workstation.yml

---
- name: Configure Fedora workstation
  hosts: workstation
  # Edit as needed if executing remotely
  remote_user: matiss
  vars:
    # Update these variables as needed to match your own settings.
    host_username: 'matiss'
    allow_ssh_users: 'matiss'
    git_email: 'matiss@hub256.com'
    git_name: 'Matīss Treinis'
    git_signing_key: '3B44AE79519B1C6552941B109123B913EBF53D43'
    git_commit_gpgsign: 'true'
    git_diff_tool: 'meld'
    git_push_default: 'current'
    authorized_keys: '{{ lookup("file", "files/id_rsa.pub") }}'
  handlers:
    - name: Update dconf
      shell: dconf update
      become: yes
    - name: Update initramfs
      shell: dracut --regenerate-all --force
      become: yes
    - name: Restart sshd
      service:
        name: sshd
        state: restarted
      become: yes
    - name: Reload firewalld
      service:
        name: firewalld
        state: reloaded
      become: yes
  tasks:
    - name: Add RPM keys (.rpm repos)
      rpm_key:
        state: present
        key: '{{item}}'
      loop:
        - 'https://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-free-fedora-2020'
        - 'https://rpmfusion.org/keys?action=AttachFile&do=get&target=RPM-GPG-KEY-rpmfusion-nonfree-fedora-2020'
        - 'https://repo.protonvpn.com/fedora-{{ansible_distribution_major_version}}-stable/public_key.asc'
      become: yes
      tags: [ 'repositories' ]

    - name: Add repositories (.rpm)
      dnf:
        name: '{{ item }}'
        state: present
      loop:
        - 'https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-{{ansible_distribution_major_version}}.noarch.rpm'
        - 'https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-{{ansible_distribution_major_version}}.noarch.rpm'
        - 'https://repo.protonvpn.com/fedora-{{ansible_distribution_major_version}}-stable/protonvpn-stable-release/protonvpn-stable-release-1.0.2-1.noarch.rpm'
      become: yes
      tags: [ 'repositories' ]

    - name: Add repositories (.repo)
      get_url:
        url: '{{item.url}}'
        dest: '/etc/yum.repos.d/{{item.name}}.repo'
      loop:
        - { name: docker-ce, url: 'https://download.docker.com/linux/fedora/docker-ce.repo' }
        - { name: hashicorp, url: 'https://rpm.releases.hashicorp.com/fedora/hashicorp.repo' }
      become: yes
      tags: [ 'repositories' ]

    - name: Enable repositories
      shell: 'dnf5 config-manager setopt {{item}}.enabled=1'
      loop:
        - docker-ce-stable
        - rpmfusion-free
        - rpmfusion-free-updates
        - rpmfusion-nonfree
        - rpmfusion-nonfree-updates
        - protonvpn-fedora-stable
      become: yes
      tags: [ 'repositories' ]
      changed_when: false

    - name: Install workstation packages
      package:
        name: '{{item}}'
        state: latest
      loop:
        - NetworkManager-openvpn
        - NetworkManager-openvpn-gnome
        - clang
        - cloud-utils
        - cmake
        - containerd.io
        - cups
        - curl
        - dnsutils
        - docker-buildx-plugin
        - docker-ce
        - docker-ce-cli
        - docker-compose-plugin
        - file-roller
        - filezilla
        - firefox
        - firewall-config
        - firewalld
        - fzf
        - gimp
        - git
        - git-extras
        - gitg
        - gnome-boxes
        - gnome-connections
        - gnome-extensions-app
        - gnome-shell-extension-apps-menu
        - gnome-shell-extension-caffeine
        - gnome-shell-extension-dash-to-dock
        - gnome-shell-extension-user-theme
        - libappindicator-gtk3
        - gnome-shell-extension-appindicator
        - gnome-tweaks
        - gnupg
        - htop
        - inkscape
        - libreoffice-base
        - libreoffice-calc
        - libreoffice-impress
        - libreoffice-writer
        - make
        - meld
        - micro
        - ncdu
        - nmap
        - openvpn
        - p7zip
        - papirus-icon-theme
        - podman
        - polari
        - proton-vpn-gnome-desktop
        - python3
        - python3-pip
        - rubygems
        - seahorse
        - terraform
        - tmux
        - traceroute
        - unzip
        - virt-manager
        - vlc
        - wget
        - whois
        - zip
        - zsh
      become: yes
      tags: [ 'packages' ]

    - name: Install ffmpeg with allow erasing
      dnf:
        name: ffmpeg
        state: latest
        allowerasing: yes
      become: yes
      tags: [ 'packages' ]

    - name: Install tmuxinator
      gem:
        name: tmuxinator
        state: latest
        user_install: false
      become: yes
      tags: [ 'packages' , 'gem' ]

    - name: Ensure pip3 packages
      pip:
        name: '{{item}}'
        executable: pip3
        state: latest
      loop:
        - ansible # Yo dawg i herd you like Ansible so we put a Ansible in yo Ansible so you can automate while u automate
        - awscli

    - name: Add the Flathub to flatpak remotes
      flatpak_remote:
        name: flathub
        flatpakrepo_url: https://dl.flathub.org/repo/flathub.flatpakrepo
        state: present
      become: yes
      tags: [ 'packages', 'flatpak' ]

    - name: Install flatpak packages
      flatpak:
        name:
          - com.bitwarden.desktop
          - com.mattermost.Desktop
          - com.skype.Client
          - com.slack.Slack
          - com.spotify.Client
          - com.valvesoftware.Steam
          - org.gnome.World.PikaBackup
          - org.signal.Signal
          - org.standardnotes.standardnotes
          - org.telegram.desktop
          - us.zoom.Zoom
      become: yes
      tags: [ 'packages', 'flatpak' , 'flatpak_packages' ]

    - name: Stat /opt/jetbrains-toolbox/
      stat:
        path: /opt/jetbrains-toolbox/
      register: opt_jetbrains_toolbox
      tags: [ 'packages', 'toolbox' ]

    - name: Create /opt/jetbrains-toolbox/ if not present
      file:
        path: /opt/jetbrains-toolbox/
        state: directory
        owner: root
        mode: '0775'
      when: not opt_jetbrains_toolbox.stat.exists
      become: yes
      tags: [ 'packages', 'toolbox' ]

    - name: Download JB toolbox
      unarchive:
        src: https://download.jetbrains.com/product?code=TB&latest&distribution=linux
        remote_src: true
        dest: /opt/jetbrains-toolbox/
        owner: '{{host_username}}'
        group: '{{host_username}}'
        mode: '0755'
      when: not opt_jetbrains_toolbox.stat.exists
      become: yes
      tags: [ 'packages', 'toolbox' ]

    - name: Enable and start Docker-CE service
      service:
        name: docker
        state: started
        enabled: yes
      become: yes

    - name: Copy system wallpaper
      copy:
        src: wallpaper.jpg
        dest: /usr/share/backgrounds/wallpaper.jpg
        mode: '0644'
        owner: root
        group: root
      become: yes
      tags: [ 'wallpaper' ]

    - name: Install fonts
      copy:
        src: fonts/
        dest: /usr/local/share/fonts
      become: yes

    - name: Configure boot screen
      copy:
        src: plymouthd.conf
        dest: /etc/plymouth/plymouthd.conf
        mode: '0644'
        owner: root
        group: root
      notify: [ Update initramfs ]
      become: yes

    - meta: flush_handlers

    - name: Install oh-my-zsh for self
      script:
        cmd: 'scripts/oh-my-zsh-setup.sh --unattended --keep-zshrc'
        chdir: '/home/{{host_username}}'
        creates: '/home/{{host_username}}/.oh-my-zsh'
      changed_when: false # ignore

    - name: Install oh-my-zsh for root
      script:
        cmd: 'scripts/oh-my-zsh-setup.sh --unattended --keep-zshrc'
        creates: '/root/.oh-my-zsh'
      changed_when: false # ignore
      become: yes

    - name: Ensure group "docker" exists
      group:
        name: docker
        state: present
      become: yes

    - name: Configure '{{host_username}}' user settings (zsh, docker group)
      user:
        name: '{{host_username}}'
        shell: /bin/zsh
        groups: docker
        append: yes
        create_home: yes
        password: '*' # Initial password is none, account locked
        update_password: on_create # Do not reset password from ansible
      become: yes

    - name: Set root shell to zsh
      user:
        name: root
        shell: /bin/zsh
      become: yes

    - name: Ensure '/home/{{host_username}}/.ssh/' has correct permissions
      file:
        path: '/home/{{host_username}}/.ssh'
        state: directory
        mode: '0700'
        owner: '{{host_username}}'
        group: '{{host_username}}'
      become: yes

    - name: Locate all files in '/home/{{host_username}}/.ssh/'
      find:
        paths: '/home/{{host_username}}/.ssh'
        file_type: file
        patterns: "*"
      register: home_dot_ssh_files

    - name: Ensure all files in '/home/{{host_username}}/.ssh/' have correct permissions
      file:
        path: '{{ item.path }}'
        state: file
        owner: '{{host_username}}'
        group: '{{host_username}}'
        mode: '0600'
      loop: '{{ home_dot_ssh_files.files }}'
      loop_control:
        label: '{{item.path}}'

    - name: Ensure personal dot files
      copy:
        src: '{{item.src}}'
        dest: '{{item.dest}}'
        mode: '0600'
        owner: '{{host_username}}'
        group: '{{host_username}}'
      loop:
        - { src: dots/zshrc.zsh, dest: '/home/{{host_username}}/.zshrc' }
        - { src: dots/tmux.conf, dest: '/home/{{host_username}}/.tmux.conf' }
        - { src: dots/editorconfig, dest: '/home/{{host_username}}/.editorconfig' }
        - { src: dots/wgetrc, dest: '/home/{{host_username}}/.wgetrc' }
        - { src: dots/gitignore, dest: '/home/{{host_username}}/.gitignore' }
        - { src: dots/curlrc, dest: '/home/{{host_username}}/.curlrc' }
      tags: [ 'dots' ]

    - name: Ensure root dot files
      copy:
        src: '{{item.src}}'
        dest: '{{item.dest}}'
        mode: '0600'
        owner: root
        group: root
      loop:
        - { src: dots/zshrc.zsh, dest: '/root/.zshrc' }
        - { src: dots/editorconfig, dest: '/root/.editorconfig' }
        - { src: dots/wgetrc, dest: '/root/.wgetrc' }
        - { src: dots/curlrc, dest: '/root/.curlrc' }
      become: yes
      tags: [ 'dots' ]

    - name: Ensure personal files (from templates)
      template:
        src: '{{item.src}}'
        dest: '{{item.dest}}'
        mode: '0600'
        owner: '{{host_username}}'
        group: '{{host_username}}'
      loop:
        - { src: dots/gitconfig, dest: '/home/{{host_username}}/.gitconfig' }
        - { src: dots/authorized_keys, dest: '/home/{{host_username}}/.ssh/authorized_keys' }

    - name: Ensure default directories in home
      file:
        path: '{{item}}'
        state: directory
        mode: '0700'
        owner: '{{host_username}}'
        group: '{{host_username}}'
      loop:
        - '/home/{{host_username}}/dots'
        - '/home/{{host_username}}/Projects'
        - '/home/{{host_username}}/Projects/Work'
        - '/home/{{host_username}}/Projects/Work/Archive'
        - '/home/{{host_username}}/Projects/Work/Scratch'
        - '/home/{{host_username}}/Projects/Personal'
        - '/home/{{host_username}}/Projects/Personal/Archive'
        - '/home/{{host_username}}/Projects/Personal/Scratch'
        - '/home/{{host_username}}/Documents/Work/Archive'
        - '/home/{{host_username}}/Documents/Personal/Archive'
      become: yes
      tags: [ 'dir-structure' ]

    # Configure icons in Nautilus for some directories.
    - name: Set home folder icons
      shell: 'gio set -t string {{item.dir}} metadata::custom-icon file://{{item.icon}}'
      changed_when: false # Really not that important...
      loop:
        - { dir: '/home/{{host_username}}/dots', icon: '/usr/share/icons/Papirus/64x64/places/folder-orange-sync.svg' }
        - { dir: '/home/{{host_username}}/Projects', icon: '/usr/share/icons/Papirus/64x64/places/folder-magenta-projects.svg' }
        - { dir: '/home/{{host_username}}/Projects/Work', icon: '/usr/share/icons/Papirus/64x64/places/folder-red-projects.svg' }
        - { dir: '/home/{{host_username}}/Projects/Work/Archive', icon: '/usr/share/icons/Papirus/64x64/places/folder-red-tar.svg' }
        - { dir: '/home/{{host_username}}/Projects/Work/Scratch', icon: '/usr/share/icons/Papirus/64x64/places/folder-red-java.svg' }
        - { dir: '/home/{{host_username}}/Projects/Personal', icon: '/usr/share/icons/Papirus/64x64/places/folder-teal-projects.svg' }
        - { dir: '/home/{{host_username}}/Projects/Personal/Archive', icon: '/usr/share/icons/Papirus/64x64/places/folder-teal-tar.svg' }
        - { dir: '/home/{{host_username}}/Projects/Personal/Scratch', icon: '/usr/share/icons/Papirus/64x64/places/folder-teal-java.svg' }
        - { dir: '/home/{{host_username}}/Documents/Work', icon: '/usr/share/icons/Papirus/64x64/places/folder-red-documents.svg' }
        - { dir: '/home/{{host_username}}/Documents/Work/Archive', icon: '/usr/share/icons/Papirus/64x64/places/folder-red-tar.svg' }
        - { dir: '/home/{{host_username}}/Documents/Personal', icon: '/usr/share/icons/Papirus/64x64/places/folder-teal-documents.svg' }
        - { dir: '/home/{{host_username}}/Documents/Personal/Archive', icon: '/usr/share/icons/Papirus/64x64/places/folder-teal-tar.svg' }
      tags: [ 'dir-structure' ]

    - name: Ensure dconf profile directory exists
      file:
        path: /etc/dconf/profile
        state: directory
        mode: '0755'
        owner: root
        group: root
      become: yes
      tags: [ 'dconf' ]

    - name: Copy dconf user profile configuration
      copy:
        src: dconf_profile_user
        dest: /etc/dconf/profile/user
        mode: '0644'
        owner: root
        group: root
      become: yes
      tags: [ 'dconf' ]

    - name: Ensure dconf local configuration defaults exists
      file:
        path: /etc/dconf/db/local.d
        state: directory
        mode: '0755'
        owner: root
        group: root
      become: yes
      tags: [ 'dconf' ]

    - name: Configure dconf global defaults
      copy:
        src: dconf_settings.ini
        dest: /etc/dconf/db/local.d/00-global
        mode: '0644'
        owner: root
        group: root
      notify: [ Update dconf ]
      become: yes
      tags: [ 'dconf' ]

    - name: Configure GDM dconf settings defaults
      copy:
        src: dconf_gdm.ini
        dest: /etc/dconf/db/gdm.d/00-global
        mode: '0644'
        owner: root
        group: root
      notify: [ Update dconf ]
      become: yes
      tags: [ 'dconf' ]

    - meta: flush_handlers

    - name: Ensure local sshd config exists with the right perms
      file:
        path: /etc/ssh/sshd_config.d/00-local.conf
        state: touch
        mode: '0700'
        owner: root
        group: root
        modification_time: preserve
        access_time: preserve
      become: yes
      tags: [ 'sshd' ]

    - name: Set local sshd config
      lineinfile:
        path: /etc/ssh/sshd_config.d/00-local.conf
        regexp: '^{{item.key}}'
        line: '{{item.key}} {{item.value}}'
        state: present
      become: yes
      loop:
        - { key: 'PasswordAuthentication', value: 'no' }
        - { key: 'PermitEmptyPasswords', value: 'no' }
        - { key: 'GSSAPIAuthentication', value: 'no' }
        - { key: 'ChallengeResponseAuthentication', value: 'no' }
        - { key: 'KerberosAuthentication', value: 'no' }
        - { key: 'PermitRootLogin', value: 'no' }
        - { key: 'X11Forwarding', value: 'no' }
        - { key: 'AllowTcpForwarding', value: 'yes' }
        - { key: 'ClientAliveCountMax', value: '3' }
        - { key: 'ClientAliveInterval', value: '300' }
        - { key: 'LoginGraceTime', value: '15' }
        - { key: 'Ciphers', value: 'aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr' }
        - { key: 'MACs', value: 'hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512' }
        - { key: 'KexAlgorithms', value: 'curve25519-sha256@libssh.org' }
        - { key: 'AllowUsers', value: '{{allow_ssh_users}}' }
      notify: [ Restart sshd ]
      tags: [ 'sshd' ]

    - name: Ensure firewalld is running
      service:
        name: firewalld
        state: started
        enabled: yes
      become: yes
      tags: [ 'firewall' ]

    - meta: flush_handlers

    - name: Create custom zone to use by default
      firewalld:
        zone: GoAway
        state: present
        permanent: true
      become: yes
      notify: [ Reload firewalld ]
      tags: [ 'firewall' ]

    - meta: flush_handlers

    - name: Allow basic services in firewall
      firewalld:
        service: '{{item}}'
        permanent: yes
        state: enabled
        immediate: yes
        zone: GoAway
      loop:
        - dhcpv6-client
        - mdns
        - samba-client
        - ssh
      become: yes
      tags: [ 'firewall' ]

    - name: Set GoAway as default policy
      command: firewall-cmd --set-default-zone=GoAway
      become: yes
      tags: [ 'firewall' ]