diff --git a/AGENTS.md b/AGENTS.md index c621bce..aea6316 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,6 +1,6 @@ # AGENTS.md -Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux Mint and FreeBSD transition targets, Linux workstations, WSL, and an Ubuntu server. +Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux Mint and FreeBSD transition targets, WSL, and an Ubuntu server. ## Source Of Truth - Main orchestration: `ansible/site.yml` @@ -11,11 +11,10 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux - Codex config is rendered from `dotfiles/common/.codex/config.toml.j2` so `model_instructions_file` points to the deployed `~/.config/ai/bootstrap.md`. ## Topology -- Current personal desktop: `ikaros = platform_mint + role_personal_workstation + desktop_cinnamon` +- Current personal desktop: `ikaros = platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome` - Current laptop: `nymph = platform_fedora + graphical_desktop + desktop_gnome` - Void desktop profile is also the base for other future/reference hosts via `platform_void + graphical_desktop` -- Native Linux workstation: `deadalus-fedora` -- WSL dev: `deadalus-wsl` +- Workstation: `deadalus` is Windows + WSL; Ansible target is `deadalus-wsl` - Ubuntu server: `prometheus` - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions. - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents. @@ -37,9 +36,8 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux - `ansible-lint ansible/roles` - `yamllint ansible/` - Host-focused dry runs: - - Mint desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff` + - Fedora desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff` - Fedora laptop work: `ansible-playbook ansible/site.yml --limit nymph --check --diff` - - Fedora workstation: `ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff` - WSL dev: `ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff` - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff` - Focused checks: @@ -67,7 +65,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux - `dotfiles/desktop/.config/hypr/hyprland.conf` plus `host.conf` and `session-env` deployed via `host_hyprland_dotfiles` (Hyprland / Wayland) - `dotfiles/desktop/.config/niri/config.kdl` and `session-env` deployed via `desktop_niri_dotfiles` (Niri / Wayland) - Void Niri lives in `profile_desktop_niri`, gated on `'niri' in desktop_sessions_enabled`; it installs the `emptty` `niri.desktop` session, the `/usr/local/bin/start-niri` launcher, and the xdg-desktop-portal config, mirroring `profile_desktop_sway`. -- Fedora GNOME (`desktop_gnome`) assumes GNOME comes from the Fedora Workstation base install; Ansible only deploys shared desktop dotfiles and git/GPG config for `nymph`, not GNOME settings. +- Fedora GNOME (`desktop_gnome`) assumes GNOME comes from the Fedora Workstation base install; Ansible deploys shared desktop dotfiles and git/GPG config for `ikaros` and `nymph`, not GNOME settings. - FreeBSD Niri (dormant; `platform_freebsd` currently has no hosts) must keep FreeBSD-specific package, rc, DBus, seat, portal, and launcher behavior in `profile_desktop_niri_freebsd` or FreeBSD platform vars. - Do not switch or restart a display manager during a playbook run from an active graphical session. Changing among `emptty`, LightDM, and SDDM requires an explicit run from another TTY/SSH session with `desktop_allow_display_manager_switch=true`. Apply managed XFCE XML while logged out of XFCE so `xfconfd` cannot overwrite it from its in-memory state. - `nymph` is the Fedora/GNOME laptop target; keep GNOME settings unmanaged for now and add host-specific tuning only after real use. @@ -83,8 +81,8 @@ The Void desktop package lists in `ansible/inventory/group_vars/void.yml` are ke The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-independent content, `desktop_minimal_dotfiles` carries Thunar, Udiskie, and minimal MIME defaults, and `desktop_xfce_dotfiles` carries XFCE state. KDE uses its own MIME defaults. `desktop_void_dotfiles` remains reserved for files that need the Void runtime. ## Workstation Notes -- Native Linux workstation hosts can combine `workstation_host_linux` with an OS-specific dev group. -- `deadalus-fedora` keeps GNOME managed settings in `ansible/inventory/host_vars/deadalus-fedora.yml`. +- `deadalus` is modeled as Windows + WSL; keep Linux dev automation on `deadalus-wsl`. +- Native Linux workstation groups remain available for future hosts but have no current host in the main inventory. ## Coding Agent Notes - Shared agent packages live in `ai_agents_npm_packages` in `ansible/inventory/group_vars/all.yml`. diff --git a/CLAUDE.md b/CLAUDE.md index 1bea238..33c1570 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co ## What this repo is -Ansible-driven personal infrastructure as code for Void Linux desktops (`ikaros`, `nymph`), Linux workstations (`deadalus-fedora`, `deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions. +Ansible-driven personal infrastructure as code for Fedora desktops (`ikaros`, `nymph`), WSL development (`deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions. ## Validation commands @@ -15,7 +15,6 @@ ansible-playbook ansible/site.yml --syntax-check # Dry-run per host ansible-playbook ansible/site.yml --limit ikaros --check --diff ansible-playbook ansible/site.yml --limit nymph --check --diff -ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff ansible-playbook ansible/site.yml --limit prometheus --check --diff diff --git a/README.md b/README.md index 4c96a4b..065341b 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,7 @@ Matrice target: | Host | Platform | Role | Desktop | | -------------- | ---------- | -------------------- | --------------------------------- | -| ikaros | Linux Mint | Personal workstation | Cinnamon | +| ikaros | Fedora | Personal workstation | GNOME | | nymph | Fedora | Desktop laptop | GNOME | | void-reference | Void Linux | Lab/reference | Current preserved desktop profile | @@ -81,8 +81,8 @@ ikaros must be boring nymph is allowed to break ``` -`ikaros` usa il target stabile Linux Mint/Cinnamon; `nymph` usa il target -Fedora Workstation/GNOME. I gruppi legacy `void` e `desktop` restano alias di +`ikaros` usa Fedora Workstation/GNOME come desktop personale stabile; `nymph` usa lo stesso +target Fedora Workstation/GNOME come laptop. I gruppi legacy `void` e `desktop` restano alias di compatibilita per eventuali host Void futuri mentre i nuovi assi sono `platform_*`, `role_*` e `desktop_*`. @@ -96,8 +96,7 @@ git tag void-desktop-before-platform-refactor Nota sullo stato attuale del playbook principale: -- `ansible/site.yml` applica oggi in automatico Cinnamon su Linux Mint e Niri su FreeBSD -- `ansible/site.yml` applica la workstation Linux nativa separando il layer dev comune dal layer host GNOME +- `ansible/site.yml` applica oggi in automatico GNOME su Fedora e Niri su FreeBSD - `ansible/site.yml` applica anche il ramo `workstation_dev_wsl` per il modello dev in WSL - `ansible/site.yml` applica anche il profilo `ubuntu_server` con baseline apt, systemd, dotfiles server e firewall UFW @@ -105,7 +104,7 @@ Nota sullo stato attuale del playbook principale: Target operativi: -- `ikaros`: Linux Mint + Cinnamon, desktop personale stabile/floating. +- `ikaros`: Fedora Workstation + GNOME, desktop personale stabile/floating. - `nymph`: Fedora Workstation + GNOME, laptop desktop con dotfiles desktop condivisi e GNOME lasciato al default Fedora. Il profilo Void desktop resta disponibile come modello riutilizzabile per host @@ -150,8 +149,7 @@ Desktop environment host Linux: Macchine attuali: -- `deadalus-fedora` come workstation Fedora nativa -- `deadalus-wsl` come ambiente dev Ubuntu in WSL +- `deadalus-wsl` come ambiente dev Ubuntu in WSL sulla workstation Windows `deadalus` Questo profilo รจ pensato per sviluppo e lavoro, con separazione tra layer host e layer dev. @@ -160,8 +158,8 @@ Nel modello Ansible usato qui, un singolo inventory host puo appartenere intenzi Il profilo workstation e agganciato al playbook principale e ora distingue: - layer dev Ubuntu condiviso tra WSL e server -- layer dev Fedora nativo -- layer host Linux GNOME +- layer dev Fedora nativo disponibile per host futuri +- layer host Linux GNOME disponibile per host futuri - layer WSL dedicato per sviluppo con `systemd` Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `workstation_dev_fedora`, a seconda del layering che vuoi comporre. @@ -175,8 +173,7 @@ Lo stato attuale del profilo workstation include: - installazione di Google Chrome su Fedora, `VS Code` su Fedora via repository RPM Microsoft, `IntelliJ IDEA Ultimate` su Fedora via COPR RPM, e applicazioni workstation residue su Fedora via Flatpak - estensioni GNOME sul solo host Linux nativo - preparazione del ramo WSL Ubuntu con `systemd` per il toolchain di sviluppo -- attivazione del firewall `firewalld` su Fedora nativa -- gestione di `gsettings` GNOME host-specifici su `deadalus-fedora`, inclusi shell, Files/Nautilus, file chooser GTK e GNOME Text Editor, allineati allo stato reale della macchina +- attivazione del firewall `firewalld` su Fedora Workflow WSL previsto: @@ -251,7 +248,7 @@ common configuration Esempi correnti: ```text -ikaros -> common + platform_mint + role_personal_workstation + desktop_cinnamon + ikaros +ikaros -> common + platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome + ikaros nymph -> common + platform_fedora + graphical_desktop + desktop_gnome + nymph ``` @@ -313,6 +310,7 @@ platform_freebsd -> packages_freebsd + services_freebsd platform_freebsd & role_lab -> profile_lab platform_freebsd & desktop_niri -> profile_desktop_niri_freebsd platform_fedora -> packages_fedora + services_systemd +platform_fedora & role_personal_workstation -> profile_personal_workstation platform_fedora & desktop_gnome -> profile_desktop_gnome workstation_dev_fedora -> profile_workstation_dev_common workstation_host_linux -> profile_workstation_gnome @@ -322,10 +320,9 @@ ubuntu_server -> packages_ubuntu + services_systemd + profile_server Questo significa che, allo stato attuale: -- `ikaros` riceve Linux Mint/Cinnamon come target stabile +- `ikaros` riceve Fedora Workstation/GNOME come target desktop personale stabile - `nymph` riceve Fedora Workstation/GNOME come target laptop - il profilo Void resta selezionabile tramite `platform_void + graphical_desktop` per host futuri -- la workstation Fedora (`deadalus-fedora`) usa il principio di composizione a gruppi con il ramo Fedora dedicato e con `gsettings` host-specifici dichiarati in inventory - il ramo WSL (`deadalus-wsl`) e predisposto con play dev dedicato - il server Ubuntu (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewall - lo stack container server include `navidrome`, `postgres`, `gitea`, `nginx-proxy-manager` e `syncthing`, con GUI Syncthing raggiungibile tramite la rete Docker `web` @@ -417,7 +414,6 @@ ansible-playbook ansible/site.yml --syntax-check ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff ansible-playbook ansible/site.yml --limit ikaros --check --diff ansible-playbook ansible/site.yml --limit nymph --check --diff -ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff ansible-playbook ansible/site.yml --limit prometheus --check --diff ansible-lint ansible/site.yml @@ -488,8 +484,7 @@ Esempi pratici: ```bash ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,niri --check --diff -ansible-playbook ansible/site.yml --limit ikaros --tags cinnamon --check --diff -ansible-playbook ansible/site.yml --limit deadalus-fedora --tags packages,vscode --check --diff +ansible-playbook ansible/site.yml --limit ikaros --tags gnome --check --diff ansible-playbook ansible/site.yml --limit prometheus --tags services,dotfiles:server --check --diff ``` diff --git a/ansible/inventory/group_vars/desktop_gnome.yml b/ansible/inventory/group_vars/desktop_gnome.yml index b88f22d..03e589a 100644 --- a/ansible/inventory/group_vars/desktop_gnome.yml +++ b/ansible/inventory/group_vars/desktop_gnome.yml @@ -19,6 +19,7 @@ fedora_desktop_packages: - poppler-utils - fontconfig-devel - freetype-devel + - gh - golang - golangci-lint - gopls diff --git a/ansible/inventory/host_vars/deadalus-fedora.yml b/ansible/inventory/host_vars/deadalus-fedora.yml deleted file mode 100644 index a12efb1..0000000 --- a/ansible/inventory/host_vars/deadalus-fedora.yml +++ /dev/null @@ -1,177 +0,0 @@ ---- -hostname: deadalus-fedora - -host_packages: [] -host_enabled_services: - - docker -workstation_firewall_backend: firewalld - -workstation_host_vscode_extensions: - - ms-vscode-remote.remote-containers - - ms-vscode-remote.remote-ssh - - ms-azuretools.vscode-docker - - redhat.vscode-yaml - - redhat.ansible - -workstation_gnome_managed_settings: - - schema: org.gnome.shell - key: favorite-apps - value: "['google-chrome.desktop', 'org.gnome.Nautilus.desktop', 'com.spotify.Client.desktop', 'org.mozilla.Thunderbird.desktop', 'org.telegram.desktop.desktop', 'code.desktop', 'intellij-idea-ultimate.desktop', 'io.dbeaver.DBeaverCommunity.desktop', 'com.getpostman.Postman.desktop', 'org.gnome.Ptyxis.desktop']" - - schema: org.gnome.shell - key: app-picker-layout - value: "[{'6f4bfcaf-700e-4fe3-8fd2-4a3e6fc46bcf': <{'position': <0>}>, 'System': <{'position': <1>}>, 'Utilities': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Weather.desktop': <{'position': <4>}>, 'org.gnome.clocks.desktop': <{'position': <5>}>, 'org.gnome.Maps.desktop': <{'position': <6>}>, 'org.gnome.SimpleScan.desktop': <{'position': <7>}>, 'org.gnome.Settings.desktop': <{'position': <8>}>, 'org.gnome.Boxes.desktop': <{'position': <9>}>, 'org.gnome.Showtime.desktop': <{'position': <10>}>, 'org.gnome.Snapshot.desktop': <{'position': <11>}>, 'org.gnome.Characters.desktop': <{'position': <12>}>, 'org.gnome.Calculator.desktop': <{'position': <13>}>, 'org.gnome.Calendar.desktop': <{'position': <14>}>, 'org.gnome.TextEditor.desktop': <{'position': <15>}>, 'org.gnome.Meld.desktop': <{'position': <16>}>, 'org.gnome.tweaks.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>}]" - - schema: org.gnome.desktop.input-sources - key: sources - value: "[('xkb', 'us')]" - - schema: org.gnome.desktop.interface - key: color-scheme - value: "'prefer-dark'" - - schema: org.gnome.desktop.privacy - key: report-technical-problems - value: "false" - - schema: org.gnome.desktop.wm.preferences - key: button-layout - value: "'appmenu:minimize,maximize,close'" - - schema: org.gnome.nautilus.preferences - key: click-policy - value: "'double'" - - schema: org.gnome.nautilus.preferences - key: date-time-format - value: "'simple'" - - schema: org.gnome.nautilus.preferences - key: default-folder-viewer - value: "'icon-view'" - - schema: org.gnome.nautilus.preferences - key: default-sort-order - value: "'name'" - - schema: org.gnome.nautilus.preferences - key: recursive-search - value: "'local-only'" - - schema: org.gnome.nautilus.preferences - key: show-create-link - value: "true" - - schema: org.gnome.nautilus.preferences - key: show-delete-permanently - value: "true" - - schema: org.gnome.nautilus.preferences - key: show-directory-item-counts - value: "'local-only'" - - schema: org.gnome.nautilus.preferences - key: show-hidden-files - value: "false" - - schema: org.gnome.nautilus.preferences - key: show-image-thumbnails - value: "'local-only'" - - schema: org.gnome.nautilus.preferences - key: thumbnail-limit - value: "uint64 50" - - schema: org.gnome.nautilus.icon-view - key: captions - value: "['none', 'none', 'none']" - - schema: org.gnome.nautilus.icon-view - key: default-zoom-level - value: "'medium'" - - schema: org.gtk.Settings.FileChooser - key: clock-format - value: "'24h'" - - schema: org.gtk.Settings.FileChooser - key: date-format - value: "'regular'" - - schema: org.gtk.Settings.FileChooser - key: location-mode - value: "'path-bar'" - - schema: org.gtk.Settings.FileChooser - key: show-hidden - value: "false" - - schema: org.gtk.Settings.FileChooser - key: show-size-column - value: "true" - - schema: org.gtk.Settings.FileChooser - key: show-type-column - value: "true" - - schema: org.gtk.Settings.FileChooser - key: sort-column - value: "'name'" - - schema: org.gtk.gtk4.Settings.FileChooser - key: clock-format - value: "'24h'" - - schema: org.gtk.gtk4.Settings.FileChooser - key: date-format - value: "'regular'" - - schema: org.gtk.gtk4.Settings.FileChooser - key: location-mode - value: "'path-bar'" - - schema: org.gtk.gtk4.Settings.FileChooser - key: show-hidden - value: "false" - - schema: org.gtk.gtk4.Settings.FileChooser - key: show-size-column - value: "true" - - schema: org.gtk.gtk4.Settings.FileChooser - key: show-type-column - value: "true" - - schema: org.gtk.gtk4.Settings.FileChooser - key: sort-column - value: "'name'" - - schema: org.gtk.gtk4.Settings.FileChooser - key: sort-directories-first - value: "true" - - schema: org.gnome.TextEditor - key: auto-indent - value: "true" - - schema: org.gnome.TextEditor - key: highlight-matching-brackets - value: "true" - - schema: org.gnome.TextEditor - key: indent-style - value: "'tab'" - - schema: org.gnome.TextEditor - key: keybindings - value: "'default'" - - schema: org.gnome.TextEditor - key: restore-session - value: "true" - - schema: org.gnome.TextEditor - key: show-line-numbers - value: "false" - - schema: org.gnome.TextEditor - key: spellcheck - value: "true" - - schema: org.gnome.TextEditor - key: style-scheme - value: "'Adwaita'" - - schema: org.gnome.TextEditor - key: style-variant - value: "'follow'" - - schema: org.gnome.TextEditor - key: use-system-font - value: "true" - - schema: org.gnome.TextEditor - key: wrap-text - value: "true" - - schema: org.gnome.desktop.background - key: picture-uri - value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-l.jxl'" - - schema: org.gnome.desktop.background - key: picture-uri-dark - value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-d.jxl'" - -workstation_gnome_extension_dconf_settings: - - path: /org/gnome/shell/extensions/paperwm/ - key: selection-border-radius-bottom - value: "15" - - path: /org/gnome/shell/extensions/paperwm/ - key: selection-border-radius-top - value: "15" - - path: /org/gnome/shell/extensions/paperwm/ - key: selection-border-size - value: "5" - - path: /org/gnome/shell/extensions/paperwm/ - key: show-window-position-bar - value: "false" - - path: /org/gnome/shell/extensions/paperwm/ - key: show-workspace-indicator - value: "false" - - path: /org/gnome/shell/extensions/paperwm/ - key: window-gap - value: "10" diff --git a/ansible/inventory/host_vars/ikaros.yml b/ansible/inventory/host_vars/ikaros.yml index 326f0ef..7c98a3a 100644 --- a/ansible/inventory/host_vars/ikaros.yml +++ b/ansible/inventory/host_vars/ikaros.yml @@ -2,16 +2,12 @@ hostname: ikaros host_packages: - - openssh-client + - openssh-clients - openssh-server - mesa-vulkan-drivers - - xserver-xorg-video-amdgpu -host_ufw_rules: - - rule: allow - port: "22" - proto: tcp - src: "192.168.0.0/24" +host_firewalld_rich_rules: + - rule family="ipv4" source address="192.168.0.0/24" service name="ssh" accept host_sshd_settings: PermitRootLogin: "no" @@ -25,4 +21,4 @@ host_sshd_allow_users: host_authorized_ssh_keys: "{{ vault_ikaros_authorized_ssh_keys | default([]) }}" host_enabled_services: - - ssh + - sshd diff --git a/ansible/inventory/hosts.yml b/ansible/inventory/hosts.yml index b573643..1b9e8b1 100644 --- a/ansible/inventory/hosts.yml +++ b/ansible/inventory/hosts.yml @@ -6,15 +6,13 @@ all: platform_fedora: hosts: - nymph: + ikaros: ansible_connection: local - deadalus-fedora: + nymph: ansible_connection: local platform_mint: - hosts: - ikaros: - ansible_connection: local + hosts: {} platform_freebsd: hosts: {} @@ -57,13 +55,13 @@ all: desktop_gnome: hosts: + ikaros: + ansible_connection: local nymph: ansible_connection: local desktop_cinnamon: - hosts: - ikaros: - ansible_connection: local + hosts: {} ubuntu: children: @@ -89,19 +87,13 @@ all: ubuntu_server: fedora_workstation: - hosts: - deadalus-fedora: - ansible_connection: local + hosts: {} workstation_host_linux: - hosts: - deadalus-fedora: - ansible_connection: local + hosts: {} workstation_dev_fedora: - hosts: - deadalus-fedora: - ansible_connection: local + hosts: {} workstation_dev_wsl: hosts: diff --git a/ansible/roles/profile_desktop_common/tasks/main.yml b/ansible/roles/profile_desktop_common/tasks/main.yml index be83a57..c3cbbbe 100644 --- a/ansible/roles/profile_desktop_common/tasks/main.yml +++ b/ansible/roles/profile_desktop_common/tasks/main.yml @@ -190,12 +190,27 @@ loop: "{{ desktop_ufw_rules_effective }}" loop_control: label: "{{ item.name | default(item.port) }}" + when: workstation_firewall_backend | default('ufw') == 'ufw' - name: Enable UFW firewall on desktop when host rules are defined tags: [services, packages] community.general.ufw: state: enabled - when: (desktop_ufw_rules_effective | default([])) | length > 0 + when: + - workstation_firewall_backend | default('ufw') == 'ufw' + - (desktop_ufw_rules_effective | default([])) | length > 0 + +- name: Apply host firewalld rich rules on desktop + tags: [services, packages] + ansible.posix.firewalld: + rich_rule: "{{ item }}" + permanent: true + immediate: true + state: enabled + loop: "{{ host_firewalld_rich_rules | default([]) }}" + loop_control: + label: "{{ item }}" + when: workstation_firewall_backend | default('ufw') == 'firewalld' - name: Check whether libvirt service directory exists tags: [packages, services] diff --git a/ansible/roles/profile_desktop_gnome/handlers/main.yml b/ansible/roles/profile_desktop_gnome/handlers/main.yml index 7da93fb..ce652d2 100644 --- a/ansible/roles/profile_desktop_gnome/handlers/main.yml +++ b/ansible/roles/profile_desktop_gnome/handlers/main.yml @@ -9,3 +9,8 @@ environment: HOME: "{{ user_home }}" changed_when: false + +- name: Reload SSH service + ansible.builtin.systemd: + name: sshd + state: reloaded diff --git a/ansible/roles/profile_desktop_gnome/tasks/main.yml b/ansible/roles/profile_desktop_gnome/tasks/main.yml index 0cb3112..1f71670 100644 --- a/ansible/roles/profile_desktop_gnome/tasks/main.yml +++ b/ansible/roles/profile_desktop_gnome/tasks/main.yml @@ -80,3 +80,91 @@ owner: "{{ username }}" group: "{{ user_group }}" mode: "0644" + +- name: Check whether SSH host ed25519 key exists on GNOME desktop + tags: [services, gnome] + ansible.builtin.stat: + path: /etc/ssh/ssh_host_ed25519_key + register: gnome_ssh_host_ed25519_key + when: + - (host_sshd_settings | default({})) | length > 0 + or (host_sshd_allow_users | default([])) | length > 0 + +- name: Generate missing SSH host keys on GNOME desktop + tags: [services, gnome] + ansible.builtin.command: ssh-keygen -A + changed_when: true + when: + - (host_sshd_settings | default({})) | length > 0 + or (host_sshd_allow_users | default([])) | length > 0 + - not gnome_ssh_host_ed25519_key.stat.exists + +- name: Require authorized SSH keys before disabling password authentication on GNOME desktop + tags: [services, gnome] + ansible.builtin.assert: + that: + - (host_authorized_ssh_keys | default([])) | length > 0 + fail_msg: >- + SSH password authentication is disabled for this host, but no authorized SSH + keys are defined. Set host_authorized_ssh_keys via vault variables before + applying this configuration. + when: + - "'sshd' in (host_enabled_services | default([]))" + - (host_sshd_settings | default({})).PasswordAuthentication | default('yes') == 'no' + +- name: Ensure GNOME desktop user authorized_keys file exists + tags: [services, dotfiles, gnome] + ansible.builtin.file: + path: "{{ user_home }}/.ssh/authorized_keys" + state: touch + owner: "{{ username }}" + group: "{{ user_group }}" + mode: "0600" + when: (host_authorized_ssh_keys | default([])) | length > 0 + +- name: Manage GNOME desktop user authorized SSH keys exclusively + tags: [services, dotfiles, gnome] + ansible.posix.authorized_key: + user: "{{ username }}" + key: "{{ host_authorized_ssh_keys | join('\n') }}" + state: present + exclusive: true + manage_dir: false + when: (host_authorized_ssh_keys | default([])) | length > 0 + +- name: Apply SSH daemon settings on GNOME desktop + tags: [services, gnome] + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: '^\s*{{ item.key }}\s+' + line: "{{ item.key }} {{ item.value }}" + state: present + validate: "sshd -t -f %s" + notify: Reload SSH service + loop: "{{ host_sshd_settings | default({}) | dict2items }}" + loop_control: + label: "{{ item.key }}" + when: (host_sshd_settings | default({})) | length > 0 + +- name: Restrict SSH login to allowed GNOME desktop users + tags: [services, gnome] + ansible.builtin.lineinfile: + path: /etc/ssh/sshd_config + regexp: '^\s*AllowUsers\s+' + line: "AllowUsers {{ host_sshd_allow_users | join(' ') }}" + state: present + validate: "sshd -t -f %s" + notify: Reload SSH service + when: (host_sshd_allow_users | default([])) | length > 0 + +- name: Apply host firewalld rich rules on GNOME desktop + tags: [services, packages, gnome] + ansible.posix.firewalld: + rich_rule: "{{ item }}" + permanent: true + immediate: true + state: enabled + loop: "{{ host_firewalld_rich_rules | default([]) }}" + loop_control: + label: "{{ item }}" + when: workstation_firewall_backend | default('firewalld') == 'firewalld' diff --git a/ansible/site.yml b/ansible/site.yml index d2cc2c4..e7a4f4e 100644 --- a/ansible/site.yml +++ b/ansible/site.yml @@ -102,6 +102,13 @@ - packages_fedora - services_systemd +- name: Configure personal workstation role on Fedora + hosts: platform_fedora:&role_personal_workstation + become: true + + roles: + - profile_personal_workstation + - name: Configure Fedora GNOME desktop hosts: platform_fedora:&desktop_gnome become: true