Update README.md

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux Mint and FreeBSD transition targets, Linux workstations, WSL, and an Ubuntu server.
+Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux Mint and FreeBSD transition targets, WSL, and an Ubuntu server.
 
 ## Source Of Truth
 - Main orchestration: `ansible/site.yml`
@@ -11,11 +11,10 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
 - Codex config is rendered from `dotfiles/common/.codex/config.toml.j2` so `model_instructions_file` points to the deployed `~/.config/ai/bootstrap.md`.
 
 ## Topology
-- Current personal desktop: `ikaros = platform_mint + role_personal_workstation + desktop_cinnamon`
+- Current personal desktop: `ikaros = platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome`
 - Current laptop: `nymph = platform_fedora + graphical_desktop + desktop_gnome`
 - Void desktop profile is also the base for other future/reference hosts via `platform_void + graphical_desktop`
-- Native Linux workstation: `deadalus-fedora`
+- Workstation: `deadalus` is Windows + WSL; Ansible target is `deadalus-wsl`
-- WSL dev: `deadalus-wsl`
 - Ubuntu server: `prometheus`
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
 - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
@@ -37,9 +36,8 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
   - `ansible-lint ansible/roles`
   - `yamllint ansible/`
 - Host-focused dry runs:
-  - Mint desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff`
+  - Fedora desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff`
   - Fedora laptop work: `ansible-playbook ansible/site.yml --limit nymph --check --diff`
-  - Fedora workstation: `ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff`
   - WSL dev: `ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
 - Focused checks:
@@ -57,7 +55,7 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
 
 ## Desktop Notes
 - `desktop_profile` names independently selectable desktop groups such as `desktop_gnome`, `desktop_hyprland`, `desktop_sway`, `desktop_niri`, and `desktop_cinnamon`. Keep platform-specific session bootstrap in platform-specific roles.
-- `desktop_environment` selects the mutually exclusive `minimal` (default), `gnome`, `xfce`, or `kde` desktop mode. `profile_desktop_common` owns shared bootstrap; the minimal mode uses `profile_desktop_sway`, `profile_desktop_hyprland`, and `profile_desktop_niri`, `profile_desktop_xfce` owns the reproducible XFCE setup, and `profile_desktop_kde` owns KDE-specific defaults and cleanup. `desktop_sessions_enabled` and `desktop_default_session` apply only to the minimal mode.
+- `desktop_environment` selects the mutually exclusive `minimal` (default), `gnome`, `xfce`, or `kde` desktop mode. `profile_desktop_common` owns shared Void bootstrap; the minimal mode uses `profile_desktop_sway`, `profile_desktop_hyprland`, and `profile_desktop_niri`, `profile_desktop_xfce` owns the reproducible XFCE setup, `profile_desktop_kde` owns KDE-specific defaults and cleanup, and `profile_desktop_gnome` copies shared desktop dotfiles for Fedora/GNOME without managing GNOME settings. `desktop_sessions_enabled` and `desktop_default_session` apply only to the minimal mode.
 - Emacs packages and `.emacs.d` deploy are disabled by default via `emacs_enabled: false`; keep the dotfiles in the repo for reversible opt-in only.
 - NTFS filesystem support is provided by `ntfs-3g` in `ansible/inventory/group_vars/void.yml`.
 - Void user services are managed by `turnstile` and live under `dotfiles/desktop/.config/service/`.
@@ -67,10 +65,10 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux
   - `dotfiles/desktop/.config/hypr/hyprland.conf` plus `host.conf` and `session-env` deployed via `host_hyprland_dotfiles` (Hyprland / Wayland)
   - `dotfiles/desktop/.config/niri/config.kdl` and `session-env` deployed via `desktop_niri_dotfiles` (Niri / Wayland)
 - Void Niri lives in `profile_desktop_niri`, gated on `'niri' in desktop_sessions_enabled`; it installs the `emptty` `niri.desktop` session, the `/usr/local/bin/start-niri` launcher, and the xdg-desktop-portal config, mirroring `profile_desktop_sway`.
-- Fedora GNOME (`desktop_gnome`) currently assumes GNOME comes from the Fedora Workstation base install; Ansible does not customize GNOME for `nymph` yet.
+- Fedora GNOME (`desktop_gnome`) assumes GNOME comes from the Fedora Workstation base install; Ansible deploys shared desktop dotfiles and git/GPG config for `ikaros` and `nymph`, not GNOME settings.
 - FreeBSD Niri (dormant; `platform_freebsd` currently has no hosts) must keep FreeBSD-specific package, rc, DBus, seat, portal, and launcher behavior in `profile_desktop_niri_freebsd` or FreeBSD platform vars.
 - Do not switch or restart a display manager during a playbook run from an active graphical session. Changing among `emptty`, LightDM, and SDDM requires an explicit run from another TTY/SSH session with `desktop_allow_display_manager_switch=true`. Apply managed XFCE XML while logged out of XFCE so `xfconfd` cannot overwrite it from its in-memory state.
-- `nymph` is the Fedora/GNOME laptop target; keep GNOME unmanaged for now and add host-specific tuning only after real use.
+- `nymph` is the Fedora/GNOME laptop target; keep GNOME settings unmanaged for now and add host-specific tuning only after real use.
 
 ## Void Package And Dotfile Bucket Rules
 `platform_void` is the reusable Void platform selection. The legacy `void` group remains a compatibility parent so existing `group_vars/void.yml` and `when: "'void' in group_names"` checks keep working during the transition.
@@ -83,8 +81,8 @@ The Void desktop package lists in `ansible/inventory/group_vars/void.yml` are ke
 The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-independent content, `desktop_minimal_dotfiles` carries Thunar, Udiskie, and minimal MIME defaults, and `desktop_xfce_dotfiles` carries XFCE state. KDE uses its own MIME defaults. `desktop_void_dotfiles` remains reserved for files that need the Void runtime.
 
 ## Workstation Notes
-- Native Linux workstation hosts can combine `workstation_host_linux` with an OS-specific dev group.
+- `deadalus` is modeled as Windows + WSL; keep Linux dev automation on `deadalus-wsl`.
-- `deadalus-fedora` keeps GNOME managed settings in `ansible/inventory/host_vars/deadalus-fedora.yml`.
+- Native Linux workstation groups remain available for future hosts but have no current host in the main inventory.
 
 ## Coding Agent Notes
 - Shared agent packages live in `ai_agents_npm_packages` in `ansible/inventory/group_vars/all.yml`.

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What this repo is
 
-Ansible-driven personal infrastructure as code for Void Linux desktops (`ikaros`, `nymph`), Linux workstations (`deadalus-fedora`, `deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions.
+Ansible-driven personal infrastructure as code for Fedora desktops (`ikaros`, `nymph`), WSL development (`deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions.
 
 ## Validation commands
 
@@ -15,7 +15,6 @@ ansible-playbook ansible/site.yml --syntax-check
 # Dry-run per host
 ansible-playbook ansible/site.yml --limit ikaros --check --diff
 ansible-playbook ansible/site.yml --limit nymph --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff
 ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --check --diff
 

README.md

@@ -36,7 +36,6 @@ infra/
 │   ├── workstation/
 │   ├── workstation_host_linux/
 │   ├── workstation_dev_wsl/
-│   ├── ikaros/
 │   └── nymph/
 │
 ├── scripts/
@@ -55,8 +54,8 @@ Il repository è diviso in due componenti principali:
 
 # Macchine gestite
 
-Il repository modella attualmente tre tipologie di profilo, con i filoni workstation Linux nativa e WSL.
+Il repository modella attualmente host Fedora/GNOME, un ambiente WSL di sviluppo e un server Ubuntu.
-La nuova direzione del repository separa tre assi indipendenti:
+La composizione resta separata in assi indipendenti:
 
 ```text
 common user environment
@@ -70,7 +69,7 @@ Matrice target:
 
 | Host           | Platform   | Role                 | Desktop                           |
 | -------------- | ---------- | -------------------- | --------------------------------- |
-| ikaros         | Linux Mint | Personal workstation | Cinnamon                          |
+| ikaros         | Fedora     | Personal workstation | GNOME                             |
 | nymph          | Fedora     | Desktop laptop       | GNOME                             |
 | void-reference | Void Linux | Lab/reference        | Current preserved desktop profile |
 
@@ -81,23 +80,14 @@ ikaros must be boring
 nymph is allowed to break
 ```
 
-`ikaros` usa il target stabile Linux Mint/Cinnamon; `nymph` usa il target
+`ikaros` usa Fedora Workstation/GNOME come desktop personale stabile; `nymph` usa lo stesso
-Fedora Workstation/GNOME. I gruppi legacy `void` e `desktop` restano alias di
+target Fedora Workstation/GNOME come laptop. I gruppi legacy `void` e `desktop` restano alias di
 compatibilita per eventuali host Void futuri mentre i nuovi assi sono
 `platform_*`, `role_*` e `desktop_*`.
 
-Prima di una migrazione reale degli host e consigliato creare uno snapshot
-logico, per esempio:
-
-```bash
-git switch -c refactor/platform-role-desktop
-git tag void-desktop-before-platform-refactor
-```
-
 Nota sullo stato attuale del playbook principale:
 
-- `ansible/site.yml` applica oggi in automatico Cinnamon su Linux Mint e Niri su FreeBSD
+- `ansible/site.yml` applica oggi in automatico Fedora/GNOME su `ikaros` e `nymph`
-- `ansible/site.yml` applica la workstation Linux nativa separando il layer dev comune dal layer host GNOME
 - `ansible/site.yml` applica anche il ramo `workstation_dev_wsl` per il modello dev in WSL
 - `ansible/site.yml` applica anche il profilo `ubuntu_server` con baseline apt, systemd, dotfiles server e firewall UFW
 
@@ -105,8 +95,8 @@ Nota sullo stato attuale del playbook principale:
 
 Target operativi:
 
-- `ikaros`: Linux Mint + Cinnamon, desktop personale stabile/floating.
+- `ikaros`: Fedora Workstation + GNOME, desktop personale stabile/floating.
-- `nymph`: Fedora Workstation + GNOME, laptop desktop con GNOME non personalizzato da Ansible per ora.
+- `nymph`: Fedora Workstation + GNOME, laptop desktop con dotfiles desktop condivisi e GNOME lasciato al default Fedora.
 
 Il profilo Void desktop resta disponibile come modello riutilizzabile per host
 futuri. `desktop_environment` continua a selezionare in modo esclusivo
@@ -141,17 +131,16 @@ Lo stato attuale del profilo desktop include, tra le altre cose:
 
 Sistemi operativi supportati:
 
-- Fedora Workstation nativa
+- Ubuntu WSL, attualmente usato da `deadalus-wsl`
-- Ubuntu WSL
+- Fedora Workstation nativa, disponibile per host futuri tramite gruppi dedicati
 
-Desktop environment host Linux:
+Desktop environment host Linux, per eventuali workstation native:
 
 - GNOME
 
 Macchine attuali:
 
-- `deadalus-fedora` come workstation Fedora nativa
+- `deadalus-wsl` come ambiente dev Ubuntu in WSL sulla workstation Windows `deadalus`
-- `deadalus-wsl` come ambiente dev Ubuntu in WSL
 
 Questo profilo è pensato per sviluppo e lavoro, con separazione tra layer host e layer dev.
 
@@ -160,8 +149,8 @@ Nel modello Ansible usato qui, un singolo inventory host puo appartenere intenzi
 Il profilo workstation e agganciato al playbook principale e ora distingue:
 
 - layer dev Ubuntu condiviso tra WSL e server
-- layer dev Fedora nativo
+- layer dev Fedora nativo disponibile per host futuri
-- layer host Linux GNOME
+- layer host Linux GNOME disponibile per host futuri
 - layer WSL dedicato per sviluppo con `systemd`
 
 Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `workstation_dev_fedora`, a seconda del layering che vuoi comporre.
@@ -169,14 +158,13 @@ Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `wo
 Lo stato attuale del profilo workstation include:
 
 - installazione pacchetti base Ubuntu via apt
-- installazione pacchetti base Fedora via dnf per il ramo workstation nativo
+- installazione pacchetti base Fedora via dnf per eventuali workstation native
 - installazione e configurazione di Docker dal repository ufficiale
 - gestione dei dotfiles workstation e rendering dei template dev condivisi
-- installazione di Google Chrome su Fedora, `VS Code` su Fedora via repository RPM Microsoft, `IntelliJ IDEA Ultimate` su Fedora via COPR RPM, e applicazioni workstation residue su Fedora via Flatpak
+- installazione opzionale di Google Chrome, VS Code, IntelliJ IDEA Ultimate e applicazioni Flatpak per eventuali workstation Fedora native
-- estensioni GNOME sul solo host Linux nativo
+- estensioni GNOME per eventuali host Linux nativi
 - preparazione del ramo WSL Ubuntu con `systemd` per il toolchain di sviluppo
-- attivazione del firewall `firewalld` su Fedora nativa
+- attivazione del firewall `firewalld` sui target Fedora che dichiarano regole host-specifiche
-- gestione di `gsettings` GNOME host-specifici su `deadalus-fedora`, inclusi shell, Files/Nautilus, file chooser GTK e GNOME Text Editor, allineati allo stato reale della macchina
 
 Workflow WSL previsto:
 
@@ -251,7 +239,7 @@ common configuration
 Esempi correnti:
 
 ```text
-ikaros -> common + platform_mint + role_personal_workstation + desktop_cinnamon + ikaros
+ikaros -> common + platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome + ikaros
 nymph  -> common + platform_fedora + graphical_desktop + desktop_gnome + nymph
 ```
 
@@ -281,8 +269,10 @@ I principali ruoli attualmente presenti sono:
 | services_systemd          | gestione servizi systemd            |
 | services_freebsd          | gestione servizi FreeBSD rc.conf/rc.d |
 | profile_desktop_common    | bootstrap desktop Void condiviso    |
+| profile_desktop_gnome     | dotfiles desktop condivisi per Fedora/GNOME |
 | profile_desktop_sway      | sessione desktop sway / SwayFX (Wayland) |
 | profile_desktop_hyprland  | sessione desktop Hyprland (Wayland) |
+| profile_desktop_niri     | sessione desktop Niri su Void (Wayland) |
 | profile_desktop_niri_freebsd | adattamenti FreeBSD per Niri |
 | profile_desktop_cinnamon  | impostazioni Cinnamon circoscritte |
 | profile_desktop_host      | override desktop specifici per host |
@@ -304,7 +294,7 @@ Il playbook `ansible/site.yml` e attualmente composto da blocchi per asse:
 ```text
 all -> dotfiles_common
 platform_void -> packages_void + services_runit
-platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_hyprland + profile_desktop_kde + profile_desktop_xfce + profile_desktop_host
+platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_hyprland + profile_desktop_niri + profile_desktop_kde + profile_desktop_xfce + profile_desktop_host
 platform_mint -> packages_mint + services_systemd
 platform_mint & role_personal_workstation -> profile_personal_workstation
 platform_mint & desktop_cinnamon -> profile_desktop_cinnamon
@@ -312,6 +302,8 @@ platform_freebsd -> packages_freebsd + services_freebsd
 platform_freebsd & role_lab -> profile_lab
 platform_freebsd & desktop_niri -> profile_desktop_niri_freebsd
 platform_fedora -> packages_fedora + services_systemd
+platform_fedora & role_personal_workstation -> profile_personal_workstation
+platform_fedora & desktop_gnome -> profile_desktop_gnome
 workstation_dev_fedora -> profile_workstation_dev_common
 workstation_host_linux -> profile_workstation_gnome
 workstation_dev_wsl -> packages_ubuntu + services_systemd + profile_workstation_dev_common + profile_workstation_dev_wsl
@@ -320,10 +312,9 @@ ubuntu_server -> packages_ubuntu + services_systemd + profile_server
 
 Questo significa che, allo stato attuale:
 
-- `ikaros` riceve Linux Mint/Cinnamon come target stabile
+- `ikaros` riceve Fedora Workstation/GNOME come target desktop personale stabile
 - `nymph` riceve Fedora Workstation/GNOME come target laptop
 - il profilo Void resta selezionabile tramite `platform_void + graphical_desktop` per host futuri
-- la workstation Fedora (`deadalus-fedora`) usa il principio di composizione a gruppi con il ramo Fedora dedicato e con `gsettings` host-specifici dichiarati in inventory
 - il ramo WSL (`deadalus-wsl`) e predisposto con play dev dedicato
 - il server Ubuntu (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewall
 - lo stack container server include `navidrome`, `postgres`, `gitea`, `nginx-proxy-manager` e `syncthing`, con GUI Syncthing raggiungibile tramite la rete Docker `web`
@@ -342,7 +333,6 @@ dotfiles/
 ├── workstation
 ├── workstation_host_linux
 ├── workstation_dev_wsl
-├── ikaros
 └── nymph
 ```
 
@@ -398,11 +388,11 @@ Allo stato attuale questo comando:
 - distribuisce i dotfiles comuni a tutti gli host
 - per `platform_void` applica pacchetti Void e servizi runit
 - per `platform_void + graphical_desktop` applica bootstrap desktop condiviso, sessioni sway/Hyprland/Niri e override specifici per host
-- per `platform_mint` e `platform_freebsd` applica solo host presenti esplicitamente in quei gruppi; nell'inventory principale iniziale questi gruppi sono vuoti
+- per `platform_mint`, `platform_freebsd`, `workstation_dev_fedora` e `workstation_host_linux` non applica nulla finche quei gruppi restano senza host
-- per `platform_fedora` applica pacchetti Fedora e servizi systemd
+- per `platform_fedora` applica pacchetti Fedora e servizi systemd a `ikaros` e `nymph`
-- per `workstation_dev_fedora` applica il profilo dev comune
+- per `platform_fedora & role_personal_workstation` applica il layer personale a `ikaros`
-- per `workstation_host_linux` applica il layer host Linux GNOME
+- per `platform_fedora & desktop_gnome` applica il profilo GNOME a `ikaros` e `nymph`
-- per `workstation_dev_wsl` applica pacchetti Ubuntu, servizi systemd, profilo dev comune e tweak WSL dedicati
+- per `workstation_dev_wsl` applica pacchetti Ubuntu, servizi systemd, profilo dev comune e tweak WSL dedicati a `deadalus-wsl`
 - per gli host `ubuntu_server` applica pacchetti Ubuntu, servizi systemd, profilo server, UFW, dotfiles e template dedicati
 - non riavvia automaticamente il display manager; i passaggi tra `emptty`, LightDM e SDDM vanno applicati da SSH o da una TTY separata
 - carica `secrets/vault.yml` solo se presente
@@ -415,7 +405,6 @@ ansible-playbook ansible/site.yml --syntax-check
 ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff
 ansible-playbook ansible/site.yml --limit ikaros --check --diff
 ansible-playbook ansible/site.yml --limit nymph --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff
 ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --check --diff
 ansible-lint ansible/site.yml
@@ -462,32 +451,31 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common |
 | `dotfiles` | distribuzione/configurazione dotfiles | tutti i profili |
 | `dotfiles:common` | dotfiles comuni condivisi | common, workstation, server |
-| `dotfiles:desktop` | dotfiles desktop | desktop Void |
+| `dotfiles:desktop` | dotfiles desktop | desktop Void, Fedora/GNOME, FreeBSD/Niri |
 | `dotfiles:host` | override host-specifici desktop | desktop Void |
 | `dotfiles:server` | dotfiles dedicati al profilo server | server |
-| `dotfiles:workstation` | dotfiles dedicati alle workstation | workstation Linux, WSL |
+| `dotfiles:workstation` | dotfiles dedicati alle workstation | personal workstation, WSL, workstation Linux future |
 | `emptty` | gestione display manager `emptty` | desktop Void |
 | `display-manager` | selezione protetta tra `emptty`, LightDM e SDDM | desktop Void |
 | `kde` | profilo KDE Plasma e relativa pulizia | desktop Void |
 | `xfce` | profilo XFCE, LightDM e relativa pulizia | desktop Void |
 | `cinnamon` | impostazioni Cinnamon circoscritte | Linux Mint desktop |
-| `gnome` | configurazione host GNOME | workstation host Linux, parte desktop |
+| `gnome` | configurazione host GNOME | Fedora/GNOME desktop, workstation host Linux future |
 | `sway` | sessione/configurazione sway / SwayFX (Wayland) | desktop Void |
 | `hyprland` | sessione/configurazione Hyprland (Wayland) | desktop Void |
-| `niri` | sessione/configurazione Niri (Wayland) | FreeBSD laptop |
+| `niri` | sessione/configurazione Niri (Wayland) | Void o FreeBSD con `desktop_niri` |
-| `npm` | installazione pacchetti npm globali | desktop Void, workstation Linux, WSL |
+| `npm` | installazione pacchetti npm globali | Fedora/GNOME, desktop Void, workstation Linux, WSL |
 | `nvidia` | componenti NVIDIA desktop | desktop Void |
 | `packages` | installazione e aggiornamento pacchetti | tutti i profili |
 | `services` | gestione servizi runit/systemd | tutti i profili |
-| `vscode` | installazione/configurazione VS Code | Fedora, host Linux |
+| `vscode` | installazione/configurazione VS Code | workstation Fedora future, host Linux |
 | `wsl` | bootstrap e configurazione WSL | WSL |
 
 Esempi pratici:
 
 ```bash
-ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,niri --check --diff
+ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,gnome --check --diff
-ansible-playbook ansible/site.yml --limit ikaros --tags cinnamon --check --diff
+ansible-playbook ansible/site.yml --limit ikaros --tags gnome --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora --tags packages,vscode --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --tags services,dotfiles:server --check --diff
 ```
 

ansible/inventory/group_vars/desktop_gnome.yml

@@ -19,6 +19,7 @@ fedora_desktop_packages:
   - poppler-utils
   - fontconfig-devel
   - freetype-devel
+  - gh
   - golang
   - golangci-lint
   - gopls
@@ -32,6 +33,7 @@ fedora_desktop_packages:
   - meld
   - mpv
   - pdfarranger
+  - pinentry-gnome3
   - playerctl
   - qemu
   - qemu-img

ansible/inventory/host_vars/deadalus-fedora.yml

@@ -1,177 +0,0 @@
----
-hostname: deadalus-fedora
-
-host_packages: []
-host_enabled_services:
-  - docker
-workstation_firewall_backend: firewalld
-
-workstation_host_vscode_extensions:
-  - ms-vscode-remote.remote-containers
-  - ms-vscode-remote.remote-ssh
-  - ms-azuretools.vscode-docker
-  - redhat.vscode-yaml
-  - redhat.ansible
-
-workstation_gnome_managed_settings:
-  - schema: org.gnome.shell
-    key: favorite-apps
-    value: "['google-chrome.desktop', 'org.gnome.Nautilus.desktop', 'com.spotify.Client.desktop', 'org.mozilla.Thunderbird.desktop', 'org.telegram.desktop.desktop', 'code.desktop', 'intellij-idea-ultimate.desktop', 'io.dbeaver.DBeaverCommunity.desktop', 'com.getpostman.Postman.desktop', 'org.gnome.Ptyxis.desktop']"
-  - schema: org.gnome.shell
-    key: app-picker-layout
-    value: "[{'6f4bfcaf-700e-4fe3-8fd2-4a3e6fc46bcf': <{'position': <0>}>, 'System': <{'position': <1>}>, 'Utilities': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Weather.desktop': <{'position': <4>}>, 'org.gnome.clocks.desktop': <{'position': <5>}>, 'org.gnome.Maps.desktop': <{'position': <6>}>, 'org.gnome.SimpleScan.desktop': <{'position': <7>}>, 'org.gnome.Settings.desktop': <{'position': <8>}>, 'org.gnome.Boxes.desktop': <{'position': <9>}>, 'org.gnome.Showtime.desktop': <{'position': <10>}>, 'org.gnome.Snapshot.desktop': <{'position': <11>}>, 'org.gnome.Characters.desktop': <{'position': <12>}>, 'org.gnome.Calculator.desktop': <{'position': <13>}>, 'org.gnome.Calendar.desktop': <{'position': <14>}>, 'org.gnome.TextEditor.desktop': <{'position': <15>}>, 'org.gnome.Meld.desktop': <{'position': <16>}>, 'org.gnome.tweaks.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>}]"
-  - schema: org.gnome.desktop.input-sources
-    key: sources
-    value: "[('xkb', 'us')]"
-  - schema: org.gnome.desktop.interface
-    key: color-scheme
-    value: "'prefer-dark'"
-  - schema: org.gnome.desktop.privacy
-    key: report-technical-problems
-    value: "false"
-  - schema: org.gnome.desktop.wm.preferences
-    key: button-layout
-    value: "'appmenu:minimize,maximize,close'"
-  - schema: org.gnome.nautilus.preferences
-    key: click-policy
-    value: "'double'"
-  - schema: org.gnome.nautilus.preferences
-    key: date-time-format
-    value: "'simple'"
-  - schema: org.gnome.nautilus.preferences
-    key: default-folder-viewer
-    value: "'icon-view'"
-  - schema: org.gnome.nautilus.preferences
-    key: default-sort-order
-    value: "'name'"
-  - schema: org.gnome.nautilus.preferences
-    key: recursive-search
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: show-create-link
-    value: "true"
-  - schema: org.gnome.nautilus.preferences
-    key: show-delete-permanently
-    value: "true"
-  - schema: org.gnome.nautilus.preferences
-    key: show-directory-item-counts
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: show-hidden-files
-    value: "false"
-  - schema: org.gnome.nautilus.preferences
-    key: show-image-thumbnails
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: thumbnail-limit
-    value: "uint64 50"
-  - schema: org.gnome.nautilus.icon-view
-    key: captions
-    value: "['none', 'none', 'none']"
-  - schema: org.gnome.nautilus.icon-view
-    key: default-zoom-level
-    value: "'medium'"
-  - schema: org.gtk.Settings.FileChooser
-    key: clock-format
-    value: "'24h'"
-  - schema: org.gtk.Settings.FileChooser
-    key: date-format
-    value: "'regular'"
-  - schema: org.gtk.Settings.FileChooser
-    key: location-mode
-    value: "'path-bar'"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-hidden
-    value: "false"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-size-column
-    value: "true"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-type-column
-    value: "true"
-  - schema: org.gtk.Settings.FileChooser
-    key: sort-column
-    value: "'name'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: clock-format
-    value: "'24h'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: date-format
-    value: "'regular'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: location-mode
-    value: "'path-bar'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-hidden
-    value: "false"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-size-column
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-type-column
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-column
-    value: "'name'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-directories-first
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: auto-indent
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: highlight-matching-brackets
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: indent-style
-    value: "'tab'"
-  - schema: org.gnome.TextEditor
-    key: keybindings
-    value: "'default'"
-  - schema: org.gnome.TextEditor
-    key: restore-session
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: show-line-numbers
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: spellcheck
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: style-scheme
-    value: "'Adwaita'"
-  - schema: org.gnome.TextEditor
-    key: style-variant
-    value: "'follow'"
-  - schema: org.gnome.TextEditor
-    key: use-system-font
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: wrap-text
-    value: "true"
-  - schema: org.gnome.desktop.background
-    key: picture-uri
-    value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-l.jxl'"
-  - schema: org.gnome.desktop.background
-    key: picture-uri-dark
-    value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-d.jxl'"
-
-workstation_gnome_extension_dconf_settings:
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-radius-bottom
-    value: "15"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-radius-top
-    value: "15"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-size
-    value: "5"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: show-window-position-bar
-    value: "false"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: show-workspace-indicator
-    value: "false"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: window-gap
-    value: "10"

ansible/inventory/host_vars/ikaros.yml

@@ -2,16 +2,12 @@
 hostname: ikaros
 
 host_packages:
-  - openssh-client
+  - openssh-clients
   - openssh-server
   - mesa-vulkan-drivers
-  - xserver-xorg-video-amdgpu
 
-host_ufw_rules:
+host_firewalld_rich_rules:
-  - rule: allow
+  - rule family="ipv4" source address="192.168.0.0/24" service name="ssh" accept
-    port: "22"
-    proto: tcp
-    src: "192.168.0.0/24"
 
 host_sshd_settings:
   PermitRootLogin: "no"
@@ -25,4 +21,4 @@ host_sshd_allow_users:
 host_authorized_ssh_keys: "{{ vault_ikaros_authorized_ssh_keys | default([]) }}"
 
 host_enabled_services:
-  - ssh
+  - sshd

ansible/inventory/host_vars/nymph.yml

@@ -2,6 +2,12 @@
 hostname: nymph
 
 # Fedora Workstation/GNOME laptop target. GNOME is provided by the base Fedora
-# Workstation install and is intentionally not customized by Ansible yet.
+# Workstation install; Ansible deploys shared desktop dotfiles but leaves GNOME
-host_packages: []
+# settings unmanaged for now.
+host_packages:
+  - rclone
+  - syncthing
+host_flatpak_packages:
+  - com.spotify.Client
+  - org.telegram.desktop
 host_enabled_services: []

ansible/inventory/hosts.yml

@@ -6,15 +6,13 @@ all:
 
     platform_fedora:
       hosts:
-        nymph:
+        ikaros:
           ansible_connection: local
-        deadalus-fedora:
+        nymph:
           ansible_connection: local
 
     platform_mint:
-      hosts:
+      hosts: {}
-        ikaros:
-          ansible_connection: local
 
     platform_freebsd:
       hosts: {}
@@ -57,13 +55,13 @@ all:
 
     desktop_gnome:
       hosts:
+        ikaros:
+          ansible_connection: local
         nymph:
           ansible_connection: local
 
     desktop_cinnamon:
-      hosts:
+      hosts: {}
-        ikaros:
-          ansible_connection: local
 
     ubuntu:
       children:
@@ -89,19 +87,13 @@ all:
         ubuntu_server:
 
     fedora_workstation:
-      hosts:
+      hosts: {}
-        deadalus-fedora:
-          ansible_connection: local
 
     workstation_host_linux:
-      hosts:
+      hosts: {}
-        deadalus-fedora:
-          ansible_connection: local
 
     workstation_dev_fedora:
-      hosts:
+      hosts: {}
-        deadalus-fedora:
-          ansible_connection: local
 
     workstation_dev_wsl:
       hosts:

ansible/roles/profile_desktop_common/tasks/main.yml

@@ -190,12 +190,27 @@
   loop: "{{ desktop_ufw_rules_effective }}"
   loop_control:
     label: "{{ item.name | default(item.port) }}"
+  when: workstation_firewall_backend | default('ufw') == 'ufw'
 
 - name: Enable UFW firewall on desktop when host rules are defined
   tags: [services, packages]
   community.general.ufw:
     state: enabled
-  when: (desktop_ufw_rules_effective | default([])) | length > 0
+  when:
+    - workstation_firewall_backend | default('ufw') == 'ufw'
+    - (desktop_ufw_rules_effective | default([])) | length > 0
+
+- name: Apply host firewalld rich rules on desktop
+  tags: [services, packages]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ host_firewalld_rich_rules | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when: workstation_firewall_backend | default('ufw') == 'firewalld'
 
 - name: Check whether libvirt service directory exists
   tags: [packages, services]

ansible/roles/profile_desktop_gnome/handlers/main.yml

@@ -0,0 +1,16 @@
+---
+- name: Reload GNOME gpg-agent
+  ansible.builtin.command:
+    argv:
+      - gpgconf
+      - --kill
+      - gpg-agent
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  changed_when: false
+
+- name: Reload SSH service
+  ansible.builtin.systemd:
+    name: sshd
+    state: reloaded

ansible/roles/profile_desktop_gnome/tasks/main.yml

@@ -0,0 +1,170 @@
+---
+- name: Ensure GNOME desktop user config directories exist
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config"
+    - "{{ user_home }}/.config/autostart"
+    - "{{ user_home }}/.local"
+    - "{{ user_home }}/.local/bin"
+    - "{{ user_home }}/.bashrc.d"
+    - "{{ user_home }}/.tmux"
+    - "{{ user_home }}/.tmux/bin"
+    - "{{ user_home }}/.tmux/plugins"
+
+- name: Ensure GNOME desktop private directories exist
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - path: "{{ user_home }}/.gnupg"
+      mode: "0700"
+    - path: "{{ user_home }}/.ssh"
+      mode: "0700"
+    - path: "{{ user_home }}/.local/state/ssh/sockets"
+      mode: "0700"
+
+- name: Copy GNOME desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_common_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Copy GNOME Emacs desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, emacs, gnome]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_emacs_dotfiles | default([]) }}"
+  when: emacs_enabled | default(false) | bool
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Configure GNOME gpg-agent for Fedora
+  tags: [dotfiles, dotfiles:desktop, git, gnome]
+  ansible.builtin.copy:
+    dest: "{{ user_home }}/.gnupg/gpg-agent.conf"
+    content: |
+      pinentry-program /usr/bin/pinentry-gnome3
+      enable-ssh-support
+      default-cache-ttl 600
+      max-cache-ttl 7200
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+  notify: Reload GNOME gpg-agent
+
+- name: Render GNOME git configuration with private values
+  tags: [dotfiles, dotfiles:desktop, git, gnome]
+  ansible.builtin.template:
+    src: desktop/.gitconfig.j2
+    dest: "{{ user_home }}/.gitconfig"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+
+- name: Check whether SSH host ed25519 key exists on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.stat:
+    path: /etc/ssh/ssh_host_ed25519_key
+  register: gnome_ssh_host_ed25519_key
+  when:
+    - (host_sshd_settings | default({})) | length > 0
+      or (host_sshd_allow_users | default([])) | length > 0
+
+- name: Generate missing SSH host keys on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.command: ssh-keygen -A
+  changed_when: true
+  when:
+    - (host_sshd_settings | default({})) | length > 0
+      or (host_sshd_allow_users | default([])) | length > 0
+    - not gnome_ssh_host_ed25519_key.stat.exists
+
+- name: Require authorized SSH keys before disabling password authentication on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.assert:
+    that:
+      - (host_authorized_ssh_keys | default([])) | length > 0
+    fail_msg: >-
+      SSH password authentication is disabled for this host, but no authorized SSH
+      keys are defined. Set host_authorized_ssh_keys via vault variables before
+      applying this configuration.
+  when:
+    - "'sshd' in (host_enabled_services | default([]))"
+    - (host_sshd_settings | default({})).PasswordAuthentication | default('yes') == 'no'
+
+- name: Ensure GNOME desktop user authorized_keys file exists
+  tags: [services, dotfiles, gnome]
+  ansible.builtin.file:
+    path: "{{ user_home }}/.ssh/authorized_keys"
+    state: touch
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+  when: (host_authorized_ssh_keys | default([])) | length > 0
+
+- name: Manage GNOME desktop user authorized SSH keys exclusively
+  tags: [services, dotfiles, gnome]
+  ansible.posix.authorized_key:
+    user: "{{ username }}"
+    key: "{{ host_authorized_ssh_keys | join('\n') }}"
+    state: present
+    exclusive: true
+    manage_dir: false
+  when: (host_authorized_ssh_keys | default([])) | length > 0
+
+- name: Apply SSH daemon settings on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*{{ item.key }}\s+'
+    line: "{{ item.key }} {{ item.value }}"
+    state: present
+    validate: "sshd -t -f %s"
+  notify: Reload SSH service
+  loop: "{{ host_sshd_settings | default({}) | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: (host_sshd_settings | default({})) | length > 0
+
+- name: Restrict SSH login to allowed GNOME desktop users
+  tags: [services, gnome]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*AllowUsers\s+'
+    line: "AllowUsers {{ host_sshd_allow_users | join(' ') }}"
+    state: present
+    validate: "sshd -t -f %s"
+  notify: Reload SSH service
+  when: (host_sshd_allow_users | default([])) | length > 0
+
+- name: Apply host firewalld rich rules on GNOME desktop
+  tags: [services, packages, gnome]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ host_firewalld_rich_rules | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when: workstation_firewall_backend | default('firewalld') == 'firewalld'

ansible/site.yml

@@ -102,6 +102,20 @@
     - packages_fedora
     - services_systemd
 
+- name: Configure personal workstation role on Fedora
+  hosts: platform_fedora:&role_personal_workstation
+  become: true
+
+  roles:
+    - profile_personal_workstation
+
+- name: Configure Fedora GNOME desktop
+  hosts: platform_fedora:&desktop_gnome
+  become: true
+
+  roles:
+    - profile_desktop_gnome
+
 - name: Configure Fedora workstation development layer
   hosts: workstation_dev_fedora
   become: true