fedora_init.yml

# Usage:
# 1) Copy the accompanying ansible.cfg as ~/.ansible.cfg
# 2) Install Ansible
# 3) Adjust and run the playbook
# 4) Set password for the new user and reboot
---
- name: Initialize Fedora
  hosts: all
  become: true
  gather_facts: true
  vars:
    console_keymap: fi
    console_font: eurlatgr
    langpacks: ['en', 'fi']
    system_locale: C.UTF-8
    system_timezone: Europe/Helsinki
    root_shell: /bin/zsh
    create_user: false
    user_uid: 1000
    user_name: mm
    user_group: users
    user_shell: /bin/zsh
    workstation: false
    enable_sshd: true
    disable_network_services: true
  tasks:
    - name: Check target basics
      check_mode: false
      raw: rpm -q python3 python3-libdnf5 python3-libselinux
      register: basics
      failed_when: false
      changed_when: false

    - name: Prepare target basics
      raw: dnf -y install python3 python3-libdnf5 python3-libselinux
      changed_when: true
      when: basics.rc != 0

    - name: Create target remote_tmp
      file:
        path: "{{ ansible_facts.env.HOME }}/.ansible/tmp"
        state: directory
        mode: '0700'

    - name: Detect boot parameters
      check_mode: false
      command: grep -q TIMEOUT=5 /etc/default/grub
      register: adjust_boot_parameters
      failed_when: false
      changed_when: false

    - name: Install grubby
      dnf:
        name: grubby
        state: present
      when: adjust_boot_parameters.rc == 0

    - name: Adjust boot timeout
      replace:
        dest: /etc/default/grub
        regexp: '^GRUB_TIMEOUT=.*'
        replace: 'GRUB_TIMEOUT=1'
      when: adjust_boot_parameters.rc == 0

    - name: Adjust boot parameters
      command: grubby --remove-args="rhgb" --args="quiet" --update-kernel=ALL
      changed_when: true
      when: adjust_boot_parameters.rc == 0

    - name: Detect rescue images
      find:
        paths:
          - /boot
          - /boot/loader/entries
        patterns:
          - '*rescue*'
      register: rescue_images

    - name: Remove rescue images
      file:
        path: "{{ item }}"
        state: absent
      loop: "{{ rescue_images.files | map(attribute='path') }}"

    - name: Update GRUB configuration
      command: grub2-mkconfig -o /boot/grub2/grub.cfg
      changed_when: true
      when: adjust_boot_parameters.rc == 0

    - name: Detect LUKS configuration
      check_mode: false
      command: grep -q mapper/luks /etc/fstab
      register: luks_in_use
      failed_when: false
      changed_when: false

    - name: Configure console
      copy:
        content: |
          KEYMAP="{{ console_keymap }}"
          FONT="{{ console_font }}"
        dest: /etc/vconsole.conf
        mode: '0644'

    - name: Configure locale
      copy:
        content: |
          LANG="{{ system_locale }}"
        dest: /etc/locale.conf
        mode: '0644'

    - name: Set timezone
      community.general.timezone:
        name: "{{ system_timezone }}"

    - name: Check RPM Fusion repository
      # noqa: command-instead-of-module
      command: >
        rpm -q rpmfusion-free-release-{{ ansible_facts.distribution_major_version }} rpmfusion-nonfree-release-{{ ansible_facts.distribution_major_version }}
      register: fusion_enabled
      failed_when: false
      changed_when: false
      when: workstation | bool

    - name: Enable RPM Fusion repository
      dnf:
        name:
          - https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-{{ ansible_facts.distribution_major_version }}.noarch.rpm
          - https://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-{{ ansible_facts.distribution_major_version }}.noarch.rpm
        state: present
        disable_gpg_check: true
      when: workstation | bool and fusion_enabled.rc != 0

    - name: Remove unneeded firmware packages
      dnf:
        name:
          - 'a*firmware*'
          - 'i*firmware*'
          - 'lib*firmware*'
          - linux-firmware
          - 'n*firmware*'
          - 'z*firmware'
        state: absent
        cacheonly: true
        disablerepo: '*'
      when: ansible_facts.virtualization_role == "guest"

    - name: Remove all virtual guest packages
      dnf:
        name:
          - 'hyperv*'
          - open-vm-tools
          - qemu-guest-agent
          - spice-vdagent
          - virtualbox-guest-additions
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when: ansible_facts.virtualization_role != "guest"

    - name: Remove unhelpful packages on VM
      dnf:
        name:
          - akmods
          - 'dmraid*'
          #- 'libvirt*'
          - 'pcsc*'
          - thermald
        state: absent
        cacheonly: true
        disablerepo: '*'
      when: ansible_facts.virtualization_role == "guest"

    - name: Remove unneeded packages on Azure/Hyper-V
      dnf:
        name:
          - open-vm-tools
          - qemu-guest-agent
          - spice-vdagent
          - virtualbox-guest-additions
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type == "VirtualPC"

    - name: Remove unneeded packages on KVM
      dnf:
        name:
          - 'hyperv*'
          - open-vm-tools
          - virtualbox-guest-additions
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type == "kvm"

    - name: Remove unneeded packages on VirtualBox
      dnf:
        name:
          - 'hyperv*'
          - open-vm-tools
          - qemu-guest-agent
          - spice-vdagent
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type == "virtualbox"

    - name: Remove unneeded packages on VMware
      dnf:
        name:
          - 'hyperv*'
          - qemu-guest-agent
          - spice-vdagent
          - virtualbox-guest-additions
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type == "VMware"

    - name: Remove unneeded packages on other VMs
      dnf:
        name:
          - 'hyperv*'
          - open-vm-tools
          - qemu-guest-agent
          - spice-vdagent
          - virtualbox-guest-additions
          - WALinuxAgent
        state: absent
        cacheonly: true
        disablerepo: '*'
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type not in ['kvm', 'virtualbox', 'VirtualPC', 'VMware']

    - name: Remove unneeded Plymouth packages
      dnf:
        name:
          - 'plymouth*'
        state: absent
        cacheonly: true
        disablerepo: '*'
      when: not luks_in_use.rc == 0

    - name: Remove unhelpful packages
      dnf:
        name:
          - NetworkManager-adsl
          - NetworkManager-openconnect
          - NetworkManager-pptp
          - NetworkManager-team
          - NetworkManager-tui
          #- 'PackageKit*'
          - 'abrt*'
          - anaconda
          - 'b43*'
          - cifs-utils
          - cockpit
          - dracut-config-rescue
          - dracut-live
          - evolution
          - 'foomatic*'
          - gnome-tour
          - gnome-user-docs
          - 'gutenprint*'
          - '*hangul*'
          - 'hplip*'
          - 'java*'
          - kernel-modules-extra
          - kexec-tools
          - '*kkc*'
          - '*libreoffice*'
          - mediawriter
          - nfs-utils
          - orca
          - pam_krb5
          #- 'perl*'
          - '*pinyin*'
          - qgnomeplatform
          #- 'qt*'
          - realmd
          - 'sane*'
          - teamd
          - trousers
          - '*zhuyin*'
        state: absent
        autoremove: true
        cacheonly: true
        disablerepo: '*'

    - name: Install helpful packages (common)
      dnf:
        name:
          - bash-completion
          - bc
          - bind-utils
          - ethtool
          - git-core
          - glibc-minimal-langpack
          #- gpm
          #- iotop
          - irqbalance
          - keychain
          #- ltrace
          - man-pages
          - nano
          #- nmap-ncat
          #- numactl
          - openssh-clients
          #- pcp-doc
          #- pcp-system-tools
          #- perf
          - plocate
          - policycoreutils-python-utils
          - psmisc
          - setools-console
          - strace
          - tar
          - tcpdump
          #- telnet
          - tmux
          - tuned
          - unzip
          - util-linux-user
          - yum-utils
          - zsh
          - zstd
        state: present

    - name: Install helpful packages (guest agent)
      vars:
        agent_packages:
          kvm: qemu-guest-agent
          virtualbox: virtualbox-guest-additions
          VirtualPC:
            - hyperv-daemons
            - WALinuxAgent
          VMware: open-vm-tools
      dnf:
        name: "{{ agent_packages[ansible_facts.virtualization_type] }}"
        state: present
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type in agent_packages

    - name: Enable virtual guest agent service
      vars:
        agent_services:
          kvm: qemu-guest-agent.service
          virtualbox: vboxservice.service
          VirtualPC: waagent.service
          VMware: vmtoolsd.service
      service:
        name: "{{ agent_services[ansible_facts.virtualization_type] }}"
        state: started
        enabled: true
      when:
        - ansible_facts.virtualization_role == "guest"
        - ansible_facts.virtualization_type in agent_services
        - ansible_facts.virtualization_type in ['kvm', 'virtualbox', 'VirtualPC', 'VMware']

    - name: Install helpful packages (langpacks)
      dnf:
        name: glibc-langpack-{{ langpacks | join(',glibc-langpack-') }}
        state: present

    - name: Install helpful packages (workstation)
      dnf:
        name:
          - GraphicsMagick
          - dconf-editor
          - ffmpeg
          #- fuse-sshfs
          - gnome-tweaks
          - gstreamer1-libav
          - gstreamer1-plugins-good-gtk
          - libavc1394
          - ntfsprogs
          - patch
          #- powertop
          - seahorse
          - totem
          #- vlc
          - xauth
          - xclip
          - xorg-x11-fonts-misc
          - xorriso
          - youtube-dl
        state: present
      when: workstation | bool

    - name: Install helpful packages (workstation langpacks)
      dnf:
        name: langpacks-core-{{ langpacks | join(',langpacks-') }}
        state: present
      when: workstation | bool

    - name: Remove unhelpful packages ('all' langpacks)
      dnf:
        name:
          - gawk-all-langpacks
          - glibc-all-langpacks
        state: absent
        cacheonly: true
        disablerepo: '*'

    - name: Update all packages
      # noqa: package-latest
      dnf:
        name: '*'
        state: latest
        update_cache: true

    - name: Check current boot parameters
      check_mode: false
      shell: set -o pipefail ; cat /proc/cmdline | grep -q rhgb
      register: rhgb_used
      failed_when: false
      changed_when: false

    - name: Ensure correct boot parameters
      command: grubby --remove-args="rhgb" --args="quiet" --update-kernel=ALL
      changed_when: true
      when: rhgb_used.rc == 0

    - name: Disable unhelpful services
      service:
        name: "{{ item }}"
        enabled: false
      loop:
        - cups.service
        - dmraid-activation.service
        - dnf-makecache.timer
        - lvm2-monitor.service
        - mcelog.service
        - mdmonitor.service
        - multipathd.service
        #- pmie.service
      failed_when: false

    - name: Disable unhelpful services on VMs
      service:
        name: "{{ item }}"
        enabled: false
      loop:
        - raid-check.timer
        - switcheroo-control
        - upower.service
      failed_when: false
      when: ansible_facts.virtualization_role == "guest"

    - name: Disable unhelpful network services
      service:
        name: "{{ item }}"
        enabled: false
      loop:
        - bluetooth.service
        - iscsi.service
        - iscsid.socket
        - iscsiuio.socket
        - nfs-client.target
        - nfs-convert.service
        - remote-fs.target
        - sssd.service
      failed_when: false
      when: disable_network_services | bool

    - name: Enable helpful services
      service:
        name: "{{ item }}"
        enabled: true
      loop:
        #- gpm.service
        - irqbalance.service
        #- pmcd.service
        #- pmlogger.service
        - tuned.service

    - name: Install SSH daemon
      dnf:
        name: openssh-server
        state: present
      when: enable_sshd | bool

    - name: Enable SSH daemon
      service:
        name: sshd
        state: started
        enabled: true
      when: enable_sshd | bool

    - name: Change root shell
      user:
        name: root
        shell: "{{ root_shell }}"

    - name: Disable pulseaudio for root, part I
      file:
        path: /root/.config/systemd/user
        state: directory
        mode: '0755'

    - name: Disable pulseaudio for root, part II
      file:
        state: link
        src: /dev/null
        dest: /root/.config/systemd/user/{{ item }}
      loop:
        - pulseaudio.service
        - pulseaudio.socket

    - name: Create user, part I
      user:
        name: "{{ user_name }}"
        uid: "{{ user_uid }}"
        group: "{{ user_group }}"
        shell: "{{ user_shell }}"
      when: create_user | bool

    - name: Create user, part II
      copy:
        content: |
          [User]
          Language=
          XSession=
          Icon=/home/{{ user_name }}/.face
          SystemAccount=false
        dest: /var/lib/AccountsService/users/{{ user_name }}
        owner: root
        group: root
        mode: '0600'
      when: workstation | bool and create_user | bool

    - name: Disable tracker for the user, part I
      file:
        path: /home/{{ user_name }}/.config/systemd/user
        state: directory
        owner: "{{ user_name }}"
        group: "{{ user_group }}"
        mode: '0755'
      when: false and create_user | bool

    - name: Disable tracker for the user, part II
      file:
        state: link
        src: /dev/null
        dest: /home/{{ user_name }}/.config/systemd/user/{{ item }}
        owner: "{{ user_name }}"
        group: "{{ user_group }}"
      loop:
        - tracker-extract.service
        - tracker-miner-apps.service
        - tracker-miner-fs.service
        - tracker-miner-rss.service
        - tracker-store.service
        - tracker-writeback.service
      when: false and create_user | bool

    - name: Disable tracker for the user, part III
      command: restorecon -Rv "/home/{{ user_name }}/.config/systemd"
      register: restorecon
      changed_when: "'Relabeled' in restorecon.stdout"
      when: false and create_user | bool

    - name: Configure sudoers
      lineinfile:
        path: /etc/sudoers.d/{{ user_name }}
        line: '{{ user_name }} ALL=(ALL) NOPASSWD: ALL'
        create: true
        mode: '0440'
        validate: /usr/sbin/visudo -csf %s
      when: create_user | bool

    - name: Create Windows partition mount point
      file:
        path: /mnt/c
        state: directory
        mode: '0755'
      when: workstation | bool

    - name: Check Windows mount point configuration
      check_mode: true
      lineinfile:
        path: /etc/fstab
        regexp: '.* ntfs .*'
        line: ''
      register: ntfs_line
      changed_when: false
      when: workstation | bool

    # Needs to be adjusted and enabled manually
    - name: Create Windows mount point fstab entry
      lineinfile:
        path: /etc/fstab
        line: "#/dev/sda5 /mnt/c ntfs noauto,ro,uid={{ user_uid }},nls=utf8,comment=systemd.automount 1 2"
      when: workstation | bool and ntfs_line.msg == "line added"

    - name: Clean up, part I
      file:
        path: "{{ item }}"
        state: absent
      loop:
        - /1
        - /etc/rc.d/init.d/livesys
        - /root/.config/pulse
        - /root/.esd_auth
        - /root/.lesshst
        - /root/.local/share/ibus-typing-booster
        - /root/.rnd
        - /root/.wget-hsts
        - /root/anaconda-ks.cfg
        - /root/original-ks.cfg
        - /var/lib/abrt
        - /var/spool/abrt
        - /var/tmp/abrt

    - name: Clean up, part II
      find:
        paths:
          - /tmp
        patterns:
          - 'ks-script*'
      register: tmp_files

    - name: Clean up, part III
      file:
        path: "{{ item }}"
        state: absent
      loop: "{{ tmp_files.files | map(attribute='path') }}"