Cachy-workstation

Infrastructure-as-Code for a CachyOS Linux workstation, managed with Ansible.

Goals

Describe and reproduce the workstation configuration declaratively
Learn Ansible patterns: site-based playbooks, roles, and tags

Design

Tool: Ansible
Target: localhost only
Entry point: site.yml
Structure: Roles with tags for selective execution

New Machine Bootstrap

On a fresh machine, run bootstrap.yml first. It handles the prerequisites that site.yml depends on:

Installs and authenticates Tailscale
Imports GPG keys from the local git server
Clones the pass password store

Prerequisites before running bootstrap:

sudo pacman -S ansible git

Run bootstrap:

ansible-playbook -K -i inventory/hosts.yml bootstrap.yml

Then run the full site playbook:

ansible-playbook -K -i inventory/hosts.yml site.yml

Usage

Run the full site playbook:

ansible-playbook -K -i inventory/hosts.yml site.yml

Run only tasks matching a specific tag:

ansible-playbook -K -i inventory/hosts.yml site.yml --tags <tagname>

Skip tasks matching a tag:

ansible-playbook -K -i inventory/hosts.yml site.yml --skip-tags <tagname>

Roles

Role	Play	Description
firewall	system	ufw, default deny incoming, allow port 22
packages	system	General packages via pacman
docker	system	Docker, enables service, adds user to docker group
virtualization	system	qemu-full, virt-manager, libvirtd
web	system	hcloud, hugo, tea
flatpak	system	Flatpak and apps, MakeMKV device permissions
gpg	user	Import GPG keys from private git repo
ssh	user	Deploy SSH keys and config from pass
pass	user	Clone pass password store
dotfiles	user	Clone dotfiles and nvim repos, symlink configs
scripts	user	Clone scripts repo, add to PATH, deploy Pushover credentials
hotkeys	user	Deploy .desktop files, set Plasma 6 global shortcuts

Structure

.
├── bootstrap.yml     # New machine bootstrap
├── site.yml          # Main entry point
├── inventory/        # Inventory files
└── roles/            # Ansible roles