Share desktop tmux config with WSL

Elimina completamente la sessione desktop i3 (X11), ormai non più usata
(gli host espongono solo sway e Hyprland su Wayland):
- ruolo profile_desktop_i3 e voce emptty i3.desktop
- desktop_i3_packages e i guard 'i3' in desktop_sessions_enabled
- desktop_i3_dotfiles e host_i3_dotfiles (autorandr X11)
- dotfiles i3/X11: .xinitrc, i3, i3blocks, picom, polybar, autorandr
- task host-specifici i3 (copy dotfiles, wrap prime-run su nymph)
- rimuove st (terminale X11 da sorgente) da desktop_void_source_tools
- consolida lo script live in scripts/remove_i3.sh, elimina cleanup-i3.sh
- aggiorna la documentazione (README/AGENTS/CLAUDE/knowledge)

Config Emacs lasciata invariata di proposito.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Ansible-driven personal infrastructure repo for Void desktops, Linux workstations, Windows+WSL, and an Ubuntu server.
+Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux Mint and FreeBSD transition targets, WSL, and an Ubuntu server.
 
 ## Source Of Truth
 - Main orchestration: `ansible/site.yml`
@@ -11,17 +11,19 @@ Ansible-driven personal infrastructure repo for Void desktops, Linux workstation
 - Codex config is rendered from `dotfiles/common/.codex/config.toml.j2` so `model_instructions_file` points to the deployed `~/.config/ai/bootstrap.md`.
 
 ## Topology
-- Void desktops: `ikaros`, `nymph`
-- Native Linux workstations: `deadalus-ubuntu`, `deadalus-fedora`
-- Windows host + WSL dev: `deadalus-win`, `deadalus-wsl`
+- Current personal desktop: `ikaros = platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome`
+- Current laptop: `nymph = platform_fedora + graphical_desktop + desktop_gnome`
+- Void desktop profile is also the base for other future/reference hosts via `platform_void + graphical_desktop`
+- Workstation: `deadalus` is Windows + WSL; Ansible target is `deadalus-wsl`
 - Ubuntu server: `prometheus`
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
+- Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
 
 ## Working Rules
-- Preserve layering `all -> OS -> profile -> host`.
+- Preserve layering `all -> platform -> role -> desktop -> host`.
 - Keep `ansible/site.yml` small; orchestration belongs there, implementation belongs in roles.
 - Prefer minimal, targeted edits. Preserve idempotency and existing ordering.
-- Most hosts use `ansible_connection: local`; Windows host is the exception.
+- All hosts use `ansible_connection: local`.
 - Treat `secrets/` as sensitive. Never print secret values.
 - Tmux plugins are bootstrapped by TPM on the host; the repo only keeps tmux config and custom helper scripts.
 - Read the relevant role tasks, templates, vars, and deployed dotfiles before editing.
@@ -34,15 +36,13 @@ Ansible-driven personal infrastructure repo for Void desktops, Linux workstation
   - `ansible-lint ansible/roles`
   - `yamllint ansible/`
 - Host-focused dry runs:
-  - Void desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff` or `--limit nymph --check --diff`
-  - Ubuntu workstation: `ansible-playbook ansible/site.yml --limit deadalus-ubuntu --check --diff`
-  - Fedora workstation: `ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff`
+  - Fedora desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff`
+  - Fedora laptop work: `ansible-playbook ansible/site.yml --limit nymph --check --diff`
   - WSL dev: `ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
 - Focused checks:
-  - Emacs dotfiles only: `ansible-playbook ansible/site.yml --limit ikaros --tags emacs --check --diff` or `--limit nymph --tags emacs --check --diff`
+  - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
   - Mail bootstrap: `sh -n scripts/bootstrap_mail.sh` and `shellcheck scripts/bootstrap_mail.sh`
-  - Windows bootstrap parse: `pwsh -NoProfile -Command "[void][System.Management.Automation.Language.Parser]::ParseFile('scripts/bootstrap_windows_workstation.ps1', [ref]$null, [ref]$null)"`
   - Server compose render: `docker compose -f /opt/docker/server/docker-compose.yml config`
 
 ## Conventions
@@ -54,31 +54,35 @@ Ansible-driven personal infrastructure repo for Void desktops, Linux workstation
 - Use `no_log: true` for secret-bearing task inputs or outputs.
 
 ## Desktop Notes
-- `profile_desktop_common` owns the shared desktop bootstrap; `profile_desktop_i3` (X11) and `profile_desktop_sway` (Wayland/SwayFX) install their respective session in parallel and are both wired into the `void` play in `ansible/site.yml`. `desktop_sessions_enabled` and `desktop_default_session` in host vars decide which sessions are exposed in `emptty` and which is preselected.
-- `.emacs.d` is deployed by a dedicated `profile_desktop_common` task tagged `emacs`.
+- `desktop_profile` names independently selectable desktop groups such as `desktop_gnome`, `desktop_hyprland`, `desktop_sway`, `desktop_niri`, and `desktop_cinnamon`. Keep platform-specific session bootstrap in platform-specific roles.
+- `desktop_environment` selects the mutually exclusive `minimal` (default), `gnome`, `xfce`, or `kde` desktop mode. `profile_desktop_common` owns shared Void bootstrap; the minimal mode uses `profile_desktop_sway`, `profile_desktop_hyprland`, and `profile_desktop_niri`, `profile_desktop_xfce` owns the reproducible XFCE setup, `profile_desktop_kde` owns KDE-specific defaults and cleanup, and `profile_desktop_gnome` copies shared desktop dotfiles for Fedora/GNOME without managing GNOME settings. `desktop_sessions_enabled` and `desktop_default_session` apply only to the minimal mode.
+- Emacs packages and `.emacs.d` deploy are disabled by default via `emacs_enabled: false`; keep the dotfiles in the repo for reversible opt-in only.
 - NTFS filesystem support is provided by `ntfs-3g` in `ansible/inventory/group_vars/void.yml`.
 - Void user services are managed by `turnstile` and live under `dotfiles/desktop/.config/service/`.
 - `ssh-agent` keeps the stable socket `~/.local/state/ssh-agent/socket`.
 - Critical session entrypoints:
-  - `dotfiles/desktop/.xinitrc` (i3 / X11)
   - `dotfiles/desktop/.config/sway/config` plus `host.conf` and `session-env` deployed via `host_sway_dotfiles` (sway / Wayland)
-- Do not auto-restart `emptty` during playbook runs on active Void desktop hosts; restart it manually from another TTY/SSH session if needed.
-- `nymph` is a Void laptop with NVIDIA Optimus, running both i3 (X11) and sway (Wayland); host-specific tasks in `profile_desktop_host/tasks/nymph.yml` handle GRUB NVIDIA cmdline params, `prime-run` wrapper, and the WirePlumber camera priority config. Multi-monitor on X11 is driven by `autorandr`; on sway it is driven by `kanshi` (config deployed via `host_sway_dotfiles`).
+  - `dotfiles/desktop/.config/hypr/hyprland.conf` plus `host.conf` and `session-env` deployed via `host_hyprland_dotfiles` (Hyprland / Wayland)
+  - `dotfiles/desktop/.config/niri/config.kdl` and `session-env` deployed via `desktop_niri_dotfiles` (Niri / Wayland)
+- Void Niri lives in `profile_desktop_niri`, gated on `'niri' in desktop_sessions_enabled`; it installs the `emptty` `niri.desktop` session, the `/usr/local/bin/start-niri` launcher, and the xdg-desktop-portal config, mirroring `profile_desktop_sway`.
+- Fedora GNOME (`desktop_gnome`) assumes GNOME comes from the Fedora Workstation base install; Ansible deploys shared desktop dotfiles and git/GPG config for `ikaros` and `nymph`, not GNOME settings.
+- FreeBSD Niri (dormant; `platform_freebsd` currently has no hosts) must keep FreeBSD-specific package, rc, DBus, seat, portal, and launcher behavior in `profile_desktop_niri_freebsd` or FreeBSD platform vars.
+- Do not switch or restart a display manager during a playbook run from an active graphical session. Changing among `emptty`, LightDM, and SDDM requires an explicit run from another TTY/SSH session with `desktop_allow_display_manager_switch=true`. Apply managed XFCE XML while logged out of XFCE so `xfconfd` cannot overwrite it from its in-memory state.
+- `nymph` is the Fedora/GNOME laptop target; keep GNOME settings unmanaged for now and add host-specific tuning only after real use.
 
 ## Void Package And Dotfile Bucket Rules
-The four Void desktop package lists in `ansible/inventory/group_vars/void.yml` are kept disjoint by role:
+`platform_void` is the reusable Void platform selection. The legacy `void` group remains a compatibility parent so existing `group_vars/void.yml` and `when: "'void' in group_names"` checks keep working during the transition.
+The Void desktop package lists in `ansible/inventory/group_vars/void.yml` are kept disjoint by role:
 - `void_packages_base` — system runtime only (init/services, kernel, audio core, networking, filesystem, firewall, hardware daemons, runit logging).
-- `desktop_common_packages` — WM-agnostic GUI infra (GTK theme, polkit, keyring, NM-applet, blueman, audio GUI, file manager backend + GVFS, portal, flatpak, printing/scanning).
-- `desktop_i3_packages` / `desktop_sway_packages` — binaries specific to each session. Cross-WM packages used by both (`dunst`, `rofi`, `alacritty`) are intentionally duplicated in the two lists.
+- `desktop_common_packages` — GUI infrastructure shared by all desktop modes.
+- `desktop_minimal_packages` / `desktop_xfce_packages` / `desktop_kde_packages` — mutually exclusive applications, integration components, and display managers. Packages required by more than one exclusive mode may be repeated; cleanup subtracts the selected mode before removing inactive packages.
+- `desktop_sway_packages` / `desktop_hyprland_packages` — binaries specific to each session. Cross-WM packages used by both (such as `dunst`, `rofi`, and `foot`) are intentionally duplicated in the two lists.
 `profile_packages` in the same file is cross-distro and is overridden by `group_vars/server.yml` and the workstation group vars; do not move desktop-specific Void entries through it.
-The dotfile vars follow the same split: `desktop_common_dotfiles` (in `group_vars/desktop.yml`) carries WM-agnostic GUI config and user scripts (Thunar, mimeapps, GTK theme setup, Udiskie, fontconfig, WirePlumber, mpv, …); `desktop_void_dotfiles` (in `group_vars/void.yml`) is reserved for files that need Void runtime (turnstile services, bash runit/dbus/ssh-agent fragments, `update-turnstile-env`).
+The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-independent content, `desktop_minimal_dotfiles` carries Thunar, Udiskie, and minimal MIME defaults, and `desktop_xfce_dotfiles` carries XFCE state. KDE uses its own MIME defaults. `desktop_void_dotfiles` remains reserved for files that need the Void runtime.
 
-## Workstation / Windows Notes
-- Native Linux workstation hosts can combine `workstation_host_linux` with an OS-specific dev group.
-- `deadalus-fedora` keeps GNOME managed settings in `ansible/inventory/host_vars/deadalus-fedora.yml`.
-- Ubuntu workstation follow-up work is still open around YubiKey/GPG/SSH-FIDO2 package verification, GPG signing setup on the YubiKey, and evaluating `ed25519-sk` SSH key generation.
-- `workstation_host_windows` runs with `gather_facts: false` and validates PSRP settings plus `windows_package_backend` before role execution.
-- Windows taskbar pins are driven by `windows_taskbar_pins` in `ansible/inventory/group_vars/workstation_host_windows.yml`; validate identifiers from a real Windows session before changing them.
+## Workstation Notes
+- `deadalus` is modeled as Windows + WSL; keep Linux dev automation on `deadalus-wsl`.
+- Native Linux workstation groups remain available for future hosts but have no current host in the main inventory.
 
 ## Coding Agent Notes
 - Shared agent packages live in `ai_agents_npm_packages` in `ansible/inventory/group_vars/all.yml`.
@@ -91,7 +95,7 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` (in `group_var
 - Install local tooling with:
   - `python3 -m pip install ansible ansible-lint yamllint shellcheck-py`
   - `ansible-galaxy collection install -r ansible/collections/requirements.yml`
-- Required collections currently include `ansible.posix`, `ansible.windows`, `community.general`, and `community.windows`.
+- Required collections currently include `ansible.posix` and `community.general`.
 - `.yamllint` treats `line-length` as a warning at 120 chars and disables `document-start` and `comments-indentation`.
 
 ## When Updating Docs

CLAUDE.md

@@ -0,0 +1,70 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this repo is
+
+Ansible-driven personal infrastructure as code for Fedora desktops (`ikaros`, `nymph`), WSL development (`deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions.
+
+## Validation commands
+
+```bash
+# Minimum before any change
+ansible-playbook ansible/site.yml --syntax-check
+
+# Dry-run per host
+ansible-playbook ansible/site.yml --limit ikaros --check --diff
+ansible-playbook ansible/site.yml --limit nymph --check --diff
+ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
+ansible-playbook ansible/site.yml --limit prometheus --check --diff
+
+# Linting
+ansible-lint ansible/site.yml
+ansible-lint ansible/roles
+yamllint ansible/
+
+# Tag-scoped dry-run
+ansible-playbook ansible/site.yml --limit ikaros --tags <tag> --check --diff
+
+# Shell scripts
+sh -n scripts/bootstrap_mail.sh && shellcheck scripts/bootstrap_mail.sh
+```
+
+## Architecture
+
+Configuration is composed in layers: `all → OS → profile → host`. All hosts use `ansible_connection: local`.
+
+`ansible/site.yml` is the sole orchestration entry point — keep it thin. Implementation belongs in roles under `ansible/roles/`.
+
+Variable layering:
+- `ansible/inventory/group_vars/` — OS and profile defaults
+- `ansible/inventory/host_vars/` — host-specific overrides (never put host overrides in group_vars)
+
+Dotfiles under `dotfiles/` mirror the same layer split: `common/`, `desktop/`, `server/`, `workstation/`, then per-host directories (`ikaros/`, `nymph/`).
+
+## Key conventions
+
+- FQCN for all Ansible modules.
+- Prefer declarative modules over `command`/`shell`; when shell is unavoidable, make idempotency explicit.
+- YAML: start with `---`, 2-space indent, file modes quoted as `"0644"`, booleans as booleans.
+- `no_log: true` on any task that handles secrets.
+- Do not restart `emptty` in playbook tasks on active desktop hosts — do it manually via SSH/TTY.
+
+## Void desktop package buckets (keep disjoint)
+
+- `void_packages_base` — system runtime (init, kernel, audio core, networking, firewall, hw daemons)
+- `desktop_common_packages` — WM-agnostic GUI infra (GTK theme, polkit, keyring, portals, flatpak, printing)
+- `desktop_sway_packages` / `desktop_hyprland_packages` — session-specific binaries; cross-WM packages used by both (`dunst`, `rofi`, `alacritty`) are intentionally duplicated
+- `profile_packages` — cross-distro; do not move desktop-only Void entries into it
+
+Dotfile var split follows the same logic: `desktop_common_dotfiles` (WM-agnostic), `desktop_void_dotfiles` (Void runtime — turnstile services, bash fragments).
+
+## Secrets
+
+- `secrets/vault.yml` and `secrets/vault.local.yml` are loaded conditionally if present.
+- `secrets/.vault_pass.gpg` is used automatically if present; falls back to `secrets/.vault_pass`.
+- Never print vault values; always use `no_log: true` where secrets flow through tasks.
+
+## AI agent dotfiles
+
+Shared agent instructions live in `dotfiles/common/.config/ai/`. Agent-specific entrypoints reference that path rather than duplicating content. Shared npm packages are in `ai_agents_npm_packages` in `ansible/inventory/group_vars/all.yml`.

README.md

@@ -36,7 +36,6 @@ infra/
 │   ├── workstation/
 │   ├── workstation_host_linux/
 │   ├── workstation_dev_wsl/
-│   ├── ikaros/
 │   └── nymph/
 │
 ├── scripts/
@@ -55,51 +54,76 @@ Il repository è diviso in due componenti principali:
 
 # Macchine gestite
 
-Il repository modella attualmente tre tipologie di profilo e prepara due filoni workstation: Linux nativa e Windows + WSL.
+Il repository modella attualmente host Fedora/GNOME, un ambiente WSL di sviluppo e un server Ubuntu.
+La composizione resta separata in assi indipendenti:
+
+```text
+common user environment
++ host-specific platform
++ role-specific software
++ independently selectable desktop
++ host hardware overrides
+```
+
+Matrice target:
+
+| Host           | Platform   | Role                 | Desktop                           |
+| -------------- | ---------- | -------------------- | --------------------------------- |
+| ikaros         | Fedora     | Personal workstation | GNOME                             |
+| nymph          | Fedora     | Desktop laptop       | GNOME                             |
+| void-reference | Void Linux | Lab/reference        | Current preserved desktop profile |
+
+Regola operativa:
+
+```text
+ikaros must be boring
+nymph is allowed to break
+```
+
+`ikaros` usa Fedora Workstation/GNOME come desktop personale stabile; `nymph` usa lo stesso
+target Fedora Workstation/GNOME come laptop. I gruppi legacy `void` e `desktop` restano alias di
+compatibilita per eventuali host Void futuri mentre i nuovi assi sono
+`platform_*`, `role_*` e `desktop_*`.
 
 Nota sullo stato attuale del playbook principale:
 
-- `ansible/site.yml` applica oggi in automatico il profilo desktop su host Void Linux
-- `ansible/site.yml` applica la workstation Linux nativa separando il layer dev comune dal layer host GNOME
-- `ansible/site.yml` applica anche il ramo `workstation_host_windows` + `workstation_dev_wsl` per il modello Windows 11 + WSL
+- `ansible/site.yml` applica oggi in automatico Fedora/GNOME su `ikaros` e `nymph`
+- `ansible/site.yml` applica anche il ramo `workstation_dev_wsl` per il modello dev in WSL
 - `ansible/site.yml` applica anche il profilo `ubuntu_server` con baseline apt, systemd, dotfiles server e firewall UFW
 
 ## Desktop
 
-Sistema operativo:
+Target operativi:
 
-- Void Linux
+- `ikaros`: Fedora Workstation + GNOME, desktop personale stabile/floating.
+- `nymph`: Fedora Workstation + GNOME, laptop desktop con dotfiles desktop condivisi e GNOME lasciato al default Fedora.
 
-Sessioni desktop:
-
-- `ikaros`: i3 (X11) + sway (Wayland), default i3
-- `nymph`: i3 (X11) + sway (Wayland), default i3
-
-Macchine:
-
-- `ikaros`
-- `nymph`
-
-Queste macchine condividono la stessa configurazione base desktop e vengono mantenute allineate tramite Ansible. Sia i3 sia sway/SwayFX sono installate in parallelo e selezionabili da `emptty`; `desktop_default_session` decide quale sessione viene preselezionata al login.
+Il profilo Void desktop resta disponibile come modello riutilizzabile per host
+futuri. `desktop_environment` continua a selezionare in modo esclusivo
+`minimal`, `xfce` oppure `kde` per i desktop Void; Niri, GNOME e Cinnamon sono profili
+desktop indipendenti via gruppi `desktop_niri`, `desktop_gnome` e `desktop_cinnamon`.
 
 Lo stato attuale del profilo desktop include, tra le altre cose:
 
 - dotfiles comuni e desktop
-- sessioni i3 e sway su entrambi gli host (default i3, sway disponibile via `emptty`)
-- `emptty` con default host-specific per il desktop attivo, con `XORG_SESSIONS_PATH` puntato a `/etc/emptty/xsessions` e session file Wayland esposti su `WAYLAND_SESSIONS_PATH` per `sway`
+- sessioni sway e Hyprland per eventuali host Void in modalita `minimal`
+- KDE Plasma con applicazioni KDE curate e SDDM disponibile come alternativa esclusiva
+- XFCE con pannello, keybinding, terminale, tema e workspace dichiarativi, LightDM e Thunderbird come client grafico principale
+- `emptty` con default host-specific in modalita `minimal`, con session file Wayland esposti per `sway` e `hyprland`
 - pacchetti Void Linux e servizi runit; le liste pacchetti Void desktop sono separate per criterio:
   - `void_packages_base` per il runtime sistema (init, kernel, audio core, networking, firewall, hw daemons)
-  - `desktop_common_packages` per l'infrastruttura GUI WM-agnostic (tema, polkit, keyring, NM-applet, blueman, audio GUI, file manager backend, portal, flatpak, printing/scanning)
-  - `desktop_i3_packages` e `desktop_sway_packages` per i binari specifici di ciascuna sessione
-- `turnstile` per i servizi utente, inclusi `emacs` e `ssh-agent`
-- `ssh-agent` con socket stabile condiviso tra shell, SSH ed Emacs in `~/.local/state/ssh-agent/socket`
-- `.emacs.d` distribuito da un task dedicato Ansible con tag `emacs`
+  - `desktop_common_packages` per l'infrastruttura condivisa dalle modalita
+  - `desktop_minimal_packages` per applicazioni GTK/XFCE e `emptty`
+  - `desktop_xfce_packages` per XFCE, LightDM e le relative integrazioni
+  - `desktop_kde_packages` per Plasma, SDDM e le applicazioni KDE equivalenti
+  - `desktop_sway_packages` e `desktop_hyprland_packages` per i binari specifici di ciascuna sessione
+- `turnstile` per i servizi utente Void, incluso `ssh-agent`
+- `ssh-agent` con socket stabile condiviso tra shell e SSH in `~/.local/state/ssh-agent/socket`
+- Emacs e i relativi dotfile restano nel repo ma sono disabilitati di default tramite `emacs_enabled: false`
 - `tmux` con plugin gestiti da TPM al bootstrap del profilo desktop
 - Flatpak con remoto Flathub
-- GNOME Keyring e bootstrap della posta via script dedicato
-- `udiskie` come backend per automount/LUKS
-- `autorandr` per profili monitor X11 host-specifici (`nymph` ha profili `dual` e `solo`); sotto sway il multi-monitor è gestito da `kanshi` (config host-specifica in `host_sway_dotfiles` su `nymph`)
-- override NVIDIA Optimus su `nymph`: parametri kernel GRUB iniettati in modo idempotente in `GRUB_CMDLINE_LINUX`, wrapper `prime-run` e config WirePlumber per priorità telecamera
+- GNOME Keyring e `udiskie` nella modalita minimale; KWallet e integrazione UDisks di Plasma nella modalita KDE
+- multi-monitor Void: sotto sway è gestito da `kanshi`; sotto Hyprland gli override monitor vivono in `host_hyprland_dotfiles`
 
 ---
 
@@ -107,19 +131,16 @@ Lo stato attuale del profilo desktop include, tra le altre cose:
 
 Sistemi operativi supportati:
 
-- Ubuntu LTS nativa
-- Fedora Workstation nativa
-- Windows 11 host + Ubuntu WSL
+- Ubuntu WSL, attualmente usato da `deadalus-wsl`
+- Fedora Workstation nativa, disponibile per host futuri tramite gruppi dedicati
 
-Desktop environment host Linux:
+Desktop environment host Linux, per eventuali workstation native:
 
 - GNOME
 
 Macchine attuali:
 
-- `deadalus-ubuntu` come workstation Ubuntu nativa
-- `deadalus-fedora` come workstation Fedora nativa
-- supporto attivo per host Windows 11 + WSL tramite `deadalus-win` e `deadalus-wsl`
+- `deadalus-wsl` come ambiente dev Ubuntu in WSL sulla workstation Windows `deadalus`
 
 Questo profilo è pensato per sviluppo e lavoro, con separazione tra layer host e layer dev.
 
@@ -127,56 +148,30 @@ Nel modello Ansible usato qui, un singolo inventory host puo appartenere intenzi
 
 Il profilo workstation e agganciato al playbook principale e ora distingue:
 
-- layer dev Ubuntu condiviso tra workstation Linux nativa e Ubuntu in WSL
-- layer dev Fedora nativo parallelo a Ubuntu
-- layer host Linux GNOME
-- layer host Windows 11 con bootstrap WSL, remoting `PSRP` su `HTTPS/5986`, gestione app via `winget` con backend configurabile e VS Code lato Windows
+- layer dev Ubuntu condiviso tra WSL e server
+- layer dev Fedora nativo disponibile per host futuri
+- layer host Linux GNOME disponibile per host futuri
 - layer WSL dedicato per sviluppo con `systemd`
 
-Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `workstation_dev_fedora` oppure `workstation_dev_ubuntu`, a seconda del layering che vuoi comporre.
+Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `workstation_dev_fedora`, a seconda del layering che vuoi comporre.
 
 Lo stato attuale del profilo workstation include:
 
 - installazione pacchetti base Ubuntu via apt
-- installazione pacchetti base Fedora via dnf per il ramo workstation nativo
+- installazione pacchetti base Fedora via dnf per eventuali workstation native
 - installazione e configurazione di Docker dal repository ufficiale
 - gestione dei dotfiles workstation e rendering dei template dev condivisi
-- installazione di Google Chrome su Ubuntu e Fedora, `VS Code` su Fedora via repository RPM Microsoft, `IntelliJ IDEA Ultimate` su Fedora via COPR RPM, e applicazioni workstation residue su Fedora via Flatpak
-- installazione di applicazioni workstation su Ubuntu nativa via Snap, oltre alle estensioni GNOME sul solo host Linux nativo
-- configurazione del ramo Windows 11 host con app installate dal playbook via `winget`, con backend predefinito `winget_psrp`, tema scuro, pin della taskbar gestiti via policy locale e profilo predefinito di Windows Terminal impostato su `Ubuntu`
+- installazione opzionale di Google Chrome, VS Code, IntelliJ IDEA Ultimate e applicazioni Flatpak per eventuali workstation Fedora native
+- estensioni GNOME per eventuali host Linux nativi
 - preparazione del ramo WSL Ubuntu con `systemd` per il toolchain di sviluppo
-- attivazione del firewall UFW su Ubuntu nativa e `firewalld` su Fedora nativa
-- gestione di `gsettings` GNOME host-specifici su `deadalus-fedora`, inclusi shell, Files/Nautilus, file chooser GTK e GNOME Text Editor, allineati allo stato reale della macchina
+- attivazione del firewall `firewalld` sui target Fedora che dichiarano regole host-specifiche
 
-Workflow Windows + WSL previsto:
+Workflow WSL previsto:
 
-Prima di eseguire il bootstrap Windows, apri PowerShell come amministratore e verifica la policy di esecuzione:
-
-```powershell
-Get-ExecutionPolicy -List
-```
-
-Se necessario, abilita l'esecuzione degli script per l'utente corrente:
-
-```powershell
-Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
-```
-
-Se Windows ha bloccato il file di bootstrap, sbloccalo esplicitamente:
-
-```powershell
-Unblock-File .\scripts\bootstrap_windows_workstation.ps1
-```
-
-1. eseguire `scripts/bootstrap_windows_workstation.ps1` su Windows come amministratore
-2. riavviare Windows se richiesto dalle feature WSL
-3. avviare Ubuntu WSL almeno una volta e completare la creazione dell'utente Linux
-4. installare Ansible dentro WSL Ubuntu
-5. lanciare il playbook da WSL su `deadalus-wsl` per configurare l'ambiente dev locale
-6. lanciare da WSL anche il playbook su `deadalus-win` via `psrp` per configurare l'host Windows; per default il backend pacchetti Windows e `winget_psrp`
-7. usare VS Code con le estensioni Remote (`WSL`, `SSH`, `Dev Containers`) dal lato Windows
-
-Per il remoting Windows il repository usa di default `PSRP` con `Negotiate` su `HTTPS/5986`. L'utente di default puo essere un `MicrosoftAccount\...`, con host, utente e password forniti via vault o extra vars. Il backend pacchetti Windows e configurabile con `windows_package_backend` oppure `vault_windows_package_backend`; il default e `winget_psrp`.
+1. avviare Ubuntu WSL almeno una volta e completare la creazione dell'utente Linux
+2. installare Ansible dentro WSL Ubuntu
+3. lanciare il playbook da WSL su `deadalus-wsl` per configurare l'ambiente dev locale
+4. usare VS Code con le estensioni Remote (`WSL`, `SSH`, `Dev Containers`) dal lato Windows
 
 ---
 
@@ -225,32 +220,27 @@ ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser -
 
 # Composizione della configurazione
 
-Deploy mirato della configurazione Emacs sui desktop Void:
+Emacs è disabilitato di default. Per riattivare temporaneamente il deploy Emacs:
 
 ```bash
-ansible-playbook ansible/site.yml --limit ikaros --tags emacs
-ansible-playbook ansible/site.yml --limit nymph --tags emacs
+ansible-playbook ansible/site.yml --limit <host> --tags emacs -e emacs_enabled=true
 ```
 
 La configurazione finale di una macchina è ottenuta combinando più livelli.
 
 ```text
 common configuration
-+ OS configuration
-+ profile configuration
++ platform configuration
++ role configuration
++ desktop configuration
 + host overrides
 ```
 
-Esempio per `ikaros`:
+Esempi correnti:
 
 ```text
-common + void + desktop + ikaros
-```
-
-Esempio per `nymph`:
-
-```text
-common + void + desktop + nymph
+ikaros -> common + platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome + ikaros
+nymph  -> common + platform_fedora + graphical_desktop + desktop_gnome + nymph
 ```
 
 Questo approccio consente di:
@@ -258,6 +248,8 @@ Questo approccio consente di:
 - mantenere configurazioni condivise
 - applicare override specifici per host
 - evitare duplicazioni
+- riutilizzare il profilo Void corrente su un host futuro assegnandolo a
+  `platform_void + graphical_desktop + role_lab + desktop_hyprland`
 
 ---
 
@@ -269,18 +261,26 @@ I principali ruoli attualmente presenti sono:
 | ------------------------- | ----------------------------------- |
 | base                      | configurazione base comune          |
 | packages_void             | installazione pacchetti su Void     |
+| packages_mint             | installazione pacchetti su Linux Mint via APT |
+| packages_freebsd          | installazione pacchetti su FreeBSD via pkg |
 | packages_ubuntu           | installazione pacchetti su Ubuntu   |
 | packages_fedora           | installazione pacchetti su Fedora   |
 | services_runit            | gestione servizi runit              |
 | services_systemd          | gestione servizi systemd            |
+| services_freebsd          | gestione servizi FreeBSD rc.conf/rc.d |
 | profile_desktop_common    | bootstrap desktop Void condiviso    |
-| profile_desktop_i3        | sessione desktop i3 (X11)           |
+| profile_desktop_gnome     | dotfiles desktop condivisi per Fedora/GNOME |
 | profile_desktop_sway      | sessione desktop sway / SwayFX (Wayland) |
+| profile_desktop_hyprland  | sessione desktop Hyprland (Wayland) |
+| profile_desktop_niri     | sessione desktop Niri su Void (Wayland) |
+| profile_desktop_niri_freebsd | adattamenti FreeBSD per Niri |
+| profile_desktop_cinnamon  | impostazioni Cinnamon circoscritte |
 | profile_desktop_host      | override desktop specifici per host |
+| profile_personal_workstation | layer stabile per workstation personale |
+| profile_lab               | layer sperimentale/lab              |
 | profile_workstation_dev_common | configurazione dev workstation condivisa |
 | profile_workstation_gnome | configurazione host workstation GNOME |
 | profile_workstation_dev_wsl | configurazione WSL Ubuntu per sviluppo |
-| profile_workstation_host_windows | configurazione host Windows 11 workstation |
 | profile_server            | configurazione server               |
 | dotfiles_common           | distribuzione dotfiles comuni       |
 | dotfiles                  | distribuzione configurazioni utente |
@@ -289,25 +289,33 @@ I principali ruoli attualmente presenti sono:
 
 # Stato attuale del playbook principale
 
-Il playbook `ansible/site.yml` e attualmente composto da sette blocchi:
+Il playbook `ansible/site.yml` e attualmente composto da blocchi per asse:
 
 ```text
-all:!workstation_host_windows -> dotfiles_common
-void -> packages_void + services_runit + profile_desktop_common + profile_desktop_i3 + profile_desktop_sway + profile_desktop_host
-workstation_dev_ubuntu -> packages_ubuntu + services_systemd + profile_workstation_dev_common
-workstation_dev_fedora -> packages_fedora + services_systemd + profile_workstation_dev_common
+all -> dotfiles_common
+platform_void -> packages_void + services_runit
+platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_hyprland + profile_desktop_niri + profile_desktop_kde + profile_desktop_xfce + profile_desktop_host
+platform_mint -> packages_mint + services_systemd
+platform_mint & role_personal_workstation -> profile_personal_workstation
+platform_mint & desktop_cinnamon -> profile_desktop_cinnamon
+platform_freebsd -> packages_freebsd + services_freebsd
+platform_freebsd & role_lab -> profile_lab
+platform_freebsd & desktop_niri -> profile_desktop_niri_freebsd
+platform_fedora -> packages_fedora + services_systemd
+platform_fedora & role_personal_workstation -> profile_personal_workstation
+platform_fedora & desktop_gnome -> profile_desktop_gnome
+workstation_dev_fedora -> profile_workstation_dev_common
 workstation_host_linux -> profile_workstation_gnome
 workstation_dev_wsl -> packages_ubuntu + services_systemd + profile_workstation_dev_common + profile_workstation_dev_wsl
-workstation_host_windows -> profile_workstation_host_windows
 ubuntu_server -> packages_ubuntu + services_systemd + profile_server
 ```
 
 Questo significa che, allo stato attuale:
 
-- i desktop Void (`ikaros`, `nymph`) restano il target operativo piu completo
-- la workstation Ubuntu (`deadalus-ubuntu`) e gestita separando ambiente dev e layer host GNOME
-- la workstation Fedora (`deadalus-fedora`) usa lo stesso principio di composizione a gruppi con il ramo Fedora dedicato e con `gsettings` host-specifici dichiarati in inventory
-- il ramo Windows + WSL e predisposto con bootstrap PowerShell e play Windows/WSL dedicati
+- `ikaros` riceve Fedora Workstation/GNOME come target desktop personale stabile
+- `nymph` riceve Fedora Workstation/GNOME come target laptop
+- il profilo Void resta selezionabile tramite `platform_void + graphical_desktop` per host futuri
+- il ramo WSL (`deadalus-wsl`) e predisposto con play dev dedicato
 - il server Ubuntu (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewall
 - lo stack container server include `navidrome`, `postgres`, `gitea`, `nginx-proxy-manager` e `syncthing`, con GUI Syncthing raggiungibile tramite la rete Docker `web`
 
@@ -325,7 +333,6 @@ dotfiles/
 ├── workstation
 ├── workstation_host_linux
 ├── workstation_dev_wsl
-├── ikaros
 └── nymph
 ```
 
@@ -365,7 +372,6 @@ Gestione segreti:
 - `secrets/vault.yml.example` funge da template/esempio
 - se `secrets/vault.yml` non e presente, il playbook continua comunque senza caricare variabili locali opzionali
 - se `secrets/.vault_pass.gpg` esiste viene usato automaticamente per sbloccare i vault tramite `gpg`; in alternativa resta supportato `secrets/.vault_pass` come fallback legacy locale; se nessuno dei due file esiste Ansible richiede la password in modo interattivo
-- per il ramo Windows puoi anche definire `vault_windows_package_backend`, con valori supportati `winget_psrp` e `winget_wsl_local`; il default e `winget_psrp`
 
 ---
 
@@ -380,14 +386,15 @@ ansible-playbook ansible/site.yml
 Allo stato attuale questo comando:
 
 - distribuisce i dotfiles comuni a tutti gli host
-- per gli host Void applica bootstrap desktop condiviso, sessione i3 e override specifici per host
-- per `workstation_dev_ubuntu` applica pacchetti Ubuntu, servizi systemd e profilo dev comune
-- per `workstation_dev_fedora` applica pacchetti Fedora, servizi systemd e profilo dev comune
-- per `workstation_host_linux` applica il layer host Linux GNOME
-- per `workstation_dev_wsl` applica pacchetti Ubuntu, servizi systemd, profilo dev comune e tweak WSL dedicati
-- per `workstation_host_windows` applica il layer host Windows 11 via PSRP, con installazione pacchetti Windows eseguita di default tramite `winget_psrp`
+- per `platform_void` applica pacchetti Void e servizi runit
+- per `platform_void + graphical_desktop` applica bootstrap desktop condiviso, sessioni sway/Hyprland/Niri e override specifici per host
+- per `platform_mint`, `platform_freebsd`, `workstation_dev_fedora` e `workstation_host_linux` non applica nulla finche quei gruppi restano senza host
+- per `platform_fedora` applica pacchetti Fedora e servizi systemd a `ikaros` e `nymph`
+- per `platform_fedora & role_personal_workstation` applica il layer personale a `ikaros`
+- per `platform_fedora & desktop_gnome` applica il profilo GNOME a `ikaros` e `nymph`
+- per `workstation_dev_wsl` applica pacchetti Ubuntu, servizi systemd, profilo dev comune e tweak WSL dedicati a `deadalus-wsl`
 - per gli host `ubuntu_server` applica pacchetti Ubuntu, servizi systemd, profilo server, UFW, dotfiles e template dedicati
-- non riavvia automaticamente `emptty`; le modifiche al display manager vanno applicate manualmente da SSH o da una TTY separata
+- non riavvia automaticamente il display manager; i passaggi tra `emptty`, LightDM e SDDM vanno applicati da SSH o da una TTY separata
 - carica `secrets/vault.yml` solo se presente
 - carica `secrets/vault.local.yml` solo se presente, dopo `vault.yml`, cosi gli override locali hanno precedenza
 
@@ -395,10 +402,9 @@ Per validare prima di applicare:
 
 ```bash
 ansible-playbook ansible/site.yml --syntax-check
+ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff
 ansible-playbook ansible/site.yml --limit ikaros --check --diff
 ansible-playbook ansible/site.yml --limit nymph --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-ubuntu --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff
 ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --check --diff
 ansible-lint ansible/site.yml
@@ -430,34 +436,46 @@ Per vedere l'elenco reale aggiornato dei tag disponibili:
 ansible-playbook ansible/site.yml --list-tags
 ```
 
+Per attivare XFCE o KDE su un host, impostare rispettivamente `desktop_environment: xfce` o `desktop_environment: kde` nei relativi `host_vars` ed eseguire prima un dry run. Il primo play configura il profilo ma, se un altro display manager e ancora attivo, rinvia il cambio. Da una TTY o sessione SSH separata, con la sessione grafica chiusa, applicare quindi il passaggio esplicito:
+
+```bash
+ansible-playbook ansible/site.yml --limit <host> -e desktop_allow_display_manager_switch=true
+```
+
+La stessa procedura vale per ogni passaggio tra `minimal`, `xfce` e `kde`. Gli XML XFCE sono autorevoli: applicare i relativi aggiornamenti mentre XFCE e disconnesso evita che `xfconfd` ripristini lo stato in memoria.
+
 Allo stato attuale `ansible/site.yml` espone questi tag:
 
 | Tag | Scopo | Ambito principale |
 | --- | --- | --- |
-| `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common, Windows |
+| `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common |
 | `dotfiles` | distribuzione/configurazione dotfiles | tutti i profili |
 | `dotfiles:common` | dotfiles comuni condivisi | common, workstation, server |
-| `dotfiles:desktop` | dotfiles desktop | desktop Void |
+| `dotfiles:desktop` | dotfiles desktop | desktop Void, Fedora/GNOME, FreeBSD/Niri |
 | `dotfiles:host` | override host-specifici desktop | desktop Void |
 | `dotfiles:server` | dotfiles dedicati al profilo server | server |
-| `dotfiles:workstation` | dotfiles dedicati alle workstation | workstation Linux, WSL |
+| `dotfiles:workstation` | dotfiles dedicati alle workstation | personal workstation, WSL, workstation Linux future |
 | `emptty` | gestione display manager `emptty` | desktop Void |
-| `gnome` | configurazione host GNOME | workstation host Linux, parte desktop |
-| `i3` | sessione/configurazione i3 (X11) | desktop Void |
+| `display-manager` | selezione protetta tra `emptty`, LightDM e SDDM | desktop Void |
+| `kde` | profilo KDE Plasma e relativa pulizia | desktop Void |
+| `xfce` | profilo XFCE, LightDM e relativa pulizia | desktop Void |
+| `cinnamon` | impostazioni Cinnamon circoscritte | Linux Mint desktop |
+| `gnome` | configurazione host GNOME | Fedora/GNOME desktop, workstation host Linux future |
 | `sway` | sessione/configurazione sway / SwayFX (Wayland) | desktop Void |
-| `npm` | installazione pacchetti npm globali | desktop Void, workstation Linux, WSL |
+| `hyprland` | sessione/configurazione Hyprland (Wayland) | desktop Void |
+| `niri` | sessione/configurazione Niri (Wayland) | Void o FreeBSD con `desktop_niri` |
+| `npm` | installazione pacchetti npm globali | Fedora/GNOME, desktop Void, workstation Linux, WSL |
 | `nvidia` | componenti NVIDIA desktop | desktop Void |
 | `packages` | installazione e aggiornamento pacchetti | tutti i profili |
-| `services` | gestione servizi runit/systemd/Windows | tutti i profili |
-| `vscode` | installazione/configurazione VS Code | Fedora, host Linux, Windows |
-| `wsl` | bootstrap e configurazione WSL | WSL, Windows |
+| `services` | gestione servizi runit/systemd | tutti i profili |
+| `vscode` | installazione/configurazione VS Code | workstation Fedora future, host Linux |
+| `wsl` | bootstrap e configurazione WSL | WSL |
 
 Esempi pratici:
 
 ```bash
-ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,i3 --check --diff
-ansible-playbook ansible/site.yml --limit ikaros --tags sway,portal --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora --tags packages,vscode --check --diff
+ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,gnome --check --diff
+ansible-playbook ansible/site.yml --limit ikaros --tags gnome --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --tags services,dotfiles:server --check --diff
 ```
 
@@ -476,6 +494,22 @@ ansible-playbook ansible/site.yml
 
 Dopo l'esecuzione del playbook la macchina verra configurata secondo il profilo definito e i ruoli attualmente orchestrati.
 
+Per aggiungere un nuovo host Void che riusa il profilo desktop preservato:
+
+1. aggiungere l'host a `platform_void`;
+2. aggiungerlo a `graphical_desktop`;
+3. scegliere il ruolo, per esempio `role_lab`;
+4. scegliere il desktop, per esempio `desktop_hyprland`;
+5. lasciare eventuali dettagli hardware in `host_vars/<host>.yml`.
+
+I gruppi legacy `void` e `desktop` sono parent di compatibilita, quindi un host
+in `platform_void` e `graphical_desktop` continua a ricevere anche le variabili
+Void e desktop esistenti.
+
+Per prove in VM sono disponibili gruppi di esempio in
+`ansible/inventory/examples/platform-test-hosts.yml`, da passare esplicitamente
+con `-i` insieme all'inventory principale.
+
 Per il flusso mail desktop esiste inoltre uno script dedicato:
 
 ```bash

ansible/collections/requirements.yml

@@ -1,6 +1,4 @@
 ---
 collections:
   - name: ansible.posix
-  - name: ansible.windows
   - name: community.general
-  - name: community.windows

ansible/inventory/examples/platform-test-hosts.yml

@@ -0,0 +1,34 @@
+---
+# Optional inventory overlay for VM tests. It is not loaded by ansible.cfg.
+all:
+  children:
+    platform_mint:
+      hosts:
+        minttest:
+          ansible_connection: local
+
+    platform_freebsd:
+      hosts:
+        freebsdtest:
+          ansible_connection: local
+
+    graphical_desktop:
+      hosts:
+        minttest:
+        freebsdtest:
+
+    role_personal_workstation:
+      hosts:
+        minttest:
+
+    role_lab:
+      hosts:
+        freebsdtest:
+
+    desktop_cinnamon:
+      hosts:
+        minttest:
+
+    desktop_hyprland:
+      hosts:
+        freebsdtest:

ansible/inventory/group_vars/all.yml

@@ -7,6 +7,7 @@ user_shell: /bin/bash
 effective_username: "{{ username }}"
 effective_user_group: "{{ user_group }}"
 effective_user_home: "{{ user_home }}"
+emacs_enabled: false
 
 xdg_user_directories:
   - Desktop
@@ -32,6 +33,18 @@ common_packages:
   - zip
   - zoxide
 
+vim_plugins_enabled: true
+vim_plugin_distro_packages:
+  - fzf
+  - vim-fugitive
+vim_plugin_source_plugins:
+  - name: fzf
+    repo: https://github.com/junegunn/fzf.git
+    version: v0.72.0
+  - name: fzf.vim
+    repo: https://github.com/junegunn/fzf.vim.git
+    version: 34a564c81f36047f50e593c1656f4580ff75ccca
+
 common_dotfiles:
   - name: .bashrc
     src: .bashrc

ansible/inventory/group_vars/desktop.yml

@@ -1,11 +1,18 @@
 ---
-desktop_protonmail_bridge_cert_path: ~/.var/app/ch.protonmail.protonmail-bridge/config/protonmail/bridge-v3/cert.pem
+desktop_environment: minimal
+desktop_allow_display_manager_switch: false
+
+desktop_display_manager_by_environment:
+  minimal: emptty
+  xfce: lightdm
+  kde: sddm
 
 desktop_sessions_enabled:
-  - i3
+  - sway
+  - hyprland
 
-desktop_default_session: i3
-desktop_default_session_env: xorg
+desktop_default_session: hyprland
+desktop_default_session_env: wayland
 desktop_prompt_for_session: true
 
 desktop_source_tools:
@@ -29,7 +36,18 @@ desktop_source_tools:
 
 desktop_binary_tools: []
 
-desktop_npm_packages: "{{ ai_agents_npm_packages + [] }}"
+desktop_npm_packages: >-
+  {{
+    ai_agents_npm_packages
+    + [
+      {'name': '@mermaid-js/mermaid-cli', 'state': 'latest'},
+      {'name': 'vscode-langservers-extracted', 'state': 'latest'}
+    ]
+  }}
+
+desktop_uv_tools:
+  - debugpy
+  - python-lsp-server
 
 desktop_common_dotfiles:
   - name: XDG autostart entries
@@ -48,22 +66,6 @@ desktop_common_dotfiles:
     src: .local/bin/setup-gtk-theme
     dest: .local/bin/setup-gtk-theme
     mode: "0755"
-  - name: MIME application defaults
-    src: .config/mimeapps.list
-    dest: .config/mimeapps.list
-    mode: "0644"
-  - name: Thunar config
-    src: .config/Thunar/
-    dest: .config/Thunar/
-    mode: preserve
-  - name: Udiskie config
-    src: .config/udiskie/
-    dest: .config/udiskie/
-    mode: preserve
-  - name: Udiskie password helper
-    src: .local/bin/udiskie-password
-    dest: .local/bin/udiskie-password
-    mode: "0755"
   - name: WirePlumber config
     src: .config/wireplumber/
     dest: .config/wireplumber/
@@ -92,10 +94,6 @@ desktop_common_dotfiles:
     src: .bashrc.d/20-editor-desktop.sh
     dest: .bashrc.d/20-editor-desktop.sh
     mode: "0644"
-  - name: Bash Emacs client fragment
-    src: .bashrc.d/25-emacs-client-desktop.sh
-    dest: .bashrc.d/25-emacs-client-desktop.sh
-    mode: "0644"
   - name: Bash VM helper fragment
     src: .bashrc.d/30-runvm.sh
     dest: .bashrc.d/30-runvm.sh
@@ -133,50 +131,50 @@ desktop_common_dotfiles:
     dest: .ssh/config
     mode: "0600"
 
+desktop_minimal_dotfiles:
+  - name: Minimal desktop MIME defaults
+    src: .config/mimeapps.list
+    dest: .config/mimeapps.list
+    mode: "0644"
+  - name: Thunar config
+    src: .config/Thunar/
+    dest: .config/Thunar/
+    mode: preserve
+  - name: Udiskie config
+    src: .config/udiskie/
+    dest: .config/udiskie/
+    mode: preserve
+  - name: Udiskie password helper
+    src: .local/bin/udiskie-password
+    dest: .local/bin/udiskie-password
+    mode: "0755"
+
+desktop_minimal_managed_paths:
+  - .config/Thunar
+  - .config/alacritty
+  - .config/dunst
+  - .config/flameshot
+  - .config/foot
+  - .config/gtklock
+  - .config/hypr
+  - .config/kanshi
+  - .config/rofi
+  - .config/sway
+  - .config/udiskie
+  - .config/waybar
+  - .config/wlogout
+  - .local/bin/udiskie-password
+
 desktop_emacs_dotfiles:
+  - name: Bash Emacs client fragment
+    src: .bashrc.d/25-emacs-client-desktop.sh
+    dest: .bashrc.d/25-emacs-client-desktop.sh
+    mode: "0644"
   - name: Emacs config
     src: .emacs.d/
     dest: .emacs.d/
     mode: preserve
 
-desktop_i3_dotfiles:
-  - name: i3 config
-    src: .config/i3/
-    dest: .config/i3/
-    mode: preserve
-  - name: dunst config
-    src: .config/dunst/
-    dest: .config/dunst/
-    mode: preserve
-  - name: i3blocks config
-    src: .config/i3blocks/
-    dest: .config/i3blocks/
-    mode: preserve
-  - name: rofi config
-    src: .config/rofi/
-    dest: .config/rofi/
-    mode: preserve
-  - name: picom config
-    src: .config/picom/picom.conf
-    dest: .config/picom/picom.conf
-    mode: "0644"
-  - name: polybar config
-    src: .config/polybar/config.ini
-    dest: .config/polybar/config.ini
-    mode: "0644"
-  - name: polybar launcher
-    src: .config/polybar/launch.sh
-    dest: .config/polybar/launch.sh
-    mode: "0755"
-  - name: alacritty config
-    src: .config/alacritty/
-    dest: .config/alacritty/
-    mode: preserve
-  - name: .xinitrc
-    src: .xinitrc
-    dest: .xinitrc
-    mode: "0644"
-
 desktop_sway_dotfiles:
   - name: alacritty config
     src: .config/alacritty/
@@ -206,6 +204,86 @@ desktop_sway_dotfiles:
     src: .config/wlogout/
     dest: .config/wlogout/
     mode: preserve
+  - name: foot config
+    src: .config/foot/
+    dest: .config/foot/
+    mode: preserve
+  - name: gtklock config
+    src: .config/gtklock/
+    dest: .config/gtklock/
+    mode: preserve
+
+desktop_hyprland_dotfiles:
+  - name: alacritty config
+    src: .config/alacritty/
+    dest: .config/alacritty/
+    mode: preserve
+  - name: dunst config
+    src: .config/dunst/
+    dest: .config/dunst/
+    mode: preserve
+  - name: rofi config
+    src: .config/rofi/
+    dest: .config/rofi/
+    mode: preserve
+  - name: hyprland config
+    src: .config/hypr/
+    dest: .config/hypr/
+    mode: preserve
+  - name: waybar config
+    src: .config/waybar/
+    dest: .config/waybar/
+    mode: preserve
+  - name: foot config
+    src: .config/foot/
+    dest: .config/foot/
+    mode: preserve
+
+desktop_niri_dotfiles:
+  - name: foot config
+    src: .config/foot/
+    dest: .config/foot/
+    mode: preserve
+  - name: dunst config
+    src: .config/dunst/
+    dest: .config/dunst/
+    mode: preserve
+  - name: rofi config
+    src: .config/rofi/
+    dest: .config/rofi/
+    mode: preserve
+  - name: waybar config
+    src: .config/waybar/
+    dest: .config/waybar/
+    mode: preserve
+  - name: niri config
+    src: .config/niri/
+    dest: .config/niri/
+    mode: preserve
+
+desktop_xfce_dotfiles:
+  - name: XFCE configuration
+    src: .config/xfce4/
+    dest: .config/xfce4/
+    mode: preserve
+  - name: XFCE Thunar custom actions
+    src: .config/Thunar/uca.xfce.xml
+    dest: .config/Thunar/uca.xml
+    mode: "0644"
+  - name: XFCE dark desktop background
+    src: .local/share/backgrounds/xfce-dark.svg
+    dest: .local/share/backgrounds/xfce-dark.svg
+    mode: "0644"
+
+desktop_xfce_managed_paths:
+  - .config/xfce4
+  - .local/share/backgrounds/xfce-dark.svg
+
+xfce_theme_gtk: Yaru-blue-dark
+xfce_theme_icons: Papirus-Dark
+xfce_theme_wm: Greybird-dark
+xfce_font_ui: Liberation Sans 10
+xfce_font_monospace: Liberation Mono 11
 
 desktop_flatpak_packages:
   - be.alexandervanhee.gradia

ansible/inventory/group_vars/desktop_cinnamon.yml

@@ -0,0 +1,29 @@
+---
+desktop_profile: cinnamon
+desktop_default_session: cinnamon
+
+cinnamon_theme_gtk: Mint-Y-Dark-Aqua
+cinnamon_theme_icons: Mint-Y-Aqua
+cinnamon_font_ui: Sans 10
+cinnamon_font_monospace: Monospace 10
+
+# WM-agnostic desktop dotfiles from desktop_common_dotfiles that do NOT apply to
+# Cinnamon: the autostart entry is the (removed) Protonmail mail bridge, and the
+# GTK theme script conflicts with Cinnamon's own dconf-managed theming.
+cinnamon_desktop_dotfiles_exclude:
+  - XDG autostart entries
+  - GTK theme setup script
+
+cinnamon_dconf_settings:
+  - key: /org/cinnamon/desktop/interface/gtk-theme
+    value: "'{{ cinnamon_theme_gtk }}'"
+  - key: /org/cinnamon/desktop/interface/icon-theme
+    value: "'{{ cinnamon_theme_icons }}'"
+  - key: /org/cinnamon/desktop/interface/font-name
+    value: "'{{ cinnamon_font_ui }}'"
+  - key: /org/cinnamon/desktop/interface/monospace-font-name
+    value: "'{{ cinnamon_font_monospace }}'"
+  - key: /org/cinnamon/desktop/interface/clock-use-24h
+    value: "true"
+  - key: /org/cinnamon/desktop/wm/preferences/button-layout
+    value: "'menu:minimize,maximize,close'"

ansible/inventory/group_vars/desktop_gnome.yml

@@ -0,0 +1,84 @@
+---
+desktop_profile: gnome
+desktop_environment: gnome
+desktop_sessions_enabled: []
+desktop_default_session: gnome
+
+# Fedora Workstation/GNOME desktop applications. Keep this profile separate from
+# workstation_* so nymph can remain a desktop laptop rather than a dev workstation.
+fedora_desktop_packages:
+  # Fedora equivalents of the development/tooling packages previously pulled by
+  # the Void desktop profile.
+  - 7zip
+  - nodejs-bash-language-server
+  - bluez
+  - bridge-utils
+  - cmake
+  - cscope
+  - ctags
+  - delve
+  - dnsmasq
+  - fastfetch
+  - poppler-glib
+  - poppler-utils
+  - fontconfig-devel
+  - freetype-devel
+  - gh
+  - golang
+  - golangci-lint
+  - gopls
+  - hunspell
+  - libvirt
+  - libreoffice
+  - liberation-fonts
+  - libasan
+  - libvterm-devel
+  - libX11-devel
+  - libXft-devel
+  - meld
+  - mpv
+  - pdfarranger
+  - pinentry-gnome3
+  - plocate
+  - playerctl
+  - podman-compose
+  - qemu
+  - qemu-img
+  - qemu-tools
+  - rclone
+  - remmina
+  - ruff
+  - rustup
+  - rsync
+  - shfmt
+  - syncthing
+  - tealdeer
+  - terminus-fonts
+  - texlive
+  - tmux
+  - wl-clipboard
+  - ty
+  - uv
+  - valgrind
+  - virt-manager
+  - virt-install
+  - wireplumber
+  - yt-dlp
+  - zstd
+
+fedora_nerd_fonts_version: v3.3.0
+fedora_nerd_fonts:
+  - Hack
+  - JetBrainsMono
+  - Iosevka
+  - UbuntuSans
+  - NerdFontsSymbolsOnly
+
+fedora_flatpak_packages:
+  - be.alexandervanhee.gradia
+  - ch.protonmail.protonmail-bridge
+  - com.spotify.Client
+  - org.mozilla.thunderbird
+  - org.telegram.desktop
+
+fedora_npm_packages: "{{ ai_agents_npm_packages }}"

ansible/inventory/group_vars/desktop_hyprland.yml

@@ -0,0 +1,3 @@
+---
+desktop_profile: hyprland
+desktop_default_session: hyprland

ansible/inventory/group_vars/desktop_niri.yml

@@ -0,0 +1,5 @@
+---
+desktop_profile: niri
+desktop_sessions_enabled:
+  - niri
+desktop_default_session: niri

ansible/inventory/group_vars/desktop_sway.yml

@@ -0,0 +1,2 @@
+---
+desktop_profile: sway

ansible/inventory/group_vars/fedora.yml

@@ -27,7 +27,6 @@ fedora_docker_packages:
   - docker-compose-plugin
 
 enabled_services:
-  - docker
   - firewalld
 
 fedora_dotfiles:
@@ -64,8 +63,11 @@ workstation_host_linux_packages_fedora:
   - rclone
   - yubikey-manager
 
-workstation_flatpak_remote_name: flathub
-workstation_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
+fedora_flatpak_remote_name: flathub
+fedora_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
+
+workstation_flatpak_remote_name: "{{ fedora_flatpak_remote_name }}"
+workstation_flatpak_remote_url: "{{ fedora_flatpak_remote_url }}"
 workstation_flatpak_packages:
   - com.getpostman.Postman
   - com.spotify.Client

ansible/inventory/group_vars/graphical_desktop.yml

@@ -0,0 +1,3 @@
+---
+host_capabilities:
+  - graphical_desktop

ansible/inventory/group_vars/platform_fedora.yml

@@ -0,0 +1,5 @@
+---
+platform_profile: fedora
+platform_family: redhat
+platform_package_manager: dnf
+platform_service_manager: systemd

ansible/inventory/group_vars/platform_freebsd.yml

@@ -0,0 +1,121 @@
+---
+platform_profile: freebsd
+platform_family: freebsd
+platform_package_manager: pkg
+platform_service_manager: rc
+ansible_python_interpreter: /usr/local/bin/python3
+
+vim_plugin_distro_packages:
+  - fzf
+vim_plugin_source_plugins:
+  - name: fzf
+    repo: https://github.com/junegunn/fzf.git
+    version: v0.72.0
+  - name: fzf.vim
+    repo: https://github.com/junegunn/fzf.vim.git
+    version: 34a564c81f36047f50e593c1656f4580ff75ccca
+  - name: vim-fugitive
+    repo: https://github.com/tpope/vim-fugitive.git
+    version: 3b753cf8c6a4dcde6edee8827d464ba9b8c4a6f0
+
+effective_user_group: "{{ user_group }}"
+effective_user_home: "/home/{{ effective_username }}"
+user_home: "/home/{{ username }}"
+
+freebsd_packages_base:
+  - bash
+  - bash-completion
+  - bat
+  - curl
+  - fzf
+  - git
+  - jq
+  - python3
+  - ripgrep
+  - rsync
+  - tmux
+  - tree
+  - unzip
+  - vim
+  - wget
+  - zip
+  - zoxide
+
+freebsd_development_packages:
+  - clang
+  - cmake
+  - gdb
+  - go
+  - gmake
+  - node
+  - npm
+  - pkgconf
+  - py311-pip
+  - rust
+  - shellcheck
+
+freebsd_desktop_common_packages:
+  - dbus
+  - dconf
+  - firefox
+  - fontconfig
+  - gnome-keyring
+  - libsecret
+  - mpv
+  - pinentry-gnome
+  - pipewire
+  - polkit
+  - thunderbird
+  - wireplumber
+  - xdg-desktop-portal
+
+freebsd_hyprland_packages:
+  - alacritty
+  - cliphist
+  - dunst
+  - foot
+  - grim
+  - hypridle
+  - hyprland
+  - hyprlock
+  - hyprpaper
+  - rofi-wayland
+  - seatd
+  - slurp
+  - waybar
+  - wl-clipboard
+  - xdg-desktop-portal-gtk
+  - xdg-desktop-portal-hyprland
+  - xwayland
+
+freebsd_niri_packages:
+  - cliphist
+  - dunst
+  - foot
+  - grim
+  - niri
+  - rofi-wayland
+  - seatd
+  - slurp
+  - waybar
+  - wl-clipboard
+  - xdg-desktop-portal-gtk
+
+freebsd_lab_packages:
+  - lldb
+  - llvm
+  - podman
+  - qemu
+  - smartmontools
+
+freebsd_rc_conf:
+  - name: dbus_enable
+    value: "YES"
+  - name: seatd_enable
+    value: "YES"
+
+freebsd_enabled_services:
+  - dbus
+  - seatd
+
+freebsd_xdg_config_dir: /usr/local/etc/xdg

ansible/inventory/group_vars/platform_mint.yml

@@ -0,0 +1,102 @@
+---
+platform_profile: mint
+platform_family: debian
+platform_package_manager: apt
+platform_service_manager: systemd
+
+# syncthing runs per-user via the packaged system unit template
+# (Debian/Mint ship syncthing@.service, parametrised by username).
+enabled_services:
+  - "syncthing@{{ username }}.service"
+
+mint_manage_flatpak: true
+mint_flatpak_remote_name: flathub
+mint_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
+
+mint_packages_base:
+  - ca-certificates
+  - curl
+  - flatpak
+  - gpg
+  - htop
+  - make
+  - python3-pip
+  - ripgrep
+  - rsync
+  - shellcheck
+
+mint_development_packages:
+  - build-essential
+  - clang
+  - clang-tools
+  - cmake
+  - gdb
+  - golang
+  - nodejs
+  - npm
+  - pkg-config
+  - python3-venv
+
+mint_desktop_common_packages:
+  - dconf-cli
+  - deja-dup
+  - firefox
+  - fonts-liberation
+  - fonts-noto-color-emoji
+  - git-delta
+  - gnome-keyring
+  - libsecret-tools
+  - mpv
+  - pinentry-gnome3
+  - pinentry-gtk2
+  - rclone
+  - syncthing
+  - thunderbird
+  - tmux
+  - xdg-user-dirs
+  - yt-dlp
+
+mint_emacs_packages:
+  - autoconf
+  - automake
+  - emacs
+  - hunspell
+  - hunspell-it
+  - libfreetype-dev
+  - libpoppler-glib-dev
+  - libpoppler-private-dev
+  - libtool-bin
+  - libvterm-dev
+  - libx11-dev
+
+mint_cinnamon_packages:
+  - cinnamon
+  - cinnamon-control-center
+  - cinnamon-screensaver
+  - lightdm
+  - slick-greeter
+  - xdg-desktop-portal
+  - xdg-desktop-portal-gtk
+
+mint_personal_workstation_packages:
+  - libreoffice
+  - meld
+  - pdfarranger
+  - vim
+
+mint_flatpak_packages:
+  - ch.protonmail.protonmail-bridge
+  - com.calibre_ebook.calibre
+  - com.spotify.Client
+  - org.telegram.desktop
+
+# Nerd Fonts referenced by the desktop configs deployed on Mint. Debian has no
+# equivalent of Void's nerd-fonts-ttf package, so they are fetched from the
+# upstream ryanoasis/nerd-fonts release.
+mint_nerd_fonts_version: v3.3.0
+mint_nerd_fonts:
+  - Hack
+  - JetBrainsMono
+  - Iosevka
+  - UbuntuSans
+  - NerdFontsSymbolsOnly

ansible/inventory/group_vars/platform_void.yml

@@ -0,0 +1,18 @@
+---
+platform_profile: void
+platform_family: void
+platform_package_manager: xbps
+platform_service_manager: runit
+
+vim_plugin_distro_packages:
+  - fzf
+vim_plugin_source_plugins:
+  - name: fzf
+    repo: https://github.com/junegunn/fzf.git
+    version: v0.72.0
+  - name: fzf.vim
+    repo: https://github.com/junegunn/fzf.vim.git
+    version: 34a564c81f36047f50e593c1656f4580ff75ccca
+  - name: vim-fugitive
+    repo: https://github.com/tpope/vim-fugitive.git
+    version: 3b753cf8c6a4dcde6edee8827d464ba9b8c4a6f0

ansible/inventory/group_vars/role_lab.yml

@@ -0,0 +1,11 @@
+---
+machine_role: lab
+role_profile: lab
+role_stability: experimental
+experimental_profile: true
+
+lab_workspace_directories:
+  - path: "{{ user_home }}/Lab"
+    mode: "0755"
+  - path: "{{ user_home }}/Scratch"
+    mode: "0755"

ansible/inventory/group_vars/role_personal_workstation.yml

@@ -0,0 +1,24 @@
+---
+machine_role: personal_workstation
+role_profile: personal_workstation
+role_stability: stable
+
+personal_workstation_directories:
+  - path: "{{ user_home }}/Documents"
+    mode: "0755"
+  - path: "{{ user_home }}/Downloads"
+    mode: "0755"
+  - path: "{{ user_home }}/Org"
+    mode: "0755"
+  - path: "{{ user_home }}/Remotes"
+    mode: "0755"
+
+personal_workstation_dotfiles:
+  - src: .gitignore_global
+    dest: .gitignore_global
+    mode: "0644"
+  - src: .themes.gitignore
+    dest: .themes.gitignore
+    mode: "0644"
+
+personal_workstation_flatpak_packages: []

ansible/inventory/group_vars/server.yml

@@ -7,6 +7,7 @@ effective_user_group: "{{ server_user_group }}"
 effective_user_home: "{{ server_user_home }}"
 server_container_stack_dir: /opt/docker/server
 ai_agents_enabled: false
+vim_plugins_enabled: false
 
 profile_packages:
   - avahi-daemon

ansible/inventory/group_vars/void.yml

@@ -1,10 +1,7 @@
 ---
-desktop_void_source_tools:
-  - name: st
-    repo: https://codeberg.org/fscotto/st
-    build_cmd: make
-    binary_name: st
-    install_name: st
+void_xbps_repositories:
+  - name: hyprland-void
+    url: https://raw.githubusercontent.com/sofijacom/hyprland-void/repository-x86_64-glibc
 
 void_packages_base:
   - 7zip
@@ -18,6 +15,7 @@ void_packages_base:
   - elogind
   - fastfetch
   - fuse3
+  - fuse-sshfs
   - gcc
   - gdb
   - gist
@@ -25,7 +23,6 @@ void_packages_base:
   - go
   - hugo
   - ImageMagick
-  - isync
   - libtool
   - linux
   - linux-headers
@@ -35,8 +32,6 @@ void_packages_base:
   - lm_sensors
   - man-pages-devel
   - man-pages-posix
-  - msmtp
-  - mu4e
   - nodejs
   - ntfs-3g
   - pipewire
@@ -66,7 +61,6 @@ enabled_services:
   - cupsd
   - dbus
   - elogind
-  - emptty
   - libvirtd
   - nanoklogd
   - socklog-unix
@@ -101,57 +95,89 @@ desktop_void_dotfiles:
     mode: "0755"
 
 desktop_common_packages:
-  - blueman
-  - brightnessctl
   - cups
   - cups-filters
   - cups-pk-helper
-  - dex
-  - emptty
   - flatpak
-  - gnome-keyring
-  - gvfs
   - libsecret
-  - network-manager-applet
-  - pavucontrol
-  - pinentry-emacs
-  - pinentry-gtk
   - sane
   - sane-airscan
+  - turnstile
+  - xdg-desktop-portal
+  - xdg-user-dirs
+
+desktop_emacs_packages:
+  - pinentry-emacs
+
+desktop_minimal_packages:
+  - alacritty
+  - blueman
+  - brightnessctl
+  - dex
+  - emptty
+  - exo
+  - ffmpegthumbnailer
+  - gnome-keyring
+  - gvfs
+  - gvfs-cdda
+  - gvfs-mtp
+  - gvfs-smb
+  - network-manager-applet
+  - pavucontrol
+  - pinentry-gtk
+  - ristretto
   - seahorse
+  - shotwell
   - simple-scan
   - system-config-printer
-  - turnstile
+  - Thunar
+  - thunar-archive-plugin
+  - thunar-volman
+  - tumbler
   - udiskie
-  - xdg-desktop-portal
+  - xarchiver
   - xdg-desktop-portal-gtk
-  - xdg-user-dirs
   - xfce-polkit
+  - xournalpp
 
-desktop_i3_packages:
-  - arandr
-  - autorandr
-  - feh
-  - i3
-  - i3blocks
-  - i3blocks-blocklets
-  - i3lock-color
-  - i3status
-  - dunst
-  - picom
-  - polybar
-  - rofi
-  - scrot
-  - setxkbmap
-  - volumeicon
-  - xclip
+desktop_kde_packages:
+  - ark
+  - dolphin
+  - ffmpegthumbs
+  - gwenview
+  - kate
+  - kde-plasma
+  - kleopatra
+  - konsole
+  - okular
+  - polkit-kde-agent
+  - print-manager
+  - sddm
+  - skanpage
+  - spectacle
+
+desktop_xfce_packages:
+  - blueman
+  - gnome-keyring
+  - greybird-themes
+  - gvfs
+  - gvfs-cdda
+  - gvfs-mtp
+  - gvfs-smb
+  - lightdm
+  - lightdm-gtk-greeter
+  - network-manager-applet
+  - papirus-icon-theme
+  - seahorse
+  - thunar-archive-plugin
+  - xarchiver
+  - xdg-desktop-portal-gtk
+  - xfce4
   - xfce4-clipman-plugin
+  - xfce4-pulseaudio-plugin
   - xfce4-screenshooter
-  - xkbutils
-  - xorg-fonts
-  - xorg-minimal
-  - xss-lock
-  - xdotool
+  - xfce4-whiskermenu-plugin
+  - xorg
 
 desktop_sway_packages:
   - cliphist
@@ -159,6 +185,7 @@ desktop_sway_packages:
   - flameshot
   - foot
   - foot-terminfo
+  - gtklock
   - grim
   - kanshi
   - rofi
@@ -166,7 +193,6 @@ desktop_sway_packages:
   - swayfx
   - swaybg
   - swayidle
-  - swaylock
   - SwayOSD
   - Waybar
   - wl-clipboard
@@ -174,24 +200,66 @@ desktop_sway_packages:
   - xdg-desktop-portal-wlr
   - xorg-server-xwayland
 
+desktop_hyprland_packages:
+  - cliphist
+  - dunst
+  - foot
+  - foot-terminfo
+  - grim
+  - hypridle
+  - hyprland
+  - hyprland-guiutils
+  - hyprlock
+  - hyprpolkitagent
+  - hyprpaper
+  - hyprsysteminfo
+  - rofi
+  - slurp
+  - SwayOSD
+  - Waybar
+  - wl-clipboard
+  - xdg-desktop-portal-hyprland
+  - xorg-server-xwayland
+
+desktop_niri_packages:
+  - cliphist
+  - dunst
+  - foot
+  - foot-terminfo
+  - gtklock
+  - grim
+  - niri
+  - rofi
+  - slurp
+  - SwayOSD
+  - Waybar
+  - wl-clipboard
+  - xdg-desktop-portal-gtk
+  - xorg-server-xwayland
+
+void_lab_packages:
+  - llvm
+  - podman
+  - qemu
+  - smartmontools
+
 profile_packages:
-  - alacritty
+  - bash-language-server
   - bluez
   - bridge-utils
   - ctags
   - firefox
   - deluge-gtk
+  - delve
   - dnsmasq
-  - emacs-gtk3
   - poppler-glib
   - poppler-utils
-  - exo
   - fontconfig-devel
   - freetype-devel
-  - gvfs-cdda
-  - gvfs-mtp
-  - gvfs-smb
   - gufw
+  - golangci-lint
+  - gopls
+  - hunspell
   - libvirt
   - libspa-bluetooth
   - libreoffice
@@ -212,24 +280,19 @@ profile_packages:
   - remmina
   - ripgrep
   - rustup
-  - ristretto
   - rsync
-  - shotwell
+  - shfmt
   - ruff
   - terminus-font
   - texlive
   - ty
-  - tumbler
   - uv
-  - Thunar
-  - thunar-archive-plugin
-  - thunar-volman
-  - ffmpegthumbnailer
   - virt-manager
   - virt-manager-tools
   - wireplumber
-  - xarchiver
-  - xournalpp
   - yaru
   - yaru-plus
   - zstd
+
+profile_emacs_packages:
+  - emacs-pgtk

ansible/inventory/group_vars/workstation.yml

@@ -1,4 +1,5 @@
 ---
 workstation_manage_opencode: true
-
+workstation_manage_ibm_bob: true
+workstation_ibm_bob_install_url: "https://bob.ibm.com/download/bobshell.sh"
 workstation_npm_packages: "{{ ai_agents_npm_packages + [] }}"

ansible/inventory/group_vars/workstation_dev_wsl.yml

@@ -3,9 +3,12 @@ enabled_services:
   - docker
 
 workstation_dev_wsl_packages:
+  - lazygit
   - pinentry-curses
   - python3-pip
+  - tmux
 workstation_dev_wsl_excluded_packages:
+  - alacritty
   - pcscd
   - pinentry-gnome3
   - podman
@@ -16,11 +19,17 @@ workstation_is_wsl: true
 workstation_manage_google_chrome: false
 workstation_removed_snap_packages: []
 workstation_snap_packages: []
-workstation_dev_wsl_python_packages:
-  - pypsrp
-  - pyspnego
+workstation_dev_wsl_python_packages: []
 workstation_wsl_systemd_enabled: true
 workstation_dev_wsl_dotfiles:
   - src: .gnupg/gpg-agent.conf
     dest: .gnupg/gpg-agent.conf
     mode: "0600"
+  - src: .tmux.conf
+    dest: .tmux.conf
+    mode: "0644"
+    source_dir: desktop
+  - src: .tmux/bin/
+    dest: .tmux/bin/
+    mode: preserve
+    source_dir: desktop

ansible/inventory/group_vars/workstation_dev_wsl.yml.orig

@@ -0,0 +1,47 @@
+---
+enabled_services:
+  - docker
+
+workstation_dev_wsl_packages:
+  - lazygit
+  - pinentry-curses
+  - python3-pip
+workstation_dev_wsl_excluded_packages:
+  - alacritty
+  - pcscd
+  - pinentry-gnome3
+  - podman
+  - podman-compose
+  - ufw
+  - yubikey-manager
+workstation_is_wsl: true
+workstation_manage_google_chrome: false
+<<<<<<< HEAD
+workstation_removed_snap_packages: []
+workstation_snap_packages:
+  - name: glab
+    classic: true
+workstation_dev_wsl_python_packages: []
+||||||| parent of cb83ed1 (Update gitconfig on WSL)
+workstation_removed_snap_packages: []
+workstation_snap_packages:
+  - name: glab
+    classic: true
+workstation_dev_wsl_python_packages:
+  - pypsrp
+  - pyspnego
+=======
+workstation_manage_glab: true
+workstation_glab_version: "1.103.0"
+workstation_removed_snap_packages:
+  - glab
+workstation_snap_packages: []
+workstation_dev_wsl_python_packages:
+  - pypsrp
+  - pyspnego
+>>>>>>> cb83ed1 (Update gitconfig on WSL)
+workstation_wsl_systemd_enabled: true
+workstation_dev_wsl_dotfiles:
+  - src: .gnupg/gpg-agent.conf
+    dest: .gnupg/gpg-agent.conf
+    mode: "0600"

ansible/inventory/group_vars/workstation_host_windows.yml

@@ -1,71 +0,0 @@
----
-ansible_connection: psrp
-ansible_psrp_auth: negotiate
-ansible_psrp_cert_validation: ignore
-ansible_psrp_protocol: https
-ansible_port: 5986
-ansible_shell_type: powershell
-
-windows_enable_dark_theme: true
-windows_hide_taskbar_search: true
-windows_hide_taskbar_widgets: true
-windows_terminal_default_profile_name: Ubuntu
-windows_taskbar_layout_directory: 'C:\ProgramData\Infra\Windows'
-windows_taskbar_layout_path: '{{ windows_taskbar_layout_directory }}\taskbar-layout.xml'
-windows_taskbar_reapply_every_logon: false
-
-windows_taskbar_pins:
-  - type: desktop_application_id
-    id: Chrome
-  - type: desktop_application_id
-    id: Microsoft.Windows.Explorer
-  - type: app_user_model_id
-    id: Microsoft.OutlookForWindows_8wekyb3d8bbwe!Microsoft.OutlookforWindows
-  - type: app_user_model_id
-    id: MSTeams_8wekyb3d8bbwe!MSTeams
-  - type: app_user_model_id
-    id: 5319275A.WhatsAppDesktop_cv1g1gvanyjgm!App
-  - type: desktop_application_id
-    id: Telegram.TelegramDesktop
-  - type: desktop_application_id
-    id: Microsoft.VisualStudioCode
-  - type: desktop_application_link_path
-    path: '%APPDATA%\Microsoft\Windows\Start Menu\Programs\JetBrains Toolbox\IntelliJ IDEA Ultimate.lnk'
-  - type: desktop_application_id
-    id: com.squirrel.Postman.Postman
-  - type: app_user_model_id
-    id: Microsoft.WindowsTerminal_8wekyb3d8bbwe!App
-  - type: desktop_application_link_path
-    path: '%APPDATA%\Microsoft\Windows\Start Menu\Programs\DBeaver Community\DBeaver.lnk'
-
-windows_winget_packages:
-  - id: 7zip.7zip
-    name: 7-Zip
-  - id: Adobe.Acrobat.Reader.64-bit
-    name: Adobe Acrobat Reader
-  - id: DBeaver.DBeaver.Community
-    name: DBeaver Community
-  - id: Google.Chrome
-    name: Google Chrome
-  - id: JetBrains.IntelliJIDEA.Ultimate
-    name: IntelliJ IDEA Ultimate
-  - id: Logitech.OptionsPlus
-    name: Logitech Options+
-  - id: Microsoft.VisualStudioCode
-    name: Visual Studio Code
-  - id: Microsoft.WindowsTerminal
-    name: Windows Terminal
-  - id: Postman.Postman
-    name: Postman
-  - id: Telegram.TelegramDesktop
-    name: Telegram Desktop
-  - id: 9NKSQGP7F2NH
-    name: WhatsApp
-    source: msstore
-
-windows_vscode_extensions:
-  - ms-vscode-remote.remote-containers
-  - ms-vscode-remote.remote-ssh
-  - ms-vscode-remote.remote-wsl
-
-windows_wsl_distribution_name: Ubuntu

ansible/inventory/host_vars/deadalus-fedora.yml

@@ -1,176 +0,0 @@
----
-hostname: deadalus-fedora
-
-host_packages: []
-host_enabled_services: []
-workstation_firewall_backend: firewalld
-
-workstation_host_vscode_extensions:
-  - ms-vscode-remote.remote-containers
-  - ms-vscode-remote.remote-ssh
-  - ms-azuretools.vscode-docker
-  - redhat.vscode-yaml
-  - redhat.ansible
-
-workstation_gnome_managed_settings:
-  - schema: org.gnome.shell
-    key: favorite-apps
-    value: "['google-chrome.desktop', 'org.gnome.Nautilus.desktop', 'com.spotify.Client.desktop', 'org.mozilla.Thunderbird.desktop', 'org.telegram.desktop.desktop', 'code.desktop', 'intellij-idea-ultimate.desktop', 'io.dbeaver.DBeaverCommunity.desktop', 'com.getpostman.Postman.desktop', 'org.gnome.Ptyxis.desktop']"
-  - schema: org.gnome.shell
-    key: app-picker-layout
-    value: "[{'6f4bfcaf-700e-4fe3-8fd2-4a3e6fc46bcf': <{'position': <0>}>, 'System': <{'position': <1>}>, 'Utilities': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Weather.desktop': <{'position': <4>}>, 'org.gnome.clocks.desktop': <{'position': <5>}>, 'org.gnome.Maps.desktop': <{'position': <6>}>, 'org.gnome.SimpleScan.desktop': <{'position': <7>}>, 'org.gnome.Settings.desktop': <{'position': <8>}>, 'org.gnome.Boxes.desktop': <{'position': <9>}>, 'org.gnome.Showtime.desktop': <{'position': <10>}>, 'org.gnome.Snapshot.desktop': <{'position': <11>}>, 'org.gnome.Characters.desktop': <{'position': <12>}>, 'org.gnome.Calculator.desktop': <{'position': <13>}>, 'org.gnome.Calendar.desktop': <{'position': <14>}>, 'org.gnome.TextEditor.desktop': <{'position': <15>}>, 'org.gnome.Meld.desktop': <{'position': <16>}>, 'org.gnome.tweaks.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>}]"
-  - schema: org.gnome.desktop.input-sources
-    key: sources
-    value: "[('xkb', 'us')]"
-  - schema: org.gnome.desktop.interface
-    key: color-scheme
-    value: "'prefer-dark'"
-  - schema: org.gnome.desktop.privacy
-    key: report-technical-problems
-    value: "false"
-  - schema: org.gnome.desktop.wm.preferences
-    key: button-layout
-    value: "'appmenu:minimize,maximize,close'"
-  - schema: org.gnome.nautilus.preferences
-    key: click-policy
-    value: "'double'"
-  - schema: org.gnome.nautilus.preferences
-    key: date-time-format
-    value: "'simple'"
-  - schema: org.gnome.nautilus.preferences
-    key: default-folder-viewer
-    value: "'icon-view'"
-  - schema: org.gnome.nautilus.preferences
-    key: default-sort-order
-    value: "'name'"
-  - schema: org.gnome.nautilus.preferences
-    key: recursive-search
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: show-create-link
-    value: "true"
-  - schema: org.gnome.nautilus.preferences
-    key: show-delete-permanently
-    value: "true"
-  - schema: org.gnome.nautilus.preferences
-    key: show-directory-item-counts
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: show-hidden-files
-    value: "false"
-  - schema: org.gnome.nautilus.preferences
-    key: show-image-thumbnails
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: thumbnail-limit
-    value: "uint64 50"
-  - schema: org.gnome.nautilus.icon-view
-    key: captions
-    value: "['none', 'none', 'none']"
-  - schema: org.gnome.nautilus.icon-view
-    key: default-zoom-level
-    value: "'medium'"
-  - schema: org.gtk.Settings.FileChooser
-    key: clock-format
-    value: "'24h'"
-  - schema: org.gtk.Settings.FileChooser
-    key: date-format
-    value: "'regular'"
-  - schema: org.gtk.Settings.FileChooser
-    key: location-mode
-    value: "'path-bar'"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-hidden
-    value: "false"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-size-column
-    value: "true"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-type-column
-    value: "true"
-  - schema: org.gtk.Settings.FileChooser
-    key: sort-column
-    value: "'name'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: clock-format
-    value: "'24h'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: date-format
-    value: "'regular'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: location-mode
-    value: "'path-bar'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-hidden
-    value: "false"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-size-column
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-type-column
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-column
-    value: "'name'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-directories-first
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: auto-indent
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: highlight-matching-brackets
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: indent-style
-    value: "'tab'"
-  - schema: org.gnome.TextEditor
-    key: keybindings
-    value: "'default'"
-  - schema: org.gnome.TextEditor
-    key: restore-session
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: show-line-numbers
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: spellcheck
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: style-scheme
-    value: "'Adwaita'"
-  - schema: org.gnome.TextEditor
-    key: style-variant
-    value: "'follow'"
-  - schema: org.gnome.TextEditor
-    key: use-system-font
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: wrap-text
-    value: "true"
-  - schema: org.gnome.desktop.background
-    key: picture-uri
-    value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-l.jxl'"
-  - schema: org.gnome.desktop.background
-    key: picture-uri-dark
-    value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-d.jxl'"
-
-workstation_gnome_extension_dconf_settings:
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-radius-bottom
-    value: "15"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-radius-top
-    value: "15"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-size
-    value: "5"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: show-window-position-bar
-    value: "false"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: show-workspace-indicator
-    value: "false"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: window-gap
-    value: "10"

ansible/inventory/host_vars/deadalus-ubuntu.yml

@@ -1,319 +0,0 @@
----
-hostname: deadalus-ubuntu
-
-host_packages: []
-host_enabled_services: []
-
-workstation_host_vscode_extensions:
-  - ms-vscode-remote.remote-containers
-  - ms-vscode-remote.remote-ssh
-  - ms-azuretools.vscode-docker
-  - redhat.vscode-yaml
-  - redhat.ansible
-
-workstation_gnome_managed_settings:
-  - schema: org.gnome.shell
-    key: favorite-apps
-    value: "['google-chrome.desktop', 'org.gnome.Nautilus.desktop', 'spotify_spotify.desktop', 'thunderbird_thunderbird.desktop', 'telegram-desktop_telegram-desktop.desktop', 'code_code.desktop', 'intellij-idea-ultimate_intellij-idea-ultimate.desktop', 'dbeaver-ce_dbeaver-ce.desktop', 'postman_postman.desktop', 'org.gnome.Ptyxis.desktop']"
-  - schema: org.gnome.shell
-    key: app-picker-layout
-    value: "[{'Utilities': <{'position': <0>}>, 'System': <{'position': <1>}>, 'a3b499f3-e2cc-40ac-9145-7db9c827dff2': <{'position': <2>}>, 'org.gnome.Calculator.desktop': <{'position': <3>}>, 'com.mattjakeman.ExtensionManager.desktop': <{'position': <4>}>, 'org.gnome.clocks.desktop': <{'position': <5>}>, 'htop.desktop': <{'position': <6>}>, 'org.gnome.Characters.desktop': <{'position': <7>}>, 'gnome-language-selector.desktop': <{'position': <8>}>, 'org.gnome.Meld.desktop': <{'position': <9>}>, 'net.nokyan.Resources.desktop': <{'position': <10>}>, 'org.gnome.TextEditor.desktop': <{'position': <11>}>, 'org.gnome.tweaks.desktop': <{'position': <12>}>, 'vim.desktop': <{'position': <13>}>, 'snap-store_snap-store.desktop': <{'position': <14>}>, 'org.gnome.Yelp.desktop': <{'position': <15>}>}]"
-  - schema: org.gnome.desktop.app-folders
-    key: folder-children
-    value: "['System', 'Utilities', 'YaST', 'Pardus', 'a3b499f3-e2cc-40ac-9145-7db9c827dff2']"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/System/
-    key: name
-    value: "'X-GNOME-Shell-System.directory'"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/System/
-    key: translate
-    value: "true"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/System/
-    key: categories
-    value: "@as []"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/System/
-    key: apps
-    value: "['nm-connection-editor.desktop', 'org.gnome.baobab.desktop', 'org.gnome.DiskUtility.desktop', 'im-config.desktop', 'org.gnome.Logs.desktop', 'org.gnome.Sysprof.desktop', 'gufw.desktop', 'firmware-updater_firmware-updater.desktop', 'org.gnome.Settings.desktop', 'update-manager.desktop', 'desktop-security-center_desktop-security-center.desktop']"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/Utilities/
-    key: name
-    value: "'X-GNOME-Shell-Utilities.directory'"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/Utilities/
-    key: translate
-    value: "true"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/Utilities/
-    key: categories
-    value: "@as []"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/Utilities/
-    key: apps
-    value: "['org.gnome.Papers.desktop', 'org.gnome.font-viewer.desktop', 'org.gnome.Loupe.desktop', 'org.gnome.seahorse.Application.desktop']"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/YaST/
-    key: name
-    value: "'suse-yast.directory'"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/YaST/
-    key: translate
-    value: "true"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/YaST/
-    key: categories
-    value: "['X-SuSE-YaST']"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/YaST/
-    key: apps
-    value: "@as []"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/Pardus/
-    key: name
-    value: "'X-Pardus-Apps.directory'"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/Pardus/
-    key: translate
-    value: "true"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/Pardus/
-    key: categories
-    value: "['X-Pardus-Apps']"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/Pardus/
-    key: apps
-    value: "@as []"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/a3b499f3-e2cc-40ac-9145-7db9c827dff2/
-    key: name
-    value: "'Office'"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/a3b499f3-e2cc-40ac-9145-7db9c827dff2/
-    key: translate
-    value: "false"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/a3b499f3-e2cc-40ac-9145-7db9c827dff2/
-    key: categories
-    value: "@as []"
-  - schema: org.gnome.desktop.app-folders.folder
-    path: /org/gnome/desktop/app-folders/folders/a3b499f3-e2cc-40ac-9145-7db9c827dff2/
-    key: apps
-    value: "['libreoffice-calc.desktop', 'libreoffice-base.desktop', 'libreoffice-draw.desktop', 'libreoffice-impress.desktop', 'libreoffice-math.desktop', 'libreoffice-writer.desktop', 'xournalpp_xournalpp.desktop', 'libreoffice-startcenter.desktop', 'pdfarranger_pdfarranger.desktop']"
-  - schema: org.gnome.desktop.input-sources
-    key: sources
-    value: "[('xkb', 'us')]"
-  - schema: org.gnome.desktop.interface
-    key: accent-color
-    value: "'orange'"
-  - schema: org.gnome.desktop.interface
-    key: clock-format
-    value: "'24h'"
-  - schema: org.gnome.desktop.interface
-    key: clock-show-date
-    value: "true"
-  - schema: org.gnome.desktop.interface
-    key: color-scheme
-    value: "'prefer-dark'"
-  - schema: org.gnome.desktop.interface
-    key: cursor-theme
-    value: "'Adwaita'"
-  - schema: org.gnome.desktop.interface
-    key: document-font-name
-    value: "'Adwaita Sans 12'"
-  - schema: org.gnome.desktop.interface
-    key: font-name
-    value: "'Adwaita Sans 11'"
-  - schema: org.gnome.desktop.interface
-    key: gtk-theme
-    value: "'Yaru-dark'"
-  - schema: org.gnome.desktop.interface
-    key: icon-theme
-    value: "'Yaru-dark'"
-  - schema: org.gnome.desktop.interface
-    key: monospace-font-name
-    value: "'Ubuntu Sans Mono 11'"
-  - schema: org.gnome.desktop.interface
-    key: show-battery-percentage
-    value: "false"
-  - schema: org.gnome.desktop.interface
-    key: text-scaling-factor
-    value: "1.0"
-  - schema: org.gnome.desktop.privacy
-    key: report-technical-problems
-    value: "false"
-  - schema: org.gnome.desktop.wm.preferences
-    key: button-layout
-    value: "'appmenu:close'"
-  - schema: org.gnome.desktop.wm.preferences
-    key: focus-mode
-    value: "'click'"
-  - schema: org.gnome.desktop.wm.preferences
-    key: focus-new-windows
-    value: "'smart'"
-  - schema: org.gnome.desktop.wm.preferences
-    key: num-workspaces
-    value: "4"
-  - schema: org.gnome.nautilus.preferences
-    key: click-policy
-    value: "'double'"
-  - schema: org.gnome.nautilus.preferences
-    key: date-time-format
-    value: "'simple'"
-  - schema: org.gnome.nautilus.preferences
-    key: default-folder-viewer
-    value: "'icon-view'"
-  - schema: org.gnome.nautilus.preferences
-    key: default-sort-order
-    value: "'name'"
-  - schema: org.gnome.nautilus.preferences
-    key: recursive-search
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: show-create-link
-    value: "true"
-  - schema: org.gnome.nautilus.preferences
-    key: show-delete-permanently
-    value: "true"
-  - schema: org.gnome.nautilus.preferences
-    key: show-directory-item-counts
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: show-hidden-files
-    value: "false"
-  - schema: org.gnome.nautilus.preferences
-    key: show-image-thumbnails
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: thumbnail-limit
-    value: "uint64 50"
-  - schema: org.gnome.nautilus.icon-view
-    key: captions
-    value: "['none', 'none', 'none']"
-  - schema: org.gnome.nautilus.icon-view
-    key: default-zoom-level
-    value: "'medium'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: clock-format
-    value: "'24h'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: date-format
-    value: "'regular'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: location-mode
-    value: "'path-bar'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-hidden
-    value: "false"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-size-column
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-type-column
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-column
-    value: "'name'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-directories-first
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-order
-    value: "'ascending'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: startup-mode
-    value: "'recent'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: type-format
-    value: "'category'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: view-type
-    value: "'list'"
-  - schema: org.gnome.settings-daemon.plugins.color
-    key: night-light-schedule-automatic
-    value: "false"
-  - schema: org.gnome.settings-daemon.plugins.power
-    key: sleep-inactive-ac-timeout
-    value: "3600"
-  - schema: org.gnome.settings-daemon.plugins.power
-    key: sleep-inactive-ac-type
-    value: "'nothing'"
-  - schema: org.gnome.system.location
-    key: enabled
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: auto-indent
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: auto-save-delay
-    value: "uint32 3"
-  - schema: org.gnome.TextEditor
-    key: custom-font
-    value: "'Monospace 11'"
-  - schema: org.gnome.TextEditor
-    key: discover-settings
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: draw-spaces
-    value: "@as []"
-  - schema: org.gnome.TextEditor
-    key: enable-snippets
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: highlight-current-line
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: highlight-matching-brackets
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: indent-style
-    value: "'tab'"
-  - schema: org.gnome.TextEditor
-    key: indent-width
-    value: "-1"
-  - schema: org.gnome.TextEditor
-    key: keybindings
-    value: "'default'"
-  - schema: org.gnome.TextEditor
-    key: line-height
-    value: "1.2"
-  - schema: org.gnome.TextEditor
-    key: recolor-window
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: restore-session
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: right-margin-position
-    value: "uint32 80"
-  - schema: org.gnome.TextEditor
-    key: show-grid
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: show-line-numbers
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: show-map
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: show-right-margin
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: spellcheck
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: style-scheme
-    value: "'Adwaita'"
-  - schema: org.gnome.TextEditor
-    key: style-variant
-    value: "'follow'"
-  - schema: org.gnome.TextEditor
-    key: tab-width
-    value: "uint32 8"
-  - schema: org.gnome.TextEditor
-    key: use-system-font
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: wrap-text
-    value: "true"

ansible/inventory/host_vars/deadalus-win.yml

@@ -1,2 +0,0 @@
----
-hostname: deadalus-win

ansible/inventory/host_vars/ikaros.yml

@@ -1,26 +1,13 @@
 ---
 hostname: ikaros
 
-desktop_sessions_enabled:
-  - i3
-  - sway
-
-desktop_default_session: i3
-desktop_default_session_env: xorg
-
 host_packages:
-  - openssh
-  - mesa-dri
-  - vulkan-loader
-  - mesa-vulkan-radeon
-  - mesa-vaapi
-  - xf86-video-amdgpu
+  - openssh-clients
+  - openssh-server
+  - mesa-vulkan-drivers
 
-host_ufw_rules:
-  - rule: allow
-    port: "22"
-    proto: tcp
-    src: "192.168.0.0/24"
+host_firewalld_rich_rules:
+  - rule family="ipv4" source address="192.168.0.0/24" service name="ssh" accept
 
 host_sshd_settings:
   PermitRootLogin: "no"
@@ -33,10 +20,258 @@ host_sshd_allow_users:
 
 host_authorized_ssh_keys: "{{ vault_ikaros_authorized_ssh_keys | default([]) }}"
 
-host_i3_dotfiles:
-  - src: .config/autorandr/
-    dest: .config/autorandr/
-    mode: preserve
-
 host_enabled_services:
   - sshd
+
+# Host-local GNOME preferences captured from ikaros' live session. Keep these
+# here rather than in desktop_gnome so nymph remains unmanaged for GNOME
+# settings until it has its own real-use tuning.
+gnome_gsettings_settings:
+  - schema: org.gnome.GWeather4
+    key: temperature-unit
+    value: "'centigrade'"
+  - schema: org.gnome.Ptyxis
+    key: cursor-shape
+    value: "'block'"
+  - schema: org.gnome.Ptyxis
+    key: default-columns
+    value: "uint32 140"
+  - schema: org.gnome.Ptyxis
+    key: default-profile-uuid
+    value: "'caa3c49ba73a208b4c4b64b56a5cd0af'"
+  - schema: org.gnome.Ptyxis
+    key: default-rows
+    value: "uint32 35"
+  - schema: org.gnome.Ptyxis
+    key: font-name
+    value: "'JetBrainsMono Nerd Font 14'"
+  - schema: org.gnome.Ptyxis
+    key: new-tab-position
+    value: "'last'"
+  - schema: org.gnome.Ptyxis
+    key: profile-uuids
+    value: "['caa3c49ba73a208b4c4b64b56a5cd0af']"
+  - schema: org.gnome.Ptyxis
+    key: restore-session
+    value: "false"
+  - schema: org.gnome.Ptyxis
+    key: restore-window-size
+    value: "false"
+  - schema: org.gnome.Ptyxis
+    key: use-system-font
+    value: "false"
+  - schema: org.gnome.Ptyxis.Profile
+    path: /org/gnome/Ptyxis/Profiles/caa3c49ba73a208b4c4b64b56a5cd0af/
+    key: bold-is-bright
+    value: "true"
+  - schema: org.gnome.Ptyxis.Profile
+    path: /org/gnome/Ptyxis/Profiles/caa3c49ba73a208b4c4b64b56a5cd0af/
+    key: label
+    value: "'Default'"
+  - schema: org.gnome.Ptyxis.Profile
+    path: /org/gnome/Ptyxis/Profiles/caa3c49ba73a208b4c4b64b56a5cd0af/
+    key: palette
+    value: "'linux'"
+  - schema: org.gnome.Ptyxis.Profile
+    path: /org/gnome/Ptyxis/Profiles/caa3c49ba73a208b4c4b64b56a5cd0af/
+    key: scroll-on-output
+    value: "true"
+  - schema: org.gnome.TextEditor
+    key: highlight-current-line
+    value: "true"
+  - schema: org.gnome.TextEditor
+    key: indent-style
+    value: "'space'"
+  - schema: org.gnome.TextEditor
+    key: indent-width
+    value: "-1"
+  - schema: org.gnome.TextEditor
+    key: right-margin-position
+    value: "uint32 120"
+  - schema: org.gnome.TextEditor
+    key: show-line-numbers
+    value: "true"
+  - schema: org.gnome.TextEditor
+    key: show-right-margin
+    value: "true"
+  - schema: org.gnome.TextEditor
+    key: tab-width
+    value: "uint32 4"
+  - schema: org.gnome.desktop.background
+    key: picture-options
+    value: "'zoom'"
+  - schema: org.gnome.desktop.background
+    key: picture-uri
+    value: "'file:///usr/share/backgrounds/gnome/morphogenesis-l.svg'"
+  - schema: org.gnome.desktop.background
+    key: picture-uri-dark
+    value: "'file:///usr/share/backgrounds/gnome/morphogenesis-d.svg'"
+  - schema: org.gnome.desktop.datetime
+    key: automatic-timezone
+    value: "true"
+  - schema: org.gnome.desktop.input-sources
+    key: sources
+    value: "[('xkb', 'us+alt-intl')]"
+  - schema: org.gnome.desktop.interface
+    key: accent-color
+    value: "'blue'"
+  - schema: org.gnome.desktop.interface
+    key: color-scheme
+    value: "'prefer-dark'"
+  - schema: org.gnome.desktop.peripherals.touchpad
+    key: two-finger-scrolling-enabled
+    value: "true"
+  - schema: org.gnome.desktop.privacy
+    key: remove-old-temp-files
+    value: "true"
+  - schema: org.gnome.desktop.privacy
+    key: remove-old-trash-files
+    value: "true"
+  - schema: org.gnome.desktop.privacy
+    key: report-technical-problems
+    value: "false"
+  - schema: org.gnome.desktop.screensaver
+    key: picture-options
+    value: "'zoom'"
+  - schema: org.gnome.desktop.screensaver
+    key: picture-uri
+    value: "'file:///usr/share/backgrounds/gnome/morphogenesis-l.svg'"
+  - schema: org.gnome.desktop.search-providers
+    key: sort-order
+    value: "['org.gnome.Settings.desktop', 'org.gnome.Contacts.desktop', 'org.gnome.Nautilus.desktop']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-1
+    value: "['<Super>1']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-2
+    value: "['<Super>2']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-3
+    value: "['<Super>3']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-4
+    value: "['<Super>4']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-5
+    value: "['<Super>5']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-6
+    value: "['<Super>6']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-7
+    value: "['<Super>7']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-8
+    value: "['<Super>8']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-9
+    value: "['<Super>9']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-10
+    value: "['<Super>0']"
+  - schema: org.gnome.meld
+    key: highlight-current-line
+    value: "true"
+  - schema: org.gnome.meld
+    key: highlight-syntax
+    value: "true"
+  - schema: org.gnome.meld
+    key: indent-width
+    value: "4"
+  - schema: org.gnome.meld
+    key: insert-spaces-instead-of-tabs
+    value: "true"
+  - schema: org.gnome.meld
+    key: prefer-dark-theme
+    value: "true"
+  - schema: org.gnome.meld
+    key: show-line-numbers
+    value: "true"
+  - schema: org.gnome.meld
+    key: style-scheme
+    value: "'meld-dark'"
+  - schema: org.gnome.meld
+    key: wrap-mode
+    value: "'none'"
+  - schema: org.gnome.nautilus.list-view
+    key: default-zoom-level
+    value: "'large'"
+  - schema: org.gnome.nautilus.list-view
+    key: use-tree-view
+    value: "false"
+  - schema: org.gnome.nautilus.preferences
+    key: default-folder-viewer
+    value: "'list-view'"
+  - schema: org.gnome.nautilus.preferences
+    key: show-create-link
+    value: "true"
+  - schema: org.gnome.nautilus.preferences
+    key: show-delete-permanently
+    value: "true"
+  - schema: org.gnome.settings-daemon.plugins.color
+    key: night-light-enabled
+    value: "true"
+  - schema: org.gnome.settings-daemon.plugins.media-keys
+    key: custom-keybindings
+    value: "['/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/']"
+  - schema: org.gnome.settings-daemon.plugins.media-keys.custom-keybinding
+    path: /org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/
+    key: binding
+    value: "'<Super>Return'"
+  - schema: org.gnome.settings-daemon.plugins.media-keys.custom-keybinding
+    path: /org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/
+    key: command
+    value: "'ptyxis'"
+  - schema: org.gnome.settings-daemon.plugins.media-keys.custom-keybinding
+    path: /org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/
+    key: name
+    value: "'Launch Terminal'"
+  - schema: org.gnome.shell
+    key: app-picker-layout
+    value: >-
+      [{'org.fedoraproject.MediaWriter.desktop': <{'position': <0>}>, 'org.gnome.Contacts.desktop': <{'position': <1>}>, 'org.gnome.Weather.desktop': <{'position': <2>}>, 'org.gnome.clocks.desktop': <{'position': <3>}>, 'org.gnome.Maps.desktop': <{'position': <4>}>, 'org.gnome.SimpleScan.desktop': <{'position': <5>}>, 'org.gnome.Settings.desktop': <{'position': <6>}>, 'org.gnome.Boxes.desktop': <{'position': <7>}>, 'org.gnome.Showtime.desktop': <{'position': <8>}>, 'org.gnome.Snapshot.desktop': <{'position': <9>}>, 'org.gnome.Characters.desktop': <{'position': <10>}>, 'Utilities': <{'position': <11>}>, 'System': <{'position': <12>}>, 'org.gnome.Tour.desktop': <{'position': <13>}>, 'org.gnome.Yelp.desktop': <{'position': <14>}>, 'htop.desktop': <{'position': <15>}>, 'libreoffice-writer.desktop': <{'position': <16>}>, 'libreoffice-calc.desktop': <{'position': <17>}>, 'libreoffice-impress.desktop': <{'position': <18>}>, 'libreoffice-draw.desktop': <{'position': <19>}>, 'libreoffice-math.desktop': <{'position': <20>}>, 'libreoffice-base.desktop': <{'position': <21>}>, 'org.gnome.Meld.desktop': <{'position': <22>}>, 'mpv.desktop': <{'position': <23>}>}, {'com.github.jeromerobert.pdfarranger.desktop': <{'position': <0>}>, 'org.remmina.Remmina.desktop': <{'position': <1>}>, 'ch.protonmail.protonmail-bridge.desktop': <{'position': <2>}>, 'org.gnome.TextEditor.desktop': <{'position': <3>}>, 'org.gnome.Software.desktop': <{'position': <4>}>, 'org.gnome.Calculator.desktop': <{'position': <5>}>, 'org.gnome.Calendar.desktop': <{'position': <6>}>, 'com.mattjakeman.ExtensionManager.desktop': <{'position': <7>}>, 'be.alexandervanhee.gradia.desktop': <{'position': <8>}>, 'syncthing-start.desktop': <{'position': <9>}>, 'syncthing-ui.desktop': <{'position': <10>}>}]
+  - schema: org.gnome.shell
+    key: disabled-extensions
+    value: >-
+      ['window-list@gnome-shell-extensions.gcampax.github.com', 'background-logo@fedorahosted.org', 'apps-menu@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'maximize-new-windows@VitalyOstanin']
+  - schema: org.gnome.shell
+    key: enabled-extensions
+    value: >-
+      ['status-icons@gnome-shell-extensions.gcampax.github.com', 'gnome-ui-tune@itstime.tech', 'appindicatorsupport@rgcjonas.gmail.com', 'bluetooth-battery-monitor@v8v88v8v88.com', 'clipboard-indicator@tudmotu.com', 'status-area-horizontal-spacing@mathematical.coffee.gmail.com', 'MaximizeWindowIntoNewWorkspace@kyleross.com']
+  - schema: org.gnome.shell
+    key: favorite-apps
+    value: >-
+      ['org.gnome.Nautilus.desktop', 'org.mozilla.firefox.desktop', 'com.spotify.Client.desktop', 'org.mozilla.thunderbird.desktop', 'org.telegram.desktop.desktop', 'org.gnome.Ptyxis.desktop', 'virt-manager.desktop']
+  - schema: org.gnome.shell
+    key: remember-mount-password
+    value: "true"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-1
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-2
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-3
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-4
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-5
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-6
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-7
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-8
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-9
+    value: "@as []"
+  - schema: org.gnome.system.location
+    key: enabled
+    value: "true"

ansible/inventory/host_vars/nymph.yml

@@ -1,44 +1,8 @@
 ---
 hostname: nymph
 
-desktop_sessions_enabled:
-  - i3
-  - sway
-
-desktop_default_session: i3
-desktop_default_session_env: xorg
-desktop_emptty_session_error_logging: rotate
-
-host_packages:
-  - nvidia580
-  - linux-mainline-headers
-  - mesa-dri
-  - vulkan-loader
-  - mesa-vulkan-intel
-  - intel-video-accel
-  - power-profiles-daemon
-  - tlp
-  - tlp-rdw
-  - upower
-
-host_enabled_services:
-  - tlp
-
-host_i3_dotfiles:
-  - src: .config/autorandr/
-    dest: .config/autorandr/
-    mode: preserve
-  - src: .config/wireplumber/wireplumber.conf.d/60-camera-priority.conf
-    dest: .config/wireplumber/wireplumber.conf.d/60-camera-priority.conf
-    mode: "0644"
-
-host_sway_dotfiles:
-  - src: .config/sway/host.conf
-    dest: .config/sway/host.conf
-    mode: "0644"
-  - src: .config/sway/session-env
-    dest: .config/sway/session-env
-    mode: "0644"
-  - src: .config/kanshi/
-    dest: .config/kanshi/
-    mode: preserve
+# Fedora Workstation/GNOME laptop target. GNOME is provided by the base Fedora
+# Workstation install; Ansible deploys shared desktop dotfiles but leaves GNOME
+# settings unmanaged for now.
+host_packages: []
+host_enabled_services: []

ansible/inventory/hosts.yml

@@ -1,7 +1,31 @@
 ---
 all:
   children:
+    platform_void:
+      hosts: {}
+
+    platform_fedora:
+      hosts:
+        ikaros:
+          ansible_connection: local
+        nymph:
+          ansible_connection: local
+
+    platform_mint:
+      hosts: {}
+
+    platform_freebsd:
+      hosts: {}
+
     void:
+      children:
+        platform_void:
+
+    fedora:
+      children:
+        platform_fedora:
+
+    graphical_desktop:
       hosts:
         ikaros:
           ansible_connection: local
@@ -9,22 +33,41 @@ all:
           ansible_connection: local
 
     desktop:
+      children:
+        graphical_desktop:
+
+    role_personal_workstation:
+      hosts:
+        ikaros:
+          ansible_connection: local
+
+    role_lab:
+      hosts: {}
+
+    desktop_sway:
+      hosts: {}
+
+    desktop_hyprland:
+      hosts: {}
+
+    desktop_niri:
+      hosts: {}
+
+    desktop_gnome:
       hosts:
         ikaros:
           ansible_connection: local
         nymph:
           ansible_connection: local
 
+    desktop_cinnamon:
+      hosts: {}
+
     ubuntu:
       children:
-        ubuntu_workstation:
         workstation_dev_wsl:
         ubuntu_server:
 
-    fedora:
-      children:
-        fedora_workstation:
-
     workstation:
       children:
         workstation_host:
@@ -33,11 +76,9 @@ all:
     workstation_host:
       children:
         workstation_host_linux:
-        workstation_host_windows:
 
     workstation_dev:
       children:
-        workstation_dev_ubuntu:
         workstation_dev_fedora:
         workstation_dev_wsl:
 
@@ -45,36 +86,14 @@ all:
       children:
         ubuntu_server:
 
-    ubuntu_workstation:
-      hosts:
-        deadalus-ubuntu:
-          ansible_connection: local
-
     fedora_workstation:
-      hosts:
-        deadalus-fedora:
-          ansible_connection: local
+      hosts: {}
 
     workstation_host_linux:
-      hosts:
-        deadalus-ubuntu:
-          ansible_connection: local
-        deadalus-fedora:
-          ansible_connection: local
-
-    workstation_dev_ubuntu:
-      hosts:
-        deadalus-ubuntu:
-          ansible_connection: local
+      hosts: {}
 
     workstation_dev_fedora:
-      hosts:
-        deadalus-fedora:
-          ansible_connection: local
-
-    workstation_host_windows:
-      hosts:
-        deadalus-win:
+      hosts: {}
 
     workstation_dev_wsl:
       hosts:

ansible/roles/dotfiles_common/tasks/main.yml

@@ -50,6 +50,53 @@
   loop_control:
     label: "{{ item.dest }}"
 
+- name: Install distro packages for Vim plugins
+  tags: [packages, vim, fzf]
+  ansible.builtin.package:
+    name: "{{ vim_plugin_distro_packages | default([]) }}"
+    state: present
+  when:
+    - vim_plugins_enabled | default(false)
+    - (vim_plugin_distro_packages | default([])) | length > 0
+
+- name: Ensure git package is installed for source Vim plugins
+  tags: [packages, vim, fzf]
+  ansible.builtin.package:
+    name: git
+    state: present
+  when:
+    - vim_plugins_enabled | default(false)
+    - (vim_plugin_source_plugins | default([])) | length > 0
+
+- name: Ensure Vim plugin pack directory exists
+  tags: [dotfiles, dotfiles:common, vim, fzf]
+  ansible.builtin.file:
+    path: "{{ effective_user_home }}/.vim/pack/plugins/opt"
+    state: directory
+    owner: "{{ effective_username }}"
+    group: "{{ effective_user_group }}"
+    mode: "0755"
+  when:
+    - vim_plugins_enabled | default(false)
+    - (vim_plugin_source_plugins | default([])) | length > 0
+
+- name: Install source Vim plugins
+  tags: [dotfiles, dotfiles:common, vim, fzf]
+  ansible.builtin.git:
+    repo: "{{ item.repo }}"
+    dest: "{{ effective_user_home }}/.vim/pack/plugins/opt/{{ item.name }}"
+    version: "{{ item.version }}"
+    update: false
+  become_user: "{{ effective_username }}"
+  environment:
+    HOME: "{{ effective_user_home }}"
+  loop: "{{ vim_plugin_source_plugins | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when:
+    - vim_plugins_enabled | default(false)
+    - (vim_plugin_source_plugins | default([])) | length > 0
+
 - name: Ensure AI config directories exist
   tags: [dotfiles, dotfiles:common]
   ansible.builtin.file:

ansible/roles/packages_fedora/tasks/main.yml

@@ -26,7 +26,9 @@
     gpgcheck: true
     gpgkey: https://download.docker.com/linux/fedora/gpg
     state: present
-  when: fedora_manage_docker_repo | default(false)
+  when:
+    - "'workstation_dev_fedora' in group_names"
+    - fedora_manage_docker_repo | default(false)
 
 - name: Configure Google Chrome repository on Fedora
   tags: [packages]
@@ -82,14 +84,27 @@
         (
           (common_packages | default([]))
         + (fedora_packages_base | default([]))
-        + (fedora_docker_packages | default([]))
+        + (
+            (fedora_docker_packages | default([]))
+            if 'workstation_dev_fedora' in group_names
+            else []
+          )
         + (
             ['google-chrome-stable']
             if workstation_manage_google_chrome | default(false)
             else []
           )
         + (profile_packages | default([]))
-        + (fedora_workstation_dev_packages | default(workstation_dev_packages | default([])))
+        + (
+            (fedora_desktop_packages | default([]))
+            if 'graphical_desktop' in group_names
+            else []
+          )
+        + (
+            (fedora_workstation_dev_packages | default(workstation_dev_packages | default([])))
+            if 'workstation_dev_fedora' in group_names
+            else []
+          )
         + (
             (workstation_host_linux_packages_fedora | default(workstation_host_linux_packages | default([])))
             if 'workstation_host_linux' in group_names
@@ -115,25 +130,102 @@
     name: "{{ effective_username }}"
     groups: docker
     append: true
-  when: (fedora_docker_packages | default([])) | length > 0
+  when:
+    - "'workstation_dev_fedora' in group_names"
+    - (fedora_docker_packages | default([])) | length > 0
 
-- name: Ensure Flathub remote is configured for Fedora workstation
+- name: Install Fedora npm packages
+  tags: [packages, npm, ai_agents]
+  community.general.npm:
+    name: "{{ item.name }}"
+    global: true
+    state: "{{ item.state | default('present') }}"
+  loop: "{{ fedora_npm_packages | default([]) }}"
+  when: (fedora_npm_packages | default([])) | length > 0
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Define Fedora Flatpak applications
+  tags: [packages]
+  ansible.builtin.set_fact:
+    packages_fedora_flatpak_packages: >-
+      {{
+        (
+          (fedora_flatpak_packages | default([]))
+          + (host_flatpak_packages | default([]))
+          + (
+              (workstation_flatpak_packages | default([]))
+              if 'workstation_host_linux' in group_names
+              else []
+            )
+        )
+        | unique
+      }}
+
+- name: Ensure Flathub remote is configured on Fedora
   tags: [packages]
   community.general.flatpak_remote:
-    name: "{{ workstation_flatpak_remote_name | default('flathub') }}"
+    name: "{{ fedora_flatpak_remote_name | default('flathub') }}"
     state: present
-    flatpakrepo_url: "{{ workstation_flatpak_remote_url | default('https://dl.flathub.org/repo/flathub.flatpakrepo') }}"
-  when:
-    - "'workstation_host_linux' in group_names"
-    - (workstation_flatpak_packages | default([])) | length > 0
+    flatpakrepo_url: "{{ fedora_flatpak_remote_url | default('https://dl.flathub.org/repo/flathub.flatpakrepo') }}"
+  when: (packages_fedora_flatpak_packages | default([])) | length > 0
 
-- name: Install Fedora workstation Flatpak applications
+- name: Install Fedora Flatpak applications
   tags: [packages]
   community.general.flatpak:
-    name: "{{ workstation_flatpak_packages }}"
+    name: "{{ packages_fedora_flatpak_packages }}"
     state: present
-    remote: "{{ workstation_flatpak_remote_name | default('flathub') }}"
+    remote: "{{ fedora_flatpak_remote_name | default('flathub') }}"
     method: system
-  when:
-    - "'workstation_host_linux' in group_names"
-    - (workstation_flatpak_packages | default([])) | length > 0
+  when: (packages_fedora_flatpak_packages | default([])) | length > 0
+
+- name: Ensure Fedora Nerd Fonts base directory exists
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: /usr/local/share/fonts/nerd-fonts
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: (fedora_nerd_fonts | default([])) | length > 0
+
+- name: Ensure Fedora per-font Nerd Fonts directories exist
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+
+- name: Download Fedora Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.get_url:
+    url: "https://github.com/ryanoasis/nerd-fonts/releases/download/{{ fedora_nerd_fonts_version }}/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+
+- name: Extract Fedora Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.unarchive:
+    src: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    remote_src: true
+    owner: root
+    group: root
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  register: fedora_nerd_fonts_extract
+
+- name: Refresh system font cache after installing Fedora Nerd Fonts
+  tags: [packages, fonts]
+  ansible.builtin.command: fc-cache -f
+  changed_when: false
+  when: fedora_nerd_fonts_extract is changed

ansible/roles/packages_freebsd/tasks/main.yml

@@ -0,0 +1,34 @@
+---
+- name: Install packages on FreeBSD
+  tags: [packages]
+  community.general.pkgng:
+    name: >-
+      {{
+        (
+          (freebsd_packages_base | default([]))
+          + (freebsd_development_packages | default([]))
+          + (
+              (freebsd_desktop_common_packages | default([]))
+              if 'graphical_desktop' in group_names
+              else []
+            )
+          + (
+              (freebsd_hyprland_packages | default([]))
+              if 'desktop_hyprland' in group_names
+              else []
+            )
+          + (
+              (freebsd_niri_packages | default([]))
+              if 'desktop_niri' in group_names
+              else []
+            )
+          + (
+              (freebsd_lab_packages | default([]))
+              if 'role_lab' in group_names
+              else []
+            )
+          + (host_packages | default([]))
+        )
+        | unique
+      }}
+    state: present

ansible/roles/packages_mint/tasks/main.yml

@@ -0,0 +1,88 @@
+---
+- name: Refresh apt package cache on Linux Mint
+  tags: [packages]
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: Install packages on Linux Mint
+  tags: [packages]
+  ansible.builtin.apt:
+    name: >-
+      {{
+        (
+          (common_packages | default([]))
+          + (mint_packages_base | default([]))
+          + (mint_development_packages | default([]))
+          + (
+              (mint_desktop_common_packages | default([]))
+              if 'graphical_desktop' in group_names
+              else []
+            )
+          + (
+              (mint_emacs_packages | default([]))
+              if (
+                'graphical_desktop' in group_names
+                and (emacs_enabled | default(false) | bool)
+              )
+              else []
+            )
+          + (
+              (mint_cinnamon_packages | default([]))
+              if 'desktop_cinnamon' in group_names
+              else []
+            )
+          + (
+              (mint_personal_workstation_packages | default([]))
+              if 'role_personal_workstation' in group_names
+              else []
+            )
+          + (host_packages | default([]))
+        )
+        | unique
+      }}
+    state: present
+
+- name: Ensure Flathub remote is configured on Linux Mint
+  tags: [packages]
+  community.general.flatpak_remote:
+    name: "{{ mint_flatpak_remote_name | default('flathub') }}"
+    state: present
+    flatpakrepo_url: "{{ mint_flatpak_remote_url | default('https://dl.flathub.org/repo/flathub.flatpakrepo') }}"
+  when:
+    - mint_manage_flatpak | default(true)
+    - >-
+      (
+        (mint_flatpak_packages | default([]))
+        + (personal_workstation_flatpak_packages | default([]))
+      ) | length > 0
+
+- name: Install Linux Mint Flatpak applications
+  tags: [packages]
+  community.general.flatpak:
+    name: >-
+      {{
+        (
+          (mint_flatpak_packages | default([]))
+          + (
+              (personal_workstation_flatpak_packages | default([]))
+              if 'role_personal_workstation' in group_names
+              else []
+            )
+        )
+        | unique
+      }}
+    state: present
+    remote: "{{ mint_flatpak_remote_name | default('flathub') }}"
+    method: system
+  when:
+    - mint_manage_flatpak | default(true)
+    - >-
+      (
+        (mint_flatpak_packages | default([]))
+        + (
+            (personal_workstation_flatpak_packages | default([]))
+            if 'role_personal_workstation' in group_names
+            else []
+          )
+      ) | length > 0

ansible/roles/packages_ubuntu/tasks/main.yml

@@ -52,6 +52,39 @@
     - workstation_manage_google_chrome | default(false)
     - "'google-chrome-stable' not in (ansible_facts.packages | default({}))"
 
+- name: Download glab Debian package
+  tags: [packages]
+  ansible.builtin.get_url:
+    url: >-
+      https://gitlab.com/gitlab-org/cli/-/releases/v{{ workstation_glab_version }}/downloads/glab_{{ workstation_glab_version }}_linux_{{
+        'amd64' if ansible_facts['architecture'] == 'x86_64'
+        else 'arm64' if ansible_facts['architecture'] in ['aarch64', 'arm64']
+        else ansible_facts['architecture']
+      }}.deb
+    dest: "/tmp/glab_{{ workstation_glab_version }}.deb"
+    mode: "0644"
+  when:
+    - workstation_manage_glab | default(false)
+    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
+
+- name: Install glab from downloaded Debian package
+  tags: [packages]
+  ansible.builtin.apt:
+    deb: "/tmp/glab_{{ workstation_glab_version }}.deb"
+    state: present
+  when:
+    - workstation_manage_glab | default(false)
+    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
+
+- name: Remove downloaded glab Debian package
+  tags: [packages]
+  ansible.builtin.file:
+    path: "/tmp/glab_{{ workstation_glab_version }}.deb"
+    state: absent
+  when:
+    - workstation_manage_glab | default(false)
+    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
+
 - name: Ensure Docker apt keyrings directory exists
   tags: [packages]
   ansible.builtin.file:
@@ -115,11 +148,6 @@
             else []
           )
         + (desktop_common_packages | default([]))
-        + (
-            (desktop_i3_packages | default([]))
-            if 'i3' in (desktop_sessions_enabled | default([]))
-            else []
-          )
         + (host_packages | default([]))
         )
         | difference(

ansible/roles/packages_void/tasks/main.yml

@@ -5,9 +5,9 @@
     path: /etc/xbps.d
     state: directory
     mode: "0755"
-  when: (host_xbps_repositories | default([])) | length > 0
+  when: (void_xbps_repositories | default([]) + host_xbps_repositories | default([])) | length > 0
 
-- name: Configure host-specific XBPS repositories
+- name: Configure Void XBPS repositories
   tags: [packages]
   ansible.builtin.copy:
     dest: "/etc/xbps.d/{{ item.name }}.conf"
@@ -16,11 +16,11 @@
     owner: root
     group: root
     mode: "0644"
-  loop: "{{ host_xbps_repositories | default([]) }}"
+  loop: "{{ void_xbps_repositories | default([]) + host_xbps_repositories | default([]) }}"
   loop_control:
     label: "{{ item.name }}"
-  register: host_xbps_repository_configs
-  when: (host_xbps_repositories | default([])) | length > 0
+  register: packages_void_xbps_repository_configs
+  when: (void_xbps_repositories | default([]) + host_xbps_repositories | default([])) | length > 0
 
 - name: Install Void nonfree repository if needed
   tags: [packages]
@@ -28,7 +28,7 @@
     name: void-repo-nonfree
     state: present
     update_cache: false
-  register: void_nonfree_repository
+  register: packages_void_nonfree_repository
   when: "'void-repo-nonfree' in (host_packages | default([]) + void_packages_base | default([]))"
 
 - name: Refresh XBPS cache after configuring repositories
@@ -37,8 +37,8 @@
     update_cache: true
     accept_pubkey: true
   when: >-
-    (host_xbps_repositories | default([])) | length > 0
-    or (void_nonfree_repository is defined and void_nonfree_repository is changed)
+    (void_xbps_repositories | default([]) + host_xbps_repositories | default([])) | length > 0
+    or (packages_void_nonfree_repository is defined and packages_void_nonfree_repository is changed)
 
 - name: Synchronize and upgrade Void Linux packages
   tags: [packages]
@@ -46,6 +46,65 @@
     update_cache: false
     upgrade: true
 
+- name: Select packages for the configured desktop environment
+  tags: [packages]
+  ansible.builtin.set_fact:
+    packages_void_selected_desktop_packages: >-
+      {{
+        (
+          (desktop_minimal_packages | default([]))
+          if (desktop_environment | default('minimal')) == 'minimal'
+          else (
+            (desktop_xfce_packages | default([]))
+            if (desktop_environment | default('minimal')) == 'xfce'
+            else (desktop_kde_packages | default([]))
+          )
+        )
+        + (
+            (desktop_sway_packages | default([]))
+            if (
+              (desktop_environment | default('minimal')) == 'minimal'
+              and 'sway' in (desktop_sessions_enabled | default([]))
+            )
+            else []
+          )
+        + (
+            (desktop_hyprland_packages | default([]))
+            if (
+              (desktop_environment | default('minimal')) == 'minimal'
+              and 'hyprland' in (desktop_sessions_enabled | default([]))
+            )
+            else []
+          )
+        + (
+            (desktop_niri_packages | default([]))
+            if (
+              (desktop_environment | default('minimal')) == 'minimal'
+              and 'niri' in (desktop_sessions_enabled | default([]))
+            )
+            else []
+          )
+        | unique
+      }}
+
+- name: Calculate packages owned only by inactive desktop environments
+  tags: [packages]
+  ansible.builtin.set_fact:
+    packages_void_inactive_desktop_packages: >-
+      {{
+        (
+          (desktop_minimal_packages | default([]))
+          + (desktop_sway_packages | default([]))
+          + (desktop_hyprland_packages | default([]))
+          + (desktop_niri_packages | default([]))
+          + (desktop_xfce_packages | default([]))
+          + (desktop_kde_packages | default([]))
+        )
+        | unique
+        | difference(packages_void_selected_desktop_packages)
+        | difference(desktop_display_manager_by_environment.values() | list)
+      }}
+
 - name: Install packages on Void Linux
   tags: [packages]
   community.general.xbps:
@@ -55,17 +114,11 @@
           (common_packages | default([]))
         + (void_packages_base | default([]))
         + (profile_packages | default([]))
+        + ((profile_emacs_packages | default([])) if (emacs_enabled | default(false) | bool) else [])
         + (desktop_common_packages | default([]))
-        + (
-            (desktop_i3_packages | default([]))
-            if 'i3' in (desktop_sessions_enabled | default([]))
-            else []
-          )
-        + (
-            (desktop_sway_packages | default([]))
-            if 'sway' in (desktop_sessions_enabled | default([]))
-            else []
-          )
+        + ((desktop_emacs_packages | default([])) if (emacs_enabled | default(false) | bool) else [])
+        + (packages_void_selected_desktop_packages | default([]))
+        + ((void_lab_packages | default([])) if 'role_lab' in group_names else [])
         + (host_packages | default([]))
         )
         | unique
@@ -73,6 +126,24 @@
     state: present
     update_cache: false
 
+- name: Check whether the selected display manager is active
+  tags: [packages, display-manager]
+  ansible.builtin.stat:
+    path: "/var/service/{{ desktop_display_manager_by_environment[desktop_environment | default('minimal')] }}"
+  register: packages_void_selected_display_manager
+
+- name: Remove packages managed by the inactive desktop environment
+  tags: [packages]
+  community.general.xbps:
+    name: "{{ packages_void_inactive_desktop_packages }}"
+    state: absent
+    update_cache: false
+  when:
+    - (packages_void_inactive_desktop_packages | default([])) | length > 0
+    - >-
+      packages_void_selected_display_manager.stat.exists
+      or (desktop_allow_display_manager_switch | default(false))
+
 - name: Remove host-absent packages on Void Linux
   tags: [packages]
   community.general.xbps:

ansible/roles/profile_desktop_cinnamon/tasks/main.yml

@@ -0,0 +1,229 @@
+---
+- name: Ensure Cinnamon user config directories exist
+  tags: [dotfiles, dotfiles:desktop, cinnamon]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config"
+    - "{{ user_home }}/.local"
+    - "{{ user_home }}/.local/share"
+    - "{{ user_home }}/.local/bin"
+    - "{{ user_home }}/.local/state"
+    - "{{ user_home }}/.bashrc.d"
+    - "{{ user_home }}/.tmux"
+    - "{{ user_home }}/.tmux/bin"
+    - "{{ user_home }}/.tmux/plugins"
+
+- name: Apply Cinnamon dconf settings
+  tags: [cinnamon]
+  community.general.dconf:
+    key: "{{ item.key }}"
+    value: "{{ item.value }}"
+    state: present
+  become: true
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  loop: "{{ cinnamon_dconf_settings | default([]) }}"
+  loop_control:
+    label: "{{ item.key }}"
+
+- name: Ensure Emacs config directory exists
+  tags: [dotfiles, dotfiles:desktop, emacs]
+  ansible.builtin.file:
+    path: "{{ user_home }}/.emacs.d"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  when: emacs_enabled | default(false) | bool
+
+- name: Ensure GnuPG directory exists
+  tags: [dotfiles, dotfiles:desktop, git]
+  ansible.builtin.file:
+    path: "{{ user_home }}/.gnupg"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0700"
+
+- name: Ensure private user directories exist
+  tags: [dotfiles, dotfiles:desktop]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0700"
+  loop:
+    - "{{ user_home }}/.ssh"
+    - "{{ user_home }}/.local/state/ssh/sockets"
+
+- name: Copy Emacs desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, emacs]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_emacs_dotfiles | default([]) }}"
+  when: emacs_enabled | default(false) | bool
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Copy WM-agnostic common desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: >-
+    {{
+      desktop_common_dotfiles
+      | default([])
+      | rejectattr('name', 'in', cinnamon_desktop_dotfiles_exclude | default([]))
+      | list
+    }}
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Copy gpg-agent configuration
+  tags: [dotfiles, dotfiles:desktop, git]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/.gnupg/gpg-agent.conf"
+    dest: "{{ user_home }}/.gnupg/gpg-agent.conf"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+
+- name: Render git configuration with private values
+  tags: [dotfiles, dotfiles:desktop, git]
+  ansible.builtin.template:
+    src: desktop/.gitconfig.j2
+    dest: "{{ user_home }}/.gitconfig"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+
+- name: Bootstrap tmux plugin manager checkout
+  tags: [dotfiles, dotfiles:desktop, tmux]
+  ansible.builtin.git:
+    repo: https://github.com/tmux-plugins/tpm
+    dest: "{{ user_home }}/.tmux/plugins/tpm"
+    version: master
+    update: true
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+
+- name: Install tmux plugins through TPM
+  tags: [dotfiles, dotfiles:desktop, tmux]
+  ansible.builtin.command:
+    cmd: "{{ user_home }}/.tmux/plugins/tpm/bin/install_plugins"
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  register: cinnamon_tmux_plugin_install
+  changed_when: >-
+    (cinnamon_tmux_plugin_install.stdout | default('')) is search('download success') or
+    (cinnamon_tmux_plugin_install.stderr | default('')) is search('download success')
+
+- name: Install desktop npm packages
+  tags: [packages, npm]
+  community.general.npm:
+    name: "{{ item.name }}"
+    global: true
+    state: "{{ item.state | default('present') }}"
+  become: true
+  loop: "{{ desktop_npm_packages | default([]) }}"
+  when: desktop_npm_packages | length > 0
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Ensure /usr/src is writable for source builds
+  tags: [packages]
+  ansible.builtin.file:
+    path: /usr/src
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+
+- name: Build and install the gf debugger frontend from source
+  tags: [packages]
+  ansible.builtin.include_tasks:
+    file: "{{ role_path }}/../profile_desktop_common/tasks/source_tool.yml"
+    apply:
+      tags: [packages]
+  loop: >-
+    {{
+      desktop_source_tools
+      | default([])
+      | selectattr('name', 'equalto', 'gf')
+      | list
+    }}
+  loop_control:
+    loop_var: source_tool
+    label: "{{ source_tool.name }}"
+
+- name: Ensure Nerd Fonts base directory exists
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: /usr/local/share/fonts/nerd-fonts
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+
+- name: Ensure per-font Nerd Fonts directories exist
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+  loop: "{{ mint_nerd_fonts | default([]) }}"
+
+- name: Download Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.get_url:
+    url: "https://github.com/ryanoasis/nerd-fonts/releases/download/{{ mint_nerd_fonts_version }}/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  loop: "{{ mint_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+
+- name: Extract Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.unarchive:
+    src: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    remote_src: true
+    owner: root
+    group: root
+  become: true
+  loop: "{{ mint_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  register: cinnamon_nerd_fonts_extract
+
+- name: Refresh system font cache after installing Nerd Fonts
+  tags: [packages, fonts]
+  ansible.builtin.command: fc-cache -f
+  become: true
+  changed_when: false
+  when: cinnamon_nerd_fonts_extract is changed

ansible/roles/profile_desktop_common/tasks/main.yml

@@ -1,4 +1,22 @@
 ---
+- name: Validate desktop environment selection
+  tags: [always]
+  ansible.builtin.assert:
+    that:
+      - (desktop_environment | default('minimal')) in ['minimal', 'xfce', 'kde']
+      - >-
+        (desktop_environment | default('minimal')) != 'minimal'
+        or (desktop_sessions_enabled | default([]) | length > 0)
+      - >-
+        (desktop_environment | default('minimal')) != 'minimal'
+        or (desktop_sessions_enabled | default([]) | difference(['sway', 'hyprland', 'niri']) | length == 0)
+      - >-
+        (desktop_environment | default('minimal')) != 'minimal'
+        or desktop_default_session in (desktop_sessions_enabled | default([]))
+    fail_msg: >-
+      desktop_environment must be minimal, xfce, or kde. Minimal desktops also require
+      desktop_default_session to be included in desktop_sessions_enabled.
+
 - name: Configure elogind to suspend on lid close
   tags: [packages]
   ansible.builtin.lineinfile:
@@ -34,32 +52,33 @@
     group: "{{ user_group }}"
     mode: "0755"
 
-- name: Enable gnome-keyring PAM auth hook
+- name: Manage gnome-keyring PAM auth hook
   tags: [packages, gnome]
   ansible.builtin.lineinfile:
     path: /etc/pam.d/login
     insertafter: '^auth\s+include\s+system-local-login$'
     line: "auth       optional  pam_gnome_keyring.so"
-    state: present
+    state: "{{ 'present' if (desktop_environment | default('minimal')) == 'minimal' else 'absent' }}"
   when: "'void' in group_names"
 
-- name: Enable gnome-keyring PAM session hook
+- name: Manage gnome-keyring PAM session hook
   tags: [packages, gnome]
   ansible.builtin.lineinfile:
     path: /etc/pam.d/login
     insertafter: '^session\s+include\s+system-local-login$'
     line: "session    optional  pam_gnome_keyring.so auto_start"
-    state: present
+    state: "{{ 'present' if (desktop_environment | default('minimal')) == 'minimal' else 'absent' }}"
   when: "'void' in group_names"
 
-- name: Enable gnome-keyring PAM password hook
+- name: Manage gnome-keyring PAM password hook
   tags: [packages, gnome]
   ansible.builtin.lineinfile:
     path: /etc/pam.d/login
     insertafter: '^password\s+include\s+system-local-login$'
     line: "password   optional  pam_gnome_keyring.so use_authtok"
-    state: present
-  when: "'void' in group_names"
+    state: "{{ 'present' if (desktop_environment | default('minimal')) == 'minimal' else 'absent' }}"
+  when:
+    - "'void' in group_names"
 
 - name: Check whether SSH host ed25519 key exists
   tags: [services]
@@ -171,12 +190,27 @@
   loop: "{{ desktop_ufw_rules_effective }}"
   loop_control:
     label: "{{ item.name | default(item.port) }}"
+  when: workstation_firewall_backend | default('ufw') == 'ufw'
 
 - name: Enable UFW firewall on desktop when host rules are defined
   tags: [services, packages]
   community.general.ufw:
     state: enabled
-  when: (desktop_ufw_rules_effective | default([])) | length > 0
+  when:
+    - workstation_firewall_backend | default('ufw') == 'ufw'
+    - (desktop_ufw_rules_effective | default([])) | length > 0
+
+- name: Apply host firewalld rich rules on desktop
+  tags: [services, packages]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ host_firewalld_rich_rules | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when: workstation_firewall_backend | default('ufw') == 'firewalld'
 
 - name: Check whether libvirt service directory exists
   tags: [packages, services]
@@ -234,7 +268,9 @@
     owner: root
     group: root
     mode: "0755"
-  when: "'void' in group_names"
+  when:
+    - "'void' in group_names"
+    - (desktop_environment | default('minimal')) == 'minimal'
 
 - name: Ensure emptty session directories exist
   tags: [packages, services, emptty]
@@ -247,7 +283,9 @@
   loop:
     - /etc/emptty/xsessions
     - /etc/emptty/wayland-sessions
-  when: "'void' in group_names"
+  when:
+    - "'void' in group_names"
+    - (desktop_environment | default('minimal')) == 'minimal'
 
 - name: Configure emptty
   tags: [packages, services, emptty]
@@ -258,7 +296,9 @@
     group: root
     mode: "0644"
   notify: Restart emptty
-  when: "'void' in group_names"
+  when:
+    - "'void' in group_names"
+    - (desktop_environment | default('minimal')) == 'minimal'
 
 - name: Copy common desktop dotfiles
   tags: [dotfiles, dotfiles:desktop]
@@ -271,6 +311,11 @@
   loop: >-
     {{
       (desktop_common_dotfiles | default([]))
+      + (
+          (desktop_minimal_dotfiles | default([]))
+          if (desktop_environment | default('minimal')) == 'minimal'
+          else []
+        )
       + ((desktop_void_dotfiles | default([])) if 'void' in group_names else [])
     }}
   loop_control:
@@ -285,32 +330,18 @@
     group: "{{ user_group }}"
     mode: "{{ item.mode }}"
   loop: "{{ desktop_emacs_dotfiles | default([]) }}"
+  when: emacs_enabled | default(false) | bool
   loop_control:
     label: "{{ item.dest }}"
 
-- name: Render desktop templates with private values
-  tags: [dotfiles, dotfiles:desktop]
+- name: Render git configuration with private values
+  tags: [dotfiles, dotfiles:desktop, git]
   ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ user_home }}/{{ item.dest }}"
+    src: desktop/.gitconfig.j2
+    dest: "{{ user_home }}/.gitconfig"
     owner: "{{ username }}"
     group: "{{ user_group }}"
-    mode: "{{ item.mode }}"
-  loop:
-    - src: desktop/.gitconfig.j2
-      dest: .gitconfig
-      mode: "0644"
-    - src: desktop/.mbsyncrc.j2
-      dest: .mbsyncrc
-      mode: "0600"
-    - src: desktop/.msmtprc.j2
-      dest: .msmtprc
-      mode: "0600"
-    - src: desktop/email.el.j2
-      dest: .emacs.d/lisp/misc/email.el
-      mode: "0644"
-  loop_control:
-    label: "{{ item.dest }}"
+    mode: "0644"
 
 - name: Define managed tmux plugin directories
   tags: [dotfiles, dotfiles:desktop, tmux]
@@ -321,6 +352,7 @@
       - tmux-autoreload
       - tmux-resurrect
       - tmux-continuum
+      - tmux-yank
 
 - name: Check whether tmux plugin directories are git checkouts
   tags: [dotfiles, dotfiles:desktop, tmux]
@@ -421,19 +453,6 @@
     - path: /usr/src
       mode: "0755"
 
-- name: Ensure maildir directories exist
-  tags: [dotfiles, dotfiles:desktop]
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "0700"
-  loop:
-    - "{{ user_home }}/Maildir"
-    - "{{ user_home }}/Maildir/iCloudAccount"
-    - "{{ user_home }}/Maildir/ProtonMailAccount"
-
 - name: Make Qt apps follow the GTK theme
   tags: [theme]
   ansible.builtin.copy:
@@ -445,6 +464,14 @@
     owner: root
     group: root
     mode: "0644"
+  when: (desktop_environment | default('minimal')) in ['minimal', 'xfce']
+
+- name: Remove minimal Qt theme override for KDE
+  tags: [theme]
+  ansible.builtin.file:
+    path: /etc/profile.d/10-qt-theme.sh
+    state: absent
+  when: (desktop_environment | default('minimal')) == 'kde'
 
 - name: Ensure flathub remote is configured
   tags: [packages]
@@ -552,3 +579,21 @@
   when: desktop_npm_packages | length > 0
   loop_control:
     label: "{{ item.name }}"
+
+- name: Install desktop Python tools with uv
+  tags: [packages]
+  ansible.builtin.command:
+    cmd: "uv tool install --upgrade {{ item }}"
+  become: true
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  register: profile_desktop_common_uv_tool_install
+  changed_when: >-
+    (profile_desktop_common_uv_tool_install.stdout | default('')
+     + profile_desktop_common_uv_tool_install.stderr | default(''))
+    is regex('(?i)installed|updated')
+  loop: "{{ desktop_uv_tools | default([]) }}"
+  when: desktop_uv_tools | default([]) | length > 0
+  loop_control:
+    label: "{{ item }}"

ansible/roles/profile_desktop_gnome/handlers/main.yml

@@ -0,0 +1,16 @@
+---
+- name: Reload GNOME gpg-agent
+  ansible.builtin.command:
+    argv:
+      - gpgconf
+      - --kill
+      - gpg-agent
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  changed_when: false
+
+- name: Reload SSH service
+  ansible.builtin.systemd:
+    name: sshd
+    state: reloaded

ansible/roles/profile_desktop_gnome/tasks/main.yml

@@ -0,0 +1,238 @@
+---
+- name: Ensure GNOME desktop user config directories exist
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config"
+    - "{{ user_home }}/.config/autostart"
+    - "{{ user_home }}/.local"
+    - "{{ user_home }}/.local/bin"
+    - "{{ user_home }}/.bashrc.d"
+    - "{{ user_home }}/.tmux"
+    - "{{ user_home }}/.tmux/bin"
+    - "{{ user_home }}/.tmux/plugins"
+
+- name: Ensure GNOME desktop private directories exist
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - path: "{{ user_home }}/.gnupg"
+      mode: "0700"
+    - path: "{{ user_home }}/.ssh"
+      mode: "0700"
+    - path: "{{ user_home }}/.local/state/ssh/sockets"
+      mode: "0700"
+
+- name: Copy GNOME desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_common_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Copy GNOME Emacs desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, emacs, gnome]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_emacs_dotfiles | default([]) }}"
+  when: emacs_enabled | default(false) | bool
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Configure GNOME gpg-agent for Fedora
+  tags: [dotfiles, dotfiles:desktop, git, gnome]
+  ansible.builtin.copy:
+    dest: "{{ user_home }}/.gnupg/gpg-agent.conf"
+    content: |
+      pinentry-program /usr/bin/pinentry-gnome3
+      enable-ssh-support
+      default-cache-ttl 600
+      max-cache-ttl 7200
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+  notify: Reload GNOME gpg-agent
+
+- name: Render GNOME git configuration with private values
+  tags: [dotfiles, dotfiles:desktop, git, gnome]
+  ansible.builtin.template:
+    src: desktop/.gitconfig.j2
+    dest: "{{ user_home }}/.gitconfig"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+
+- name: Gather GNOME desktop user account data
+  tags: [gnome]
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ username }}"
+  when: (gnome_gsettings_settings | default([])) | length > 0
+
+- name: Set GNOME desktop session environment
+  tags: [gnome]
+  ansible.builtin.set_fact:
+    gnome_user_uid: "{{ ansible_facts.getent_passwd[username][1] }}"
+    gnome_gsettings_environment:
+      HOME: "{{ user_home }}"
+      XDG_RUNTIME_DIR: "/run/user/{{ ansible_facts.getent_passwd[username][1] }}"
+      DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ ansible_facts.getent_passwd[username][1] }}/bus"
+  when: (gnome_gsettings_settings | default([])) | length > 0
+
+- name: Read current GNOME managed settings
+  tags: [gnome]
+  ansible.builtin.command:
+    argv:
+      - gsettings
+      - get
+      - "{{ item.schema }}{{ ':' ~ item.path if item.path is defined else '' }}"
+      - "{{ item.key }}"
+  become_user: "{{ username }}"
+  environment: "{{ gnome_gsettings_environment }}"
+  loop: "{{ gnome_gsettings_settings | default([]) }}"
+  loop_control:
+    label: >-
+      {{ item.schema }}{{ ':' ~ item.path if item.path is defined else '' }} {{ item.key }}
+  register: gnome_gsettings_current
+  changed_when: false
+
+- name: Apply GNOME managed settings
+  tags: [gnome]
+  ansible.builtin.command:
+    argv:
+      - gsettings
+      - set
+      - "{{ item.item.schema }}{{ ':' ~ item.item.path if item.item.path is defined else '' }}"
+      - "{{ item.item.key }}"
+      - "{{ item.item.value }}"
+  become_user: "{{ username }}"
+  environment: "{{ gnome_gsettings_environment }}"
+  loop: "{{ gnome_gsettings_current.results | default([]) }}"
+  loop_control:
+    label: >-
+      {{ item.item.schema }}{{ ':' ~ item.item.path if item.item.path is defined else '' }} {{ item.item.key }}
+  changed_when: true
+  when: item.stdout | trim != item.item.value
+
+- name: Check whether SSH host ed25519 key exists on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.stat:
+    path: /etc/ssh/ssh_host_ed25519_key
+  register: gnome_ssh_host_ed25519_key
+  when:
+    - (host_sshd_settings | default({})) | length > 0
+      or (host_sshd_allow_users | default([])) | length > 0
+
+- name: Generate missing SSH host keys on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.command: ssh-keygen -A
+  changed_when: true
+  when:
+    - (host_sshd_settings | default({})) | length > 0
+      or (host_sshd_allow_users | default([])) | length > 0
+    - not gnome_ssh_host_ed25519_key.stat.exists
+
+- name: Define safe GNOME SSH daemon settings
+  tags: [services, gnome]
+  ansible.builtin.set_fact:
+    gnome_sshd_settings_effective: >-
+      {{
+        host_sshd_settings | default({})
+        if (
+          (host_authorized_ssh_keys | default([])) | length > 0
+          or (host_sshd_settings | default({})).PasswordAuthentication | default('yes') != 'no'
+        )
+        else (
+          host_sshd_settings | default({}) | dict2items
+          | rejectattr('key', 'in', ['PasswordAuthentication', 'KbdInteractiveAuthentication'])
+          | items2dict
+        )
+      }}
+
+- name: Warn when keeping SSH password authentication enabled on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.debug:
+    msg: >-
+      SSH password authentication hardening was skipped because no authorized SSH
+      keys are defined for this host. Set host_authorized_ssh_keys via vault
+      variables, then re-run the playbook to disable password authentication.
+  when:
+    - "'sshd' in (host_enabled_services | default([]))"
+    - (host_sshd_settings | default({})).PasswordAuthentication | default('yes') == 'no'
+    - (host_authorized_ssh_keys | default([])) | length == 0
+
+- name: Ensure GNOME desktop user authorized_keys file exists
+  tags: [services, dotfiles, gnome]
+  ansible.builtin.file:
+    path: "{{ user_home }}/.ssh/authorized_keys"
+    state: touch
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+  when: (host_authorized_ssh_keys | default([])) | length > 0
+
+- name: Manage GNOME desktop user authorized SSH keys exclusively
+  tags: [services, dotfiles, gnome]
+  ansible.posix.authorized_key:
+    user: "{{ username }}"
+    key: "{{ host_authorized_ssh_keys | join('\n') }}"
+    state: present
+    exclusive: true
+    manage_dir: false
+  when: (host_authorized_ssh_keys | default([])) | length > 0
+
+- name: Apply SSH daemon settings on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*{{ item.key }}\s+'
+    line: "{{ item.key }} {{ item.value }}"
+    state: present
+    validate: "sshd -t -f %s"
+  notify: Reload SSH service
+  loop: "{{ gnome_sshd_settings_effective | default({}) | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: (gnome_sshd_settings_effective | default({})) | length > 0
+
+- name: Restrict SSH login to allowed GNOME desktop users
+  tags: [services, gnome]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*AllowUsers\s+'
+    line: "AllowUsers {{ host_sshd_allow_users | join(' ') }}"
+    state: present
+    validate: "sshd -t -f %s"
+  notify: Reload SSH service
+  when: (host_sshd_allow_users | default([])) | length > 0
+
+- name: Apply host firewalld rich rules on GNOME desktop
+  tags: [services, packages, gnome]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ host_firewalld_rich_rules | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when: workstation_firewall_backend | default('firewalld') == 'firewalld'

ansible/roles/profile_desktop_host/tasks/main.yml

@@ -4,21 +4,6 @@
   ansible.builtin.include_tasks: nymph.yml
   when: hostname == 'nymph'
 
-- name: Copy host-specific i3 dotfiles
-  tags: [dotfiles, dotfiles:desktop, dotfiles:host, i3]
-  ansible.builtin.copy:
-    src: "{{ playbook_dir }}/../dotfiles/{{ hostname }}/{{ item.src }}"
-    dest: "{{ user_home }}/{{ item.dest }}"
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "{{ item.mode }}"
-  loop: "{{ host_i3_dotfiles | default([]) }}"
-  loop_control:
-    label: "{{ item.dest }}"
-  when:
-    - "'i3' in (desktop_sessions_enabled | default([]))"
-    - (host_i3_dotfiles | default([])) | length > 0
-
 - name: Copy host-specific sway dotfiles
   tags: [dotfiles, dotfiles:desktop, dotfiles:host, sway]
   ansible.builtin.copy:
@@ -31,6 +16,23 @@
   loop_control:
     label: "{{ item.dest }}"
   when:
+    - (desktop_environment | default('minimal')) == 'minimal'
     - "'sway' in (desktop_sessions_enabled | default([]))"
     - (host_sway_dotfiles | default([])) | length > 0
 
+
+- name: Copy host-specific Hyprland dotfiles
+  tags: [dotfiles, dotfiles:desktop, dotfiles:host, hyprland]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/{{ hostname }}/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ host_hyprland_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'hyprland' in (desktop_sessions_enabled | default([]))"
+    - (host_hyprland_dotfiles | default([])) | length > 0

ansible/roles/profile_desktop_host/tasks/nymph.yml

@@ -53,11 +53,3 @@
     group: "{{ user_group }}"
     mode: "0755"
     force: false
-
-- name: Wrap alacritty with prime-run for NVIDIA PRIME offload
-  tags: [nvidia, dotfiles, dotfiles:desktop, dotfiles:host]
-  ansible.builtin.lineinfile:
-    path: "{{ user_home }}/.config/i3/config"
-    regexp: '^bindsym \$mod\+Return exec --no-startup-id /usr/bin/alacritty'
-    line: 'bindsym $mod+Return exec --no-startup-id ~/.local/bin/prime-run /usr/bin/alacritty'
-  when: "'i3' in (desktop_sessions_enabled | default([]))"

ansible/roles/profile_desktop_hyprland/files/hyprland-portals.conf

@@ -0,0 +1,4 @@
+[preferred]
+default=gtk
+org.freedesktop.impl.portal.Screenshot=hyprland
+org.freedesktop.impl.portal.ScreenCast=hyprland

ansible/roles/profile_desktop_hyprland/files/hyprland.desktop

@@ -0,0 +1,6 @@
+[Desktop Entry]
+Name=Hyprland
+Comment=Hyprland (Wayland)
+Exec=/usr/local/bin/start-hyprland-session
+Type=Application
+DesktopNames=Hyprland

ansible/roles/profile_desktop_hyprland/tasks/main.yml

@@ -0,0 +1,92 @@
+---
+- name: Ensure Hyprland config directories exist
+  tags: [dotfiles, dotfiles:desktop, hyprland]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config/alacritty"
+    - "{{ user_home }}/.config/dunst"
+    - "{{ user_home }}/.config/flameshot"
+    - "{{ user_home }}/.config/foot"
+    - "{{ user_home }}/.config/hypr"
+    - "{{ user_home }}/.config/rofi"
+    - "{{ user_home }}/.config/waybar"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'hyprland' in (desktop_sessions_enabled | default([]))"
+
+- name: Install allowed emptty Hyprland Wayland session
+  tags: [packages, services, emptty, hyprland]
+  ansible.builtin.copy:
+    src: hyprland.desktop
+    dest: /etc/emptty/wayland-sessions/hyprland.desktop
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'hyprland' in (desktop_sessions_enabled | default([]))"
+
+- name: Remove legacy Hyprland session launcher shadowing package binary
+  tags: [packages, services, hyprland]
+  ansible.builtin.file:
+    path: /usr/local/bin/start-hyprland
+    state: absent
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'hyprland' in (desktop_sessions_enabled | default([]))"
+
+- name: Install Hyprland session launcher in /usr/local/bin
+  tags: [packages, services, hyprland]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/.local/bin/start-hyprland-session"
+    dest: /usr/local/bin/start-hyprland-session
+    owner: root
+    group: root
+    mode: "0755"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'hyprland' in (desktop_sessions_enabled | default([]))"
+
+- name: Ensure /etc/xdg/xdg-desktop-portal exists for Hyprland
+  tags: [packages, services, hyprland, portal]
+  ansible.builtin.file:
+    path: /etc/xdg/xdg-desktop-portal
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'hyprland' in (desktop_sessions_enabled | default([]))"
+
+- name: Configure xdg-desktop-portal backend preferences for Hyprland
+  tags: [packages, services, hyprland, portal]
+  ansible.builtin.copy:
+    src: hyprland-portals.conf
+    dest: /etc/xdg/xdg-desktop-portal/hyprland-portals.conf
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'hyprland' in (desktop_sessions_enabled | default([]))"
+
+- name: Copy Hyprland desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, hyprland]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_hyprland_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'hyprland' in (desktop_sessions_enabled | default([]))"

ansible/roles/profile_desktop_hyprland_freebsd/files/hyprland-portals.conf

@@ -0,0 +1,4 @@
+[preferred]
+default=gtk
+org.freedesktop.impl.portal.Screenshot=hyprland
+org.freedesktop.impl.portal.ScreenCast=hyprland

ansible/roles/profile_desktop_hyprland_freebsd/tasks/main.yml

@@ -0,0 +1,58 @@
+---
+- name: Ensure FreeBSD Hyprland user config directories exist
+  tags: [dotfiles, dotfiles:desktop, hyprland]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config"
+    - "{{ user_home }}/.config/alacritty"
+    - "{{ user_home }}/.config/dunst"
+    - "{{ user_home }}/.config/foot"
+    - "{{ user_home }}/.config/hypr"
+    - "{{ user_home }}/.config/rofi"
+    - "{{ user_home }}/.config/waybar"
+    - "{{ user_home }}/.local"
+    - "{{ user_home }}/.local/bin"
+
+- name: Copy common Hyprland desktop dotfiles on FreeBSD
+  tags: [dotfiles, dotfiles:desktop, hyprland]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_hyprland_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Render FreeBSD Hyprland session launcher
+  tags: [packages, services, hyprland]
+  ansible.builtin.template:
+    src: start-hyprland-session.j2
+    dest: /usr/local/bin/start-hyprland-session
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Ensure FreeBSD xdg-desktop-portal config directory exists
+  tags: [packages, services, hyprland, portal]
+  ansible.builtin.file:
+    path: "{{ freebsd_xdg_config_dir | default('/usr/local/etc/xdg') }}/xdg-desktop-portal"
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Configure xdg-desktop-portal backend preferences for FreeBSD Hyprland
+  tags: [packages, services, hyprland, portal]
+  ansible.builtin.copy:
+    src: hyprland-portals.conf
+    dest: "{{ freebsd_xdg_config_dir | default('/usr/local/etc/xdg') }}/xdg-desktop-portal/hyprland-portals.conf"
+    owner: root
+    group: wheel
+    mode: "0644"

ansible/roles/profile_desktop_hyprland_freebsd/templates/start-hyprland-session.j2

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+[ -r /etc/profile ] && . /etc/profile
+[ -r "$HOME/.profile" ] && . "$HOME/.profile"
+
+export XDG_CURRENT_DESKTOP=Hyprland
+export XDG_SESSION_DESKTOP=Hyprland
+export XDG_SESSION_TYPE=wayland
+
+export MOZ_ENABLE_WAYLAND=1
+export QT_QPA_PLATFORM='wayland;xcb'
+export _JAVA_AWT_WM_NONREPARENTING=1
+export SDL_VIDEODRIVER=wayland
+export GDK_BACKEND='wayland,x11'
+
+export SSH_AUTH_SOCK="$HOME/.local/state/ssh-agent/socket"
+
+[ -r "$HOME/.config/hypr/session-env" ] && . "$HOME/.config/hypr/session-env"
+
+if command -v dbus-run-session >/dev/null 2>&1; then
+  exec dbus-run-session Hyprland
+fi
+
+exec Hyprland

ansible/roles/profile_desktop_i3/files/i3.desktop

@@ -1,8 +0,0 @@
-[Desktop Entry]
-Name=i3
-Comment=improved dynamic tiling window manager
-Exec=i3
-TryExec=i3
-Type=Application
-DesktopNames=i3
-Keywords=tiling;wm;windowmanager;window;manager;

ansible/roles/profile_desktop_i3/tasks/main.yml

@@ -1,41 +0,0 @@
----
-- name: Ensure i3 config directories exist
-  tags: [dotfiles, dotfiles:desktop, i3]
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "0755"
-  loop:
-    - "{{ user_home }}/.config/alacritty"
-    - "{{ user_home }}/.config/dunst"
-    - "{{ user_home }}/.config/i3"
-    - "{{ user_home }}/.config/i3blocks"
-    - "{{ user_home }}/.config/picom"
-    - "{{ user_home }}/.config/polybar"
-    - "{{ user_home }}/.config/rofi"
-  when: "'i3' in (desktop_sessions_enabled | default([]))"
-
-- name: Install allowed emptty X11 sessions
-  tags: [packages, services, emptty, i3]
-  ansible.builtin.copy:
-    src: i3.desktop
-    dest: /etc/emptty/xsessions/i3.desktop
-    owner: root
-    group: root
-    mode: "0644"
-  when: "'i3' in (desktop_sessions_enabled | default([]))"
-
-- name: Copy i3 desktop dotfiles
-  tags: [dotfiles, dotfiles:desktop, i3]
-  ansible.builtin.copy:
-    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
-    dest: "{{ user_home }}/{{ item.dest }}"
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "{{ item.mode }}"
-  loop: "{{ desktop_i3_dotfiles | default([]) }}"
-  loop_control:
-    label: "{{ item.dest }}"
-  when: "'i3' in (desktop_sessions_enabled | default([]))"

ansible/roles/profile_desktop_kde/tasks/main.yml

@@ -0,0 +1,60 @@
+---
+- name: Check whether SDDM is the active runit display manager
+  tags: [packages, services, kde, display-manager]
+  ansible.builtin.stat:
+    path: /var/service/sddm
+  register: profile_desktop_kde_sddm_service
+  when: (desktop_environment | default('minimal')) == 'kde'
+
+- name: Copy KDE MIME application defaults
+  tags: [dotfiles, dotfiles:desktop, kde]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/.config/mimeapps.kde.list"
+    dest: "{{ user_home }}/.config/mimeapps.list"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+  when: (desktop_environment | default('minimal')) == 'kde'
+
+- name: Remove minimal desktop user configuration managed by Ansible
+  tags: [dotfiles, dotfiles:desktop, kde]
+  ansible.builtin.file:
+    path: "{{ user_home }}/{{ item }}"
+    state: absent
+  loop: >-
+    {{
+      (desktop_minimal_managed_paths | default([]))
+      + (desktop_xfce_managed_paths | default([]))
+    }}
+  loop_control:
+    label: "{{ item }}"
+  when:
+    - (desktop_environment | default('minimal')) == 'kde'
+    - profile_desktop_kde_sddm_service.stat.exists
+
+- name: Remove minimal desktop portal preferences
+  tags: [packages, services, kde, portal]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/xdg/xdg-desktop-portal/hyprland-portals.conf
+    - /etc/xdg/xdg-desktop-portal/sway-portals.conf
+    - /etc/xdg/xdg-desktop-portal/xfce-portals.conf
+  when:
+    - (desktop_environment | default('minimal')) == 'kde'
+    - profile_desktop_kde_sddm_service.stat.exists
+
+- name: Remove inactive emptty and minimal session launchers
+  tags: [packages, services, kde, display-manager]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/emptty
+    - /etc/lightdm/lightdm.conf.d/50-xfce.conf
+    - /usr/local/bin/start-hyprland-session
+    - /usr/local/bin/start-sway
+  when:
+    - (desktop_environment | default('minimal')) == 'kde'
+    - profile_desktop_kde_sddm_service.stat.exists

ansible/roles/profile_desktop_niri/files/niri-portals.conf

@@ -0,0 +1,4 @@
+[preferred]
+default=gtk
+org.freedesktop.impl.portal.Screenshot=gtk
+org.freedesktop.impl.portal.ScreenCast=gtk

ansible/roles/profile_desktop_niri/files/niri.desktop

@@ -0,0 +1,5 @@
+[Desktop Entry]
+Name=Niri
+Comment=Niri scrollable-tiling (Wayland)
+Exec=/usr/local/bin/start-niri
+Type=Application

ansible/roles/profile_desktop_niri/tasks/main.yml

@@ -0,0 +1,81 @@
+---
+- name: Ensure niri config directories exist
+  tags: [dotfiles, dotfiles:desktop, niri]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config/foot"
+    - "{{ user_home }}/.config/dunst"
+    - "{{ user_home }}/.config/rofi"
+    - "{{ user_home }}/.config/waybar"
+    - "{{ user_home }}/.config/niri"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Install allowed emptty Wayland sessions
+  tags: [packages, services, emptty, niri]
+  ansible.builtin.copy:
+    src: niri.desktop
+    dest: /etc/emptty/wayland-sessions/niri.desktop
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Install Niri session launcher in /usr/local/bin
+  tags: [packages, services, niri]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/.local/bin/start-niri"
+    dest: /usr/local/bin/start-niri
+    owner: root
+    group: root
+    mode: "0755"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Ensure /etc/xdg/xdg-desktop-portal exists
+  tags: [packages, services, niri, portal]
+  ansible.builtin.file:
+    path: /etc/xdg/xdg-desktop-portal
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Configure xdg-desktop-portal backend preferences for niri
+  tags: [packages, services, niri, portal]
+  ansible.builtin.copy:
+    src: niri-portals.conf
+    dest: /etc/xdg/xdg-desktop-portal/niri-portals.conf
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Copy niri desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, niri]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_niri_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"

ansible/roles/profile_desktop_niri_freebsd/tasks/main.yml

@@ -0,0 +1,41 @@
+---
+- name: Ensure FreeBSD Niri user config directories exist
+  tags: [dotfiles, dotfiles:desktop, niri]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config"
+    - "{{ user_home }}/.config/dunst"
+    - "{{ user_home }}/.config/foot"
+    - "{{ user_home }}/.config/niri"
+    - "{{ user_home }}/.config/rofi"
+    - "{{ user_home }}/.config/waybar"
+    - "{{ user_home }}/.local"
+    - "{{ user_home }}/.local/bin"
+    - "{{ user_home }}/.local/state"
+    - "{{ user_home }}/.local/state/ssh-agent"
+
+- name: Copy common Niri desktop dotfiles on FreeBSD
+  tags: [dotfiles, dotfiles:desktop, niri]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_niri_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Render FreeBSD Niri session launcher
+  tags: [packages, services, niri]
+  ansible.builtin.template:
+    src: start-niri-session.j2
+    dest: /usr/local/bin/start-niri-session
+    owner: root
+    group: wheel
+    mode: "0755"

ansible/roles/profile_desktop_niri_freebsd/templates/start-niri-session.j2

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+[ -r /etc/profile ] && . /etc/profile
+[ -r "$HOME/.profile" ] && . "$HOME/.profile"
+
+export XDG_CURRENT_DESKTOP=niri
+export XDG_SESSION_DESKTOP=niri
+export XDG_SESSION_TYPE=wayland
+
+export MOZ_ENABLE_WAYLAND=1
+export QT_QPA_PLATFORM='wayland;xcb'
+export _JAVA_AWT_WM_NONREPARENTING=1
+export SDL_VIDEODRIVER=wayland
+export GDK_BACKEND='wayland,x11'
+
+export SSH_AUTH_SOCK="$HOME/.local/state/ssh-agent/socket"
+
+[ -r "$HOME/.config/niri/session-env" ] && . "$HOME/.config/niri/session-env"
+
+if command -v dbus-run-session >/dev/null 2>&1; then
+  exec dbus-run-session niri --session
+fi
+
+exec niri --session

ansible/roles/profile_desktop_sway/tasks/main.yml

@@ -15,7 +15,9 @@
     - "{{ user_home }}/.config/sway"
     - "{{ user_home }}/.config/waybar"
     - "{{ user_home }}/.config/wlogout"
-  when: "'sway' in (desktop_sessions_enabled | default([]))"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'sway' in (desktop_sessions_enabled | default([]))"
 
 - name: Install allowed emptty Wayland sessions
   tags: [packages, services, emptty, sway]
@@ -25,7 +27,9 @@
     owner: root
     group: root
     mode: "0644"
-  when: "'sway' in (desktop_sessions_enabled | default([]))"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'sway' in (desktop_sessions_enabled | default([]))"
 
 - name: Install Sway session launcher in /usr/local/bin
   tags: [packages, services, sway]
@@ -35,7 +39,9 @@
     owner: root
     group: root
     mode: "0755"
-  when: "'sway' in (desktop_sessions_enabled | default([]))"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'sway' in (desktop_sessions_enabled | default([]))"
 
 - name: Ensure /etc/xdg/xdg-desktop-portal exists
   tags: [packages, services, sway, portal]
@@ -45,7 +51,9 @@
     owner: root
     group: root
     mode: "0755"
-  when: "'sway' in (desktop_sessions_enabled | default([]))"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'sway' in (desktop_sessions_enabled | default([]))"
 
 - name: Configure xdg-desktop-portal backend preferences for sway
   tags: [packages, services, sway, portal]
@@ -55,7 +63,9 @@
     owner: root
     group: root
     mode: "0644"
-  when: "'sway' in (desktop_sessions_enabled | default([]))"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'sway' in (desktop_sessions_enabled | default([]))"
 
 - name: Copy sway desktop dotfiles
   tags: [dotfiles, dotfiles:desktop, sway]
@@ -68,4 +78,6 @@
   loop: "{{ desktop_sway_dotfiles | default([]) }}"
   loop_control:
     label: "{{ item.dest }}"
-  when: "'sway' in (desktop_sessions_enabled | default([]))"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'sway' in (desktop_sessions_enabled | default([]))"

ansible/roles/profile_desktop_xfce/tasks/main.yml

@@ -0,0 +1,223 @@
+---
+- name: Inspect configured desktop display manager for XFCE cleanup gates
+  tags: [always, packages, services, xfce, display-manager]
+  ansible.builtin.stat:
+    path: "/var/service/{{ desktop_display_manager_by_environment[desktop_environment | default('minimal')] }}"
+  register: profile_desktop_xfce_selected_display_manager
+
+- name: Ensure XFCE user configuration directories exist
+  tags: [dotfiles, dotfiles:desktop, xfce]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config/xfce4"
+    - "{{ user_home }}/.config/xfce4/terminal"
+    - "{{ user_home }}/.config/xfce4/xfconf"
+    - "{{ user_home }}/.config/xfce4/xfconf/xfce-perchannel-xml"
+    - "{{ user_home }}/.config/Thunar"
+    - "{{ user_home }}/.local/share/backgrounds"
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Copy XFCE desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, xfce]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_xfce_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Render XFCE themed configuration
+  tags: [dotfiles, dotfiles:desktop, xfce]
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+  loop:
+    - src: xsettings.xml.j2
+      dest: .config/xfce4/xfconf/xfce-perchannel-xml/xsettings.xml
+    - src: xfwm4.xml.j2
+      dest: .config/xfce4/xfconf/xfce-perchannel-xml/xfwm4.xml
+    - src: xfce4-desktop.xml.j2
+      dest: .config/xfce4/xfconf/xfce-perchannel-xml/xfce4-desktop.xml
+    - src: terminalrc.j2
+      dest: .config/xfce4/terminal/terminalrc
+  loop_control:
+    label: "{{ item.dest }}"
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Copy XFCE MIME application defaults
+  tags: [dotfiles, dotfiles:desktop, xfce]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/.config/mimeapps.list"
+    dest: "{{ user_home }}/.config/mimeapps.list"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Make Thunderbird the XFCE mail handler
+  tags: [dotfiles, dotfiles:desktop, xfce]
+  community.general.ini_file:
+    path: "{{ user_home }}/.config/mimeapps.list"
+    section: "{{ item.section }}"
+    option: x-scheme-handler/mailto
+    value: "{{ item.value }}"
+    no_extra_spaces: true
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+  loop:
+    - section: Default Applications
+      value: org.mozilla.Thunderbird.desktop
+    - section: Added Associations
+      value: org.mozilla.Thunderbird.desktop;
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Ensure LightDM configuration directories exist
+  tags: [packages, services, xfce, display-manager]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - /etc/lightdm
+    - /etc/lightdm/lightdm.conf.d
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Configure LightDM for the XFCE session
+  tags: [packages, services, xfce, display-manager]
+  ansible.builtin.template:
+    src: lightdm-xfce.conf.j2
+    dest: /etc/lightdm/lightdm.conf.d/50-xfce.conf
+    owner: root
+    group: root
+    mode: "0644"
+  register: profile_desktop_xfce_lightdm_config
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Configure the LightDM GTK greeter
+  tags: [packages, services, xfce, display-manager]
+  ansible.builtin.template:
+    src: lightdm-gtk-greeter.conf.j2
+    dest: /etc/lightdm/lightdm-gtk-greeter.conf
+    owner: root
+    group: root
+    mode: "0644"
+  register: profile_desktop_xfce_lightdm_greeter_config
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Report deferred LightDM configuration activation
+  tags: [packages, services, xfce, display-manager]
+  ansible.builtin.debug:
+    msg: >-
+      LightDM configuration changed. Apply the display-manager switch or restart
+      LightDM from a TTY or SSH session; it is not restarted automatically.
+  when:
+    - (desktop_environment | default('minimal')) == 'xfce'
+    - >-
+      profile_desktop_xfce_lightdm_config is changed
+      or profile_desktop_xfce_lightdm_greeter_config is changed
+
+- name: Manage gnome-keyring auth hook for LightDM
+  tags: [packages, services, xfce]
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/lightdm
+    insertafter: EOF
+    line: "auth optional pam_gnome_keyring.so"
+    state: present
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Manage gnome-keyring session hook for LightDM
+  tags: [packages, services, xfce]
+  ansible.builtin.lineinfile:
+    path: /etc/pam.d/lightdm
+    insertafter: EOF
+    line: "session optional pam_gnome_keyring.so auto_start"
+    state: present
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Ensure XFCE portal configuration directory exists
+  tags: [packages, services, xfce, portal]
+  ansible.builtin.file:
+    path: /etc/xdg/xdg-desktop-portal
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Configure xdg-desktop-portal preferences for XFCE
+  tags: [packages, services, xfce, portal]
+  ansible.builtin.copy:
+    dest: /etc/xdg/xdg-desktop-portal/xfce-portals.conf
+    content: |
+      [preferred]
+      default=gtk
+    owner: root
+    group: root
+    mode: "0644"
+  when: (desktop_environment | default('minimal')) == 'xfce'
+
+- name: Remove minimal desktop user configuration after switching to XFCE
+  tags: [dotfiles, dotfiles:desktop, xfce]
+  ansible.builtin.file:
+    path: "{{ user_home }}/{{ item }}"
+    state: absent
+  loop: "{{ desktop_minimal_managed_paths | default([]) | difference(['.config/Thunar']) }}"
+  loop_control:
+    label: "{{ item }}"
+  when:
+    - (desktop_environment | default('minimal')) == 'xfce'
+    - profile_desktop_xfce_selected_display_manager.stat.exists
+
+- name: Remove minimal portal preferences and session launchers after switching to XFCE
+  tags: [packages, services, xfce, portal, display-manager]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/xdg/xdg-desktop-portal/hyprland-portals.conf
+    - /etc/xdg/xdg-desktop-portal/sway-portals.conf
+    - /etc/emptty
+    - /usr/local/bin/start-hyprland-session
+    - /usr/local/bin/start-sway
+  when:
+    - (desktop_environment | default('minimal')) == 'xfce'
+    - profile_desktop_xfce_selected_display_manager.stat.exists
+
+- name: Remove XFCE user configuration after switching to another profile
+  tags: [dotfiles, dotfiles:desktop, xfce]
+  ansible.builtin.file:
+    path: "{{ user_home }}/{{ item }}"
+    state: absent
+  loop: "{{ desktop_xfce_managed_paths | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when:
+    - (desktop_environment | default('minimal')) != 'xfce'
+    - profile_desktop_xfce_selected_display_manager.stat.exists
+
+- name: Remove inactive XFCE portal and LightDM profile configuration
+  tags: [packages, services, xfce, portal, display-manager]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: absent
+  loop:
+    - /etc/xdg/xdg-desktop-portal/xfce-portals.conf
+    - /etc/lightdm/lightdm.conf.d/50-xfce.conf
+  when:
+    - (desktop_environment | default('minimal')) != 'xfce'
+    - profile_desktop_xfce_selected_display_manager.stat.exists

ansible/roles/profile_desktop_xfce/templates/lightdm-gtk-greeter.conf.j2

@@ -0,0 +1,7 @@
+[greeter]
+theme-name={{ xfce_theme_gtk }}
+icon-theme-name={{ xfce_theme_icons }}
+font-name={{ xfce_font_ui }}
+background=#050505
+clock-format=%a %d %b, %H:%M
+indicators=~host;~spacer;~clock;~spacer;~session;~power

ansible/roles/profile_desktop_xfce/templates/lightdm-xfce.conf.j2

@@ -0,0 +1,3 @@
+[Seat:*]
+greeter-session=lightdm-gtk-greeter
+user-session=xfce

ansible/roles/profile_desktop_xfce/templates/terminalrc.j2

@@ -0,0 +1,15 @@
+[Configuration]
+FontName={{ xfce_font_monospace }}
+MiscUseSystemFont=FALSE
+MiscMenubarDefault=FALSE
+MiscToolbarDefault=FALSE
+MiscBordersDefault=TRUE
+ScrollingLines=10000
+BackgroundMode=TERMINAL_BACKGROUND_SOLID
+ColorForeground=#d8d8d8
+ColorBackground=#050505
+ColorCursor=#d8d8d8
+ColorSelection=#d8d8d8
+ColorSelectionUseDefault=FALSE
+ColorSelectionBackground=#3a5f7f
+ColorPalette=#050505;#8f3f3f;#5f7f5f;#8f7f3f;#3a5f7f;#6f4f7f;#3f7f7f;#d8d8d8;#777777;#bf5f5f;#7f9f7f;#af9f5f;#5f7f9f;#8f6f9f;#5f9f9f;#ffffff

ansible/roles/profile_desktop_xfce/templates/xfce4-desktop.xml.j2

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<channel name="xfce4-desktop" version="1.0">
+  <property name="backdrop" type="empty">
+    <property name="screen0" type="empty">
+      <property name="monitor0" type="empty">
+        <property name="workspace0" type="empty">
+          <property name="color-style" type="int" value="0"/>
+          <property name="image-style" type="int" value="5"/>
+          <property name="last-image" type="string" value="{{ user_home }}/.local/share/backgrounds/xfce-dark.svg"/>
+        </property>
+      </property>
+    </property>
+  </property>
+  <property name="desktop-icons" type="empty">
+    <property name="style" type="int" value="0"/>
+  </property>
+</channel>

ansible/roles/profile_desktop_xfce/templates/xfwm4.xml.j2

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<channel name="xfwm4" version="1.0">
+  <property name="general" type="empty">
+    <property name="theme" type="string" value="{{ xfce_theme_wm }}"/>
+    <property name="title_font" type="string" value="{{ xfce_font_ui }}"/>
+    <property name="workspace_count" type="int" value="6"/>
+    <property name="workspace_names" type="array">
+      <value type="string" value="term"/>
+      <value type="string" value="web"/>
+      <value type="string" value="code"/>
+      <value type="string" value="mail"/>
+      <value type="string" value="ops"/>
+      <value type="string" value="misc"/>
+    </property>
+    <property name="use_compositing" type="bool" value="false"/>
+    <property name="click_to_focus" type="bool" value="true"/>
+    <property name="focus_delay" type="int" value="250"/>
+    <property name="raise_delay" type="int" value="250"/>
+  </property>
+</channel>

ansible/roles/profile_desktop_xfce/templates/xsettings.xml.j2

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<channel name="xsettings" version="1.0">
+  <property name="Net" type="empty">
+    <property name="ThemeName" type="string" value="{{ xfce_theme_gtk }}"/>
+    <property name="IconThemeName" type="string" value="{{ xfce_theme_icons }}"/>
+  </property>
+  <property name="Gtk" type="empty">
+    <property name="FontName" type="string" value="{{ xfce_font_ui }}"/>
+    <property name="MonospaceFontName" type="string" value="{{ xfce_font_monospace }}"/>
+    <property name="CursorThemeName" type="string" value="Yaru"/>
+    <property name="DecorationLayout" type="string" value="menu:minimize,maximize,close"/>
+  </property>
+  <property name="Xft" type="empty">
+    <property name="Antialias" type="int" value="1"/>
+    <property name="Hinting" type="int" value="1"/>
+    <property name="HintStyle" type="string" value="hintslight"/>
+    <property name="RGBA" type="string" value="rgb"/>
+  </property>
+</channel>

ansible/roles/profile_lab/tasks/main.yml

@@ -0,0 +1,12 @@
+---
+- name: Ensure lab workspace directories exist
+  tags: [dotfiles]
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ lab_workspace_directories | default([]) }}"
+  loop_control:
+    label: "{{ item.path }}"

ansible/roles/profile_personal_workstation/tasks/main.yml

@@ -0,0 +1,24 @@
+---
+- name: Ensure personal workstation directories exist
+  tags: [dotfiles, dotfiles:workstation]
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ personal_workstation_directories | default([]) }}"
+  loop_control:
+    label: "{{ item.path }}"
+
+- name: Copy personal workstation dotfiles
+  tags: [dotfiles, dotfiles:workstation]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/workstation/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ personal_workstation_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"

ansible/roles/profile_workstation_dev_common/tasks/main.yml

@@ -48,3 +48,15 @@
     - workstation_npm_packages | length > 0
   loop_control:
     label: "{{ item.name }}"
+
+- name: Install IBM Bob coding agent
+  tags: [packages, ai_agents]
+  ansible.builtin.shell: >
+    curl -fsSL {{ workstation_ibm_bob_install_url }} | bash
+  args:
+    executable: /bin/bash
+    creates: /usr/local/bin/bob
+  become: true
+  when:
+    - workstation_manage_ibm_bob | default(false)
+    - workstation_ibm_bob_install_url | length > 0

ansible/roles/profile_workstation_dev_wsl/tasks/main.yml

@@ -1,8 +1,21 @@
 ---
+- name: Ensure WSL tmux directories exist
+  tags: [dotfiles, dotfiles:workstation, tmux, wsl]
+  ansible.builtin.file:
+    path: "{{ user_home }}/{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - .tmux
+    - .tmux/bin
+    - .tmux/plugins
+
 - name: Copy workstation WSL dotfiles
   tags: [dotfiles, dotfiles:workstation, wsl]
   ansible.builtin.copy:
-    src: "{{ playbook_dir }}/../dotfiles/workstation_dev_wsl/{{ item.src }}"
+    src: "{{ playbook_dir }}/../dotfiles/{{ item.source_dir | default('workstation_dev_wsl') }}/{{ item.src }}"
     dest: "{{ user_home }}/{{ item.dest }}"
     owner: "{{ username }}"
     group: "{{ user_group }}"

ansible/roles/profile_workstation_host_windows/tasks/main.yml

@@ -1,411 +0,0 @@
----
-- name: Enable required Windows features for WSL
-  tags: [packages, services, wsl]
-  ansible.windows.win_optional_feature:
-    name:
-      - Microsoft-Windows-Subsystem-Linux
-      - VirtualMachinePlatform
-    state: present
-    include_parent: true
-
-- name: Gather Windows host version details
-  tags: [packages]
-  ansible.windows.win_powershell:
-    script: |
-      $os = Get-ComputerInfo
-      $buildNumber = [int]$os.OsBuildNumber
-      $Ansible.Result = @{
-          product_name = $os.WindowsProductName
-          build_number = $buildNumber
-          is_windows_11 = $buildNumber -ge 22000
-      }
-      $Ansible.Changed = $false
-  register: windows_host_version_state
-
-- name: Fail when Windows host is not Windows 11
-  tags: [packages]
-  ansible.builtin.fail:
-    msg: >-
-      workstation_host_windows is supported only on Windows 11. Detected {{ windows_host_version_state.result.product_name }}
-      build {{ windows_host_version_state.result.build_number }}.
-  when: not (windows_host_version_state.result.is_windows_11 | default(false))
-
-- name: Enable dark mode for Windows apps
-  tags: [packages]
-  ansible.windows.win_regedit:
-    path: HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
-    name: AppsUseLightTheme
-    data: 0
-    type: dword
-  register: windows_apps_dark_mode_state
-  when: windows_enable_dark_theme | default(false)
-
-- name: Enable dark mode for Windows system surfaces
-  tags: [packages]
-  ansible.windows.win_regedit:
-    path: HKCU:\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize
-    name: SystemUsesLightTheme
-    data: 0
-    type: dword
-  register: windows_system_dark_mode_state
-  when: windows_enable_dark_theme | default(false)
-
-- name: Hide Windows taskbar search box
-  tags: [packages]
-  ansible.windows.win_regedit:
-    path: HKCU:\Software\Microsoft\Windows\CurrentVersion\Search
-    name: SearchboxTaskbarMode
-    data: 0
-    type: dword
-  register: windows_taskbar_search_state
-  when: windows_hide_taskbar_search | default(false)
-
-- name: Hide Windows 11 taskbar widgets
-  tags: [packages]
-  ansible.windows.win_regedit:
-    path: HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
-    name: TaskbarDa
-    data: 0
-    type: dword
-  register: windows_11_widgets_state
-  when: windows_hide_taskbar_widgets | default(false)
-
-- name: Disable Windows 11 widgets via policy
-  tags: [packages]
-  ansible.windows.win_regedit:
-    path: HKLM:\SOFTWARE\Policies\Microsoft\Dsh
-    name: AllowNewsAndInterests
-    data: 0
-    type: dword
-  register: windows_11_widgets_policy_state
-  when: windows_hide_taskbar_widgets | default(false)
-
-- name: Note when Windows shell settings may require sign out
-  tags: [packages]
-  ansible.builtin.debug:
-    msg: >-
-      Windows shell appearance settings changed. Sign out and back in, or restart explorer.exe,
-      if taskbar or theme updates do not appear immediately. Windows 11 widget policy changes can require
-      signing out before the widget button disappears from the taskbar.
-  changed_when: false
-  when: >-
-    (windows_apps_dark_mode_state is changed)
-    or (windows_system_dark_mode_state is changed)
-    or (windows_taskbar_search_state is changed)
-    or (windows_11_widgets_state is changed)
-    or (windows_11_widgets_policy_state is changed)
-
-- name: Ensure winget is executable on Windows host through PSRP
-  tags: [packages]
-  when: windows_package_backend == 'winget_psrp'
-  ansible.windows.win_powershell:
-    script: |
-      $winget = Get-Command winget.exe -ErrorAction SilentlyContinue
-      if ($null -eq $winget) {
-          throw 'winget.exe is not available on the Windows host. Install App Installer or rerun the bootstrap script.'
-      }
-
-      & $winget.Source --info *> $null
-      if ($LASTEXITCODE -ne 0) {
-          throw 'winget.exe is not executable through the current PSRP session. Set windows_package_backend to winget_wsl_local on WSL-managed hosts.'
-      }
-
-      $Ansible.Changed = $false
-
-- name: Ensure winget is executable through local Windows PowerShell from WSL
-  tags: [packages]
-  when: windows_package_backend == 'winget_wsl_local'
-  block:
-    - name: Ensure winget_wsl_local backend is running inside WSL
-      ansible.builtin.assert:
-        that:
-          - lookup('ansible.builtin.env', 'WSL_DISTRO_NAME') | length > 0
-        fail_msg: >-
-          winget_wsl_local requires running the playbook from inside the
-          target machine's WSL environment.
-
-    - name: Get local Windows host name through WSL interop
-      ansible.builtin.shell: |
-        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '$env:COMPUTERNAME'
-      args:
-        executable: /bin/bash
-      delegate_to: localhost
-      register: local_windows_host_name_state
-      changed_when: false
-
-    - name: Get local Windows host IP addresses through WSL interop
-      ansible.builtin.shell: |
-        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '
-          Get-NetIPAddress -AddressFamily IPv4, IPv6 -ErrorAction SilentlyContinue |
-            Where-Object {
-              $_.IPAddress -notin @("127.0.0.1", "::1") -and
-              $_.IPAddress -notlike "169.254.*" -and
-              $_.IPAddress -notlike "fe80:*"
-            } |
-            Select-Object -ExpandProperty IPAddress
-        '
-      args:
-        executable: /bin/bash
-      delegate_to: localhost
-      register: local_windows_host_ip_state
-      changed_when: false
-
-    - name: Ensure winget_wsl_local backend targets the local Windows host
-      ansible.builtin.assert:
-        that:
-          - >-
-            (ansible_host | lower) in ['localhost', '127.0.0.1', '::1']
-            or (local_windows_host_name_state.stdout | trim | upper)
-            == ((ansible_host | regex_replace('\\..*$', '')) | upper)
-            or (ansible_host | lower)
-            in (local_windows_host_ip_state.stdout_lines | map('trim') | map('lower') | list)
-        fail_msg: >-
-          winget_wsl_local can only target the local Windows host reached
-          through WSL interop. Local Windows host '{{ local_windows_host_name_state.stdout | trim }}'
-          with addresses {{ local_windows_host_ip_state.stdout_lines | map('trim') | list }}
-          does not match ansible_host '{{ ansible_host }}'.
-
-    - name: Ensure winget is executable through local Windows PowerShell
-      ansible.builtin.shell: |
-        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '
-          $ErrorActionPreference = "Stop"
-          $winget = Get-Command winget.exe -ErrorAction SilentlyContinue
-          if ($null -eq $winget) {
-              throw "winget.exe is not available on the local Windows host. Install App Installer or rerun the bootstrap script."
-          }
-
-          & $winget.Source --info *> $null
-          if ($LASTEXITCODE -ne 0) {
-              throw "winget.exe is not executable through local Windows PowerShell interop."
-          }
-        '
-      args:
-        executable: /bin/bash
-      delegate_to: localhost
-      changed_when: false
-
-- name: Ensure WSL 2 is the default backend
-  tags: [packages, services, wsl]
-  ansible.windows.win_powershell:
-    script: |
-      $status = & wsl --status 2>$null
-      if ($LASTEXITCODE -eq 0 -and $status -match 'Default Version:\s*2') {
-          $Ansible.Changed = $false
-          return
-      }
-
-      & wsl --set-default-version 2
-      if ($LASTEXITCODE -ne 0) {
-          throw 'Failed to set WSL default version to 2.'
-      }
-
-      $Ansible.Changed = $true
-
-- name: Install Windows workstation applications with winget through PSRP
-  tags: [packages]
-  when: windows_package_backend == 'winget_psrp'
-  ansible.windows.win_powershell:
-    script: |
-      $packageId = '{{ item.id }}'
-      $packageName = '{{ item.name | default(item.id) }}'
-      $packageSource = '{{ item.source | default('') }}'
-      $listArgs = @(
-          'list'
-          '--id', $packageId
-          '--exact'
-          '--accept-source-agreements'
-          '--disable-interactivity'
-      )
-      $installArgs = @(
-          'install'
-          '--id', $packageId
-          '--exact'
-          '--silent'
-          '--accept-package-agreements'
-          '--accept-source-agreements'
-          '--disable-interactivity'
-      )
-
-      if (-not [string]::IsNullOrWhiteSpace($packageSource)) {
-          $listArgs += @('--source', $packageSource)
-          $installArgs += @('--source', $packageSource)
-      }
-
-      $installed = & winget @listArgs 2>$null
-      if ($LASTEXITCODE -eq 0 -and $installed -match [regex]::Escape($packageId)) {
-          $Ansible.Changed = $false
-          return
-      }
-
-      & winget @installArgs
-      if ($LASTEXITCODE -ne 0) {
-          throw "Failed to install $packageName with winget"
-      }
-
-      $Ansible.Changed = $true
-  loop: "{{ windows_winget_packages | default([]) }}"
-  loop_control:
-    label: "{{ item.id }}"
-
-- name: Install Windows workstation applications with winget through WSL local backend
-  tags: [packages]
-  when: windows_package_backend == 'winget_wsl_local'
-  ansible.builtin.shell: |
-    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command '
-      $ErrorActionPreference = "Stop"
-      $packageId = "{{ item.id }}"
-      $packageName = "{{ item.name | default(item.id) }}"
-      $packageSource = "{{ item.source | default('') }}"
-      $winget = Get-Command winget.exe -ErrorAction Stop
-      $listArgs = @(
-          "list"
-          "--id", $packageId
-          "--exact"
-          "--accept-source-agreements"
-          "--disable-interactivity"
-      )
-      $installArgs = @(
-          "install"
-          "--id", $packageId
-          "--exact"
-          "--silent"
-          "--accept-package-agreements"
-          "--accept-source-agreements"
-          "--disable-interactivity"
-      )
-
-      if (-not [string]::IsNullOrWhiteSpace($packageSource)) {
-          $listArgs += @("--source", $packageSource)
-          $installArgs += @("--source", $packageSource)
-      }
-
-      $installed = & $winget.Source @listArgs 2>$null
-      if ($LASTEXITCODE -eq 0 -and $installed -match [regex]::Escape($packageId)) {
-          [Console]::Out.WriteLine("changed=false")
-          exit 0
-      }
-
-      & $winget.Source @installArgs
-      if ($LASTEXITCODE -ne 0) {
-          throw "Failed to install $packageName with winget"
-      }
-
-      [Console]::Out.WriteLine("changed=true")
-    '
-  args:
-    executable: /bin/bash
-  delegate_to: localhost
-  register: windows_wsl_local_winget_install_state
-  changed_when: "'changed=true' in windows_wsl_local_winget_install_state.stdout"
-  loop: "{{ windows_winget_packages | default([]) }}"
-  loop_control:
-    label: "{{ item.id }}"
-
-- name: Configure Windows taskbar pin layout
-  tags: [packages]
-  when: (windows_taskbar_pins | default([])) | length > 0
-  block:
-    - name: Ensure Windows taskbar layout directory exists
-      ansible.windows.win_file:
-        path: "{{ windows_taskbar_layout_directory }}"
-        state: directory
-
-    - name: Render Windows taskbar layout policy file
-      ansible.windows.win_template:
-        src: taskbar-layout.xml.j2
-        dest: "{{ windows_taskbar_layout_path }}"
-      register: windows_taskbar_layout_file_state
-
-    - name: Enable Windows taskbar layout policy
-      ansible.windows.win_regedit:
-        path: HKCU:\Software\Policies\Microsoft\Windows\Explorer
-        name: LockedStartLayout
-        data: 1
-        type: dword
-      register: windows_taskbar_layout_policy_state
-
-    - name: Set Windows taskbar layout policy file path
-      ansible.windows.win_regedit:
-        path: HKCU:\Software\Policies\Microsoft\Windows\Explorer
-        name: StartLayoutFile
-        data: "{{ windows_taskbar_layout_path }}"
-        type: expandstring
-      register: windows_taskbar_layout_policy_path_state
-
-    - name: Set Windows taskbar layout policy refresh behavior
-      ansible.windows.win_regedit:
-        path: HKCU:\Software\Policies\Microsoft\Windows\Explorer
-        name: ReapplyStartLayoutEveryLogon
-        data: "{{ (windows_taskbar_reapply_every_logon | default(false)) | ternary(1, 0) }}"
-        type: dword
-      register: windows_taskbar_layout_policy_reapply_state
-
-    - name: Note when Windows taskbar pin layout may require sign out
-      ansible.builtin.debug:
-        msg: >-
-          Windows taskbar pin policy changed. Sign out and back in if the updated pin order does not appear immediately.
-      changed_when: false
-      when: >-
-        (windows_taskbar_layout_file_state is changed)
-        or (windows_taskbar_layout_policy_state is changed)
-        or (windows_taskbar_layout_policy_path_state is changed)
-        or (windows_taskbar_layout_policy_reapply_state is changed)
-
-- name: Install VS Code WSL extensions on Windows host
-  tags: [packages, vscode]
-  ansible.windows.win_powershell:
-    script: |
-      $extensionId = '{{ item }}'
-      $code = Get-Command code.cmd -ErrorAction SilentlyContinue
-      if ($null -eq $code) {
-          throw 'code.cmd is not available. Ensure Visual Studio Code is installed before managing extensions.'
-      }
-
-      $installedExtensions = & $code.Source --list-extensions
-      if ($installedExtensions -contains $extensionId) {
-          $Ansible.Changed = $false
-          return
-      }
-
-      & $code.Source --install-extension $extensionId --force
-      if ($LASTEXITCODE -ne 0) {
-          throw "Failed to install VS Code extension $extensionId"
-      }
-
-      $Ansible.Changed = $true
-  loop: "{{ windows_vscode_extensions | default([]) }}"
-  loop_control:
-    label: "{{ item }}"
-
-- name: Set Windows Terminal default profile to Ubuntu
-  tags: [packages, wsl]
-  ansible.windows.win_powershell:
-    script: |
-      $terminalSettingsPath = Join-Path $env:LOCALAPPDATA 'Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json'
-      if (-not (Test-Path $terminalSettingsPath)) {
-          throw 'Windows Terminal settings.json was not found. Launch Windows Terminal once before applying the default profile configuration.'
-      }
-
-      $settings = Get-Content -Path $terminalSettingsPath -Raw | ConvertFrom-Json
-      if ($null -eq $settings.profiles -or $null -eq $settings.profiles.list) {
-          throw 'Windows Terminal settings.json does not contain a profiles.list section.'
-      }
-
-      $targetProfile = $settings.profiles.list |
-          Where-Object {
-              $_.name -eq '{{ windows_terminal_default_profile_name }}' -and -not ($_.PSObject.Properties.Name -contains 'hidden' -and $_.hidden)
-          } |
-          Select-Object -First 1
-
-      if ($null -eq $targetProfile) {
-          throw "Windows Terminal visible profile '{{ windows_terminal_default_profile_name }}' was not found. Ensure the Ubuntu WSL profile exists and is not hidden in Windows Terminal first."
-      }
-
-      if ($settings.defaultProfile -eq $targetProfile.guid) {
-          $Ansible.Changed = $false
-          return
-      }
-
-      $settings.defaultProfile = $targetProfile.guid
-      $settings | ConvertTo-Json -Depth 100 | Set-Content -Path $terminalSettingsPath -Encoding utf8
-      $Ansible.Changed = $true

ansible/roles/profile_workstation_host_windows/templates/taskbar-layout.xml.j2

@@ -1,23 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<LayoutModificationTemplate
-    xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
-    xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
-    xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
-    xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"
-    Version="1">
-  <CustomTaskbarLayoutCollection PinListPlacement="Replace">
-    <defaultlayout:TaskbarLayout>
-      <taskbar:TaskbarPinList>
-{% for pin in windows_taskbar_pins %}
-{% if pin.type == 'desktop_application_id' %}
-        <taskbar:DesktopApp DesktopApplicationID="{{ pin.id }}" />
-{% elif pin.type == 'desktop_application_link_path' %}
-        <taskbar:DesktopApp DesktopApplicationLinkPath="{{ pin.path }}" />
-{% elif pin.type == 'app_user_model_id' %}
-        <taskbar:UWA AppUserModelID="{{ pin.id }}" />
-{% endif %}
-{% endfor %}
-      </taskbar:TaskbarPinList>
-    </defaultlayout:TaskbarLayout>
-  </CustomTaskbarLayoutCollection>
-</LayoutModificationTemplate>

ansible/roles/services_freebsd/tasks/main.yml

@@ -0,0 +1,20 @@
+---
+- name: Configure FreeBSD rc.conf values
+  tags: [services, packages]
+  community.general.sysrc:
+    name: "{{ item.name }}"
+    value: "{{ item.value }}"
+    state: present
+  loop: "{{ freebsd_rc_conf | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Enable FreeBSD rc services
+  tags: [services, packages]
+  ansible.builtin.service:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+  loop: "{{ freebsd_enabled_services | default([]) + host_enabled_services | default([]) }}"
+  loop_control:
+    label: "{{ item }}"

ansible/roles/services_runit/tasks/main.yml

@@ -14,3 +14,105 @@
     dest: "/var/service/{{ item }}"
     state: link
   loop: "{{ host_enabled_services | default([]) }}"
+
+- name: Define desktop display manager services
+  tags: [services, packages, display-manager]
+  ansible.builtin.set_fact:
+    services_runit_desktop_display_manager_service: >-
+      {{ desktop_display_manager_by_environment[desktop_environment | default('minimal')] }}
+    services_runit_inactive_display_manager_services: >-
+      {{
+        desktop_display_manager_by_environment.values()
+        | list
+        | difference([desktop_display_manager_by_environment[desktop_environment | default('minimal')]])
+      }}
+  when: "'desktop' in group_names"
+
+- name: Inspect selected desktop display manager service
+  tags: [services, packages, display-manager]
+  ansible.builtin.stat:
+    path: "/var/service/{{ services_runit_desktop_display_manager_service }}"
+  register: services_runit_selected_display_manager_link
+  when: "'desktop' in group_names"
+
+- name: Inspect inactive desktop display manager services
+  tags: [services, packages, display-manager]
+  ansible.builtin.stat:
+    path: "/var/service/{{ item }}"
+  loop: "{{ services_runit_inactive_display_manager_services }}"
+  loop_control:
+    label: "{{ item }}"
+  register: services_runit_inactive_display_manager_links
+  when: "'desktop' in group_names"
+
+- name: Record active inactive desktop display managers
+  tags: [services, packages, display-manager]
+  ansible.builtin.set_fact:
+    services_runit_active_inactive_display_managers: >-
+      {{
+        services_runit_inactive_display_manager_links.results
+        | selectattr('stat.exists')
+        | map(attribute='item')
+        | list
+      }}
+  when: "'desktop' in group_names"
+
+- name: Report deferred desktop display manager switch
+  tags: [services, packages, display-manager]
+  ansible.builtin.debug:
+    msg: >-
+      {{ desktop_environment }} is configured, but
+      {{ services_runit_active_inactive_display_managers | join(', ') }} is still active.
+      Re-run from a TTY or SSH session with
+      -e desktop_allow_display_manager_switch=true to switch safely to
+      {{ services_runit_desktop_display_manager_service }}.
+  when:
+    - "'desktop' in group_names"
+    - (services_runit_active_inactive_display_managers | length) > 0
+    - not (desktop_allow_display_manager_switch | default(false))
+
+- name: Disable inactive desktop display managers
+  tags: [services, packages, display-manager]
+  ansible.builtin.file:
+    path: "/var/service/{{ item }}"
+    state: absent
+  loop: "{{ services_runit_active_inactive_display_managers }}"
+  loop_control:
+    label: "{{ item }}"
+  register: services_runit_display_manager_disabled
+  when:
+    - "'desktop' in group_names"
+    - (services_runit_active_inactive_display_managers | length) > 0
+    - desktop_allow_display_manager_switch | default(false)
+
+- name: Enable selected desktop display manager
+  tags: [services, packages, display-manager]
+  ansible.builtin.file:
+    src: "/etc/sv/{{ services_runit_desktop_display_manager_service }}"
+    dest: "/var/service/{{ services_runit_desktop_display_manager_service }}"
+    state: link
+  register: services_runit_display_manager_enabled
+  when:
+    - "'desktop' in group_names"
+    - not services_runit_selected_display_manager_link.stat.exists
+    - >-
+      (services_runit_active_inactive_display_managers | length) == 0
+      or (desktop_allow_display_manager_switch | default(false))
+
+- name: Remove inactive desktop display manager packages after switching
+  tags: [services, packages, display-manager]
+  community.general.xbps:
+    name: "{{ item }}"
+    state: absent
+    update_cache: false
+  loop: "{{ services_runit_inactive_display_manager_services }}"
+  loop_control:
+    label: "{{ item }}"
+  when:
+    - "'desktop' in group_names"
+    - >-
+      services_runit_selected_display_manager_link.stat.exists
+      or (services_runit_display_manager_enabled is defined and services_runit_display_manager_enabled is changed)
+    - >-
+      (services_runit_active_inactive_display_managers | length) == 0
+      or (desktop_allow_display_manager_switch | default(false))

ansible/roles/services_systemd/tasks/main.yml

@@ -18,4 +18,3 @@
   loop: "{{ host_enabled_services | default([]) }}"
   loop_control:
     label: "{{ item }}"
-

ansible/site.yml

@@ -1,56 +1,137 @@
 ---
-- hosts: all:!workstation_host_windows
+- name: Configure common user environment
+  hosts: all
   become: true
   pre_tasks:
     - name: Load local vault variables when available
       tags: [always]
       ansible.builtin.include_vars:
         file: "{{ playbook_dir }}/../secrets/vault.yml"
-      when: lookup('ansible.builtin.fileglob', playbook_dir + '/../secrets/vault.yml', errors='ignore', wantlist=True) | length > 0
+      when: >-
+        lookup('ansible.builtin.fileglob', playbook_dir + '/../secrets/vault.yml',
+        errors='ignore', wantlist=True) | length > 0
 
     - name: Load machine-local vault variables when available
       tags: [always]
       ansible.builtin.include_vars:
         file: "{{ playbook_dir }}/../secrets/vault.local.yml"
-      when: lookup('ansible.builtin.fileglob', playbook_dir + '/../secrets/vault.local.yml', errors='ignore', wantlist=True) | length > 0
+      when: >-
+        lookup('ansible.builtin.fileglob', playbook_dir + '/../secrets/vault.local.yml',
+        errors='ignore', wantlist=True) | length > 0
 
   roles:
     - dotfiles_common
 
-- hosts: void
+- name: Configure Void platform
+  hosts: platform_void
   become: true
 
   roles:
     - packages_void
     - services_runit
-    - profile_desktop_common
-    - profile_desktop_i3
-    - profile_desktop_sway
-    - profile_desktop_host
 
-- hosts: workstation_dev_ubuntu
+- name: Configure Void graphical desktop
+  hosts: platform_void:&graphical_desktop
   become: true
 
   roles:
-    - packages_ubuntu
-    - services_systemd
-    - profile_workstation_dev_common
+    - profile_desktop_common
+    - profile_desktop_sway
+    - profile_desktop_hyprland
+    - profile_desktop_niri
+    - profile_desktop_kde
+    - profile_desktop_xfce
+    - profile_desktop_host
 
-- hosts: workstation_dev_fedora
+- name: Configure lab role on Void
+  hosts: platform_void:&role_lab
+  become: true
+
+  roles:
+    - profile_lab
+
+- name: Configure Linux Mint platform
+  hosts: platform_mint
+  become: true
+
+  roles:
+    - packages_mint
+    - services_systemd
+
+- name: Configure personal workstation role on Linux Mint
+  hosts: platform_mint:&role_personal_workstation
+  become: true
+
+  roles:
+    - profile_personal_workstation
+
+- name: Configure Cinnamon desktop on Linux Mint
+  hosts: platform_mint:&desktop_cinnamon
+  become: true
+
+  roles:
+    - profile_desktop_cinnamon
+
+- name: Configure FreeBSD platform
+  hosts: platform_freebsd
+  become: true
+
+  roles:
+    - packages_freebsd
+    - services_freebsd
+
+- name: Configure lab role on FreeBSD
+  hosts: platform_freebsd:&role_lab
+  become: true
+
+  roles:
+    - profile_lab
+
+- name: Configure Niri desktop on FreeBSD
+  hosts: platform_freebsd:&desktop_niri
+  become: true
+
+  roles:
+    - profile_desktop_niri_freebsd
+
+- name: Configure Fedora platform
+  hosts: platform_fedora
   become: true
 
   roles:
     - packages_fedora
     - services_systemd
+
+- name: Configure personal workstation role on Fedora
+  hosts: platform_fedora:&role_personal_workstation
+  become: true
+
+  roles:
+    - profile_personal_workstation
+
+- name: Configure Fedora GNOME desktop
+  hosts: platform_fedora:&desktop_gnome
+  become: true
+
+  roles:
+    - profile_desktop_gnome
+
+- name: Configure Fedora workstation development layer
+  hosts: workstation_dev_fedora
+  become: true
+
+  roles:
     - profile_workstation_dev_common
 
-- hosts: workstation_host_linux
+- name: Configure native Linux workstation host layer
+  hosts: workstation_host_linux
   become: true
 
   roles:
     - profile_workstation_gnome
 
-- hosts: workstation_dev_wsl
+- name: Configure WSL workstation development layer
+  hosts: workstation_dev_wsl
   become: true
 
   roles:
@@ -59,54 +140,8 @@
     - profile_workstation_dev_common
     - profile_workstation_dev_wsl
 
-- hosts: workstation_host_windows
-  gather_facts: false
-
-  pre_tasks:
-    - name: Load local vault variables when available
-      tags: [always]
-      ansible.builtin.include_vars:
-        file: "{{ playbook_dir }}/../secrets/vault.yml"
-      when: lookup('ansible.builtin.fileglob', playbook_dir + '/../secrets/vault.yml', errors='ignore', wantlist=True) | length > 0
-
-    - name: Load machine-local vault variables when available
-      tags: [always]
-      ansible.builtin.include_vars:
-        file: "{{ playbook_dir }}/../secrets/vault.local.yml"
-      when: lookup('ansible.builtin.fileglob', playbook_dir + '/../secrets/vault.local.yml', errors='ignore', wantlist=True) | length > 0
-
-    - name: Resolve Windows PSRP connection settings
-      tags: [always]
-      ansible.builtin.set_fact:
-        ansible_host: "{{ windows_psrp_host | default(vault_windows_psrp_host | default('')) }}"
-        ansible_user: "{{ windows_psrp_user | default(vault_windows_psrp_user | default('')) }}"
-        ansible_password: "{{ windows_psrp_password | default(vault_windows_psrp_password | default('')) }}"
-        windows_package_backend: "{{ windows_package_backend | default(vault_windows_package_backend | default('winget_psrp')) }}"
-
-    - name: Ensure Windows PSRP connection settings are defined
-      tags: [always]
-      ansible.builtin.assert:
-        that:
-          - (ansible_host | default('') | length) > 0
-          - (ansible_user | default('') | length) > 0
-        fail_msg: >-
-          Define windows_psrp_host and windows_psrp_user via extra vars, secrets/vault.yml,
-          or secrets/vault.local.yml
-          before running the workstation_host_windows play.
-
-    - name: Ensure Windows package backend is supported
-      tags: [always]
-      ansible.builtin.assert:
-        that:
-          - windows_package_backend in ['winget_psrp', 'winget_wsl_local']
-        fail_msg: >-
-          Unsupported windows_package_backend '{{ windows_package_backend }}'.
-          Supported values are winget_psrp and winget_wsl_local.
-
-  roles:
-    - profile_workstation_host_windows
-
-- hosts: ubuntu_server
+- name: Configure Ubuntu server
+  hosts: ubuntu_server
   become: true
 
   roles:

ansible/templates/desktop/.gitconfig.j2

@@ -29,9 +29,19 @@
 [mergetool]
   prompt = false
 
+[mergetool "meld"]
+  cmd = meld "$LOCAL" "$BASE" "$REMOTE" --output "$MERGED"
+  trustExitCode = false
+
 [diff]
   tool = meld
 
+[difftool]
+  prompt = false
+
+[difftool "meld"]
+  cmd = meld "$LOCAL" "$REMOTE"
+
 [color]
   ui = always
 

ansible/templates/desktop/.mbsyncrc.j2

@@ -1,47 +0,0 @@
-##################### iCloud Account ##################################
-IMAPStore iCloud-remote
-    Host imap.mail.me.com
-    Port 993
-    User {{ vault_icloud_email }}
-    PassCmd "secret-tool lookup icloud-mail icloud"
-    AuthMechs *
-    TLSType IMAPS
-    TLSVersions +1.2 +1.3
-    PipelineDepth 1
-
-MaildirStore iCloud-local
-    Path ~/Maildir/iCloudAccount/
-    Inbox ~/Maildir/iCloudAccount/INBOX
-    SubFolders Verbatim
-
-Channel iCloud
-    Far :iCloud-remote:
-    Near :iCloud-local:
-    Patterns *
-    Create Both
-    Expunge Both
-    SyncState *
-
-##################### Protonmail Account ##################################
-IMAPStore protonmail-remote
-    Host 127.0.0.1
-    Port 1143
-    User {{ vault_protonmail_email }}
-    PassCmd "secret-tool lookup protonmail-bridge protonmail"
-    AuthMechs *
-    TLSType STARTTLS
-    PipelineDepth 1
-    CertificateFile  {{ desktop_protonmail_bridge_cert_path }}
-
-MaildirStore protonmail-local
-    Path ~/Maildir/ProtonMailAccount/
-    Inbox ~/Maildir/ProtonMailAccount/INBOX
-    SubFolders Verbatim
-
-Channel Protonmail
-    Far :protonmail-remote:
-    Near :protonmail-local:
-    Patterns *
-    Create Both
-    Expunge Both
-    SyncState *

ansible/templates/desktop/.msmtprc.j2

@@ -1,51 +0,0 @@
-# Set default values for all following accounts.
-defaults
-
-# Always use TLS
-tls            on
-
-# Set a list of trusted CAs for TLS. The default is to use system settings,
-# but you can select your own file.
-tls_trust_file /etc/ssl/certs/ca-certificates.crt
-logfile        ~/.cache/msmtp.log
-
-# Account iCloud
-account        icloud
-
-# Host name of the SMTP server
-host           smtp.mail.me.com
-
-# Use the mail submission port 587 instead of the SMTP port 25
-port           587
-
-# Envelop-from address
-from           {{ vault_icloud_email }}
-
-# Authentication. The password is given using one of five methods
-auth           on
-user           {{ vault_icloud_email }}
-passwordeval   "secret-tool lookup icloud-mail icloud"
-
-# Account Protonmail
-account        protonmail
-
-# Hostname of the Protonmail bridge
-host           127.0.0.1
-
-# Port of the Protonmail bridge
-port           1025
-
-# Envelop-from address
-from           {{ vault_protonmail_email }}
-
-# Security
-tls on
-tls_trust_file {{ desktop_protonmail_bridge_cert_path }}
-
-# Authentication
-auth           on
-user           {{ vault_protonmail_email }}
-passwordeval   "secret-tool lookup protonmail-bridge protonmail"
-
-# Set a default account
-account default : icloud

ansible/templates/desktop/email.el.j2

@@ -1,53 +0,0 @@
-;;; email.el -*-
-
-(use-package mu4e
-  :ensure nil
-  :load-path "/usr/share/emacs/site-lisp/mu4e/"
-  :defer 20 ; Wait until 20 seconds after startup
-  :config
-  ;; This is set to 't' to avoid mail syncing issues when using mbsync
-  (setq mu4e-change-filenames-when-moving t)
-
-  ;; Refresh mail using isync every 10 minutes
-  (setq mu4e-update-interval (* 10 60))
-  (setq mu4e-get-mail-command "~/.emacs.d/scripts/email_sync.sh")
-  (setq mu4e-maildir "~/Maildir")
-
-    ;; Configure email accounts
-  (setq mu4e-contexts
-        (list
-         ;; Protonmail Account
-         (make-mu4e-context
-          :name "Protonmail"
-          :match-func
-          (lambda (msg)
-            (when msg
-              (string-prefix-p "/ProtonMailAccount" (mu4e-message-field msg :maildir))))
-          :vars '((user-mail-address . "{{ vault_protonmail_email }}")
-                  (user-full-name . "{{ vault_personal_full_name }}")
-                  (mu4e-drafts-folder . "/ProtonMailAccount/Drafts")
-                  (mu4e-sent-folder . "/ProtonMailAccount/Sent")
-                  (mu4e-refile-folder . "/ProtonMailAccount/All Mail")
-                  (mu4e-trash-folder . "/ProtonMailAccount/Trash")))
-
-         ;; iCloud Account
-         (make-mu4e-context
-          :name "iCloud Mail"
-          :match-func
-          (lambda (msg)
-            (when msg
-              (string-prefix-p "/iCloudAccount" (mu4e-message-field msg :maildir))))
-          :vars '((user-mail-address . "{{ vault_icloud_email }}")
-                  (user-full-name . "{{ vault_personal_full_name }}")
-                  (mu4e-drafts-folder . "/iCloudAccount/Drafts")
-                  (mu4e-sent-folder . "/iCloudAccount/Sent Messages")
-                  (mu4e-refile-folder . "/iCloudAccount/INBOX")
-                  (mu4e-trash-folder . "/iCloudAccount/Junk")))))
-
-  (setq sendmail-program "/usr/bin/msmtp"
-      mail-user-agent 'mu4e-user-agent
-      read-mail-command 'mu4e
-      send-mail-function 'sendmail-send-it
-      message-sendmail-f-is-evil t
-      message-sendmail-extra-arguments '("--read-envelope-from")
-      message-send-mail-function 'message-send-mail-with-sendmail))

ansible/templates/workstation/.gitconfig.j2

@@ -24,13 +24,19 @@
 
 [merge]
   conflictstyle = diff3
-  tool = meld
+  tool = vscode
 
 [mergetool]
   prompt = false
 
+[mergetool "vscode"]
+  cmd = code --reuse-window --wait $MERGED
+
 [diff]
-  tool = meld
+  tool = vscode
+
+[difftool "vscode"]
+  cmd = code --reuse-window --wait --diff $LOCAL $REMOTE
 
 [color]
   ui = always
@@ -81,3 +87,15 @@
   colorMoved = default
   tabs = 4
   side-by-side = true
+
+[http "https://gitlab.ecaas.datacenter.comune.roma"]
+  sslBackend = gnutls
+  sslCAInfo = ~/.local/share/certs/ecaas.datacenter.comune.roma.crt
+
+[http "https://gitlab.datacenter.comune.roma"]
+  sslBackend = gnutls
+  sslCAInfo = ~/.local/share/certs/datacenter.comune.roma.crt
+
+[credential]
+  helper = store
+

dotfiles/common/.bashrc

@@ -227,10 +227,31 @@ bind '"\e[5C": forward-word'
 bind '"\e[5D": backward-word'
 
 # =========================
-# fzf history on Ctrl-r
+# fzf: Ptyxis Linux Minimal
 # =========================
 
 if command -v fzf >/dev/null 2>&1; then
+  FZF_PTYXIS_LINUX_OPTS="
+    --layout=reverse
+    --border=rounded
+    --height=40%
+    --info=inline
+    --prompt='› '
+    --pointer='›'
+    --marker='✓'
+    --separator='─'
+    --scrollbar='│'
+    --color=bg:#000000,bg+:#000000,gutter:#000000
+    --color=fg:#d7d7d7,fg+:#ffffff,hl:#55ff55,hl+:#55ff55
+    --color=prompt:#55ff55,pointer:#5555ff,marker:#ffff55,spinner:#5555ff
+    --color=info:#808080,header:#808080,border:#303030
+  "
+  export FZF_DEFAULT_OPTS="${FZF_DEFAULT_OPTS:+$FZF_DEFAULT_OPTS }$FZF_PTYXIS_LINUX_OPTS"
+
+# =========================
+# fzf history on Ctrl-r
+# =========================
+
   __fzf_history() {
     local selected history_data
 
@@ -252,7 +273,7 @@ if command -v fzf >/dev/null 2>&1; then
       )"
     fi
 
-    selected="$(printf '%s\n' "$history_data" | fzf --height 40% --layout=reverse --border --prompt='history> ')" || return
+    selected="$(printf '%s\n' "$history_data" | fzf --prompt='history> ')" || return
 
     READLINE_LINE=$selected
     READLINE_POINT=${#READLINE_LINE}

dotfiles/common/.config/ai/knowledge/desktop.md

@@ -1,4 +1,4 @@
 # Desktop
 
-- i3 primary
-- XFCE components selectively
+- Wayland only: sway (SwayFX) and Hyprland
+- Hyprland is the default session

dotfiles/common/.vimrc

@@ -89,7 +89,7 @@ nnoremap <silent> <leader>h :set hlsearch!<CR>
 " ----------------------------------------------------------
 
 set updatetime=250
-set timeoutlen=400
+set timeoutlen=800
 set ttimeoutlen=10
 set shortmess+=c
 
@@ -149,6 +149,139 @@ endif
 nnoremap <silent> <leader>g :silent grep! <C-R><C-W> .<CR>:copen<CR>
 nnoremap          <leader>/ :silent grep!<Space>
 
+" ----------------------------------------------------------
+" Optional plugins
+" ----------------------------------------------------------
+
+" Plugins are installed out-of-band by Ansible when available.  Keep this
+" vimrc usable as a standalone onefile: load optional packages only when they
+" exist and keep builtin fallbacks for the mappings below.
+let s:fzf_min_version = [0, 54, 0]
+
+function! s:PackAdd(package) abort
+  silent! execute "packadd " . a:package
+endfunction
+
+function! s:PackAddForCommand(package, command) abort
+  if exists(":" . a:command) == 2
+    return 1
+  endif
+
+  call s:PackAdd(a:package)
+  return exists(":" . a:command) == 2
+endfunction
+
+function! s:PackAddByRuntimeFile(runtime_file, command) abort
+  if exists(":" . a:command) == 2
+    return 1
+  endif
+
+  " Distro packages and source installs do not always use the same Vim package
+  " directory name.  Look for a package containing the expected runtime file and
+  " load it by its actual directory name.
+  for l:packpath in split(&packpath, ",")
+    let l:packages = glob(l:packpath . "/pack/*/opt/*", 0, 1)
+          \ + glob(l:packpath . "/pack/*/start/*", 0, 1)
+    for l:package_dir in l:packages
+      if filereadable(l:package_dir . "/" . a:runtime_file)
+        call s:PackAdd(fnamemodify(l:package_dir, ":t"))
+        if exists(":" . a:command) == 2
+          return 1
+        endif
+      endif
+    endfor
+  endfor
+
+  return 0
+endfunction
+
+let s:has_fzf = s:PackAddForCommand("fzf", "FZF")
+      \ || s:PackAddByRuntimeFile("plugin/fzf.vim", "FZF")
+let s:has_fzf_vim = s:has_fzf
+      \ && (s:PackAddForCommand("fzf.vim", "Files")
+      \     || s:PackAddByRuntimeFile("autoload/fzf/vim.vim", "Files"))
+let s:has_vim_fugitive = s:PackAddForCommand("vim-fugitive", "Git")
+      \ || s:PackAddByRuntimeFile("autoload/fugitive.vim", "Git")
+
+function! s:FzfExecutable() abort
+  if executable("fzf")
+    return "fzf"
+  endif
+
+  return ""
+endfunction
+
+function! s:FzfVersionOk() abort
+  let l:fzf = s:FzfExecutable()
+  if empty(l:fzf)
+    return 0
+  endif
+
+  let l:version = matchstr(get(systemlist(l:fzf . " --version"), 0, ""), '^\d\+\.\d\+\.\d\+')
+  if empty(l:version)
+    return 0
+  endif
+
+  let l:parts = map(split(l:version, '\.'), 'str2nr(v:val)')
+  return l:parts[0] > s:fzf_min_version[0]
+        \ || (l:parts[0] == s:fzf_min_version[0] && l:parts[1] > s:fzf_min_version[1])
+        \ || (l:parts[0] == s:fzf_min_version[0] && l:parts[1] == s:fzf_min_version[1]
+        \     && l:parts[2] >= s:fzf_min_version[2])
+endfunction
+
+if s:has_fzf_vim && s:FzfVersionOk()
+  let g:fzf_layout = {"down": "40%"}
+  let g:fzf_colors = {
+        \ "fg": ["fg", "Normal"],
+        \ "bg": ["bg", "Normal"],
+        \ "hl": ["fg", "Search"],
+        \ "fg+": ["fg", "Normal"],
+        \ "bg+": ["bg", "Normal"],
+        \ "hl+": ["fg", "Search"],
+        \ "info": ["fg", "Comment"],
+        \ "prompt": ["fg", "String"],
+        \ "pointer": ["fg", "Statement"],
+        \ "marker": ["fg", "WarningMsg"],
+        \ "spinner": ["fg", "Statement"],
+        \ "header": ["fg", "Comment"],
+        \ }
+  let g:fzf_vim = get(g:, "fzf_vim", {})
+  let g:fzf_vim.preview_window = ["right,50%", "ctrl-/"]
+endif
+
+function! s:FzfCommand(command) abort
+  if s:has_fzf_vim && s:FzfVersionOk() && exists(":" . a:command) == 2
+    execute a:command
+  elseif a:command ==# "Files" || a:command ==# "GFiles" || a:command ==# "GitFiles"
+    edit .
+  elseif a:command ==# "Buffers"
+    ls
+  elseif a:command ==# "Rg"
+    silent grep! <cword> .
+    copen
+  endif
+endfunction
+
+function! s:GitStatus() abort
+  if s:has_vim_fugitive && exists(":Git") == 2
+    Git
+  elseif executable("git")
+    botright new
+    setlocal buftype=nofile bufhidden=wipe noswapfile nobuflisted
+    silent read !git status --short --branch
+    1delete _
+    file git-status
+  else
+    echohl WarningMsg | echom "git executable not found" | echohl None
+  endif
+endfunction
+
+nnoremap <silent> <leader>ff :call <SID>FzfCommand("Files")<CR>
+nnoremap <silent> <leader>fg :call <SID>FzfCommand("GFiles")<CR>
+nnoremap <silent> <leader>fb :call <SID>FzfCommand("Buffers")<CR>
+nnoremap <silent> <leader>fr :call <SID>FzfCommand("Rg")<CR>
+nnoremap <silent> <leader>gs :call <SID>GitStatus()<CR>
+
 " ----------------------------------------------------------
 " Quickfix / location list
 " ----------------------------------------------------------

dotfiles/common/.vimrc.shortcuts.md

@@ -0,0 +1,102 @@
+# Vim shortcuts
+
+Configurazione sorgente: `.vimrc`.
+
+- Leader: `Space`
+- Local leader: `\\`
+- Le shortcut sotto sono pensate per normal mode, salvo dove indicato.
+- `timeoutlen` è impostato a `800 ms`: premi le sequenze con leader senza aspettare troppo.
+
+## Base
+
+| Shortcut | Azione |
+|---|---|
+| `Space l` | Toggle caratteri invisibili / whitespace |
+| `Space h` | Toggle evidenziazione ricerca |
+| `Space w` | Salva file corrente |
+| `Space q` | Chiudi finestra corrente |
+| `Space x` | Salva e chiudi |
+| `Space z` | Toggle fold sotto il cursore |
+
+## Ricerca
+
+| Shortcut | Azione |
+|---|---|
+| `Space g` | Cerca la parola sotto il cursore nel progetto e apre quickfix |
+| `Space /` | Avvia `:grep!` manuale |
+
+## FZF / file / Git
+
+Queste shortcut usano `fzf.vim` quando disponibile; altrimenti cadono su fallback portabili.
+
+| Shortcut | Azione |
+|---|---|
+| `Space ff` | `:Files`, fallback `:edit .` |
+| `Space fg` | `:GFiles`, fallback `:edit .` |
+| `Space fb` | `:Buffers`, fallback `:ls` |
+| `Space fr` | `:Rg`, fallback `:grep! <cword> .` + quickfix |
+| `Space gs` | `:Git` con vim-fugitive, fallback buffer con `git status` |
+
+## Quickfix e location list
+
+| Shortcut | Azione |
+|---|---|
+| `]q` | Prossimo elemento quickfix |
+| `[q` | Precedente elemento quickfix |
+| `Space qo` | Apri quickfix |
+| `Space qc` | Chiudi quickfix |
+| `]l` | Prossimo elemento location list |
+| `[l` | Precedente elemento location list |
+| `Space lo` | Apri location list |
+| `Space lc` | Chiudi location list |
+
+## Finestre
+
+| Shortcut | Azione |
+|---|---|
+| `Ctrl h` | Vai alla finestra a sinistra |
+| `Ctrl j` | Vai alla finestra sotto |
+| `Ctrl k` | Vai alla finestra sopra |
+| `Ctrl l` | Vai alla finestra a destra |
+
+## Diff
+
+| Shortcut | Azione |
+|---|---|
+| `Space df` | Attiva diff su tutte le finestre |
+| `Space do` | Disattiva diff su tutte le finestre |
+
+## Tags e preview
+
+| Shortcut | Azione |
+|---|---|
+| `Space t` | Vai al tag della parola sotto il cursore |
+| `Space pt` | Apri il tag in preview window |
+| `Space po` | Apri preview window |
+| `Space pc` | Chiudi preview window |
+| `K` | Apri la man page della parola sotto il cursore |
+
+## Cscope
+
+Disponibili solo se Vim ha supporto `cscope`.
+
+| Shortcut | Azione |
+|---|---|
+| `Space cs` | Cerca simbolo |
+| `Space cg` | Cerca definizione |
+| `Space cd` | Cerca funzioni chiamate dal simbolo |
+| `Space cc` | Cerca chiamanti |
+| `Space ct` | Cerca testo |
+| `Space ce` | Cerca egrep |
+| `Space ci` | Cerca include |
+
+Nota: `Space cf` è riservato a ClangFormat, quindi non usarlo per cscope file search.
+
+## Format, build e run
+
+| Shortcut | Modo | Azione |
+|---|---|---|
+| `Space cf` | normal | Esegue `clang-format` sul file |
+| `Space cf` | visual | Esegue `clang-format` sulla selezione |
+| `Space m` | normal | Build smart: `ninja`, `cmake --build build`, `make -C <root>` o `make` |
+| `Space r` | normal | Salva ed esegue il file corrente; supporta C, Python e shell |

dotfiles/desktop/.bashrc.d/20-editor-desktop.sh

@@ -1,2 +1,2 @@
 export EDITOR=vim
-export VISUAL=emacs
+export VISUAL=vim

dotfiles/desktop/.config/Thunar/uca.xfce.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<actions>
+  <action>
+    <icon>utilities-terminal</icon>
+    <name>Open Terminal Here</name>
+    <submenu></submenu>
+    <unique-id>xfce-open-terminal-here</unique-id>
+    <command>xfce4-terminal --working-directory %f</command>
+    <description>Open xfce4-terminal in this directory</description>
+    <range></range>
+    <patterns>*</patterns>
+    <startup-notify/>
+    <directories/>
+  </action>
+</actions>

dotfiles/desktop/.config/dunst/dunstrc

@@ -8,7 +8,7 @@ height = (0, 120)
 origin = top-right
 offset = (20, 40)
 
-font = LiterationMono Nerd Font 10
+font = NotoSans NF 10
 line_height = 2
 
 padding = 12

dotfiles/desktop/.config/foot/foot.ini

@@ -0,0 +1,5 @@
+[main]
+font = Liberation Mono:size=14
+
+[colors-dark]
+background = 000000

dotfiles/desktop/.config/gtklock/config.ini

@@ -0,0 +1 @@
+[main]

dotfiles/desktop/.config/gtklock/style.css

@@ -0,0 +1,49 @@
+* {
+    font-family: "NotoSans NF", sans-serif;
+    color: #FFE81F;
+}
+
+window {
+    background-color: #00000A;
+}
+
+box {
+    background-color: transparent;
+}
+
+entry {
+    background-color: rgba(0, 0, 10, 0.6);
+    color: #FFE81F;
+    border: 1px solid #FFE81F;
+    border-radius: 0;
+    padding: 8px 16px;
+    caret-color: #FFE81F;
+    min-width: 320px;
+    font-weight: bold;
+    font-style: italic;
+}
+
+entry > text {
+    color: #FFE81F;
+}
+
+entry:focus {
+    border-color: #FFE81F;
+    box-shadow: 0 0 8px rgba(255, 232, 31, 0.5);
+}
+
+entry.error {
+    border-color: #c7162b;
+    box-shadow: 0 0 8px rgba(199, 22, 43, 0.6);
+    color: #c7162b;
+}
+
+label {
+    color: #FFE81F;
+    font-weight: bold;
+    font-style: italic;
+}
+
+label.error {
+    color: #c7162b;
+}

dotfiles/desktop/.config/hypr/host.conf

@@ -0,0 +1,3 @@
+# Per-host Hyprland overrides. Empty by default; hosts that need tuning
+# ship their own version via host_hyprland_dotfiles, which overwrites this
+# placeholder during deploy.

dotfiles/desktop/.config/hypr/hypridle.conf

@@ -0,0 +1,11 @@
+general {
+  lock_cmd = pidof hyprlock || hyprlock
+  before_sleep_cmd = loginctl lock-session
+  after_sleep_cmd = hyprctl dispatch dpms on
+}
+
+listener {
+  timeout = 300
+  on-timeout = ~/.config/hypr/scripts/lock-and-dpms
+  on-resume = hyprctl dispatch dpms on
+}

dotfiles/desktop/.config/hypr/hyprland.conf

@@ -0,0 +1,227 @@
+# Hyprland config, aligned with the Sway desktop profile.
+
+$mod = SUPER
+$terminal = alacritty
+$browser = firefox
+
+monitor = ,preferred,auto,1
+
+env = XCURSOR_THEME,Yaru
+env = XCURSOR_SIZE,24
+
+input {
+  kb_layout = us
+  kb_variant = intl
+  follow_mouse = 0
+}
+
+cursor {
+  no_hardware_cursors = false
+}
+
+general {
+  gaps_in = 5
+  gaps_out = 20
+  border_size = 3
+  col.active_border = rgba(54d6ffff) rgba(1478ffff) 180deg
+  col.inactive_border = rgba(f5e6b899) rgba(8a8f9acc) 180deg
+  layout = master
+}
+
+decoration {
+  rounding = 8
+
+  blur {
+    enabled = true
+    size = 5
+    passes = 1
+  }
+
+  shadow {
+    enabled = true
+  }
+
+  dim_inactive = true
+  dim_strength = 0.1
+}
+
+animations {
+  enabled = true
+  bezier = easeOutQuint,0.23,1,0.32,1
+  animation = windows,1,2,easeOutQuint,popin 85%
+  animation = border,1,2,easeOutQuint
+  animation = fade,1,2,easeOutQuint
+  animation = workspaces,1,2,easeOutQuint,slide
+  animation = layers,1,2,easeOutQuint,fade
+}
+
+master {
+  new_status = slave
+  orientation = left
+}
+
+misc {
+  disable_hyprland_logo = true
+  disable_splash_rendering = true
+  force_default_wallpaper = 0
+  focus_on_activate = false
+}
+
+xwayland {
+  enabled = true
+}
+
+# Per-host overrides (terminal wrapper, env, monitors, workspace rules, etc.).
+source = ~/.config/hypr/host.conf
+
+# Window rules
+windowrule = float on, match:class (?i)(polkit)
+windowrule = float on, match:title ^Authentication Required$
+windowrule = float on, match:title ^Open File$
+windowrule = float on, match:title ^Save File$
+windowrule = float on, match:class (?i)(blueman-manager)
+windowrule = float on, match:class (?i)(nm-connection-editor)
+windowrule = float on, match:class (?i)(pinentry)
+windowrule = float on, match:class (?i)(firefox), match:title ^Library$
+windowrule = float on, match:class (?i)(firefox), match:title ^About Mozilla Firefox$
+windowrule = float on, match:class org.freedesktop.impl.portal.desktop.gtk
+windowrule = idle_inhibit fullscreen, match:fullscreen true
+windowrule = idle_inhibit focus, match:content 2
+
+# Autostart — XDG and session services
+exec-once = dbus-update-activation-environment DISPLAY WAYLAND_DISPLAY HYPRLAND_INSTANCE_SIGNATURE XDG_CURRENT_DESKTOP XDG_SESSION_TYPE XDG_SESSION_DESKTOP
+exec-once = env UPDATE_TURNSTILE_RESTART_EMACS=1 ~/.local/bin/update-turnstile-env
+exec-once = dex --autostart --environment Hyprland
+exec-once = gnome-keyring-daemon --start --components=secrets
+exec-once = ~/.local/bin/setup-gtk-theme
+exec-once = /usr/libexec/xdg-desktop-portal
+exec-once = /usr/libexec/xdg-desktop-portal-hyprland
+exec-once = /usr/libexec/xdg-desktop-portal-gtk
+
+# Audio/session services
+exec-once = pipewire
+exec-once = pipewire-pulse
+exec-once = wireplumber
+
+# Desktop services
+exec-once = hyprctl setcursor Yaru 24
+exec-once = hyprpaper
+exec-once = sleep 1 && waybar -c ~/.config/waybar/hyprland.jsonc -s ~/.config/waybar/hyprland-style.css
+exec-once = swayosd-server
+exec-once = dunst
+exec-once = hyprpolkitagent
+exec-once = nm-applet
+exec-once = blueman-applet
+exec-once = udiskie
+exec-once = hypridle
+
+# Clipboard manager
+exec-once = wl-paste --type text --watch cliphist store
+exec-once = wl-paste --type image --watch cliphist store
+
+# Applications
+bind = $mod, Return, exec, $terminal
+bind = $mod SHIFT, Return, exec, foot
+bind = $mod SHIFT, E, exec, emacsclient -c -n
+bind = $mod, D, exec, rofi -show drun -theme ~/.config/rofi/config.rasi
+bind = $mod, C, exec, cliphist list | rofi -dmenu -theme ~/.config/rofi/config.rasi | cliphist decode | wl-copy
+bind = $mod SHIFT, V, exec, pavucontrol
+bind = $mod SHIFT, F, exec, thunar
+bind = $mod SHIFT, D, exec, dunstctl set-paused toggle
+bind = $mod SHIFT, X, exec, ~/.config/hypr/scripts/lock-and-dpms
+bind = $mod SHIFT, Q, killactive
+
+# Screenshots (Hyprland-native: grim/slurp/wl-copy; Flameshot is unstable here)
+bind = , Print, exec, ~/.config/hypr/scripts/screenshot region
+bind = SHIFT, Print, exec, ~/.config/hypr/scripts/screenshot full
+bind = ALT, Print, exec, ~/.config/hypr/scripts/screenshot output
+
+# Focus
+bind = $mod, H, movefocus, l
+bind = $mod, J, movefocus, d
+bind = $mod, K, movefocus, u
+bind = $mod, L, movefocus, r
+bind = $mod, left, movefocus, l
+bind = $mod, down, movefocus, d
+bind = $mod, up, movefocus, u
+bind = $mod, right, movefocus, r
+
+# Move windows
+bind = $mod SHIFT, H, movewindow, l
+bind = $mod SHIFT, J, movewindow, d
+bind = $mod SHIFT, K, movewindow, u
+bind = $mod SHIFT, L, movewindow, r
+bind = $mod SHIFT, left, movewindow, l
+bind = $mod SHIFT, down, movewindow, d
+bind = $mod SHIFT, up, movewindow, u
+bind = $mod SHIFT, right, movewindow, r
+
+# Layouts / floating
+bind = $mod, F, fullscreen
+bind = $mod SHIFT, Space, togglefloating
+bind = $mod, Space, cyclenext
+bind = $mod, A, layoutmsg, swapwithmaster
+bindm = $mod, mouse:272, movewindow
+bindm = $mod, mouse:273, resizewindow
+
+# Scratchpad-like special workspace
+bind = $mod SHIFT, minus, movetoworkspace, special
+bind = $mod, minus, togglespecialworkspace
+
+# Volume / brightness / media
+bind = , XF86AudioRaiseVolume, exec, swayosd-client --output-volume raise
+bind = , XF86AudioLowerVolume, exec, swayosd-client --output-volume lower
+bind = , XF86AudioMute, exec, swayosd-client --output-volume mute-toggle
+bind = , XF86AudioMicMute, exec, swayosd-client --input-volume mute-toggle
+bind = , XF86MonBrightnessUp, exec, swayosd-client --brightness raise
+bind = , XF86MonBrightnessDown, exec, swayosd-client --brightness lower
+bind = , XF86AudioPlay, exec, playerctl play-pause
+bind = , XF86AudioNext, exec, playerctl next
+bind = , XF86AudioPrev, exec, playerctl previous
+
+# Workspaces
+bind = $mod, 1, workspace, 1
+bind = $mod, 2, workspace, 2
+bind = $mod, 3, workspace, 3
+bind = $mod, 4, workspace, 4
+bind = $mod, 5, workspace, 5
+bind = $mod, 6, workspace, 6
+bind = $mod, 7, workspace, 7
+bind = $mod, 8, workspace, 8
+bind = $mod, 9, workspace, 9
+bind = $mod, 0, workspace, 10
+bind = $mod, comma, exec, ~/.config/hypr/scripts/workspace-cycle prev
+bind = $mod, period, exec, ~/.config/hypr/scripts/workspace-cycle next
+
+bind = $mod SHIFT, 1, movetoworkspace, 1
+bind = $mod SHIFT, 2, movetoworkspace, 2
+bind = $mod SHIFT, 3, movetoworkspace, 3
+bind = $mod SHIFT, 4, movetoworkspace, 4
+bind = $mod SHIFT, 5, movetoworkspace, 5
+bind = $mod SHIFT, 6, movetoworkspace, 6
+bind = $mod SHIFT, 7, movetoworkspace, 7
+bind = $mod SHIFT, 8, movetoworkspace, 8
+bind = $mod SHIFT, 9, movetoworkspace, 9
+bind = $mod SHIFT, 0, movetoworkspace, 10
+
+# Reload / exit
+bind = $mod SHIFT, C, exec, hyprctl reload
+bind = $mod SHIFT, R, exec, hyprctl reload
+bind = $mod SHIFT, BackSpace, exit
+bind = $mod SHIFT, Escape, exec, ~/.config/hypr/scripts/powermenu.sh
+
+# Resize submap
+bind = $mod, R, submap, resize
+submap = resize
+bind = , H, resizeactive, -10 0
+bind = , J, resizeactive, 0 10
+bind = , K, resizeactive, 0 -10
+bind = , L, resizeactive, 10 0
+bind = , left, resizeactive, -10 0
+bind = , down, resizeactive, 0 10
+bind = , up, resizeactive, 0 -10
+bind = , right, resizeactive, 10 0
+bind = , Return, submap, reset
+bind = , Escape, submap, reset
+bind = $mod, R, submap, reset
+submap = reset

dotfiles/desktop/.config/hypr/hyprlock.conf

@@ -0,0 +1,98 @@
+general {
+  hide_cursor = true
+  immediate_render = true
+  fail_timeout = 1800
+}
+
+background {
+  monitor =
+  path = ~/.config/hypr/wallpapers/maxresdefault.jpg
+  blur_passes = 1
+  blur_size = 3
+  brightness = 0.55
+  contrast = 0.95
+  vibrancy = 0.18
+  vibrancy_darkness = 0.08
+}
+
+shape {
+  monitor =
+  size = 560, 360
+  color = rgba(06070dcc)
+  rounding = 24
+  border_size = 2
+  border_color = rgba(f5c542ee)
+  shadow_passes = 2
+  shadow_size = 10
+  shadow_color = rgba(00000099)
+  position = 0, -5
+  halign = center
+  valign = center
+}
+
+label {
+  monitor =
+  text = $TIME
+  color = rgba(f5c542ff)
+  font_size = 78
+  font_family = Noto Sans
+  shadow_passes = 2
+  shadow_size = 4
+  shadow_color = rgba(000000cc)
+  position = 0, 105
+  halign = center
+  valign = center
+}
+
+label {
+  monitor =
+  text = cmd[update:60000] date '+%A %d %B %Y'
+  color = rgba(e6d3a3ee)
+  font_size = 18
+  font_family = Noto Sans
+  shadow_passes = 1
+  shadow_size = 3
+  shadow_color = rgba(000000bb)
+  position = 0, 20
+  halign = center
+  valign = center
+}
+
+label {
+  monitor =
+  text = $USER
+  color = rgba(d7d7d7ee)
+  font_size = 16
+  font_family = Noto Sans
+  shadow_passes = 1
+  shadow_size = 3
+  shadow_color = rgba(000000bb)
+  position = 0, -24
+  halign = center
+  valign = center
+}
+
+input-field {
+  monitor =
+  size = 360, 54
+  outline_thickness = 2
+  dots_size = 0.25
+  dots_spacing = 0.20
+  dots_center = true
+  rounding = -1
+  outer_color = rgba(f5c542ee)
+  inner_color = rgba(11131bdd)
+  font_color = rgba(f5c542ff)
+  check_color = rgba(4a90d9ff)
+  fail_color = rgba(c7162bff)
+  capslock_color = rgba(ffd166ff)
+  placeholder_text = <i>Access code</i>
+  fail_text = <i>Access denied <b>($ATTEMPTS)</b></i>
+  fade_on_empty = false
+  shadow_passes = 2
+  shadow_size = 6
+  shadow_color = rgba(000000aa)
+  position = 0, -90
+  halign = center
+  valign = center
+}