{"id":20642334,"url":"https://github.com/komachi/ansible-decent-desktop","last_synced_at":"2025-10-22T03:07:19.992Z","repository":{"id":148082466,"uuid":"273764281","full_name":"komachi/ansible-decent-desktop","owner":"komachi","description":"Ansible playbook to provide decent desktop experience","archived":false,"fork":false,"pushed_at":"2025-03-29T12:05:31.000Z","size":690,"stargazers_count":13,"open_issues_count":6,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-10-22T03:02:47.449Z","etag":null,"topics":["ansible","ansible-playbook","desktop","playbook","security"],"latest_commit_sha":null,"homepage":"","language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/komachi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2020-06-20T18:36:08.000Z","updated_at":"2025-03-29T12:05:35.000Z","dependencies_parsed_at":null,"dependency_job_id":"f66b256d-28d0-4240-b8fa-57a115820fb2","html_url":"https://github.com/komachi/ansible-decent-desktop","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/komachi/ansible-decent-desktop","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komachi%2Fansible-decent-desktop","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komachi%2Fansible-decent-desktop/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komachi%2Fansible-decent-desktop/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komachi%2Fansible-decent-desktop/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/komachi","download_url":"https://codeload.github.com/komachi/ansible-decent-desktop/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komachi%2Fansible-decent-desktop/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":280371099,"owners_count":26319362,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-22T02:00:06.515Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-playbook","desktop","playbook","security"],"created_at":"2024-11-16T16:08:47.729Z","updated_at":"2025-10-22T03:07:19.950Z","avatar_url":"https://github.com/komachi.png","language":"Jinja","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ansible-decent-desktop\n\nThis is an experiment to make desktop/laptop configuration fully controllable by Ansible. Also to experiment with GNU/Linux-based web-3/dapp/defi/security-first/insert-your-buzzword-here setup. Also because it's a lot of work to configure everything each time. Also because I can.\n\nThis project is not intended to fulfil desires of every user. I use it to provision my own personal PC. You probably find some defaults incompatible with your view on desktop OS configuration, but you can fork and tune it for yourself, or just look at playbooks for inspirations. PRs with improvements welcomed btw.\n\nThis playbook meant to be run against Debian bookworm. It probably won't work for other distros/versions, but you can try.\n\nIt focus both on security and speed when it's possible. It uses lightweight software when possible and some specific tuning to meet the goal. Take note that while this README uses word \"security\" several times, nobody checked this. Think then do.\n\nIt enables autologin and intended to use only on single-user desktop machines. Use it only with full-disk encryption and if you are single user. Not only for that reason, the whole playbook is meant to be deployed on a single-user desktop machine.\n\n## Software included\n\nYou should look for sources for full list, but here are some choices I made:\n\n- OS: [Debian GNU/Linux](https://debian.org), stable (current bookworm)\n- Shell: [bash](https://www.gnu.org/software/bash/)\n- Init: [systemd](https://systemd.io)\n- MAC: [AppArmor](https://apparmor.net/), [bubblewrap](https://github.com/containers/bubblewrap) used for [Flatpak](https://flatpak.org/)-packed apps. Sister project [apparmor-even-more-profiles](https://github.com/komachi/apparmor-even-more-profiles) deployed by default, bringing profiles for most of included software in enforce mode.\n- VPN client: [Wireguard](https://wireguard.com)\n- Firewall: [nftables](https://netfilter.org/projects/nftables/) + [OpenSnitch](https://github.com/evilsocket/opensnitch)\n- Display server: [Wayland](https://wayland.freedesktop.org/)\n- Audio/video server: [PipeWire](https://pipewire.org)\n- Display manager: we don't need one, it can be replaced with single systemd unit\n- Window manager: [sway](https://swaywm.org/)\n- Notification daemon: [mako](https://wayland.emersion.fr/mako)\n- Bar: [waybar](https://github.com/Alexays/Waybar)\n- Applications launcher: [wofi](https://hg.sr.ht/~scoopta/wofi)\n- URI opener: [jaro](https://github.com/isamert/jaro)\n- Terminal emulator: [foot](https://codeberg.org/dnkl/foot)\n- Network configuration: [NetworkManager](https://wiki.gnome.org/Projects/NetworkManager)\n- DNS server: [stubby](https://github.com/getdnsapi/stubby) + [unbound](https://github.com/NLnetLabs/unbound) with DNS blocklists enabled\n- Media player: [mpv](https://mpv.io)\n- File manager: [PCManFM](https://en.wikipedia.org/wiki/PCMan_File_Manager) and [nnn](https://github.com/jarun/nnn) are available\n- [FreeTube](https://freetubeapp.io/) as alternative less privacy-invasing YouTube frontend, also [yt-dlp](https://github.com/yt-dlp/yt-dlp) configured to be used with mpv\n- Music player: [mpd](https://musicpd.org/) + [ymuse](https://yktoo.com/en/software/ymuse/)\n- Browser: [Firefox](https://mozilla.org/firefox), but [Chromium](https://chromium.org) also available and used for webapps\n- Email client: [Thunderbird](https://www.thunderbird.net)\n- Source code editor: [VSCodium](https://github.com/VSCodium/vscodium) with extensions from [Open VSX](https://open-vsx.org)\n- File sync: [Syncthing](https://syncthing.net/)\n- Download managers: [aria2](https://github.com/aria2/aria2), [qBittorrent](https://qbittorrent.org) for [BitTorent](https://www.bittorrent.org), [Nicotine+](https://nicotine-plus.org/) for [Soulseek](https://slsknet.org)\n- Some cryptocurrency wallets: [Monero](https://www.getmonero.org/) fullnode, [Electrum](https://electrum.org) and [Wasabi Wallet](https://www.wasabiwallet.io/) for [Bitcoin](https://bitcoin.org/) network, [Electron Cash](https://electroncash.org/) for [Bitcoin Cash](https://bitcoincash.org/), [MyCrypto](https://www.mycrypto.com/) for [Ethereum](https://ethereum.org), [Zecwallet Lite](https://www.zecwallet.co/) for [Zcash](https://z.cash/), [Electrum Dash](https://electrum.dash.org/) for [Dash](https://dash.org/), [Bisq](https://bisq.network/) and [Uniswap](https://uniswap.org/) as DEX\n- Support for [Ledger](https://www.ledger.com/), [Trezor](https://trezor.io/), [Nitrokey](https://www.nitrokey.com/), and [OnlyKey](https://onlykey.io/) hardware tokens\n- [I2P](https://geti2p.net/), [Tor](https://torproject.org), [IPFS](https://ipfs.io/), etc.\n- Office packages: [zathura](https://pwmt.org/projects/zathura/) + [zaread](https://github.com/paoloap/zaread) for simple document viewing and [LibreOffice](https://www.libreoffice.org/) for classical office package editing needs\n- Image viewer: [imv](https://github.com/eXeC64/imv)\n- Password manager: [KeePassXC](https://keepassxc.org/)\n- [DeltaChat](https://delta.chat), XMPP ([Dino](https://dino.im/)), [Telegram](https://telegram.org), [Jami](https://jami.net), Matrix ([nheko](https://nheko-reborn.github.io)), [Mumble](https://www.mumble.info), [SimpleX](https://simplex.chat) messengers\n- Local maps with [Organic Maps](https://organicmaps.app/).\n- Local dicts with [dictd](https://sourceforge.net/projects/dict/) and [GoldenDict](http://goldendict.org/)\n- Virtual machines: [libvirt](https://libvirt.org/) + [QEMU](https://www.qemu.org/) + [virt-manager](https://virt-manager.org/)\n- [podman](https://podman.io) + [gvisor](https://gvisor.dev/) by default for launching [OCI containers](https://opencontainers.org), [Docker](https://www.docker.com/) also installed.\n- [JOSM](https://josm.openstreetmap.de/) for OpenStreetMap editing\n- [node.js](https://nodejs.org), [golang](https://golang.org/), [python](https://python.org), etc. dev env.\n- et cetera, et cetera\n\n## Roles\n\n`main.yml` includes it all.\n\nPlaybook also depends on some roles defined in submodules, so you should also consult related upstream docs.\n\n### remote_keyring\n\nInstall some additional keyrings.\n\n### apt_transport_tor\n\nEnable and enforce apt-transport-tor.\n\n### boot_manager\n\nConfigure boot manager.\n\n### audio\n\nConfigure audio settings.\n\n### logind\n\nConfigure logind.\n\n### additional_locales\n\nSets some additional locale settings not supported by debops.\n\n### networking\n\nConfigure networking.\n\n### mullvad\n\nConfigure mullvad VPN.\n\n### firewall\n\nConfigure nftables.\n\n### dm\n\nConfigure our dm replacement.\n\n### de\n\nConfigure window manager and other goodies usually provided by desktop environment.\n\n### packages\n\nConfigure specific packages. Most of packages configured here.\n\n### games\n\nInstall and configure some games.\n\n### themes\n\nConfigure themes.\n\n### fonts\n\nConfigure fonts.\n\n### hardware\n\nConfigure hardware.\n\n### timezone\n\nSet timezone.\n\n### apparmor_profiles\n\nInstall additional apparmor profiles\n\n## Desktop and security improvements\n\nThis playbook meant to be used on desktops, so there is specific desktop-friendly settings made. Most of packages are also configured specifically to address security or speed, but here is some things to note\n\n- [Silent boot](https://wiki.archlinux.org/index.php/Silent_boot) is enabled\n- [Watchdog](https://wiki.archlinux.org/title/Improving_performance#Watchdogs) is disabled\n- [oomd](https://github.com/facebookincubator/oomd) is installed\n- [zswap](https://en.wikipedia.org/wiki/Zswap) is enabled\n- [gamemode](https://github.com/FeralInteractive/gamemode) is installed\n- [VFS cache](https://docs.kernel.org/filesystems/vfs.html) pressure is set to 50, [vm.dirty_ratio](https://docs.kernel.org/admin-guide/sysctl/vm.html) is configured to a lower value\n- [TCP Fast Open](https://en.wikipedia.org/wiki/TCP_Fast_Open) is enabled for both sides\n- [cfs-zen-tweaks](https://github.com/igo95862/cfs-zen-tweaks) is installed\n- [Core dumps](https://en.wikipedia.org/wiki/Core_dump) are disabled\n- Ansible comes with [Redis cache](https://docs.ansible.com/ansible/latest/collections/community/general/redis_cache.html) and [mitogen](https://mitogen.networkgenomics.com/ansible_detailed.html)\n- Analytics are opted-outed [with env list](/roles/de/files/environment.d/optout.conf)\n- [tirdad](https://github.com/0xsirus/tirdad) is installed\n- [kloak](https://github.com/vmonaco/kloak) is installed\n- Some kernel modules are disabled according to [GrapheneOS list](https://github.com/GrapheneOS/infrastructure/blob/main/modprobe.d/local.conf)\n- [Recommended settings from Linux Kernel Self-Protection Project](https://kspp.github.io/Recommended_Settings) are used\n- Playbooks `os_hardening` and `ssh_hardening` from [DevSec Hardening Framework](https://dev-sec.io/) are applied\n\n## Test in VM\n\nIt can be run in VirtualBox with help of Vagrant and Molecule.\n\n```\npoetry install\npoetry run molecule converge\n```\n\n## Lint\n\n```\nsh lint.sh\n```\n\n## Run locally\n\n```\nsudo apt install git python3-poetry\ncd $(mktemp -d)\ngit clone https://github.com/komachi/ansible-decent-desktop.git\ncd ansible-decent-desktop\nsh run.sh\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkomachi%2Fansible-decent-desktop","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkomachi%2Fansible-decent-desktop","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkomachi%2Fansible-decent-desktop/lists"}