fedora38-workstation.yml

---
- name: Fedora 38 Workstation 
  hosts: localhost
  vars:
    flatpak_method: system
    non_root_user: admiller
    rpmfusion_free: yes
    rpmfusion_nonfree: no
  tasks:
    - name: Package Install - Fedora
      ansible.builtin.yum:
        state: installed
        name: "{{ packages_fedora }}"

    - name: Package Install - Common
      ansible.builtin.yum:
        state: installed
        name: "{{ packages_common }}"

    - name: Package Install - gnome
      ansible.builtin.yum:
        state: installed
        name: 
          - vinagre
          - gnome-tweaks
          - NetworkManager-openvpn-gnome
          - gnome-shell-extension-windowsNavigator
          - gnome-shell-extension-system-monitor-applet

    - name: Setup RPM Fusion Free
      ansible.builtin.import_role:
        name: robertdebock.rpmfusion

    - name: Package Install | RPM Fusion Free
      ansible.builtin.yum:
        state: installed
        name: 
          - ffmpeg
          - ffmpeg-libs
          - libavcodec-freeworld
            
    - name: import flatpak app task set
      ansible.builtin.import_tasks: include_tasks/flatpak_install.yml

    - name: install SourceCode Pro patched Nerd Fonts
      ansible.builtin.import_tasks: include_tasks/nerdfonts.yml

    - name: Setup CSB Repo
      ansible.builtin.template:
        src: templates/rhel8-csb.repo.j2
        dest: /etc/yum.repos.d/rhel8-csb.repo

    - name: Package Install - CSB RHEL8 Repo
      ansible.builtin.yum:
        state: installed
        name: 
          - oneplay-gstreamer-codecs-pack
          - redhat-internal-openvpn-profiles
          - redhat-internal-NetworkManager-openvpn-profiles
          - redhat-internal-NetworkManager-openvpn-profiles-non-gnome
          - redhat-internal-wireless-config
          - redhat-internal-cert-install

    - name: Add GitHub CLI Repo
      ansible.builtin.shell: dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo
      args:
        creates: /etc/yum.repos.d/gh-cli.repo

    - name: Package Install - GitHub CLI
      ansible.builtin.yum:
        state: installed
        name: 
          - gh

    - name: Ensure SELinux Enforcing
      ansible.posix.selinux:
        policy: targeted
        state: enforcing

    - name: Enable container_manage_cgroup for running systemd in podman containers
      ansible.posix.seboolean:
        name: container_manage_cgroup
        state: true
        persistent: true

# don't do this anymore, no longer needed
#    - name: Set laptop specific configurations
#      when: ansible_form_factor in mobile_form_factors
#      block:
#        - name: Apply iwlwifi settings
#          copy:
#            src: files/iwlwifi.conf
#            dest: /etc/modprobe.d/iwlwifi.conf
#
#
    - name: Disable ssh and rpcbind because reasons
      ansible.builtin.systemd:
        name: "{{ item }}"
        state: stopped
        masked: true
        enabled: false
      loop:
        - sshd
        - rpcbind

#   - name: Ensure various ports are not open
#     ansible.posix.firewalld:
#       service: "{{ item }}"
#       permanent: yes
#       immediate: yes
#       state: disabled
#     loop:
#       - cockpit
#       - ssh

    - name: Allow non-root user access to libvirt via polkit
      ansible.builtin.template:
        src: templates/non_root_user_libvirt_polkit.j2
        dest: /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules
      notify:
        - reload polkit

    - name: Allow non-root user access to NetworkManager
      ansible.builtin.template:
        src: templates/network_manager_polkit.j2
        dest: /etc/polkit-1/rules.d/10-network-manager.pkla
      notify:
        - reload polkit

    - name: Make sure non_root_user user is in mock
      ansible.builtin.user:
        name: "{{ non_root_user }}"
        groups: mock
        append: yes

    - name: enable journald persistent storage
      ansible.builtin.file:
        path: /var/log/journal
        state: directory

    - name: workaround suspend issue on starlite mk3 laptop
      block:
        - name: install workaroundsuspend.service
          ansible.builtin.copy:
            src: files/starlite_mk3_suspendfix.service
            dest: /etc/systemd/system/workaroundsuspend.service
        - name: enable custom systemd unit
          ansible.builtin.systemd:
            name: workaroundsuspend.service
            daemon_reload: true
            enabled: true
            state: started
      when: ansible_hostname == 'starlite'

  handlers:
    - name: reload polkit
      ansible.builtin.service:
        name: polkit
        state: restarted

- name: User Stuff
  hosts: localhost
  become_user: admiller
  become: true
  tasks:
    - name: import user dev stuff
      ansible.builtin.import_tasks: include_tasks/user_stuff.yml