mustard/ansible-playbooks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Tweaking fedora 41 gnome template

Browse source
This commit is contained in:
mustard 2024-12-22 22:15:37 +01:00
parent ed68d23c6c
commit 71be578fe0
15 changed files with 176 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
qubes-config/etc/dconf/db/local.d/adw-gtk3-dark Normal file
View file

@ -0,0 +1,2 @@
[org/gnome/desktop/interface]
gtk-theme='adw-gtk3-dark'

4
qubes-config/etc/dconf/db/local.d/automount-disable Normal file
View file

@ -0,0 +1,4 @@
[org/gnome/desktop/media-handling]
automount=false
automount-open=false
autorun-never=true

3
qubes-config/etc/dconf/db/local.d/locks/automount-disable Normal file
View file

@ -0,0 +1,3 @@
org/gnome/desktop/media-handling/automount
org/gnome/desktop/media-handling/automount-open
/org/gnome/desktop/media-handling/autorun-never

14
qubes-config/etc/dconf/db/local.d/locks/privacy Normal file
View file

@ -0,0 +1,14 @@
/org/gnome/system/location/enabled
/org/gnome/desktop/privacy/remember-recent-files
/org/gnome/desktop/privacy/remove-old-trash-files
/org/gnome/desktop/privacy/remove-old-temp-files
/org/gnome/desktop/privacy/report-technical-problems
/org/gnome/desktop/privacy/send-software-usage-stats
/org/gnome/desktop/privacy/remember-app-usage
/org/gnome/online-accounts/whitelisted-providers
/org/gnome/desktop/remote-desktop/rdp/enable
/org/gnome/desktop/remote-desktop/vnc/enable

2
qubes-config/etc/dconf/db/local.d/prefer-dark Normal file
View file

@ -0,0 +1,2 @@
[org/gnome/desktop/interface]
color-scheme='prefer-dark'

2
qubes-config/etc/dconf/db/local.d/privacy Normal file
View file

@ -0,0 +1,2 @@
[org/gnome/desktop/interface]
color-scheme='prefer-dark'

11
qubes-config/etc/dnf/dnf.conf Normal file
View file

@ -0,0 +1,11 @@
[main]
gpgcheck=True
installonly_limit=3
clean_requirements_on_remove=True
best=False
skip_if_unavailable=True
max_parallel_downloads=10
deltarpm=False
defaultyes=True
install_weak_deps=False
countme=False

3
qubes-config/etc/environment Normal file
View file

@ -0,0 +1,3 @@
JavaScriptCoreUseJIT=0
GJS_DISABLE_JIT=1
XDG_CURRENT_DESKTOP=GNOME

1
qubes-config/etc/ld.so.preload Normal file
View file

@ -0,0 +1 @@
libhardened_malloc.so

1
qubes-config/etc/security/limits.d/30-disable-coredump.conf Normal file
View file

@ -0,0 +1 @@
* hard core 0

2
qubes-config/etc/systemd/coredump.conf.d/disable.conf Normal file
View file

@ -0,0 +1,2 @@
[Coredump]
Storage=none

6
qubes-config/etc/systemd/user/update-user-flatpaks.service Normal file
View file

@ -0,0 +1,6 @@
[Unit]
Description=Update user Flatpaks
[Service]
Type=oneshot
ExecStart=/usr/bin/flatpak --user update -y

9
qubes-config/etc/systemd/user/update-user-flatpaks.timer Normal file
View file

@ -0,0 +1,9 @@
[Unit]
Description=Update user Flatpaks daily
[Timer]
OnCalendar=daily
Persistent=true
[Install]
WantedBy=timers.target

4
qubes-config/etc/systemd/zram-generator.conf Normal file
View file

@ -0,0 +1,4 @@
[zram0]
zram-fraction = 1
max-zram-size = 8192
compression-algorithm = zstd

143
tasks/fedora-41-template.yaml
View file

@ -33,7 +33,7 @@
- name: Make home directory private
ansible.builtin.file:
path: /home
path: /home/*
state: directory
recurse: true
mode: '0700'
@ -61,22 +61,22 @@
- name: Disable coredump
ansible.builtin.copy:
src: '/etc/security/limits.d/30-disable-coredump.conf'
src: '../qubes-config/etc/security/limits.d/30-disable-coredump.conf'
dest: '/etc/security/limits.d/30-disable-coredump.conf'
mode: '0644'
- name: Create coredump.conf.d
- name: Create coredump.conf.d
ansible.builtin.file:
path: '/etc/systemd/coredump.conf.d'
state: 'directory'
mode: '0755'
- name: Copy disable.conf
ansible.builtin.copy:
src: '/etc/systemd/coredump.conf.d/disable.conf'
src: '../qubes-config/etc/systemd/coredump.conf.d/disable.conf'
dest: '/etc/systemd/coredump.conf.d/disable.conf'
mode: '0644'
- name: Make locks dir for dconf
ansible.builtin.file:
path: '/etc/dconf/db/local.d/locks'
path: '../qubes-config/etc/dconf/db/local.d/locks'
state: 'directory'
mode: '0755'
- name: copy dconf file 1
@ -136,23 +136,49 @@
dest: '/etc/environment'
mode: '0600'
- name: Mark packages as manually installed to avoid removal
shell: 'sudo dnf mark install flatpak gnome-menus qubes-menus'
- name: Upgrade all packages
ansible.builtin.dnf5:
name: "*"
state: latest
- name: Remove unwanted groups as well as unnecessary stuff from the template
ansible.builtin.dnf:
- name: Mark packages as manually installed to avoid removal
shell: 'sudo dnf mark user flatpak gnome-menus qubes-menus -y'
- name: Remove unnecessary stuff from the template
ansible.builtin.dnf5:
name:
- '@Container Management'
- '@Desktop Accessibility'
- '@Firefox Web Browser'
- '@Guest Desktop Agents'
- '@Libreoffice'
- '@Printing Support'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove unnecessary stuff
ansible.builtin.dnf5:
name:
- 'gnome-software'
- 'httpd'
- 'keepassxc'
- 'thunderbird'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove firefox packages
ansible.builtin.dnf5:
name:
- 'fedora-bookmarks'
- 'fedora-chromium-config'
- 'firefox'
- 'mozilla-filesystem'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove Network + hardware tools packages
ansible.builtin.dnf5:
name:
- 'avahi'
- 'cifs*'
- '*cups'
@ -173,6 +199,12 @@
- 'teamd'
- 'traceroute'
- 'usb_modeswitch'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove support for some languages
ansible.builtin.dnf5:
name:
- '*anthy*'
- '*hangul*'
- 'ibus-typing-booster'
@ -182,11 +214,23 @@
- 'texlive-libs'
- ' words'
- '*zhuyin*'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove codec + image + printers
ansible.builtin.dnf5:
name:
- 'openh264'
- 'ImageMagick*'
- 'sane*'
- 'simple-scan'
- 'sssd*'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove Active Directory + Sysadmin + reporting tools
ansible.builtin.dnf5:
name:
- 'sssd*'
- 'realmd'
- 'cyrus-sasl-gssapi'
- 'quota*'
@ -195,6 +239,12 @@
- 'sos'
- 'samba-client'
- 'gvfs-smb'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove NetworkManager
ansible.builtin.dnf5:
name:
- 'NetworkManager-pptp-gnome'
- 'NetworkManager-ssh-gnome'
- 'NetworkManager-openconnect-gnome'
@ -202,6 +252,12 @@
- 'NetworkManager-vpnc-gnome'
- 'ppp*'
- 'ModemManager'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove Gnome apps
ansible.builtin.dnf5:
name:
- 'baobab'
- 'chrome-gnome-shell'
- 'eog'
@ -234,6 +290,12 @@
- 'loupe'
- 'snapshot'
- 'totem'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove apps
ansible.builtin.dnf5:
name:
- 'abrt*'
- 'cheese'
- 'evince'
@ -242,38 +304,45 @@
- 'mediawriter'
- 'rhythmbox'
- 'yelp'
state: 'absent'
allowerasing: true
autoremove: true
- name: Remove other packages
ansible.builtin.dnf5:
name:
- 'lvm2'
- 'rng-tools'
- 'thermald'
- '*perl*'
state: 'absent'
allowerasing: true
autoremove: true
- name: Disable openh264 repo (y tho?)
community.general.dnf_config_manager:
name: 'fedora-cisco-openh264'
state: disabled
shell: 'sudo dnf config-manager setopt fedora-cisco-openh264.enabled=0'
# community.general.dnf_config_manager:
# name: 'fedora-cisco-openh264'
# state: disabled
- name: Install custom packages
ansible.builtin.dnf:
name:
- 'qubes-ctap'
- 'qubes-gpg-split'
- 'adw-gtk3-theme'
- 'ncurses'
- 'gnome-shell'
- 'ptyxis'
state: 'present'
- Enable hardened_malloc COPR
community.general.copr:
name: 'secureblue/hardened_malloc'
state: 'enabled'
ansible.builtin.dnf5:
name:
- 'qubes-ctap'
- 'qubes-gpg-split'
- 'adw-gtk3-theme'
- 'ncurses'
- 'gnome-shell'
- 'ptyxis'
state: 'present'
- name: Enable hardened_malloc COPR
shell: 'sudo dnf copr enable secureblue/hardened_malloc -y'
#
# name: 'secureblue/hardened_malloc'
# state: 'enabled'
- name: Install hardened_malloc
ansible.builtin.dnf:
name: 'hardened_malloc'
state: 'present'
ansible.builtin.dnf5:
name: 'hardened_malloc'
state: 'present'
- name: Enable hardened_malloc
ansible.builtin.copy:
@ -290,4 +359,16 @@
dest: '/etc/dnf/dnf.conf'
mode: '0644'
- name: Get list of files
ansible.builtin.find:
paths: /etc/yum.repos.d/
recurse: true
register: found_files
- name: Replace text in those files
ansible.builtin.replace:
path: '{{ item.path }}'
regexp: '^metalink=.*'
replace: '&\&protocol=https'
loop: '{{ found_files.files }}'