# Cachy-workstation

Infrastructure-as-Code for a CachyOS Linux workstation, managed with Ansible.

## Goals

- Describe and reproduce the workstation configuration declaratively
- Learn Ansible patterns: site-based playbooks, roles, and tags

## Design

- **Tool:** Ansible
- **Target:** `localhost` only
- **Entry point:** `site.yml`
- **Structure:** Roles with tags for selective execution

## New Machine Bootstrap

On a fresh machine, run `bootstrap.yml` first. It handles the prerequisites that
`site.yml` depends on:

1. Installs and authenticates Tailscale
2. Imports GPG keys from the local git server
3. Clones the pass password store

Prerequisites before running bootstrap:

```bash
sudo pacman -S ansible git
```

Run bootstrap:

```bash
ansible-playbook -K -i inventory/hosts.yml bootstrap.yml
```

Then run the full site playbook:

```bash
ansible-playbook -K -i inventory/hosts.yml site.yml
```

## Usage

Run the full site playbook:

```bash
ansible-playbook -K -i inventory/hosts.yml site.yml
```

Run only tasks matching a specific tag:

```bash
ansible-playbook -K -i inventory/hosts.yml site.yml --tags <tagname>
```

Skip tasks matching a tag:

```bash
ansible-playbook -K -i inventory/hosts.yml site.yml --skip-tags <tagname>
```

## Roles

| Role | Play | Description |
|------|------|-------------|
| firewall | system | ufw, default deny incoming, allow port 22 |
| packages | system | General packages via pacman |
| docker | system | Docker, enables service, adds user to docker group |
| virtualization | system | qemu-full, virt-manager, libvirtd |
| web | system | hcloud, hugo, tea |
| flatpak | system | Flatpak and apps, MakeMKV device permissions |
| gpg | user | Import GPG keys from private git repo |
| ssh | user | Deploy SSH keys and config from pass |
| pass | user | Clone pass password store |
| dotfiles | user | Clone dotfiles and nvim repos, symlink configs |
| scripts | user | Clone scripts repo, add to PATH, deploy Pushover credentials |
| hotkeys | user | Deploy .desktop files, set Plasma 6 global shortcuts |

## Structure

```
.
├── bootstrap.yml     # New machine bootstrap
├── site.yml          # Main entry point
├── inventory/        # Inventory files
└── roles/            # Ansible roles
```