Add English README

AGENTS.md

@@ -14,7 +14,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, FreeBS
 - Current personal desktop: `ikaros = platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome`
 - Current laptop: `nymph = platform_fedora + graphical_desktop + desktop_gnome`
 - Void desktop profile is also the base for other future/reference hosts via `platform_void + graphical_desktop`
-- Workstation: `deadalus` is Windows + WSL; Ansible targets are `deadalus-wsl` (Ubuntu) and `deadalus-fedora-wsl` (Fedora)
+- Workstation: `deadalus` is Windows + Fedora WSL.
 - Ubuntu server: `prometheus`
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
 - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
@@ -38,8 +38,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, FreeBS
 - Host-focused dry runs:
   - Fedora desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff`
   - Fedora laptop work: `ansible-playbook ansible/site.yml --limit nymph --check --diff`
-  - Ubuntu WSL dev: `ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff`
-  - Fedora WSL dev: `ansible-playbook ansible/site.yml --limit deadalus-fedora-wsl --check --diff`
+  - WSL workstation dev: `ansible-playbook ansible/site.yml --limit deadalus --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
 - Focused checks:
   - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
@@ -80,14 +79,14 @@ The Void desktop package lists in `ansible/inventory/group_vars/void.yml` are ke
 The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-independent content and `desktop_minimal_dotfiles` carries Thunar, Udiskie, and MIME defaults. `desktop_void_dotfiles` remains reserved for files that need the Void runtime.
 
 ## Workstation Notes
-- `deadalus` is modeled as Windows + WSL; keep Linux dev automation on `deadalus-wsl` (Ubuntu) and `deadalus-fedora-wsl` (Fedora).
+- `deadalus` is modeled as Windows + Fedora WSL and is the sole workstation target.
 - Fedora WSL belongs to `platform_fedora`, `workstation_dev_fedora`, and the shared WSL layer. It must not receive Flatpak or Snap runtimes.
-- Native Linux workstation groups remain available for future hosts but have no current host in the main inventory.
+- Windows applications are installed manually and are not managed from the WSL profile.
 
 ## Coding Agent Notes
 - Shared agent packages live in `ai_agents_npm_packages` in `ansible/inventory/group_vars/all.yml`.
 - Shared agent dotfiles live in `ai_agents_dotfiles`; rendered configs live in `ai_agents_templates`.
-- Desktop, native workstation, and WSL profiles consume the shared agent package list; do not duplicate package entries in profile-specific vars.
+- Desktop and WSL profiles consume the shared agent package list; do not duplicate package entries in profile-specific vars.
 - `dotfiles_common` copies common dotfiles plus `ai_agents_dotfiles`, then renders `ai_agents_templates`.
 - Keep `.config/ai/` as the common instruction source; update agent-specific entrypoints to reference it rather than duplicating instruction text.
 

README.it.md

@@ -0,0 +1,523 @@
+# Infra — Personal Infrastructure as Code
+
+> **English version:** [README.md](README.md)
+
+Questo repository contiene la configurazione **Infrastructure as Code (IaC)** utilizzata per gestire e mantenere allineate diverse macchine personali tramite **Ansible**.
+
+L'obiettivo è avere **una singola fonte di verità** per:
+
+- configurazione delle macchine
+- pacchetti installati
+- servizi di sistema
+- configurazioni utente (dotfiles)
+
+Il repository consente di gestire più sistemi operativi e profili macchina mantenendo una struttura modulare, riproducibile e idempotente.
+
+---
+
+# Architettura del progetto
+
+```text
+infra/
+├── ansible/
+│   ├── ansible.cfg
+│   ├── site.yml
+│   ├── inventory/
+│   │   ├── hosts.yml
+│   │   ├── group_vars/
+│   │   └── host_vars/
+│   ├── templates/
+│   └── roles/
+│
+├── dotfiles/
+│   ├── common/
+│   ├── desktop/
+│   ├── fedora/
+│   ├── ubuntu/
+│   ├── server/
+│   ├── workstation/
+│   ├── workstation_dev_wsl/
+│   └── nymph/
+│
+├── scripts/
+├── secrets/
+├── README.md
+└── README.it.md
+```
+
+Il repository è diviso in due componenti principali:
+
+| Componente | Scopo                                  |
+| ---------- | -------------------------------------- |
+| ansible    | provisioning e configurazione macchine |
+| dotfiles   | configurazioni utente versionate       |
+
+---
+
+# Macchine gestite
+
+Il repository modella attualmente host Fedora/GNOME, una workstation Fedora WSL e un server Ubuntu.
+La composizione resta separata in assi indipendenti:
+
+```text
+common user environment
++ host-specific platform
++ role-specific software
++ independently selectable desktop
++ host hardware overrides
+```
+
+Matrice target:
+
+| Host         | Platform | Role                 | Desktop |
+| ------------ | -------- | -------------------- | ------- |
+| ikaros       | Fedora   | Personal workstation | GNOME   |
+| nymph        | Fedora   | Desktop laptop       | GNOME   |
+| deadalus     | Fedora WSL | Workstation dev    | —       |
+| prometheus   | Ubuntu   | Server               | —       |
+
+Regola operativa:
+
+```text
+ikaros must be boring
+nymph is allowed to break
+```
+
+`ikaros` usa Fedora Workstation/GNOME come desktop personale stabile; `nymph` usa lo stesso
+target Fedora Workstation/GNOME come laptop. I gruppi legacy `void` e `desktop` restano alias di
+compatibilita per eventuali host Void futuri mentre i nuovi assi sono
+`platform_*`, `role_*` e `desktop_*`.
+
+Nota sullo stato attuale del playbook principale:
+
+- `ansible/site.yml` applica oggi in automatico Fedora/GNOME su `ikaros` e `nymph`
+- `ansible/site.yml` applica il profilo Fedora WSL alla workstation `deadalus`
+- `ansible/site.yml` applica anche il profilo `ubuntu_server` con baseline apt, systemd, dotfiles server e firewall UFW
+
+## Desktop
+
+Target operativi:
+
+- `ikaros`: Fedora Workstation + GNOME, desktop personale stabile/floating.
+- `nymph`: Fedora Workstation + GNOME, laptop desktop con dotfiles desktop condivisi e GNOME lasciato al default Fedora.
+
+Il profilo Void desktop resta disponibile come modello riutilizzabile per host
+futuri e usa esclusivamente `desktop_environment: minimal`: Sway e il default,
+mentre Niri si seleziona con il gruppo `desktop_niri`. GNOME e disponibile solo
+sui target Fedora tramite `desktop_gnome`.
+
+Lo stato attuale del profilo desktop include, tra le altre cose:
+
+- dotfiles comuni e desktop
+- sessioni Sway e Niri per eventuali host Void in modalita `minimal`
+- `emptty` con default host-specific in modalita `minimal` e session file Wayland per `sway`
+- pacchetti Void Linux e servizi runit; le liste pacchetti Void desktop sono separate per criterio:
+  - `void_packages_base` per il runtime sistema (init, kernel, audio core, networking, firewall, hw daemons)
+  - `desktop_common_packages` per l'infrastruttura condivisa
+  - `desktop_minimal_packages` per applicazioni GTK e `emptty`
+  - `desktop_sway_packages` per i binari specifici della sessione Sway
+- `turnstile` per i servizi utente Void, incluso `ssh-agent`
+- `ssh-agent` con socket stabile condiviso tra shell e SSH in `~/.local/state/ssh-agent/socket`
+- Emacs usa una sola configurazione orientata a Org e authoring, condivisa da desktop Fedora/GNOME e workstation; Vim resta l'editor di sviluppo
+- `tmux` con plugin gestiti da TPM al bootstrap del profilo desktop
+- Flatpak con remoto Flathub
+- GNOME Keyring e `udiskie` nella modalita minimale
+- multi-monitor Void: sotto Sway è gestito da `kanshi`
+
+---
+
+## Workstation
+
+La workstation `deadalus` usa Fedora in WSL sulla macchina Windows omonima, senza runtime Flatpak o Snap.
+Il profilo è pensato per sviluppo e lavoro.
+
+Nel modello Ansible usato qui, un singolo inventory host puo appartenere intenzionalmente a piu gruppi e quindi ricevere piu play nello stesso run: l'associazione non e `1 host = 1 play`, ma `host + gruppi = layering finale`.
+
+Il profilo workstation e agganciato al playbook principale tramite:
+
+- layer dev Fedora
+- layer WSL dedicato per sviluppo con `systemd`
+
+Lo stato attuale del profilo workstation include:
+
+- installazione pacchetti base Fedora via dnf
+- installazione e configurazione di Docker dal repository ufficiale
+- gestione dei dotfiles workstation e rendering dei template dev condivisi
+- preparazione di Fedora WSL con `systemd` per il toolchain di sviluppo
+- attivazione del firewall `firewalld` sui target Fedora che dichiarano regole host-specifiche
+
+Workflow WSL previsto:
+
+1. avviare Fedora WSL almeno una volta e completare la creazione dell'utente Linux
+2. installare Ansible dentro la distribuzione WSL
+3. lanciare il playbook dalla distribuzione su `deadalus` per configurare l'ambiente dev locale
+4. usare VS Code con le estensioni Remote (`WSL`, `SSH`, `Dev Containers`) dal lato Windows
+
+Le applicazioni Windows sono installate e gestite manualmente; il profilo WSL non installa componenti di remoting Python per esse.
+
+---
+
+## Server
+
+Sistema operativo:
+
+- Ubuntu LTS
+
+Configurazione:
+
+- nessun ambiente grafico
+
+Macchina:
+
+- `prometheus`
+
+Profilo orientato a servizi server e gestione di dotfiles dedicati.
+
+Lo stato attuale del profilo server include:
+
+- installazione pacchetti base Ubuntu via apt
+- installazione e configurazione di Docker dal repository ufficiale
+- abilitazione dei servizi systemd dichiarati in inventory/group vars
+- copia dei dotfiles server e rendering dei template server, incluso il `docker-compose.yml` dello stack servizi
+- attivazione del firewall UFW con regola SSH esplicita
+- apertura delle porte Syncthing `22000/tcp`, `22000/udp` e `21027/udp`, lasciando la GUI non esposta direttamente su UFW
+
+Utente del profilo server:
+
+- il profilo usa `server_username`, `server_user_group` e `server_user_home` definiti in `ansible/inventory/group_vars/server.yml`
+- per default `server_username` eredita `username`, ma puo essere sovrascritto per tutti gli host server via inventory oppure a runtime con extra vars
+- esempio override da CLI:
+
+```bash
+ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser
+```
+
+- se necessario puoi passare anche:
+
+```bash
+ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser -e server_user_group=mygroup -e server_user_home=/srv/myuser
+```
+
+---
+
+# Composizione della configurazione
+
+Emacs è abilitato sui profili Fedora/GNOME e workstation; la configurazione canonica è distribuita da `dotfiles_common`, con Org in `~/Org/`, template versionati e export PDF/HTML/Markdown/DOCX/ODT. Per abilitarlo temporaneamente su un altro profilo:
+
+```bash
+ansible-playbook ansible/site.yml --limit <host> --tags emacs -e emacs_enabled=true
+```
+
+La configurazione finale di una macchina è ottenuta combinando più livelli.
+
+```text
+common configuration
++ platform configuration
++ role configuration
++ desktop configuration
++ host overrides
+```
+
+Esempi correnti:
+
+```text
+ikaros -> common + platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome + ikaros
+nymph  -> common + platform_fedora + graphical_desktop + desktop_gnome + nymph
+deadalus -> common + platform_fedora + workstation_dev_fedora + workstation_dev_wsl + deadalus
+```
+
+Questo approccio consente di:
+
+- mantenere configurazioni condivise
+- applicare override specifici per host
+- evitare duplicazioni
+- riutilizzare il profilo Void corrente su un host futuro assegnandolo a
+  `platform_void + graphical_desktop + desktop_sway`
+
+---
+
+# Ruoli Ansible
+
+I principali ruoli attualmente presenti sono:
+
+| Role                      | Descrizione                         |
+| ------------------------- | ----------------------------------- |
+| base                      | configurazione base comune          |
+| packages_void             | installazione pacchetti su Void     |
+| packages_freebsd          | installazione pacchetti su FreeBSD via pkg |
+| packages_ubuntu           | installazione pacchetti su Ubuntu   |
+| packages_fedora           | installazione pacchetti su Fedora   |
+| services_runit            | gestione servizi runit              |
+| services_systemd          | gestione servizi systemd            |
+| services_freebsd          | gestione servizi FreeBSD dichiarati per host |
+| profile_desktop_common    | bootstrap desktop Void condiviso    |
+| profile_desktop_gnome     | dotfiles desktop condivisi per Fedora/GNOME |
+| profile_desktop_sway      | sessione desktop sway / SwayFX (Wayland) |
+| profile_desktop_niri     | sessione desktop Niri su Void (Wayland) |
+| profile_desktop_host      | override desktop specifici per host |
+| profile_personal_workstation | layer stabile per workstation personale |
+| profile_workstation_dev_common | configurazione dev workstation condivisa |
+| profile_workstation_dev_wsl | configurazione WSL condivisa per sviluppo |
+| profile_server            | configurazione server               |
+| dotfiles_common           | distribuzione dotfiles comuni       |
+| dotfiles                  | distribuzione configurazioni utente |
+
+---
+
+# Stato attuale del playbook principale
+
+Il playbook `ansible/site.yml` e attualmente composto da blocchi per asse:
+
+```text
+all -> dotfiles_common
+platform_void -> packages_void + services_runit
+platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_niri + profile_desktop_host
+platform_freebsd -> packages_freebsd + services_freebsd
+platform_fedora -> packages_fedora + services_systemd
+platform_fedora & role_personal_workstation -> profile_personal_workstation
+platform_fedora & desktop_gnome -> profile_desktop_gnome
+workstation_dev_fedora -> profile_workstation_dev_common
+workstation_dev_wsl -> profile_workstation_dev_wsl (dopo platform_fedora + workstation_dev_fedora)
+ubuntu_server -> packages_ubuntu + services_systemd + profile_server
+```
+
+Questo significa che, allo stato attuale:
+
+- `ikaros` riceve Fedora Workstation/GNOME come target desktop personale stabile
+- `nymph` riceve Fedora Workstation/GNOME come target laptop
+- il profilo Void resta selezionabile tramite `platform_void + graphical_desktop` per host futuri
+- `deadalus` riceve il profilo Fedora WSL tramite play dev dedicati
+- il server Ubuntu (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewall
+- lo stack container server include `navidrome`, `postgres`, `gitea`, `nginx-proxy-manager` e `syncthing`, con GUI Syncthing raggiungibile tramite la rete Docker `web`
+
+# Dotfiles
+
+La directory `dotfiles/` contiene le configurazioni utente versionate.
+
+```text
+dotfiles/
+├── common
+├── desktop
+├── server
+├── fedora
+├── ubuntu
+├── workstation
+├── workstation_dev_wsl
+└── nymph
+```
+
+Le configurazioni sono applicate tramite Ansible e organizzate per livelli:
+
+| Livello | Scopo                            |
+| ------- | -------------------------------- |
+| common  | configurazioni condivise         |
+| profile | configurazioni per tipo macchina |
+| host    | override specifici               |
+
+---
+
+# Requisiti
+
+Per utilizzare il repository sono necessari:
+
+- Python 3
+- Ansible
+- `ansible-lint`
+- `yamllint`
+- `shellcheck`
+- collection definite in `ansible/collections/requirements.yml`
+- accesso locale o SSH alle macchine target, in base a come e definito l'inventory
+
+Installazione base:
+
+```bash
+python3 -m pip install ansible ansible-lint yamllint shellcheck-py
+ansible-galaxy collection install -r ansible/collections/requirements.yml
+```
+
+Gestione segreti:
+
+- il repository supporta il caricamento opzionale di `secrets/vault.yml`
+- il repository supporta anche `secrets/vault.local.yml` per override locali non versionati
+- `secrets/vault.yml.example` funge da template/esempio
+- se `secrets/vault.yml` non e presente, il playbook continua comunque senza caricare variabili locali opzionali
+- se `secrets/.vault_pass.gpg` esiste viene usato automaticamente per sbloccare i vault tramite `gpg`; in alternativa resta supportato `secrets/.vault_pass` come fallback legacy locale; se nessuno dei due file esiste Ansible richiede la password in modo interattivo
+
+---
+
+# Utilizzo
+
+Eseguire il playbook principale:
+
+```bash
+ansible-playbook ansible/site.yml
+```
+
+Allo stato attuale questo comando:
+
+- distribuisce i dotfiles comuni a tutti gli host
+- per `platform_void` applica pacchetti Void e servizi runit
+- per `platform_void + graphical_desktop` applica bootstrap desktop condiviso, sessioni Sway/Niri e override specifici per host
+- per `platform_freebsd` non applica nulla finche il gruppo resta senza host
+- per `platform_fedora` applica pacchetti Fedora e servizi systemd a `ikaros`, `nymph` e `deadalus`
+- per `platform_fedora & role_personal_workstation` applica il layer personale a `ikaros`
+- per `platform_fedora & desktop_gnome` applica il profilo GNOME a `ikaros` e `nymph`
+- per `workstation_dev_wsl` applica i tweak WSL dopo il layer Fedora a `deadalus`, escludendo Flatpak e Snap
+- per gli host `ubuntu_server` applica pacchetti Ubuntu, servizi systemd, profilo server, UFW, dotfiles e template dedicati
+- non riavvia automaticamente il display manager
+- carica `secrets/vault.yml` solo se presente
+- carica `secrets/vault.local.yml` solo se presente, dopo `vault.yml`, cosi gli override locali hanno precedenza
+
+Per validare prima di applicare:
+
+```bash
+ansible-playbook ansible/site.yml --syntax-check
+ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff
+ansible-playbook ansible/site.yml --limit ikaros --check --diff
+ansible-playbook ansible/site.yml --limit nymph --check --diff
+ansible-playbook ansible/site.yml --limit deadalus --check --diff
+ansible-playbook ansible/site.yml --limit prometheus --check --diff
+ansible-lint ansible/site.yml
+ansible-lint ansible/roles
+yamllint ansible/
+```
+
+Per testare un override dell'utente server senza modificare l'inventory:
+
+```bash
+ansible-playbook ansible/site.yml --limit prometheus --check --diff -e server_username=myuser
+```
+
+Per validazioni piu mirate:
+
+```bash
+ansible-playbook ansible/site.yml --limit <host> --tags <tag1>,<tag2> --check --diff
+ansible-playbook ansible/site.yml --limit <host> --start-at-task "<task name>" --check --diff
+ansible-lint ansible/roles/<role>
+yamllint ansible/path/to/file.yml
+docker compose -f /opt/docker/server/docker-compose.yml config
+```
+
+## Tag supportati dal playbook
+
+Per vedere l'elenco reale aggiornato dei tag disponibili:
+
+```bash
+ansible-playbook ansible/site.yml --list-tags
+```
+
+Allo stato attuale `ansible/site.yml` espone questi tag:
+
+| Tag | Scopo | Ambito principale |
+| --- | --- | --- |
+| `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common |
+| `ai_agents` | installazione agenti AI condivisi | Fedora, WSL |
+| `dotfiles` | distribuzione/configurazione dotfiles | tutti i profili |
+| `dotfiles:common` | dotfiles comuni condivisi | common, workstation, server |
+| `dotfiles:desktop` | dotfiles desktop | desktop Void, Fedora/GNOME |
+| `dotfiles:host` | override host-specifici desktop | desktop Void |
+| `dotfiles:server` | dotfiles dedicati al profilo server | server |
+| `dotfiles:workstation` | dotfiles dedicati alle workstation | personal workstation, WSL |
+| `emptty` | gestione display manager `emptty` | desktop Void |
+| `display-manager` | gestione del display manager `emptty` | desktop Void |
+| `emacs` | configurazione Emacs condivisa e dipendenze di authoring | desktop Fedora/GNOME e workstation |
+| `fonts` | installazione font | Fedora |
+| `fzf` | configurazione FZF | dotfiles comuni |
+| `git` | configurazione Git e GPG desktop | Fedora/GNOME, desktop Void |
+| `gnome` | configurazione host GNOME | Fedora/GNOME desktop |
+| `sway` | sessione/configurazione sway / SwayFX (Wayland) | desktop Void |
+| `niri` | sessione/configurazione Niri (Wayland) | desktop Void |
+| `npm` | installazione pacchetti npm globali | Fedora/GNOME, desktop Void, WSL |
+| `nvidia` | componenti NVIDIA desktop | desktop Void |
+| `packages` | installazione e aggiornamento pacchetti | tutti i profili |
+| `portal` | configurazione xdg-desktop-portal | desktop Void |
+| `services` | gestione servizi runit/systemd | tutti i profili |
+| `theme` | configurazione del tema GTK/Qt | desktop Void |
+| `tmux` | configurazione e plugin tmux | desktop Fedora/Void, WSL |
+| `vim` | configurazione Vim | dotfiles comuni |
+| `wsl` | bootstrap e configurazione WSL | WSL |
+
+Esempi pratici:
+
+```bash
+ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,gnome --check --diff
+ansible-playbook ansible/site.yml --limit ikaros --tags gnome --check --diff
+ansible-playbook ansible/site.yml --limit prometheus --tags services,dotfiles:server --check --diff
+```
+
+---
+
+# Bootstrap di una nuova macchina
+
+Una nuova macchina può essere inizializzata con i seguenti passaggi:
+
+```bash
+git clone <repo>
+cd <repo-dir>
+ansible-galaxy collection install -r ansible/collections/requirements.yml
+ansible-playbook ansible/site.yml
+```
+
+Dopo l'esecuzione del playbook la macchina verra configurata secondo il profilo definito e i ruoli attualmente orchestrati.
+
+Per aggiungere un nuovo host Void che riusa il profilo desktop preservato:
+
+1. aggiungere l'host a `platform_void`;
+2. aggiungerlo a `graphical_desktop`;
+3. usare Sway, oppure aggiungerlo a `desktop_niri` per selezionare Niri;
+4. lasciare eventuali dettagli hardware in `host_vars/<host>.yml`.
+
+I gruppi legacy `void` e `desktop` sono parent di compatibilita, quindi un host
+in `platform_void` e `graphical_desktop` continua a ricevere anche le variabili
+Void e desktop esistenti.
+
+Per prove in VM sono disponibili gruppi di esempio in
+`ansible/inventory/examples/platform-test-hosts.yml`, da passare esplicitamente
+con `-i` insieme all'inventory principale.
+
+Per il flusso mail desktop esiste inoltre uno script dedicato:
+
+```bash
+scripts/bootstrap_mail.sh
+```
+
+Lo script si occupa del bootstrap dei secret nel keyring, del primo sync con `mbsync` e dell'inizializzazione di `mu` usando la configurazione mail generata dai template.
+
+Se modifichi questo script, valida almeno con:
+
+```bash
+sh -n scripts/bootstrap_mail.sh
+shellcheck scripts/bootstrap_mail.sh
+```
+
+---
+
+# Filosofia del progetto
+
+Il repository segue alcuni principi chiave:
+
+- Infrastructure as Code
+- configurazione dichiarativa
+- idempotenza
+- ambienti riproducibili
+- separazione tra configurazione sistema e configurazione utente
+
+Questo consente di ricreare qualsiasi macchina partendo esclusivamente dal repository.
+
+---
+
+# Roadmap
+
+Possibili evoluzioni future:
+
+- hardening sicurezza server
+- configurazione backup
+- testing automatico playbook
+- integrazione CI
+- supporto ad altre distribuzioni Linux
+
+---
+
+# Licenza
+
+Questo progetto è distribuito sotto licenza **LGPL-3.0**.

README.md

@@ -1,24 +1,14 @@
 # Infra — Personal Infrastructure as Code
 
-Questo repository contiene la configurazione **Infrastructure as Code (IaC)** utilizzata per gestire e mantenere allineate diverse macchine personali tramite **Ansible**.
+> **Italian version:** [README.it.md](README.it.md)
 
-L'obiettivo è avere **una singola fonte di verità** per:
+This is my Ansible repo for keeping my personal machines and dotfiles in sync. It is the source of truth for packages, services, and user configuration. The setup is meant to stay modular, reproducible, and idempotent without getting too clever.
 
-- configurazione delle macchine
-- pacchetti installati
-- servizi di sistema
-- configurazioni utente (dotfiles)
-
-Il repository consente di gestire più sistemi operativi e profili macchina mantenendo una struttura modulare, riproducibile e idempotente.
-
----
-
-# Architettura del progetto
+## Layout
 
 ```text
 infra/
 ├── ansible/
-│   ├── ansible.cfg
 │   ├── site.yml
 │   ├── inventory/
 │   │   ├── hosts.yml
@@ -26,7 +16,6 @@ infra/
 │   │   └── host_vars/
 │   ├── templates/
 │   └── roles/
-│
 ├── dotfiles/
 │   ├── common/
 │   ├── desktop/
@@ -34,199 +23,96 @@ infra/
 │   ├── ubuntu/
 │   ├── server/
 │   ├── workstation/
-│   ├── workstation_host_linux/
 │   ├── workstation_dev_wsl/
 │   └── nymph/
-│
 ├── scripts/
 ├── secrets/
-└── README.md
+├── README.md
+└── README.it.md
 ```
 
-Il repository è diviso in due componenti principali:
+- `ansible/` holds provisioning and host configuration.
+- `dotfiles/` holds versioned user configuration.
 
-| Componente | Scopo                                  |
-| ---------- | -------------------------------------- |
-| ansible    | provisioning e configurazione macchine |
-| dotfiles   | configurazioni utente versionate       |
+## Managed machines
 
----
-
-# Macchine gestite
-
-Il repository modella attualmente host Fedora/GNOME, ambienti WSL di sviluppo Ubuntu e Fedora e un server Ubuntu.
-La composizione resta separata in assi indipendenti:
+The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, and an Ubuntu server. Configuration is layered instead of being tied to host names:
 
 ```text
 common user environment
-+ host-specific platform
++ platform-specific setup
 + role-specific software
-+ independently selectable desktop
-+ host hardware overrides
++ independently selected desktop
++ host overrides
 ```
 
-Matrice target:
-
-| Host         | Platform | Role                 | Desktop |
-| ------------ | -------- | -------------------- | ------- |
-| ikaros       | Fedora   | Personal workstation | GNOME   |
-| nymph        | Fedora   | Desktop laptop       | GNOME   |
-| deadalus-wsl | Ubuntu   | Workstation dev      | —       |
-| deadalus-fedora-wsl | Fedora | Workstation dev WSL | —       |
-| prometheus   | Ubuntu   | Server               | —       |
-
-Regola operativa:
+| Host | Platform | Role | Desktop |
+| --- | --- | --- | --- |
+| `ikaros` | Fedora | Personal workstation | GNOME |
+| `nymph` | Fedora | Desktop laptop | GNOME |
+| `deadalus` | Fedora WSL | Development workstation | — |
+| `prometheus` | Ubuntu | Server | — |
 
 ```text
 ikaros must be boring
 nymph is allowed to break
 ```
 
-`ikaros` usa Fedora Workstation/GNOME come desktop personale stabile; `nymph` usa lo stesso
-target Fedora Workstation/GNOME come laptop. I gruppi legacy `void` e `desktop` restano alias di
-compatibilita per eventuali host Void futuri mentre i nuovi assi sono
-`platform_*`, `role_*` e `desktop_*`.
+`ikaros` is the stable personal Fedora/GNOME desktop. `nymph` is the laptop and gets the same shared desktop dotfiles while GNOME itself stays close to the Fedora defaults. The legacy `void` and `desktop` groups are compatibility parents; the main axes are `platform_*`, `role_*`, and `desktop_*`.
 
-Nota sullo stato attuale del playbook principale:
+## Desktop profiles
 
-- `ansible/site.yml` applica oggi in automatico Fedora/GNOME su `ikaros` e `nymph`
-- `ansible/site.yml` applica i rami WSL Ubuntu e Fedora per il modello dev in WSL
-- `ansible/site.yml` applica anche il profilo `ubuntu_server` con baseline apt, systemd, dotfiles server e firewall UFW
+- `ikaros`: stable Fedora Workstation + GNOME desktop.
+- `nymph`: Fedora Workstation + GNOME laptop.
+- Void desktops stay available as reusable future profiles through `platform_void + graphical_desktop`.
 
-## Desktop
+Void uses `desktop_environment: minimal`. Sway is the normal session; add a host to `desktop_niri` to select Niri. GNOME is only handled on Fedora through `desktop_gnome`.
 
-Target operativi:
+The desktop setup includes shared desktop dotfiles, Sway/Niri support for future Void hosts, `emptty`, `turnstile` user services, a stable ssh-agent socket at `~/.local/state/ssh-agent/socket`, Emacs authoring config, tmux bootstrapped through TPM, Flatpak, GNOME Keyring, Udiskie, and `kanshi` for Sway multi-monitor setups.
 
-- `ikaros`: Fedora Workstation + GNOME, desktop personale stabile/floating.
-- `nymph`: Fedora Workstation + GNOME, laptop desktop con dotfiles desktop condivisi e GNOME lasciato al default Fedora.
+Void package buckets stay separate on purpose:
 
-Il profilo Void desktop resta disponibile come modello riutilizzabile per host
-futuri e usa esclusivamente `desktop_environment: minimal`: Sway e il default,
-mentre Niri si seleziona con il gruppo `desktop_niri`. GNOME e disponibile solo
-sui target Fedora tramite `desktop_gnome`.
-
-Lo stato attuale del profilo desktop include, tra le altre cose:
-
-- dotfiles comuni e desktop
-- sessioni Sway e Niri per eventuali host Void in modalita `minimal`
-- `emptty` con default host-specific in modalita `minimal` e session file Wayland per `sway`
-- pacchetti Void Linux e servizi runit; le liste pacchetti Void desktop sono separate per criterio:
-  - `void_packages_base` per il runtime sistema (init, kernel, audio core, networking, firewall, hw daemons)
-  - `desktop_common_packages` per l'infrastruttura condivisa
-  - `desktop_minimal_packages` per applicazioni GTK e `emptty`
-  - `desktop_sway_packages` per i binari specifici della sessione Sway
-- `turnstile` per i servizi utente Void, incluso `ssh-agent`
-- `ssh-agent` con socket stabile condiviso tra shell e SSH in `~/.local/state/ssh-agent/socket`
-- Emacs usa una sola configurazione orientata a Org e authoring, condivisa da desktop Fedora/GNOME e workstation; Vim resta l'editor di sviluppo
-- `tmux` con plugin gestiti da TPM al bootstrap del profilo desktop
-- Flatpak con remoto Flathub
-- GNOME Keyring e `udiskie` nella modalita minimale
-- multi-monitor Void: sotto Sway è gestito da `kanshi`
-
----
+- `void_packages_base`: system runtime and services.
+- `desktop_common_packages`: shared GUI infrastructure.
+- `desktop_minimal_packages`: GTK applications and `emptty`.
+- `desktop_sway_packages`: Sway-only binaries.
 
 ## Workstation
 
-Sistemi operativi supportati:
+`deadalus` is the only workstation target. It is Fedora running in WSL on the Windows machine with the same name. Flatpak and Snap are explicitly kept out of this profile.
 
-- Ubuntu WSL, usato da `deadalus-wsl`
-- Fedora WSL, usato da `deadalus-fedora-wsl`
-- Fedora Workstation nativa, disponibile per host futuri tramite gruppi dedicati
+The workstation receives two layers:
 
-Desktop environment host Linux, per eventuali workstation native:
+- Fedora development setup through `workstation_dev_fedora`.
+- WSL setup with `systemd` through `workstation_dev_wsl`.
 
-- GNOME
+That gives it Fedora packages through DNF, Docker from the official repository, shared workstation dotfiles and templates, tmux helpers, and WSL systemd configuration. Windows applications are installed manually; the WSL profile does not manage Python remoting components for them.
 
-Macchine attuali:
+### WSL workflow
 
-- `deadalus-wsl` come ambiente dev Ubuntu in WSL sulla workstation Windows `deadalus`
-- `deadalus-fedora-wsl` come clone dev Fedora in WSL sulla workstation Windows `deadalus`, senza runtime Flatpak o Snap
-
-Questo profilo è pensato per sviluppo e lavoro, con separazione tra layer host e layer dev.
-
-Nel modello Ansible usato qui, un singolo inventory host puo appartenere intenzionalmente a piu gruppi e quindi ricevere piu play nello stesso run: l'associazione non e `1 host = 1 play`, ma `host + gruppi = layering finale`.
-
-Il profilo workstation e agganciato al playbook principale e ora distingue:
-
-- layer dev condiviso tra WSL e workstation Fedora future
-- layer dev Fedora nativo disponibile per host futuri
-- layer host Linux GNOME disponibile per host futuri
-- layer WSL dedicato per sviluppo con `systemd`
-
-Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `workstation_dev_fedora`, a seconda del layering che vuoi comporre.
-
-Lo stato attuale del profilo workstation include:
-
-- installazione pacchetti base Ubuntu via apt
-- installazione pacchetti base Fedora via dnf per eventuali workstation native
-- installazione e configurazione di Docker dal repository ufficiale
-- gestione dei dotfiles workstation e rendering dei template dev condivisi
-- installazione opzionale di Google Chrome, VS Code, IntelliJ IDEA Ultimate e applicazioni Flatpak per eventuali workstation Fedora native
-- estensioni GNOME per eventuali host Linux nativi
-- preparazione dei rami WSL Ubuntu e Fedora con `systemd` per il toolchain di sviluppo
-- attivazione del firewall `firewalld` sui target Fedora che dichiarano regole host-specifiche
-
-Workflow WSL previsto:
-
-1. avviare la distribuzione WSL scelta almeno una volta e completare la creazione dell'utente Linux
-2. installare Ansible dentro la distribuzione WSL
-3. lanciare il playbook dalla distribuzione su `deadalus-wsl` oppure `deadalus-fedora-wsl` per configurare l'ambiente dev locale
-4. usare VS Code con le estensioni Remote (`WSL`, `SSH`, `Dev Containers`) dal lato Windows
-
----
+1. Start Fedora WSL once and finish creating the Linux user.
+2. Install Ansible inside Fedora WSL.
+3. Run the playbook from that distribution with `--limit deadalus`.
+4. Use Windows-side VS Code with Remote WSL, Remote SSH, and Dev Containers if wanted.
 
 ## Server
 
-Sistema operativo:
+`prometheus` is the Ubuntu LTS server. It has no graphical environment and gets server-specific dotfiles and templates.
 
-- Ubuntu LTS
+The server profile installs Ubuntu packages, Docker from the official repository, declared systemd services, UFW rules, and the server Compose stack. Syncthing ports `22000/tcp`, `22000/udp`, and `21027/udp` are opened; the Syncthing GUI is not directly opened in UFW.
 
-Configurazione:
-
-- nessun ambiente grafico
-
-Macchina:
-
-- `prometheus`
-
-Profilo orientato a servizi server e gestione di dotfiles dedicati.
-
-Lo stato attuale del profilo server include:
-
-- installazione pacchetti base Ubuntu via apt
-- installazione e configurazione di Docker dal repository ufficiale
-- abilitazione dei servizi systemd dichiarati in inventory/group vars
-- copia dei dotfiles server e rendering dei template server, incluso il `docker-compose.yml` dello stack servizi
-- attivazione del firewall UFW con regola SSH esplicita
-- apertura delle porte Syncthing `22000/tcp`, `22000/udp` e `21027/udp`, lasciando la GUI non esposta direttamente su UFW
-
-Utente del profilo server:
-
-- il profilo usa `server_username`, `server_user_group` e `server_user_home` definiti in `ansible/inventory/group_vars/server.yml`
-- per default `server_username` eredita `username`, ma puo essere sovrascritto per tutti gli host server via inventory oppure a runtime con extra vars
-- esempio override da CLI:
+Server identity comes from `server_username`, `server_user_group`, and `server_user_home` in `ansible/inventory/group_vars/server.yml`. `server_username` defaults to `username`, but it can be overridden, for example:
 
 ```bash
 ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser
+ansible-playbook ansible/site.yml --limit prometheus \
+  -e server_username=myuser -e server_user_group=mygroup \
+  -e server_user_home=/srv/myuser
 ```
 
-- se necessario puoi passare anche:
+## How layering works
 
-```bash
-ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser -e server_user_group=mygroup -e server_user_home=/srv/myuser
-```
-
----
-
-# Composizione della configurazione
-
-Emacs è abilitato sui profili Fedora/GNOME e workstation; la configurazione canonica è distribuita da `dotfiles_common`, con Org in `~/Org/`, template versionati e export PDF/HTML/Markdown/DOCX/ODT. Per abilitarlo temporaneamente su un altro profilo:
-
-```bash
-ansible-playbook ansible/site.yml --limit <host> --tags emacs -e emacs_enabled=true
-```
-
-La configurazione finale di una macchina è ottenuta combinando più livelli.
+A host can intentionally belong to more than one inventory group. The final configuration is the combination of the host and its groups, not a one-host/one-play mapping.
 
 ```text
 common configuration
@@ -236,56 +122,45 @@ common configuration
 + host overrides
 ```
 
-Esempi correnti:
+Current examples:
 
 ```text
-ikaros -> common + platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome + ikaros
-nymph  -> common + platform_fedora + graphical_desktop + desktop_gnome + nymph
-deadalus-fedora-wsl -> common + platform_fedora + workstation_dev_fedora + workstation_dev_wsl + deadalus-fedora-wsl
+ikaros   -> common + platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome + ikaros
+nymph    -> common + platform_fedora + graphical_desktop + desktop_gnome + nymph
+deadalus -> common + platform_fedora + workstation_dev_fedora + workstation_dev_wsl + deadalus
 ```
 
-Questo approccio consente di:
+This keeps shared configuration reusable, lets host overrides stay small, and leaves the Void desktop profile ready for a future host using `platform_void + graphical_desktop + desktop_sway`.
 
-- mantenere configurazioni condivise
-- applicare override specifici per host
-- evitare duplicazioni
-- riutilizzare il profilo Void corrente su un host futuro assegnandolo a
-  `platform_void + graphical_desktop + desktop_sway`
+Emacs is enabled on Fedora/GNOME and workstation profiles. `dotfiles_common` deploys the canonical authoring setup, including `~/Org/`, versioned templates, and PDF/HTML/Markdown/DOCX/ODT export support. To turn it on temporarily elsewhere:
 
----
+```bash
+ansible-playbook ansible/site.yml --limit <host> --tags emacs -e emacs_enabled=true
+```
 
-# Ruoli Ansible
+## Main roles
 
-I principali ruoli attualmente presenti sono:
+| Role | What it does |
+| --- | --- |
+| `packages_void` | Installs packages on Void. |
+| `packages_freebsd` | Installs packages on FreeBSD with pkg. |
+| `packages_ubuntu` | Installs packages on Ubuntu. |
+| `packages_fedora` | Installs packages on Fedora. |
+| `services_runit` | Manages runit services. |
+| `services_systemd` | Manages systemd services. |
+| `services_freebsd` | Manages declared FreeBSD rc services. |
+| `profile_desktop_common` | Shared Void desktop bootstrap. |
+| `profile_desktop_gnome` | Shared Fedora/GNOME desktop dotfiles. |
+| `profile_desktop_sway` | Sway / SwayFX Wayland session. |
+| `profile_desktop_niri` | Niri Wayland session on Void. |
+| `profile_desktop_host` | Host-specific desktop overrides. |
+| `profile_personal_workstation` | Stable personal-workstation layer. |
+| `profile_workstation_dev_common` | Shared workstation development setup. |
+| `profile_workstation_dev_wsl` | WSL development setup. |
+| `profile_server` | Server setup. |
+| `dotfiles_common` | Shared user dotfiles. |
 
-| Role                      | Descrizione                         |
-| ------------------------- | ----------------------------------- |
-| base                      | configurazione base comune          |
-| packages_void             | installazione pacchetti su Void     |
-| packages_freebsd          | installazione pacchetti su FreeBSD via pkg |
-| packages_ubuntu           | installazione pacchetti su Ubuntu   |
-| packages_fedora           | installazione pacchetti su Fedora   |
-| services_runit            | gestione servizi runit              |
-| services_systemd          | gestione servizi systemd            |
-| services_freebsd          | gestione servizi FreeBSD dichiarati per host |
-| profile_desktop_common    | bootstrap desktop Void condiviso    |
-| profile_desktop_gnome     | dotfiles desktop condivisi per Fedora/GNOME |
-| profile_desktop_sway      | sessione desktop sway / SwayFX (Wayland) |
-| profile_desktop_niri     | sessione desktop Niri su Void (Wayland) |
-| profile_desktop_host      | override desktop specifici per host |
-| profile_personal_workstation | layer stabile per workstation personale |
-| profile_workstation_dev_common | configurazione dev workstation condivisa |
-| profile_workstation_gnome | configurazione host workstation GNOME |
-| profile_workstation_dev_wsl | configurazione WSL condivisa per sviluppo |
-| profile_server            | configurazione server               |
-| dotfiles_common           | distribuzione dotfiles comuni       |
-| dotfiles                  | distribuzione configurazioni utente |
-
----
-
-# Stato attuale del playbook principale
-
-Il playbook `ansible/site.yml` e attualmente composto da blocchi per asse:
+## What `site.yml` runs
 
 ```text
 all -> dotfiles_common
@@ -296,123 +171,59 @@ platform_fedora -> packages_fedora + services_systemd
 platform_fedora & role_personal_workstation -> profile_personal_workstation
 platform_fedora & desktop_gnome -> profile_desktop_gnome
 workstation_dev_fedora -> profile_workstation_dev_common
-workstation_host_linux -> profile_workstation_gnome
-workstation_dev_wsl_ubuntu -> packages_ubuntu + services_systemd + profile_workstation_dev_common + profile_workstation_dev_wsl
-workstation_dev_wsl_fedora -> profile_workstation_dev_wsl (dopo platform_fedora + workstation_dev_fedora)
+workstation_dev_wsl -> profile_workstation_dev_wsl (after platform_fedora + workstation_dev_fedora)
 ubuntu_server -> packages_ubuntu + services_systemd + profile_server
 ```
 
-Questo significa che, allo stato attuale:
+So, in practice:
 
-- `ikaros` riceve Fedora Workstation/GNOME come target desktop personale stabile
-- `nymph` riceve Fedora Workstation/GNOME come target laptop
-- il profilo Void resta selezionabile tramite `platform_void + graphical_desktop` per host futuri
-- i rami WSL Ubuntu (`deadalus-wsl`) e Fedora (`deadalus-fedora-wsl`) sono predisposti con play dev dedicati
-- il server Ubuntu (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewall
-- lo stack container server include `navidrome`, `postgres`, `gitea`, `nginx-proxy-manager` e `syncthing`, con GUI Syncthing raggiungibile tramite la rete Docker `web`
+- `platform_fedora` configures `ikaros`, `nymph`, and `deadalus`.
+- `deadalus` gets the Fedora development layer followed by the WSL layer.
+- `ubuntu_server` configures `prometheus`.
+- Empty `platform_void` and `platform_freebsd` groups do nothing until they get a host.
+- The playbook never restarts the display manager during a run.
+- `secrets/vault.yml` and then `secrets/vault.local.yml` are loaded only when present.
 
-# Dotfiles
+## Requirements
 
-La directory `dotfiles/` contiene le configurazioni utente versionate.
-
-```text
-dotfiles/
-├── common
-├── desktop
-├── server
-├── fedora
-├── ubuntu
-├── workstation
-├── workstation_host_linux
-├── workstation_dev_wsl
-└── nymph
-```
-
-Le configurazioni sono applicate tramite Ansible e organizzate per livelli:
-
-| Livello | Scopo                            |
-| ------- | -------------------------------- |
-| common  | configurazioni condivise         |
-| profile | configurazioni per tipo macchina |
-| host    | override specifici               |
-
----
-
-# Requisiti
-
-Per utilizzare il repository sono necessari:
-
-- Python 3
-- Ansible
-- `ansible-lint`
-- `yamllint`
-- `shellcheck`
-- collection definite in `ansible/collections/requirements.yml`
-- accesso locale o SSH alle macchine target, in base a come e definito l'inventory
-
-Installazione base:
+You will need Python 3, Ansible, `ansible-lint`, `yamllint`, `shellcheck`, and the collections in `ansible/collections/requirements.yml`.
 
 ```bash
 python3 -m pip install ansible ansible-lint yamllint shellcheck-py
 ansible-galaxy collection install -r ansible/collections/requirements.yml
 ```
 
-Gestione segreti:
+Secrets are optional:
 
-- il repository supporta il caricamento opzionale di `secrets/vault.yml`
-- il repository supporta anche `secrets/vault.local.yml` per override locali non versionati
-- `secrets/vault.yml.example` funge da template/esempio
-- se `secrets/vault.yml` non e presente, il playbook continua comunque senza caricare variabili locali opzionali
-- se `secrets/.vault_pass.gpg` esiste viene usato automaticamente per sbloccare i vault tramite `gpg`; in alternativa resta supportato `secrets/.vault_pass` come fallback legacy locale; se nessuno dei due file esiste Ansible richiede la password in modo interattivo
+- `secrets/vault.yml` can hold shared local vault values.
+- `secrets/vault.local.yml` can hold untracked local overrides.
+- `secrets/vault.yml.example` is the example template.
+- If no vault file exists, the playbook still runs without those optional values.
+- `secrets/.vault_pass.gpg` is used when available; `secrets/.vault_pass` is a legacy local fallback. Without either one, Ansible asks for the password interactively.
 
----
+## Running it
 
-# Utilizzo
-
-Eseguire il playbook principale:
+Run the whole playbook:
 
 ```bash
 ansible-playbook ansible/site.yml
 ```
 
-Allo stato attuale questo comando:
-
-- distribuisce i dotfiles comuni a tutti gli host
-- per `platform_void` applica pacchetti Void e servizi runit
-- per `platform_void + graphical_desktop` applica bootstrap desktop condiviso, sessioni Sway/Niri e override specifici per host
-- per `platform_freebsd` e `workstation_host_linux` non applica nulla finche quei gruppi restano senza host
-- per `platform_fedora` applica pacchetti Fedora e servizi systemd a `ikaros`, `nymph` e `deadalus-fedora-wsl`
-- per `platform_fedora & role_personal_workstation` applica il layer personale a `ikaros`
-- per `platform_fedora & desktop_gnome` applica il profilo GNOME a `ikaros` e `nymph`
-- per `workstation_dev_wsl_ubuntu` applica pacchetti Ubuntu, servizi systemd, profilo dev comune e tweak WSL a `deadalus-wsl`
-- per `workstation_dev_wsl_fedora` applica i tweak WSL dopo il layer Fedora a `deadalus-fedora-wsl`, escludendo Flatpak e Snap
-- per gli host `ubuntu_server` applica pacchetti Ubuntu, servizi systemd, profilo server, UFW, dotfiles e template dedicati
-- non riavvia automaticamente il display manager
-- carica `secrets/vault.yml` solo se presente
-- carica `secrets/vault.local.yml` solo se presente, dopo `vault.yml`, cosi gli override locali hanno precedenza
-
-Per validare prima di applicare:
+Useful checks before applying changes:
 
 ```bash
 ansible-playbook ansible/site.yml --syntax-check
 ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff
 ansible-playbook ansible/site.yml --limit ikaros --check --diff
 ansible-playbook ansible/site.yml --limit nymph --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora-wsl --check --diff
+ansible-playbook ansible/site.yml --limit deadalus --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --check --diff
 ansible-lint ansible/site.yml
 ansible-lint ansible/roles
 yamllint ansible/
 ```
 
-Per testare un override dell'utente server senza modificare l'inventory:
-
-```bash
-ansible-playbook ansible/site.yml --limit prometheus --check --diff -e server_username=myuser
-```
-
-Per validazioni piu mirate:
+For focused checks:
 
 ```bash
 ansible-playbook ansible/site.yml --limit <host> --tags <tag1>,<tag2> --check --diff
@@ -422,59 +233,33 @@ yamllint ansible/path/to/file.yml
 docker compose -f /opt/docker/server/docker-compose.yml config
 ```
 
-## Tag supportati dal playbook
+## Tags
 
-Per vedere l'elenco reale aggiornato dei tag disponibili:
+Use Ansible as the source of truth for the current tag list:
 
 ```bash
 ansible-playbook ansible/site.yml --list-tags
 ```
 
-Allo stato attuale `ansible/site.yml` espone questi tag:
+| Tag | Main scope |
+| --- | --- |
+| `always` | Common pre-tasks, including optional vault loading. |
+| `ai_agents` | Shared AI agent installation on Fedora and WSL. |
+| `dotfiles` | User configuration across all profiles. |
+| `dotfiles:common` | Shared dotfiles. |
+| `dotfiles:desktop` | Void and Fedora/GNOME desktop dotfiles. |
+| `dotfiles:host` | Host-specific Void desktop overrides. |
+| `dotfiles:server` | Server dotfiles. |
+| `dotfiles:workstation` | Personal workstation and WSL dotfiles. |
+| `emacs` | Shared Emacs setup and authoring dependencies. |
+| `gnome` | Fedora/GNOME desktop configuration. |
+| `npm` | Global npm packages. |
+| `packages` | Package installation and updates. |
+| `services` | runit and systemd services. |
+| `tmux` | tmux configuration and plugins. |
+| `wsl` | WSL bootstrap and configuration. |
 
-| Tag | Scopo | Ambito principale |
-| --- | --- | --- |
-| `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common |
-| `ai_agents` | installazione agenti AI condivisi | Fedora, WSL |
-| `dotfiles` | distribuzione/configurazione dotfiles | tutti i profili |
-| `dotfiles:common` | dotfiles comuni condivisi | common, workstation, server |
-| `dotfiles:desktop` | dotfiles desktop | desktop Void, Fedora/GNOME |
-| `dotfiles:host` | override host-specifici desktop | desktop Void |
-| `dotfiles:server` | dotfiles dedicati al profilo server | server |
-| `dotfiles:workstation` | dotfiles dedicati alle workstation | personal workstation, WSL, workstation Linux future |
-| `emptty` | gestione display manager `emptty` | desktop Void |
-| `display-manager` | gestione del display manager `emptty` | desktop Void |
-| `emacs` | configurazione Emacs condivisa e dipendenze di authoring | desktop Fedora/GNOME e workstation |
-| `fonts` | installazione font | Fedora |
-| `fzf` | configurazione FZF | dotfiles comuni |
-| `git` | configurazione Git e GPG desktop | Fedora/GNOME, desktop Void |
-| `gnome` | configurazione host GNOME | Fedora/GNOME desktop, workstation host Linux future |
-| `sway` | sessione/configurazione sway / SwayFX (Wayland) | desktop Void |
-| `niri` | sessione/configurazione Niri (Wayland) | desktop Void |
-| `npm` | installazione pacchetti npm globali | Fedora/GNOME, desktop Void, workstation Linux, WSL |
-| `nvidia` | componenti NVIDIA desktop | desktop Void |
-| `packages` | installazione e aggiornamento pacchetti | tutti i profili |
-| `portal` | configurazione xdg-desktop-portal | desktop Void |
-| `services` | gestione servizi runit/systemd | tutti i profili |
-| `theme` | configurazione del tema GTK/Qt | desktop Void |
-| `tmux` | configurazione e plugin tmux | desktop Fedora/Void, WSL |
-| `vim` | configurazione Vim | dotfiles comuni |
-| `vscode` | installazione/configurazione VS Code | workstation Fedora future, host Linux |
-| `wsl` | bootstrap e configurazione WSL | WSL |
-
-Esempi pratici:
-
-```bash
-ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,gnome --check --diff
-ansible-playbook ansible/site.yml --limit ikaros --tags gnome --check --diff
-ansible-playbook ansible/site.yml --limit prometheus --tags services,dotfiles:server --check --diff
-```
-
----
-
-# Bootstrap di una nuova macchina
-
-Una nuova macchina può essere inizializzata con i seguenti passaggi:
+## Bootstrapping a new machine
 
 ```bash
 git clone <repo>
@@ -483,66 +268,11 @@ ansible-galaxy collection install -r ansible/collections/requirements.yml
 ansible-playbook ansible/site.yml
 ```
 
-Dopo l'esecuzione del playbook la macchina verra configurata secondo il profilo definito e i ruoli attualmente orchestrati.
+For a future Void desktop host:
 
-Per aggiungere un nuovo host Void che riusa il profilo desktop preservato:
+1. Add it to `platform_void`.
+2. Add it to `graphical_desktop`.
+3. Use Sway, or add it to `desktop_niri` for Niri.
+4. Put hardware-specific details in `host_vars/<host>.yml`.
 
-1. aggiungere l'host a `platform_void`;
-2. aggiungerlo a `graphical_desktop`;
-3. usare Sway, oppure aggiungerlo a `desktop_niri` per selezionare Niri;
-4. lasciare eventuali dettagli hardware in `host_vars/<host>.yml`.
-
-I gruppi legacy `void` e `desktop` sono parent di compatibilita, quindi un host
-in `platform_void` e `graphical_desktop` continua a ricevere anche le variabili
-Void e desktop esistenti.
-
-Per prove in VM sono disponibili gruppi di esempio in
-`ansible/inventory/examples/platform-test-hosts.yml`, da passare esplicitamente
-con `-i` insieme all'inventory principale.
-
-Per il flusso mail desktop esiste inoltre uno script dedicato:
-
-```bash
-scripts/bootstrap_mail.sh
-```
-
-Lo script si occupa del bootstrap dei secret nel keyring, del primo sync con `mbsync` e dell'inizializzazione di `mu` usando la configurazione mail generata dai template.
-
-Se modifichi questo script, valida almeno con:
-
-```bash
-sh -n scripts/bootstrap_mail.sh
-shellcheck scripts/bootstrap_mail.sh
-```
-
----
-
-# Filosofia del progetto
-
-Il repository segue alcuni principi chiave:
-
-- Infrastructure as Code
-- configurazione dichiarativa
-- idempotenza
-- ambienti riproducibili
-- separazione tra configurazione sistema e configurazione utente
-
-Questo consente di ricreare qualsiasi macchina partendo esclusivamente dal repository.
-
----
-
-# Roadmap
-
-Possibili evoluzioni future:
-
-- hardening sicurezza server
-- configurazione backup
-- testing automatico playbook
-- integrazione CI
-- supporto ad altre distribuzioni Linux
-
----
-
-# Licenza
-
-Questo progetto è distribuito sotto licenza **LGPL-3.0**.
+The legacy `void` and `desktop` groups remain compatibility parents, so hosts in `platform_void` and `graphical_desktop` still receive the existing Void and desktop variables.

ansible/inventory/group_vars/fedora.yml

@@ -12,12 +12,6 @@ fedora_packages_base:
   - ripgrep
 
 fedora_manage_docker_repo: true
-fedora_manage_google_chrome_repo: true
-fedora_manage_intellij_repo: true
-fedora_manage_vscode_repo: true
-fedora_intellij_copr_owner: coder966
-fedora_intellij_copr_project: intellij-idea-ultimate
-fedora_intellij_package_name: intellij-idea-ultimate
 
 fedora_emacs_packages:
   - emacs-pgtk
@@ -53,7 +47,7 @@ fedora_dotfiles:
 
 workstation_firewall_backend: firewalld
 
-fedora_workstation_dev_packages:
+fedora_dev_packages:
   - croc
   - distrobox
   - gnupg
@@ -62,35 +56,5 @@ fedora_workstation_dev_packages:
   - openssh-clients
   - shellcheck
 
-workstation_host_linux_packages_fedora:
-  - code
-  - croc
-  - firewall-config
-  - gnome-extensions-app
-  - gnome-shell-extension-appindicator
-  - gnome-shell-extension-just-perfection
-  - gnome-shell-extension-no-overview
-  - gnome-tweaks
-  - libreoffice
-  - meld
-  - NetworkManager-openconnect-gnome
-  - pcsc-lite
-  - pinentry-gnome3
-  - podman
-  - podman-compose
-  - rclone
-  - yubikey-manager
-
 fedora_flatpak_remote_name: flathub
 fedora_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
-
-workstation_flatpak_remote_name: "{{ fedora_flatpak_remote_name }}"
-workstation_flatpak_remote_url: "{{ fedora_flatpak_remote_url }}"
-workstation_flatpak_packages:
-  - com.getpostman.Postman
-  - com.spotify.Client
-  - com.github.jeromerobert.pdfarranger
-  - com.github.xournalpp.xournalpp
-  - io.dbeaver.DBeaverCommunity
-  - org.mozilla.Thunderbird
-  - org.telegram.desktop

ansible/inventory/group_vars/workstation_dev.yml

@@ -1,14 +1,6 @@
 ---
 emacs_enabled: true
 
-workstation_dev_packages:
-  - distrobox
-  - gnupg
-  - gpg-agent
-  - libfido2-1
-  - openssh-client
-  - shellcheck
-
 workstation_user_directories:
   - path: "{{ user_home }}/.config"
     mode: "0755"

ansible/inventory/group_vars/workstation_dev_wsl.yml

@@ -3,25 +3,10 @@ enabled_services:
   - docker
 
 workstation_dev_wsl_packages:
-  - lazygit
   - pinentry-curses
   - python3-pip
   - tmux
-workstation_dev_wsl_excluded_packages:
-  - alacritty
-  - pcscd
-  - pinentry-gnome3
-  - podman
-  - podman-compose
-  - ufw
-  - yubikey-manager
 workstation_is_wsl: true
-workstation_manage_google_chrome: false
-workstation_manage_croc: true
-workstation_croc_version: v11.0.3
-workstation_removed_snap_packages: []
-workstation_snap_packages: []
-workstation_dev_wsl_python_packages: []
 workstation_wsl_systemd_enabled: true
 workstation_dev_wsl_dotfiles:
   - src: .gnupg/gpg-agent.conf

ansible/inventory/group_vars/workstation_dev_wsl.yml.orig

@@ -1,47 +0,0 @@
----
-enabled_services:
-  - docker
-
-workstation_dev_wsl_packages:
-  - lazygit
-  - pinentry-curses
-  - python3-pip
-workstation_dev_wsl_excluded_packages:
-  - alacritty
-  - pcscd
-  - pinentry-gnome3
-  - podman
-  - podman-compose
-  - ufw
-  - yubikey-manager
-workstation_is_wsl: true
-workstation_manage_google_chrome: false
-<<<<<<< HEAD
-workstation_removed_snap_packages: []
-workstation_snap_packages:
-  - name: glab
-    classic: true
-workstation_dev_wsl_python_packages: []
-||||||| parent of cb83ed1 (Update gitconfig on WSL)
-workstation_removed_snap_packages: []
-workstation_snap_packages:
-  - name: glab
-    classic: true
-workstation_dev_wsl_python_packages:
-  - pypsrp
-  - pyspnego
-=======
-workstation_manage_glab: true
-workstation_glab_version: "1.103.0"
-workstation_removed_snap_packages:
-  - glab
-workstation_snap_packages: []
-workstation_dev_wsl_python_packages:
-  - pypsrp
-  - pyspnego
->>>>>>> cb83ed1 (Update gitconfig on WSL)
-workstation_wsl_systemd_enabled: true
-workstation_dev_wsl_dotfiles:
-  - src: .gnupg/gpg-agent.conf
-    dest: .gnupg/gpg-agent.conf
-    mode: "0600"

ansible/inventory/group_vars/workstation_dev_wsl_fedora.yml

@@ -1,11 +0,0 @@
----
-# Fedora WSL mirrors the Ubuntu WSL development profile without installing
-# alternative application runtimes.
-fedora_excluded_packages:
-  - flatpak
-  - lazygit
-fedora_removed_packages:
-  - flatpak
-  - snapd
-fedora_manage_lazygit: true
-fedora_lazygit_version: 0.64.1

ansible/inventory/group_vars/workstation_host_linux.yml

@@ -1,75 +0,0 @@
----
-emacs_enabled: true
-
-workstation_host_linux_packages:
-  - croc
-  - gnome-shell-extension-manager
-  - gnome-shell-extensions
-  - gnome-tweaks
-  - gufw
-  - libreoffice
-  - meld
-  - network-manager-openconnect-gnome
-  - pcscd
-  - pinentry-gnome3
-  - podman
-  - podman-compose
-  - yubikey-manager
-
-workstation_host_linux_dotfiles:
-  - src: .gnupg/gpg-agent.conf
-    dest: .gnupg/gpg-agent.conf
-    mode: "0600"
-
-workstation_firewall_backend: ufw
-workstation_manage_google_chrome: true
-
-workstation_removed_snap_packages:
-  - firefox
-
-workstation_snap_packages:
-  - name: intellij-idea-ultimate
-    classic: true
-    channel: latest/stable
-  - name: postman
-    classic: false
-    channel: latest/stable
-  - name: thunderbird
-    classic: false
-    channel: latest/stable
-  - name: code
-    classic: true
-    channel: latest/stable
-  - name: xournalpp
-    classic: false
-    channel: latest/stable
-  - name: pdfarranger
-    classic: false
-    channel: latest/stable
-  - name: spotify
-    classic: false
-    channel: latest/stable
-  - name: telegram-desktop
-    classic: false
-    channel: latest/stable
-  - name: dbeaver-ce
-    classic: true
-    channel: latest/stable
-
-workstation_gnome_extensions:
-  - id: 9308
-    uuid: bluetooth-battery-monitor@v8v88v8v88.com
-    version_tag: 68559
-    enabled: true
-  - id: 1401
-    uuid: bluetooth-quick-connect@bjarosze.gmail.com
-    version_tag: 65323
-    enabled: true
-  - id: 6099
-    uuid: paperwm@paperwm.github.com
-    version_tag: 68525
-    enabled: true
-
-workstation_disabled_gnome_extensions:
-  - tiling-assistant@ubuntu.com
-  - ubuntu-dock@ubuntu.com

ansible/inventory/host_vars/deadalus-fedora-wsl.yml

@@ -1,6 +0,0 @@
----
-hostname: deadalus-fedora-wsl
-workstation_wsl_windows_user_home: /mnt/c/Users/FABIOSCOTTODISANTOLO
-
-host_packages: []
-host_enabled_services: []

ansible/inventory/host_vars/deadalus-wsl.yml

@@ -1,6 +0,0 @@
----
-hostname: deadalus-wsl
-workstation_wsl_windows_user_home: /mnt/c/Users/FABIOSCOTTODISANTOLO
-
-host_packages: []
-host_enabled_services: []

ansible/inventory/host_vars/deadalus.yml

@@ -0,0 +1,13 @@
+---
+hostname: deadalus
+workstation_wsl_windows_user_home: /mnt/c/Users/FABIOSCOTTODISANTOLO
+
+host_packages: []
+host_enabled_services: []
+
+# Fedora WSL must not receive alternative application runtimes.
+fedora_excluded_packages:
+  - flatpak
+fedora_removed_packages:
+  - flatpak
+  - snapd

ansible/inventory/hosts.yml

@@ -10,7 +10,7 @@ all:
           ansible_connection: local
         nymph:
           ansible_connection: local
-        deadalus-fedora-wsl:
+        deadalus:
           ansible_connection: local
 
     platform_freebsd:
@@ -55,18 +55,12 @@ all:
 
     ubuntu:
       children:
-        workstation_dev_wsl_ubuntu:
         ubuntu_server:
 
     workstation:
       children:
-        workstation_host:
         workstation_dev:
 
-    workstation_host:
-      children:
-        workstation_host_linux:
-
     workstation_dev:
       children:
         workstation_dev_fedora:
@@ -76,29 +70,14 @@ all:
       children:
         ubuntu_server:
 
-    fedora_workstation:
-      hosts: {}
-
-    workstation_host_linux:
-      hosts: {}
-
     workstation_dev_fedora:
-      children:
-        workstation_dev_wsl_fedora:
-
-    workstation_dev_wsl:
-      children:
-        workstation_dev_wsl_ubuntu:
-        workstation_dev_wsl_fedora:
-
-    workstation_dev_wsl_ubuntu:
       hosts:
-        deadalus-wsl:
+        deadalus:
           ansible_connection: local
 
-    workstation_dev_wsl_fedora:
+    workstation_dev_wsl:
       hosts:
-        deadalus-fedora-wsl:
+        deadalus:
           ansible_connection: local
 
     ubuntu_server:

ansible/roles/packages_fedora/tasks/main.yml

@@ -25,47 +25,6 @@
     - "'workstation_dev_fedora' in group_names"
     - fedora_manage_docker_repo | default(false)
 
-- name: Configure Google Chrome repository on Fedora
-  tags: [packages]
-  ansible.builtin.yum_repository:
-    name: google-chrome
-    description: Google Chrome
-    baseurl: "https://dl.google.com/linux/chrome/rpm/stable/$basearch"
-    enabled: true
-    gpgcheck: true
-    gpgkey: https://dl.google.com/linux/linux_signing_key.pub
-    state: present
-  when:
-    - workstation_manage_google_chrome | default(false)
-    - fedora_manage_google_chrome_repo | default(false)
-
-- name: Configure Visual Studio Code repository on Fedora
-  tags: [packages, vscode]
-  ansible.builtin.yum_repository:
-    name: vscode
-    description: Visual Studio Code
-    baseurl: https://packages.microsoft.com/yumrepos/vscode
-    enabled: true
-    gpgcheck: true
-    gpgkey: https://packages.microsoft.com/keys/microsoft.asc
-    state: present
-  when:
-    - "'workstation_host_linux' in group_names"
-    - fedora_manage_vscode_repo | default(false)
-
-- name: Configure IntelliJ IDEA COPR repository on Fedora
-  tags: [packages]
-  ansible.builtin.get_url:
-    url: >-
-      https://copr.fedorainfracloud.org/coprs/{{ fedora_intellij_copr_owner }}/{{ fedora_intellij_copr_project }}/repo/fedora-{{ ansible_facts['distribution_major_version'] }}/{{ fedora_intellij_copr_owner }}-{{ fedora_intellij_copr_project }}-fedora-{{ ansible_facts['distribution_major_version'] }}.repo
-    dest: /etc/yum.repos.d/{{ fedora_intellij_copr_owner }}-{{ fedora_intellij_copr_project }}-fedora-{{ ansible_facts['distribution_major_version'] }}.repo
-    owner: root
-    group: root
-    mode: "0644"
-  when:
-    - "'workstation_host_linux' in group_names"
-    - fedora_manage_intellij_repo | default(false)
-
 - name: Refresh dnf package metadata
   tags: [packages]
   ansible.builtin.dnf:
@@ -84,11 +43,6 @@
             if 'workstation_dev_fedora' in group_names
             else []
           )
-        + (
-            ['google-chrome-stable']
-            if workstation_manage_google_chrome | default(false)
-            else []
-          )
         + (profile_packages | default([]))
         + (
             (fedora_desktop_packages | default([]))
@@ -103,7 +57,7 @@
             else []
           )
         + (
-            (fedora_workstation_dev_packages | default(workstation_dev_packages | default([])))
+            (fedora_dev_packages | default([]))
             if 'workstation_dev_fedora' in group_names
             else []
           )
@@ -112,19 +66,6 @@
             if 'workstation_dev_wsl' in group_names
             else []
           )
-        + (
-            (workstation_host_linux_packages_fedora | default(workstation_host_linux_packages | default([])))
-            if 'workstation_host_linux' in group_names
-            else []
-          )
-        + (
-            [fedora_intellij_package_name]
-            if (
-              'workstation_host_linux' in group_names
-              and fedora_manage_intellij_repo | default(false)
-            )
-            else []
-          )
         + (host_packages | default([]))
         )
         | difference(fedora_excluded_packages | default([]))
@@ -139,100 +80,6 @@
     state: absent
   when: (fedora_removed_packages | default([])) | length > 0
 
-- name: Ensure architecture is supported for LazyGit release
-  tags: [packages]
-  ansible.builtin.fail:
-    msg: "Unsupported architecture {{ ansible_facts['architecture'] }} for LazyGit release"
-  when:
-    - fedora_manage_lazygit | default(false)
-    - ansible_facts['architecture'] not in ['x86_64', 'aarch64', 'arm64']
-
-- name: Read installed LazyGit version
-  tags: [packages]
-  ansible.builtin.command: /usr/local/bin/lazygit --version
-  register: fedora_lazygit_version_check
-  changed_when: false
-  failed_when: false
-  check_mode: false
-  when: fedora_manage_lazygit | default(false)
-
-- name: Ensure temporary LazyGit extraction directory is absent
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/lazygit_{{ fedora_lazygit_version }}"
-    state: absent
-  when:
-    - fedora_manage_lazygit | default(false)
-    - fedora_lazygit_version not in (fedora_lazygit_version_check.stdout | default(''))
-
-- name: Create temporary LazyGit extraction directory
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/lazygit_{{ fedora_lazygit_version }}"
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-  when:
-    - fedora_manage_lazygit | default(false)
-    - fedora_lazygit_version not in (fedora_lazygit_version_check.stdout | default(''))
-
-- name: Download LazyGit release archive
-  tags: [packages]
-  ansible.builtin.get_url:
-    url: >-
-      https://github.com/jesseduffield/lazygit/releases/download/v{{ fedora_lazygit_version }}/lazygit_{{
-      fedora_lazygit_version }}_Linux_{{
-      'x86_64' if ansible_facts['architecture'] == 'x86_64'
-      else 'arm64'
-      }}.tar.gz
-    dest: "/tmp/lazygit_{{ fedora_lazygit_version }}.tar.gz"
-    mode: "0644"
-  when:
-    - fedora_manage_lazygit | default(false)
-    - fedora_lazygit_version not in (fedora_lazygit_version_check.stdout | default(''))
-
-- name: Extract LazyGit release archive
-  tags: [packages]
-  ansible.builtin.unarchive:
-    src: "/tmp/lazygit_{{ fedora_lazygit_version }}.tar.gz"
-    dest: "/tmp/lazygit_{{ fedora_lazygit_version }}"
-    remote_src: true
-  when:
-    - fedora_manage_lazygit | default(false)
-    - fedora_lazygit_version not in (fedora_lazygit_version_check.stdout | default(''))
-
-- name: Install LazyGit binary
-  tags: [packages]
-  ansible.builtin.copy:
-    src: "/tmp/lazygit_{{ fedora_lazygit_version }}/lazygit"
-    dest: /usr/local/bin/lazygit
-    owner: root
-    group: root
-    mode: "0755"
-    remote_src: true
-  when:
-    - fedora_manage_lazygit | default(false)
-    - fedora_lazygit_version not in (fedora_lazygit_version_check.stdout | default(''))
-
-- name: Remove downloaded LazyGit archive
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/lazygit_{{ fedora_lazygit_version }}.tar.gz"
-    state: absent
-  when:
-    - fedora_manage_lazygit | default(false)
-    - fedora_lazygit_version not in (fedora_lazygit_version_check.stdout | default(''))
-
-- name: Remove temporary LazyGit extraction directory
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/lazygit_{{ fedora_lazygit_version }}"
-    state: absent
-  when:
-    - fedora_manage_lazygit | default(false)
-    - fedora_lazygit_version not in (fedora_lazygit_version_check.stdout | default(''))
-
 - name: Add user to docker group
   tags: [packages]
   ansible.builtin.user:
@@ -262,11 +109,6 @@
         (
           (fedora_flatpak_packages | default([]))
           + (host_flatpak_packages | default([]))
-          + (
-              (workstation_flatpak_packages | default([]))
-              if 'workstation_host_linux' in group_names
-              else []
-            )
         )
         | unique
       }}

ansible/roles/packages_ubuntu/tasks/main.yml

@@ -1,9 +1,4 @@
 ---
-- name: Gather installed package facts
-  tags: [packages]
-  ansible.builtin.package_facts:
-    manager: auto
-
 - name: Copy Ubuntu dotfiles
   tags: [dotfiles, dotfiles:common]
   ansible.builtin.copy:
@@ -16,75 +11,6 @@
   loop_control:
     label: "{{ item.dest }}"
 
-- name: Ensure architecture is supported for Google Chrome
-  tags: [packages]
-  ansible.builtin.fail:
-    msg: "Unsupported architecture {{ ansible_facts['architecture'] }} for Google Chrome stable package"
-  when:
-    - workstation_manage_google_chrome | default(false)
-    - ansible_facts['architecture'] != 'x86_64'
-
-- name: Download Google Chrome Debian package
-  tags: [packages]
-  ansible.builtin.get_url:
-    url: https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
-    dest: /tmp/google-chrome-stable_current_amd64.deb
-    mode: "0644"
-  when:
-    - workstation_manage_google_chrome | default(false)
-    - "'google-chrome-stable' not in (ansible_facts.packages | default({}))"
-
-- name: Install Google Chrome from downloaded Debian package
-  tags: [packages]
-  ansible.builtin.apt:
-    deb: /tmp/google-chrome-stable_current_amd64.deb
-    state: present
-  when:
-    - workstation_manage_google_chrome | default(false)
-    - "'google-chrome-stable' not in (ansible_facts.packages | default({}))"
-
-- name: Remove downloaded Google Chrome Debian package
-  tags: [packages]
-  ansible.builtin.file:
-    path: /tmp/google-chrome-stable_current_amd64.deb
-    state: absent
-  when:
-    - workstation_manage_google_chrome | default(false)
-    - "'google-chrome-stable' not in (ansible_facts.packages | default({}))"
-
-- name: Download glab Debian package
-  tags: [packages]
-  ansible.builtin.get_url:
-    url: >-
-      https://gitlab.com/gitlab-org/cli/-/releases/v{{ workstation_glab_version }}/downloads/glab_{{ workstation_glab_version }}_linux_{{
-        'amd64' if ansible_facts['architecture'] == 'x86_64'
-        else 'arm64' if ansible_facts['architecture'] in ['aarch64', 'arm64']
-        else ansible_facts['architecture']
-      }}.deb
-    dest: "/tmp/glab_{{ workstation_glab_version }}.deb"
-    mode: "0644"
-  when:
-    - workstation_manage_glab | default(false)
-    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
-
-- name: Install glab from downloaded Debian package
-  tags: [packages]
-  ansible.builtin.apt:
-    deb: "/tmp/glab_{{ workstation_glab_version }}.deb"
-    state: present
-  when:
-    - workstation_manage_glab | default(false)
-    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
-
-- name: Remove downloaded glab Debian package
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/glab_{{ workstation_glab_version }}.deb"
-    state: absent
-  when:
-    - workstation_manage_glab | default(false)
-    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
-
 - name: Ensure Docker apt keyrings directory exists
   tags: [packages]
   ansible.builtin.file:
@@ -141,25 +67,8 @@
             if (emacs_enabled | default(false) | bool)
             else []
           )
-        + (workstation_dev_packages | default([]))
-        + (
-            (workstation_host_linux_packages | default([]))
-            if 'workstation_host_linux' in group_names
-            else []
-          )
-        + (
-            (workstation_dev_wsl_packages | default([]))
-            if 'workstation_dev_wsl' in group_names
-            else []
-          )
-        + (desktop_common_packages | default([]))
         + (host_packages | default([]))
         )
-        | difference(
-            (workstation_dev_wsl_excluded_packages | default([]))
-            if 'workstation_dev_wsl' in group_names
-            else []
-          )
         | unique
       }}
     state: present
@@ -171,127 +80,3 @@
     groups: docker
     append: true
   when: (ubuntu_docker_packages | default([])) | length > 0
-
-- name: Ensure architecture is supported for croc GitHub release
-  tags: [packages]
-  ansible.builtin.fail:
-    msg: "Unsupported architecture {{ ansible_facts['architecture'] }} for croc GitHub release"
-  when:
-    - workstation_manage_croc | default(false)
-    - ansible_facts['architecture'] not in ['x86_64', 'aarch64', 'arm64']
-
-- name: Read installed croc version
-  tags: [packages]
-  ansible.builtin.command: /usr/local/bin/croc --version
-  register: croc_version_check
-  changed_when: false
-  failed_when: false
-  check_mode: false
-  when: workstation_manage_croc | default(false)
-
-- name: Ensure temporary croc extraction directory is absent
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/croc_{{ workstation_croc_version }}"
-    state: absent
-  when:
-    - workstation_manage_croc | default(false)
-    - workstation_croc_version not in (croc_version_check.stdout | default(''))
-
-- name: Create temporary croc extraction directory
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/croc_{{ workstation_croc_version }}"
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-  when:
-    - workstation_manage_croc | default(false)
-    - workstation_croc_version not in (croc_version_check.stdout | default(''))
-
-- name: Download croc GitHub release archive
-  tags: [packages]
-  ansible.builtin.get_url:
-    url: >-
-      {{
-        'https://github.com/schollz/croc/releases/download/'
-        ~ workstation_croc_version
-        ~ '/croc_'
-        ~ workstation_croc_version
-        ~ '_Linux-'
-        ~ (
-          '64bit' if ansible_facts['architecture'] == 'x86_64'
-          else 'ARM64' if ansible_facts['architecture'] in ['aarch64', 'arm64']
-          else ansible_facts['architecture']
-        )
-        ~ '.tar.gz'
-      }}
-    dest: "/tmp/croc_{{ workstation_croc_version }}.tar.gz"
-    mode: "0644"
-  when:
-    - workstation_manage_croc | default(false)
-    - workstation_croc_version not in (croc_version_check.stdout | default(''))
-
-- name: Extract croc GitHub release archive
-  tags: [packages]
-  ansible.builtin.unarchive:
-    src: "/tmp/croc_{{ workstation_croc_version }}.tar.gz"
-    dest: "/tmp/croc_{{ workstation_croc_version }}"
-    remote_src: true
-  when:
-    - workstation_manage_croc | default(false)
-    - workstation_croc_version not in (croc_version_check.stdout | default(''))
-
-- name: Install croc binary
-  tags: [packages]
-  ansible.builtin.copy:
-    src: "/tmp/croc_{{ workstation_croc_version }}/croc"
-    dest: /usr/local/bin/croc
-    owner: root
-    group: root
-    mode: "0755"
-    remote_src: true
-  when:
-    - workstation_manage_croc | default(false)
-    - workstation_croc_version not in (croc_version_check.stdout | default(''))
-
-- name: Remove downloaded croc archive
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/croc_{{ workstation_croc_version }}.tar.gz"
-    state: absent
-  when:
-    - workstation_manage_croc | default(false)
-    - workstation_croc_version not in (croc_version_check.stdout | default(''))
-
-- name: Remove temporary croc extraction directory
-  tags: [packages]
-  ansible.builtin.file:
-    path: "/tmp/croc_{{ workstation_croc_version }}"
-    state: absent
-  when:
-    - workstation_manage_croc | default(false)
-    - workstation_croc_version not in (croc_version_check.stdout | default(''))
-
-- name: Remove workstation snap packages
-  tags: [packages]
-  community.general.snap:
-    name: "{{ item }}"
-    state: absent
-  loop: "{{ workstation_removed_snap_packages | default([]) }}"
-  loop_control:
-    label: "{{ item }}"
-  when: (workstation_removed_snap_packages | default([])) | length > 0
-
-- name: Install workstation snap packages
-  tags: [packages]
-  community.general.snap:
-    name: "{{ item.name }}"
-    classic: "{{ item.classic | default(false) }}"
-    channel: "{{ item.channel | default(omit) }}"
-    state: present
-  loop: "{{ workstation_snap_packages | default([]) }}"
-  loop_control:
-    label: "{{ item.name }}"
-  when: (workstation_snap_packages | default([])) | length > 0

ansible/roles/profile_workstation_dev_wsl/tasks/main.yml

@@ -76,15 +76,6 @@
   register: workstation_wsl_systemd_config
   when: workstation_wsl_systemd_enabled | default(false)
 
-- name: Install WSL Python packages for Windows remoting
-  tags: [packages]
-  ansible.builtin.pip:
-    name: "{{ workstation_dev_wsl_python_packages | default([]) }}"
-    executable: pip3
-    extra_args: --break-system-packages
-    state: present
-  when: (workstation_dev_wsl_python_packages | default([])) | length > 0
-
 - name: Note when WSL must be restarted
   tags: [packages, services]
   ansible.builtin.debug:

ansible/roles/profile_workstation_gnome/tasks/main.yml

@@ -1,262 +0,0 @@
----
-- name: Copy workstation host Linux dotfiles
-  tags: [dotfiles, dotfiles:workstation, gnome]
-  ansible.builtin.copy:
-    src: "{{ playbook_dir }}/../dotfiles/workstation_host_linux/{{ item.src }}"
-    dest: "{{ user_home }}/{{ item.dest }}"
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "{{ item.mode }}"
-  loop: "{{ workstation_host_linux_dotfiles | default([]) }}"
-  loop_control:
-    label: "{{ item.dest }}"
-
-- name: Ensure GNOME extension directories exist
-  tags: [packages, gnome]
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "0755"
-  loop:
-    - "{{ user_home }}/.cache/gnome-shell/extensions"
-    - "{{ user_home }}/.local/share/gnome-shell/extensions"
-
-- name: Gather workstation user account data
-  tags: [packages, gnome]
-  ansible.builtin.getent:
-    database: passwd
-    key: "{{ username }}"
-
-- name: Set workstation GNOME session environment
-  tags: [packages, gnome]
-  ansible.builtin.set_fact:
-    workstation_user_uid: "{{ ansible_facts.getent_passwd[username][1] }}"
-    workstation_gnome_extension_dir: "{{ user_home }}/.cache/gnome-shell/extensions"
-    workstation_gnome_environment:
-      HOME: "{{ user_home }}"
-      XDG_RUNTIME_DIR: "/run/user/{{ ansible_facts.getent_passwd[username][1] }}"
-      DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ ansible_facts.getent_passwd[username][1] }}/bus"
-
-- name: Read current workstation GNOME managed settings
-  tags: [gnome]
-  ansible.builtin.command:
-    argv:
-      - gsettings
-      - get
-      - "{{ item.schema }}{{ ':' ~ item.path if item.path is defined else '' }}"
-      - "{{ item.key }}"
-  become_user: "{{ username }}"
-  environment: "{{ workstation_gnome_environment }}"
-  loop: "{{ workstation_gnome_managed_settings | default([]) }}"
-  loop_control:
-    label: >-
-      {{ item.schema }}{{ ':' ~ item.path if item.path is defined else '' }} {{ item.key }}
-  register: workstation_gnome_managed_settings_current
-  changed_when: false
-
-- name: Apply workstation GNOME managed settings
-  tags: [gnome]
-  ansible.builtin.command:
-    argv:
-      - gsettings
-      - set
-      - "{{ item.item.schema }}{{ ':' ~ item.item.path if item.item.path is defined else '' }}"
-      - "{{ item.item.key }}"
-      - "{{ item.item.value }}"
-  become_user: "{{ username }}"
-  environment: "{{ workstation_gnome_environment }}"
-  loop: "{{ workstation_gnome_managed_settings_current.results | default([]) }}"
-  loop_control:
-    label: >-
-      {{ item.item.schema }}{{ ':' ~ item.item.path if item.item.path is defined else '' }} {{ item.item.key }}
-  changed_when: true
-  when: item.stdout | trim != item.item.value
-
-- name: Apply workstation GNOME extension dconf settings
-  tags: [gnome]
-  ansible.builtin.command:
-    argv:
-      - dconf
-      - write
-      - "{{ item.path }}{{ item.key }}"
-      - "{{ item.value }}"
-  become_user: "{{ username }}"
-  loop: "{{ workstation_gnome_extension_dconf_settings | default([]) }}"
-  loop_control:
-    label: "{{ item.path }}{{ item.key }}"
-  changed_when: true
-
-- name: Check whether VS Code CLI is available on workstation host
-  tags: [packages, vscode]
-  ansible.builtin.command:
-    argv:
-      - code
-      - --version
-  become_user: "{{ username }}"
-  environment:
-    HOME: "{{ user_home }}"
-  register: workstation_vscode_cli
-  changed_when: false
-  failed_when: false
-  when: (workstation_host_vscode_extensions | default([])) | length > 0
-
-- name: Ensure VS Code CLI is available before managing extensions
-  tags: [packages, vscode]
-  ansible.builtin.fail:
-    msg: Ensure Visual Studio Code is installed before managing workstation VS Code extensions.
-  when:
-    - (workstation_host_vscode_extensions | default([])) | length > 0
-    - workstation_vscode_cli.rc != 0
-
-- name: Read installed VS Code extensions on workstation host
-  tags: [packages, vscode]
-  ansible.builtin.command:
-    argv:
-      - code
-      - --list-extensions
-  become_user: "{{ username }}"
-  environment:
-    HOME: "{{ user_home }}"
-  register: workstation_vscode_extensions_current
-  changed_when: false
-  when:
-    - (workstation_host_vscode_extensions | default([])) | length > 0
-    - workstation_vscode_cli.rc == 0
-
-- name: Install VS Code extensions on workstation host
-  tags: [packages, vscode]
-  ansible.builtin.command:
-    argv:
-      - code
-      - --install-extension
-      - "{{ item }}"
-      - --force
-  become_user: "{{ username }}"
-  environment:
-    HOME: "{{ user_home }}"
-  loop: "{{ workstation_host_vscode_extensions | default([]) }}"
-  loop_control:
-    label: "{{ item }}"
-  when:
-    - workstation_vscode_cli.rc == 0
-    - item not in (workstation_vscode_extensions_current.stdout_lines | default([]))
-
-- name: Download workstation GNOME extension archives
-  tags: [packages, gnome]
-  ansible.builtin.get_url:
-    url: >-
-      https://extensions.gnome.org/download-extension/{{ item.uuid }}.shell-extension.zip?version_tag={{ item.version_tag }}
-    dest: "{{ workstation_gnome_extension_dir }}/{{ item.uuid }}.zip"
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "0644"
-  loop: "{{ workstation_gnome_extensions | default([]) }}"
-  loop_control:
-    label: "{{ item.uuid }}"
-
-- name: Check installed workstation GNOME extensions
-  tags: [packages, gnome]
-  ansible.builtin.stat:
-    path: "{{ user_home }}/.local/share/gnome-shell/extensions/{{ item.uuid }}/metadata.json"
-  loop: "{{ workstation_gnome_extensions | default([]) }}"
-  loop_control:
-    label: "{{ item.uuid }}"
-  register: workstation_gnome_extension_install_state
-
-- name: Install workstation GNOME extensions from downloaded archives
-  tags: [packages, gnome]
-  ansible.builtin.command:
-    cmd: "gnome-extensions install --force {{ workstation_gnome_extension_dir }}/{{ item.uuid }}.zip"
-  become_user: "{{ username }}"
-  environment: "{{ workstation_gnome_environment }}"
-  loop: "{{ workstation_gnome_extensions | default([]) }}"
-  loop_control:
-    label: "{{ item.uuid }}"
-  when: >-
-    not (
-      workstation_gnome_extension_install_state.results
-      | selectattr('item.uuid', 'equalto', item.uuid)
-      | map(attribute='stat.exists')
-      | first
-      | default(false)
-    )
-
-- name: Read current workstation GNOME enabled extensions
-  tags: [gnome]
-  ansible.builtin.command:
-    cmd: gsettings get org.gnome.shell enabled-extensions
-  become_user: "{{ username }}"
-  environment: "{{ workstation_gnome_environment }}"
-  register: workstation_enabled_gnome_extensions_current
-  changed_when: false
-
-- name: Compute desired workstation GNOME enabled extensions
-  tags: [gnome]
-  ansible.builtin.set_fact:
-    workstation_enabled_gnome_extensions_current_list: >-
-      {{
-        (
-          workstation_enabled_gnome_extensions_current.stdout
-          | default('')
-          | regex_search('\[.*\]')
-          | default('[]', true)
-        )
-        | from_yaml
-      }}
-
-- name: Build desired workstation GNOME enabled extensions list
-  tags: [gnome]
-  ansible.builtin.set_fact:
-    workstation_enabled_gnome_extensions_desired: >-
-      {{
-        (
-          workstation_enabled_gnome_extensions_current_list
-          + (
-            workstation_gnome_extensions
-            | default([])
-            | selectattr('enabled', 'defined')
-            | selectattr('enabled')
-            | map(attribute='uuid')
-            | list
-          )
-        )
-        | difference(workstation_disabled_gnome_extensions | default([]))
-        | unique
-        | sort
-      }}
-
-- name: Build workstation GNOME extensions gsettings payload
-  tags: [gnome]
-  ansible.builtin.set_fact:
-    workstation_enabled_gnome_extensions_desired_gsettings: >-
-      [{% for extension_uuid in workstation_enabled_gnome_extensions_desired -%}
-      '{{ extension_uuid | replace("'", "\\'") }}'{% if not loop.last %}, {% endif %}
-      {%- endfor %}]
-
-- name: Determine whether workstation GNOME enabled extensions must change
-  tags: [gnome]
-  ansible.builtin.set_fact:
-    workstation_gnome_extensions_state_changed: >-
-      {{ (workstation_enabled_gnome_extensions_current_list | sort) != workstation_enabled_gnome_extensions_desired }}
-
-- name: Apply workstation GNOME enabled extensions list
-  tags: [gnome]
-  ansible.builtin.command:
-    argv:
-      - gsettings
-      - set
-      - org.gnome.shell
-      - enabled-extensions
-      - "{{ workstation_enabled_gnome_extensions_desired_gsettings }}"
-  become_user: "{{ username }}"
-  environment: "{{ workstation_gnome_environment }}"
-  changed_when: workstation_gnome_extensions_state_changed
-  when: workstation_gnome_extensions_state_changed
-
-- name: Enable UFW firewall on workstation
-  tags: [services, packages]
-  community.general.ufw:
-    state: enabled
-  when: workstation_firewall_backend | default('ufw') == 'ufw'

ansible/site.yml

@@ -78,29 +78,12 @@
     - profile_workstation_dev_common
 
 - name: Configure Fedora WSL workstation development layer
-  hosts: workstation_dev_wsl_fedora
+  hosts: workstation_dev_wsl
   become: true
 
   roles:
     - profile_workstation_dev_wsl
 
-- name: Configure native Linux workstation host layer
-  hosts: workstation_host_linux
-  become: true
-
-  roles:
-    - profile_workstation_gnome
-
-- name: Configure WSL workstation development layer
-  hosts: workstation_dev_wsl_ubuntu
-  become: true
-
-  roles:
-    - packages_ubuntu
-    - services_systemd
-    - profile_workstation_dev_common
-    - profile_workstation_dev_wsl
-
 - name: Configure Ubuntu server
   hosts: ubuntu_server
   become: true

dotfiles/workstation_host_linux/.gnupg/gpg-agent.conf

@@ -1,3 +0,0 @@
-pinentry-program /usr/bin/pinentry-gnome3
-default-cache-ttl 600
-max-cache-ttl 7200