main.yml

---
- name: Ansible-decent-desktop
  hosts: all
  become: true
  gather_facts: true
  roles:
    - role: debops.debops.apt_preferences
      tags:
        - repos
    - role: debops.debops.extrepo
      tags:
        - repos
    - role: debops.debops.apt_install
      tags:
        - packages
    # TODO enable and move to systemd-boot
    # - boot_manager
    - role: debops.debops.grub
      tags:
        - boot
    - role: debops.debops.apt
      tags:
        - repos
    - role: debops.debops.unattended_upgrades
      tags:
        - unattended-upgrades
    - role: debops.debops.libuser
      tags:
        - users
    - role: debops.debops.users
      tags:
        - users
    - role: debops.debops.system_groups
      tags:
        - users
        - groups
    - role: debops.debops.locales
      tags:
        - locale
    - role: additional_locales
      tags:
        - locale
    - role: dm
      tags:
        - dm
    - debops.debops.sysctl
    - role: debops.debops.secret
      vars:
        secret__directories:
          - sysfs/dependent_config/{{ inventory_hostname }}
    - debops.debops.sysfs
    - role: devsec.hardening.ssh_hardening
      tags:
        - hardering
    - logind
    - role: debops.debops.journald
      tags:
        - logs
    - role: debops.debops.logrotate
      tags:
        - logs
    - role: networking
      tags:
        - networking
    - role: mullvad
      when: mullvad_account is defined and mullvad_account != ''
      tags:
        - mullvad
    - role: audio
      tags:
        - audio
    # - role: firewall
    #   tags:
    #     - firewall
    - role: timezone
      tags:
        - time
    - role: debops.debops.ntp
      tags:
        - time
    - role: de
      tags:
        - de
    - role: packages
      tags:
        - packages
    - debops.debops.kmod
    - role: debops.debops.python
      tags:
        - python
    - role: themes
      tags:
        - theme
    - role: fonts
      tags:
        - fonts
    - role: hardware
      tags:
        - hardware
    - gantsign.keyboard
    - role: apparmor_profiles
      tags:
        - hardering
        - apparmor
    - role: games
      tags:
        - games
    - role: devsec.hardening.os_hardening
      tags:
        - hardering
  vars:
    large_dirs: /home/{{ username }}
    local_ip: 192.168.0.0/16
    architecture_map:
      x86_64: amd64
      armv7l: armhf
      aarch64: arm64
    nonfree_firmware: true
    tor_browser_user_agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0
    timezone: Etc/UTC
    # gantsign.keyboard vars
    keyboard_model: pc105
    keyboard_layout: us,ru
    keyboard_options: grp:caps_toggle,compose:ralt,grp_led:scroll
    # dev-sec vars
    sysctl_overwrite:
      net.ipv6.conf.all.disable_ipv6: 0
      net.ipv4.ip_forward: 1
      kernel.unprivileged_userns_clone: 1
      net.ipv4.conf.all.log_martians: 0
      net.ipv4.conf.default.log_martians: 0
      # https://kspp.github.io/Recommended_Settings#sysctls
      kernel.dmesg_restrict: 1
      kernel.yama.ptrace_scope: 3
      net.core.bpf_jit_harden: 2
      vm.unprivileged_userfaultfd: 0
      fs.protected_fifos: 2
      dev.tty.legacy_tiocsti: 0
      dev.tty.ldisc_autoload: 0
      kernel.unprivileged_bpf_disabled: 1

    os_auth_retries: 10
    os_filesystem_whitelist:
      - squashfs
    os_desktop_enable: true
    ufw_manage_defaults: false
    ssh_server_enabled: false
    ssh_server_hardening: false
    ssh_use_dns: true
    ssh_client_hardening: true
    ssh_client_password_login: true
    os_auditd_enabled: false
    hidepid_option: 0
    # debops vars
    extrepo__packages:
      - tor
      - apt-transport-tor
      - extrepo-offline-data
    extrepo__sources:
      - fasttrack_backports
      - josm
      - node_21.x
      - yarnpkg
      - whonix
      - kicksecure
      - waydroid
      - vscodium
    extrepo__configuration:
      - name: policies
        config:
          enabled_policies: [main]
    sysfs__enabled: true
    ntp__daemon_enabled: true
    ntp__daemon: chrony
    ntp__timezone: "{{ timezone }}"
    journald__configuration:
      - name: SystemMaxUse
        value: 500M
        state: present
      - name: SystemKeepFree
        value: 3G
        state: present
      - name: SystemMaxFiles
        value: 10
        state: present
      - name: MaxFileSec
        value: 3day
        state: present
    logrotate__config:
      - state: present
        options: |
          daily
          rotate 2
          create
          compress
          maxage 3
          shred
          tabooext + .dpkg-divert
          include /etc/logrotate.d
    system_groups__list:
      - name: console
        members: "{{ username }}"
    users__accounts:
      - name: "{{ username }}"
        group: "{{ username }}"
        groups:
          - cdrom
          - floppy
          - sudo
          - audio
          - video
          - plugdev
          - netdev
          - lpadmin
          - console
          - wireshark
          - debian-tor
          - docker
        shell: /bin/bash
    packages:
      - tirdad
      - kloak
      - micro
      - bat
      - lsd
      - duf
      - tldr
      - flatpak
      - systemd
      - systemd-sysv
      - jitterentropy-rngd
      - whois
      - plocate
      - jq
      - pavucontrol
      - ffmpeg
      - git
      - htop
      - curl
      - wget
      - openssh-client
      - unar
      - suckless-tools
      - libavcodec-extra
      - gstreamer1.0-libav
      - gstreamer1.0-vaapi
      - gstreamer1.0-plugins-base
      - gstreamer1.0-plugins-good
      - gstreamer1.0-plugins-bad
      - gstreamer1.0-plugins-ugly
      - ripgrep
      - dnsutils
      - udevil
      - gvfs
      - gvfs-backends
      - imv
      - pngquant
      - optipng
      - jpegoptim
      - mat2
      - nnn
      - g++
      - gcc
      - make
      - needrestart
      - lm-sensors
      - shellcheck
      - wireshark
      - devscripts
      - build-essential
      - debhelper
      - secure-delete
      - command-not-found
      - apt-file
      - direnv
      - libvips-tools
      - p7zip-full
      - openclipart-svg
      - v4l2loopback-dkms
      - timidity
      - fluid-soundfont-gm
      - mate-polkit
    apt_install__all_packages:
      - "{{ packages }}"
    apt_preferences__list:
      - packages:
          - yt-dlp
          - streamlink
          - python3-streamlink
          - runsc
          - telegram-desktop
          - scrcpy
          - scrcpy-*
          - dino-im
          - dino-im-*
          - bubblewrap
          - flatpak
          - flatpak-*
          - libflatpak-*
          - libflatpak0
          - xdg-desktop-portal
          - xdg-desktop-portal-*
          - josm
          - josm-*
          - jmapviewer
          # libreoffice
          - uno-libs-private
          - ure
          - ure-java
          - liblibreoffice-*
          - libunoloader-java
          - python3-uno
          - libreoffice-*
          - libofficebean-java
          - libuno-*
          - 0ad
          - 0ad-*
          - syncthing
          - syncthing-*
          - persepolis
          # backported kernel
          - linux-compiler-gcc-*
          - linux-headers-*
          - linux-image-*
          - linux-kbuild-*
          - linux-config-*
          - linux-doc-*
          - kernel-image-*
          - linux-doc
          - linux-libc-dev
          # systemd
          - systemd
          - systemd-*
          - libnss-systemd
          - libpam-systemd
          - libsystemd-*
          - libsystemd0
          - dbus-broker
          - init-system-helpers
          # pipewire
          - pipewire
          - wireplumber
          - libpipewire-*
          - libwireplumber-*
          - pipewire-*
          - libspa-0.2-*
          - wireplumber-*
          - easyeffects
          - sqlcipher
          - golang
          - golang-*
          - tlp
          - tlp-*
          - smartmontools
          - glab
          - firmware-*
          # wayland
          - wayland-protocols
          - libwayland-*
          - electrum
          - python3-electrum

        suffix: _backports
        backports: [bookworm]
      - "{{ apt_preferences__preset_list | list }}"
      - suffix: _tor
        raw: |
          Explanation: Prefer official tor packages
          Package: tor deb.torproject.org-keyring tor-dbgsym tor-geoipdb
          Pin: release o=TorProject,n={{ ansible_distribution_release }}
          Pin-Priority: 600
      - suffix: _nodejs
        raw: |
          Explanation: Prefer nodesource packages
          Package: nodejs nsolid
          Pin: release a=nodistro,n=nodistro
          Pin-Priority: 600
      - suffix: _yarn
        raw: |
          Explanation: Prefer official yarn package
          Package: yarn
          Pin: release o=yarn
          Pin-Priority: 600
      - suffix: _josm
        raw: |
          Explanation: Prefer official josm packages
          Package: josm josm-latest
          Pin: release n=alldist
          Pin-Priority: 600
    apt_install__default_alternatives: []
    apt__install_recommends: false
    apt__install_suggests: false
    apt__configuration:
      - name: seccomp
        filename: 01-seccomp.conf
        comment: Enable seccomp sanboxing
        raw: |
          APT::Sandbox::Seccomp "true";
        state: present
    apt__repositories:
      - repo: deb https://deb.debian.org/debian {{ ansible_distribution_release }} main contrib non-free
        state: absent
      - repo: deb https://deb.debian.org/debian {{ ansible_distribution_release }} main contrib non-free non-free-firmware
        state: absent
      - repo: deb https://deb.debian.org/debian {{ ansible_distribution_release }}-updates main contrib non-free
        state: absent
      - repo: deb https://deb.debian.org/debian {{ ansible_distribution_release }}-updates main contrib non-free non-free-firmware
        state: absent
      - repo: deb https://deb.debian.org/debian {{ ansible_distribution_release }}-backports main contrib non-free
        state: absent
      - repo: deb https://deb.debian.org/debian {{ ansible_distribution_release }}-backports main contrib non-free non-free-firmware
        state: absent
      - repo: deb https://security.debian.org/debian-security {{ ansible_distribution_release }} main contrib non-free
        state: absent
      - repo: deb https://security.debian.org/debian-security {{ ansible_distribution_release }} main contrib non-free non-free-firmware
        state: absent
      - repo: deb https://security.debian.org/debian-security {{ ansible_distribution_release }}-updates main contrib non-free
        state: absent
      - repo: deb https://security.debian.org/debian-security {{ ansible_distribution_release }}-updates main contrib non-free non-free-firmware
        state: absent
      - repo: deb https://security.debian.org/debian-security {{ ansible_distribution_release }}-backports main contrib non-free
        state: absent
      - repo: deb https://security.debian.org/debian-security {{ ansible_distribution_release }}-backports main contrib non-free non-free-firmware
        state: absent
      - repo: deb http://deb.debian.org/debian {{ ansible_distribution_release }} main contrib non-free
        state: absent
      - repo: deb http://deb.debian.org/debian {{ ansible_distribution_release }}-updates main contrib non-free
        state: absent
      - repo: deb http://deb.debian.org/debian {{ ansible_distribution_release }}-backports main contrib non-free
        state: absent
      - repo: deb http://security.debian.org/debian-security {{ ansible_distribution_release }} main contrib non-free
        state: absent
      - repo: deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-updates main contrib non-free
        state: absent
      - repo: deb http://security.debian.org/debian-security {{ ansible_distribution_release }}-backports main contrib non-free
        state: absent
    apt__default_sources:
      - uri: tor+http://2s4yqjx5ul6okpp3f2gaunr2syex5jgbfpfvhxxbbjwnrsvbk5v3qbid.onion/debian
        comment: '{{ "Official " + apt__distribution + " repositories" }}'
        distribution: Debian
        state: present
    apt__security_sources:
      - uri: tor+http://5ajw6aqf3ep7sijnscdzw77t7xq4xjpsy335yb2wiwgouo7yfxtjlmid.onion/debian-security
        comment: Debian Security repository
        type: "{{ apt__source_types }}"
        suite: '{{ ansible_distribution_release + "-security" }}'
        components: "{{ apt__distribution_components }}"
        distribution: Debian
        state: present
    apt__nonfree: true
    apparmor__mail_to: false
    sysctl__parameters:
      - name: virtual_memory
        comment: https://wiki.archlinux.org/index.php/Sysctl#Virtual_memory
        options:
          - vm.dirty_ratio: 3
          - vm.dirty_background_ratio: 2
          - vm.swappiness: 5
          - vm.vfs_cache_pressure: 50
      - name: inotify
        options:
          - fs.inotify.max_user_watches: 4194304
          - fs.inotify.max_user_instances: 8192
      - name: net
        options:
          - net.core.netdev_max_backlog: 16384
          - net.core.somaxconn: 8192
          - net.ipv4.tcp_fastopen: 3
    python__v3: true
    python__v2: false
    python__packages3:
      - python3-dev
      - python-is-python3
      - python3-pip
      - python3-setuptools
    locales__list:
      - ru_RU.UTF-8
      - en_DK.UTF-8
    locales__packages:
      - localepurge
      - mythes-en-us
      - mythes-ru
      - hunspell-en-us
      - hunspell-ru
      - myspell-ru
      - hyphen-en-us
      - hyphen-ru
      - irussian
      - iamerican
      - iamerican-large
      - aspell-ru
      - enchant-2
    locales__system_lang: en_US.UTF-8
    kmod__load:
      - name: tun
    kmod__modules:
      # https://github.com/GrapheneOS/infrastructure/blob/main/modprobe.d/local.conf
      - name: cdrom
        state: blacklist
      - name: floppy
        state: blacklist
      - name: intel_agp
        state: blacklist
      - name: ip_tables
        state: blacklist
      - name: pcspkr
        state: blacklist
      - name: snd_intel8x0
        state: blacklist
      - name: sr_mod
        state: blacklist
      - name: tls
        state: blacklist
      - name: virtio_balloon
        state: blacklist
      - name: virtio_console
        state: blacklist
    grub__timeout_hardware: 1
    grub__timeout_virtual: 1
    grub__configuration:
      - name: cmdline_linux_default
        value:
          # silent boot
          # https://wiki.archlinux.org/index.php/Silent_boot
          - quiet
          - loglevel=3
          - rd.systemd.show_status=auto
          - rd.udev.log_level=3
          - vt.global_cursor_default=0
          - debugfs=on
          # zswap
          - zswap.enabled=1
          - zswap.compressor=zstd
          - zswap.max_pool_percent=15
          # apparmor
          - apparmor=1
          - security=apparmor
          # disable watchdog
          - nowatchdog
          - modprobe.blacklist=iTCO_wdt
          - modprobe.blacklist=iTCO_vendor_support
          - nmi_watchdog=0
          # disable sss
          - libahci.ignore_sss=1
          # required by oomd
          - swapaccount=1
          - systemd.unified_cgroup_hierarchy=1
          # https://kspp.github.io/Recommended_Settings#kernel-command-line-options
          - randomize_kstack_offset=on
          - init_on_alloc=1
          - init_on_free=1
          - hardened_usercopy=1
          - page_alloc.shuffle=1
          - slab_nomerge
          - pti=on
          - iommu=force
          - iommu.passthrough=0
          - iommu.strict=1
          - mitigations=auto,nosmt
          - kfence.sample_interval=100
          - vsyscall=none
          - vdso32=0
          # - cfi=kcfi
          # https://github.com/Kicksecure/security-misc/blob/master/etc/default/grub.d/40_kernel_hardening.cfg
          - random.trust_bootloader=off
          - random.trust_cpu=off
          - extra_latent_entropy