Verify WireGuard handshakes and restore Podman networking

AGENTS.md

@@ -48,8 +48,6 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
   - Rocky server after activation: `ansible-playbook ansible/site.yml --limit <host> --check --diff`
   - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff`
   - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
-  - Aegis NFS client layer: `ansible-playbook ansible/site.yml --limit aegis --tags nfs --list-tasks`
-  - Aegis host DNS: `ansible-playbook ansible/site.yml --limit aegis --tags dns --check --diff`
 - Focused checks:
   - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
   - AI coding agents: `ansible-playbook ansible/site.yml --limit <host> --tags ai_agents --check --diff`
@@ -170,24 +168,19 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
   service ports only in the WireGuard firewalld zone.
 
 ## Atlas NAS TODO
-Completed validation: the existing RAIDZ2 pool and datasets, SELinux, LAN firewall, SSH, Cockpit with
-the selected 45Drives plugins, encrypted SMB3 `Archive`, the Aegis-only NFSv4 `photobook` export, and
-the Prometheus--Atlas WireGuard path are operational. Aegis has validated NFSv4.2 read, write, delete,
-and `all_squash` mapping to UID/GID `1100` end-to-end.
-- Complete the Phase 1 Navidrome cutover: stop the Prometheus writer, copy and verify its complete
-  `/opt/navidrome/data/` directory (including SQLite sidecars) under
-  `/zpool/archive/app_data/navidrome/`, then set `backend_phase1_start_services: true` and validate
-  Navidrome on Atlas through WireGuard. Do not delete the source until a restore test succeeds.
-- Start and validate the rendered Syncthing Quadlet only after its device IDs, star topology, folders,
-  folder modes, ignore rules, and GUI/API protection are declared. Validate its GUI and native transfer
-  ports through WireGuard only.
-- Decide whether a common SMB/NFS namespace is required. `Archive` (SMB) and `photobook` (NFS) are
-  intentionally distinct today; only if a shared namespace is selected, finalize its UID/GID, group,
-  and POSIX ACL model and test the same files through both protocols.
-- Keep `atlas_manage_media_stack` disabled until the future Immich deployment has validated `/dev/dri`,
-  container paths, and the required Vault database secret.
+- Provide the required Vault variables and validate the first remote bootstrap on the real Rocky Linux 9 host.
+  Before the first apply, confirm the pool, mountpoints, LAN subnet and firewalld zone. Keep
+  `atlas_manage_media_stack` disabled until `/dev/dri`, the container paths and the Immich database secret are validated.
+- Validate the complete baseline on the target: OpenZFS kmod loading, existing pool import, dataset
+  mounts, SSH reconnect, Cockpit and all selected 45Drives plugins, NFSv4, SMB and Syncthing.
+- Finalize dataset properties and the shared UID/GID, group and POSIX ACL model; test the same files
+  through both NFS and SMB before considering multiprotocol access complete.
 - Add Ansible-managed ZFS snapshot retention and scrub timers. Use Cockpit Scheduler for visibility
   or manual operations, not as the only source of configuration, and never automate snapshot rollback.
+- Manage the Syncthing star topology, device IDs, folders, folder modes, ignore rules and protected GUI
+  or API access for the selected clients.
+- Validate the managed WireGuard path and its LAN/VPN-only firewalld rules before enabling remote services;
+  never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding.
 - Add the Atlas-initiated least-privilege Prometheus backup pull: Prometheus exposes only prepared
   read-only dumps through a dedicated account and Atlas retains the private SSH key, pinned host key,
   atomic pull, verification, retention and systemd service/timer.
@@ -200,9 +193,8 @@ and `all_squash` mapping to UID/GID `1100` end-to-end.
   failed backup timers, plus a controlled Rocky kernel/OpenZFS update and reboot procedure.
 - Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore
   from snapshot/USB/Hetzner, preserve Vault and Borg recovery material offline, and define RPO/RTO.
-- Optionally design iCloud photo ingestion and an Aegis persistent NFS mount as a separate workflow
-  after the storage and backup layers are validated; do not make either a dependency of the Atlas
-  baseline.
+- Optionally design iCloud photo ingestion as a separate workflow after the storage and backup layers
+  are validated; do not make it a dependency of the Atlas baseline.
 
 ## Coding Agent Notes
 - Shared agent definitions and lifecycle flags live in `ai_agents` in `ansible/inventory/group_vars/all.yml`.
@@ -229,18 +221,14 @@ and `all_squash` mapping to UID/GID `1100` end-to-end.
 - `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with
   `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH.
 - Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
-- `profile_aegis` owns the `nfs-utils` rpm-ostree layer used as the Atlas NFS client and reports the
-  required reboot without initiating it. It also owns rootful Podman Quadlets, persistent container
-  state under `/var/lib`, the Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
-  `aegis_lan_subnet`, `aegis_adguard_web_port`, and `aegis_network_connection_uuid` host-specific;
-  SSH permits only the declared
+- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, the
+  Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
+  `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared
   key-authenticated users, never root or password authentication. Keep Apple IDs and other
   credentials in Vault and use `no_log` for their rendering.
 - `aegis_adguard_web_port` defaults to `80`. The initial AdGuard Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
   completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before
   AdGuard binds port 53; keep
-  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf`. LAN clients may use AdGuard, but
-  Aegis must use the independent upstream DNS declared by `aegis_host_dns_servers` so Greenboot does
-  not depend on the AdGuard container during startup.
+  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS.
 - iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is
   persisted in `/var/lib/icloudpd/config`.

README.md

@@ -63,10 +63,6 @@ nymph is allowed to break
 
 `ikaros` is the stable personal Fedora/GNOME desktop. `nymph` is the laptop and gets the same shared desktop dotfiles while GNOME itself stays close to the Fedora defaults. The legacy `void` and `desktop` groups are compatibility parents; the main axes are `platform_*`, `role_*`, and `desktop_*`.
 
-The official ChatGPT desktop RPM is enabled only on `ikaros` and `nymph`. The
-playbook configures OpenAI's signed RPM repository and imports its pinned RPM
-signing key before installation; subsequent updates are handled by DNF.
-
 ## Desktop profiles
 
 - `ikaros`: stable Fedora Workstation + GNOME desktop.
@@ -193,17 +189,12 @@ ansible/bootstrap/generate-aegis-ign.sh --write IMAGE DEVICE
 The controller manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is
 intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard
 Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted
-firewalld rules, SSH key-only access for `pi`, the `nfs-utils` rpm-ostree layer required by the
-Atlas NFS client, and `wake-ikaros`. A new layered package deployment requires a manual reboot; the
-role reports this condition but never reboots Aegis automatically. Set the host-local
-`aegis_lan_subnet`, `aegis_adguard_web_port`, and `aegis_network_connection_uuid` values before
-applying it. The playbook permits
+firewalld rules, SSH key-only access for `pi`, and `wake-ikaros`. Set the host-local
+`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The playbook permits
 AdGuard Home HTTP on port `80`; the initial wizard port `3000` is intentionally unmanaged and must be
 opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS
-stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53 for AdGuard. LAN clients
-may use AdGuard on Aegis, while Aegis itself uses the independent upstream DNS declared by
-`aegis_host_dns_servers`; this prevents Greenboot from depending on the AdGuard container during
-startup. Reboot Aegis after changing its NetworkManager DNS profile. Define
+stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53
+for AdGuard while retaining DNS learned from the router. Define
 `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA
 initialization after its first deployment.
 
@@ -218,21 +209,6 @@ ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit aegis --check --diff --ask-become-pass
 ```
 
-Apply only the independent host DNS configuration, then reboot Aegis manually:
-
-```bash
-ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit aegis --tags dns --ask-become-pass
-```
-
-Layer the Atlas NFS client package independently, then reboot Aegis manually when the role reports
-that the new deployment is ready:
-
-```bash
-ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-ansible-playbook ansible/site.yml --limit aegis --tags nfs --ask-become-pass
-```
-
 ## NAS
 
 `atlas` is a Rocky Linux 9 NAS reached through SSH. Normally its pool already exists and the profile
@@ -358,10 +334,9 @@ ansible-playbook ansible/site.yml --limit <host> --tags emacs -e emacs_enabled=t
 ## AI coding agents
 
 The shared npm-managed agents are OpenCode, Claude Code, Codex, Gemini CLI, and
-GitHub Copilot; IBM Bob is also managed on `deadalus`. Codex Relay is installed
-only on `ikaros`. Each agent has its own lifecycle flags in
-`ansible/inventory/group_vars/all.yml`, so one agent can be installed,
-configured, or removed without affecting the others:
+GitHub Copilot; IBM Bob is also managed on `deadalus`. Each agent has its own
+lifecycle flags in `ansible/inventory/group_vars/all.yml`, so one agent can be
+installed, configured, or removed without affecting the others:
 
 ```yaml
 ai_agents:

ansible/inventory/group_vars/all.yml

@@ -93,8 +93,6 @@ common_dotfiles:
 # AI coding-agent lifecycle controls are independent for every agent.
 # Installation and removal are mutually exclusive per agent; the common
 # pre-task enforces this before any changes are made.
-codex_relay_install_enabled: false
-
 ai_agents:
   opencode:
     npm_package: opencode-ai
@@ -111,11 +109,6 @@ ai_agents:
     install_enabled: true
     deploy_enabled: true
     uninstall_enabled: false
-  codex_relay:
-    npm_package: codex-relay
-    install_enabled: "{{ codex_relay_install_enabled }}"
-    deploy_enabled: false
-    uninstall_enabled: false
   gemini_cli:
     npm_package: "@google/gemini-cli"
     install_enabled: true

ansible/inventory/group_vars/fedora.yml

@@ -58,13 +58,3 @@ fedora_dev_packages:
 
 fedora_flatpak_remote_name: flathub
 fedora_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
-
-chatgpt_desktop_enabled: false
-chatgpt_desktop_supported_fedora_versions:
-  - "43"
-  - "44"
-chatgpt_desktop_supported_architectures:
-  - x86_64
-  - aarch64
-chatgpt_desktop_rpm_gpg_key: RPM-GPG-KEY-chatgpt-3BFA0E4AE8B8CC16A2D9BA684A3B4A566C4660E4.asc
-chatgpt_desktop_rpm_repository: https://persistent.oaistatic.com/codex-app-prod/linux/rpm/$basearch

ansible/inventory/group_vars/workstation_dev_wsl.yml

@@ -3,10 +3,6 @@ enabled_services:
   - docker
 
 workstation_dev_wsl_packages:
-  - buildah
-  - helm
-  # Fedora ships the kubectl client binary in the kubernetes-client package.
-  - kubernetes-client
   - mise
   - pinentry-curses
   - python3-pip

ansible/inventory/host_vars/aegis.yml

@@ -9,12 +9,6 @@ ansible_ssh_use_tty: false
 
 aegis_lan_subnet: 192.168.178.0/24
 aegis_adguard_web_port: 80
-aegis_network_connection_name: FRITZ!Box 7530 NR
-aegis_network_connection_uuid: a52fda3d-3eb6-351f-bf04-753edcb76944
-aegis_host_dns_servers:
-  - 192.168.178.1
-aegis_host_dns_search_domains:
-  - fritz.box
 aegis_ssh_authorized_keys:
   - name: ikaros
     key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"

ansible/inventory/host_vars/ikaros.yml

@@ -1,9 +1,6 @@
 ---
 hostname: ikaros
 
-codex_relay_install_enabled: true
-chatgpt_desktop_enabled: true
-
 host_packages:
   - openssh-clients
   - openssh-server
@@ -232,7 +229,7 @@ gnome_gsettings_settings:
   - schema: org.gnome.shell
     key: app-picker-layout
     value: >-
-      [{'System': <{'position': <0>}>, 'Utilities': <{'position': <1>}>, 'org.fedoraproject.MediaWriter.desktop': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Calendar.desktop': <{'position': <4>}>, 'org.gnome.Calculator.desktop': <{'position': <5>}>, 'org.gnome.Weather.desktop': <{'position': <6>}>, 'org.gnome.clocks.desktop': <{'position': <7>}>, 'org.gnome.Maps.desktop': <{'position': <8>}>, 'org.gnome.SimpleScan.desktop': <{'position': <9>}>, 'org.gnome.TextEditor.desktop': <{'position': <10>}>, 'org.gnome.Settings.desktop': <{'position': <11>}>, 'org.gnome.Boxes.desktop': <{'position': <12>}>, 'org.gnome.Showtime.desktop': <{'position': <13>}>, 'org.gnome.Snapshot.desktop': <{'position': <14>}>, 'org.gnome.Characters.desktop': <{'position': <15>}>, 'org.gnome.Tour.desktop': <{'position': <16>}>, 'org.gnome.Yelp.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>, 'be.alexandervanhee.gradia.desktop': <{'position': <19>}>, 'com.github.jeromerobert.pdfarranger.desktop': <{'position': <20>}>, 'org.onlyoffice.desktopeditors.desktop': <{'position': <21>}>, 'org.gnome.Meld.desktop': <{'position': <22>}>, 'com.mattjakeman.ExtensionManager.desktop': <{'position': <23>}>}, {'org.remmina.Remmina.desktop': <{'position': <0>}>, 'ch.protonmail.protonmail-bridge.desktop': <{'position': <1>}>, 'syncthing-start.desktop': <{'position': <2>}>, 'syncthing-ui.desktop': <{'position': <3>}>, 'emacs.desktop': <{'position': <4>}>, 'emacs-client.desktop': <{'position': <5>}>, 'org.gnome.gitlab.somas.Apostrophe.desktop': <{'position': <6>}>, 'mpv.desktop': <{'position': <7>}>, 'htop.desktop': <{'position': <8>}>, 'com.raspberrypi.rpi-imager.desktop': <{'position': <9>}>}]
+      [{'System': <{'position': <0>}>, 'Utilities': <{'position': <1>}>, 'org.fedoraproject.MediaWriter.desktop': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Calendar.desktop': <{'position': <4>}>, 'org.gnome.Calculator.desktop': <{'position': <5>}>, 'org.gnome.Weather.desktop': <{'position': <6>}>, 'org.gnome.clocks.desktop': <{'position': <7>}>, 'org.gnome.Maps.desktop': <{'position': <8>}>, 'org.gnome.SimpleScan.desktop': <{'position': <9>}>, 'org.gnome.TextEditor.desktop': <{'position': <10>}>, 'org.gnome.Settings.desktop': <{'position': <11>}>, 'org.gnome.Boxes.desktop': <{'position': <12>}>, 'org.gnome.Showtime.desktop': <{'position': <13>}>, 'org.gnome.Snapshot.desktop': <{'position': <14>}>, 'org.gnome.Characters.desktop': <{'position': <15>}>, 'org.gnome.Tour.desktop': <{'position': <16>}>, 'org.gnome.Yelp.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>, 'be.alexandervanhee.gradia.desktop': <{'position': <19>}>, 'com.github.jeromerobert.pdfarranger.desktop': <{'position': <20>}>, 'org.onlyoffice.desktopeditors.desktop': <{'position': <21>}>, 'org.gnome.Meld.desktop': <{'position': <22>}>, 'com.mattjakeman.ExtensionManager.desktop': <{'position': <23>}>}, {'org.remmina.Remmina.desktop': <{'position': <0>}>, 'ch.protonmail.protonmail-bridge.desktop': <{'position': <1>}>, 'syncthing-start.desktop': <{'position': <2>}>, 'syncthing-ui.desktop': <{'position': <3>}>, 'emacs.desktop': <{'position': <4>}>, 'emacs-client.desktop': <{'position': <5>}>, 'org.gnome.gitlab.somas.Apostrophe.desktop': <{'position': <6>}>, 'mpv.desktop': <{'position': <7>}>, 'htop.desktop': <{'position': <8>}>, 'org.mozilla.thunderbird.desktop': <{'position': <9>}>}]
   - schema: org.gnome.shell
     key: disabled-extensions
     value: >-
@@ -244,7 +241,7 @@ gnome_gsettings_settings:
   - schema: org.gnome.shell
     key: favorite-apps
     value: >-
-      ['org.gnome.Nautilus.desktop', 'org.mozilla.firefox.desktop', 'com.spotify.Client.desktop', 'org.gnome.Evolution.desktop', 'org.telegram.desktop.desktop', 'chatgpt.desktop', 'org.gnome.Ptyxis.desktop', 'virt-manager.desktop']
+      ['org.gnome.Nautilus.desktop', 'org.mozilla.firefox.desktop', 'com.spotify.Client.desktop', 'org.gnome.Evolution.desktop', 'org.telegram.desktop.desktop', 'org.gnome.Ptyxis.desktop', 'virt-manager.desktop']
   - schema: org.gnome.shell
     key: remember-mount-password
     value: "true"

ansible/inventory/host_vars/nymph.yml

@@ -1,8 +1,6 @@
 ---
 hostname: nymph
 
-chatgpt_desktop_enabled: true
-
 # Fedora Workstation/GNOME laptop target. GNOME is provided by the base Fedora
 # Workstation install; Ansible deploys shared desktop dotfiles but leaves GNOME
 # settings unmanaged for now.

ansible/roles/packages_fedora/files/RPM-GPG-KEY-chatgpt-3BFA0E4AE8B8CC16A2D9BA684A3B4A566C4660E4.asc

@@ -1,28 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGpypFUBEACi1Vvzq9pIpA6lj7chbqELuxJtVuzUzxrasa6ZU0yF4yhq7jf8
-3YkJRHwbezBKeQyzJ5lkX0EhXS8aXxUhMAm3PFpAlwcInfKzmV7atJwvaxIw6Rmd
-GYe9fBWKjTN/SmPIjtyxrTznZY97+TfD1AeGZpLaJ8fsnhrC+HkiN2TACiTocgpe
-hFiP0OWK7mWZeTWnY2scpIYXP1Ro7nQv4KacmY4JacTQ7m/HM0Qej/3olhuEv2Cw
-lMVWw57/oHhmTllfLDQOogFQyIVqaaR98y/Eu6cAabSfcsqAAZ2A8vfHYD27z28J
-vLO2PZEJd5ThlnX4Zqv0eIpZdBj//8Sl/MSqTshFZ1NDsRoqwdqw284X5MpnOJ4k
-4Sc2Se8tJxt/nCeibH3dJ504Fb1X/mnOqhCAQ6pVJz4RB5HRlFPSkxVPyag1v1m/
-7T4vie+OR4eqFQNz6mudrOoMmeVIfyL5fbe4cOr4fk/FyvEE2xMgkFatPqXn7vM9
-og+zremPCfwRAFpBPyX74VowFY7llcdaj/w8K5T8PzM14Hb3E4ZKizMluKmTvTq9
-WE1/eSQJLLQqXD5VmtmdUaC/VyE/1ZlIxcA1LWqvEQ327UXREvX/nHsrkKrl956W
-jzkiHFUTsD1NJ0dMfs+csOt8Furb5jZj+HsMmCm9jLdfz5b/4WKLPbvxIwARAQAB
-tBZDb2RleCBMaW51eCBSZXBvc2l0b3J5iQJRBBMBCgA7FiEEO/oOSui4zBai2bpo
-SjtKVmxGYOQFAmpypFUCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQ
-SjtKVmxGYORlCQ/9FyikZo8HQcJBP9E/oXVPds/fQnIFB2qJR2z3DrfYEonNt/ev
-SAySkPPq4/mEOjaI0pFlDDGSaps+FTcJFgoVRTasBIF7JJivvjW9ap8iWEbhhVLe
-IrFLbMLpUcTRntUx7R4fVMJ/1/cGn+NWZmNwS9ORorzSyCH0IAgCw1Xc3ZrjuMbF
-VjdToMC1TiXXCEmlYpQakmQ3Ay1cH0FHC2BBNn1MNVkJdPhpZIZCdhaMPHfYFpyo
-pg8wFvZ5iIcvlbMgyuy8CPJVRWUcYy2dOhEOGnYJnXRPkE3E1hf8YOHNzRlduH89
-6lT9qcEK2+fpLfrVGoc4zscLZ+Ey+Ko6iQRdVE1j67+wNR3hX8ukue574v1N/xxu
-i575jumSE19lEj1sH4+P4gFHOtTbF0JhKKzLctbga0IAwTPKhnt3qzj1U5Yj/MZS
-uEVjrLhdRauOuFBXUclgyVf2w/lE85UUOdlcollsYA6Huq7xDamqf8SslZQGre3E
-I+lhpqJR1cOwDMUzzcl40uTyhrxXXd/bk4QSlhZbwHR25Pnt+ZMtWavlQWS0eDEV
-8djuXAURCmx5WOqAFB/TJe1mn5EvyWg4VFzrY/NVNOpzgY5+Xp7J28z7f637r712
-Eu9j4imVcdPigwS+jf/0f81i2o9b82Y26TN8+EtDLCY841MJ1lrjDrX/dno=
-=Y+3h
------END PGP PUBLIC KEY BLOCK-----

ansible/roles/packages_fedora/tasks/main.yml

@@ -130,56 +130,6 @@
   loop_control:
     label: "{{ item.key }}"
 
-- name: Validate ChatGPT desktop architecture on Fedora
-  tags: [packages, chatgpt]
-  ansible.builtin.assert:
-    that:
-      - ansible_facts['architecture'] in chatgpt_desktop_supported_architectures
-      - ansible_facts['distribution_major_version'] in chatgpt_desktop_supported_fedora_versions
-    fail_msg: >-
-      ChatGPT desktop supports Fedora {{ chatgpt_desktop_supported_fedora_versions | join(' and ') }}
-      on x86_64 or aarch64; detected Fedora {{ ansible_facts['distribution_major_version'] }}
-      on {{ ansible_facts['architecture'] }}.
-  when: chatgpt_desktop_enabled | bool
-
-- name: Install ChatGPT desktop RPM signing key
-  tags: [packages, chatgpt]
-  ansible.builtin.copy:
-    src: "{{ chatgpt_desktop_rpm_gpg_key }}"
-    dest: "/etc/pki/rpm-gpg/{{ chatgpt_desktop_rpm_gpg_key }}"
-    owner: root
-    group: root
-    mode: "0644"
-  when: chatgpt_desktop_enabled | bool
-
-- name: Import ChatGPT desktop RPM signing key
-  tags: [packages, chatgpt]
-  ansible.builtin.rpm_key:
-    state: present
-    key: "/etc/pki/rpm-gpg/{{ chatgpt_desktop_rpm_gpg_key }}"
-  when: chatgpt_desktop_enabled | bool
-
-- name: Configure ChatGPT desktop RPM repository
-  tags: [packages, chatgpt]
-  ansible.builtin.yum_repository:
-    name: openai-chatgpt
-    description: ChatGPT
-    baseurl: "{{ chatgpt_desktop_rpm_repository }}"
-    enabled: true
-    gpgcheck: true
-    repo_gpgcheck: true
-    gpgkey: "file:///etc/pki/rpm-gpg/{{ chatgpt_desktop_rpm_gpg_key }}"
-    state: present
-  when: chatgpt_desktop_enabled | bool
-
-- name: Install ChatGPT desktop on selected Fedora hosts
-  tags: [packages, chatgpt]
-  ansible.builtin.dnf:
-    name: chatgpt
-    state: latest
-    update_cache: true
-  when: chatgpt_desktop_enabled | bool
-
 - name: Define Fedora Flatpak applications
   tags: [packages]
   ansible.builtin.set_fact:

ansible/roles/profile_aegis/defaults/main.yml

@@ -1,11 +1,5 @@
 ---
 aegis_hostname: aegis
-aegis_layered_packages:
-  - nfs-utils
-aegis_network_connection_name: ""
-aegis_network_connection_uuid: ""
-aegis_host_dns_servers: []
-aegis_host_dns_search_domains: []
 aegis_adguard_image: docker.io/adguard/adguardhome:latest
 aegis_icloudpd_image: docker.io/boredazfcuk/icloudpd:latest
 aegis_icloudpd_folder_structure: '{:%Y/%m/%d}'

ansible/roles/profile_aegis/tasks/main.yml

@@ -1,18 +1,4 @@
 ---
-- name: Manage Aegis layered packages
-  tags: [aegis, packages, nfs]
-  community.general.rpm_ostree_pkg:
-    name: "{{ aegis_layered_packages }}"
-    state: present
-  register: aegis_layered_packages_result
-  when: aegis_layered_packages | length > 0
-
-- name: Report reboot required for Aegis layered packages
-  tags: [aegis, packages, nfs]
-  ansible.builtin.debug:
-    msg: Reboot Aegis to activate the newly layered packages, then rerun the playbook.
-  when: aegis_layered_packages_result.needs_reboot | default(false)
-
 - name: Require Aegis iCloudPD Apple ID
   tags: [aegis, icloudpd]
   ansible.builtin.assert:
@@ -22,86 +8,15 @@
   no_log: true
 
 - name: Require completed Aegis network placeholders
-  tags: [aegis, dns, firewall, network, services]
+  tags: [aegis, firewall, services]
   ansible.builtin.assert:
     that:
       - aegis_lan_subnet != 'CHANGEME_LAN_SUBNET'
       - aegis_firewalld_zone | length > 0
       - aegis_adguard_web_port | int > 0
       - aegis_adguard_web_port | int < 65536
-      - aegis_network_connection_name | length > 0
-      - aegis_network_connection_uuid | length > 0
-      - aegis_host_dns_servers | length > 0
-      - ansible_facts["default_ipv4"]["address"] not in aegis_host_dns_servers
       - aegis_ssh_allowed_users | length > 0
-    fail_msg: >-
-      Define the Aegis LAN subnet, firewalld zone, AdGuard web port, independent host DNS,
-      NetworkManager connection, and SSH users. Aegis must not use its own address as upstream DNS.
-
-- name: Verify the declared Aegis NetworkManager connection exists
-  tags: [aegis, dns, network, services]
-  ansible.builtin.command:
-    argv:
-      - nmcli
-      - --get-values
-      - connection.id
-      - connection
-      - show
-      - uuid
-      - "{{ aegis_network_connection_uuid }}"
-  register: aegis_network_connection
-  changed_when: false
-  failed_when: >-
-    aegis_network_connection.rc != 0
-    or aegis_network_connection.stdout != aegis_network_connection_name
-
-- name: Read the current Aegis host DNS configuration
-  tags: [aegis, dns, network, services]
-  ansible.builtin.command:
-    argv:
-      - nmcli
-      - --get-values
-      - ipv4.ignore-auto-dns,ipv4.dns,ipv4.dns-search,ipv6.ignore-auto-dns
-      - connection
-      - show
-      - uuid
-      - "{{ aegis_network_connection_uuid }}"
-  register: aegis_host_dns_current
-  changed_when: false
-
-- name: Configure independent upstream DNS for the Aegis host
-  tags: [aegis, dns, network, services]
-  ansible.builtin.command:
-    argv:
-      - nmcli
-      - connection
-      - modify
-      - uuid
-      - "{{ aegis_network_connection_uuid }}"
-      - ipv4.ignore-auto-dns
-      - "yes"
-      - ipv4.dns
-      - "{{ aegis_host_dns_servers | join(',') }}"
-      - ipv4.dns-search
-      - "{{ aegis_host_dns_search_domains | join(',') }}"
-      - ipv6.ignore-auto-dns
-      - "yes"
-  register: aegis_host_dns_profile
-  when: >-
-    aegis_host_dns_current.stdout_lines !=
-    [
-      'yes',
-      aegis_host_dns_servers | join(','),
-      aegis_host_dns_search_domains | join(','),
-      'yes'
-    ]
-  changed_when: true
-
-- name: Report Aegis reboot required for host DNS changes
-  tags: [aegis, dns, network, services]
-  ansible.builtin.debug:
-    msg: Reboot Aegis to activate its independent upstream DNS before testing another OS update.
-  when: aegis_host_dns_profile.changed | default(false)
+    fail_msg: Define the Aegis LAN subnet, firewalld zone, AdGuard web port, and SSH users.
 
 - name: Set Aegis hostname
   tags: [aegis, services]