90 lines
2.2 KiB
Markdown
90 lines
2.2 KiB
Markdown
# Cachy-workstation
|
|
|
|
Infrastructure-as-Code for a CachyOS Linux workstation, managed with Ansible.
|
|
|
|
## Goals
|
|
|
|
- Describe and reproduce the workstation configuration declaratively
|
|
- Learn Ansible patterns: site-based playbooks, roles, and tags
|
|
|
|
## Design
|
|
|
|
- **Tool:** Ansible
|
|
- **Target:** `localhost` only
|
|
- **Entry point:** `site.yml`
|
|
- **Structure:** Roles with tags for selective execution
|
|
|
|
## New Machine Bootstrap
|
|
|
|
On a fresh machine, run `bootstrap.yml` first. It handles the prerequisites that
|
|
`site.yml` depends on:
|
|
|
|
1. Installs and authenticates Tailscale
|
|
2. Imports GPG keys from the local git server
|
|
3. Clones the pass password store
|
|
|
|
Prerequisites before running bootstrap:
|
|
|
|
```bash
|
|
sudo pacman -S ansible git
|
|
```
|
|
|
|
Run bootstrap:
|
|
|
|
```bash
|
|
ansible-playbook -K -i inventory/hosts.yml bootstrap.yml
|
|
```
|
|
|
|
Then run the full site playbook:
|
|
|
|
```bash
|
|
ansible-playbook -K -i inventory/hosts.yml site.yml
|
|
```
|
|
|
|
## Usage
|
|
|
|
Run the full site playbook:
|
|
|
|
```bash
|
|
ansible-playbook -K -i inventory/hosts.yml site.yml
|
|
```
|
|
|
|
Run only tasks matching a specific tag:
|
|
|
|
```bash
|
|
ansible-playbook -K -i inventory/hosts.yml site.yml --tags <tagname>
|
|
```
|
|
|
|
Skip tasks matching a tag:
|
|
|
|
```bash
|
|
ansible-playbook -K -i inventory/hosts.yml site.yml --skip-tags <tagname>
|
|
```
|
|
|
|
## Roles
|
|
|
|
| Role | Play | Description |
|
|
|------|------|-------------|
|
|
| firewall | system | ufw, default deny incoming, allow port 22 |
|
|
| packages | system | General packages via pacman |
|
|
| docker | system | Docker, enables service, adds user to docker group |
|
|
| virtualization | system | qemu-full, virt-manager, libvirtd |
|
|
| web | system | hcloud, hugo, tea |
|
|
| flatpak | system | Flatpak and apps, MakeMKV device permissions |
|
|
| gpg | user | Import GPG keys from private git repo |
|
|
| ssh | user | Deploy SSH keys and config from pass |
|
|
| pass | user | Clone pass password store |
|
|
| dotfiles | user | Clone dotfiles and nvim repos, symlink configs |
|
|
| scripts | user | Clone scripts repo, add to PATH, deploy Pushover credentials |
|
|
| hotkeys | user | Deploy .desktop files, set Plasma 6 global shortcuts |
|
|
|
|
## Structure
|
|
|
|
```
|
|
.
|
|
├── bootstrap.yml # New machine bootstrap
|
|
├── site.yml # Main entry point
|
|
├── inventory/ # Inventory files
|
|
└── roles/ # Ansible roles
|
|
```
|