Adding etc, flatpak and rpm-ostree role

roles/etc/defaults/main.yml

@@ -0,0 +1,12 @@
+---
+etc_set_hostname: true
+etc_enable_BLSCFG: true
+etc_update_users: true
+etc_enable_NTS: true
+etc_configure_firewalld: true
+etc_configure_sysctl: true
+
+etc_sysctl_params:
+  kernel.unprivileged_bpf_disabled:
+    value: 1
+    state: present

roles/etc/handlers/main.yml

@@ -0,0 +1,6 @@
+- name: Restart chronyd
+  ansible.builtin.systemd:
+    name: chronyd
+    state: restarted
+    enabled: yes
+  become: yes

roles/etc/tasks/blscfg.yml

@@ -0,0 +1,16 @@
+---
+- name: Check if BootLoaderSpec is enabled
+  ansible.builtin.lineinfile:
+    path: /etc/default/grub
+    line: 'GRUB_ENABLE_BLSCFG=true'
+    #regexp: '^GRUB_ENABLE_BLSCFG=[tT]rue'
+    state: present
+  check_mode: yes
+  register: conf
+
+- name: Enable BootLoaderSpec
+  ansible.builtin.command:
+    cmd: grub2-switch-to-blscfg
+  become: yes
+  when:
+    - conf.changed != false

roles/etc/tasks/firewalld.yml

@@ -0,0 +1,10 @@
+---
+- name: Configure firewalld
+  ansible.posix.firewalld:
+    service: "{{ item.key }}"
+    zone: "{{ item.value.zone }}"
+    state: "{{ item.value.state }}"
+    immediate: yes
+    permanent: yes
+  become: yes
+  loop: "{{ lookup('dict', etc_firewalld, wantlist=True) }}"

roles/etc/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ etc_hostname }}"
+    use: systemd
+  become: yes
+  when: etc_set_hostname | bool
+
+- name: Include users.yml
+  ansible.builtin.include: users.yml
+  when:  etc_update_users | bool
+
+- name: Include blscfg.yml
+  ansible.builtin.include: blscfg.yml
+  when: etc_enable_BLSCFG | bool
+
+- name: Include nts.yml
+  ansible.builtin.include: nts.yml
+  when: etc_enable_NTS | bool
+
+- name: Include firewalld.yml
+  ansible.builtin.include: firewalld.yml
+  when: etc_configure_firewalld | bool
+
+- name: Include sysctl.yml
+  ansible.builtin.include: sysctl.yml
+  when: etc_configure_sysctl | bool

roles/etc/tasks/nts.yml

@@ -0,0 +1,7 @@
+---
+- name: Enable NTS
+  ansible.builtin.template:
+    src: chrony.conf.j2
+    dest: /etc/chrony.conf
+  become: yes
+  notify: Restart chronyd

roles/etc/tasks/sysctl.yml

@@ -0,0 +1,10 @@
+---
+- name: Configure sysctl
+  ansible.posix.sysctl:
+    name: "{{ item.key }}"
+    value: "{{ item.value.value }}"
+    state: "{{ item.value.state }}"
+    sysctl_file: "/etc/sysctl.d/100-custom.conf"
+    sysctl_set: yes
+  become: yes
+  loop: "{{ lookup('dict', etc_sysctl_params, wantlist=True) }}"

roles/etc/tasks/users.yml

@@ -0,0 +1,7 @@
+---
+- name: Update users
+  ansible.builtin.user:
+    name: "{{ item.key }}"
+    shell: "{{ item.value.shell }}"
+  become: yes
+  loop: "{{ lookup('dict', etc_users, wantlist=True) }}"

roles/etc/templates/chrony.conf.j2

@@ -0,0 +1,50 @@
+# Use public servers from the pool.ntp.org project.
+# Please consider joining the pool (https://www.pool.ntp.org/join.html).
+server time.cloudflare.com iburst nts
+
+# Use NTP servers from DHCP.
+#sourcedir /run/chrony-dhcp
+
+# Record the rate at which the system clock gains/losses time.
+driftfile /var/lib/chrony/drift
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on all interfaces that support it.
+#hwtimestamp *
+
+# Increase the minimum number of selectable sources required to adjust
+# the system clock.
+#minsources 2
+
+# Allow NTP client access from local network.
+#allow 192.168.0.0/16
+
+# Serve time even if not synchronized to a time source.
+#local stratum 10
+
+# Require authentication (nts or key option) for all NTP sources.
+#authselectmode require
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+#leapsecmode slew
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz right/UTC
+
+# Specify directory for log files.
+logdir /var/log/chrony
+
+# Select which information is logged.
+#log measurements statistics tracking