stream9-workstation.yml

---
- name: CentOS Stream 9 Workstation / Server w/ GUI Setup / Laptop / Whatever
  hosts: localhost
  vars:
    non_root_user: admiller
    flatpak_method: system
  tasks:

    - name: Package Install - CentOS Stream 9
      ansible.builtin.yum:
        state: installed
        name: "{{ packages_stream9 }}"

    - name: Package Install - Common
      ansible.builtin.yum:
        state: installed
        name: "{{ packages_common }}"

    - name: Package Install - Desktop
      ansible.builtin.yum:
        state: installed
        name: 
          - gnome-tweaks

    - name: Package Install - EPEL9 
      ansible.builtin.yum:
        state: installed
        name: "{{ packages_epel9 }}"

    - name: Setup CSB Repo
      template:
        src: templates/rhel8-csb.repo.j2
        dest: /etc/yum.repos.d/rhel8-csb.repo

    - name: Package Install - CSB RHEL8
      ansible.builtin.yum:
        state: installed
        name:
          - oneplay-gstreamer-codecs-pack
          - redhat-internal-openvpn-profiles
          - redhat-internal-NetworkManager-openvpn-profiles
          - redhat-internal-NetworkManager-openvpn-profiles-non-gnome
          - redhat-internal-wireless-config
          - redhat-internal-cert-install
      ignore_errors: yes

    - name: import flatpak app install tasks
      import_tasks: include_tasks/flatpak_install.yml

    - name: Ensure SELinux Enforcing
      ansible.posix.selinux:
        policy: targeted
        state: enforcing

    - name: Enable container_manage_cgroup for running systemd in podman containers
      ansible.posix.seboolean:
        name: container_manage_cgroup
        state: true
        persistent: true

    - name: Disable ssh and rpcbind because reasons
      ansible.builtin.systemd:
        name: "{{ item }}"
        state: stopped
        masked: true
        enabled: false
      loop:
        - rpcbind
        - sshd

    - name: Ensure various ports are not open
      ansible.posix.firewalld:
        service: "{{ item }}"
        permanent: yes
        immediate: yes
        state: disabled
      loop:
        - cockpit
        - ssh

    - name: Make sure non_root_user user is in mock
      ansible.builtin.user:
        name: "{{ non_root_user }}" 
        groups: mock
        append: yes

    - name: Allow non-root user access to libvirt via polkit
      ansible.builtin.template:
        src: templates/non_root_user_libvirt_polkit.j2
        dest: /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules
      notify:
        - reload polkit

    - name: Allow non-root user access to NetworkManager
      ansible.builtin.template:
        src: templates/network_manager_polkit.j2
        dest: /etc/polkit-1/rules.d/10-network-manager.pkla
      notify:
        - reload polkit

    - name: enable journald persistent storage
      ansible.builtin.file:
        path: /var/log/journal
        state: directory

  handlers:
    - name: reload polkit
      ansible.builtin.service:
        name: polkit
        state: restarted

- name: CentOS Stream 9 Workstation / Server w/ GUI Setup / Laptop / Whatever - User Stuff
  hosts: localhost
  become_user: admiller
  become: yes
  tasks:
    - name: import user dev stuff
      ansible.builtin.import_tasks: include_tasks/user_stuff.yml
    - name: import install minikube task set
      ansible.builtin.import_tasks: include_tasks/install_minikube.yml