more renaming + ignore weak dnf deps
This commit is contained in:
@@ -0,0 +1,370 @@
|
||||
---
|
||||
|
||||
- hosts: all
|
||||
name: setup desktop
|
||||
vars_files:
|
||||
- secrets
|
||||
tasks:
|
||||
- name: remove fedora fluff
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
allowerasing: true
|
||||
autoremove: true
|
||||
name:
|
||||
- anaconda-core
|
||||
- anaconda-live
|
||||
- anaconda-install-env-deps
|
||||
- cockpit-system
|
||||
- python3-botocore
|
||||
- firefox
|
||||
- nodejs
|
||||
state: absent
|
||||
- name: install core components
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
state: present
|
||||
install_weak_deps: false
|
||||
name:
|
||||
- git
|
||||
- git-crypt
|
||||
- git-lfs
|
||||
- gnupg2
|
||||
- tmux
|
||||
- curl
|
||||
- acl
|
||||
- stow
|
||||
- make
|
||||
- just
|
||||
- zsh
|
||||
- neovim
|
||||
- nnn
|
||||
- openssh-clients
|
||||
- openssh-server
|
||||
- mosh
|
||||
- unzip
|
||||
- flatpak
|
||||
- name: install pup
|
||||
become: true
|
||||
unarchive:
|
||||
remote_src: yes
|
||||
creates: /usr/local/bin/pup
|
||||
dest: /usr/local/bin/
|
||||
src: https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_amd64.zip
|
||||
- name: install google-chrome dnf repository
|
||||
become: true
|
||||
copy:
|
||||
dest: /etc/yum.repos.d/google-chrome.repo
|
||||
content: |
|
||||
[google-chrome]
|
||||
name=google-chrome
|
||||
baseurl=https://dl.google.com/linux/chrome/rpm/stable/x86_64
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://dl.google.com/linux/linux_signing_key.pub
|
||||
- name: install tailscale dnf repository
|
||||
become: true
|
||||
copy:
|
||||
dest: /etc/yum.repos.d/tailscale.repo
|
||||
content: |
|
||||
[tailscale]
|
||||
name=Tailscale
|
||||
baseurl=https://pkgs.tailscale.com/stable/fedora/$basearch
|
||||
enabled=1
|
||||
type=rpm
|
||||
repo_gpgcheck=1
|
||||
gpgcheck=1
|
||||
gpgkey=https://pkgs.tailscale.com/stable/fedora/repo.gpg
|
||||
- name: install dnf packages
|
||||
become: true
|
||||
ansible.builtin.dnf:
|
||||
state: present
|
||||
install_weak_deps: false
|
||||
name:
|
||||
- aria2
|
||||
- bat
|
||||
- bc
|
||||
- btop
|
||||
- btrfs-progs
|
||||
- coreutils
|
||||
- moreutils
|
||||
- fcitx5-gtk4
|
||||
- file
|
||||
- gh
|
||||
- google-chrome-stable
|
||||
- gparted
|
||||
- jo
|
||||
- jq
|
||||
- jrnl
|
||||
- kitty
|
||||
- kitty-terminfo
|
||||
- lshw
|
||||
- mpv
|
||||
- ncdu
|
||||
- pandoc
|
||||
- podman
|
||||
- runc
|
||||
- pass
|
||||
- wtype
|
||||
- tailscale
|
||||
- rclone
|
||||
- rsync
|
||||
- seahorse
|
||||
- timew
|
||||
- toolbox
|
||||
- tree
|
||||
- fzf
|
||||
- socat
|
||||
- tree-sitter-cli
|
||||
- waybar
|
||||
- wkhtmltopdf
|
||||
- yq
|
||||
- ImageMagick
|
||||
- name: install flatpak applications
|
||||
become: true
|
||||
flatpak:
|
||||
state: present
|
||||
name:
|
||||
- https://valent.andyholmes.ca/valent.flatpakref
|
||||
- com.nextcloud.desktopclient.nextcloud
|
||||
- org.libreoffice.LibreOffice
|
||||
- org.mozilla.Thunderbird
|
||||
|
||||
- com.logseq.Logseq
|
||||
- com.github.xournalpp.xournalpp
|
||||
|
||||
- com.obsproject.Studio
|
||||
|
||||
- com.yubico.yubioath
|
||||
- com.github.tchx84.Flatseal
|
||||
|
||||
- org.gnome.Loupe
|
||||
- com.github.johnfactotum.Foliate
|
||||
- org.gnome.Papers
|
||||
- org.gnome.FileRoller
|
||||
- org.gnome.SimpleScan
|
||||
|
||||
- com.github.neithern.g4music
|
||||
- info.febvre.Komikku
|
||||
|
||||
- org.gimp.GIMP
|
||||
- net.scribus.Scribus
|
||||
- org.inkscape.Inkscape
|
||||
- org.darktable.Darktable
|
||||
- org.audacityteam.Audacity
|
||||
- name: create group myself
|
||||
become: true
|
||||
group:
|
||||
name: myself
|
||||
gid: 690
|
||||
system: true
|
||||
- name: create group rootlessmen
|
||||
become: true
|
||||
group:
|
||||
name: rootlessmen
|
||||
system: true
|
||||
- name: create users
|
||||
become: true
|
||||
with_items:
|
||||
- name: kevins
|
||||
uid: 6901
|
||||
groups: ["myself", "rootlessmen"]
|
||||
- name: kevinsamuel
|
||||
uid: 6902
|
||||
groups: myself
|
||||
- name: kevinnlsamuel
|
||||
uid: 6903
|
||||
groups: ["myself", "rootlessmen"]
|
||||
user:
|
||||
state: present
|
||||
name: "{{ item.name }}"
|
||||
uid: "{{ item.uid }}"
|
||||
groups: "{{ item.groups }}"
|
||||
skeleton: /dev/null
|
||||
append: true
|
||||
password: $1$aBLdYKQI$iB3ZfYF.QPCwVhgnkROUX.
|
||||
update_password: on_create
|
||||
shell: /bin/zsh
|
||||
|
||||
- name: use crun as podman engine
|
||||
become: true
|
||||
vars:
|
||||
file: /etc/containers/containers.conf
|
||||
block:
|
||||
- lineinfile:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
create: true
|
||||
path: "{{file}}"
|
||||
line: "[engine]"
|
||||
insertbefore: BOF
|
||||
- lineinfile:
|
||||
path: "{{file}}"
|
||||
line: 'runtime = "/usr/bin/runc"'
|
||||
search_string: 'runtime = '
|
||||
- name: create storage for rootlessmen
|
||||
become: true
|
||||
file:
|
||||
path: /var/lib/rootlessmen
|
||||
owner: root
|
||||
group: rootlessmen
|
||||
mode: "0770"
|
||||
state: directory
|
||||
- name: setup podman to use rootlessmen for storage
|
||||
become: true
|
||||
vars:
|
||||
file: /etc/containers/storage.conf
|
||||
block:
|
||||
- name: create container storage config
|
||||
lineinfile:
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
create: true
|
||||
path: "{{file}}"
|
||||
line: "[storage]"
|
||||
insertbefore: BOF
|
||||
- name: setup storage config to use rootlessmen
|
||||
with_items:
|
||||
- line: 'driver_priority = ["btrfs", "overlay", "vfs"]'
|
||||
search_string: 'driver_priority = '
|
||||
- line: 'rootless_storage_path = "/var/lib/rootlessmen/$USER/storage"'
|
||||
search_string: 'rootless_storage_path = '
|
||||
lineinfile:
|
||||
path: "{{file}}"
|
||||
line: "{{item.line}}"
|
||||
search_string: "{{item.search_string}}"
|
||||
- name: set selinux fcontext for rootlessmen
|
||||
become: true
|
||||
with_items:
|
||||
- pathspec: /var/lib/rootlessmen/[^/]+/storage/artifacts(/.*)?
|
||||
type: container_ro_file_t
|
||||
- pathspec: /var/lib/rootlessmen/[^/]+/storage/volumes/[^/]*/.*
|
||||
type: container_file_t
|
||||
sefcontext:
|
||||
target: "{{item.pathspec}}"
|
||||
setype: "{{item.type}}"
|
||||
seuser: unconfined_u
|
||||
|
||||
- name: enable tpm-tss in dracut
|
||||
become: true
|
||||
lineinfile:
|
||||
path: /etc/dracut.conf.d/55-tpm.conf
|
||||
line: "add_dracutmodules+=' tpm2-tss '"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "1644"
|
||||
create: true
|
||||
state: present
|
||||
- name: tell PAM to unlock gnome-keyring in tty
|
||||
become: true
|
||||
with_items:
|
||||
- type: auth
|
||||
args: ""
|
||||
- type: session
|
||||
args: auto_start
|
||||
pamd:
|
||||
name: login
|
||||
state: before
|
||||
type: "{{item.type}}"
|
||||
control: include
|
||||
module_path: postlogin
|
||||
new_type: "-{{item.type}}"
|
||||
new_control: optional
|
||||
new_module_path: pam_gnome_keyring.so
|
||||
module_arguments: "{{item.args}}"
|
||||
|
||||
- name: create wifi networks
|
||||
become: true
|
||||
loop:
|
||||
- ssid: KEVINSAM_5
|
||||
zone: home
|
||||
- ssid: KEVINSAM
|
||||
zone: home
|
||||
- ssid: askKevin
|
||||
zone: work
|
||||
community.general.nmcli:
|
||||
state: present
|
||||
type: wifi
|
||||
zone: "{{ item.zone }}"
|
||||
conn_name: "{{ item.ssid }}"
|
||||
ssid: "{{ item.ssid }}"
|
||||
autoconnect: true
|
||||
wifi:
|
||||
hidden: true
|
||||
wifi_sec:
|
||||
key-mgmt: wpa-psk
|
||||
psk: "not really the key"
|
||||
|
||||
- name: create tailscale firewall zone
|
||||
become: true
|
||||
shell: |
|
||||
firewall-cmd --permanent --new-zone=tailscale
|
||||
firewall-cmd --permanent --zone=tailscale --add-interface=tailscale0
|
||||
firewall-cmd --permanent --zone=tailscale --add-forward
|
||||
firewall-cmd --permanent --zone=tailscale --set-target=ACCEPT
|
||||
firewall-cmd --reload
|
||||
|
||||
- name: other firewall rules
|
||||
become: true
|
||||
shell: |
|
||||
firewall-cmd --permanent --zone public --remove-service ssh
|
||||
firewall-cmd --permanent --zone public --add-service kdeconnect
|
||||
firewall-cmd --permanent --zone home --add-service=kdeconnect --add-service=mosh --add-service=ssh
|
||||
firewall-cmd --reload
|
||||
|
||||
- name: create /home/myself
|
||||
become: true
|
||||
file:
|
||||
state: directory
|
||||
path: /home/myself
|
||||
group: myself
|
||||
owner: kevins
|
||||
mode: '2770'
|
||||
- name: check if HOME.git is cloned
|
||||
become: true
|
||||
become_user: kevins
|
||||
register: home_repo
|
||||
stat:
|
||||
path: /home/myself/HOME.git/HEAD
|
||||
- name: "clone HOME.git"
|
||||
become: true
|
||||
become_user: kevins
|
||||
when: not home_repo.stat.exists
|
||||
shell: |
|
||||
mkdir -p /home/myself/HOME.git
|
||||
cd /home/myself/HOME.git
|
||||
git init --bare .
|
||||
git remote add \
|
||||
origin \
|
||||
-t stable \
|
||||
-m stable \
|
||||
https://{{PAT}}@github.com/kevinnlsamuel/HOME.git
|
||||
git fetch --set-upstream origin stable
|
||||
|
||||
- name: clone HOME to my selves
|
||||
vars:
|
||||
src: /home/myself/HOME.git
|
||||
dest: "/home/{{item}}/.local/state/HOME"
|
||||
with_items:
|
||||
- kevins
|
||||
- kevinsamuel
|
||||
- kevinnlsamuel
|
||||
become_user: "{{item}}"
|
||||
become: true
|
||||
failed_when:
|
||||
- result.rc != 140
|
||||
- result.rc != 0
|
||||
changed_when: "result.rc != 140"
|
||||
register: result
|
||||
shell: |
|
||||
mkdir -p "{{dest}}"
|
||||
cd "{{dest}}"
|
||||
if [ -f ".git/HEAD" ]; then exit 140 2>/dev/null; fi
|
||||
git init -b main
|
||||
git config --add safe.directory "{{src}}"
|
||||
git remote add myself "{{src}}"
|
||||
git pull myself main
|
||||
|
||||
# manually install:
|
||||
# - sieve
|
||||
Reference in New Issue
Block a user