Ubuntu desktop role

.github/workflows/pre-commit.yml

@@ -6,6 +6,37 @@ on:
     branches: [main]
 
 jobs:
+  audit-scripts:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Audit scripts/requirements.txt
+        run: pipx run pip-audit -r scripts/requirements.txt
+
+  audit-infra-mcp:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+
+      - name: Audit scripts/infra-mcp
+        run: |
+          uv export --frozen --no-dev --directory scripts/infra-mcp > /tmp/infra-mcp-reqs.txt
+          pipx run pip-audit -r /tmp/infra-mcp-reqs.txt
+
   check:
     runs-on: ubuntu-latest
     steps:

ansible/apply-cloud.sh

@@ -1,4 +1,7 @@
 #!/bin/sh
 
 cd "$(dirname "$0")" || exit
-ansible-playbook "playbooks/cloud.yaml" "$@"
+ansible-playbook "playbooks/cloud.yaml" \
+  -i inventory/inventory.yaml \
+  -i ../config/ansible/inventory/inventory.yaml \
+  "$@"

ansible/apply-homelab.sh

@@ -1,4 +1,8 @@
 #!/bin/sh
 
 cd "$(dirname "$0")" || exit
-ansible-playbook "playbooks/homelab.yaml" --limit "!local-debian,!azure-vm" "$@"
+ansible-playbook "playbooks/homelab.yaml" \
+  -i inventory/inventory.yaml \
+  -i ../config/ansible/inventory/inventory.yaml \
+  --limit "!local-debian,!azure-vm" \
+  "$@"

ansible/apply-localhost.sh

@@ -1,7 +1,10 @@
 #!/bin/sh
 
 cd "$(dirname "$0")" || exit
-ansible-playbook "playbooks/homelab.yaml" --limit "$(hostname)" \
+ansible-playbook "playbooks/homelab.yaml" \
+  -i inventory/inventory.yaml \
+  -i ../config/ansible/inventory/inventory.yaml \
   -e ansible_connection=local \
   -e ansible_pipelining=false \
+  --limit "$(hostname)" \
   "$@"

ansible/inventory/group_vars/debian/vars.yaml

@@ -53,7 +53,6 @@ debian_tools_apt_packages:
   - pipx                # https://pipx.pypa.io/
   - pre-commit          # https://pre-commit.com/
   - shellcheck          # https://www.shellcheck.net/
-  - tea                 # https://gitea.com/gitea/tea
 
 # Homebrew - https://brew.sh/
 # Installation flags - override in inventory.yaml per-host
@@ -75,8 +74,10 @@ debian_tools_brew_packages_common:
 
 ## Dev Tools
 debian_tools_brew_packages_dev:
+  - uv                  # https://github.com/astral-sh/uv
   - act                 # https://nektosact.com/
   - gh                  # https://cli.github.com/
+  - tea                 # https://gitea.com/gitea/tea
 
 ## AWS Cloud Tools
 debian_tools_brew_packages_aws:

ansible/playbooks/homelab.yaml

@@ -30,3 +30,9 @@
     - colony
   roles:
     - role: debian_samba_client
+
+- name: Setup Ubuntu desktop software
+  hosts:
+    - colony
+  roles:
+    - role: ubuntu_desktop

ansible/roles/debian_base/tasks/70-user.yaml

@@ -57,3 +57,5 @@
       value: "store"
     - name: "pull.rebase"
       value: "true"
+    - name: "core.editor"
+      value: "vim"

ansible/roles/ubuntu_desktop/defaults/main.yaml

@@ -0,0 +1,17 @@
+---
+ubuntu_desktop_snap_packages:
+  - brave
+  - steam
+
+ubuntu_desktop_snap_classic_packages:
+  - code
+
+ubuntu_desktop_install_chrome: true
+
+ubuntu_desktop_install_rustdesk: true
+# renovate: datasource=github-releases depName=rustdesk/rustdesk
+ubuntu_desktop_rustdesk_version: "1.4.6"
+
+ubuntu_desktop_install_sunshine: false
+# renovate: datasource=github-releases depName=LizardByte/Sunshine
+ubuntu_desktop_sunshine_version: "v2026.516.143833"

ansible/roles/ubuntu_desktop/tasks/10-snap.yaml

@@ -0,0 +1,12 @@
+---
+- name: Install snap packages
+  community.general.snap:
+    name: "{{ ubuntu_desktop_snap_packages }}"
+    state: present
+
+- name: Install classic snap packages
+  community.general.snap:
+    name: "{{ item }}"
+    classic: true
+    state: present
+  loop: "{{ ubuntu_desktop_snap_classic_packages }}"

ansible/roles/ubuntu_desktop/tasks/20-chrome.yaml

@@ -0,0 +1,26 @@
+---
+- name: Check if Chrome is installed
+  ansible.builtin.command:
+    cmd: dpkg-query -W -f='${Status}' google-chrome-stable
+  register: ubuntu_desktop_chrome_status
+  changed_when: false
+  failed_when: false
+
+- name: Download Chrome .deb package
+  ansible.builtin.get_url:
+    url: https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
+    dest: /tmp/google-chrome-stable_current_amd64.deb
+    mode: "0644"
+  when: ubuntu_desktop_chrome_status.rc != 0 or 'install ok installed' not in ubuntu_desktop_chrome_status.stdout
+
+- name: Install Chrome
+  ansible.builtin.apt:
+    deb: /tmp/google-chrome-stable_current_amd64.deb
+    state: present
+  when: ubuntu_desktop_chrome_status.rc != 0 or 'install ok installed' not in ubuntu_desktop_chrome_status.stdout
+
+- name: Clean up Chrome .deb
+  ansible.builtin.file:
+    path: /tmp/google-chrome-stable_current_amd64.deb
+    state: absent
+  when: ubuntu_desktop_chrome_status.rc != 0 or 'install ok installed' not in ubuntu_desktop_chrome_status.stdout

ansible/roles/ubuntu_desktop/tasks/30-rustdesk.yaml

@@ -0,0 +1,26 @@
+---
+- name: Check installed RustDesk version
+  ansible.builtin.command:
+    cmd: dpkg-query -W -f='${Version}' rustdesk
+  register: ubuntu_desktop_rustdesk_installed
+  changed_when: false
+  failed_when: false
+
+- name: Download RustDesk .deb package
+  ansible.builtin.get_url:
+    url: "https://github.com/rustdesk/rustdesk/releases/download/{{ ubuntu_desktop_rustdesk_version }}/rustdesk-{{ ubuntu_desktop_rustdesk_version }}-x86_64.deb"
+    dest: /tmp/rustdesk.deb
+    mode: "0644"
+  when: ubuntu_desktop_rustdesk_installed.rc != 0 or ubuntu_desktop_rustdesk_installed.stdout != ubuntu_desktop_rustdesk_version
+
+- name: Install RustDesk
+  ansible.builtin.apt:
+    deb: /tmp/rustdesk.deb
+    state: present
+  when: ubuntu_desktop_rustdesk_installed.rc != 0 or ubuntu_desktop_rustdesk_installed.stdout != ubuntu_desktop_rustdesk_version
+
+- name: Clean up RustDesk .deb
+  ansible.builtin.file:
+    path: /tmp/rustdesk.deb
+    state: absent
+  when: ubuntu_desktop_rustdesk_installed.rc != 0 or ubuntu_desktop_rustdesk_installed.stdout != ubuntu_desktop_rustdesk_version

ansible/roles/ubuntu_desktop/tasks/40-sunshine.yaml

@@ -0,0 +1,59 @@
+---
+# URL uses ansible_facts['distribution_version'] for the Ubuntu release (e.g. 24.04)
+# dpkg version strips the leading 'v' from the release tag
+- name: Check installed Sunshine version
+  ansible.builtin.command:
+    cmd: dpkg-query -W -f='${Version}' sunshine
+  register: ubuntu_desktop_sunshine_installed
+  changed_when: false
+  failed_when: false
+
+- name: Install Sunshine dependencies
+  ansible.builtin.apt:
+    pkg:
+      - miniupnpc
+      - libminiupnpc21
+    state: present
+  when: ubuntu_desktop_sunshine_installed.rc != 0 or ubuntu_desktop_sunshine_installed.stdout != ubuntu_desktop_sunshine_version | regex_replace('^v', '')
+
+- name: Fetch checksum release metadata
+  ansible.builtin.uri:
+    url: "https://api.github.com/repos/LizardByte/Sunshine/releases/tags/{{ ubuntu_desktop_sunshine_version }}"
+    return_content: true
+    headers:
+      Accept: "application/vnd.github+json"
+  register: ubuntu_desktop_sunshine_release
+  when: ubuntu_desktop_sunshine_installed.rc != 0 or ubuntu_desktop_sunshine_installed.stdout != ubuntu_desktop_sunshine_version | regex_replace('^v', '')
+
+- name: Extract Sunshine checksum for this platform
+  ansible.builtin.set_fact:
+    ubuntu_desktop_sunshine_checksum: >-
+      sha256:{{ (ubuntu_desktop_sunshine_release.json.body
+        | regex_search('sunshine-ubuntu-' + ansible_facts['distribution_version'] + '-amd64[.]deb[^\n]*sha256:([a-f0-9]{64})', '\1')) | first }}
+  when: ubuntu_desktop_sunshine_installed.rc != 0 or ubuntu_desktop_sunshine_installed.stdout != ubuntu_desktop_sunshine_version | regex_replace('^v', '')
+
+- name: Create temporary file for Sunshine .deb
+  ansible.builtin.tempfile:
+    suffix: .deb
+  register: ubuntu_desktop_sunshine_deb
+  when: ubuntu_desktop_sunshine_installed.rc != 0 or ubuntu_desktop_sunshine_installed.stdout != ubuntu_desktop_sunshine_version | regex_replace('^v', '')
+
+- name: Download Sunshine .deb package
+  ansible.builtin.get_url:
+    url: "https://github.com/LizardByte/Sunshine/releases/download/{{ ubuntu_desktop_sunshine_version }}/sunshine-ubuntu-{{ ansible_facts['distribution_version'] }}-amd64.deb"
+    dest: "{{ ubuntu_desktop_sunshine_deb.path }}"
+    mode: "0644"
+    checksum: "{{ ubuntu_desktop_sunshine_checksum }}"
+  when: ubuntu_desktop_sunshine_installed.rc != 0 or ubuntu_desktop_sunshine_installed.stdout != ubuntu_desktop_sunshine_version | regex_replace('^v', '')
+
+- name: Install Sunshine
+  ansible.builtin.apt:
+    deb: "{{ ubuntu_desktop_sunshine_deb.path }}"
+    state: present
+  when: ubuntu_desktop_sunshine_installed.rc != 0 or ubuntu_desktop_sunshine_installed.stdout != ubuntu_desktop_sunshine_version | regex_replace('^v', '')
+
+- name: Clean up Sunshine .deb
+  ansible.builtin.file:
+    path: "{{ ubuntu_desktop_sunshine_deb.path }}"
+    state: absent
+  when: ubuntu_desktop_sunshine_installed.rc != 0 or ubuntu_desktop_sunshine_installed.stdout != ubuntu_desktop_sunshine_version | regex_replace('^v', '')

ansible/roles/ubuntu_desktop/tasks/main.yaml

@@ -0,0 +1,19 @@
+---
+- name: Install snap packages
+  ansible.builtin.import_tasks: 10-snap.yaml
+  become: true
+
+- name: Install Chrome
+  ansible.builtin.import_tasks: 20-chrome.yaml
+  become: true
+  when: ubuntu_desktop_install_chrome | default(false) | ansible.builtin.bool
+
+- name: Install RustDesk
+  ansible.builtin.import_tasks: 30-rustdesk.yaml
+  become: true
+  when: ubuntu_desktop_install_rustdesk | default(false) | ansible.builtin.bool
+
+- name: Install Sunshine
+  ansible.builtin.import_tasks: 40-sunshine.yaml
+  become: true
+  when: ubuntu_desktop_install_sunshine | default(false) | ansible.builtin.bool

config-example/ansible/inventory/group_vars/debian/secret.yaml

@@ -0,0 +1,10 @@
+---
+
+# kics-scan ignore-line
+admin_password: "XXX"
+
+# sha512_crypt requires <= 16 chars for salt. Generate with:
+#   tr -dc 'A-Za-z0-9./' < /dev/urandom | head -c 16
+password_salt: "XXX"
+
+debian_base_crowdsec_local_api_key: "XXX"