Adding etc, flatpak and rpm-ostree role

roles/etc/defaults/main.yml

@@ -0,0 +1,12 @@
+---
+etc_set_hostname: true
+etc_enable_BLSCFG: true
+etc_update_users: true
+etc_enable_NTS: true
+etc_configure_firewalld: true
+etc_configure_sysctl: true
+
+etc_sysctl_params:
+  kernel.unprivileged_bpf_disabled:
+    value: 1
+    state: present

roles/etc/handlers/main.yml

@@ -0,0 +1,6 @@
+- name: Restart chronyd
+  ansible.builtin.systemd:
+    name: chronyd
+    state: restarted
+    enabled: yes
+  become: yes

roles/etc/tasks/blscfg.yml

@@ -0,0 +1,16 @@
+---
+- name: Check if BootLoaderSpec is enabled
+  ansible.builtin.lineinfile:
+    path: /etc/default/grub
+    line: 'GRUB_ENABLE_BLSCFG=true'
+    #regexp: '^GRUB_ENABLE_BLSCFG=[tT]rue'
+    state: present
+  check_mode: yes
+  register: conf
+
+- name: Enable BootLoaderSpec
+  ansible.builtin.command:
+    cmd: grub2-switch-to-blscfg
+  become: yes
+  when:
+    - conf.changed != false

roles/etc/tasks/firewalld.yml

@@ -0,0 +1,10 @@
+---
+- name: Configure firewalld
+  ansible.posix.firewalld:
+    service: "{{ item.key }}"
+    zone: "{{ item.value.zone }}"
+    state: "{{ item.value.state }}"
+    immediate: yes
+    permanent: yes
+  become: yes
+  loop: "{{ lookup('dict', etc_firewalld, wantlist=True) }}"

roles/etc/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Set hostname
+  ansible.builtin.hostname:
+    name: "{{ etc_hostname }}"
+    use: systemd
+  become: yes
+  when: etc_set_hostname | bool
+
+- name: Include users.yml
+  ansible.builtin.include: users.yml
+  when:  etc_update_users | bool
+
+- name: Include blscfg.yml
+  ansible.builtin.include: blscfg.yml
+  when: etc_enable_BLSCFG | bool
+
+- name: Include nts.yml
+  ansible.builtin.include: nts.yml
+  when: etc_enable_NTS | bool
+
+- name: Include firewalld.yml
+  ansible.builtin.include: firewalld.yml
+  when: etc_configure_firewalld | bool
+
+- name: Include sysctl.yml
+  ansible.builtin.include: sysctl.yml
+  when: etc_configure_sysctl | bool

roles/etc/tasks/nts.yml

@@ -0,0 +1,7 @@
+---
+- name: Enable NTS
+  ansible.builtin.template:
+    src: chrony.conf.j2
+    dest: /etc/chrony.conf
+  become: yes
+  notify: Restart chronyd

roles/etc/tasks/sysctl.yml

@@ -0,0 +1,10 @@
+---
+- name: Configure sysctl
+  ansible.posix.sysctl:
+    name: "{{ item.key }}"
+    value: "{{ item.value.value }}"
+    state: "{{ item.value.state }}"
+    sysctl_file: "/etc/sysctl.d/100-custom.conf"
+    sysctl_set: yes
+  become: yes
+  loop: "{{ lookup('dict', etc_sysctl_params, wantlist=True) }}"

roles/etc/tasks/users.yml

@@ -0,0 +1,7 @@
+---
+- name: Update users
+  ansible.builtin.user:
+    name: "{{ item.key }}"
+    shell: "{{ item.value.shell }}"
+  become: yes
+  loop: "{{ lookup('dict', etc_users, wantlist=True) }}"

roles/etc/templates/chrony.conf.j2

@@ -0,0 +1,50 @@
+# Use public servers from the pool.ntp.org project.
+# Please consider joining the pool (https://www.pool.ntp.org/join.html).
+server time.cloudflare.com iburst nts
+
+# Use NTP servers from DHCP.
+#sourcedir /run/chrony-dhcp
+
+# Record the rate at which the system clock gains/losses time.
+driftfile /var/lib/chrony/drift
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on all interfaces that support it.
+#hwtimestamp *
+
+# Increase the minimum number of selectable sources required to adjust
+# the system clock.
+#minsources 2
+
+# Allow NTP client access from local network.
+#allow 192.168.0.0/16
+
+# Serve time even if not synchronized to a time source.
+#local stratum 10
+
+# Require authentication (nts or key option) for all NTP sources.
+#authselectmode require
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+#leapsecmode slew
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz right/UTC
+
+# Specify directory for log files.
+logdir /var/log/chrony
+
+# Select which information is logged.
+#log measurements statistics tracking

roles/flatpak/defaults/main.yml

@@ -0,0 +1,13 @@
+---
+flatpak_configure_remotes: true
+flatpak_alter_flatpaks: true
+
+flatpak_remotes:
+  flathub:
+    state: present
+    url: https://flathub.org/repo/flathub.flatpakrepo
+
+flatpak_flatpaks:
+  com.github.tchx84.Flatseal:
+    state: present
+    remote: flathub

roles/flatpak/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+- name: Add/remove Flatpak remotes
+  community.general.flatpak_remote:
+    name: "{{ item.key }}"
+    state: "{{ item.value.state }}"
+    flatpakrepo_url: "{{ item.value.url }}"
+  become: true
+  loop: "{{ lookup('dict', flatpak_remotes ) }}"
+  when: flatpak_configure_remotes | bool
+
+- name: Add/remove Flatpaks
+  community.general.flatpak:
+    name: "{{ item.key }}"
+    state: "{{ item.value.state }}"
+    remote: "{{ item.value.remote }}"
+  loop: "{{ lookup('dict', flatpak_flatpaks) }}"
+  when: flatpak_alter_flatpaks | bool

roles/rpm-ostree/defaults/main.yml

@@ -0,0 +1,5 @@
+---
+rpm_ostree_alter_base_packages: true
+rpm_ostree_alter_layered_packages: true
+rpm_ostree_configure_kargs: true
+rpm_ostree_enable_autoupdates: true

roles/rpm-ostree/handlers/main.yml

@@ -0,0 +1,15 @@
+---
+- name: Reload rpm-ostree configuration
+  ansible.builtin.command:
+    cmd: rpm-ostree reload
+  become: yes
+  
+- name: Enable rpm-ostree-automatic
+  ansible.builtin.systemd:
+    name: rpm-ostreed-automatic.timer
+    state: started
+    enabled: yes
+
+- name: Reload systemd units
+  ansible.builtin.systemd:
+    daemon_reload: yes

roles/rpm-ostree/tasks/main.yml

@@ -0,0 +1,63 @@
+---
+- name: Remove base packages
+  ansible.builtin.shell:
+    cmd: rpm-ostree override remove "{{ item.key }}" || /bin/true
+  register: result
+  become: yes
+  changed_when: '"Run \"systemctl reboot\" to start a reboot" in result.stdout'
+  loop: "{{ lookup('dict', rpm_ostree_base_packages) }}"
+  when:
+    - item.value.state == 'absent'
+    - rpm_ostree_alter_base_packages | bool
+
+- name: Reset base packages
+  ansible.builtin.shell:
+    cmd: rpm-ostree override reset "{{ item.key }}" || /bin/true
+  register: result
+  become: yes
+  changed_when: '"Run \"systemctl reboot\" to start a reboot" in result.stdout'
+  loop: "{{ lookup('dict', rpm_ostree_base_packages) }}"
+  when:
+    - item.value.state == 'present'
+    - rpm_ostree_alter_base_packages | bool
+
+- name: Set kernel parameters
+  ansible.builtin.command:
+    cmd: rpm-ostree kargs --append-if-missing="{{ item.key }}"
+  register: result
+  become: yes
+  changed_when: '"Kernel arguments updated" in result.stdout'
+  loop: "{{ lookup('dict', rpm_ostree_kargs) }}"
+  when:
+    - item.value.state == 'present'
+    - rpm_ostree_configure_kargs | bool
+
+- name: Remove kernel parameters
+  ansible.builtin.command:
+    cmd: rpm-ostree kargs --delete-if-present="{{ item.key }}"
+  register: result
+  become: yes
+  changed_when: '"Kernel arguments updated" in result.stdout'
+  loop: "{{ lookup('dict', rpm_ostree_kargs) }}"
+  when:
+    - item.value.state == 'absent'
+    - rpm_ostree_configure_kargs | bool
+
+- name: Enable autostaging and autoupdates
+  ansible.builtin.replace:
+    path: /etc/rpm-ostreed.conf
+    regexp: '^#AutomaticUpdatePolicy=none'
+    replace: 'AutomaticUpdatePolicy=stage'
+  become: yes
+  notify:
+    - Reload rpm-ostree configuration
+    - Enable rpm-ostree-automatic
+  when: rpm_ostree_enable_autoupdates | bool
+
+- name: Add/remove layered packages
+  community.general.rpm_ostree_pkg:
+    name: "{{ item.key }}"
+    state: "{{ item.value.state }}"
+  become: yes
+  loop: "{{ lookup('dict', rpm_ostree_layered_packages, wantlist=True) }}"
+  when: rpm_ostree_alter_layered_packages | bool