Add configurable Windows package backends and taskbar policy

AGENTS.md

@@ -19,7 +19,7 @@ Project type: Ansible-driven infrastructure, workstation/server provisioning, an
 - Ubuntu workstation: `deadalus`
 - Ubuntu server: `prometheus`
 - Workstation topology now supports Linux host + Ubuntu dev and Windows 11 host + Ubuntu WSL dev as separate layers
-- The WSL dev environment is intended to be managed by running Ansible locally from inside the distro, while the Windows host is managed remotely via PSRP
+- The WSL dev environment is intended to be managed by running Ansible locally from inside the distro, while the Windows host is managed remotely via PSRP and Windows package installs default to `winget_psrp`
 - Most hosts use `ansible_connection: local`
 - Current playbook layering: `all:!workstation_host_windows -> dotfiles_common`, `void -> packages_void + services_runit + profile_desktop_common + profile_desktop_i3 + profile_desktop_sway + profile_desktop_hyprland + profile_desktop_host`, `workstation_dev_ubuntu -> packages_ubuntu + services_systemd + profile_workstation_dev_common`, `workstation_host_linux -> profile_workstation_gnome`, `workstation_dev_wsl -> packages_ubuntu + services_systemd + profile_workstation_dev_common + profile_workstation_dev_wsl`, `workstation_host_windows -> profile_workstation_host_windows`, `ubuntu_server -> packages_ubuntu + services_systemd + profile_server`
 - Present but currently unwired roles: `base`, `dotfiles`
@@ -156,9 +156,9 @@ Use the narrowest command matching the changed area.
 - `profile_workstation_dev_common` carries the Ubuntu dev layer shared by native workstation and WSL Ubuntu
 - `profile_workstation_gnome` carries Linux host-only GNOME setup, extensions, and UFW
 - `profile_workstation_dev_wsl` carries WSL-specific Ubuntu tweaks such as `systemd` and PSRP Python dependencies
-- `profile_workstation_host_windows` manages the Windows 11 host via PSRP over HTTPS using `negotiate` by default, installs host applications via `winget`, applies Windows shell tweaks, and sets Windows Terminal's default profile to Ubuntu
+- `profile_workstation_host_windows` manages the Windows 11 host via PSRP over HTTPS using `negotiate` by default, installs host applications via `winget` with a configurable `windows_package_backend` defaulting to `winget_psrp`, applies Windows shell tweaks, manages taskbar pins through a local Start layout policy with `PinListPlacement="Replace"`, and sets Windows Terminal's default profile to Ubuntu
 - `deadalus-wsl` is modeled as a local inventory target intended to be run from inside the Ubuntu WSL distro
-- Future Windows taskbar pinning work should be done from a real Windows session after discovering installed app identifiers on that host, then applied via a Windows 11 taskbar layout policy with `PinListPlacement="Replace"`
+- Windows taskbar pinning is driven by the ordered `windows_taskbar_pins` list in `ansible/inventory/group_vars/workstation_host_windows.yml`; validate identifiers from a real Windows session before changing that list
 - Do not auto-restart `emptty` during playbook runs on active desktop hosts; prefer a manual restart from SSH or another TTY after the run
 - `dotfiles/desktop/.xinitrc` affects X11 login behavior
 - `dotfiles/desktop/.local/bin/start-sway-session` and `start-hyprland-session` are critical session bootstrap paths

README.md

@@ -113,7 +113,7 @@ Il profilo workstation e agganciato al playbook principale e ora distingue:
 
 - layer dev Ubuntu condiviso tra workstation Linux nativa e Ubuntu in WSL
 - layer host Linux GNOME
-- layer host Windows 11 con bootstrap WSL, remoting `PSRP` su `HTTPS/5986`, gestione app via `winget` e VS Code lato Windows
+- layer host Windows 11 con bootstrap WSL, remoting `PSRP` su `HTTPS/5986`, gestione app via `winget` con backend configurabile e VS Code lato Windows
 - layer WSL dedicato per sviluppo con `systemd`
 
 Lo stato attuale del profilo workstation include:
@@ -122,7 +122,7 @@ Lo stato attuale del profilo workstation include:
 - installazione e configurazione di Docker dal repository ufficiale
 - gestione dei dotfiles workstation e rendering dei template dev condivisi
 - installazione di Google Chrome, pacchetti Snap workstation e estensioni GNOME sul solo host Linux nativo
-- configurazione del ramo Windows 11 host con app installate dal playbook via `winget`, tema scuro, taskbar ripulita e profilo predefinito di Windows Terminal impostato su `Ubuntu`
+- configurazione del ramo Windows 11 host con app installate dal playbook via `winget`, con backend predefinito `winget_psrp`, tema scuro, pin della taskbar gestiti via policy locale e profilo predefinito di Windows Terminal impostato su `Ubuntu`
 - preparazione del ramo WSL Ubuntu con `systemd` per il toolchain di sviluppo
 - attivazione del firewall UFW sul solo host Linux nativo
 
@@ -151,10 +151,10 @@ Unblock-File .\scripts\bootstrap_windows_workstation.ps1
 3. avviare Ubuntu WSL almeno una volta e completare la creazione dell'utente Linux
 4. installare Ansible dentro WSL Ubuntu
 5. lanciare il playbook da WSL su `deadalus-wsl` per configurare l'ambiente dev locale
-6. lanciare da WSL anche il playbook su `deadalus-win` via `psrp` per configurare l'host Windows
+6. lanciare da WSL anche il playbook su `deadalus-win` via `psrp` per configurare l'host Windows; per default il backend pacchetti Windows e `winget_psrp`
 7. usare VS Code con le estensioni Remote (`WSL`, `SSH`, `Dev Containers`) dal lato Windows
 
-Per il remoting Windows il repository usa di default `PSRP` con `Negotiate` su `HTTPS/5986`. L'utente di default puo essere un `MicrosoftAccount\...`, con host, utente e password forniti via vault o extra vars.
+Per il remoting Windows il repository usa di default `PSRP` con `Negotiate` su `HTTPS/5986`. L'utente di default puo essere un `MicrosoftAccount\...`, con host, utente e password forniti via vault o extra vars. Il backend pacchetti Windows e configurabile con `windows_package_backend` oppure `vault_windows_package_backend`; il default e `winget_psrp`.
 
 ---
 
@@ -328,6 +328,7 @@ Gestione segreti:
 - `secrets/vault.yml.example` funge da template/esempio
 - se `secrets/vault.yml` non e presente, il playbook continua comunque senza caricare variabili locali opzionali
 - se `secrets/.vault_pass` esiste viene usato automaticamente per sbloccare i vault; altrimenti Ansible richiede la password in modo interattivo
+- per il ramo Windows puoi anche definire `vault_windows_package_backend`, con valori supportati `winget_psrp` e `winget_wsl_local`; il default e `winget_psrp`
 
 ---
 
@@ -346,7 +347,7 @@ Allo stato attuale questo comando:
 - per `workstation_dev_ubuntu` applica pacchetti Ubuntu, servizi systemd e profilo dev comune
 - per `workstation_host_linux` applica il layer host Linux GNOME
 - per `workstation_dev_wsl` applica pacchetti Ubuntu, servizi systemd, profilo dev comune e tweak WSL dedicati
-- per `workstation_host_windows` applica il layer host Windows 11 via PSRP
+- per `workstation_host_windows` applica il layer host Windows 11 via PSRP, con installazione pacchetti Windows eseguita di default tramite `winget_psrp`
 - per gli host `ubuntu_server` applica pacchetti Ubuntu, servizi systemd, profilo server, UFW, dotfiles e template dedicati
 - non riavvia automaticamente `emptty`; le modifiche al display manager vanno applicate manualmente da SSH o da una TTY separata
 - carica `secrets/vault.yml` solo se presente

ansible/inventory/group_vars/workstation_host_windows.yml

@@ -10,6 +10,33 @@ windows_enable_dark_theme: true
 windows_hide_taskbar_search: true
 windows_hide_taskbar_widgets: true
 windows_terminal_default_profile_name: Ubuntu
+windows_taskbar_layout_directory: 'C:\ProgramData\Infra\Windows'
+windows_taskbar_layout_path: '{{ windows_taskbar_layout_directory }}\taskbar-layout.xml'
+windows_taskbar_reapply_every_logon: false
+
+windows_taskbar_pins:
+  - type: desktop_application_id
+    id: Chrome
+  - type: desktop_application_id
+    id: Microsoft.Windows.Explorer
+  - type: app_user_model_id
+    id: Microsoft.OutlookForWindows_8wekyb3d8bbwe!Microsoft.OutlookforWindows
+  - type: app_user_model_id
+    id: MSTeams_8wekyb3d8bbwe!MSTeams
+  - type: app_user_model_id
+    id: 5319275A.WhatsAppDesktop_cv1g1gvanyjgm!App
+  - type: desktop_application_id
+    id: Telegram.TelegramDesktop
+  - type: desktop_application_id
+    id: Microsoft.VisualStudioCode
+  - type: desktop_application_link_path
+    path: '%APPDATA%\Microsoft\Windows\Start Menu\Programs\JetBrains Toolbox\IntelliJ IDEA Ultimate.lnk'
+  - type: desktop_application_id
+    id: com.squirrel.Postman.Postman
+  - type: app_user_model_id
+    id: Microsoft.WindowsTerminal_8wekyb3d8bbwe!App
+  - type: desktop_application_link_path
+    path: '%APPDATA%\Microsoft\Windows\Start Menu\Programs\DBeaver Community\DBeaver.lnk'
 
 windows_winget_packages:
   - id: 7zip.7zip

ansible/roles/profile_workstation_host_windows/tasks/main.yml

@@ -95,16 +95,95 @@
     or (windows_11_widgets_state is changed)
     or (windows_11_widgets_policy_state is changed)
 
-- name: Ensure winget is available on Windows host
+- name: Ensure winget is executable on Windows host through PSRP
   tags: [packages]
+  when: windows_package_backend == 'winget_psrp'
   ansible.windows.win_powershell:
     script: |
       $winget = Get-Command winget.exe -ErrorAction SilentlyContinue
       if ($null -eq $winget) {
           throw 'winget.exe is not available on the Windows host. Install App Installer or rerun the bootstrap script.'
       }
+
+      & $winget.Source --info *> $null
+      if ($LASTEXITCODE -ne 0) {
+          throw 'winget.exe is not executable through the current PSRP session. Set windows_package_backend to winget_wsl_local on WSL-managed hosts.'
+      }
+
       $Ansible.Changed = $false
 
+- name: Ensure winget is executable through local Windows PowerShell from WSL
+  tags: [packages]
+  when: windows_package_backend == 'winget_wsl_local'
+  block:
+    - name: Ensure winget_wsl_local backend is running inside WSL
+      ansible.builtin.assert:
+        that:
+          - lookup('ansible.builtin.env', 'WSL_DISTRO_NAME') | length > 0
+        fail_msg: >-
+          winget_wsl_local requires running the playbook from inside the
+          target machine's WSL environment.
+
+    - name: Get local Windows host name through WSL interop
+      ansible.builtin.shell: |
+        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '$env:COMPUTERNAME'
+      args:
+        executable: /bin/bash
+      delegate_to: localhost
+      register: local_windows_host_name_state
+      changed_when: false
+
+    - name: Get local Windows host IP addresses through WSL interop
+      ansible.builtin.shell: |
+        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '
+          Get-NetIPAddress -AddressFamily IPv4, IPv6 -ErrorAction SilentlyContinue |
+            Where-Object {
+              $_.IPAddress -notin @("127.0.0.1", "::1") -and
+              $_.IPAddress -notlike "169.254.*" -and
+              $_.IPAddress -notlike "fe80:*"
+            } |
+            Select-Object -ExpandProperty IPAddress
+        '
+      args:
+        executable: /bin/bash
+      delegate_to: localhost
+      register: local_windows_host_ip_state
+      changed_when: false
+
+    - name: Ensure winget_wsl_local backend targets the local Windows host
+      ansible.builtin.assert:
+        that:
+          - >-
+            (ansible_host | lower) in ['localhost', '127.0.0.1', '::1']
+            or (local_windows_host_name_state.stdout | trim | upper)
+            == ((ansible_host | regex_replace('\\..*$', '')) | upper)
+            or (ansible_host | lower)
+            in (local_windows_host_ip_state.stdout_lines | map('trim') | map('lower') | list)
+        fail_msg: >-
+          winget_wsl_local can only target the local Windows host reached
+          through WSL interop. Local Windows host '{{ local_windows_host_name_state.stdout | trim }}'
+          with addresses {{ local_windows_host_ip_state.stdout_lines | map('trim') | list }}
+          does not match ansible_host '{{ ansible_host }}'.
+
+    - name: Ensure winget is executable through local Windows PowerShell
+      ansible.builtin.shell: |
+        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '
+          $ErrorActionPreference = "Stop"
+          $winget = Get-Command winget.exe -ErrorAction SilentlyContinue
+          if ($null -eq $winget) {
+              throw "winget.exe is not available on the local Windows host. Install App Installer or rerun the bootstrap script."
+          }
+
+          & $winget.Source --info *> $null
+          if ($LASTEXITCODE -ne 0) {
+              throw "winget.exe is not executable through local Windows PowerShell interop."
+          }
+        '
+      args:
+        executable: /bin/bash
+      delegate_to: localhost
+      changed_when: false
+
 - name: Ensure WSL 2 is the default backend
   tags: [packages, services, wsl]
   ansible.windows.win_powershell:
@@ -122,8 +201,9 @@
 
       $Ansible.Changed = $true
 
-- name: Install Windows workstation applications with winget
+- name: Install Windows workstation applications with winget through PSRP
   tags: [packages]
+  when: windows_package_backend == 'winget_psrp'
   ansible.windows.win_powershell:
     script: |
       $packageId = '{{ item.id }}'
@@ -167,6 +247,110 @@
   loop_control:
     label: "{{ item.id }}"
 
+- name: Install Windows workstation applications with winget through WSL local backend
+  tags: [packages]
+  when: windows_package_backend == 'winget_wsl_local'
+  ansible.builtin.shell: |
+    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '
+      $ErrorActionPreference = "Stop"
+      $packageId = "{{ item.id }}"
+      $packageName = "{{ item.name | default(item.id) }}"
+      $packageSource = "{{ item.source | default('') }}"
+      $winget = Get-Command winget.exe -ErrorAction Stop
+      $listArgs = @(
+          "list"
+          "--id", $packageId
+          "--exact"
+          "--accept-source-agreements"
+          "--disable-interactivity"
+      )
+      $installArgs = @(
+          "install"
+          "--id", $packageId
+          "--exact"
+          "--silent"
+          "--accept-package-agreements"
+          "--accept-source-agreements"
+          "--disable-interactivity"
+      )
+
+      if (-not [string]::IsNullOrWhiteSpace($packageSource)) {
+          $listArgs += @("--source", $packageSource)
+          $installArgs += @("--source", $packageSource)
+      }
+
+      $installed = & $winget.Source @listArgs 2>$null
+      if ($LASTEXITCODE -eq 0 -and $installed -match [regex]::Escape($packageId)) {
+          [Console]::Out.WriteLine("changed=false")
+          exit 0
+      }
+
+      & $winget.Source @installArgs
+      if ($LASTEXITCODE -ne 0) {
+          throw "Failed to install $packageName with winget"
+      }
+
+      [Console]::Out.WriteLine("changed=true")
+    '
+  args:
+    executable: /bin/bash
+  delegate_to: localhost
+  register: windows_wsl_local_winget_install_state
+  changed_when: "'changed=true' in windows_wsl_local_winget_install_state.stdout"
+  loop: "{{ windows_winget_packages | default([]) }}"
+  loop_control:
+    label: "{{ item.id }}"
+
+- name: Configure Windows taskbar pin layout
+  tags: [packages]
+  when: (windows_taskbar_pins | default([])) | length > 0
+  block:
+    - name: Ensure Windows taskbar layout directory exists
+      ansible.windows.win_file:
+        path: "{{ windows_taskbar_layout_directory }}"
+        state: directory
+
+    - name: Render Windows taskbar layout policy file
+      ansible.windows.win_template:
+        src: taskbar-layout.xml.j2
+        dest: "{{ windows_taskbar_layout_path }}"
+      register: windows_taskbar_layout_file_state
+
+    - name: Enable Windows taskbar layout policy
+      ansible.windows.win_regedit:
+        path: HKCU:\Software\Policies\Microsoft\Windows\Explorer
+        name: LockedStartLayout
+        data: 1
+        type: dword
+      register: windows_taskbar_layout_policy_state
+
+    - name: Set Windows taskbar layout policy file path
+      ansible.windows.win_regedit:
+        path: HKCU:\Software\Policies\Microsoft\Windows\Explorer
+        name: StartLayoutFile
+        data: "{{ windows_taskbar_layout_path }}"
+        type: expandstring
+      register: windows_taskbar_layout_policy_path_state
+
+    - name: Set Windows taskbar layout policy refresh behavior
+      ansible.windows.win_regedit:
+        path: HKCU:\Software\Policies\Microsoft\Windows\Explorer
+        name: ReapplyStartLayoutEveryLogon
+        data: "{{ (windows_taskbar_reapply_every_logon | default(false)) | ternary(1, 0) }}"
+        type: dword
+      register: windows_taskbar_layout_policy_reapply_state
+
+    - name: Note when Windows taskbar pin layout may require sign out
+      ansible.builtin.debug:
+        msg: >-
+          Windows taskbar pin policy changed. Sign out and back in if the updated pin order does not appear immediately.
+      changed_when: false
+      when: >-
+        (windows_taskbar_layout_file_state is changed)
+        or (windows_taskbar_layout_policy_state is changed)
+        or (windows_taskbar_layout_policy_path_state is changed)
+        or (windows_taskbar_layout_policy_reapply_state is changed)
+
 - name: Install VS Code WSL extensions on Windows host
   tags: [packages, vscode]
   ansible.windows.win_powershell:

ansible/roles/profile_workstation_host_windows/templates/taskbar-layout.xml.j2

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<LayoutModificationTemplate
+    xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
+    xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
+    xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
+    xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"
+    Version="1">
+  <CustomTaskbarLayoutCollection PinListPlacement="Replace">
+    <defaultlayout:TaskbarLayout>
+      <taskbar:TaskbarPinList>
+{% for pin in windows_taskbar_pins %}
+{% if pin.type == 'desktop_application_id' %}
+        <taskbar:DesktopApp DesktopApplicationID="{{ pin.id }}" />
+{% elif pin.type == 'desktop_application_link_path' %}
+        <taskbar:DesktopApp DesktopApplicationLinkPath="{{ pin.path }}" />
+{% elif pin.type == 'app_user_model_id' %}
+        <taskbar:UWA AppUserModelID="{{ pin.id }}" />
+{% endif %}
+{% endfor %}
+      </taskbar:TaskbarPinList>
+    </defaultlayout:TaskbarLayout>
+  </CustomTaskbarLayoutCollection>
+</LayoutModificationTemplate>

ansible/site.yml

@@ -74,6 +74,7 @@
         ansible_host: "{{ windows_psrp_host | default(vault_windows_psrp_host | default('')) }}"
         ansible_user: "{{ windows_psrp_user | default(vault_windows_psrp_user | default('')) }}"
         ansible_password: "{{ windows_psrp_password | default(vault_windows_psrp_password | default('')) }}"
+        windows_package_backend: "{{ windows_package_backend | default(vault_windows_package_backend | default('winget_psrp')) }}"
 
     - name: Ensure Windows PSRP connection settings are defined
       tags: [always]
@@ -86,6 +87,15 @@
           or secrets/vault.local.yml
           before running the workstation_host_windows play.
 
+    - name: Ensure Windows package backend is supported
+      tags: [always]
+      ansible.builtin.assert:
+        that:
+          - windows_package_backend in ['winget_psrp', 'winget_wsl_local']
+        fail_msg: >-
+          Unsupported windows_package_backend '{{ windows_package_backend }}'.
+          Supported values are winget_psrp and winget_wsl_local.
+
   roles:
     - profile_workstation_host_windows
 

scripts/bootstrap_windows_workstation.ps1

@@ -153,7 +153,7 @@ Write-Host 'Passi successivi:'
 Write-Host '1. Riavvia Windows se richiesto dalle feature WSL.'
 Write-Host '2. Avvia la distro Ubuntu almeno una volta e completa la creazione dell''utente Linux.'
 Write-Host '3. Installa Ansible dentro WSL Ubuntu e lancia il playbook da li.'
-Write-Host '4. Le applicazioni Windows saranno installate dal playbook Ansible via winget, non da questo bootstrap.'
+Write-Host '4. Le applicazioni Windows saranno installate dal playbook Ansible; il backend predefinito e winget_psrp.'
 Write-Host ''
 Write-Host ('WSL distro Ubuntu rilevata: {0}' -f $(if ($null -ne $installedUbuntuDistribution) { $installedUbuntuDistribution } else { 'nessuna, verra installata ' + $Distribution }))
 Write-Host ('PSRP transport consigliato: https://{0}:5986/wsman' -f $env:COMPUTERNAME)

secrets/vault.yml.example

@@ -9,5 +9,6 @@ vault_git_work_email: "REPLACE_ME"
 vault_windows_psrp_host: "REPLACE_ME"
 vault_windows_psrp_user: 'MicrosoftAccount\user@example.com'
 vault_windows_psrp_password: "REPLACE_ME"
+vault_windows_package_backend: "winget_psrp"
 vault_navidrome_db_password: "REPLACE_ME"
 vault_postgres_root_password: "REPLACE_ME"