Update nymph Fedora desktop configuration

AGENTS.md

@@ -57,7 +57,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
 
 ## Desktop Notes
 - `desktop_profile` names independently selectable desktop groups such as `desktop_gnome`, `desktop_hyprland`, `desktop_sway`, `desktop_niri`, and `desktop_cinnamon`. Keep platform-specific session bootstrap in platform-specific roles.
-- `desktop_environment` selects the mutually exclusive `minimal` (default), `gnome`, `xfce`, or `kde` desktop mode. `profile_desktop_common` owns shared bootstrap; the minimal mode uses `profile_desktop_sway`, `profile_desktop_hyprland`, and `profile_desktop_niri`, `profile_desktop_xfce` owns the reproducible XFCE setup, and `profile_desktop_kde` owns KDE-specific defaults and cleanup. `desktop_sessions_enabled` and `desktop_default_session` apply only to the minimal mode.
+- `desktop_environment` selects the mutually exclusive `minimal` (default), `gnome`, `xfce`, or `kde` desktop mode. `profile_desktop_common` owns shared Void bootstrap; the minimal mode uses `profile_desktop_sway`, `profile_desktop_hyprland`, and `profile_desktop_niri`, `profile_desktop_xfce` owns the reproducible XFCE setup, `profile_desktop_kde` owns KDE-specific defaults and cleanup, and `profile_desktop_gnome` copies shared desktop dotfiles for Fedora/GNOME without managing GNOME settings. `desktop_sessions_enabled` and `desktop_default_session` apply only to the minimal mode.
 - Emacs packages and `.emacs.d` deploy are disabled by default via `emacs_enabled: false`; keep the dotfiles in the repo for reversible opt-in only.
 - NTFS filesystem support is provided by `ntfs-3g` in `ansible/inventory/group_vars/void.yml`.
 - Void user services are managed by `turnstile` and live under `dotfiles/desktop/.config/service/`.
@@ -67,10 +67,10 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
   - `dotfiles/desktop/.config/hypr/hyprland.conf` plus `host.conf` and `session-env` deployed via `host_hyprland_dotfiles` (Hyprland / Wayland)
   - `dotfiles/desktop/.config/niri/config.kdl` and `session-env` deployed via `desktop_niri_dotfiles` (Niri / Wayland)
 - Void Niri lives in `profile_desktop_niri`, gated on `'niri' in desktop_sessions_enabled`; it installs the `emptty` `niri.desktop` session, the `/usr/local/bin/start-niri` launcher, and the xdg-desktop-portal config, mirroring `profile_desktop_sway`.
-- Fedora GNOME (`desktop_gnome`) currently assumes GNOME comes from the Fedora Workstation base install; Ansible does not customize GNOME for `nymph` yet.
+- Fedora GNOME (`desktop_gnome`) assumes GNOME comes from the Fedora Workstation base install; Ansible only deploys shared desktop dotfiles and git/GPG config for `nymph`, not GNOME settings.
 - FreeBSD Niri (dormant; `platform_freebsd` currently has no hosts) must keep FreeBSD-specific package, rc, DBus, seat, portal, and launcher behavior in `profile_desktop_niri_freebsd` or FreeBSD platform vars.
 - Do not switch or restart a display manager during a playbook run from an active graphical session. Changing among `emptty`, LightDM, and SDDM requires an explicit run from another TTY/SSH session with `desktop_allow_display_manager_switch=true`. Apply managed XFCE XML while logged out of XFCE so `xfconfd` cannot overwrite it from its in-memory state.
-- `nymph` is the Fedora/GNOME laptop target; keep GNOME unmanaged for now and add host-specific tuning only after real use.
+- `nymph` is the Fedora/GNOME laptop target; keep GNOME settings unmanaged for now and add host-specific tuning only after real use.
 
 ## Void Package And Dotfile Bucket Rules
 `platform_void` is the reusable Void platform selection. The legacy `void` group remains a compatibility parent so existing `group_vars/void.yml` and `when: "'void' in group_names"` checks keep working during the transition.

README.md

@@ -106,7 +106,7 @@ Nota sullo stato attuale del playbook principale:
 Target operativi:
 
 - `ikaros`: Linux Mint + Cinnamon, desktop personale stabile/floating.
-- `nymph`: Fedora Workstation + GNOME, laptop desktop con GNOME non personalizzato da Ansible per ora.
+- `nymph`: Fedora Workstation + GNOME, laptop desktop con dotfiles desktop condivisi e GNOME lasciato al default Fedora.
 
 Il profilo Void desktop resta disponibile come modello riutilizzabile per host
 futuri. `desktop_environment` continua a selezionare in modo esclusivo
@@ -281,6 +281,7 @@ I principali ruoli attualmente presenti sono:
 | services_systemd          | gestione servizi systemd            |
 | services_freebsd          | gestione servizi FreeBSD rc.conf/rc.d |
 | profile_desktop_common    | bootstrap desktop Void condiviso    |
+| profile_desktop_gnome     | dotfiles desktop condivisi per Fedora/GNOME |
 | profile_desktop_sway      | sessione desktop sway / SwayFX (Wayland) |
 | profile_desktop_hyprland  | sessione desktop Hyprland (Wayland) |
 | profile_desktop_niri_freebsd | adattamenti FreeBSD per Niri |
@@ -312,6 +313,7 @@ platform_freebsd -> packages_freebsd + services_freebsd
 platform_freebsd & role_lab -> profile_lab
 platform_freebsd & desktop_niri -> profile_desktop_niri_freebsd
 platform_fedora -> packages_fedora + services_systemd
+platform_fedora & desktop_gnome -> profile_desktop_gnome
 workstation_dev_fedora -> profile_workstation_dev_common
 workstation_host_linux -> profile_workstation_gnome
 workstation_dev_wsl -> packages_ubuntu + services_systemd + profile_workstation_dev_common + profile_workstation_dev_wsl

ansible/inventory/group_vars/desktop_gnome.yml

@@ -32,6 +32,7 @@ fedora_desktop_packages:
   - meld
   - mpv
   - pdfarranger
+  - pinentry-gnome3
   - playerctl
   - qemu
   - qemu-img

ansible/inventory/host_vars/nymph.yml

@@ -2,6 +2,12 @@
 hostname: nymph
 
 # Fedora Workstation/GNOME laptop target. GNOME is provided by the base Fedora
-# Workstation install and is intentionally not customized by Ansible yet.
+# Workstation install; Ansible deploys shared desktop dotfiles but leaves GNOME
-host_packages: []
+# settings unmanaged for now.
+host_packages:
+  - rclone
+  - syncthing
+host_flatpak_packages:
+  - com.spotify.Client
+  - org.telegram.desktop
 host_enabled_services: []

ansible/roles/profile_desktop_gnome/handlers/main.yml

@@ -0,0 +1,11 @@
+---
+- name: Reload GNOME gpg-agent
+  ansible.builtin.command:
+    argv:
+      - gpgconf
+      - --kill
+      - gpg-agent
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  changed_when: false

ansible/roles/profile_desktop_gnome/tasks/main.yml

@@ -0,0 +1,82 @@
+---
+- name: Ensure GNOME desktop user config directories exist
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config"
+    - "{{ user_home }}/.config/autostart"
+    - "{{ user_home }}/.local"
+    - "{{ user_home }}/.local/bin"
+    - "{{ user_home }}/.bashrc.d"
+    - "{{ user_home }}/.tmux"
+    - "{{ user_home }}/.tmux/bin"
+    - "{{ user_home }}/.tmux/plugins"
+
+- name: Ensure GNOME desktop private directories exist
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - path: "{{ user_home }}/.gnupg"
+      mode: "0700"
+    - path: "{{ user_home }}/.ssh"
+      mode: "0700"
+    - path: "{{ user_home }}/.local/state/ssh/sockets"
+      mode: "0700"
+
+- name: Copy GNOME desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_common_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Copy GNOME Emacs desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, emacs, gnome]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_emacs_dotfiles | default([]) }}"
+  when: emacs_enabled | default(false) | bool
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Configure GNOME gpg-agent for Fedora
+  tags: [dotfiles, dotfiles:desktop, git, gnome]
+  ansible.builtin.copy:
+    dest: "{{ user_home }}/.gnupg/gpg-agent.conf"
+    content: |
+      pinentry-program /usr/bin/pinentry-gnome3
+      enable-ssh-support
+      default-cache-ttl 600
+      max-cache-ttl 7200
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+  notify: Reload GNOME gpg-agent
+
+- name: Render GNOME git configuration with private values
+  tags: [dotfiles, dotfiles:desktop, git, gnome]
+  ansible.builtin.template:
+    src: desktop/.gitconfig.j2
+    dest: "{{ user_home }}/.gitconfig"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"

ansible/site.yml

@@ -102,6 +102,13 @@
     - packages_fedora
     - services_systemd
 
+- name: Configure Fedora GNOME desktop
+  hosts: platform_fedora:&desktop_gnome
+  become: true
+
+  roles:
+    - profile_desktop_gnome
+
 - name: Configure Fedora workstation development layer
   hosts: workstation_dev_fedora
   become: true