Share desktop tmux config with WSL

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Ansible-driven personal infrastructure repo for Void desktops, Linux Mint and FreeBSD transition targets, Linux workstations, WSL, and an Ubuntu server.
+Ansible-driven personal infrastructure repo for Fedora and Void desktops, Linux Mint and FreeBSD transition targets, WSL, and an Ubuntu server.
 
 ## Source Of Truth
 - Main orchestration: `ansible/site.yml`
@@ -11,10 +11,10 @@ Ansible-driven personal infrastructure repo for Void desktops, Linux Mint and Fr
 - Codex config is rendered from `dotfiles/common/.codex/config.toml.j2` so `model_instructions_file` points to the deployed `~/.config/ai/bootstrap.md`.
 
 ## Topology
-- Current Void desktops: `ikaros`, `nymph` via `platform_void + graphical_desktop`
-- Target model: `ikaros = platform_mint + role_personal_workstation + desktop_cinnamon`; `nymph = platform_freebsd + role_lab + desktop_hyprland`
-- Native Linux workstation: `deadalus-fedora`
-- WSL dev: `deadalus-wsl`
+- Current personal desktop: `ikaros = platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome`
+- Current laptop: `nymph = platform_fedora + graphical_desktop + desktop_gnome`
+- Void desktop profile is also the base for other future/reference hosts via `platform_void + graphical_desktop`
+- Workstation: `deadalus` is Windows + WSL; Ansible target is `deadalus-wsl`
 - Ubuntu server: `prometheus`
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
 - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
@@ -36,13 +36,12 @@ Ansible-driven personal infrastructure repo for Void desktops, Linux Mint and Fr
   - `ansible-lint ansible/roles`
   - `yamllint ansible/`
 - Host-focused dry runs:
-  - Current Void preservation: `ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff`
-  - Void desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff` or `--limit nymph --check --diff`
-  - Fedora workstation: `ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff`
+  - Fedora desktop work: `ansible-playbook ansible/site.yml --limit ikaros --check --diff`
+  - Fedora laptop work: `ansible-playbook ansible/site.yml --limit nymph --check --diff`
   - WSL dev: `ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
 - Focused checks:
-  - Emacs dotfiles only: `ansible-playbook ansible/site.yml --limit ikaros --tags emacs --check --diff` or `--limit nymph --tags emacs --check --diff`
+  - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
   - Mail bootstrap: `sh -n scripts/bootstrap_mail.sh` and `shellcheck scripts/bootstrap_mail.sh`
   - Server compose render: `docker compose -f /opt/docker/server/docker-compose.yml config`
 
@@ -55,18 +54,21 @@ Ansible-driven personal infrastructure repo for Void desktops, Linux Mint and Fr
 - Use `no_log: true` for secret-bearing task inputs or outputs.
 
 ## Desktop Notes
-- `desktop_profile` names independently selectable desktop groups such as `desktop_hyprland`, `desktop_sway`, and `desktop_cinnamon`. Keep platform-specific session bootstrap in platform-specific roles.
-- `desktop_environment` selects the mutually exclusive `minimal` (default), `xfce`, or `kde` desktop mode. `profile_desktop_common` owns shared bootstrap; the minimal mode uses `profile_desktop_sway` and `profile_desktop_hyprland`, `profile_desktop_xfce` owns the reproducible XFCE setup, and `profile_desktop_kde` owns KDE-specific defaults and cleanup. `desktop_sessions_enabled` and `desktop_default_session` apply only to the minimal mode.
-- `.emacs.d` is deployed by a dedicated `profile_desktop_common` task tagged `emacs`.
+- `desktop_profile` names independently selectable desktop groups such as `desktop_gnome`, `desktop_hyprland`, `desktop_sway`, `desktop_niri`, and `desktop_cinnamon`. Keep platform-specific session bootstrap in platform-specific roles.
+- `desktop_environment` selects the mutually exclusive `minimal` (default), `gnome`, `xfce`, or `kde` desktop mode. `profile_desktop_common` owns shared Void bootstrap; the minimal mode uses `profile_desktop_sway`, `profile_desktop_hyprland`, and `profile_desktop_niri`, `profile_desktop_xfce` owns the reproducible XFCE setup, `profile_desktop_kde` owns KDE-specific defaults and cleanup, and `profile_desktop_gnome` copies shared desktop dotfiles for Fedora/GNOME without managing GNOME settings. `desktop_sessions_enabled` and `desktop_default_session` apply only to the minimal mode.
+- Emacs packages and `.emacs.d` deploy are disabled by default via `emacs_enabled: false`; keep the dotfiles in the repo for reversible opt-in only.
 - NTFS filesystem support is provided by `ntfs-3g` in `ansible/inventory/group_vars/void.yml`.
 - Void user services are managed by `turnstile` and live under `dotfiles/desktop/.config/service/`.
 - `ssh-agent` keeps the stable socket `~/.local/state/ssh-agent/socket`.
 - Critical session entrypoints:
   - `dotfiles/desktop/.config/sway/config` plus `host.conf` and `session-env` deployed via `host_sway_dotfiles` (sway / Wayland)
   - `dotfiles/desktop/.config/hypr/hyprland.conf` plus `host.conf` and `session-env` deployed via `host_hyprland_dotfiles` (Hyprland / Wayland)
-- FreeBSD Hyprland must reuse common Hyprland dotfiles and keep FreeBSD-specific package, rc, DBus, seat, portal, and launcher behavior in `profile_desktop_hyprland_freebsd` or FreeBSD platform vars.
+  - `dotfiles/desktop/.config/niri/config.kdl` and `session-env` deployed via `desktop_niri_dotfiles` (Niri / Wayland)
+- Void Niri lives in `profile_desktop_niri`, gated on `'niri' in desktop_sessions_enabled`; it installs the `emptty` `niri.desktop` session, the `/usr/local/bin/start-niri` launcher, and the xdg-desktop-portal config, mirroring `profile_desktop_sway`.
+- Fedora GNOME (`desktop_gnome`) assumes GNOME comes from the Fedora Workstation base install; Ansible deploys shared desktop dotfiles and git/GPG config for `ikaros` and `nymph`, not GNOME settings.
+- FreeBSD Niri (dormant; `platform_freebsd` currently has no hosts) must keep FreeBSD-specific package, rc, DBus, seat, portal, and launcher behavior in `profile_desktop_niri_freebsd` or FreeBSD platform vars.
 - Do not switch or restart a display manager during a playbook run from an active graphical session. Changing among `emptty`, LightDM, and SDDM requires an explicit run from another TTY/SSH session with `desktop_allow_display_manager_switch=true`. Apply managed XFCE XML while logged out of XFCE so `xfconfd` cannot overwrite it from its in-memory state.
-- `nymph` is a Void laptop with NVIDIA Optimus, running sway (Wayland) and Hyprland (Wayland); host-specific tasks in `profile_desktop_host/tasks/nymph.yml` handle GRUB NVIDIA cmdline params, `prime-run` wrapper, and the WirePlumber camera priority config. Multi-monitor on sway is driven by `kanshi` (config deployed via `host_sway_dotfiles`), and on Hyprland by host-specific Hyprland monitor/workspace rules.
+- `nymph` is the Fedora/GNOME laptop target; keep GNOME settings unmanaged for now and add host-specific tuning only after real use.
 
 ## Void Package And Dotfile Bucket Rules
 `platform_void` is the reusable Void platform selection. The legacy `void` group remains a compatibility parent so existing `group_vars/void.yml` and `when: "'void' in group_names"` checks keep working during the transition.
@@ -79,8 +81,8 @@ The Void desktop package lists in `ansible/inventory/group_vars/void.yml` are ke
 The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-independent content, `desktop_minimal_dotfiles` carries Thunar, Udiskie, and minimal MIME defaults, and `desktop_xfce_dotfiles` carries XFCE state. KDE uses its own MIME defaults. `desktop_void_dotfiles` remains reserved for files that need the Void runtime.
 
 ## Workstation Notes
-- Native Linux workstation hosts can combine `workstation_host_linux` with an OS-specific dev group.
-- `deadalus-fedora` keeps GNOME managed settings in `ansible/inventory/host_vars/deadalus-fedora.yml`.
+- `deadalus` is modeled as Windows + WSL; keep Linux dev automation on `deadalus-wsl`.
+- Native Linux workstation groups remain available for future hosts but have no current host in the main inventory.
 
 ## Coding Agent Notes
 - Shared agent packages live in `ai_agents_npm_packages` in `ansible/inventory/group_vars/all.yml`.

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## What this repo is
 
-Ansible-driven personal infrastructure as code for Void Linux desktops (`ikaros`, `nymph`), Linux workstations (`deadalus-fedora`, `deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions.
+Ansible-driven personal infrastructure as code for Fedora desktops (`ikaros`, `nymph`), WSL development (`deadalus-wsl`), and an Ubuntu server (`prometheus`). See `AGENTS.md` for topology and `README.md` for full profile descriptions.
 
 ## Validation commands
 
@@ -15,7 +15,6 @@ ansible-playbook ansible/site.yml --syntax-check
 # Dry-run per host
 ansible-playbook ansible/site.yml --limit ikaros --check --diff
 ansible-playbook ansible/site.yml --limit nymph --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff
 ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --check --diff
 

README.md

@@ -36,7 +36,6 @@ infra/
 │   ├── workstation/
 │   ├── workstation_host_linux/
 │   ├── workstation_dev_wsl/
-│   ├── ikaros/
 │   └── nymph/
 │
 ├── scripts/
@@ -55,93 +54,76 @@ Il repository è diviso in due componenti principali:
 
 # Macchine gestite
 
-Il repository modella attualmente tre tipologie di profilo, con i filoni workstation Linux nativa e WSL.
-La nuova direzione del repository separa tre assi indipendenti:
-
-```text
-common user environment
-+ host-specific platform
-+ role-specific software
-+ independently selectable desktop
-+ host hardware overrides
-```
-
-Matrice target:
-
-| Host           | Platform   | Role                 | Desktop                           |
-| -------------- | ---------- | -------------------- | --------------------------------- |
-| ikaros         | Linux Mint | Personal workstation | Cinnamon                          |
-| nymph          | FreeBSD    | Lab                  | Hyprland                          |
-| void-reference | Void Linux | Lab/reference        | Current preserved desktop profile |
-
-Regola operativa:
-
-```text
-ikaros must be boring
-nymph is allowed to break
-```
-
-Durante il refactoring strutturale iniziale `ikaros` e `nymph` restano in
-`platform_void` per preservare il comportamento esistente. I gruppi legacy
-`void` e `desktop` restano alias di compatibilita mentre i nuovi assi sono
-`platform_*`, `role_*` e `desktop_*`.
-
-Prima di una migrazione reale degli host e consigliato creare uno snapshot
-logico, per esempio:
-
-```bash
-git switch -c refactor/platform-role-desktop
-git tag void-desktop-before-platform-refactor
-```
+Il repository modella attualmente host Fedora/GNOME, un ambiente WSL di sviluppo e un server Ubuntu.
+La composizione resta separata in assi indipendenti:
+
+```text
+common user environment
++ host-specific platform
++ role-specific software
++ independently selectable desktop
++ host hardware overrides
+```
+
+Matrice target:
+
+| Host           | Platform   | Role                 | Desktop                           |
+| -------------- | ---------- | -------------------- | --------------------------------- |
+| ikaros         | Fedora     | Personal workstation | GNOME                             |
+| nymph          | Fedora     | Desktop laptop       | GNOME                             |
+| void-reference | Void Linux | Lab/reference        | Current preserved desktop profile |
+
+Regola operativa:
+
+```text
+ikaros must be boring
+nymph is allowed to break
+```
+
+`ikaros` usa Fedora Workstation/GNOME come desktop personale stabile; `nymph` usa lo stesso
+target Fedora Workstation/GNOME come laptop. I gruppi legacy `void` e `desktop` restano alias di
+compatibilita per eventuali host Void futuri mentre i nuovi assi sono
+`platform_*`, `role_*` e `desktop_*`.
 
 Nota sullo stato attuale del playbook principale:
 
-- `ansible/site.yml` applica oggi in automatico il profilo desktop su host Void Linux
-- `ansible/site.yml` applica la workstation Linux nativa separando il layer dev comune dal layer host GNOME
+- `ansible/site.yml` applica oggi in automatico Fedora/GNOME su `ikaros` e `nymph`
 - `ansible/site.yml` applica anche il ramo `workstation_dev_wsl` per il modello dev in WSL
 - `ansible/site.yml` applica anche il profilo `ubuntu_server` con baseline apt, systemd, dotfiles server e firewall UFW
 
 ## Desktop
 
-Sistema operativo:
+Target operativi:
 
-- Void Linux
+- `ikaros`: Fedora Workstation + GNOME, desktop personale stabile/floating.
+- `nymph`: Fedora Workstation + GNOME, laptop desktop con dotfiles desktop condivisi e GNOME lasciato al default Fedora.
 
-Modalita desktop:
-
-- `minimal`: sway (Wayland) + Hyprland (Wayland), gestite da `emptty`
-- `xfce`: XFCE puro con look scuro e sobrio, gestito da LightDM
-- `kde`: KDE Plasma, gestito da SDDM
-
-Macchine:
-
-- `ikaros`
-- `nymph`
-
-Queste macchine condividono la stessa configurazione base desktop e vengono mantenute allineate tramite Ansible. `desktop_environment` seleziona in modo esclusivo `minimal` (default), `xfce` oppure `kde`. Nella modalita minimale Sway/SwayFX e Hyprland sono installate in parallelo e selezionabili da `emptty`; `desktop_default_session` decide quale sessione viene preselezionata al login. XFCE usa direttamente la sessione `xfce` tramite LightDM.
+Il profilo Void desktop resta disponibile come modello riutilizzabile per host
+futuri. `desktop_environment` continua a selezionare in modo esclusivo
+`minimal`, `xfce` oppure `kde` per i desktop Void; Niri, GNOME e Cinnamon sono profili
+desktop indipendenti via gruppi `desktop_niri`, `desktop_gnome` e `desktop_cinnamon`.
 
 Lo stato attuale del profilo desktop include, tra le altre cose:
 
 - dotfiles comuni e desktop
-- sessioni sway e Hyprland su entrambi gli host in modalita `minimal`
-- KDE Plasma con applicazioni KDE curate e SDDM disponibile come alternativa esclusiva
-- XFCE con pannello, keybinding, terminale, tema e workspace dichiarativi, LightDM e Thunderbird come client grafico principale
-- `emptty` con default host-specific in modalita `minimal`, con session file Wayland esposti per `sway` e `hyprland`
+- sessioni sway e Hyprland per eventuali host Void in modalita `minimal`
+- KDE Plasma con applicazioni KDE curate e SDDM disponibile come alternativa esclusiva
+- XFCE con pannello, keybinding, terminale, tema e workspace dichiarativi, LightDM e Thunderbird come client grafico principale
+- `emptty` con default host-specific in modalita `minimal`, con session file Wayland esposti per `sway` e `hyprland`
 - pacchetti Void Linux e servizi runit; le liste pacchetti Void desktop sono separate per criterio:
   - `void_packages_base` per il runtime sistema (init, kernel, audio core, networking, firewall, hw daemons)
-  - `desktop_common_packages` per l'infrastruttura condivisa dalle modalita
-  - `desktop_minimal_packages` per applicazioni GTK/XFCE e `emptty`
-  - `desktop_xfce_packages` per XFCE, LightDM e le relative integrazioni
-  - `desktop_kde_packages` per Plasma, SDDM e le applicazioni KDE equivalenti
+  - `desktop_common_packages` per l'infrastruttura condivisa dalle modalita
+  - `desktop_minimal_packages` per applicazioni GTK/XFCE e `emptty`
+  - `desktop_xfce_packages` per XFCE, LightDM e le relative integrazioni
+  - `desktop_kde_packages` per Plasma, SDDM e le applicazioni KDE equivalenti
   - `desktop_sway_packages` e `desktop_hyprland_packages` per i binari specifici di ciascuna sessione
-- `turnstile` per i servizi utente, inclusi `emacs` e `ssh-agent`
-- `ssh-agent` con socket stabile condiviso tra shell, SSH ed Emacs in `~/.local/state/ssh-agent/socket`
-- `.emacs.d` distribuito da un task dedicato Ansible con tag `emacs`
+- `turnstile` per i servizi utente Void, incluso `ssh-agent`
+- `ssh-agent` con socket stabile condiviso tra shell e SSH in `~/.local/state/ssh-agent/socket`
+- Emacs e i relativi dotfile restano nel repo ma sono disabilitati di default tramite `emacs_enabled: false`
 - `tmux` con plugin gestiti da TPM al bootstrap del profilo desktop
 - Flatpak con remoto Flathub
-- GNOME Keyring e `udiskie` nella modalita minimale; KWallet e integrazione UDisks di Plasma nella modalita KDE
-- multi-monitor: sotto sway è gestito da `kanshi` (config host-specifica in `host_sway_dotfiles` su `nymph`); sotto Hyprland gli override monitor vivono in `host_hyprland_dotfiles`
-- override NVIDIA Optimus su `nymph`: parametri kernel GRUB iniettati in modo idempotente in `GRUB_CMDLINE_LINUX`, wrapper `prime-run` e config WirePlumber per priorità telecamera
+- GNOME Keyring e `udiskie` nella modalita minimale; KWallet e integrazione UDisks di Plasma nella modalita KDE
+- multi-monitor Void: sotto sway è gestito da `kanshi`; sotto Hyprland gli override monitor vivono in `host_hyprland_dotfiles`
 
 ---
 
@@ -149,17 +131,16 @@ Lo stato attuale del profilo desktop include, tra le altre cose:
 
 Sistemi operativi supportati:
 
-- Fedora Workstation nativa
-- Ubuntu WSL
+- Ubuntu WSL, attualmente usato da `deadalus-wsl`
+- Fedora Workstation nativa, disponibile per host futuri tramite gruppi dedicati
 
-Desktop environment host Linux:
+Desktop environment host Linux, per eventuali workstation native:
 
 - GNOME
 
 Macchine attuali:
 
-- `deadalus-fedora` come workstation Fedora nativa
-- `deadalus-wsl` come ambiente dev Ubuntu in WSL
+- `deadalus-wsl` come ambiente dev Ubuntu in WSL sulla workstation Windows `deadalus`
 
 Questo profilo è pensato per sviluppo e lavoro, con separazione tra layer host e layer dev.
 
@@ -168,8 +149,8 @@ Nel modello Ansible usato qui, un singolo inventory host puo appartenere intenzi
 Il profilo workstation e agganciato al playbook principale e ora distingue:
 
 - layer dev Ubuntu condiviso tra WSL e server
-- layer dev Fedora nativo
-- layer host Linux GNOME
+- layer dev Fedora nativo disponibile per host futuri
+- layer host Linux GNOME disponibile per host futuri
 - layer WSL dedicato per sviluppo con `systemd`
 
 Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `workstation_dev_fedora`, a seconda del layering che vuoi comporre.
@@ -177,14 +158,13 @@ Per esempio, lo stesso host Linux puo stare in `workstation_host_linux` e in `wo
 Lo stato attuale del profilo workstation include:
 
 - installazione pacchetti base Ubuntu via apt
-- installazione pacchetti base Fedora via dnf per il ramo workstation nativo
+- installazione pacchetti base Fedora via dnf per eventuali workstation native
 - installazione e configurazione di Docker dal repository ufficiale
 - gestione dei dotfiles workstation e rendering dei template dev condivisi
-- installazione di Google Chrome su Fedora, `VS Code` su Fedora via repository RPM Microsoft, `IntelliJ IDEA Ultimate` su Fedora via COPR RPM, e applicazioni workstation residue su Fedora via Flatpak
-- estensioni GNOME sul solo host Linux nativo
+- installazione opzionale di Google Chrome, VS Code, IntelliJ IDEA Ultimate e applicazioni Flatpak per eventuali workstation Fedora native
+- estensioni GNOME per eventuali host Linux nativi
 - preparazione del ramo WSL Ubuntu con `systemd` per il toolchain di sviluppo
-- attivazione del firewall `firewalld` su Fedora nativa
-- gestione di `gsettings` GNOME host-specifici su `deadalus-fedora`, inclusi shell, Files/Nautilus, file chooser GTK e GNOME Text Editor, allineati allo stato reale della macchina
+- attivazione del firewall `firewalld` sui target Fedora che dichiarano regole host-specifiche
 
 Workflow WSL previsto:
 
@@ -240,49 +220,36 @@ ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser -
 
 # Composizione della configurazione
 
-Deploy mirato della configurazione Emacs sui desktop Void:
+Emacs è disabilitato di default. Per riattivare temporaneamente il deploy Emacs:
 
 ```bash
-ansible-playbook ansible/site.yml --limit ikaros --tags emacs
-ansible-playbook ansible/site.yml --limit nymph --tags emacs
+ansible-playbook ansible/site.yml --limit <host> --tags emacs -e emacs_enabled=true
 ```
 
-La configurazione finale di una macchina è ottenuta combinando più livelli.
-
-```text
-common configuration
-+ platform configuration
-+ role configuration
-+ desktop configuration
-+ host overrides
-```
-
-Esempio corrente per `ikaros` nella fase conservativa:
-
-```text
-common + platform_void + graphical_desktop + role_personal_workstation + desktop_hyprland/desktop_sway + ikaros
-```
-
-Esempio corrente per `nymph` nella fase conservativa:
-
-```text
-common + platform_void + graphical_desktop + role_lab + desktop_hyprland/desktop_sway + nymph
-```
-
-Esempi target, da attivare con un cambio inventory separato:
-
-```text
-ikaros -> platform_mint + role_personal_workstation + desktop_cinnamon
-nymph  -> platform_freebsd + role_lab + desktop_hyprland
-```
+La configurazione finale di una macchina è ottenuta combinando più livelli.
+
+```text
+common configuration
++ platform configuration
++ role configuration
++ desktop configuration
++ host overrides
+```
+
+Esempi correnti:
+
+```text
+ikaros -> common + platform_fedora + role_personal_workstation + graphical_desktop + desktop_gnome + ikaros
+nymph  -> common + platform_fedora + graphical_desktop + desktop_gnome + nymph
+```
 
 Questo approccio consente di:
 
-- mantenere configurazioni condivise
-- applicare override specifici per host
-- evitare duplicazioni
-- riutilizzare il profilo Void corrente su un host futuro assegnandolo a
-  `platform_void + graphical_desktop + role_lab + desktop_hyprland`
+- mantenere configurazioni condivise
+- applicare override specifici per host
+- evitare duplicazioni
+- riutilizzare il profilo Void corrente su un host futuro assegnandolo a
+  `platform_void + graphical_desktop + role_lab + desktop_hyprland`
 
 ---
 
@@ -290,26 +257,28 @@ Questo approccio consente di:
 
 I principali ruoli attualmente presenti sono:
 
-| Role                      | Descrizione                         |
-| ------------------------- | ----------------------------------- |
-| base                      | configurazione base comune          |
-| packages_void             | installazione pacchetti su Void     |
-| packages_mint             | installazione pacchetti su Linux Mint via APT |
-| packages_freebsd          | installazione pacchetti su FreeBSD via pkg |
-| packages_ubuntu           | installazione pacchetti su Ubuntu   |
-| packages_fedora           | installazione pacchetti su Fedora   |
-| services_runit            | gestione servizi runit              |
-| services_systemd          | gestione servizi systemd            |
-| services_freebsd          | gestione servizi FreeBSD rc.conf/rc.d |
-| profile_desktop_common    | bootstrap desktop Void condiviso    |
-| profile_desktop_sway      | sessione desktop sway / SwayFX (Wayland) |
-| profile_desktop_hyprland  | sessione desktop Hyprland (Wayland) |
-| profile_desktop_hyprland_freebsd | adattamenti FreeBSD per Hyprland |
-| profile_desktop_cinnamon  | impostazioni Cinnamon circoscritte |
-| profile_desktop_host      | override desktop specifici per host |
-| profile_personal_workstation | layer stabile per workstation personale |
-| profile_lab               | layer sperimentale/lab              |
-| profile_workstation_dev_common | configurazione dev workstation condivisa |
+| Role                      | Descrizione                         |
+| ------------------------- | ----------------------------------- |
+| base                      | configurazione base comune          |
+| packages_void             | installazione pacchetti su Void     |
+| packages_mint             | installazione pacchetti su Linux Mint via APT |
+| packages_freebsd          | installazione pacchetti su FreeBSD via pkg |
+| packages_ubuntu           | installazione pacchetti su Ubuntu   |
+| packages_fedora           | installazione pacchetti su Fedora   |
+| services_runit            | gestione servizi runit              |
+| services_systemd          | gestione servizi systemd            |
+| services_freebsd          | gestione servizi FreeBSD rc.conf/rc.d |
+| profile_desktop_common    | bootstrap desktop Void condiviso    |
+| profile_desktop_gnome     | dotfiles desktop condivisi per Fedora/GNOME |
+| profile_desktop_sway      | sessione desktop sway / SwayFX (Wayland) |
+| profile_desktop_hyprland  | sessione desktop Hyprland (Wayland) |
+| profile_desktop_niri     | sessione desktop Niri su Void (Wayland) |
+| profile_desktop_niri_freebsd | adattamenti FreeBSD per Niri |
+| profile_desktop_cinnamon  | impostazioni Cinnamon circoscritte |
+| profile_desktop_host      | override desktop specifici per host |
+| profile_personal_workstation | layer stabile per workstation personale |
+| profile_lab               | layer sperimentale/lab              |
+| profile_workstation_dev_common | configurazione dev workstation condivisa |
 | profile_workstation_gnome | configurazione host workstation GNOME |
 | profile_workstation_dev_wsl | configurazione WSL Ubuntu per sviluppo |
 | profile_server            | configurazione server               |
@@ -320,29 +289,32 @@ I principali ruoli attualmente presenti sono:
 
 # Stato attuale del playbook principale
 
-Il playbook `ansible/site.yml` e attualmente composto da blocchi per asse:
-
-```text
-all -> dotfiles_common
-platform_void -> packages_void + services_runit
-platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_hyprland + profile_desktop_kde + profile_desktop_xfce + profile_desktop_host
-platform_mint -> packages_mint + services_systemd
-platform_mint & role_personal_workstation -> profile_personal_workstation
-platform_mint & desktop_cinnamon -> profile_desktop_cinnamon
-platform_freebsd -> packages_freebsd + services_freebsd
-platform_freebsd & role_lab -> profile_lab
-platform_freebsd & desktop_hyprland -> profile_desktop_hyprland_freebsd
-workstation_dev_fedora -> packages_fedora + services_systemd + profile_workstation_dev_common
-workstation_host_linux -> profile_workstation_gnome
-workstation_dev_wsl -> packages_ubuntu + services_systemd + profile_workstation_dev_common + profile_workstation_dev_wsl
-ubuntu_server -> packages_ubuntu + services_systemd + profile_server
+Il playbook `ansible/site.yml` e attualmente composto da blocchi per asse:
+
+```text
+all -> dotfiles_common
+platform_void -> packages_void + services_runit
+platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_hyprland + profile_desktop_niri + profile_desktop_kde + profile_desktop_xfce + profile_desktop_host
+platform_mint -> packages_mint + services_systemd
+platform_mint & role_personal_workstation -> profile_personal_workstation
+platform_mint & desktop_cinnamon -> profile_desktop_cinnamon
+platform_freebsd -> packages_freebsd + services_freebsd
+platform_freebsd & role_lab -> profile_lab
+platform_freebsd & desktop_niri -> profile_desktop_niri_freebsd
+platform_fedora -> packages_fedora + services_systemd
+platform_fedora & role_personal_workstation -> profile_personal_workstation
+platform_fedora & desktop_gnome -> profile_desktop_gnome
+workstation_dev_fedora -> profile_workstation_dev_common
+workstation_host_linux -> profile_workstation_gnome
+workstation_dev_wsl -> packages_ubuntu + services_systemd + profile_workstation_dev_common + profile_workstation_dev_wsl
+ubuntu_server -> packages_ubuntu + services_systemd + profile_server
 ```
 
 Questo significa che, allo stato attuale:
 
-- i desktop Void (`ikaros`, `nymph`) restano il target operativo piu completo tramite `platform_void + graphical_desktop`
-- Linux Mint/Cinnamon e FreeBSD/Hyprland sono scaffolding selezionabile tramite gruppi, ma non ricevono host reali nel refactoring strutturale iniziale
-- la workstation Fedora (`deadalus-fedora`) usa il principio di composizione a gruppi con il ramo Fedora dedicato e con `gsettings` host-specifici dichiarati in inventory
+- `ikaros` riceve Fedora Workstation/GNOME come target desktop personale stabile
+- `nymph` riceve Fedora Workstation/GNOME come target laptop
+- il profilo Void resta selezionabile tramite `platform_void + graphical_desktop` per host futuri
 - il ramo WSL (`deadalus-wsl`) e predisposto con play dev dedicato
 - il server Ubuntu (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewall
 - lo stack container server include `navidrome`, `postgres`, `gitea`, `nginx-proxy-manager` e `syncthing`, con GUI Syncthing raggiungibile tramite la rete Docker `web`
@@ -361,7 +333,6 @@ dotfiles/
 ├── workstation
 ├── workstation_host_linux
 ├── workstation_dev_wsl
-├── ikaros
 └── nymph
 ```
 
@@ -412,28 +383,28 @@ Eseguire il playbook principale:
 ansible-playbook ansible/site.yml
 ```
 
-Allo stato attuale questo comando:
-
-- distribuisce i dotfiles comuni a tutti gli host
-- per `platform_void` applica pacchetti Void e servizi runit
-- per `platform_void + graphical_desktop` applica bootstrap desktop condiviso, sessioni sway/Hyprland e override specifici per host
-- per `platform_mint` e `platform_freebsd` applica solo host presenti esplicitamente in quei gruppi; nell'inventory principale iniziale questi gruppi sono vuoti
-- per `workstation_dev_fedora` applica pacchetti Fedora, servizi systemd e profilo dev comune
-- per `workstation_host_linux` applica il layer host Linux GNOME
-- per `workstation_dev_wsl` applica pacchetti Ubuntu, servizi systemd, profilo dev comune e tweak WSL dedicati
+Allo stato attuale questo comando:
+
+- distribuisce i dotfiles comuni a tutti gli host
+- per `platform_void` applica pacchetti Void e servizi runit
+- per `platform_void + graphical_desktop` applica bootstrap desktop condiviso, sessioni sway/Hyprland/Niri e override specifici per host
+- per `platform_mint`, `platform_freebsd`, `workstation_dev_fedora` e `workstation_host_linux` non applica nulla finche quei gruppi restano senza host
+- per `platform_fedora` applica pacchetti Fedora e servizi systemd a `ikaros` e `nymph`
+- per `platform_fedora & role_personal_workstation` applica il layer personale a `ikaros`
+- per `platform_fedora & desktop_gnome` applica il profilo GNOME a `ikaros` e `nymph`
+- per `workstation_dev_wsl` applica pacchetti Ubuntu, servizi systemd, profilo dev comune e tweak WSL dedicati a `deadalus-wsl`
 - per gli host `ubuntu_server` applica pacchetti Ubuntu, servizi systemd, profilo server, UFW, dotfiles e template dedicati
-- non riavvia automaticamente il display manager; i passaggi tra `emptty`, LightDM e SDDM vanno applicati da SSH o da una TTY separata
+- non riavvia automaticamente il display manager; i passaggi tra `emptty`, LightDM e SDDM vanno applicati da SSH o da una TTY separata
 - carica `secrets/vault.yml` solo se presente
 - carica `secrets/vault.local.yml` solo se presente, dopo `vault.yml`, cosi gli override locali hanno precedenza
 
-Per validare prima di applicare:
-
-```bash
-ansible-playbook ansible/site.yml --syntax-check
-ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff
-ansible-playbook ansible/site.yml --limit ikaros --check --diff
-ansible-playbook ansible/site.yml --limit nymph --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora --check --diff
+Per validare prima di applicare:
+
+```bash
+ansible-playbook ansible/site.yml --syntax-check
+ansible-playbook ansible/site.yml --limit ikaros,nymph --check --diff
+ansible-playbook ansible/site.yml --limit ikaros --check --diff
+ansible-playbook ansible/site.yml --limit nymph --check --diff
 ansible-playbook ansible/site.yml --limit deadalus-wsl --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --check --diff
 ansible-lint ansible/site.yml
@@ -465,14 +436,14 @@ Per vedere l'elenco reale aggiornato dei tag disponibili:
 ansible-playbook ansible/site.yml --list-tags
 ```
 
-Per attivare XFCE o KDE su un host, impostare rispettivamente `desktop_environment: xfce` o `desktop_environment: kde` nei relativi `host_vars` ed eseguire prima un dry run. Il primo play configura il profilo ma, se un altro display manager e ancora attivo, rinvia il cambio. Da una TTY o sessione SSH separata, con la sessione grafica chiusa, applicare quindi il passaggio esplicito:
-
-```bash
-ansible-playbook ansible/site.yml --limit <host> -e desktop_allow_display_manager_switch=true
-```
-
-La stessa procedura vale per ogni passaggio tra `minimal`, `xfce` e `kde`. Gli XML XFCE sono autorevoli: applicare i relativi aggiornamenti mentre XFCE e disconnesso evita che `xfconfd` ripristini lo stato in memoria.
-
+Per attivare XFCE o KDE su un host, impostare rispettivamente `desktop_environment: xfce` o `desktop_environment: kde` nei relativi `host_vars` ed eseguire prima un dry run. Il primo play configura il profilo ma, se un altro display manager e ancora attivo, rinvia il cambio. Da una TTY o sessione SSH separata, con la sessione grafica chiusa, applicare quindi il passaggio esplicito:
+
+```bash
+ansible-playbook ansible/site.yml --limit <host> -e desktop_allow_display_manager_switch=true
+```
+
+La stessa procedura vale per ogni passaggio tra `minimal`, `xfce` e `kde`. Gli XML XFCE sono autorevoli: applicare i relativi aggiornamenti mentre XFCE e disconnesso evita che `xfconfd` ripristini lo stato in memoria.
+
 Allo stato attuale `ansible/site.yml` espone questi tag:
 
 | Tag | Scopo | Ambito principale |
@@ -480,32 +451,31 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common |
 | `dotfiles` | distribuzione/configurazione dotfiles | tutti i profili |
 | `dotfiles:common` | dotfiles comuni condivisi | common, workstation, server |
-| `dotfiles:desktop` | dotfiles desktop | desktop Void |
+| `dotfiles:desktop` | dotfiles desktop | desktop Void, Fedora/GNOME, FreeBSD/Niri |
 | `dotfiles:host` | override host-specifici desktop | desktop Void |
 | `dotfiles:server` | dotfiles dedicati al profilo server | server |
-| `dotfiles:workstation` | dotfiles dedicati alle workstation | workstation Linux, WSL |
+| `dotfiles:workstation` | dotfiles dedicati alle workstation | personal workstation, WSL, workstation Linux future |
 | `emptty` | gestione display manager `emptty` | desktop Void |
-| `display-manager` | selezione protetta tra `emptty`, LightDM e SDDM | desktop Void |
-| `kde` | profilo KDE Plasma e relativa pulizia | desktop Void |
-| `xfce` | profilo XFCE, LightDM e relativa pulizia | desktop Void |
-| `cinnamon` | impostazioni Cinnamon circoscritte | Linux Mint desktop |
-| `gnome` | configurazione host GNOME | workstation host Linux, parte desktop |
+| `display-manager` | selezione protetta tra `emptty`, LightDM e SDDM | desktop Void |
+| `kde` | profilo KDE Plasma e relativa pulizia | desktop Void |
+| `xfce` | profilo XFCE, LightDM e relativa pulizia | desktop Void |
+| `cinnamon` | impostazioni Cinnamon circoscritte | Linux Mint desktop |
+| `gnome` | configurazione host GNOME | Fedora/GNOME desktop, workstation host Linux future |
 | `sway` | sessione/configurazione sway / SwayFX (Wayland) | desktop Void |
 | `hyprland` | sessione/configurazione Hyprland (Wayland) | desktop Void |
-| `npm` | installazione pacchetti npm globali | desktop Void, workstation Linux, WSL |
+| `niri` | sessione/configurazione Niri (Wayland) | Void o FreeBSD con `desktop_niri` |
+| `npm` | installazione pacchetti npm globali | Fedora/GNOME, desktop Void, workstation Linux, WSL |
 | `nvidia` | componenti NVIDIA desktop | desktop Void |
 | `packages` | installazione e aggiornamento pacchetti | tutti i profili |
 | `services` | gestione servizi runit/systemd | tutti i profili |
-| `vscode` | installazione/configurazione VS Code | Fedora, host Linux |
+| `vscode` | installazione/configurazione VS Code | workstation Fedora future, host Linux |
 | `wsl` | bootstrap e configurazione WSL | WSL |
 
 Esempi pratici:
 
 ```bash
-ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,sway --check --diff
-ansible-playbook ansible/site.yml --limit ikaros --tags sway,portal --check --diff
-ansible-playbook ansible/site.yml --limit ikaros --tags hyprland,portal --check --diff
-ansible-playbook ansible/site.yml --limit deadalus-fedora --tags packages,vscode --check --diff
+ansible-playbook ansible/site.yml --limit nymph --tags dotfiles:desktop,gnome --check --diff
+ansible-playbook ansible/site.yml --limit ikaros --tags gnome --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --tags services,dotfiles:server --check --diff
 ```
 
@@ -522,25 +492,25 @@ ansible-galaxy collection install -r ansible/collections/requirements.yml
 ansible-playbook ansible/site.yml
 ```
 
-Dopo l'esecuzione del playbook la macchina verra configurata secondo il profilo definito e i ruoli attualmente orchestrati.
-
-Per aggiungere un nuovo host Void che riusa il profilo desktop preservato:
-
-1. aggiungere l'host a `platform_void`;
-2. aggiungerlo a `graphical_desktop`;
-3. scegliere il ruolo, per esempio `role_lab`;
-4. scegliere il desktop, per esempio `desktop_hyprland`;
-5. lasciare eventuali dettagli hardware in `host_vars/<host>.yml`.
-
-I gruppi legacy `void` e `desktop` sono parent di compatibilita, quindi un host
-in `platform_void` e `graphical_desktop` continua a ricevere anche le variabili
-Void e desktop esistenti.
-
-Per prove in VM sono disponibili gruppi di esempio in
-`ansible/inventory/examples/platform-test-hosts.yml`, da passare esplicitamente
-con `-i` insieme all'inventory principale.
-
-Per il flusso mail desktop esiste inoltre uno script dedicato:
+Dopo l'esecuzione del playbook la macchina verra configurata secondo il profilo definito e i ruoli attualmente orchestrati.
+
+Per aggiungere un nuovo host Void che riusa il profilo desktop preservato:
+
+1. aggiungere l'host a `platform_void`;
+2. aggiungerlo a `graphical_desktop`;
+3. scegliere il ruolo, per esempio `role_lab`;
+4. scegliere il desktop, per esempio `desktop_hyprland`;
+5. lasciare eventuali dettagli hardware in `host_vars/<host>.yml`.
+
+I gruppi legacy `void` e `desktop` sono parent di compatibilita, quindi un host
+in `platform_void` e `graphical_desktop` continua a ricevere anche le variabili
+Void e desktop esistenti.
+
+Per prove in VM sono disponibili gruppi di esempio in
+`ansible/inventory/examples/platform-test-hosts.yml`, da passare esplicitamente
+con `-i` insieme all'inventory principale.
+
+Per il flusso mail desktop esiste inoltre uno script dedicato:
 
 ```bash
 scripts/bootstrap_mail.sh

ansible/inventory/group_vars/all.yml

@@ -7,6 +7,7 @@ user_shell: /bin/bash
 effective_username: "{{ username }}"
 effective_user_group: "{{ user_group }}"
 effective_user_home: "{{ user_home }}"
+emacs_enabled: false
 
 xdg_user_directories:
   - Desktop
@@ -32,6 +33,18 @@ common_packages:
   - zip
   - zoxide
 
+vim_plugins_enabled: true
+vim_plugin_distro_packages:
+  - fzf
+  - vim-fugitive
+vim_plugin_source_plugins:
+  - name: fzf
+    repo: https://github.com/junegunn/fzf.git
+    version: v0.72.0
+  - name: fzf.vim
+    repo: https://github.com/junegunn/fzf.vim.git
+    version: 34a564c81f36047f50e593c1656f4580ff75ccca
+
 common_dotfiles:
   - name: .bashrc
     src: .bashrc

ansible/inventory/group_vars/desktop.yml

@@ -1,6 +1,4 @@
 ---
-desktop_protonmail_bridge_cert_path: ~/.var/app/ch.protonmail.protonmail-bridge/config/protonmail/bridge-v3/cert.pem
-
 desktop_environment: minimal
 desktop_allow_display_manager_switch: false
 
@@ -96,10 +94,6 @@ desktop_common_dotfiles:
     src: .bashrc.d/20-editor-desktop.sh
     dest: .bashrc.d/20-editor-desktop.sh
     mode: "0644"
-  - name: Bash Emacs client fragment
-    src: .bashrc.d/25-emacs-client-desktop.sh
-    dest: .bashrc.d/25-emacs-client-desktop.sh
-    mode: "0644"
   - name: Bash VM helper fragment
     src: .bashrc.d/30-runvm.sh
     dest: .bashrc.d/30-runvm.sh
@@ -172,6 +166,10 @@ desktop_minimal_managed_paths:
   - .local/bin/udiskie-password
 
 desktop_emacs_dotfiles:
+  - name: Bash Emacs client fragment
+    src: .bashrc.d/25-emacs-client-desktop.sh
+    dest: .bashrc.d/25-emacs-client-desktop.sh
+    mode: "0644"
   - name: Emacs config
     src: .emacs.d/
     dest: .emacs.d/
@@ -241,6 +239,28 @@ desktop_hyprland_dotfiles:
     dest: .config/foot/
     mode: preserve
 
+desktop_niri_dotfiles:
+  - name: foot config
+    src: .config/foot/
+    dest: .config/foot/
+    mode: preserve
+  - name: dunst config
+    src: .config/dunst/
+    dest: .config/dunst/
+    mode: preserve
+  - name: rofi config
+    src: .config/rofi/
+    dest: .config/rofi/
+    mode: preserve
+  - name: waybar config
+    src: .config/waybar/
+    dest: .config/waybar/
+    mode: preserve
+  - name: niri config
+    src: .config/niri/
+    dest: .config/niri/
+    mode: preserve
+
 desktop_xfce_dotfiles:
   - name: XFCE configuration
     src: .config/xfce4/

ansible/inventory/group_vars/desktop_cinnamon.yml

@@ -7,6 +7,13 @@ cinnamon_theme_icons: Mint-Y-Aqua
 cinnamon_font_ui: Sans 10
 cinnamon_font_monospace: Monospace 10
 
+# WM-agnostic desktop dotfiles from desktop_common_dotfiles that do NOT apply to
+# Cinnamon: the autostart entry is the (removed) Protonmail mail bridge, and the
+# GTK theme script conflicts with Cinnamon's own dconf-managed theming.
+cinnamon_desktop_dotfiles_exclude:
+  - XDG autostart entries
+  - GTK theme setup script
+
 cinnamon_dconf_settings:
   - key: /org/cinnamon/desktop/interface/gtk-theme
     value: "'{{ cinnamon_theme_gtk }}'"

ansible/inventory/group_vars/desktop_gnome.yml

@@ -0,0 +1,84 @@
+---
+desktop_profile: gnome
+desktop_environment: gnome
+desktop_sessions_enabled: []
+desktop_default_session: gnome
+
+# Fedora Workstation/GNOME desktop applications. Keep this profile separate from
+# workstation_* so nymph can remain a desktop laptop rather than a dev workstation.
+fedora_desktop_packages:
+  # Fedora equivalents of the development/tooling packages previously pulled by
+  # the Void desktop profile.
+  - 7zip
+  - nodejs-bash-language-server
+  - bluez
+  - bridge-utils
+  - cmake
+  - cscope
+  - ctags
+  - delve
+  - dnsmasq
+  - fastfetch
+  - poppler-glib
+  - poppler-utils
+  - fontconfig-devel
+  - freetype-devel
+  - gh
+  - golang
+  - golangci-lint
+  - gopls
+  - hunspell
+  - libvirt
+  - libreoffice
+  - liberation-fonts
+  - libasan
+  - libvterm-devel
+  - libX11-devel
+  - libXft-devel
+  - meld
+  - mpv
+  - pdfarranger
+  - pinentry-gnome3
+  - plocate
+  - playerctl
+  - podman-compose
+  - qemu
+  - qemu-img
+  - qemu-tools
+  - rclone
+  - remmina
+  - ruff
+  - rustup
+  - rsync
+  - shfmt
+  - syncthing
+  - tealdeer
+  - terminus-fonts
+  - texlive
+  - tmux
+  - wl-clipboard
+  - ty
+  - uv
+  - valgrind
+  - virt-manager
+  - virt-install
+  - wireplumber
+  - yt-dlp
+  - zstd
+
+fedora_nerd_fonts_version: v3.3.0
+fedora_nerd_fonts:
+  - Hack
+  - JetBrainsMono
+  - Iosevka
+  - UbuntuSans
+  - NerdFontsSymbolsOnly
+
+fedora_flatpak_packages:
+  - be.alexandervanhee.gradia
+  - ch.protonmail.protonmail-bridge
+  - com.spotify.Client
+  - org.mozilla.thunderbird
+  - org.telegram.desktop
+
+fedora_npm_packages: "{{ ai_agents_npm_packages }}"

ansible/inventory/group_vars/desktop_niri.yml

@@ -0,0 +1,5 @@
+---
+desktop_profile: niri
+desktop_sessions_enabled:
+  - niri
+desktop_default_session: niri

ansible/inventory/group_vars/fedora.yml

@@ -27,7 +27,6 @@ fedora_docker_packages:
   - docker-compose-plugin
 
 enabled_services:
-  - docker
   - firewalld
 
 fedora_dotfiles:
@@ -64,8 +63,11 @@ workstation_host_linux_packages_fedora:
   - rclone
   - yubikey-manager
 
-workstation_flatpak_remote_name: flathub
-workstation_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
+fedora_flatpak_remote_name: flathub
+fedora_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
+
+workstation_flatpak_remote_name: "{{ fedora_flatpak_remote_name }}"
+workstation_flatpak_remote_url: "{{ fedora_flatpak_remote_url }}"
 workstation_flatpak_packages:
   - com.getpostman.Postman
   - com.spotify.Client

ansible/inventory/group_vars/platform_fedora.yml

@@ -0,0 +1,5 @@
+---
+platform_profile: fedora
+platform_family: redhat
+platform_package_manager: dnf
+platform_service_manager: systemd

ansible/inventory/group_vars/platform_freebsd.yml

@@ -5,6 +5,19 @@ platform_package_manager: pkg
 platform_service_manager: rc
 ansible_python_interpreter: /usr/local/bin/python3
 
+vim_plugin_distro_packages:
+  - fzf
+vim_plugin_source_plugins:
+  - name: fzf
+    repo: https://github.com/junegunn/fzf.git
+    version: v0.72.0
+  - name: fzf.vim
+    repo: https://github.com/junegunn/fzf.vim.git
+    version: 34a564c81f36047f50e593c1656f4580ff75ccca
+  - name: vim-fugitive
+    repo: https://github.com/tpope/vim-fugitive.git
+    version: 3b753cf8c6a4dcde6edee8827d464ba9b8c4a6f0
+
 effective_user_group: "{{ user_group }}"
 effective_user_home: "/home/{{ effective_username }}"
 user_home: "/home/{{ username }}"
@@ -75,6 +88,19 @@ freebsd_hyprland_packages:
   - xdg-desktop-portal-hyprland
   - xwayland
 
+freebsd_niri_packages:
+  - cliphist
+  - dunst
+  - foot
+  - grim
+  - niri
+  - rofi-wayland
+  - seatd
+  - slurp
+  - waybar
+  - wl-clipboard
+  - xdg-desktop-portal-gtk
+
 freebsd_lab_packages:
   - lldb
   - llvm

ansible/inventory/group_vars/platform_mint.yml

@@ -4,6 +4,11 @@ platform_family: debian
 platform_package_manager: apt
 platform_service_manager: systemd
 
+# syncthing runs per-user via the packaged system unit template
+# (Debian/Mint ship syncthing@.service, parametrised by username).
+enabled_services:
+  - "syncthing@{{ username }}.service"
+
 mint_manage_flatpak: true
 mint_flatpak_remote_name: flathub
 mint_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
@@ -35,17 +40,34 @@ mint_development_packages:
 mint_desktop_common_packages:
   - dconf-cli
   - deja-dup
-  - emacs
   - firefox
   - fonts-liberation
   - fonts-noto-color-emoji
+  - git-delta
   - gnome-keyring
   - libsecret-tools
   - mpv
   - pinentry-gnome3
+  - pinentry-gtk2
   - rclone
+  - syncthing
   - thunderbird
+  - tmux
   - xdg-user-dirs
+  - yt-dlp
+
+mint_emacs_packages:
+  - autoconf
+  - automake
+  - emacs
+  - hunspell
+  - hunspell-it
+  - libfreetype-dev
+  - libpoppler-glib-dev
+  - libpoppler-private-dev
+  - libtool-bin
+  - libvterm-dev
+  - libx11-dev
 
 mint_cinnamon_packages:
   - cinnamon
@@ -62,4 +84,19 @@ mint_personal_workstation_packages:
   - pdfarranger
   - vim
 
-mint_flatpak_packages: []
+mint_flatpak_packages:
+  - ch.protonmail.protonmail-bridge
+  - com.calibre_ebook.calibre
+  - com.spotify.Client
+  - org.telegram.desktop
+
+# Nerd Fonts referenced by the desktop configs deployed on Mint. Debian has no
+# equivalent of Void's nerd-fonts-ttf package, so they are fetched from the
+# upstream ryanoasis/nerd-fonts release.
+mint_nerd_fonts_version: v3.3.0
+mint_nerd_fonts:
+  - Hack
+  - JetBrainsMono
+  - Iosevka
+  - UbuntuSans
+  - NerdFontsSymbolsOnly

ansible/inventory/group_vars/platform_void.yml

@@ -3,3 +3,16 @@ platform_profile: void
 platform_family: void
 platform_package_manager: xbps
 platform_service_manager: runit
+
+vim_plugin_distro_packages:
+  - fzf
+vim_plugin_source_plugins:
+  - name: fzf
+    repo: https://github.com/junegunn/fzf.git
+    version: v0.72.0
+  - name: fzf.vim
+    repo: https://github.com/junegunn/fzf.vim.git
+    version: 34a564c81f36047f50e593c1656f4580ff75ccca
+  - name: vim-fugitive
+    repo: https://github.com/tpope/vim-fugitive.git
+    version: 3b753cf8c6a4dcde6edee8827d464ba9b8c4a6f0

ansible/inventory/group_vars/server.yml

@@ -7,6 +7,7 @@ effective_user_group: "{{ server_user_group }}"
 effective_user_home: "{{ server_user_home }}"
 server_container_stack_dir: /opt/docker/server
 ai_agents_enabled: false
+vim_plugins_enabled: false
 
 profile_packages:
   - avahi-daemon

ansible/inventory/group_vars/void.yml

@@ -23,7 +23,6 @@ void_packages_base:
   - go
   - hugo
   - ImageMagick
-  - isync
   - libtool
   - linux
   - linux-headers
@@ -33,8 +32,6 @@ void_packages_base:
   - lm_sensors
   - man-pages-devel
   - man-pages-posix
-  - msmtp
-  - mu4e
   - nodejs
   - ntfs-3g
   - pipewire
@@ -103,13 +100,15 @@ desktop_common_packages:
   - cups-pk-helper
   - flatpak
   - libsecret
-  - pinentry-emacs
   - sane
   - sane-airscan
   - turnstile
   - xdg-desktop-portal
   - xdg-user-dirs
 
+desktop_emacs_packages:
+  - pinentry-emacs
+
 desktop_minimal_packages:
   - alacritty
   - blueman
@@ -222,6 +221,28 @@ desktop_hyprland_packages:
   - xdg-desktop-portal-hyprland
   - xorg-server-xwayland
 
+desktop_niri_packages:
+  - cliphist
+  - dunst
+  - foot
+  - foot-terminfo
+  - gtklock
+  - grim
+  - niri
+  - rofi
+  - slurp
+  - SwayOSD
+  - Waybar
+  - wl-clipboard
+  - xdg-desktop-portal-gtk
+  - xorg-server-xwayland
+
+void_lab_packages:
+  - llvm
+  - podman
+  - qemu
+  - smartmontools
+
 profile_packages:
   - bash-language-server
   - bluez
@@ -231,7 +252,6 @@ profile_packages:
   - deluge-gtk
   - delve
   - dnsmasq
-  - emacs-pgtk
   - poppler-glib
   - poppler-utils
   - fontconfig-devel
@@ -273,3 +293,6 @@ profile_packages:
   - yaru
   - yaru-plus
   - zstd
+
+profile_emacs_packages:
+  - emacs-pgtk

ansible/inventory/group_vars/workstation_dev_wsl.yml

@@ -8,6 +8,7 @@ workstation_dev_wsl_packages:
   - python3-pip
   - tmux
 workstation_dev_wsl_excluded_packages:
+  - alacritty
   - pcscd
   - pinentry-gnome3
   - podman
@@ -17,9 +18,7 @@ workstation_dev_wsl_excluded_packages:
 workstation_is_wsl: true
 workstation_manage_google_chrome: false
 workstation_removed_snap_packages: []
-workstation_snap_packages:
-  - name: glab
-    classic: true
+workstation_snap_packages: []
 workstation_dev_wsl_python_packages: []
 workstation_wsl_systemd_enabled: true
 workstation_dev_wsl_dotfiles:
@@ -29,3 +28,8 @@ workstation_dev_wsl_dotfiles:
   - src: .tmux.conf
     dest: .tmux.conf
     mode: "0644"
+    source_dir: desktop
+  - src: .tmux/bin/
+    dest: .tmux/bin/
+    mode: preserve
+    source_dir: desktop

ansible/inventory/group_vars/workstation_dev_wsl.yml.orig

@@ -0,0 +1,47 @@
+---
+enabled_services:
+  - docker
+
+workstation_dev_wsl_packages:
+  - lazygit
+  - pinentry-curses
+  - python3-pip
+workstation_dev_wsl_excluded_packages:
+  - alacritty
+  - pcscd
+  - pinentry-gnome3
+  - podman
+  - podman-compose
+  - ufw
+  - yubikey-manager
+workstation_is_wsl: true
+workstation_manage_google_chrome: false
+<<<<<<< HEAD
+workstation_removed_snap_packages: []
+workstation_snap_packages:
+  - name: glab
+    classic: true
+workstation_dev_wsl_python_packages: []
+||||||| parent of cb83ed1 (Update gitconfig on WSL)
+workstation_removed_snap_packages: []
+workstation_snap_packages:
+  - name: glab
+    classic: true
+workstation_dev_wsl_python_packages:
+  - pypsrp
+  - pyspnego
+=======
+workstation_manage_glab: true
+workstation_glab_version: "1.103.0"
+workstation_removed_snap_packages:
+  - glab
+workstation_snap_packages: []
+workstation_dev_wsl_python_packages:
+  - pypsrp
+  - pyspnego
+>>>>>>> cb83ed1 (Update gitconfig on WSL)
+workstation_wsl_systemd_enabled: true
+workstation_dev_wsl_dotfiles:
+  - src: .gnupg/gpg-agent.conf
+    dest: .gnupg/gpg-agent.conf
+    mode: "0600"

ansible/inventory/host_vars/deadalus-fedora.yml

@@ -1,176 +0,0 @@
----
-hostname: deadalus-fedora
-
-host_packages: []
-host_enabled_services: []
-workstation_firewall_backend: firewalld
-
-workstation_host_vscode_extensions:
-  - ms-vscode-remote.remote-containers
-  - ms-vscode-remote.remote-ssh
-  - ms-azuretools.vscode-docker
-  - redhat.vscode-yaml
-  - redhat.ansible
-
-workstation_gnome_managed_settings:
-  - schema: org.gnome.shell
-    key: favorite-apps
-    value: "['google-chrome.desktop', 'org.gnome.Nautilus.desktop', 'com.spotify.Client.desktop', 'org.mozilla.Thunderbird.desktop', 'org.telegram.desktop.desktop', 'code.desktop', 'intellij-idea-ultimate.desktop', 'io.dbeaver.DBeaverCommunity.desktop', 'com.getpostman.Postman.desktop', 'org.gnome.Ptyxis.desktop']"
-  - schema: org.gnome.shell
-    key: app-picker-layout
-    value: "[{'6f4bfcaf-700e-4fe3-8fd2-4a3e6fc46bcf': <{'position': <0>}>, 'System': <{'position': <1>}>, 'Utilities': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Weather.desktop': <{'position': <4>}>, 'org.gnome.clocks.desktop': <{'position': <5>}>, 'org.gnome.Maps.desktop': <{'position': <6>}>, 'org.gnome.SimpleScan.desktop': <{'position': <7>}>, 'org.gnome.Settings.desktop': <{'position': <8>}>, 'org.gnome.Boxes.desktop': <{'position': <9>}>, 'org.gnome.Showtime.desktop': <{'position': <10>}>, 'org.gnome.Snapshot.desktop': <{'position': <11>}>, 'org.gnome.Characters.desktop': <{'position': <12>}>, 'org.gnome.Calculator.desktop': <{'position': <13>}>, 'org.gnome.Calendar.desktop': <{'position': <14>}>, 'org.gnome.TextEditor.desktop': <{'position': <15>}>, 'org.gnome.Meld.desktop': <{'position': <16>}>, 'org.gnome.tweaks.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>}]"
-  - schema: org.gnome.desktop.input-sources
-    key: sources
-    value: "[('xkb', 'us')]"
-  - schema: org.gnome.desktop.interface
-    key: color-scheme
-    value: "'prefer-dark'"
-  - schema: org.gnome.desktop.privacy
-    key: report-technical-problems
-    value: "false"
-  - schema: org.gnome.desktop.wm.preferences
-    key: button-layout
-    value: "'appmenu:minimize,maximize,close'"
-  - schema: org.gnome.nautilus.preferences
-    key: click-policy
-    value: "'double'"
-  - schema: org.gnome.nautilus.preferences
-    key: date-time-format
-    value: "'simple'"
-  - schema: org.gnome.nautilus.preferences
-    key: default-folder-viewer
-    value: "'icon-view'"
-  - schema: org.gnome.nautilus.preferences
-    key: default-sort-order
-    value: "'name'"
-  - schema: org.gnome.nautilus.preferences
-    key: recursive-search
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: show-create-link
-    value: "true"
-  - schema: org.gnome.nautilus.preferences
-    key: show-delete-permanently
-    value: "true"
-  - schema: org.gnome.nautilus.preferences
-    key: show-directory-item-counts
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: show-hidden-files
-    value: "false"
-  - schema: org.gnome.nautilus.preferences
-    key: show-image-thumbnails
-    value: "'local-only'"
-  - schema: org.gnome.nautilus.preferences
-    key: thumbnail-limit
-    value: "uint64 50"
-  - schema: org.gnome.nautilus.icon-view
-    key: captions
-    value: "['none', 'none', 'none']"
-  - schema: org.gnome.nautilus.icon-view
-    key: default-zoom-level
-    value: "'medium'"
-  - schema: org.gtk.Settings.FileChooser
-    key: clock-format
-    value: "'24h'"
-  - schema: org.gtk.Settings.FileChooser
-    key: date-format
-    value: "'regular'"
-  - schema: org.gtk.Settings.FileChooser
-    key: location-mode
-    value: "'path-bar'"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-hidden
-    value: "false"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-size-column
-    value: "true"
-  - schema: org.gtk.Settings.FileChooser
-    key: show-type-column
-    value: "true"
-  - schema: org.gtk.Settings.FileChooser
-    key: sort-column
-    value: "'name'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: clock-format
-    value: "'24h'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: date-format
-    value: "'regular'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: location-mode
-    value: "'path-bar'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-hidden
-    value: "false"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-size-column
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: show-type-column
-    value: "true"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-column
-    value: "'name'"
-  - schema: org.gtk.gtk4.Settings.FileChooser
-    key: sort-directories-first
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: auto-indent
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: highlight-matching-brackets
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: indent-style
-    value: "'tab'"
-  - schema: org.gnome.TextEditor
-    key: keybindings
-    value: "'default'"
-  - schema: org.gnome.TextEditor
-    key: restore-session
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: show-line-numbers
-    value: "false"
-  - schema: org.gnome.TextEditor
-    key: spellcheck
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: style-scheme
-    value: "'Adwaita'"
-  - schema: org.gnome.TextEditor
-    key: style-variant
-    value: "'follow'"
-  - schema: org.gnome.TextEditor
-    key: use-system-font
-    value: "true"
-  - schema: org.gnome.TextEditor
-    key: wrap-text
-    value: "true"
-  - schema: org.gnome.desktop.background
-    key: picture-uri
-    value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-l.jxl'"
-  - schema: org.gnome.desktop.background
-    key: picture-uri-dark
-    value: "'file:///usr/share/backgrounds/gnome/lcd-rainbow-d.jxl'"
-
-workstation_gnome_extension_dconf_settings:
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-radius-bottom
-    value: "15"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-radius-top
-    value: "15"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: selection-border-size
-    value: "5"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: show-window-position-bar
-    value: "false"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: show-workspace-indicator
-    value: "false"
-  - path: /org/gnome/shell/extensions/paperwm/
-    key: window-gap
-    value: "10"

ansible/inventory/host_vars/ikaros.yml

@@ -2,18 +2,12 @@
 hostname: ikaros
 
 host_packages:
-  - openssh
-  - mesa-dri
-  - vulkan-loader
-  - mesa-vulkan-radeon
-  - mesa-vaapi
-  - xf86-video-amdgpu
+  - openssh-clients
+  - openssh-server
+  - mesa-vulkan-drivers
 
-host_ufw_rules:
-  - rule: allow
-    port: "22"
-    proto: tcp
-    src: "192.168.0.0/24"
+host_firewalld_rich_rules:
+  - rule family="ipv4" source address="192.168.0.0/24" service name="ssh" accept
 
 host_sshd_settings:
   PermitRootLogin: "no"
@@ -28,3 +22,256 @@ host_authorized_ssh_keys: "{{ vault_ikaros_authorized_ssh_keys | default([]) }}"
 
 host_enabled_services:
   - sshd
+
+# Host-local GNOME preferences captured from ikaros' live session. Keep these
+# here rather than in desktop_gnome so nymph remains unmanaged for GNOME
+# settings until it has its own real-use tuning.
+gnome_gsettings_settings:
+  - schema: org.gnome.GWeather4
+    key: temperature-unit
+    value: "'centigrade'"
+  - schema: org.gnome.Ptyxis
+    key: cursor-shape
+    value: "'block'"
+  - schema: org.gnome.Ptyxis
+    key: default-columns
+    value: "uint32 140"
+  - schema: org.gnome.Ptyxis
+    key: default-profile-uuid
+    value: "'caa3c49ba73a208b4c4b64b56a5cd0af'"
+  - schema: org.gnome.Ptyxis
+    key: default-rows
+    value: "uint32 35"
+  - schema: org.gnome.Ptyxis
+    key: font-name
+    value: "'JetBrainsMono Nerd Font 14'"
+  - schema: org.gnome.Ptyxis
+    key: new-tab-position
+    value: "'last'"
+  - schema: org.gnome.Ptyxis
+    key: profile-uuids
+    value: "['caa3c49ba73a208b4c4b64b56a5cd0af']"
+  - schema: org.gnome.Ptyxis
+    key: restore-session
+    value: "false"
+  - schema: org.gnome.Ptyxis
+    key: restore-window-size
+    value: "false"
+  - schema: org.gnome.Ptyxis
+    key: use-system-font
+    value: "false"
+  - schema: org.gnome.Ptyxis.Profile
+    path: /org/gnome/Ptyxis/Profiles/caa3c49ba73a208b4c4b64b56a5cd0af/
+    key: bold-is-bright
+    value: "true"
+  - schema: org.gnome.Ptyxis.Profile
+    path: /org/gnome/Ptyxis/Profiles/caa3c49ba73a208b4c4b64b56a5cd0af/
+    key: label
+    value: "'Default'"
+  - schema: org.gnome.Ptyxis.Profile
+    path: /org/gnome/Ptyxis/Profiles/caa3c49ba73a208b4c4b64b56a5cd0af/
+    key: palette
+    value: "'linux'"
+  - schema: org.gnome.Ptyxis.Profile
+    path: /org/gnome/Ptyxis/Profiles/caa3c49ba73a208b4c4b64b56a5cd0af/
+    key: scroll-on-output
+    value: "true"
+  - schema: org.gnome.TextEditor
+    key: highlight-current-line
+    value: "true"
+  - schema: org.gnome.TextEditor
+    key: indent-style
+    value: "'space'"
+  - schema: org.gnome.TextEditor
+    key: indent-width
+    value: "-1"
+  - schema: org.gnome.TextEditor
+    key: right-margin-position
+    value: "uint32 120"
+  - schema: org.gnome.TextEditor
+    key: show-line-numbers
+    value: "true"
+  - schema: org.gnome.TextEditor
+    key: show-right-margin
+    value: "true"
+  - schema: org.gnome.TextEditor
+    key: tab-width
+    value: "uint32 4"
+  - schema: org.gnome.desktop.background
+    key: picture-options
+    value: "'zoom'"
+  - schema: org.gnome.desktop.background
+    key: picture-uri
+    value: "'file:///usr/share/backgrounds/gnome/morphogenesis-l.svg'"
+  - schema: org.gnome.desktop.background
+    key: picture-uri-dark
+    value: "'file:///usr/share/backgrounds/gnome/morphogenesis-d.svg'"
+  - schema: org.gnome.desktop.datetime
+    key: automatic-timezone
+    value: "true"
+  - schema: org.gnome.desktop.input-sources
+    key: sources
+    value: "[('xkb', 'us+alt-intl')]"
+  - schema: org.gnome.desktop.interface
+    key: accent-color
+    value: "'blue'"
+  - schema: org.gnome.desktop.interface
+    key: color-scheme
+    value: "'prefer-dark'"
+  - schema: org.gnome.desktop.peripherals.touchpad
+    key: two-finger-scrolling-enabled
+    value: "true"
+  - schema: org.gnome.desktop.privacy
+    key: remove-old-temp-files
+    value: "true"
+  - schema: org.gnome.desktop.privacy
+    key: remove-old-trash-files
+    value: "true"
+  - schema: org.gnome.desktop.privacy
+    key: report-technical-problems
+    value: "false"
+  - schema: org.gnome.desktop.screensaver
+    key: picture-options
+    value: "'zoom'"
+  - schema: org.gnome.desktop.screensaver
+    key: picture-uri
+    value: "'file:///usr/share/backgrounds/gnome/morphogenesis-l.svg'"
+  - schema: org.gnome.desktop.search-providers
+    key: sort-order
+    value: "['org.gnome.Settings.desktop', 'org.gnome.Contacts.desktop', 'org.gnome.Nautilus.desktop']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-1
+    value: "['<Super>1']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-2
+    value: "['<Super>2']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-3
+    value: "['<Super>3']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-4
+    value: "['<Super>4']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-5
+    value: "['<Super>5']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-6
+    value: "['<Super>6']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-7
+    value: "['<Super>7']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-8
+    value: "['<Super>8']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-9
+    value: "['<Super>9']"
+  - schema: org.gnome.desktop.wm.keybindings
+    key: switch-to-workspace-10
+    value: "['<Super>0']"
+  - schema: org.gnome.meld
+    key: highlight-current-line
+    value: "true"
+  - schema: org.gnome.meld
+    key: highlight-syntax
+    value: "true"
+  - schema: org.gnome.meld
+    key: indent-width
+    value: "4"
+  - schema: org.gnome.meld
+    key: insert-spaces-instead-of-tabs
+    value: "true"
+  - schema: org.gnome.meld
+    key: prefer-dark-theme
+    value: "true"
+  - schema: org.gnome.meld
+    key: show-line-numbers
+    value: "true"
+  - schema: org.gnome.meld
+    key: style-scheme
+    value: "'meld-dark'"
+  - schema: org.gnome.meld
+    key: wrap-mode
+    value: "'none'"
+  - schema: org.gnome.nautilus.list-view
+    key: default-zoom-level
+    value: "'large'"
+  - schema: org.gnome.nautilus.list-view
+    key: use-tree-view
+    value: "false"
+  - schema: org.gnome.nautilus.preferences
+    key: default-folder-viewer
+    value: "'list-view'"
+  - schema: org.gnome.nautilus.preferences
+    key: show-create-link
+    value: "true"
+  - schema: org.gnome.nautilus.preferences
+    key: show-delete-permanently
+    value: "true"
+  - schema: org.gnome.settings-daemon.plugins.color
+    key: night-light-enabled
+    value: "true"
+  - schema: org.gnome.settings-daemon.plugins.media-keys
+    key: custom-keybindings
+    value: "['/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/']"
+  - schema: org.gnome.settings-daemon.plugins.media-keys.custom-keybinding
+    path: /org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/
+    key: binding
+    value: "'<Super>Return'"
+  - schema: org.gnome.settings-daemon.plugins.media-keys.custom-keybinding
+    path: /org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/
+    key: command
+    value: "'ptyxis'"
+  - schema: org.gnome.settings-daemon.plugins.media-keys.custom-keybinding
+    path: /org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/custom0/
+    key: name
+    value: "'Launch Terminal'"
+  - schema: org.gnome.shell
+    key: app-picker-layout
+    value: >-
+      [{'org.fedoraproject.MediaWriter.desktop': <{'position': <0>}>, 'org.gnome.Contacts.desktop': <{'position': <1>}>, 'org.gnome.Weather.desktop': <{'position': <2>}>, 'org.gnome.clocks.desktop': <{'position': <3>}>, 'org.gnome.Maps.desktop': <{'position': <4>}>, 'org.gnome.SimpleScan.desktop': <{'position': <5>}>, 'org.gnome.Settings.desktop': <{'position': <6>}>, 'org.gnome.Boxes.desktop': <{'position': <7>}>, 'org.gnome.Showtime.desktop': <{'position': <8>}>, 'org.gnome.Snapshot.desktop': <{'position': <9>}>, 'org.gnome.Characters.desktop': <{'position': <10>}>, 'Utilities': <{'position': <11>}>, 'System': <{'position': <12>}>, 'org.gnome.Tour.desktop': <{'position': <13>}>, 'org.gnome.Yelp.desktop': <{'position': <14>}>, 'htop.desktop': <{'position': <15>}>, 'libreoffice-writer.desktop': <{'position': <16>}>, 'libreoffice-calc.desktop': <{'position': <17>}>, 'libreoffice-impress.desktop': <{'position': <18>}>, 'libreoffice-draw.desktop': <{'position': <19>}>, 'libreoffice-math.desktop': <{'position': <20>}>, 'libreoffice-base.desktop': <{'position': <21>}>, 'org.gnome.Meld.desktop': <{'position': <22>}>, 'mpv.desktop': <{'position': <23>}>}, {'com.github.jeromerobert.pdfarranger.desktop': <{'position': <0>}>, 'org.remmina.Remmina.desktop': <{'position': <1>}>, 'ch.protonmail.protonmail-bridge.desktop': <{'position': <2>}>, 'org.gnome.TextEditor.desktop': <{'position': <3>}>, 'org.gnome.Software.desktop': <{'position': <4>}>, 'org.gnome.Calculator.desktop': <{'position': <5>}>, 'org.gnome.Calendar.desktop': <{'position': <6>}>, 'com.mattjakeman.ExtensionManager.desktop': <{'position': <7>}>, 'be.alexandervanhee.gradia.desktop': <{'position': <8>}>, 'syncthing-start.desktop': <{'position': <9>}>, 'syncthing-ui.desktop': <{'position': <10>}>}]
+  - schema: org.gnome.shell
+    key: disabled-extensions
+    value: >-
+      ['window-list@gnome-shell-extensions.gcampax.github.com', 'background-logo@fedorahosted.org', 'apps-menu@gnome-shell-extensions.gcampax.github.com', 'places-menu@gnome-shell-extensions.gcampax.github.com', 'maximize-new-windows@VitalyOstanin']
+  - schema: org.gnome.shell
+    key: enabled-extensions
+    value: >-
+      ['status-icons@gnome-shell-extensions.gcampax.github.com', 'gnome-ui-tune@itstime.tech', 'appindicatorsupport@rgcjonas.gmail.com', 'bluetooth-battery-monitor@v8v88v8v88.com', 'clipboard-indicator@tudmotu.com', 'status-area-horizontal-spacing@mathematical.coffee.gmail.com', 'MaximizeWindowIntoNewWorkspace@kyleross.com']
+  - schema: org.gnome.shell
+    key: favorite-apps
+    value: >-
+      ['org.gnome.Nautilus.desktop', 'org.mozilla.firefox.desktop', 'com.spotify.Client.desktop', 'org.mozilla.thunderbird.desktop', 'org.telegram.desktop.desktop', 'org.gnome.Ptyxis.desktop', 'virt-manager.desktop']
+  - schema: org.gnome.shell
+    key: remember-mount-password
+    value: "true"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-1
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-2
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-3
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-4
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-5
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-6
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-7
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-8
+    value: "@as []"
+  - schema: org.gnome.shell.keybindings
+    key: switch-to-application-9
+    value: "@as []"
+  - schema: org.gnome.system.location
+    key: enabled
+    value: "true"

ansible/inventory/host_vars/nymph.yml

@@ -1,44 +1,8 @@
 ---
 hostname: nymph
 
-desktop_emptty_session_error_logging: rotate
-
-host_packages:
-  - nvidia580
-  - linux-mainline-headers
-  - mesa-dri
-  - vulkan-loader
-  - mesa-vulkan-intel
-  - intel-video-accel
-  - power-profiles-daemon
-  - tlp
-  - tlp-rdw
-  - upower
-
-host_enabled_services:
-  - tlp
-
-host_sway_dotfiles:
-  - src: .config/sway/host.conf
-    dest: .config/sway/host.conf
-    mode: "0644"
-  - src: .config/sway/session-env
-    dest: .config/sway/session-env
-    mode: "0644"
-  - src: .config/kanshi/
-    dest: .config/kanshi/
-    mode: preserve
-  - src: .config/wireplumber/wireplumber.conf.d/60-camera-priority.conf
-    dest: .config/wireplumber/wireplumber.conf.d/60-camera-priority.conf
-    mode: "0644"
-
-host_hyprland_dotfiles:
-  - src: .config/hypr/host.conf
-    dest: .config/hypr/host.conf
-    mode: "0644"
-  - src: .config/hypr/session-env
-    dest: .config/hypr/session-env
-    mode: "0644"
-  - src: .config/wireplumber/wireplumber.conf.d/60-camera-priority.conf
-    dest: .config/wireplumber/wireplumber.conf.d/60-camera-priority.conf
-    mode: "0644"
+# Fedora Workstation/GNOME laptop target. GNOME is provided by the base Fedora
+# Workstation install; Ansible deploys shared desktop dotfiles but leaves GNOME
+# settings unmanaged for now.
+host_packages: []
+host_enabled_services: []

ansible/inventory/hosts.yml

@@ -2,6 +2,9 @@
 all:
   children:
     platform_void:
+      hosts: {}
+
+    platform_fedora:
       hosts:
         ikaros:
           ansible_connection: local
@@ -18,6 +21,10 @@ all:
       children:
         platform_void:
 
+    fedora:
+      children:
+        platform_fedora:
+
     graphical_desktop:
       hosts:
         ikaros:
@@ -35,18 +42,18 @@ all:
           ansible_connection: local
 
     role_lab:
-      hosts:
-        nymph:
-          ansible_connection: local
+      hosts: {}
 
     desktop_sway:
-      hosts:
-        ikaros:
-          ansible_connection: local
-        nymph:
-          ansible_connection: local
+      hosts: {}
 
     desktop_hyprland:
+      hosts: {}
+
+    desktop_niri:
+      hosts: {}
+
+    desktop_gnome:
       hosts:
         ikaros:
           ansible_connection: local
@@ -61,10 +68,6 @@ all:
         workstation_dev_wsl:
         ubuntu_server:
 
-    fedora:
-      children:
-        fedora_workstation:
-
     workstation:
       children:
         workstation_host:
@@ -84,19 +87,13 @@ all:
         ubuntu_server:
 
     fedora_workstation:
-      hosts:
-        deadalus-fedora:
-          ansible_connection: local
+      hosts: {}
 
     workstation_host_linux:
-      hosts:
-        deadalus-fedora:
-          ansible_connection: local
+      hosts: {}
 
     workstation_dev_fedora:
-      hosts:
-        deadalus-fedora:
-          ansible_connection: local
+      hosts: {}
 
     workstation_dev_wsl:
       hosts:

ansible/roles/dotfiles_common/tasks/main.yml

@@ -50,6 +50,53 @@
   loop_control:
     label: "{{ item.dest }}"
 
+- name: Install distro packages for Vim plugins
+  tags: [packages, vim, fzf]
+  ansible.builtin.package:
+    name: "{{ vim_plugin_distro_packages | default([]) }}"
+    state: present
+  when:
+    - vim_plugins_enabled | default(false)
+    - (vim_plugin_distro_packages | default([])) | length > 0
+
+- name: Ensure git package is installed for source Vim plugins
+  tags: [packages, vim, fzf]
+  ansible.builtin.package:
+    name: git
+    state: present
+  when:
+    - vim_plugins_enabled | default(false)
+    - (vim_plugin_source_plugins | default([])) | length > 0
+
+- name: Ensure Vim plugin pack directory exists
+  tags: [dotfiles, dotfiles:common, vim, fzf]
+  ansible.builtin.file:
+    path: "{{ effective_user_home }}/.vim/pack/plugins/opt"
+    state: directory
+    owner: "{{ effective_username }}"
+    group: "{{ effective_user_group }}"
+    mode: "0755"
+  when:
+    - vim_plugins_enabled | default(false)
+    - (vim_plugin_source_plugins | default([])) | length > 0
+
+- name: Install source Vim plugins
+  tags: [dotfiles, dotfiles:common, vim, fzf]
+  ansible.builtin.git:
+    repo: "{{ item.repo }}"
+    dest: "{{ effective_user_home }}/.vim/pack/plugins/opt/{{ item.name }}"
+    version: "{{ item.version }}"
+    update: false
+  become_user: "{{ effective_username }}"
+  environment:
+    HOME: "{{ effective_user_home }}"
+  loop: "{{ vim_plugin_source_plugins | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when:
+    - vim_plugins_enabled | default(false)
+    - (vim_plugin_source_plugins | default([])) | length > 0
+
 - name: Ensure AI config directories exist
   tags: [dotfiles, dotfiles:common]
   ansible.builtin.file:

ansible/roles/packages_fedora/tasks/main.yml

@@ -26,7 +26,9 @@
     gpgcheck: true
     gpgkey: https://download.docker.com/linux/fedora/gpg
     state: present
-  when: fedora_manage_docker_repo | default(false)
+  when:
+    - "'workstation_dev_fedora' in group_names"
+    - fedora_manage_docker_repo | default(false)
 
 - name: Configure Google Chrome repository on Fedora
   tags: [packages]
@@ -82,14 +84,27 @@
         (
           (common_packages | default([]))
         + (fedora_packages_base | default([]))
-        + (fedora_docker_packages | default([]))
+        + (
+            (fedora_docker_packages | default([]))
+            if 'workstation_dev_fedora' in group_names
+            else []
+          )
         + (
             ['google-chrome-stable']
             if workstation_manage_google_chrome | default(false)
             else []
           )
         + (profile_packages | default([]))
-        + (fedora_workstation_dev_packages | default(workstation_dev_packages | default([])))
+        + (
+            (fedora_desktop_packages | default([]))
+            if 'graphical_desktop' in group_names
+            else []
+          )
+        + (
+            (fedora_workstation_dev_packages | default(workstation_dev_packages | default([])))
+            if 'workstation_dev_fedora' in group_names
+            else []
+          )
         + (
             (workstation_host_linux_packages_fedora | default(workstation_host_linux_packages | default([])))
             if 'workstation_host_linux' in group_names
@@ -115,25 +130,102 @@
     name: "{{ effective_username }}"
     groups: docker
     append: true
-  when: (fedora_docker_packages | default([])) | length > 0
+  when:
+    - "'workstation_dev_fedora' in group_names"
+    - (fedora_docker_packages | default([])) | length > 0
 
-- name: Ensure Flathub remote is configured for Fedora workstation
+- name: Install Fedora npm packages
+  tags: [packages, npm, ai_agents]
+  community.general.npm:
+    name: "{{ item.name }}"
+    global: true
+    state: "{{ item.state | default('present') }}"
+  loop: "{{ fedora_npm_packages | default([]) }}"
+  when: (fedora_npm_packages | default([])) | length > 0
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Define Fedora Flatpak applications
+  tags: [packages]
+  ansible.builtin.set_fact:
+    packages_fedora_flatpak_packages: >-
+      {{
+        (
+          (fedora_flatpak_packages | default([]))
+          + (host_flatpak_packages | default([]))
+          + (
+              (workstation_flatpak_packages | default([]))
+              if 'workstation_host_linux' in group_names
+              else []
+            )
+        )
+        | unique
+      }}
+
+- name: Ensure Flathub remote is configured on Fedora
   tags: [packages]
   community.general.flatpak_remote:
-    name: "{{ workstation_flatpak_remote_name | default('flathub') }}"
+    name: "{{ fedora_flatpak_remote_name | default('flathub') }}"
     state: present
-    flatpakrepo_url: "{{ workstation_flatpak_remote_url | default('https://dl.flathub.org/repo/flathub.flatpakrepo') }}"
-  when:
-    - "'workstation_host_linux' in group_names"
-    - (workstation_flatpak_packages | default([])) | length > 0
+    flatpakrepo_url: "{{ fedora_flatpak_remote_url | default('https://dl.flathub.org/repo/flathub.flatpakrepo') }}"
+  when: (packages_fedora_flatpak_packages | default([])) | length > 0
 
-- name: Install Fedora workstation Flatpak applications
+- name: Install Fedora Flatpak applications
   tags: [packages]
   community.general.flatpak:
-    name: "{{ workstation_flatpak_packages }}"
+    name: "{{ packages_fedora_flatpak_packages }}"
     state: present
-    remote: "{{ workstation_flatpak_remote_name | default('flathub') }}"
+    remote: "{{ fedora_flatpak_remote_name | default('flathub') }}"
     method: system
-  when:
-    - "'workstation_host_linux' in group_names"
-    - (workstation_flatpak_packages | default([])) | length > 0
+  when: (packages_fedora_flatpak_packages | default([])) | length > 0
+
+- name: Ensure Fedora Nerd Fonts base directory exists
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: /usr/local/share/fonts/nerd-fonts
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: (fedora_nerd_fonts | default([])) | length > 0
+
+- name: Ensure Fedora per-font Nerd Fonts directories exist
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+
+- name: Download Fedora Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.get_url:
+    url: "https://github.com/ryanoasis/nerd-fonts/releases/download/{{ fedora_nerd_fonts_version }}/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+
+- name: Extract Fedora Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.unarchive:
+    src: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    remote_src: true
+    owner: root
+    group: root
+  loop: "{{ fedora_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  register: fedora_nerd_fonts_extract
+
+- name: Refresh system font cache after installing Fedora Nerd Fonts
+  tags: [packages, fonts]
+  ansible.builtin.command: fc-cache -f
+  changed_when: false
+  when: fedora_nerd_fonts_extract is changed

ansible/roles/packages_freebsd/tasks/main.yml

@@ -17,6 +17,11 @@
               if 'desktop_hyprland' in group_names
               else []
             )
+          + (
+              (freebsd_niri_packages | default([]))
+              if 'desktop_niri' in group_names
+              else []
+            )
           + (
               (freebsd_lab_packages | default([]))
               if 'role_lab' in group_names

ansible/roles/packages_mint/tasks/main.yml

@@ -19,6 +19,14 @@
               if 'graphical_desktop' in group_names
               else []
             )
+          + (
+              (mint_emacs_packages | default([]))
+              if (
+                'graphical_desktop' in group_names
+                and (emacs_enabled | default(false) | bool)
+              )
+              else []
+            )
           + (
               (mint_cinnamon_packages | default([]))
               if 'desktop_cinnamon' in group_names

ansible/roles/packages_ubuntu/tasks/main.yml

@@ -52,6 +52,39 @@
     - workstation_manage_google_chrome | default(false)
     - "'google-chrome-stable' not in (ansible_facts.packages | default({}))"
 
+- name: Download glab Debian package
+  tags: [packages]
+  ansible.builtin.get_url:
+    url: >-
+      https://gitlab.com/gitlab-org/cli/-/releases/v{{ workstation_glab_version }}/downloads/glab_{{ workstation_glab_version }}_linux_{{
+        'amd64' if ansible_facts['architecture'] == 'x86_64'
+        else 'arm64' if ansible_facts['architecture'] in ['aarch64', 'arm64']
+        else ansible_facts['architecture']
+      }}.deb
+    dest: "/tmp/glab_{{ workstation_glab_version }}.deb"
+    mode: "0644"
+  when:
+    - workstation_manage_glab | default(false)
+    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
+
+- name: Install glab from downloaded Debian package
+  tags: [packages]
+  ansible.builtin.apt:
+    deb: "/tmp/glab_{{ workstation_glab_version }}.deb"
+    state: present
+  when:
+    - workstation_manage_glab | default(false)
+    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
+
+- name: Remove downloaded glab Debian package
+  tags: [packages]
+  ansible.builtin.file:
+    path: "/tmp/glab_{{ workstation_glab_version }}.deb"
+    state: absent
+  when:
+    - workstation_manage_glab | default(false)
+    - ansible_facts.packages['glab'] is not defined or ansible_facts.packages['glab'][0].version != workstation_glab_version
+
 - name: Ensure Docker apt keyrings directory exists
   tags: [packages]
   ansible.builtin.file:

ansible/roles/packages_void/tasks/main.yml

@@ -76,6 +76,14 @@
             )
             else []
           )
+        + (
+            (desktop_niri_packages | default([]))
+            if (
+              (desktop_environment | default('minimal')) == 'minimal'
+              and 'niri' in (desktop_sessions_enabled | default([]))
+            )
+            else []
+          )
         | unique
       }}
 
@@ -88,6 +96,7 @@
           (desktop_minimal_packages | default([]))
           + (desktop_sway_packages | default([]))
           + (desktop_hyprland_packages | default([]))
+          + (desktop_niri_packages | default([]))
           + (desktop_xfce_packages | default([]))
           + (desktop_kde_packages | default([]))
         )
@@ -105,8 +114,11 @@
           (common_packages | default([]))
         + (void_packages_base | default([]))
         + (profile_packages | default([]))
+        + ((profile_emacs_packages | default([])) if (emacs_enabled | default(false) | bool) else [])
         + (desktop_common_packages | default([]))
+        + ((desktop_emacs_packages | default([])) if (emacs_enabled | default(false) | bool) else [])
         + (packages_void_selected_desktop_packages | default([]))
+        + ((void_lab_packages | default([])) if 'role_lab' in group_names else [])
         + (host_packages | default([]))
         )
         | unique

ansible/roles/profile_desktop_cinnamon/tasks/main.yml

@@ -11,6 +11,12 @@
     - "{{ user_home }}/.config"
     - "{{ user_home }}/.local"
     - "{{ user_home }}/.local/share"
+    - "{{ user_home }}/.local/bin"
+    - "{{ user_home }}/.local/state"
+    - "{{ user_home }}/.bashrc.d"
+    - "{{ user_home }}/.tmux"
+    - "{{ user_home }}/.tmux/bin"
+    - "{{ user_home }}/.tmux/plugins"
 
 - name: Apply Cinnamon dconf settings
   tags: [cinnamon]
@@ -25,3 +31,199 @@
   loop: "{{ cinnamon_dconf_settings | default([]) }}"
   loop_control:
     label: "{{ item.key }}"
+
+- name: Ensure Emacs config directory exists
+  tags: [dotfiles, dotfiles:desktop, emacs]
+  ansible.builtin.file:
+    path: "{{ user_home }}/.emacs.d"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  when: emacs_enabled | default(false) | bool
+
+- name: Ensure GnuPG directory exists
+  tags: [dotfiles, dotfiles:desktop, git]
+  ansible.builtin.file:
+    path: "{{ user_home }}/.gnupg"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0700"
+
+- name: Ensure private user directories exist
+  tags: [dotfiles, dotfiles:desktop]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0700"
+  loop:
+    - "{{ user_home }}/.ssh"
+    - "{{ user_home }}/.local/state/ssh/sockets"
+
+- name: Copy Emacs desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, emacs]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_emacs_dotfiles | default([]) }}"
+  when: emacs_enabled | default(false) | bool
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Copy WM-agnostic common desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: >-
+    {{
+      desktop_common_dotfiles
+      | default([])
+      | rejectattr('name', 'in', cinnamon_desktop_dotfiles_exclude | default([]))
+      | list
+    }}
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Copy gpg-agent configuration
+  tags: [dotfiles, dotfiles:desktop, git]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/.gnupg/gpg-agent.conf"
+    dest: "{{ user_home }}/.gnupg/gpg-agent.conf"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+
+- name: Render git configuration with private values
+  tags: [dotfiles, dotfiles:desktop, git]
+  ansible.builtin.template:
+    src: desktop/.gitconfig.j2
+    dest: "{{ user_home }}/.gitconfig"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+
+- name: Bootstrap tmux plugin manager checkout
+  tags: [dotfiles, dotfiles:desktop, tmux]
+  ansible.builtin.git:
+    repo: https://github.com/tmux-plugins/tpm
+    dest: "{{ user_home }}/.tmux/plugins/tpm"
+    version: master
+    update: true
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+
+- name: Install tmux plugins through TPM
+  tags: [dotfiles, dotfiles:desktop, tmux]
+  ansible.builtin.command:
+    cmd: "{{ user_home }}/.tmux/plugins/tpm/bin/install_plugins"
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  register: cinnamon_tmux_plugin_install
+  changed_when: >-
+    (cinnamon_tmux_plugin_install.stdout | default('')) is search('download success') or
+    (cinnamon_tmux_plugin_install.stderr | default('')) is search('download success')
+
+- name: Install desktop npm packages
+  tags: [packages, npm]
+  community.general.npm:
+    name: "{{ item.name }}"
+    global: true
+    state: "{{ item.state | default('present') }}"
+  become: true
+  loop: "{{ desktop_npm_packages | default([]) }}"
+  when: desktop_npm_packages | length > 0
+  loop_control:
+    label: "{{ item.name }}"
+
+- name: Ensure /usr/src is writable for source builds
+  tags: [packages]
+  ansible.builtin.file:
+    path: /usr/src
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+
+- name: Build and install the gf debugger frontend from source
+  tags: [packages]
+  ansible.builtin.include_tasks:
+    file: "{{ role_path }}/../profile_desktop_common/tasks/source_tool.yml"
+    apply:
+      tags: [packages]
+  loop: >-
+    {{
+      desktop_source_tools
+      | default([])
+      | selectattr('name', 'equalto', 'gf')
+      | list
+    }}
+  loop_control:
+    loop_var: source_tool
+    label: "{{ source_tool.name }}"
+
+- name: Ensure Nerd Fonts base directory exists
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: /usr/local/share/fonts/nerd-fonts
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+
+- name: Ensure per-font Nerd Fonts directories exist
+  tags: [packages, fonts]
+  ansible.builtin.file:
+    path: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  become: true
+  loop: "{{ mint_nerd_fonts | default([]) }}"
+
+- name: Download Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.get_url:
+    url: "https://github.com/ryanoasis/nerd-fonts/releases/download/{{ mint_nerd_fonts_version }}/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    owner: root
+    group: root
+    mode: "0644"
+  become: true
+  loop: "{{ mint_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+
+- name: Extract Nerd Font archives
+  tags: [packages, fonts]
+  ansible.builtin.unarchive:
+    src: "/usr/local/share/fonts/nerd-fonts/{{ item }}.zip"
+    dest: "/usr/local/share/fonts/nerd-fonts/{{ item }}"
+    remote_src: true
+    owner: root
+    group: root
+  become: true
+  loop: "{{ mint_nerd_fonts | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  register: cinnamon_nerd_fonts_extract
+
+- name: Refresh system font cache after installing Nerd Fonts
+  tags: [packages, fonts]
+  ansible.builtin.command: fc-cache -f
+  become: true
+  changed_when: false
+  when: cinnamon_nerd_fonts_extract is changed

ansible/roles/profile_desktop_common/tasks/main.yml

@@ -9,7 +9,7 @@
         or (desktop_sessions_enabled | default([]) | length > 0)
       - >-
         (desktop_environment | default('minimal')) != 'minimal'
-        or (desktop_sessions_enabled | default([]) | difference(['sway', 'hyprland']) | length == 0)
+        or (desktop_sessions_enabled | default([]) | difference(['sway', 'hyprland', 'niri']) | length == 0)
       - >-
         (desktop_environment | default('minimal')) != 'minimal'
         or desktop_default_session in (desktop_sessions_enabled | default([]))
@@ -190,12 +190,27 @@
   loop: "{{ desktop_ufw_rules_effective }}"
   loop_control:
     label: "{{ item.name | default(item.port) }}"
+  when: workstation_firewall_backend | default('ufw') == 'ufw'
 
 - name: Enable UFW firewall on desktop when host rules are defined
   tags: [services, packages]
   community.general.ufw:
     state: enabled
-  when: (desktop_ufw_rules_effective | default([])) | length > 0
+  when:
+    - workstation_firewall_backend | default('ufw') == 'ufw'
+    - (desktop_ufw_rules_effective | default([])) | length > 0
+
+- name: Apply host firewalld rich rules on desktop
+  tags: [services, packages]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ host_firewalld_rich_rules | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when: workstation_firewall_backend | default('ufw') == 'firewalld'
 
 - name: Check whether libvirt service directory exists
   tags: [packages, services]
@@ -315,32 +330,18 @@
     group: "{{ user_group }}"
     mode: "{{ item.mode }}"
   loop: "{{ desktop_emacs_dotfiles | default([]) }}"
+  when: emacs_enabled | default(false) | bool
   loop_control:
     label: "{{ item.dest }}"
 
-- name: Render desktop templates with private values
-  tags: [dotfiles, dotfiles:desktop]
+- name: Render git configuration with private values
+  tags: [dotfiles, dotfiles:desktop, git]
   ansible.builtin.template:
-    src: "{{ item.src }}"
-    dest: "{{ user_home }}/{{ item.dest }}"
+    src: desktop/.gitconfig.j2
+    dest: "{{ user_home }}/.gitconfig"
     owner: "{{ username }}"
     group: "{{ user_group }}"
-    mode: "{{ item.mode }}"
-  loop:
-    - src: desktop/.gitconfig.j2
-      dest: .gitconfig
-      mode: "0644"
-    - src: desktop/.mbsyncrc.j2
-      dest: .mbsyncrc
-      mode: "0600"
-    - src: desktop/.msmtprc.j2
-      dest: .msmtprc
-      mode: "0600"
-    - src: desktop/email.el.j2
-      dest: .emacs.d/lisp/misc/email.el
-      mode: "0644"
-  loop_control:
-    label: "{{ item.dest }}"
+    mode: "0644"
 
 - name: Define managed tmux plugin directories
   tags: [dotfiles, dotfiles:desktop, tmux]
@@ -351,6 +352,7 @@
       - tmux-autoreload
       - tmux-resurrect
       - tmux-continuum
+      - tmux-yank
 
 - name: Check whether tmux plugin directories are git checkouts
   tags: [dotfiles, dotfiles:desktop, tmux]
@@ -451,19 +453,6 @@
     - path: /usr/src
       mode: "0755"
 
-- name: Ensure maildir directories exist
-  tags: [dotfiles, dotfiles:desktop]
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "0700"
-  loop:
-    - "{{ user_home }}/Maildir"
-    - "{{ user_home }}/Maildir/iCloudAccount"
-    - "{{ user_home }}/Maildir/ProtonMailAccount"
-
 - name: Make Qt apps follow the GTK theme
   tags: [theme]
   ansible.builtin.copy:
@@ -592,7 +581,7 @@
     label: "{{ item.name }}"
 
 - name: Install desktop Python tools with uv
-  tags: [packages, emacs]
+  tags: [packages]
   ansible.builtin.command:
     cmd: "uv tool install --upgrade {{ item }}"
   become: true

ansible/roles/profile_desktop_gnome/handlers/main.yml

@@ -0,0 +1,16 @@
+---
+- name: Reload GNOME gpg-agent
+  ansible.builtin.command:
+    argv:
+      - gpgconf
+      - --kill
+      - gpg-agent
+  become_user: "{{ username }}"
+  environment:
+    HOME: "{{ user_home }}"
+  changed_when: false
+
+- name: Reload SSH service
+  ansible.builtin.systemd:
+    name: sshd
+    state: reloaded

ansible/roles/profile_desktop_gnome/tasks/main.yml

@@ -0,0 +1,238 @@
+---
+- name: Ensure GNOME desktop user config directories exist
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config"
+    - "{{ user_home }}/.config/autostart"
+    - "{{ user_home }}/.local"
+    - "{{ user_home }}/.local/bin"
+    - "{{ user_home }}/.bashrc.d"
+    - "{{ user_home }}/.tmux"
+    - "{{ user_home }}/.tmux/bin"
+    - "{{ user_home }}/.tmux/plugins"
+
+- name: Ensure GNOME desktop private directories exist
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop:
+    - path: "{{ user_home }}/.gnupg"
+      mode: "0700"
+    - path: "{{ user_home }}/.ssh"
+      mode: "0700"
+    - path: "{{ user_home }}/.local/state/ssh/sockets"
+      mode: "0700"
+
+- name: Copy GNOME desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, gnome]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_common_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Copy GNOME Emacs desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, emacs, gnome]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_emacs_dotfiles | default([]) }}"
+  when: emacs_enabled | default(false) | bool
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Configure GNOME gpg-agent for Fedora
+  tags: [dotfiles, dotfiles:desktop, git, gnome]
+  ansible.builtin.copy:
+    dest: "{{ user_home }}/.gnupg/gpg-agent.conf"
+    content: |
+      pinentry-program /usr/bin/pinentry-gnome3
+      enable-ssh-support
+      default-cache-ttl 600
+      max-cache-ttl 7200
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+  notify: Reload GNOME gpg-agent
+
+- name: Render GNOME git configuration with private values
+  tags: [dotfiles, dotfiles:desktop, git, gnome]
+  ansible.builtin.template:
+    src: desktop/.gitconfig.j2
+    dest: "{{ user_home }}/.gitconfig"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0644"
+
+- name: Gather GNOME desktop user account data
+  tags: [gnome]
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ username }}"
+  when: (gnome_gsettings_settings | default([])) | length > 0
+
+- name: Set GNOME desktop session environment
+  tags: [gnome]
+  ansible.builtin.set_fact:
+    gnome_user_uid: "{{ ansible_facts.getent_passwd[username][1] }}"
+    gnome_gsettings_environment:
+      HOME: "{{ user_home }}"
+      XDG_RUNTIME_DIR: "/run/user/{{ ansible_facts.getent_passwd[username][1] }}"
+      DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ ansible_facts.getent_passwd[username][1] }}/bus"
+  when: (gnome_gsettings_settings | default([])) | length > 0
+
+- name: Read current GNOME managed settings
+  tags: [gnome]
+  ansible.builtin.command:
+    argv:
+      - gsettings
+      - get
+      - "{{ item.schema }}{{ ':' ~ item.path if item.path is defined else '' }}"
+      - "{{ item.key }}"
+  become_user: "{{ username }}"
+  environment: "{{ gnome_gsettings_environment }}"
+  loop: "{{ gnome_gsettings_settings | default([]) }}"
+  loop_control:
+    label: >-
+      {{ item.schema }}{{ ':' ~ item.path if item.path is defined else '' }} {{ item.key }}
+  register: gnome_gsettings_current
+  changed_when: false
+
+- name: Apply GNOME managed settings
+  tags: [gnome]
+  ansible.builtin.command:
+    argv:
+      - gsettings
+      - set
+      - "{{ item.item.schema }}{{ ':' ~ item.item.path if item.item.path is defined else '' }}"
+      - "{{ item.item.key }}"
+      - "{{ item.item.value }}"
+  become_user: "{{ username }}"
+  environment: "{{ gnome_gsettings_environment }}"
+  loop: "{{ gnome_gsettings_current.results | default([]) }}"
+  loop_control:
+    label: >-
+      {{ item.item.schema }}{{ ':' ~ item.item.path if item.item.path is defined else '' }} {{ item.item.key }}
+  changed_when: true
+  when: item.stdout | trim != item.item.value
+
+- name: Check whether SSH host ed25519 key exists on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.stat:
+    path: /etc/ssh/ssh_host_ed25519_key
+  register: gnome_ssh_host_ed25519_key
+  when:
+    - (host_sshd_settings | default({})) | length > 0
+      or (host_sshd_allow_users | default([])) | length > 0
+
+- name: Generate missing SSH host keys on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.command: ssh-keygen -A
+  changed_when: true
+  when:
+    - (host_sshd_settings | default({})) | length > 0
+      or (host_sshd_allow_users | default([])) | length > 0
+    - not gnome_ssh_host_ed25519_key.stat.exists
+
+- name: Define safe GNOME SSH daemon settings
+  tags: [services, gnome]
+  ansible.builtin.set_fact:
+    gnome_sshd_settings_effective: >-
+      {{
+        host_sshd_settings | default({})
+        if (
+          (host_authorized_ssh_keys | default([])) | length > 0
+          or (host_sshd_settings | default({})).PasswordAuthentication | default('yes') != 'no'
+        )
+        else (
+          host_sshd_settings | default({}) | dict2items
+          | rejectattr('key', 'in', ['PasswordAuthentication', 'KbdInteractiveAuthentication'])
+          | items2dict
+        )
+      }}
+
+- name: Warn when keeping SSH password authentication enabled on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.debug:
+    msg: >-
+      SSH password authentication hardening was skipped because no authorized SSH
+      keys are defined for this host. Set host_authorized_ssh_keys via vault
+      variables, then re-run the playbook to disable password authentication.
+  when:
+    - "'sshd' in (host_enabled_services | default([]))"
+    - (host_sshd_settings | default({})).PasswordAuthentication | default('yes') == 'no'
+    - (host_authorized_ssh_keys | default([])) | length == 0
+
+- name: Ensure GNOME desktop user authorized_keys file exists
+  tags: [services, dotfiles, gnome]
+  ansible.builtin.file:
+    path: "{{ user_home }}/.ssh/authorized_keys"
+    state: touch
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0600"
+  when: (host_authorized_ssh_keys | default([])) | length > 0
+
+- name: Manage GNOME desktop user authorized SSH keys exclusively
+  tags: [services, dotfiles, gnome]
+  ansible.posix.authorized_key:
+    user: "{{ username }}"
+    key: "{{ host_authorized_ssh_keys | join('\n') }}"
+    state: present
+    exclusive: true
+    manage_dir: false
+  when: (host_authorized_ssh_keys | default([])) | length > 0
+
+- name: Apply SSH daemon settings on GNOME desktop
+  tags: [services, gnome]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*{{ item.key }}\s+'
+    line: "{{ item.key }} {{ item.value }}"
+    state: present
+    validate: "sshd -t -f %s"
+  notify: Reload SSH service
+  loop: "{{ gnome_sshd_settings_effective | default({}) | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+  when: (gnome_sshd_settings_effective | default({})) | length > 0
+
+- name: Restrict SSH login to allowed GNOME desktop users
+  tags: [services, gnome]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*AllowUsers\s+'
+    line: "AllowUsers {{ host_sshd_allow_users | join(' ') }}"
+    state: present
+    validate: "sshd -t -f %s"
+  notify: Reload SSH service
+  when: (host_sshd_allow_users | default([])) | length > 0
+
+- name: Apply host firewalld rich rules on GNOME desktop
+  tags: [services, packages, gnome]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+  loop: "{{ host_firewalld_rich_rules | default([]) }}"
+  loop_control:
+    label: "{{ item }}"
+  when: workstation_firewall_backend | default('firewalld') == 'firewalld'

ansible/roles/profile_desktop_niri/files/niri-portals.conf

@@ -0,0 +1,4 @@
+[preferred]
+default=gtk
+org.freedesktop.impl.portal.Screenshot=gtk
+org.freedesktop.impl.portal.ScreenCast=gtk

ansible/roles/profile_desktop_niri/files/niri.desktop

@@ -0,0 +1,5 @@
+[Desktop Entry]
+Name=Niri
+Comment=Niri scrollable-tiling (Wayland)
+Exec=/usr/local/bin/start-niri
+Type=Application

ansible/roles/profile_desktop_niri/tasks/main.yml

@@ -0,0 +1,81 @@
+---
+- name: Ensure niri config directories exist
+  tags: [dotfiles, dotfiles:desktop, niri]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config/foot"
+    - "{{ user_home }}/.config/dunst"
+    - "{{ user_home }}/.config/rofi"
+    - "{{ user_home }}/.config/waybar"
+    - "{{ user_home }}/.config/niri"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Install allowed emptty Wayland sessions
+  tags: [packages, services, emptty, niri]
+  ansible.builtin.copy:
+    src: niri.desktop
+    dest: /etc/emptty/wayland-sessions/niri.desktop
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Install Niri session launcher in /usr/local/bin
+  tags: [packages, services, niri]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/.local/bin/start-niri"
+    dest: /usr/local/bin/start-niri
+    owner: root
+    group: root
+    mode: "0755"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Ensure /etc/xdg/xdg-desktop-portal exists
+  tags: [packages, services, niri, portal]
+  ansible.builtin.file:
+    path: /etc/xdg/xdg-desktop-portal
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Configure xdg-desktop-portal backend preferences for niri
+  tags: [packages, services, niri, portal]
+  ansible.builtin.copy:
+    src: niri-portals.conf
+    dest: /etc/xdg/xdg-desktop-portal/niri-portals.conf
+    owner: root
+    group: root
+    mode: "0644"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"
+
+- name: Copy niri desktop dotfiles
+  tags: [dotfiles, dotfiles:desktop, niri]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_niri_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+  when:
+    - (desktop_environment | default('minimal')) == 'minimal'
+    - "'niri' in (desktop_sessions_enabled | default([]))"

ansible/roles/profile_desktop_niri_freebsd/tasks/main.yml

@@ -0,0 +1,41 @@
+---
+- name: Ensure FreeBSD Niri user config directories exist
+  tags: [dotfiles, dotfiles:desktop, niri]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - "{{ user_home }}/.config"
+    - "{{ user_home }}/.config/dunst"
+    - "{{ user_home }}/.config/foot"
+    - "{{ user_home }}/.config/niri"
+    - "{{ user_home }}/.config/rofi"
+    - "{{ user_home }}/.config/waybar"
+    - "{{ user_home }}/.local"
+    - "{{ user_home }}/.local/bin"
+    - "{{ user_home }}/.local/state"
+    - "{{ user_home }}/.local/state/ssh-agent"
+
+- name: Copy common Niri desktop dotfiles on FreeBSD
+  tags: [dotfiles, dotfiles:desktop, niri]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/desktop/{{ item.src }}"
+    dest: "{{ user_home }}/{{ item.dest }}"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ desktop_niri_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+
+- name: Render FreeBSD Niri session launcher
+  tags: [packages, services, niri]
+  ansible.builtin.template:
+    src: start-niri-session.j2
+    dest: /usr/local/bin/start-niri-session
+    owner: root
+    group: wheel
+    mode: "0755"

ansible/roles/profile_desktop_niri_freebsd/templates/start-niri-session.j2

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+[ -r /etc/profile ] && . /etc/profile
+[ -r "$HOME/.profile" ] && . "$HOME/.profile"
+
+export XDG_CURRENT_DESKTOP=niri
+export XDG_SESSION_DESKTOP=niri
+export XDG_SESSION_TYPE=wayland
+
+export MOZ_ENABLE_WAYLAND=1
+export QT_QPA_PLATFORM='wayland;xcb'
+export _JAVA_AWT_WM_NONREPARENTING=1
+export SDL_VIDEODRIVER=wayland
+export GDK_BACKEND='wayland,x11'
+
+export SSH_AUTH_SOCK="$HOME/.local/state/ssh-agent/socket"
+
+[ -r "$HOME/.config/niri/session-env" ] && . "$HOME/.config/niri/session-env"
+
+if command -v dbus-run-session >/dev/null 2>&1; then
+  exec dbus-run-session niri --session
+fi
+
+exec niri --session

ansible/roles/profile_workstation_dev_wsl/tasks/main.yml

@@ -1,8 +1,21 @@
 ---
+- name: Ensure WSL tmux directories exist
+  tags: [dotfiles, dotfiles:workstation, tmux, wsl]
+  ansible.builtin.file:
+    path: "{{ user_home }}/{{ item }}"
+    state: directory
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+  loop:
+    - .tmux
+    - .tmux/bin
+    - .tmux/plugins
+
 - name: Copy workstation WSL dotfiles
   tags: [dotfiles, dotfiles:workstation, wsl]
   ansible.builtin.copy:
-    src: "{{ playbook_dir }}/../dotfiles/workstation_dev_wsl/{{ item.src }}"
+    src: "{{ playbook_dir }}/../dotfiles/{{ item.source_dir | default('workstation_dev_wsl') }}/{{ item.src }}"
     dest: "{{ user_home }}/{{ item.dest }}"
     owner: "{{ username }}"
     group: "{{ user_group }}"

ansible/site.yml

@@ -38,10 +38,18 @@
     - profile_desktop_common
     - profile_desktop_sway
     - profile_desktop_hyprland
+    - profile_desktop_niri
     - profile_desktop_kde
     - profile_desktop_xfce
     - profile_desktop_host
 
+- name: Configure lab role on Void
+  hosts: platform_void:&role_lab
+  become: true
+
+  roles:
+    - profile_lab
+
 - name: Configure Linux Mint platform
   hosts: platform_mint
   become: true
@@ -79,20 +87,40 @@
   roles:
     - profile_lab
 
-- name: Configure Hyprland desktop on FreeBSD
-  hosts: platform_freebsd:&desktop_hyprland
+- name: Configure Niri desktop on FreeBSD
+  hosts: platform_freebsd:&desktop_niri
   become: true
 
   roles:
-    - profile_desktop_hyprland_freebsd
+    - profile_desktop_niri_freebsd
+
+- name: Configure Fedora platform
+  hosts: platform_fedora
+  become: true
+
+  roles:
+    - packages_fedora
+    - services_systemd
+
+- name: Configure personal workstation role on Fedora
+  hosts: platform_fedora:&role_personal_workstation
+  become: true
+
+  roles:
+    - profile_personal_workstation
+
+- name: Configure Fedora GNOME desktop
+  hosts: platform_fedora:&desktop_gnome
+  become: true
+
+  roles:
+    - profile_desktop_gnome
 
 - name: Configure Fedora workstation development layer
   hosts: workstation_dev_fedora
   become: true
 
   roles:
-    - packages_fedora
-    - services_systemd
     - profile_workstation_dev_common
 
 - name: Configure native Linux workstation host layer

ansible/templates/desktop/.gitconfig.j2

@@ -29,9 +29,19 @@
 [mergetool]
   prompt = false
 
+[mergetool "meld"]
+  cmd = meld "$LOCAL" "$BASE" "$REMOTE" --output "$MERGED"
+  trustExitCode = false
+
 [diff]
   tool = meld
 
+[difftool]
+  prompt = false
+
+[difftool "meld"]
+  cmd = meld "$LOCAL" "$REMOTE"
+
 [color]
   ui = always
 

ansible/templates/desktop/.mbsyncrc.j2

@@ -1,47 +0,0 @@
-##################### iCloud Account ##################################
-IMAPStore iCloud-remote
-    Host imap.mail.me.com
-    Port 993
-    User {{ vault_icloud_email }}
-    PassCmd "secret-tool lookup icloud-mail icloud"
-    AuthMechs *
-    TLSType IMAPS
-    TLSVersions +1.2 +1.3
-    PipelineDepth 1
-
-MaildirStore iCloud-local
-    Path ~/Maildir/iCloudAccount/
-    Inbox ~/Maildir/iCloudAccount/INBOX
-    SubFolders Verbatim
-
-Channel iCloud
-    Far :iCloud-remote:
-    Near :iCloud-local:
-    Patterns *
-    Create Both
-    Expunge Both
-    SyncState *
-
-##################### Protonmail Account ##################################
-IMAPStore protonmail-remote
-    Host 127.0.0.1
-    Port 1143
-    User {{ vault_protonmail_email }}
-    PassCmd "secret-tool lookup protonmail-bridge protonmail"
-    AuthMechs *
-    TLSType STARTTLS
-    PipelineDepth 1
-    CertificateFile  {{ desktop_protonmail_bridge_cert_path }}
-
-MaildirStore protonmail-local
-    Path ~/Maildir/ProtonMailAccount/
-    Inbox ~/Maildir/ProtonMailAccount/INBOX
-    SubFolders Verbatim
-
-Channel Protonmail
-    Far :protonmail-remote:
-    Near :protonmail-local:
-    Patterns *
-    Create Both
-    Expunge Both
-    SyncState *

ansible/templates/desktop/.msmtprc.j2

@@ -1,51 +0,0 @@
-# Set default values for all following accounts.
-defaults
-
-# Always use TLS
-tls            on
-
-# Set a list of trusted CAs for TLS. The default is to use system settings,
-# but you can select your own file.
-tls_trust_file /etc/ssl/certs/ca-certificates.crt
-logfile        ~/.cache/msmtp.log
-
-# Account iCloud
-account        icloud
-
-# Host name of the SMTP server
-host           smtp.mail.me.com
-
-# Use the mail submission port 587 instead of the SMTP port 25
-port           587
-
-# Envelop-from address
-from           {{ vault_icloud_email }}
-
-# Authentication. The password is given using one of five methods
-auth           on
-user           {{ vault_icloud_email }}
-passwordeval   "secret-tool lookup icloud-mail icloud"
-
-# Account Protonmail
-account        protonmail
-
-# Hostname of the Protonmail bridge
-host           127.0.0.1
-
-# Port of the Protonmail bridge
-port           1025
-
-# Envelop-from address
-from           {{ vault_protonmail_email }}
-
-# Security
-tls on
-tls_trust_file {{ desktop_protonmail_bridge_cert_path }}
-
-# Authentication
-auth           on
-user           {{ vault_protonmail_email }}
-passwordeval   "secret-tool lookup protonmail-bridge protonmail"
-
-# Set a default account
-account default : icloud

ansible/templates/desktop/email.el.j2

@@ -1,53 +0,0 @@
-;;; email.el -*-
-
-(use-package mu4e
-  :ensure nil
-  :load-path "/usr/share/emacs/site-lisp/mu4e/"
-  :defer 20 ; Wait until 20 seconds after startup
-  :config
-  ;; This is set to 't' to avoid mail syncing issues when using mbsync
-  (setq mu4e-change-filenames-when-moving t)
-
-  ;; Refresh mail using isync every 10 minutes
-  (setq mu4e-update-interval (* 10 60))
-  (setq mu4e-get-mail-command "~/.emacs.d/scripts/email_sync.sh")
-  (setq mu4e-maildir "~/Maildir")
-
-    ;; Configure email accounts
-  (setq mu4e-contexts
-        (list
-         ;; Protonmail Account
-         (make-mu4e-context
-          :name "Protonmail"
-          :match-func
-          (lambda (msg)
-            (when msg
-              (string-prefix-p "/ProtonMailAccount" (mu4e-message-field msg :maildir))))
-          :vars '((user-mail-address . "{{ vault_protonmail_email }}")
-                  (user-full-name . "{{ vault_personal_full_name }}")
-                  (mu4e-drafts-folder . "/ProtonMailAccount/Drafts")
-                  (mu4e-sent-folder . "/ProtonMailAccount/Sent")
-                  (mu4e-refile-folder . "/ProtonMailAccount/All Mail")
-                  (mu4e-trash-folder . "/ProtonMailAccount/Trash")))
-
-         ;; iCloud Account
-         (make-mu4e-context
-          :name "iCloud Mail"
-          :match-func
-          (lambda (msg)
-            (when msg
-              (string-prefix-p "/iCloudAccount" (mu4e-message-field msg :maildir))))
-          :vars '((user-mail-address . "{{ vault_icloud_email }}")
-                  (user-full-name . "{{ vault_personal_full_name }}")
-                  (mu4e-drafts-folder . "/iCloudAccount/Drafts")
-                  (mu4e-sent-folder . "/iCloudAccount/Sent Messages")
-                  (mu4e-refile-folder . "/iCloudAccount/INBOX")
-                  (mu4e-trash-folder . "/iCloudAccount/Junk")))))
-
-  (setq sendmail-program "/usr/bin/msmtp"
-      mail-user-agent 'mu4e-user-agent
-      read-mail-command 'mu4e
-      send-mail-function 'sendmail-send-it
-      message-sendmail-f-is-evil t
-      message-sendmail-extra-arguments '("--read-envelope-from")
-      message-send-mail-function 'message-send-mail-with-sendmail))

ansible/templates/workstation/.gitconfig.j2

@@ -72,12 +72,12 @@
   ld = log -p
   lg = log --graph --abbrev-commit --decorate --date=relative --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)%n' --all
   glog = log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset'
-  onelinegraph = log --oneline --graph --decorate 
+  onelinegraph = log --oneline --graph --decorate
   undo = reset --soft HEAD~1
   stash-all = stash save --include-untracked
   expireunreachablenow = reflog expire --expire-unreachable=now --all
-  gcunreachablenow = gc --prune=now 
- 
+  gcunreachablenow = gc --prune=now
+
 [include]
   path = ~/.themes.gitignore
 
@@ -87,3 +87,15 @@
   colorMoved = default
   tabs = 4
   side-by-side = true
+
+[http "https://gitlab.ecaas.datacenter.comune.roma"]
+  sslBackend = gnutls
+  sslCAInfo = ~/.local/share/certs/ecaas.datacenter.comune.roma.crt
+
+[http "https://gitlab.datacenter.comune.roma"]
+  sslBackend = gnutls
+  sslCAInfo = ~/.local/share/certs/datacenter.comune.roma.crt
+
+[credential]
+  helper = store
+

dotfiles/common/.bashrc

@@ -227,10 +227,31 @@ bind '"\e[5C": forward-word'
 bind '"\e[5D": backward-word'
 
 # =========================
-# fzf history on Ctrl-r
+# fzf: Ptyxis Linux Minimal
 # =========================
 
 if command -v fzf >/dev/null 2>&1; then
+  FZF_PTYXIS_LINUX_OPTS="
+    --layout=reverse
+    --border=rounded
+    --height=40%
+    --info=inline
+    --prompt='› '
+    --pointer='›'
+    --marker='✓'
+    --separator='─'
+    --scrollbar='│'
+    --color=bg:#000000,bg+:#000000,gutter:#000000
+    --color=fg:#d7d7d7,fg+:#ffffff,hl:#55ff55,hl+:#55ff55
+    --color=prompt:#55ff55,pointer:#5555ff,marker:#ffff55,spinner:#5555ff
+    --color=info:#808080,header:#808080,border:#303030
+  "
+  export FZF_DEFAULT_OPTS="${FZF_DEFAULT_OPTS:+$FZF_DEFAULT_OPTS }$FZF_PTYXIS_LINUX_OPTS"
+
+# =========================
+# fzf history on Ctrl-r
+# =========================
+
   __fzf_history() {
     local selected history_data
 
@@ -252,7 +273,7 @@ if command -v fzf >/dev/null 2>&1; then
       )"
     fi
 
-    selected="$(printf '%s\n' "$history_data" | fzf --height 40% --layout=reverse --border --prompt='history> ')" || return
+    selected="$(printf '%s\n' "$history_data" | fzf --prompt='history> ')" || return
 
     READLINE_LINE=$selected
     READLINE_POINT=${#READLINE_LINE}

dotfiles/common/.vimrc

@@ -89,7 +89,7 @@ nnoremap <silent> <leader>h :set hlsearch!<CR>
 " ----------------------------------------------------------
 
 set updatetime=250
-set timeoutlen=400
+set timeoutlen=800
 set ttimeoutlen=10
 set shortmess+=c
 
@@ -149,6 +149,139 @@ endif
 nnoremap <silent> <leader>g :silent grep! <C-R><C-W> .<CR>:copen<CR>
 nnoremap          <leader>/ :silent grep!<Space>
 
+" ----------------------------------------------------------
+" Optional plugins
+" ----------------------------------------------------------
+
+" Plugins are installed out-of-band by Ansible when available.  Keep this
+" vimrc usable as a standalone onefile: load optional packages only when they
+" exist and keep builtin fallbacks for the mappings below.
+let s:fzf_min_version = [0, 54, 0]
+
+function! s:PackAdd(package) abort
+  silent! execute "packadd " . a:package
+endfunction
+
+function! s:PackAddForCommand(package, command) abort
+  if exists(":" . a:command) == 2
+    return 1
+  endif
+
+  call s:PackAdd(a:package)
+  return exists(":" . a:command) == 2
+endfunction
+
+function! s:PackAddByRuntimeFile(runtime_file, command) abort
+  if exists(":" . a:command) == 2
+    return 1
+  endif
+
+  " Distro packages and source installs do not always use the same Vim package
+  " directory name.  Look for a package containing the expected runtime file and
+  " load it by its actual directory name.
+  for l:packpath in split(&packpath, ",")
+    let l:packages = glob(l:packpath . "/pack/*/opt/*", 0, 1)
+          \ + glob(l:packpath . "/pack/*/start/*", 0, 1)
+    for l:package_dir in l:packages
+      if filereadable(l:package_dir . "/" . a:runtime_file)
+        call s:PackAdd(fnamemodify(l:package_dir, ":t"))
+        if exists(":" . a:command) == 2
+          return 1
+        endif
+      endif
+    endfor
+  endfor
+
+  return 0
+endfunction
+
+let s:has_fzf = s:PackAddForCommand("fzf", "FZF")
+      \ || s:PackAddByRuntimeFile("plugin/fzf.vim", "FZF")
+let s:has_fzf_vim = s:has_fzf
+      \ && (s:PackAddForCommand("fzf.vim", "Files")
+      \     || s:PackAddByRuntimeFile("autoload/fzf/vim.vim", "Files"))
+let s:has_vim_fugitive = s:PackAddForCommand("vim-fugitive", "Git")
+      \ || s:PackAddByRuntimeFile("autoload/fugitive.vim", "Git")
+
+function! s:FzfExecutable() abort
+  if executable("fzf")
+    return "fzf"
+  endif
+
+  return ""
+endfunction
+
+function! s:FzfVersionOk() abort
+  let l:fzf = s:FzfExecutable()
+  if empty(l:fzf)
+    return 0
+  endif
+
+  let l:version = matchstr(get(systemlist(l:fzf . " --version"), 0, ""), '^\d\+\.\d\+\.\d\+')
+  if empty(l:version)
+    return 0
+  endif
+
+  let l:parts = map(split(l:version, '\.'), 'str2nr(v:val)')
+  return l:parts[0] > s:fzf_min_version[0]
+        \ || (l:parts[0] == s:fzf_min_version[0] && l:parts[1] > s:fzf_min_version[1])
+        \ || (l:parts[0] == s:fzf_min_version[0] && l:parts[1] == s:fzf_min_version[1]
+        \     && l:parts[2] >= s:fzf_min_version[2])
+endfunction
+
+if s:has_fzf_vim && s:FzfVersionOk()
+  let g:fzf_layout = {"down": "40%"}
+  let g:fzf_colors = {
+        \ "fg": ["fg", "Normal"],
+        \ "bg": ["bg", "Normal"],
+        \ "hl": ["fg", "Search"],
+        \ "fg+": ["fg", "Normal"],
+        \ "bg+": ["bg", "Normal"],
+        \ "hl+": ["fg", "Search"],
+        \ "info": ["fg", "Comment"],
+        \ "prompt": ["fg", "String"],
+        \ "pointer": ["fg", "Statement"],
+        \ "marker": ["fg", "WarningMsg"],
+        \ "spinner": ["fg", "Statement"],
+        \ "header": ["fg", "Comment"],
+        \ }
+  let g:fzf_vim = get(g:, "fzf_vim", {})
+  let g:fzf_vim.preview_window = ["right,50%", "ctrl-/"]
+endif
+
+function! s:FzfCommand(command) abort
+  if s:has_fzf_vim && s:FzfVersionOk() && exists(":" . a:command) == 2
+    execute a:command
+  elseif a:command ==# "Files" || a:command ==# "GFiles" || a:command ==# "GitFiles"
+    edit .
+  elseif a:command ==# "Buffers"
+    ls
+  elseif a:command ==# "Rg"
+    silent grep! <cword> .
+    copen
+  endif
+endfunction
+
+function! s:GitStatus() abort
+  if s:has_vim_fugitive && exists(":Git") == 2
+    Git
+  elseif executable("git")
+    botright new
+    setlocal buftype=nofile bufhidden=wipe noswapfile nobuflisted
+    silent read !git status --short --branch
+    1delete _
+    file git-status
+  else
+    echohl WarningMsg | echom "git executable not found" | echohl None
+  endif
+endfunction
+
+nnoremap <silent> <leader>ff :call <SID>FzfCommand("Files")<CR>
+nnoremap <silent> <leader>fg :call <SID>FzfCommand("GFiles")<CR>
+nnoremap <silent> <leader>fb :call <SID>FzfCommand("Buffers")<CR>
+nnoremap <silent> <leader>fr :call <SID>FzfCommand("Rg")<CR>
+nnoremap <silent> <leader>gs :call <SID>GitStatus()<CR>
+
 " ----------------------------------------------------------
 " Quickfix / location list
 " ----------------------------------------------------------

dotfiles/common/.vimrc.shortcuts.md

@@ -0,0 +1,102 @@
+# Vim shortcuts
+
+Configurazione sorgente: `.vimrc`.
+
+- Leader: `Space`
+- Local leader: `\\`
+- Le shortcut sotto sono pensate per normal mode, salvo dove indicato.
+- `timeoutlen` è impostato a `800 ms`: premi le sequenze con leader senza aspettare troppo.
+
+## Base
+
+| Shortcut | Azione |
+|---|---|
+| `Space l` | Toggle caratteri invisibili / whitespace |
+| `Space h` | Toggle evidenziazione ricerca |
+| `Space w` | Salva file corrente |
+| `Space q` | Chiudi finestra corrente |
+| `Space x` | Salva e chiudi |
+| `Space z` | Toggle fold sotto il cursore |
+
+## Ricerca
+
+| Shortcut | Azione |
+|---|---|
+| `Space g` | Cerca la parola sotto il cursore nel progetto e apre quickfix |
+| `Space /` | Avvia `:grep!` manuale |
+
+## FZF / file / Git
+
+Queste shortcut usano `fzf.vim` quando disponibile; altrimenti cadono su fallback portabili.
+
+| Shortcut | Azione |
+|---|---|
+| `Space ff` | `:Files`, fallback `:edit .` |
+| `Space fg` | `:GFiles`, fallback `:edit .` |
+| `Space fb` | `:Buffers`, fallback `:ls` |
+| `Space fr` | `:Rg`, fallback `:grep! <cword> .` + quickfix |
+| `Space gs` | `:Git` con vim-fugitive, fallback buffer con `git status` |
+
+## Quickfix e location list
+
+| Shortcut | Azione |
+|---|---|
+| `]q` | Prossimo elemento quickfix |
+| `[q` | Precedente elemento quickfix |
+| `Space qo` | Apri quickfix |
+| `Space qc` | Chiudi quickfix |
+| `]l` | Prossimo elemento location list |
+| `[l` | Precedente elemento location list |
+| `Space lo` | Apri location list |
+| `Space lc` | Chiudi location list |
+
+## Finestre
+
+| Shortcut | Azione |
+|---|---|
+| `Ctrl h` | Vai alla finestra a sinistra |
+| `Ctrl j` | Vai alla finestra sotto |
+| `Ctrl k` | Vai alla finestra sopra |
+| `Ctrl l` | Vai alla finestra a destra |
+
+## Diff
+
+| Shortcut | Azione |
+|---|---|
+| `Space df` | Attiva diff su tutte le finestre |
+| `Space do` | Disattiva diff su tutte le finestre |
+
+## Tags e preview
+
+| Shortcut | Azione |
+|---|---|
+| `Space t` | Vai al tag della parola sotto il cursore |
+| `Space pt` | Apri il tag in preview window |
+| `Space po` | Apri preview window |
+| `Space pc` | Chiudi preview window |
+| `K` | Apri la man page della parola sotto il cursore |
+
+## Cscope
+
+Disponibili solo se Vim ha supporto `cscope`.
+
+| Shortcut | Azione |
+|---|---|
+| `Space cs` | Cerca simbolo |
+| `Space cg` | Cerca definizione |
+| `Space cd` | Cerca funzioni chiamate dal simbolo |
+| `Space cc` | Cerca chiamanti |
+| `Space ct` | Cerca testo |
+| `Space ce` | Cerca egrep |
+| `Space ci` | Cerca include |
+
+Nota: `Space cf` è riservato a ClangFormat, quindi non usarlo per cscope file search.
+
+## Format, build e run
+
+| Shortcut | Modo | Azione |
+|---|---|---|
+| `Space cf` | normal | Esegue `clang-format` sul file |
+| `Space cf` | visual | Esegue `clang-format` sulla selezione |
+| `Space m` | normal | Build smart: `ninja`, `cmake --build build`, `make -C <root>` o `make` |
+| `Space r` | normal | Salva ed esegue il file corrente; supporta C, Python e shell |

dotfiles/desktop/.bashrc.d/20-editor-desktop.sh

@@ -1,2 +1,2 @@
 export EDITOR=vim
-export VISUAL=emacs
+export VISUAL=vim

dotfiles/desktop/.config/niri/config.kdl

@@ -0,0 +1,88 @@
+// Minimal niri profile for the laptop.
+// niri arranges windows in scrollable columns, which keeps small laptop screens usable.
+
+input {
+    keyboard {
+        xkb {
+            layout "us"
+            variant "intl"
+        }
+    }
+
+    touchpad {
+        tap
+        natural-scroll
+    }
+}
+
+layout {
+    gaps 12
+    center-focused-column "on-overflow"
+
+    preset-column-widths {
+        proportion 0.33333
+        proportion 0.5
+        proportion 0.66667
+    }
+
+    default-column-width { proportion 0.5; }
+
+    focus-ring {
+        width 4
+        active-color "#54d6ff"
+        inactive-color "#505050"
+    }
+}
+
+spawn-at-startup "waybar"
+
+prefer-no-csd
+screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png"
+
+binds {
+    Mod+Shift+Slash { show-hotkey-overlay; }
+
+    Mod+Return hotkey-overlay-title="Open a Terminal" { spawn "foot"; }
+    Mod+D hotkey-overlay-title="Run an Application" { spawn "rofi" "-show" "drun"; }
+    Mod+B hotkey-overlay-title="Open Browser" { spawn "firefox"; }
+
+    Mod+Q repeat=false { close-window; }
+    Mod+O repeat=false { toggle-overview; }
+
+    Mod+H { focus-column-left; }
+    Mod+J { focus-window-down; }
+    Mod+K { focus-window-up; }
+    Mod+L { focus-column-right; }
+
+    Mod+Ctrl+H { move-column-left; }
+    Mod+Ctrl+J { move-window-down; }
+    Mod+Ctrl+K { move-window-up; }
+    Mod+Ctrl+L { move-column-right; }
+
+    Mod+U { focus-workspace-down; }
+    Mod+I { focus-workspace-up; }
+    Mod+Ctrl+U { move-column-to-workspace-down; }
+    Mod+Ctrl+I { move-column-to-workspace-up; }
+
+    Mod+1 { focus-workspace 1; }
+    Mod+2 { focus-workspace 2; }
+    Mod+3 { focus-workspace 3; }
+    Mod+4 { focus-workspace 4; }
+    Mod+5 { focus-workspace 5; }
+    Mod+Ctrl+1 { move-column-to-workspace 1; }
+    Mod+Ctrl+2 { move-column-to-workspace 2; }
+    Mod+Ctrl+3 { move-column-to-workspace 3; }
+    Mod+Ctrl+4 { move-column-to-workspace 4; }
+    Mod+Ctrl+5 { move-column-to-workspace 5; }
+
+    Mod+R { switch-preset-column-width; }
+    Mod+F { maximize-column; }
+    Mod+Shift+F { fullscreen-window; }
+    Mod+V { toggle-window-floating; }
+
+    Mod+Minus { set-column-width "-10%"; }
+    Mod+Equal { set-column-width "+10%"; }
+
+    Print { screenshot; }
+    Mod+Shift+E { quit; }
+}

dotfiles/desktop/.config/niri/session-env

@@ -0,0 +1 @@
+# Per-host Niri environment overrides. Empty by default.

dotfiles/desktop/.emacs.d/init.el

@@ -42,7 +42,6 @@
   'misc/doom-modeline
   'misc/which-key
   'misc/gptel
-  'misc/email
   'misc/rss
   'misc/terminal
   'misc/vcs

dotfiles/desktop/.emacs.d/lisp/core/keybindings.el

@@ -59,12 +59,6 @@
 (with-eval-after-load 'vterm
   (define-key vterm-mode-map (kbd "C-c C-t") #'vterm-copy-mode))
 
-;; -------- mu4e --------
-(autoload 'mu4e "mu4e" nil t)
-(autoload 'mu4e-compose-new "mu4e" nil t)
-(global-set-key (kbd "C-x m") #'mu4e-compose-new)
-(define-key fscotto/open (kbd "m") #'mu4e)
-
 ;; -------- elfeed --------
 (autoload 'elfeed "elfeed" nil t)
 (define-key fscotto/open (kbd "f") #'fscotto/elfeed-load-db-and-open)

dotfiles/desktop/.emacs.d/lisp/lang/python.el

@@ -1,6 +1,8 @@
 ;;; python.el -*- lexical-binding: t; -*-
 
-(require 'reformatter)
+(use-package reformatter
+  :ensure t
+  :demand t)
 
 (with-eval-after-load 'project
   (add-to-list 'project-vc-extra-root-markers "pyproject.toml")

dotfiles/desktop/.emacs.d/lisp/misc/rss.el

@@ -29,6 +29,20 @@
   :hook
   (elfeed-show-mode . visual-line-mode))
 
+(use-package evil-collection
+  :ensure t
+  :after (evil elfeed)
+  :config
+  ;; Enable Vim-style keybindings only for elfeed (search + entry views),
+  ;; leaving the rest of the configuration on evil's defaults.
+  (evil-collection-init (list 'elfeed))
+  ;; Restore the custom "v" -> mpv binding, which evil's normal-state visual
+  ;; selection would otherwise shadow inside elfeed buffers.
+  (evil-collection-define-key 'normal 'elfeed-search-mode-map
+    "v" #'elfeed-play-with-mpv)
+  (evil-collection-define-key 'normal 'elfeed-show-mode-map
+    "v" #'elfeed-play-with-mpv))
+
 (use-package elfeed-org
   :ensure t
   :after elfeed

dotfiles/desktop/.emacs.d/lisp/misc/which-key.el

@@ -24,7 +24,7 @@
     "C-c p" "Project"
     "C-c d" "Debug"
     "C-c g" "Git"
-    "C-c e" "Email / Elfeed")
+    "C-c e" "Elfeed")
 
   ;; --------------------------------------------------------------------------
   ;; Open (C-c o …)
@@ -33,7 +33,6 @@
     "C-c o d" "Dirvish"
     "C-c o f" "RSS (Elfeed)"
     "C-c o l" "LLM chat (gptel)"
-    "C-c o m" "mu4e (Email Client)"
     "C-c o T" "Terminal (multi-vterm)"
     "C-c o z" "Ztree diff")
 

dotfiles/desktop/.emacs.d/scripts/email_sync.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env sh
-
-mbsync -a & pid1=$!
-wait $pid1
-
-mu index
-

dotfiles/desktop/.local/bin/start-niri

@@ -0,0 +1,27 @@
+#!/bin/sh
+
+[ -r /etc/profile ]    && . /etc/profile
+[ -r "$HOME/.profile" ] && . "$HOME/.profile"
+
+export XDG_CURRENT_DESKTOP=niri
+export XDG_SESSION_DESKTOP=niri
+export XDG_SESSION_TYPE=wayland
+
+export MOZ_ENABLE_WAYLAND=1
+export QT_QPA_PLATFORM='wayland;xcb'
+export _JAVA_AWT_WM_NONREPARENTING=1
+export SDL_VIDEODRIVER=wayland
+export GDK_BACKEND='wayland,x11'
+
+export SSH_AUTH_SOCK="$HOME/.local/state/ssh-agent/socket"
+
+# Per-host session environment (GPU / Wayland tuning, etc.)
+[ -r "$HOME/.config/niri/session-env" ] && . "$HOME/.config/niri/session-env"
+
+exec dbus-run-session sh -eu -c '
+  umask 077
+  printf "%s\n" "$DBUS_SESSION_BUS_ADDRESS" > "$HOME/.dbus-session-bus-address"
+  gpgconf --launch gpg-agent
+  "$HOME/.local/bin/update-turnstile-env"
+  exec niri --session
+'

dotfiles/desktop/.tmux.conf

@@ -1,18 +1,46 @@
 #=== BEHAVIOR ===#
 
+unbind C-b
+set -g prefix C-x
+bind-key C-x send-prefix
+
 set -g renumber-window on
 set -g base-index 1
 setw -g pane-base-index 1
 set -g mouse on
+set -g history-limit 50000
+set -s escape-time 0
+set -g focus-events on
+set -g detach-on-destroy off
 
 bind-key c new-window -c '#{pane_current_path}'
+bind-key | split-window -h -c '#{pane_current_path}'
+bind-key - split-window -v -c '#{pane_current_path}'
+bind-key \" split-window -v -c '#{pane_current_path}'
+bind-key % split-window -h -c '#{pane_current_path}'
+bind-key r source-file ~/.tmux.conf \; display-message 'tmux configuration reloaded'
+bind-key y setw synchronize-panes \; display-message 'synchronize-panes #{?pane_synchronized,on,off}'
 bind-key -n M-Left select-pane -L
 bind-key -n M-Right select-pane -R
 bind-key -n M-Up select-pane -U
 bind-key -n M-Down select-pane -D
+bind-key -n M-H resize-pane -L 5
+bind-key -n M-J resize-pane -D 5
+bind-key -n M-K resize-pane -U 5
+bind-key -n M-L resize-pane -R 5
 
 # Session popup: Enter switches, Ctrl-k kills, Ctrl-n creates.
-bind-key S display-popup -E -w 80% -h 80% "~/.tmux/bin/session-popup '#{pane_current_path}'"
+bind-key S display-popup -E -x "#{popup_centre_x}" -y "#{popup_centre_y}" -w 95% -h 95% "~/.tmux/bin/session-popup '#{pane_current_path}'"
+
+#=== COPY MODE ===#
+
+setw -g mode-keys vi
+set -g set-clipboard on
+set -g @yank_action 'copy-pipe-and-cancel'
+set -g @override_copy_command '~/.tmux/bin/copy-to-clipboard'
+bind-key -T copy-mode-vi v send -X begin-selection
+bind-key -T copy-mode-vi C-v send -X rectangle-toggle
+bind-key -T copy-mode-vi y send -X copy-pipe-and-cancel '~/.tmux/bin/copy-to-clipboard'
 
 #=== TERMINAL ===#
 
@@ -29,55 +57,55 @@ set -g @plugin 'tmux-plugins/tmux-sensible'
 set -g @plugin 'b0o/tmux-autoreload'
 set -g @plugin 'tmux-plugins/tmux-resurrect'
 set -g @plugin 'tmux-plugins/tmux-continuum'
+set -g @plugin 'tmux-plugins/tmux-yank'
 
-#=== THEME: Yaru Blue Dark ===#
+#=== THEME: Ptyxis Linux Minimal ===#
 
-set -g @yaru_bg "#2b2b2e"
-set -g @yaru_bg_light "#3b3b3e"
-set -g @yaru_fg "#e0e0e0"
-set -g @yaru_fg_dim "#9a9a9a"
-set -g @yaru_blue "#4a90d9"
-set -g @yaru_blue_b "#6daeea"
-set -g @yaru_orange "#e95420"
-set -g @yaru_sep "#4a4a52"
-set -g @yaru_red "#c7162b"
-set -g @yaru_green "#4caf50"
+set -g @linux_bg "#000000"
+set -g @linux_fg "#d7d7d7"
+set -g @linux_dim "#808080"
+set -g @linux_sep "#303030"
+set -g @linux_blue "#5555ff"
+set -g @linux_green "#55ff55"
+set -g @linux_yellow "#ffff55"
+set -g @linux_red "#ff5555"
 
-set -g status-position top
-set -g status-style "bg=#{@yaru_bg}"
-set -g status-left-length 120
+set -g status-position bottom
+set -g status-style "bg=#{@linux_bg},fg=#{@linux_dim}"
+set -g status-left-length 100
 set -g status-right-length 80
+set -g status-interval 5
 
 set -g status-left ""
-set -ga status-left "#[bg=#{@yaru_bg},fg=#{@yaru_blue},bold]  #S "
-set -ga status-left "#[bg=#{@yaru_bg},fg=#{@yaru_sep}]│"
-set -ga status-left "#[bg=#{@yaru_bg},fg=#{@yaru_fg_dim}]  #{pane_current_command} "
-set -ga status-left "#[bg=#{@yaru_bg},fg=#{@yaru_sep}]│"
-set -ga status-left "#[bg=#{@yaru_bg},fg=#{@yaru_blue_b}]  #{=/-40/...:#{s|$USER|~|:#{b:pane_current_path}}} "
-set -ga status-left "#[bg=#{@yaru_bg},fg=#{@yaru_sep}]#{?window_zoomed_flag,│,}"
-set -ga status-left "#[bg=#{@yaru_bg},fg=#{@yaru_orange}]#{?window_zoomed_flag,  zoom ,}"
+set -ga status-left "#[fg=#{@linux_green},bold] #S "
+set -ga status-left "#[fg=#{@linux_sep}]·"
+set -ga status-left "#[fg=#{@linux_dim}] #{pane_current_command} "
+set -ga status-left "#[fg=#{@linux_sep}]·"
+set -ga status-left "#[fg=#{@linux_fg}] #{=/-36/...:#{s|$USER|~|:#{b:pane_current_path}}} "
 
 set -g status-right ""
-set -ga status-right "#[bg=#{@yaru_bg},fg=#{@yaru_sep}]│"
-set -ga status-right "#[bg=#{@yaru_bg},fg=#{@yaru_blue_b}]  #H"
+set -ga status-right "#[fg=#{@linux_yellow}]#{?pane_synchronized, sync ,}"
+set -ga status-right "#[fg=#{@linux_blue}]#{?window_zoomed_flag, zoom ,}"
+set -ga status-right "#[fg=#{@linux_sep}]·"
+set -ga status-right "#[fg=#{@linux_dim}] #H "
 
 setw -g pane-border-status off
-setw -g pane-active-border-style "fg=#{@yaru_blue}"
-setw -g pane-border-style "fg=#{@yaru_sep}"
+setw -g pane-active-border-style "fg=#{@linux_blue}"
+setw -g pane-border-style "fg=#{@linux_sep}"
 setw -g pane-border-lines single
 
-set -g message-style "bg=#{@yaru_blue},fg=#{@yaru_bg},bold"
-set -g message-command-style "bg=#{@yaru_blue},fg=#{@yaru_bg},bold"
-set -g mode-style "bg=#{@yaru_orange},fg=#{@yaru_bg},bold"
+set -g message-style "bg=#{@linux_blue},fg=#{@linux_bg},bold"
+set -g message-command-style "bg=#{@linux_blue},fg=#{@linux_bg},bold"
+set -g mode-style "bg=#{@linux_yellow},fg=#{@linux_bg},bold"
 
-set -g window-status-format " #I:#{?#{!=:#{window_name},Window},#W,} "
-set -g window-status-style "bg=#{@yaru_bg},fg=#{@yaru_fg_dim}"
-set -g window-status-last-style "bg=#{@yaru_bg},fg=#{@yaru_fg}"
-set -g window-status-activity-style "bg=#{@yaru_bg},fg=#{@yaru_orange}"
-set -g window-status-bell-style "bg=#{@yaru_bg},fg=#{@yaru_red},bold"
-set -gF window-status-separator "#[bg=#{@yaru_bg},fg=#{@yaru_sep}]│"
-set -g window-status-current-format " #I:#{?#{!=:#{window_name},Window},#W,} "
-set -g window-status-current-style "bg=#{@yaru_blue},fg=#{@yaru_bg},bold"
+set -g window-status-format " #I:#W "
+set -g window-status-style "bg=#{@linux_bg},fg=#{@linux_dim}"
+set -g window-status-last-style "bg=#{@linux_bg},fg=#{@linux_fg}"
+set -g window-status-activity-style "bg=#{@linux_bg},fg=#{@linux_yellow}"
+set -g window-status-bell-style "bg=#{@linux_bg},fg=#{@linux_red},bold"
+set -gF window-status-separator "#[fg=#{@linux_sep}]·"
+set -g window-status-current-format " #I:#W "
+set -g window-status-current-style "bg=#{@linux_bg},fg=#{@linux_green},bold"
 
 #=== SESSION RESTORE ===#
 

dotfiles/desktop/.tmux/bin/copy-to-clipboard

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -eu
+
+if command -v wl-copy >/dev/null 2>&1 && [ -n "${WAYLAND_DISPLAY:-}" ]; then
+  exec wl-copy
+fi
+
+if command -v xclip >/dev/null 2>&1 && [ -n "${DISPLAY:-}" ]; then
+  exec xclip -selection clipboard -in
+fi
+
+if command -v xsel >/dev/null 2>&1 && [ -n "${DISPLAY:-}" ]; then
+  exec xsel --clipboard --input
+fi
+
+if command -v clip.exe >/dev/null 2>&1; then
+  exec clip.exe
+fi
+
+if command -v pbcopy >/dev/null 2>&1; then
+  exec pbcopy
+fi
+
+cat >/dev/null
+exit 1

dotfiles/desktop/.tmux/bin/session-popup

@@ -4,6 +4,24 @@ set -eu
 
 default_dir=${1:-$HOME}
 
+# tmux popups are launched by the tmux server and may not inherit ~/.bashrc.
+# Keep fzf visually aligned with the shared Ptyxis Linux Minimal style.
+FZF_PTYXIS_LINUX_OPTS="
+  --layout=reverse
+  --border=rounded
+  --info=inline
+  --prompt='› '
+  --pointer='›'
+  --marker='✓'
+  --separator='─'
+  --scrollbar='│'
+  --color=bg:#000000,bg+:#000000,gutter:#000000
+  --color=fg:#d7d7d7,fg+:#ffffff,hl:#55ff55,hl+:#55ff55
+  --color=prompt:#55ff55,pointer:#5555ff,marker:#ffff55,spinner:#5555ff
+  --color=info:#808080,header:#808080,border:#303030
+"
+export FZF_DEFAULT_OPTS="${FZF_DEFAULT_OPTS:+$FZF_DEFAULT_OPTS }$FZF_PTYXIS_LINUX_OPTS"
+
 new_session() {
   printf 'New session name: '
   IFS= read -r session_name
@@ -22,9 +40,7 @@ while :; do
   selection=$(
     tmux list-sessions -F '#{session_name}' |
       fzf \
-        --layout=reverse \
         --height=100% \
-        --border \
         --prompt='sessions> ' \
         --header='Enter switch  Ctrl-n new  Ctrl-k kill' \
         --preview 'tmux list-windows -t {} -F "#{window_index}: #{window_name}#{?window_active, [active],}"' \

dotfiles/workstation/.gitignore_global

@@ -1,6 +1,8 @@
 # Created by https://www.toptal.com/developers/gitignore/api/windows,macos,linux
 # Edit at https://www.toptal.com/developers/gitignore?templates=windows,macos,linux
 
+.idea/**
+
 ### Linux ###
 *~
 

dotfiles/workstation_dev_wsl/.tmux.conf

@@ -1,27 +0,0 @@
-# Prefix and Emacs-style key handling
-unbind C-b
-set -g prefix C-x
-bind C-x send-prefix
-set -g status-keys emacs
-setw -g mode-keys emacs
-
-# General behavior
-set -g mouse on
-set -g base-index 1
-setw -g pane-base-index 1
-set -g renumber-windows on
-set -g history-limit 10000
-set -s escape-time 0
-set -g focus-events on
-
-# Keep the current directory when creating windows and panes
-bind c new-window -c "#{pane_current_path}"
-bind '"' split-window -v -c "#{pane_current_path}"
-bind % split-window -h -c "#{pane_current_path}"
-
-# Reload the configuration with C-x r
-bind r source-file ~/.tmux.conf \; display-message "tmux configuration reloaded"
-
-# Terminal capabilities
-set -g default-terminal "tmux-256color"
-set -as terminal-features ",xterm-256color:RGB"