Tweaking fedora 41 gnome template

tasks/fedora-41-template.yaml

@@ -33,7 +33,7 @@
 
    - name: Make home directory private
      ansible.builtin.file:
-       path: /home
+       path: /home/*
        state: directory
        recurse: true
        mode: '0700'
@@ -61,22 +61,22 @@
 
    - name: Disable coredump
      ansible.builtin.copy:
-       src: '/etc/security/limits.d/30-disable-coredump.conf'
+       src: '../qubes-config/etc/security/limits.d/30-disable-coredump.conf'
        dest: '/etc/security/limits.d/30-disable-coredump.conf'
        mode: '0644'
-   - name: Create coredump.conf.d  
+   - name: Create coredump.conf.d
      ansible.builtin.file:
        path: '/etc/systemd/coredump.conf.d'
        state: 'directory'
        mode: '0755'
    - name: Copy disable.conf
      ansible.builtin.copy:
-       src: '/etc/systemd/coredump.conf.d/disable.conf'
+       src: '../qubes-config/etc/systemd/coredump.conf.d/disable.conf'
        dest: '/etc/systemd/coredump.conf.d/disable.conf'
        mode: '0644'
    - name: Make locks dir for dconf
      ansible.builtin.file:
-       path: '/etc/dconf/db/local.d/locks'
+       path: '../qubes-config/etc/dconf/db/local.d/locks'
        state: 'directory'
        mode: '0755'
    - name: copy dconf file 1
@@ -136,23 +136,49 @@
        dest: '/etc/environment'
        mode: '0600'
 
-   - name: Mark packages as manually installed to avoid removal
-     shell: 'sudo dnf mark install flatpak gnome-menus qubes-menus'
+   - name: Upgrade all packages
+     ansible.builtin.dnf5:
+       name: "*"
+       state: latest
 
-   - name: Remove unwanted groups as well as unnecessary stuff from the template
-     ansible.builtin.dnf:
+   - name: Mark packages as manually installed to avoid removal
+     shell: 'sudo dnf mark user flatpak gnome-menus qubes-menus -y'
+
+   - name: Remove unnecessary stuff from the template
+     ansible.builtin.dnf5:
        name:
          - '@Container Management'
          - '@Desktop Accessibility'
          - '@Firefox Web Browser'
+         - '@Guest Desktop Agents'
+         - '@Libreoffice'
+         - '@Printing Support'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove unnecessary stuff
+     ansible.builtin.dnf5:
+       name:
          - 'gnome-software'
          - 'httpd'
          - 'keepassxc'
          - 'thunderbird'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove firefox packages
+     ansible.builtin.dnf5:
+       name:
          - 'fedora-bookmarks'
          - 'fedora-chromium-config'
          - 'firefox'
          - 'mozilla-filesystem'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove Network + hardware tools packages
+     ansible.builtin.dnf5:
+       name:
          - 'avahi'
          - 'cifs*'
          - '*cups'
@@ -173,6 +199,12 @@
          - 'teamd'
          - 'traceroute'
          - 'usb_modeswitch'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove support for some languages
+     ansible.builtin.dnf5:
+       name:
          -  '*anthy*'
          - '*hangul*'
          - 'ibus-typing-booster'
@@ -182,11 +214,23 @@
          - 'texlive-libs'
          - ' words'
          - '*zhuyin*'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove codec + image + printers
+     ansible.builtin.dnf5:
+       name:
          - 'openh264'
          - 'ImageMagick*'
          - 'sane*'
          - 'simple-scan'
-         -  'sssd*'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove Active Directory + Sysadmin + reporting tools
+     ansible.builtin.dnf5:
+       name:
+         - 'sssd*'
          - 'realmd'
          - 'cyrus-sasl-gssapi'
          - 'quota*'
@@ -195,6 +239,12 @@
          - 'sos'
          - 'samba-client'
          - 'gvfs-smb'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove NetworkManager
+     ansible.builtin.dnf5:
+       name:
          - 'NetworkManager-pptp-gnome'
          - 'NetworkManager-ssh-gnome'
          - 'NetworkManager-openconnect-gnome'
@@ -202,6 +252,12 @@
          - 'NetworkManager-vpnc-gnome'
          - 'ppp*'
          - 'ModemManager'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove Gnome apps
+     ansible.builtin.dnf5:
+       name:
          - 'baobab'
          - 'chrome-gnome-shell'
          - 'eog'
@@ -234,6 +290,12 @@
          - 'loupe'
          - 'snapshot'
          - 'totem'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove apps
+     ansible.builtin.dnf5:
+       name:
          - 'abrt*'
          - 'cheese'
          - 'evince'
@@ -242,38 +304,45 @@
          - 'mediawriter'
          - 'rhythmbox'
          - 'yelp'
+       state: 'absent'
+       allowerasing: true
+       autoremove: true
+   - name: Remove other packages
+     ansible.builtin.dnf5:
+       name:
          - 'lvm2'
          - 'rng-tools'
          - 'thermald'
          - '*perl*'
-
-
        state: 'absent'
+       allowerasing: true
        autoremove: true
 
    - name: Disable openh264 repo (y tho?)
-     community.general.dnf_config_manager:
-     name: 'fedora-cisco-openh264'
-     state: disabled
+     shell: 'sudo dnf config-manager setopt fedora-cisco-openh264.enabled=0'
+    #     community.general.dnf_config_manager:
+     #  name: 'fedora-cisco-openh264'
+      # state: disabled
 
    - name: Install custom packages
-     ansible.builtin.dnf:
-     name:
-       - 'qubes-ctap'
-       - 'qubes-gpg-split'
-       - 'adw-gtk3-theme'
-       - 'ncurses'
-       - 'gnome-shell'
-       - 'ptyxis'
-     state: 'present'
-   - Enable hardened_malloc COPR
-     community.general.copr:
-       name: 'secureblue/hardened_malloc'
-       state: 'enabled'
+     ansible.builtin.dnf5:
+       name:
+         - 'qubes-ctap'
+         - 'qubes-gpg-split'
+         - 'adw-gtk3-theme'
+         - 'ncurses'
+         - 'gnome-shell'
+         - 'ptyxis'
+       state: 'present'
+   - name: Enable hardened_malloc COPR
+     shell: 'sudo dnf copr enable secureblue/hardened_malloc -y'
+     # 
+     #  name: 'secureblue/hardened_malloc'
+     #  state: 'enabled'
    - name: Install hardened_malloc
-     ansible.builtin.dnf:
-     name: 'hardened_malloc'
-     state: 'present'
+     ansible.builtin.dnf5:
+       name: 'hardened_malloc'
+       state: 'present'
 
    - name: Enable hardened_malloc
      ansible.builtin.copy:
@@ -290,4 +359,16 @@
        dest: '/etc/dnf/dnf.conf'
        mode: '0644'
 
+   - name: Get list of files
+     ansible.builtin.find:
+       paths: /etc/yum.repos.d/
+       recurse: true
+     register: found_files
+
+   - name: Replace text in those files
+     ansible.builtin.replace:
+       path: '{{ item.path }}'
+       regexp: '^metalink=.*'
+       replace: '&\&protocol=https'
+     loop: '{{ found_files.files }}'