Feature/aegis coreos (#7)

* feat(aegis): add ARM image bootstrap workflow

* feat(aegis): manage firewall and SSH hardening

* feat(aegis): harden Fedora IoT services

* chore(aegis): remove local TLS configuration

* fix(aegis): restore supported Fedora IoT bootstrap

ansible/inventory/group_vars/desktop_gnome.yml

@@ -11,6 +11,7 @@ fedora_desktop_packages:
   # Fedora equivalents of the development/tooling packages previously pulled by
   # the Void desktop profile.
   - 7zip
+  - arm-image-installer
   - nodejs-bash-language-server
   - bluez
   - bridge-utils

ansible/inventory/group_vars/platform_fedora_coreos.yml

@@ -1,2 +0,0 @@
----
-# Fedora CoreOS is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/group_vars/platform_fedora_iot.yml

@@ -0,0 +1,2 @@
+---
+# Fedora IoT is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/host_vars/aegis.yml

@@ -4,5 +4,10 @@ ansible_connection: ssh
 ansible_user: pi
 ansible_become: true
 ansible_python_interpreter: /usr/bin/python3
+# Avoid PTY framing around module JSON on this remote Fedora IoT host.
+ansible_ssh_use_tty: false
+
+aegis_lan_subnet: 192.168.178.0/24
+aegis_adguard_web_port: 80
 
 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"

ansible/inventory/hosts.yml

@@ -13,7 +13,7 @@ all:
         deadalus:
           ansible_connection: local
 
-    platform_fedora_coreos:
+    platform_fedora_iot:
       hosts:
         aegis:
 
@@ -28,7 +28,7 @@ all:
     fedora:
       children:
         platform_fedora:
-        platform_fedora_coreos:
+        platform_fedora_iot:
 
     rocky:
       children: