||||
ikaros:
|
||||
ansible_connection: local
|
||||
nymph:
|
||||
ansible_connection: local
|
||||
|
||||
desktop_cinnamon:
|
||||
hosts:
|
||||
ikaros:
|
||||
ansible_connection: local
|
||||
hosts: {}
|
||||
|
||||
ubuntu:
|
||||
children:
|
||||
@@ -89,19 +87,13 @@ all:
|
||||
ubuntu_server:
|
||||
|
||||
fedora_workstation:
|
||||
hosts:
|
||||
deadalus-fedora:
|
||||
ansible_connection: local
|
||||
hosts: {}
|
||||
|
||||
workstation_host_linux:
|
||||
hosts:
|
||||
deadalus-fedora:
|
||||
ansible_connection: local
|
||||
hosts: {}
|
||||
|
||||
workstation_dev_fedora:
|
||||
hosts:
|
||||
deadalus-fedora:
|
||||
ansible_connection: local
|
||||
hosts: {}
|
||||
|
||||
workstation_dev_wsl:
|
||||
hosts:
|
||||
|
||||
@@ -190,12 +190,27 @@
|
||||
loop: "{{ desktop_ufw_rules_effective }}"
|
||||
loop_control:
|
||||
label: "{{ item.name | default(item.port) }}"
|
||||
when: workstation_firewall_backend | default('ufw') == 'ufw'
|
||||
|
||||
- name: Enable UFW firewall on desktop when host rules are defined
|
||||
tags: [services, packages]
|
||||
community.general.ufw:
|
||||
state: enabled
|
||||
when: (desktop_ufw_rules_effective | default([])) | length > 0
|
||||
when:
|
||||
- workstation_firewall_backend | default('ufw') == 'ufw'
|
||||
- (desktop_ufw_rules_effective | default([])) | length > 0
|
||||
|
||||
- name: Apply host firewalld rich rules on desktop
|
||||
tags: [services, packages]
|
||||
ansible.posix.firewalld:
|
||||
rich_rule: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
loop: "{{ host_firewalld_rich_rules | default([]) }}"
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when: workstation_firewall_backend | default('ufw') == 'firewalld'
|
||||
|
||||
- name: Check whether libvirt service directory exists
|
||||
tags: [packages, services]
|
||||
|
||||
@@ -9,3 +9,8 @@
|
||||
environment:
|
||||
HOME: "{{ user_home }}"
|
||||
changed_when: false
|
||||
|
||||
- name: Reload SSH service
|
||||
ansible.builtin.systemd:
|
||||
name: sshd
|
||||
state: reloaded
|
||||
|
||||
@@ -80,3 +80,91 @@
|
||||
owner: "{{ username }}"
|
||||
group: "{{ user_group }}"
|
||||
mode: "0644"
|
||||
|
||||
- name: Check whether SSH host ed25519 key exists on GNOME desktop
|
||||
tags: [services, gnome]
|
||||
ansible.builtin.stat:
|
||||
path: /etc/ssh/ssh_host_ed25519_key
|
||||
register: gnome_ssh_host_ed25519_key
|
||||
when:
|
||||
- (host_sshd_settings | default({})) | length > 0
|
||||
or (host_sshd_allow_users | default([])) | length > 0
|
||||
|
||||
- name: Generate missing SSH host keys on GNOME desktop
|
||||
tags: [services, gnome]
|
||||
ansible.builtin.command: ssh-keygen -A
|
||||
changed_when: true
|
||||
when:
|
||||
- (host_sshd_settings | default({})) | length > 0
|
||||
or (host_sshd_allow_users | default([])) | length > 0
|
||||
- not gnome_ssh_host_ed25519_key.stat.exists
|
||||
|
||||
- name: Require authorized SSH keys before disabling password authentication on GNOME desktop
|
||||
tags: [services, gnome]
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- (host_authorized_ssh_keys | default([])) | length > 0
|
||||
fail_msg: >-
|
||||
SSH password authentication is disabled for this host, but no authorized SSH
|
||||
keys are defined. Set host_authorized_ssh_keys via vault variables before
|
||||
applying this configuration.
|
||||
when:
|
||||
- "'sshd' in (host_enabled_services | default([]))"
|
||||
- (host_sshd_settings | default({})).PasswordAuthentication | default('yes') == 'no'
|
||||
|
||||
- name: Ensure GNOME desktop user authorized_keys file exists
|
||||
tags: [services, dotfiles, gnome]
|
||||
ansible.builtin.file:
|
||||
path: "{{ user_home }}/.ssh/authorized_keys"
|
||||
state: touch
|
||||
owner: "{{ username }}"
|
||||
group: "{{ user_group }}"
|
||||
mode: "0600"
|
||||
when: (host_authorized_ssh_keys | default([])) | length > 0
|
||||
|
||||
- name: Manage GNOME desktop user authorized SSH keys exclusively
|
||||
tags: [services, dotfiles, gnome]
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ username }}"
|
||||
key: "{{ host_authorized_ssh_keys | join('\n') }}"
|
||||
state: present
|
||||
exclusive: true
|
||||
manage_dir: false
|
||||
when: (host_authorized_ssh_keys | default([])) | length > 0
|
||||
|
||||
- name: Apply SSH daemon settings on GNOME desktop
|
||||
tags: [services, gnome]
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^\s*{{ item.key }}\s+'
|
||||
line: "{{ item.key }} {{ item.value }}"
|
||||
state: present
|
||||
validate: "sshd -t -f %s"
|
||||
notify: Reload SSH service
|
||||
loop: "{{ host_sshd_settings | default({}) | dict2items }}"
|
||||
loop_control:
|
||||
label: "{{ item.key }}"
|
||||
when: (host_sshd_settings | default({})) | length > 0
|
||||
|
||||
- name: Restrict SSH login to allowed GNOME desktop users
|
||||
tags: [services, gnome]
|
||||
ansible.builtin.lineinfile:
|
||||
path: /etc/ssh/sshd_config
|
||||
regexp: '^\s*AllowUsers\s+'
|
||||
line: "AllowUsers {{ host_sshd_allow_users | join(' ') }}"
|
||||
state: present
|
||||
validate: "sshd -t -f %s"
|
||||
notify: Reload SSH service
|
||||
when: (host_sshd_allow_users | default([])) | length > 0
|
||||
|
||||
- name: Apply host firewalld rich rules on GNOME desktop
|
||||
tags: [services, packages, gnome]
|
||||
ansible.posix.firewalld:
|
||||
rich_rule: "{{ item }}"
|
||||
permanent: true
|
||||
immediate: true
|
||||
state: enabled
|
||||
loop: "{{ host_firewalld_rich_rules | default([]) }}"
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
when: workstation_firewall_backend | default('firewalld') == 'firewalld'
|
||||
|
||||
@@ -102,6 +102,13 @@
|
||||
- packages_fedora
|
||||
- services_systemd
|
||||
|
||||
- name: Configure personal workstation role on Fedora
|
||||
hosts: platform_fedora:&role_personal_workstation
|
||||
become: true
|
||||
|
||||
roles:
|
||||
- profile_personal_workstation
|
||||
|
||||
- name: Configure Fedora GNOME desktop
|
||||
hosts: platform_fedora:&desktop_gnome
|
||||
become: true
|
||||
|
||||
Reference in New Issue
Block a user