This is an experiment to make desktop/laptop configuration fully controllable by Ansible. Also to experiment with GNU/Linux-based web-3/dapp/defi/security-first/insert-your-buzzword-here setup. Also because it's a lot of work to configure everything each time. Also because I can.
This project is not intended to fulfil desires of every user. I use it to provision my own personal PC. You probably find some defaults incompatible with your view on desktop OS configuration, but you can fork and tune it for yourself, or just look at playbooks for inspirations. PRs with improvements welcomed btw.
This playbook meant to be run against Debian bullseye. It probably won't work for other distros/versions, but you can try.
It focus both on security and speed when it's possible. It uses lightweight software when possible and some specific tuning to meet the goal. Take note that while this README uses word "security" several times, nobody checked this. Think then do.
It enables autologin and intended to use only on single-user desktop machines. Use it only with full-disk encryption and if you are single user. Not only for that reason, the whole playbook is meant to be deployed on a single-user desktop machine.
You should look for sources for full list, but here are some choices I made:
main.yml
includes it all.
Playbook also depends on some roles defined in submodules, so you should also consult related upstream docs.
Install some additional keyrings.
Enable and enforce apt-transport-tor.
Configure boot manager.
Configure audio settings.
Configure logind.
Sets some additional locale settings not supported by debops.
Configure networking.
Configure mullvad VPN.
Configure nftables.
Configure our dm replacement.
Configure window manager and other goodies usually provided by desktop environment.
Configure specific packages. Most of packages configured here.
Install and configure some games.
Configure themes.
Configure fonts.
Configure hardware.
Just checkouts https://github.com/komachi/bin to ~/bin
Set timezone.
Install additional apparmor profiles from apparmor-even-more-profiles
Some additional hardering settings placed here, for now it's just installs some packages from whonix repo