Merge pull request 'feat(maintenance): new checks added, existing improved' (#6) from dev into main

Reviewed-on: #6

.gitea/workflows/deploy_new_config.yaml

@@ -0,0 +1,21 @@
+name: Deploy new config to the Ansible server
+run-name: Config is being deployed
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [ main ]
+
+env:
+  REGISTRY: git.vmn.su
+  OWNER: max
+  REPO: vmn-ansible
+
+jobs:
+  trigger-webhook:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger the webhook to run the playbook
+        # LAN IP is used because those hosts are in the same network
+        run: curl "http://192.168.0.38:9000/hooks/run-maintain-playbook"

inventory/group_vars/all/main.yaml

@@ -1,3 +1,5 @@
 ---
 
 ansible_become_passwd: "{{ ansible_password }}"
+human_admin_user: max
+proxmox_1_host: 192.168.0.2

inventory/hosts.yaml

@@ -1,5 +1,41 @@
 ---
-physical:
+all:
-  hosts:
+  children:
-    192.168.0.45:
+    physical:
-      ansible_become_password: "{{ ansible_become_passwd }}"
+      proxmox_1:
+        ansible_host: "{{ proxmox_1_host }}"
+        ansible_become_password: "{{ ansible_become_passwd }}"
+        services_to_run: []
+    virtual:
+      hosts:
+        localhost:
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          ansible_connection: local
+          ansible_python_interpreter: "{{ ansible_playbook_python }}"
+          services_to_run:
+            - webhook 
+        nfs-server:
+          ansible_host: 192.168.0.6
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        jellyfin:
+          ansible_host: 192.168.0.8
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        frigate:
+          ansible_host: 192.168.0.12
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        vs-code:
+          ansible_host: 192.168.0.16
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        gitea-server:
+          ansible_host: 192.168.0.39
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run: []
+        ai-host:
+          ansible_host: 192.168.0.50
+          ansible_become_password: "{{ ansible_become_passwd }}"
+          services_to_run:
+            - coder_ai

playbooks/deploy_and_set_up_lxc_on_proxmox.yaml

@@ -1,5 +1,5 @@
 ---
-- name: Physical machines maintanance play
+- name: Deploy LXC
   hosts: all
   remote_user: ansible
   gather_facts: false
@@ -12,7 +12,7 @@
 
   vars_prompt:
     - name: lxc_hostname
-      prompt: "Hostname for the container"
+      prompt: "Hostname for the container (may only contain letters (a-z, A-Z), numbers (0-9), and hyphens)"
       private: false
 
     - name: lxc_root_password
@@ -25,6 +25,55 @@
       prompt: "IP address for the container (in x.x.x.x/x formant)"
       private: false
 
+    - name: lxc_is_privileged
+      prompt: "Unprivileged LXC (true/false)?"
+      private: false
+
+  pre_tasks:
+    - name: Validate hostname
+      ansible.builtin.fail:
+        msg: |
+          Invalid hostname: "{{ lxc_hostname }}"
+          Hostname may only contain letters (a-z, A-Z), numbers (0-9), and hyphens (-).
+      when: not lxc_hostname is regex('^[a-zA-Z0-9-]+$')
+      run_once: true
 
   roles:
     - ../roles/deploy_lxc_on_proxmox 
+
+  tasks:
+    - name: Make the prompted hostname available to the whole playbook
+      ansible.builtin.set_fact:
+        fact_lxc_hostname: "{{ lxc_hostname }}"
+    
+    - name: Make the prompted IP available to the whole playbook
+      ansible.builtin.set_fact:
+        #fact_lxc_ip_address: "{{ lxc_ip_address | ansible.utils.ipaddr('address') }}"
+        fact_lxc_ip_address: "{{ lxc_ip_address.split('/') | first }}"
+
+    - name: Add the target host to the inventory
+      ansible.builtin.add_host:
+        name: "{{ fact_lxc_ip_address }}"
+        groups: new_host
+        ansible_user: ansible
+        ansible_become_password: "{{ ansible_become_passwd }}"
+
+
+- name: Configure LXC
+  hosts: new_host
+  remote_user: ansible
+
+  vars_files:
+    ../inventory/group_vars/all/secrets.yaml
+  vars:
+    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+
+  roles:
+    - ../roles/configure_ansible_user 
+    - ../roles/harden_ssh 
+    - ../roles/base_system
+    - ../roles/human_admin_user
+    # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
+    - ../roles/update_configs
+

playbooks/deploy_vm_from_cloud_init.yaml

@@ -1,6 +1,7 @@
 ---
-- name: Deploy a virtual machine from a cloud init image
+- name: Deploy VM
-  hosts: localhost
+  hosts: all
+  remote_user: ansible
   gather_facts: false
 
   vars_files:
@@ -8,10 +9,60 @@
   vars:
     ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
     user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+
   vars_prompt:
     - name: vm_hostname
-      prompt: "Hostname for the VM"
+      prompt: "Hostname for the VM (may only contain letters (a-z, A-Z), numbers (0-9), and hyphens)"
       private: false
 
+    - name: vm_ip_address
+      prompt: "IP address for the VM (in x.x.x.x/x formant)"
+      private: false
+
+  pre_tasks:
+    - name: Validate hostname
+      ansible.builtin.fail:
+        msg: |
+          Invalid hostname: "{{ vm_hostname }}"
+          Hostname may only contain letters (a-z, A-Z), numbers (0-9), and hyphens (-).
+      when: not vm_hostname is regex('^[a-zA-Z0-9-]+$')
+      run_once: true
+
   roles:
-    - ../roles/deploy_vm_on_proxmox
+    - ../roles/deploy_vm_on_proxmox 
+
+  tasks:
+    - name: Make the prompted hostname available to the whole playbook
+      ansible.builtin.set_fact:
+        fact_vm_hostname: "{{ vm_hostname }}"
+    
+    - name: Make the prompted IP available to the whole playbook
+      ansible.builtin.set_fact:
+        fact_vm_ip_address: "{{ vm_ip_address.split('/') | first }}"
+
+    - name: Add the target host to the inventory
+      ansible.builtin.add_host:
+        name: "{{ fact_vm_ip_address }}"
+        groups: new_host
+        ansible_user: ansible
+        ansible_become_password: "{{ ansible_become_passwd }}"
+
+
+- name: Configure VM
+  hosts: new_host
+  remote_user: ansible
+
+  vars_files:
+    ../inventory/group_vars/all/secrets.yaml
+  vars:
+    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
+    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+
+  roles:
+    - ../roles/configure_ansible_user 
+    - ../roles/harden_ssh 
+    - ../roles/base_system
+    - ../roles/human_admin_user
+    # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
+    - ../roles/update_configs
+

playbooks/maintain.yaml

@@ -1,11 +1,22 @@
 ---
 - name: Deploy and set up an LXC container in Proxmox
-  hosts: all
+  hosts: virtual
   remote_user: ansible
-  roles:
+  
-    - ../roles/deploy_lxc_on_proxmox
   vars_files:
     ../inventory/group_vars/all/secrets.yaml
-  vars:
+  
-    ansible_user_passwd_hash: "{{ ansible_password | password_hash('sha512', 's3edscrj45e6r') }}"
+  roles:
-    user_passwd_hash: "{{ user_password | password_hash('sha512', 's3ed6123jhgcr') }}"
+    # Check the Internet connection
+    # Check free disk space
+    - ../roles/common_healthcheck
+    # Ensure that all the required packages are installed
+    - ../roles/base_system
+    # Update the system
+    - ../roles/update_system
+    # Harden SSH - we must be sure that the last version of ssh configs are distributed
+    - ../roles/harden_ssh
+    # Update configs - omz, nvim, ranger and so on. Distribute the last version of those configs
+    - ../roles/update_configs
+    # Make sure that the services that are supposed to run are running
+    - ../roles/check_services

requirements.txt

@@ -4,29 +4,34 @@ ansible-lint==26.6.0
 attrs==26.1.0
 black==26.5.1
 bracex==3.0
+certifi==2026.7.22
 cffi==2.1.0
+charset-normalizer==3.4.9
 click==8.4.2
 cryptography==49.0.0
 distro==1.9.0
 filelock==3.29.7
+idna==3.18
 Jinja2==3.1.6
 jsonschema==4.26.0
 jsonschema-specifications==2025.9.1
 MarkupSafe==3.0.3
 mypy_extensions==1.1.0
+netaddr==1.3.0
 packaging==26.2
 pathspec==1.1.1
 platformdirs==4.10.0
-proxmoxer>=2.3
+proxmoxer==2.3.0
 pycparser==3.0
 pytokens==0.4.1
 PyYAML==6.0.3
 referencing==0.37.0
-requests>=2.34.2
+requests==2.34.2
 resolvelib==1.2.1
 rpds-py==2026.6.3
 ruamel.yaml==0.19.1
 ruamel.yaml.clib==0.2.15
 subprocess-tee==0.4.2
+urllib3==2.7.0
 wcmatch==11.0
 yamllint==1.38.0

requirements.yaml

@@ -0,0 +1,17 @@
+---
+
+collections:
+  - name: ansible.posix
+    version: 2.2.2
+
+  - name: ansible.utils
+    version: 6.0.3
+
+  - name: community.general
+    version: 13.2.0
+
+  - name: community.library_inventory_filtering_v1
+    version: 1.1.5
+
+  - name: community.proxmox
+    version: 2.0.0

roles/base_system/tasks/install_packages.yaml

@@ -1,20 +1,8 @@
 ---
 - name: Installing basic utils for comfort work (apt-based system)
-  when: (ansible_facts['distribution'] == "Debian") or
+  when: (ansible_facts['os_family'] == "Debian")
-        (ansible_facts['distribution'] == "Ubuntu")
   ansible.builtin.apt:
-    name:
+    name: "{{ debian_13_packages }}" 
-      - vim
-      - neovim
-      - ranger
-      - zsh
-      - rsync
-      - git
-      - curl
-      - kitty
-      - unattended-upgrades
-      - ssh
-      - openssh-server
     update-cache: true # Run apt update before installation
   become: true
   remote_user: ansible
@@ -38,6 +26,6 @@
 - name: Update and install packages on Alpine
   when: (ansible_facts['distribution'] == "Alpine")
   community.general.apk:
-    name: neovim vim ranger zsh rsync git curl kitty openssh
+    name: "{{ alpine_packages }}"
     update_cache: true
   remote_user: ansible

roles/base_system/tasks/main.yaml

@@ -1,7 +1,9 @@
 ---
 - name: Install basic utils
-  ansible.builtin.include_tasks: install_basic_utils.yaml
+  ansible.builtin.include_tasks: install_packages.yaml
 
 - name: Remove unnecessary packages
   ansible.builtin.include_tasks: remove_packages.yaml
 
+- name: Set locale and time
+  ansible.builtin.include_tasks: set_locale_and_time.yaml

roles/base_system/vars/main/alpine_packages.yaml

@@ -0,0 +1,13 @@
+---
+
+alpine_packages:
+  - curl
+  - gcc
+  - git
+  - kitty
+  - neovim
+  - openssh-server
+  - ranger
+  - rsync
+  - ssh
+  - zsh

roles/base_system/vars/main/debian_13_packages.yaml

@@ -0,0 +1,13 @@
+---
+
+debian_13_packages:
+  - curl
+  - gcc
+  - git
+  - kitty
+  - neovim
+  - openssh-server
+  - ranger
+  - rsync
+  - ssh
+  - zsh

roles/basic_postinstall/files/.zshrc

@@ -1,105 +0,0 @@
-export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
-
-# Path to your Oh My Zsh installation.
-export ZSH="$HOME/.oh-my-zsh"
-
-export GTK_THEME=Adwaita-dark
-
-# Set name of the theme to load --- if set to "random", it will
-# load a random theme each time Oh My Zsh is loaded, in which case,
-# to know which specific one was loaded, run: echo $RANDOM_THEME
-# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
-ZSH_THEME="gnzh"
-
-# Set list of themes to pick from when loading at random
-# Setting this variable when ZSH_THEME=random will cause zsh to load
-# a theme from this variable instead of looking in $ZSH/themes/
-# If set to an empty array, this variable will have no effect.
-# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
-
-# Uncomment the following line to use case-sensitive completion.
-# CASE_SENSITIVE="true"
-
-# Uncomment the following line to use hyphen-insensitive completion.
-# Case-sensitive completion must be off. _ and - will be interchangeable.
-# HYPHEN_INSENSITIVE="true"
-
-# Uncomment one of the following lines to change the auto-update behavior
-# zstyle ':omz:update' mode disabled  # disable automatic updates
-# zstyle ':omz:update' mode auto      # update automatically without asking
-# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
-
-# Uncomment the following line to change how often to auto-update (in days).
-# zstyle ':omz:update' frequency 13
-
-# Uncomment the following line if pasting URLs and other text is messed up.
-# DISABLE_MAGIC_FUNCTIONS="true"
-
-# Uncomment the following line to disable colors in ls.
-# DISABLE_LS_COLORS="true"
-
-# Uncomment the following line to disable auto-setting terminal title.
-# DISABLE_AUTO_TITLE="true"
-
-# Uncomment the following line to enable command auto-correction.
-# ENABLE_CORRECTION="true"
-
-# Uncomment the following line to display red dots whilst waiting for completion.
-# You can also set it to another string to have that shown instead of the default red dots.
-# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
-# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
-# COMPLETION_WAITING_DOTS="true"
-
-# Uncomment the following line if you want to disable marking untracked files
-# under VCS as dirty. This makes repository status check for large repositories
-# much, much faster.
-# DISABLE_UNTRACKED_FILES_DIRTY="true"
-
-# Uncomment the following line if you want to change the command execution time
-# stamp shown in the history command output.
-# You can set one of the optional three formats:
-# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
-# or set a custom format using the strftime function format specifications,
-# see 'man strftime' for details.
-# HIST_STAMPS="mm/dd/yyyy"
-
-# Would you like to use another custom folder than $ZSH/custom?
-# ZSH_CUSTOM=/path/to/new-custom-folder
-
-# Which plugins would you like to load?
-# Standard plugins can be found in $ZSH/plugins/
-# Custom plugins may be added to $ZSH_CUSTOM/plugins/
-# Example format: plugins=(rails git textmate ruby lighthouse)
-# Add wisely, as too many plugins slow down shell startup.
-#plugins=(git)
-
-source $ZSH/oh-my-zsh.sh
-
-# User configuration
-
-# export MANPATH="/usr/local/man:$MANPATH"
-
-# You may need to manually set your language environment
-# export LANG=en_US.UTF-8
-
-# Preferred editor for local and remote sessions
-# if [[ -n $SSH_CONNECTION ]]; then
-#   export EDITOR='vim'
-# else
-#   export EDITOR='nvim'
-# fi
-
-# Compilation flags
-# export ARCHFLAGS="-arch $(uname -m)"
-
-# Set personal aliases, overriding those provided by Oh My Zsh libs,
-# plugins, and themes. Aliases can be placed here, though Oh My Zsh
-# users are encouraged to define aliases within a top-level file in
-# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
-# - $ZSH_CUSTOM/aliases.zsh
-# - $ZSH_CUSTOM/macos.zsh
-# For a full list of active aliases, run `alias`.
-#
-# Example aliases
-# alias zshconfig="mate ~/.zshrc"
-# alias ohmyzsh="mate ~/.oh-my-zsh"

roles/basic_postinstall/files/hardened_ssh.conf

@@ -1,4 +0,0 @@
- Host *
-    HashKnownHosts yes
-    GSSAPIAuthentication yes
-    KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,curve25519-sha256

roles/basic_postinstall/files/hardened_sshd.conf

@@ -1,29 +0,0 @@
-PubkeyAuthentication yes
-AuthorizedKeysFile	.ssh/authorized_keys
-PasswordAuthentication no
-KbdInteractiveAuthentication no
-UsePAM no
-# Disable password authentication — keys only
-PasswordAuthentication no
-ChallengeResponseAuthentication no
-
-
-AllowGroups sshusers
-PrintMotd no
-AcceptEnv LANG LC_*
-ClientAliveCountMax 0
-ClientAliveInterval 300
-Port 22
-
-
-# Disable root login entirely
-PermitRootLogin no
-
-# Limit authentication attempts
-MaxAuthTries 3
-MaxSessions 3
-
-# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
-KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

roles/basic_postinstall/tasks/create_new_user.yaml

@@ -1,66 +0,0 @@
----
-- name: Create a new user with a password, set shell
-  remote_user: ansible
-  ansible.builtin.user:
-    name: max
-    groups: sshusers,sudo
-    password: "{{ user_passwd_hash }}"
-    shell: /bin/zsh
-
-- name: Set authorized key taken from file
-  remote_user: ansible
-  ansible.posix.authorized_key:
-    user: max
-    state: present
-    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
-
-- name: Copy omz installation wrapper script to the target machine
-  remote_user: ansible
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/install_omz.sh"
-    dest: /home/max/install_omz.sh
-    owner: max
-    group: max
-    mode: u=rwx,g=r,o-rwx
-
-# WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
-- name: Install oh my zsh
-  remote_user: max
-  become: false
-  ansible.builtin.command: /home/max/install_omz.sh
-  changed_when: true
-
-- name: Configure oh my zsh, by pushing the config file
-  remote_user: ansible
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/.zshrc"
-    dest: /home/max/.zshrc
-    owner: max
-    group: max
-    mode: u=rw,g=r,o-rwx
-
-- name: Configure vim, by pushing the config
-  remote_user: ansible
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/.vimrc"
-    dest: /home/max/.vimrc
-    owner: max
-    group: max
-    mode: u=rw,g=r,o-rwx
-
-
-# WARNING: we've finished with the initial setup, drop ansible key
-# Push regular user key
-- name: Set authorized key taken from file
-  remote_user: ansible
-  ansible.posix.authorized_key:
-    user: max
-    state: absent
-    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
-
-- name: Set authorized key taken from file
-  remote_user: ansible
-  ansible.posix.authorized_key:
-    user: max
-    state: present
-    key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}"

roles/basic_postinstall/tasks/harden_ssh.yaml

@@ -1,36 +0,0 @@
----
-
-- name: Configure ssh-server daemon
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/hardened_sshd.conf"
-    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
-    mode: u=rw,g=r,o=r
-  when: ansible_facts['distribution'] == 'Ubuntu'
-
-- name: Configure ssh-server daemon
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/hardened_sshd.conf"
-    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
-    mode: u=rw,g=r,o=r
-  when: ansible_facts['distribution'] == 'Debian'
-
-- name: Configure ssh client
-  remote_user: ansible
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/hardened_ssh.conf"
-    dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
-    mode: u=rw,g=r,o=r
-
-- name: Restart ssh-server Debian
-  remote_user: ansible
-  ansible.builtin.service:
-    name: sshd
-    state: restarted
-  when: ansible_facts['distribution'] == 'Debian'
-
-- name: Restart ssh-server Ubuntu
-  remote_user: ansible
-  ansible.builtin.service:
-    name: ssh
-    state: restarted
-  when: ansible_facts['distribution'] == 'Ubuntu'

roles/basic_postinstall/tasks/install_basic_utils.yaml

@@ -1,42 +0,0 @@
----
-- name: Installing basic utils for comfort work (apt-based system)
-  when: (ansible_facts['distribution'] == "Debian") or
-        (ansible_facts['distribution'] == "Ubuntu")
-  ansible.builtin.apt:
-    name:
-      - vim
-      - ranger
-      - zsh
-      - rsync
-      - git
-      - curl
-      - kitty
-      - unattended-upgrades
-      - ssh
-      - openssh-server
-    update-cache: true # Run apt update before installation
-  become: true
-  remote_user: ansible
-
-- name: Install qemu-guest-agent on VM
-  when:
-    - ansible_facts['os_family'] == "Debian"
-    - ansible_facts['virtualization_type'] == "kvm"
-  ansible.builtin.apt:
-    name: qemu-guest-agent
-    state: present
-    update-cache: true # Run apt update before installation
-  become: true
-  remote_user: ansible
-  tags:
-    - kvm-guests
-    - packages
-
-
-# The same commands for Alpine
-- name: Update and install packages on Alpine
-  when: (ansible_facts['distribution'] == "Alpine")
-  community.general.apk:
-    name: vim ranger zsh rsync git curl kitty openssh
-    update_cache: true
-  remote_user: ansible

roles/basic_postinstall/tasks/main.yaml

@@ -1,18 +0,0 @@
----
-- name: Create and set up Ansible user and environment
-  ansible.builtin.include_tasks: prepare_ansible_user.yaml
-
-- name: Improve SSH configuration
-  ansible.builtin.include_tasks: harden_ssh.yaml
-
-- name: Install basic utils
-  ansible.builtin.include_tasks: install_basic_utils.yaml
-
-- name: Remove unnecessary packages
-  ansible.builtin.include_tasks: remove_packages.yaml
-
-- name: Create and set up a new user
-  ansible.builtin.include_tasks: create_new_user.yaml
-
-- name: Set locale and time
-  ansible.builtin.include_tasks: set_locale_and_time.yaml

roles/basic_postinstall/tasks/prepare_ansible_user.yaml

@@ -1,41 +0,0 @@
----
-## Installing packages
-- name: Install sudo on apt systems
-  when: (ansible_facts['distribution'] == "Debian") or
-        (ansible_facts['distribution'] == "Ubuntu")
-  ansible.builtin.apt:
-    name:
-      - sudo
-    update-cache: true
-
-# The same commands for Alpine
-- name: Update and install packages on Alpine
-  when: (ansible_facts['distribution'] == "Alpine")
-  community.general.apk:
-    name: sudo
-    update_cache: true
-  remote_user: ansible
-
-
-## Creating and setting up the ansible user
-## First, create sshusers group to grant ssh access
-- name: Ensure group "sshusers" exists
-  ansible.builtin.group:
-    name: sshusers
-    state: present
-
-## Add the user to sshusers (for ssh access) and sudo (gain root access)
-- name: Create a new user with a password for Ansible
-  ansible.builtin.user:
-    name: ansible
-    password: "{{ ansible_user_passwd_hash }}"
-
-    groups: sshusers,sudo
-    append: true
-
-## Since password authentication in SSH will be disabled, we need to add an authorized key
-- name: Set authorized key taken from file
-  ansible.posix.authorized_key:
-    user: ansible
-    state: present
-    key: "{{ ansible_ssh_key }}"

roles/basic_postinstall/tasks/remove_packages.yaml

@@ -1,31 +0,0 @@
----
-# Remove multiple packages at once
-- name: Remove unnecessary packages
-  remote_user: ansible
-  when: (ansible_facts['distribution'] == "Debian") or
-        (ansible_facts['distribution'] == "Ubuntu")
-  ansible.builtin.apt:
-    name:
-      - nano
-    state: absent
-  become: true
-
-
-# Clean up all orphaned packages
-- name: Remove all orphaned dependencies
-  remote_user: ansible
-  when: (ansible_facts['distribution'] == "Debian") or
-        (ansible_facts['distribution'] == "Ubuntu")
-  ansible.builtin.apt:
-    autoremove: true
-    purge: true
-
-
-- name: Install sudo package on Alpine
-  remote_user: ansible
-  when: (ansible_facts['distribution'] == "Alpine")
-  community.general.apk:
-    name:
-      - nano
-    state: absent
-  become: true

roles/basic_postinstall_/files/.zshrc

@@ -1,105 +0,0 @@
-export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
-
-# Path to your Oh My Zsh installation.
-export ZSH="$HOME/.oh-my-zsh"
-
-export GTK_THEME=Adwaita-dark
-
-# Set name of the theme to load --- if set to "random", it will
-# load a random theme each time Oh My Zsh is loaded, in which case,
-# to know which specific one was loaded, run: echo $RANDOM_THEME
-# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
-ZSH_THEME="gnzh"
-
-# Set list of themes to pick from when loading at random
-# Setting this variable when ZSH_THEME=random will cause zsh to load
-# a theme from this variable instead of looking in $ZSH/themes/
-# If set to an empty array, this variable will have no effect.
-# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
-
-# Uncomment the following line to use case-sensitive completion.
-# CASE_SENSITIVE="true"
-
-# Uncomment the following line to use hyphen-insensitive completion.
-# Case-sensitive completion must be off. _ and - will be interchangeable.
-# HYPHEN_INSENSITIVE="true"
-
-# Uncomment one of the following lines to change the auto-update behavior
-# zstyle ':omz:update' mode disabled  # disable automatic updates
-# zstyle ':omz:update' mode auto      # update automatically without asking
-# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
-
-# Uncomment the following line to change how often to auto-update (in days).
-# zstyle ':omz:update' frequency 13
-
-# Uncomment the following line if pasting URLs and other text is messed up.
-# DISABLE_MAGIC_FUNCTIONS="true"
-
-# Uncomment the following line to disable colors in ls.
-# DISABLE_LS_COLORS="true"
-
-# Uncomment the following line to disable auto-setting terminal title.
-# DISABLE_AUTO_TITLE="true"
-
-# Uncomment the following line to enable command auto-correction.
-# ENABLE_CORRECTION="true"
-
-# Uncomment the following line to display red dots whilst waiting for completion.
-# You can also set it to another string to have that shown instead of the default red dots.
-# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
-# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
-# COMPLETION_WAITING_DOTS="true"
-
-# Uncomment the following line if you want to disable marking untracked files
-# under VCS as dirty. This makes repository status check for large repositories
-# much, much faster.
-# DISABLE_UNTRACKED_FILES_DIRTY="true"
-
-# Uncomment the following line if you want to change the command execution time
-# stamp shown in the history command output.
-# You can set one of the optional three formats:
-# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
-# or set a custom format using the strftime function format specifications,
-# see 'man strftime' for details.
-# HIST_STAMPS="mm/dd/yyyy"
-
-# Would you like to use another custom folder than $ZSH/custom?
-# ZSH_CUSTOM=/path/to/new-custom-folder
-
-# Which plugins would you like to load?
-# Standard plugins can be found in $ZSH/plugins/
-# Custom plugins may be added to $ZSH_CUSTOM/plugins/
-# Example format: plugins=(rails git textmate ruby lighthouse)
-# Add wisely, as too many plugins slow down shell startup.
-#plugins=(git)
-
-source $ZSH/oh-my-zsh.sh
-
-# User configuration
-
-# export MANPATH="/usr/local/man:$MANPATH"
-
-# You may need to manually set your language environment
-# export LANG=en_US.UTF-8
-
-# Preferred editor for local and remote sessions
-# if [[ -n $SSH_CONNECTION ]]; then
-#   export EDITOR='vim'
-# else
-#   export EDITOR='nvim'
-# fi
-
-# Compilation flags
-# export ARCHFLAGS="-arch $(uname -m)"
-
-# Set personal aliases, overriding those provided by Oh My Zsh libs,
-# plugins, and themes. Aliases can be placed here, though Oh My Zsh
-# users are encouraged to define aliases within a top-level file in
-# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
-# - $ZSH_CUSTOM/aliases.zsh
-# - $ZSH_CUSTOM/macos.zsh
-# For a full list of active aliases, run `alias`.
-#
-# Example aliases
-# alias zshconfig="mate ~/.zshrc"
-# alias ohmyzsh="mate ~/.oh-my-zsh"

roles/basic_postinstall_/files/hardened_ssh.conf

@@ -1,4 +0,0 @@
- Host *
-    HashKnownHosts yes
-    GSSAPIAuthentication yes
-    KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,curve25519-sha256

roles/basic_postinstall_/files/hardened_sshd.conf

@@ -1,29 +0,0 @@
-PubkeyAuthentication yes
-AuthorizedKeysFile	.ssh/authorized_keys
-PasswordAuthentication no
-KbdInteractiveAuthentication no
-UsePAM no
-# Disable password authentication — keys only
-PasswordAuthentication no
-ChallengeResponseAuthentication no
-
-
-AllowGroups sshusers
-PrintMotd no
-AcceptEnv LANG LC_*
-ClientAliveCountMax 0
-ClientAliveInterval 300
-Port 22
-
-
-# Disable root login entirely
-PermitRootLogin no
-
-# Limit authentication attempts
-MaxAuthTries 3
-MaxSessions 3
-
-# Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
-KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
-Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

roles/basic_postinstall_/files/install_omz.sh

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-FILE=/home/$USER/.oh-my-zsh/oh-my-zsh.sh
-if [ -f "$FILE" ]; then
-    echo "$FILE exists and we not installing ohmyzsh"
-    exit 0
-else 
-    echo "$FILE does not exist and we install ohmyzsh"
-		cd /home/max
-    wget https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh
-		chmod +x /home/max/install.sh
-		timeout -s 15 -k 30s 20s /home/max/install.sh --unattendend --keep-zshrc || exit 0
-    exit 0
-fi
-

roles/basic_postinstall_/tasks/harden_ssh.yaml

@@ -1,36 +0,0 @@
----
-
-- name: Configure ssh-server daemon
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/hardened_sshd.conf"
-    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
-    mode: u=rw,g=r,o=r
-  when: ansible_facts['distribution'] == 'Ubuntu'
-
-- name: Configure ssh-server daemon
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/hardened_sshd.conf"
-    dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
-    mode: u=rw,g=r,o=r
-  when: ansible_facts['distribution'] == 'Debian'
-
-- name: Configure ssh client
-  remote_user: ansible
-  ansible.builtin.copy:
-    src: "{{ role_path }}/files/hardened_ssh.conf"
-    dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
-    mode: u=rw,g=r,o=r
-
-- name: Restart ssh-server Debian
-  remote_user: ansible
-  ansible.builtin.service:
-    name: sshd
-    state: restarted
-  when: ansible_facts['distribution'] == 'Debian'
-
-- name: Restart ssh-server Ubuntu
-  remote_user: ansible
-  ansible.builtin.service:
-    name: ssh
-    state: restarted
-  when: ansible_facts['distribution'] == 'Ubuntu'

roles/basic_postinstall_/tasks/install_basic_utils.yaml

@@ -1,42 +0,0 @@
----
-- name: Installing basic utils for comfort work (apt-based system)
-  when: (ansible_facts['distribution'] == "Debian") or
-        (ansible_facts['distribution'] == "Ubuntu")
-  ansible.builtin.apt:
-    name:
-      - vim
-      - ranger
-      - zsh
-      - rsync
-      - git
-      - curl
-      - kitty
-      - unattended-upgrades
-      - ssh
-      - openssh-server
-    update-cache: true # Run apt update before installation
-  become: true
-  remote_user: ansible
-
-- name: Install qemu-guest-agent on VM
-  when:
-    - ansible_facts['os_family'] == "Debian"
-    - ansible_facts['virtualization_type'] == "kvm"
-  ansible.builtin.apt:
-    name: qemu-guest-agent
-    state: present
-    update-cache: true # Run apt update before installation
-  become: true
-  remote_user: ansible
-  tags:
-    - kvm-guests
-    - packages
-
-
-# The same commands for Alpine
-- name: Update and install packages on Alpine
-  when: (ansible_facts['distribution'] == "Alpine")
-  community.general.apk:
-    name: vim ranger zsh rsync git curl kitty openssh
-    update_cache: true
-  remote_user: ansible

roles/basic_postinstall_/tasks/main.yaml

@@ -1,18 +0,0 @@
----
-- name: Create and set up Ansible user and environment
-  ansible.builtin.include_tasks: prepare_ansible_user.yaml
-
-- name: Improve SSH configuration
-  ansible.builtin.include_tasks: harden_ssh.yaml
-
-- name: Install basic utils
-  ansible.builtin.include_tasks: install_basic_utils.yaml
-
-- name: Remove unnecessary packages
-  ansible.builtin.include_tasks: remove_packages.yaml
-
-- name: Create and set up a new user
-  ansible.builtin.include_tasks: create_new_user.yaml
-
-- name: Set locale and time
-  ansible.builtin.include_tasks: set_locale_and_time.yaml

roles/basic_postinstall_/tasks/prepare_ansible_user.yaml

@@ -1,41 +0,0 @@
----
-## Installing packages
-- name: Install sudo on apt systems
-  when: (ansible_facts['distribution'] == "Debian") or
-        (ansible_facts['distribution'] == "Ubuntu")
-  ansible.builtin.apt:
-    name:
-      - sudo
-    update-cache: true
-
-# The same commands for Alpine
-- name: Update and install packages on Alpine
-  when: (ansible_facts['distribution'] == "Alpine")
-  community.general.apk:
-    name: sudo
-    update_cache: true
-  remote_user: ansible
-
-
-## Creating and setting up the ansible user
-## First, create sshusers group to grant ssh access
-- name: Ensure group "sshusers" exists
-  ansible.builtin.group:
-    name: sshusers
-    state: present
-
-## Add the user to sshusers (for ssh access) and sudo (gain root access)
-- name: Create a new user with a password for Ansible
-  ansible.builtin.user:
-    name: ansible
-    password: "{{ ansible_user_passwd_hash }}"
-
-    groups: sshusers,sudo
-    append: true
-
-## Since password authentication in SSH will be disabled, we need to add an authorized key
-- name: Set authorized key taken from file
-  ansible.posix.authorized_key:
-    user: ansible
-    state: present
-    key: "{{ ansible_ssh_key }}"

roles/basic_postinstall_/tasks/remove_packages.yaml

@@ -1,31 +0,0 @@
----
-# Remove multiple packages at once
-- name: Remove unnecessary packages
-  remote_user: ansible
-  when: (ansible_facts['distribution'] == "Debian") or
-        (ansible_facts['distribution'] == "Ubuntu")
-  ansible.builtin.apt:
-    name:
-      - nano
-    state: absent
-  become: true
-
-
-# Clean up all orphaned packages
-- name: Remove all orphaned dependencies
-  remote_user: ansible
-  when: (ansible_facts['distribution'] == "Debian") or
-        (ansible_facts['distribution'] == "Ubuntu")
-  ansible.builtin.apt:
-    autoremove: true
-    purge: true
-
-
-- name: Install sudo package on Alpine
-  remote_user: ansible
-  when: (ansible_facts['distribution'] == "Alpine")
-  community.general.apk:
-    name:
-      - nano
-    state: absent
-  become: true

roles/basic_postinstall_/tasks/set_locale_and_time.yaml

@@ -1,19 +0,0 @@
----
-- name: Generate locales
-  community.general.locale_gen:
-    name:
-      - en_US.UTF-8
-      - ru_RU.UTF-8
-    state: present
-
-- name: Set locale
-  ansible.builtin.copy:
-    dest: /etc/locale.conf
-    mode: '0644'
-    content: |
-      LANG=en_US.UTF-8
-      LC_ALL=en_US.UTF-8
-
-- name: Set time
-  community.general.timezone:
-    name: Europe/Samara

roles/check_services/tasks/main.yaml

@@ -0,0 +1,7 @@
+---
+
+- name: Make sure required services are running
+  ansible.builtin.service:
+    name: "{{ item }}"
+    state: started
+  loop: "{{ services_to_run }}"

roles/common_healthcheck/tasks/main.yaml

@@ -2,7 +2,7 @@
 - name: Internet connection test block
   block:
     - name: Test reachability to ya.ru
-      become: true # Usually it's not necessary, but sometimes there are some wierd issues with ping, especially on Alpine
+      become: true # Usually it's not necessary, but sometimes ping is disabled for non-root by default
       ansible.builtin.shell: ping -c 5 ya.ru > /dev/null
       changed_when: false   # This task does not change the system
 
@@ -21,9 +21,10 @@
   block:
     - name: Test free disk space in root
       become: false
+      # We have to use this complicated pipeline because of Alpine and its wierd df implementation
       ansible.builtin.shell: set -o pipefail && df -h / | tail -1 | awk '{gsub(/%/, "", $5); print $5}'
-      register: common_healthcheck_result
+      register: common_healthcheck_space_left_result
-      failed_when: common_healthcheck_result.stdout | int > 85
+      failed_when: common_healthcheck_space_left_result.stdout | int > 85
       changed_when: false   # This task does not change the system
 
   rescue:
@@ -40,5 +41,9 @@
         body:
           - "{{ ansible_facts['hostname'] }}: Disk space is low"
       delegate_to: 127.0.0.1
-      failed_when: false
+      failed_when: false    # It's OK if it fails, not critical
       changed_when: false   # This task does not change the system
+
+    - name: Resize rootfs if it's an LXC
+      ansible.builtin.include_tasks: resize_lxc_rootfs.yaml
+      when: ansible_virtualization_type == 'lxc'

roles/common_healthcheck/tasks/resize_lxc_rootfs.yaml

@@ -0,0 +1,24 @@
+---
+- name: Get container info by name
+  delegate_to: localhost
+  become: false
+  community.general.proxmox_vm_info:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: 192.168.0.2
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ inventory_hostname }}"
+    type: lxc
+  register: common_healthcheck_vmid
+
+- name: Resize LXC's rootfs
+  become: true
+  ansible.builtin.command:
+    cmd: pct resize {{ common_healthcheck_vmid.proxmox_vms[0].vmid }} rootfs +5G
+  delegate_to: 192.168.0.2
+  changed_when: true
+  vars:
+    ansible_become_password: "{{ ansible_become_passwd  }}"

roles/deploy_lxc_on_proxmox/tasks/main.yaml

@@ -6,7 +6,7 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
@@ -14,6 +14,7 @@
     password: "{{ lxc_root_password }}"
     hostname: "{{ lxc_hostname }}"
     ostemplate: 'main:vztmpl/debian-13-golden-image.tar.gz'
+    unprivileged: "{{ lxc_is_privileged }}"
     memory: 2048
     cores: 2
     state: present
@@ -33,12 +34,14 @@
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
 
     hostname: "{{ lxc_hostname }}"
     state: started
+  retries: 3
+  delay: 15
 
 - name: Sleep for a minute to ensure that ssh is ready
   become: false

roles/deploy_vm_on_proxmox/tasks/create_vm.yaml

@@ -0,0 +1,72 @@
+---
+
+- name: Create a new VM with minimal options only if it doesn't exist
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    clone: debian-13-cloud-init-template
+    name: "{{ vm_hostname }}"
+    storage: main
+    format: qcow2
+    full: true
+    timeout: 500
+
+- name: Sleep for 20 seconds to ensure that Proxmox has cloned the VM
+  become: false
+  ansible.builtin.wait_for:
+    timeout: 20
+  delegate_to: localhost
+  changed_when: false
+
+- name: Update the cloned VM with cloud-init configuration
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ vm_hostname }}"
+    # Cloud-init parameters
+    update: true
+    ide:
+      ide2: "local:cloudinit,format=qcow2"
+    ciuser: "ansible"
+    cipassword: "{{ ansible_become_passwd }}"
+    ipconfig:
+      ipconfig0: "ip={{ vm_ip_address }},gw=192.168.0.1"
+
+- name: Tweak the hardware settings
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ vm_hostname }}"
+    cores: 4
+    memory: 4096 # Minimal value for debian based OS for smooth workflow
+    update: true
+
+- name: Make sure the VM has started
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ vm_hostname }}"
+    state: started

roles/deploy_vm_on_proxmox/tasks/main.yaml

@@ -1,53 +1,25 @@
 ---
-- name: Create a new VM with minimal options
+
-  become: false
+- name: Check if VM already exists
   community.proxmox.proxmox_kvm:
     validate_certs: false
     node: proxmox-server
     api_user: root@pam
-    api_host: 192.168.0.2
+    api_host: "{{ proxmox_1_host }}"
     api_token_id: ansible
     api_token_secret: "{{ proxmox_token_secret }}"
-
+    
-    clone: debian-13-cloud-init-template
     name: "{{ vm_hostname }}"
-    storage: main
+    state: current
-    format: qcow2
+  ignore_errors: true
-    full: true
+  register: vm_status
-    timeout: 500
 
-- name: Sleep for 20 seconds to ensure that Proxmox has cloned the VM
-  become: false
-  ansible.builtin.wait_for:
-    timeout: 20
-  delegate_to: localhost
-  changed_when: false
 
-- name: Tweak the hardware settings
+- name: Create a new VM with minimal options only if it doesn't exist
-  become: false
+  when: vm_status is failed or 'does not exist in cluster' in vm_status.msg
-  community.proxmox.proxmox_kvm:
+  ansible.builtin.include_tasks: create_vm.yaml 
-    validate_certs: false
-    node: proxmox-server
-    api_user: root@pam
-    api_host: 192.168.0.2
-    api_token_id: ansible
-    api_token_secret: "{{ proxmox_token_secret }}"
 
-    name: "{{ vm_hostname }}"
+- name: Start the VM only if needed
-    cores: 4
+  when: '"does not exist in cluster" in vm_status.msg or vm_status.status != "running"'
-    memory: 4096 # Minimal value for debian based OS for smooth workflow
+  ansible.builtin.include_tasks: start_vm.yaml 
-    update: true
-
-- name: Make sure the VM has started
-  become: false
-  community.proxmox.proxmox_kvm:
-    validate_certs: false
-    node: proxmox-server
-    api_user: root@pam
-    api_host: 192.168.0.2
-    api_token_id: ansible
-    api_token_secret: "{{ proxmox_token_secret }}"
-
-    name: "{{ vm_hostname }}"
-    state: started
 

roles/deploy_vm_on_proxmox/tasks/start_vm.yaml

@@ -0,0 +1,21 @@
+---
+
+- name: Make sure the VM has started
+  become: false
+  community.proxmox.proxmox_kvm:
+    validate_certs: false
+    node: proxmox-server
+    api_user: root@pam
+    api_host: "{{ proxmox_1_host }}"
+    api_token_id: ansible
+    api_token_secret: "{{ proxmox_token_secret }}"
+
+    name: "{{ vm_hostname }}"
+    state: started
+
+- name: Sleep for 120 seconds to ensure that Proxmox has cloned the VM
+  become: false
+  ansible.builtin.wait_for:
+    timeout: 120
+  delegate_to: localhost
+  changed_when: false

roles/harden_ssh/files/.vimrc

@@ -1,16 +0,0 @@
-set number
-set tabstop=2
-" Disable compatibility with vi which can cause unexpected issues.
-set nocompatible
-
-" Enable type file detection. Vim will be able to try to detect the type of file in use.
-filetype on
-
-" Enable plugins and load plugin for the detected file type.
-filetype plugin on
-
-" Load an indent file for the detected file type.
-filetype indent on
-
-" Turn syntax highlighting on.
-syntax on

roles/harden_ssh/files/.zshrc

@@ -1,105 +0,0 @@
-export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
-
-# Path to your Oh My Zsh installation.
-export ZSH="$HOME/.oh-my-zsh"
-
-export GTK_THEME=Adwaita-dark
-
-# Set name of the theme to load --- if set to "random", it will
-# load a random theme each time Oh My Zsh is loaded, in which case,
-# to know which specific one was loaded, run: echo $RANDOM_THEME
-# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
-ZSH_THEME="gnzh"
-
-# Set list of themes to pick from when loading at random
-# Setting this variable when ZSH_THEME=random will cause zsh to load
-# a theme from this variable instead of looking in $ZSH/themes/
-# If set to an empty array, this variable will have no effect.
-# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
-
-# Uncomment the following line to use case-sensitive completion.
-# CASE_SENSITIVE="true"
-
-# Uncomment the following line to use hyphen-insensitive completion.
-# Case-sensitive completion must be off. _ and - will be interchangeable.
-# HYPHEN_INSENSITIVE="true"
-
-# Uncomment one of the following lines to change the auto-update behavior
-# zstyle ':omz:update' mode disabled  # disable automatic updates
-# zstyle ':omz:update' mode auto      # update automatically without asking
-# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
-
-# Uncomment the following line to change how often to auto-update (in days).
-# zstyle ':omz:update' frequency 13
-
-# Uncomment the following line if pasting URLs and other text is messed up.
-# DISABLE_MAGIC_FUNCTIONS="true"
-
-# Uncomment the following line to disable colors in ls.
-# DISABLE_LS_COLORS="true"
-
-# Uncomment the following line to disable auto-setting terminal title.
-# DISABLE_AUTO_TITLE="true"
-
-# Uncomment the following line to enable command auto-correction.
-# ENABLE_CORRECTION="true"
-
-# Uncomment the following line to display red dots whilst waiting for completion.
-# You can also set it to another string to have that shown instead of the default red dots.
-# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
-# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
-# COMPLETION_WAITING_DOTS="true"
-
-# Uncomment the following line if you want to disable marking untracked files
-# under VCS as dirty. This makes repository status check for large repositories
-# much, much faster.
-# DISABLE_UNTRACKED_FILES_DIRTY="true"
-
-# Uncomment the following line if you want to change the command execution time
-# stamp shown in the history command output.
-# You can set one of the optional three formats:
-# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
-# or set a custom format using the strftime function format specifications,
-# see 'man strftime' for details.
-# HIST_STAMPS="mm/dd/yyyy"
-
-# Would you like to use another custom folder than $ZSH/custom?
-# ZSH_CUSTOM=/path/to/new-custom-folder
-
-# Which plugins would you like to load?
-# Standard plugins can be found in $ZSH/plugins/
-# Custom plugins may be added to $ZSH_CUSTOM/plugins/
-# Example format: plugins=(rails git textmate ruby lighthouse)
-# Add wisely, as too many plugins slow down shell startup.
-#plugins=(git)
-
-source $ZSH/oh-my-zsh.sh
-
-# User configuration
-
-# export MANPATH="/usr/local/man:$MANPATH"
-
-# You may need to manually set your language environment
-# export LANG=en_US.UTF-8
-
-# Preferred editor for local and remote sessions
-# if [[ -n $SSH_CONNECTION ]]; then
-#   export EDITOR='vim'
-# else
-#   export EDITOR='nvim'
-# fi
-
-# Compilation flags
-# export ARCHFLAGS="-arch $(uname -m)"
-
-# Set personal aliases, overriding those provided by Oh My Zsh libs,
-# plugins, and themes. Aliases can be placed here, though Oh My Zsh
-# users are encouraged to define aliases within a top-level file in
-# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
-# - $ZSH_CUSTOM/aliases.zsh
-# - $ZSH_CUSTOM/macos.zsh
-# For a full list of active aliases, run `alias`.
-#
-# Example aliases
-# alias zshconfig="mate ~/.zshrc"
-# alias ohmyzsh="mate ~/.oh-my-zsh"

roles/harden_ssh/files/hardened_sshd.conf

@@ -2,7 +2,7 @@ PubkeyAuthentication yes
 AuthorizedKeysFile	.ssh/authorized_keys
 PasswordAuthentication no
 KbdInteractiveAuthentication no
-UsePAM no
+UsePAM yes
 # Disable password authentication — keys only
 PasswordAuthentication no
 ChallengeResponseAuthentication no
@@ -26,4 +26,4 @@ MaxSessions 3
 # Use modern key exchange and ciphers, prioritize post-quantum algorithms (mlkem and sntrup)
 KexAlgorithms mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
-MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

roles/harden_ssh/handlers/main.yaml

@@ -0,0 +1,13 @@
+---
+
+- name: Restart ssh-server Debian
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
+  changed_when: false # It's just a handler, no need to increase 'changed' counter
+
+- name: Restart ssh-server Ubuntu
+  ansible.builtin.service:
+    name: ssh
+    state: restarted
+  changed_when: false

roles/harden_ssh/tasks/main.yaml

@@ -6,6 +6,7 @@
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
     mode: u=rw,g=r,o=r
   when: ansible_facts['distribution'] == 'Ubuntu'
+  notify: Restart ssh-server Ubuntu
 
 - name: Configure ssh-server daemon
   ansible.builtin.copy:
@@ -13,6 +14,7 @@
     dest: /etc/ssh/sshd_config.d/hardened_sshd.conf
     mode: u=rw,g=r,o=r
   when: ansible_facts['distribution'] == 'Debian'
+  notify: Restart ssh-server Debian
 
 - name: Configure ssh client
   remote_user: ansible
@@ -21,16 +23,16 @@
     dest: /etc/ssh/ssh_config.d/hardened_ssh.conf
     mode: u=rw,g=r,o=r
 
-- name: Restart ssh-server Debian
+    #- name: Restart ssh-server Debian
-  remote_user: ansible
+    #  remote_user: ansible
-  ansible.builtin.service:
+    #  ansible.builtin.service:
-    name: sshd
+    #    name: sshd
-    state: restarted
+    #    state: restarted
-  when: ansible_facts['distribution'] == 'Debian'
+    #  when: ansible_facts['distribution'] == 'Debian'
-
+    #
-- name: Restart ssh-server Ubuntu
+    #- name: Restart ssh-server Ubuntu
-  remote_user: ansible
+    #  remote_user: ansible
-  ansible.builtin.service:
+    #  ansible.builtin.service:
-    name: ssh
+    #    name: ssh
-    state: restarted
+    #    state: restarted
-  when: ansible_facts['distribution'] == 'Ubuntu'
+    #  when: ansible_facts['distribution'] == 'Ubuntu'

roles/human_admin_user/files/.zshrc

@@ -0,0 +1,13 @@
+export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
+# Path to your Oh My Zsh installation.
+export ZSH="$HOME/.oh-my-zsh"
+# GTK theme
+export GTK_THEME=Adwaita-dark
+# ZSH theme
+ZSH_THEME="gnzh"
+# OMZ updates
+zstyle ':omz:update' mode auto      # update automatically without asking
+zstyle ':omz:update' frequency 7
+
+
+source $ZSH/oh-my-zsh.sh

roles/human_admin_user/tasks/main.yaml

@@ -2,7 +2,7 @@
 - name: Create a new user with a password, set shell
   remote_user: ansible
   ansible.builtin.user:
-    name: max
+    name: "{{ human_admin_user }}"
     groups: sshusers,sudo
     password: "{{ user_passwd_hash }}"
     shell: /bin/zsh
@@ -10,7 +10,7 @@
 - name: Set authorized key taken from file
   remote_user: ansible
   ansible.posix.authorized_key:
-    user: max
+    user: "{{ human_admin_user }}"
     state: present
     key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
 
@@ -18,34 +18,34 @@
   remote_user: ansible
   ansible.builtin.copy:
     src: "{{ role_path }}/files/install_omz.sh"
-    dest: /home/max/install_omz.sh
+    dest: "/home/{{ human_admin_user }}/install_omz.sh"
-    owner: max
+    owner: "{{ human_admin_user }}"
-    group: max
+    group: "{{ human_admin_user }}"
     mode: u=rwx,g=r,o-rwx
 
 # WARNING: UNPRIVILEGED USER (not ansible) COMMANDS
 - name: Install oh my zsh
-  remote_user: max
+  remote_user: "{{ human_admin_user }}"
-  become: false
+  ansible.builtin.command: "/home/{{ human_admin_user }}/install_omz.sh"
-  ansible.builtin.command: /home/max/install_omz.sh
   changed_when: true
+  vars:
 
 - name: Configure oh my zsh, by pushing the config file
   remote_user: ansible
   ansible.builtin.copy:
     src: "{{ role_path }}/files/.zshrc"
-    dest: /home/max/.zshrc
+    dest: "/home/{{ human_admin_user }}/.zshrc"
-    owner: max
+    owner: "{{ human_admin_user }}"
-    group: max
+    group: "{{ human_admin_user }}"
     mode: u=rw,g=r,o-rwx
 
 - name: Configure vim, by pushing the config
   remote_user: ansible
   ansible.builtin.copy:
     src: "{{ role_path }}/files/.vimrc"
-    dest: /home/max/.vimrc
+    dest: "/home/{{ human_admin_user }}/.vimrc"
-    owner: max
+    owner: "{{ human_admin_user }}"
-    group: max
+    group: "{{ human_admin_user }}"
     mode: u=rw,g=r,o-rwx
 
 
@@ -54,13 +54,13 @@
 - name: Set authorized key taken from file
   remote_user: ansible
   ansible.posix.authorized_key:
-    user: max
+    user: "{{ human_admin_user }}"
     state: absent
     key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/ansible_key.pub') }}"
 
 - name: Set authorized key taken from file
   remote_user: ansible
   ansible.posix.authorized_key:
-    user: max
+    user: "{{ human_admin_user }}"
     state: present
     key: "{{ lookup('file', lookup('env', 'HOME') + '/.ssh/max_regular_key.pub') }}"

roles/update_configs/files/.zshrc

@@ -0,0 +1,13 @@
+export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:/home/max/soft/gnu_linux:$PATH
+# Path to your Oh My Zsh installation.
+export ZSH="$HOME/.oh-my-zsh"
+# GTK theme
+export GTK_THEME=Adwaita-dark
+# ZSH theme
+ZSH_THEME="gnzh"
+# OMZ updates
+zstyle ':omz:update' mode auto      # update automatically without asking
+zstyle ':omz:update' frequency 7
+
+
+source $ZSH/oh-my-zsh.sh

roles/update_configs/files/nvim_config/init.lua

@@ -0,0 +1,2 @@
+require("config.lazy")
+require("options")

roles/update_configs/files/nvim_config/lua/config/lazy.lua

@@ -0,0 +1,35 @@
+-- Bootstrap lazy.nvim
+local lazypath = vim.fn.stdpath("data") .. "/lazy/lazy.nvim"
+if not (vim.uv or vim.loop).fs_stat(lazypath) then
+  local lazyrepo = "https://github.com/folke/lazy.nvim.git"
+  local out = vim.fn.system({ "git", "clone", "--filter=blob:none", "--branch=stable", lazyrepo, lazypath })
+  if vim.v.shell_error ~= 0 then
+    vim.api.nvim_echo({
+      { "Failed to clone lazy.nvim:\n", "ErrorMsg" },
+      { out, "WarningMsg" },
+      { "\nPress any key to exit..." },
+    }, true, {})
+    vim.fn.getchar()
+    os.exit(1)
+  end
+end
+vim.opt.rtp:prepend(lazypath)
+
+-- Make sure to setup `mapleader` and `maplocalleader` before
+-- loading lazy.nvim so that mappings are correct.
+-- This is also a good place to setup other settings (vim.opt)
+vim.g.mapleader = " "
+vim.g.maplocalleader = "\\"
+
+-- Setup lazy.nvim
+require("lazy").setup({
+  spec = {
+    -- import your plugins
+    { import = "plugins" },
+  },
+  -- Configure any other settings here. See the documentation for more details.
+  -- colorscheme that will be used when installing plugins.
+  install = { colorscheme = { "habamax" } },
+  -- automatically check for plugin updates
+  checker = { enabled = true },
+})

roles/update_configs/files/nvim_config/lua/options.lua

@@ -0,0 +1,44 @@
+-- Use OSC52 only when we are in an SSH session
+-- Without this part clipboard via SSH doesn't work properly
+-- But if don't use SSH (X11 or Wayland session) then this part would only mess things up
+if vim.env.SSH_CLIENT or vim.env.SSH_TTY then
+  vim.g.clipboard = {
+    name = "OSC52",
+    copy = {
+      ["+"] = require("vim.ui.clipboard.osc52").copy("+"),
+      ["*"] = require("vim.ui.clipboard.osc52").copy("*"),
+    },
+    paste = {
+      ["+"] = require("vim.ui.clipboard.osc52").paste("+"),
+      ["*"] = require("vim.ui.clipboard.osc52").paste("*"),
+    },
+  }
+end
+
+vim.opt.clipboard = "unnamedplus"
+
+
+vim.opt.completeopt = {'menu', 'menuone', 'noselect'}
+
+-- Tab
+vim.opt.tabstop = 2                 -- number of visual spaces per TAB
+vim.opt.softtabstop = 2             -- number of spacesin tab when editing
+vim.opt.shiftwidth = 2              -- insert 2 spaces on a tab
+vim.opt.expandtab = true            -- tabs are spaces, mainly because of python
+
+-- UI config
+vim.opt.number = true               -- show absolute number
+vim.opt.cursorline = true           -- highlight cursor line underneath the cursor horizontally
+vim.opt.splitbelow = true           -- open new vertical split bottom
+vim.opt.splitright = true           -- open new horizontal splits right
+vim.opt.termguicolors = true        -- enable 24-bit RGB color in the TUI
+
+-- Searching
+vim.opt.incsearch = true            -- search as characters are entered
+vim.opt.hlsearch = true            -- do (not) highlight matches
+vim.opt.ignorecase = true           -- ignore case in searches by default
+vim.opt.smartcase = true            -- but make it case sensitive if an uppercase is entered
+
+-- Code folding
+vim.opt.foldmethod = "indent"
+

roles/update_configs/files/nvim_config/lua/plugins/autosave.lua

@@ -0,0 +1,15 @@
+return {
+  "okuuva/auto-save.nvim",
+  cmd = "ASToggle", -- optional for lazy loading on command
+  event = { "InsertLeave", "TextChanged" }, -- optional for lazy loading on trigger events
+  opts = {
+    -- your config goes here
+    -- or just leave it empty :)
+  },
+  keys = {
+    { "<leader>sa", ":ASToggle<CR>", desc = "Toggle auto-save" },
+  },
+  config = function()
+    require("auto-save").setup { enabled = true }
+  end,
+}

roles/update_configs/files/nvim_config/lua/plugins/colorscheme.lua

@@ -0,0 +1,66 @@
+return {
+  -- the colorscheme should be available when starting Neovim
+ {
+   'ribru17/bamboo.nvim',
+   lazy = false,
+   priority = 1000,
+   config = function()
+     require('bamboo').setup {
+       -- optional configuration here
+      }
+      require('bamboo').load()
+    end,
+  }, 
+
+  -- I have a separate config.mappings file where I require which-key.
+  -- With lazy the plugin will be automatically loaded when it is required somewhere
+  { "folke/which-key.nvim", lazy = true },
+
+  {
+    "dstein64/vim-startuptime",
+    -- lazy-load on a command
+    cmd = "StartupTime",
+    -- init is called during startup. Configuration for vim plugins typically should be set in an init function
+    init = function()
+      vim.g.startuptime_tries = 10
+    end,
+  },
+
+  {
+    "hrsh7th/nvim-cmp",
+    -- load cmp on InsertEnter
+    event = "InsertEnter",
+    -- these dependencies will only be loaded when cmp loads
+    -- dependencies are always lazy-loaded unless specified otherwise
+    dependencies = {
+      "hrsh7th/cmp-nvim-lsp",
+      "hrsh7th/cmp-buffer",
+    },
+    config = function()
+      -- ...
+    end,
+  },
+
+  -- if some code requires a module from an unloaded plugin, it will be automatically loaded.
+  -- So for api plugins like devicons, we can always set lazy=true
+  { "nvim-tree/nvim-web-devicons", lazy = true },
+
+  -- you can use the VeryLazy event for things that can
+  -- load later and are not important for the initial UI
+  { "stevearc/dressing.nvim", event = "VeryLazy" },
+
+  {
+    "Wansmer/treesj",
+    keys = {
+      { "J", "<cmd>TSJToggle<cr>", desc = "Join Toggle" },
+    },
+    opts = { use_default_keymaps = false, max_join_length = 150 },
+  },
+
+  {
+    "monaqa/dial.nvim",
+    -- lazy-load on keys
+    -- mode is `n` by default. For more advanced options, check the section on key mappings
+    keys = { "<C-a>", { "<C-x>", mode = "n" } },
+  },
+}

roles/update_configs/files/ranger_config/commands.py

@@ -0,0 +1,62 @@
+# This is a sample commands.py.  You can add your own commands here.
+#
+# Please refer to commands_full.py for all the default commands and a complete
+# documentation.  Do NOT add them all here, or you may end up with defunct
+# commands when upgrading ranger.
+
+# A simple command for demonstration purposes follows.
+# -----------------------------------------------------------------------------
+
+from __future__ import (absolute_import, division, print_function)
+
+# You can import any python module as needed.
+import os
+
+# You always need to import ranger.api.commands here to get the Command class:
+from ranger.api.commands import Command
+
+
+# Any class that is a subclass of "Command" will be integrated into ranger as a
+# command.  Try typing ":my_edit<ENTER>" in ranger!
+class my_edit(Command):
+    # The so-called doc-string of the class will be visible in the built-in
+    # help that is accessible by typing "?c" inside ranger.
+    """:my_edit <filename>
+
+    A sample command for demonstration purposes that opens a file in an editor.
+    """
+
+    # The execute method is called when you run this command in ranger.
+    def execute(self):
+        # self.arg(1) is the first (space-separated) argument to the function.
+        # This way you can write ":my_edit somefilename<ENTER>".
+        if self.arg(1):
+            # self.rest(1) contains self.arg(1) and everything that follows
+            target_filename = self.rest(1)
+        else:
+            # self.fm is a ranger.core.filemanager.FileManager object and gives
+            # you access to internals of ranger.
+            # self.fm.thisfile is a ranger.container.file.File object and is a
+            # reference to the currently selected file.
+            target_filename = self.fm.thisfile.path
+
+        # This is a generic function to print text in ranger.
+        self.fm.notify("Let's edit the file " + target_filename + "!")
+
+        # Using bad=True in fm.notify allows you to print error messages:
+        if not os.path.exists(target_filename):
+            self.fm.notify("The given file does not exist!", bad=True)
+            return
+
+        # This executes a function from ranger.core.acitons, a module with a
+        # variety of subroutines that can help you construct commands.
+        # Check out the source, or run "pydoc ranger.core.actions" for a list.
+        self.fm.edit_file(target_filename)
+
+    # The tab method is called when you press tab, and should return a list of
+    # suggestions that the user will tab through.
+    # tabnum is 1 for <TAB> and -1 for <S-TAB> by default
+    def tab(self, tabnum):
+        # This is a generic tab-completion function that iterates through the
+        # content of the current directory.
+        return self._tab_directory_content()

roles/update_configs/files/ranger_config/rc.conf

@@ -0,0 +1,759 @@
+# ===================================================================
+# This file contains the default startup commands for ranger.
+# To change them, it is recommended to create either /etc/ranger/rc.conf
+# (system-wide) or ~/.config/ranger/rc.conf (per user) and add your custom
+# commands there.
+#
+# If you copy this whole file there, you may want to set the environment
+# variable RANGER_LOAD_DEFAULT_RC to FALSE to avoid loading it twice.
+#
+# The purpose of this file is mainly to define keybindings and settings.
+# For running more complex python code, please create a plugin in "plugins/" or
+# a command in "commands.py".
+#
+# Each line is a command that will be run before the user interface
+# is initialized.  As a result, you can not use commands which rely
+# on the UI such as :delete or :mark.
+# ===================================================================
+
+# ===================================================================
+# == Options
+# ===================================================================
+
+# Which viewmode should be used?  Possible values are:
+#     miller: Use miller columns which show multiple levels of the hierarchy
+#     multipane: Midnight-commander like multipane view showing all tabs next
+#                to each other
+set viewmode miller
+#set viewmode multipane
+
+# How many columns are there, and what are their relative widths?
+set column_ratios 1,3,4
+
+# Which files should be hidden? (regular expression)
+set hidden_filter ^\.|\.(?:pyc|pyo|bak|swp)$|^lost\+found$|^__(py)?cache__$
+
+# Show hidden files? You can toggle this by typing 'zh'
+set show_hidden false
+
+# Ask for a confirmation when running the "delete" command?
+# Valid values are "always", "never", "multiple" (default)
+# With "multiple", ranger will ask only if you delete multiple files at once.
+set confirm_on_delete multiple
+
+# Use non-default path for file preview script?
+# ranger ships with scope.sh, a script that calls external programs (see
+# README.md for dependencies) to preview images, archives, etc.
+#set preview_script ~/.config/ranger/scope.sh
+
+# Use the external preview script or display simple plain text or image previews?
+set use_preview_script true
+
+# Automatically count files in the directory, even before entering them?
+set automatically_count_files true
+
+# Open all images in this directory when running certain image viewers
+# like feh or sxiv?  You can still open selected files by marking them.
+set open_all_images true
+
+# Be aware of version control systems and display information.
+set vcs_aware false
+
+# State of the four backends git, hg, bzr, svn. The possible states are
+# disabled, local (only show local info), enabled (show local and remote
+# information).
+set vcs_backend_git enabled
+set vcs_backend_hg disabled
+set vcs_backend_bzr disabled
+set vcs_backend_svn disabled
+
+# Truncate the long commit messages to this length when shown in the statusbar.
+set vcs_msg_length 50
+
+# Use one of the supported image preview protocols
+set preview_images false
+
+# Set the preview image method. Supported methods:
+#
+# * w3m (default):
+#   Preview images in full color with the external command "w3mimgpreview"?
+#   This requires the console web browser "w3m" and a supported terminal.
+#   It has been successfully tested with "xterm" and "urxvt" without tmux.
+#
+# * iterm2:
+#   Preview images in full color using iTerm2 image previews
+#   (http://iterm2.com/images.html). This requires using iTerm2 compiled
+#   with image preview support.
+#
+#   This feature relies on the dimensions of the terminal's font.  By default, a
+#   width of 8 and height of 11 are used.  To use other values, set the options
+#   iterm2_font_width and iterm2_font_height to the desired values.
+#
+# * terminology:
+#   Previews images in full color in the terminology terminal emulator.
+#   Supports a wide variety of formats, even vector graphics like svg.
+#
+# * urxvt:
+#   Preview images in full color using urxvt image backgrounds. This
+#   requires using urxvt compiled with pixbuf support.
+#
+# * urxvt-full:
+#   The same as urxvt but utilizing not only the preview pane but the
+#   whole terminal window.
+#
+# * kitty:
+#   Preview images in full color using kitty image protocol.
+#   Requires python PIL or pillow library.
+#   If ranger does not share the local filesystem with kitty
+#   the transfer method is changed to encode the whole image;
+#   while slower, this allows remote previews,
+#   for example during an ssh session.
+#   Tmux is unsupported.
+#
+# * ueberzug:
+#   Preview images in full color with the external command "ueberzug".
+#   Images are shown by using a child window.
+#   Only for users who run X11 in GNU/Linux.
+set preview_images_method w3m
+
+# Delay in seconds before displaying an image with the w3m method.
+# Increase it in case of experiencing display corruption.
+set w3m_delay 0.02
+
+# Manually adjust the w3mimg offset when using a terminal which needs this
+set w3m_offset 0
+
+# Default iTerm2 font size (see: preview_images_method: iterm2)
+set iterm2_font_width 8
+set iterm2_font_height 11
+
+# Use a unicode "..." character to mark cut-off filenames?
+set unicode_ellipsis false
+
+# BIDI support - try to properly display file names in RTL languages (Hebrew, Arabic).
+# Requires the python-bidi pip package
+set bidi_support false
+
+# Show dotfiles in the bookmark preview box?
+set show_hidden_bookmarks true
+
+# Which colorscheme to use?  These colorschemes are available by default:
+# default, jungle, snow, solarized
+set colorscheme default
+
+# Preview files on the rightmost column?
+# And collapse (shrink) the last column if there is nothing to preview?
+set preview_files true
+set preview_directories true
+set collapse_preview true
+
+# Wrap long lines in plain text previews?
+set wrap_plaintext_previews false
+
+# Save the console history on exit?
+set save_console_history true
+
+# Draw the status bar on top of the browser window (default: bottom)
+set status_bar_on_top false
+
+# Draw a progress bar in the status bar which displays the average state of all
+# currently running tasks which support progress bars?
+set draw_progress_bar_in_status_bar true
+
+# Draw borders around columns? (separators, outline, both, or none)
+# Separators are vertical lines between columns.
+# Outline draws a box around all the columns.
+# Both combines the two.
+set draw_borders none
+
+# Display the directory name in tabs?
+set dirname_in_tabs false
+
+# Enable the mouse support?
+set mouse_enabled true
+
+# Display the file size in the main column or status bar?
+set display_size_in_main_column true
+set display_size_in_status_bar true
+
+# Display the free disk space in the status bar?
+set display_free_space_in_status_bar true
+
+# Display files tags in all columns or only in main column?
+set display_tags_in_all_columns true
+
+# Set a title for the window? Updates both `WM_NAME` and `WM_ICON_NAME`
+set update_title false
+
+# Set the tmux/screen window-name to "ranger"?
+set update_tmux_title true
+
+# Shorten the title if it gets long?  The number defines how many
+# directories are displayed at once, 0 turns off this feature.
+set shorten_title 3
+
+# Show hostname in titlebar?
+set hostname_in_titlebar true
+
+# Abbreviate $HOME with ~ in the titlebar (first line) of ranger?
+set tilde_in_titlebar false
+
+# How many directory-changes or console-commands should be kept in history?
+set max_history_size 20
+set max_console_history_size 50
+
+# Try to keep so much space between the top/bottom border when scrolling:
+set scroll_offset 8
+
+# Flush the input after each key hit?  (Noticeable when ranger lags)
+set flushinput true
+
+# Padding on the right when there's no preview?
+# This allows you to click into the space to run the file.
+set padding_right true
+
+# Save bookmarks (used with mX and `X) instantly?
+# This helps to synchronize bookmarks between multiple ranger
+# instances but leads to *slight* performance loss.
+# When false, bookmarks are saved when ranger is exited.
+set autosave_bookmarks true
+
+# Save the "`" bookmark to disk.  This can be used to switch to the last
+# directory by typing "``".
+set save_backtick_bookmark true
+
+# You can display the "real" cumulative size of directories by using the
+# command :get_cumulative_size or typing "dc".  The size is expensive to
+# calculate and will not be updated automatically.  You can choose
+# to update it automatically though by turning on this option:
+set autoupdate_cumulative_size false
+
+# Turning this on makes sense for screen readers:
+set show_cursor false
+
+# One of: size, natural, basename, atime, ctime, mtime, type, random
+set sort natural
+
+# Additional sorting options
+set sort_reverse false
+set sort_case_insensitive true
+set sort_directories_first true
+set sort_unicode false
+
+# Enable this if key combinations with the Alt Key don't work for you.
+# (Especially on xterm)
+set xterm_alt_key false
+
+# Whether to include bookmarks in cd command
+set cd_bookmarks true
+
+# Changes case sensitivity for the cd command tab completion
+set cd_tab_case sensitive
+
+# Use fuzzy tab completion with the "cd" command. For example,
+# ":cd /u/lo/b<tab>" expands to ":cd /usr/local/bin".
+set cd_tab_fuzzy false
+
+# Avoid previewing files larger than this size, in bytes.  Use a value of 0 to
+# disable this feature.
+set preview_max_size 0
+
+# The key hint lists up to this size have their sublists expanded.
+# Otherwise the submaps are replaced with "...".
+set hint_collapse_threshold 10
+
+# Add the highlighted file to the path in the titlebar
+set show_selection_in_titlebar true
+
+# The delay that ranger idly waits for user input, in milliseconds, with a
+# resolution of 100ms.  Lower delay reduces lag between directory updates but
+# increases CPU load.
+set idle_delay 2000
+
+# When the metadata manager module looks for metadata, should it only look for
+# a ".metadata.json" file in the current directory, or do a deep search and
+# check all directories above the current one as well?
+set metadata_deep_search false
+
+# Clear all existing filters when leaving a directory
+set clear_filters_on_dir_change false
+
+# Disable displaying line numbers in main column.
+# Possible values: false, absolute, relative.
+set line_numbers false
+
+# When line_numbers=relative show the absolute line number in the
+# current line.
+set relative_current_zero false
+
+# Start line numbers from 1 instead of 0
+set one_indexed false
+
+# Save tabs on exit
+set save_tabs_on_exit false
+
+# Enable scroll wrapping - moving down while on the last item will wrap around to
+# the top and vice versa.
+set wrap_scroll false
+
+# Set the global_inode_type_filter to nothing.  Possible options: d, f and l for
+# directories, files and symlinks respectively.
+set global_inode_type_filter
+
+# This setting allows to freeze the list of files to save I/O bandwidth.  It
+# should be 'false' during start-up, but you can toggle it by pressing F.
+set freeze_files false
+
+# Print file sizes in bytes instead of the default human-readable format.
+set size_in_bytes false
+
+# Warn at startup if RANGER_LEVEL env var is greater than 0, in other words
+# give a warning when you nest ranger in a subshell started by ranger.
+# Special value "error" makes the warning more visible.
+set nested_ranger_warning true
+
+# ===================================================================
+# == Local Options
+# ===================================================================
+# You can set local options that only affect a single directory.
+
+# Examples:
+# setlocal path=~/downloads sort mtime
+
+# ===================================================================
+# == Command Aliases in the Console
+# ===================================================================
+
+alias e     edit
+alias q     quit
+alias q!    quit!
+alias qa    quitall
+alias qa!   quitall!
+alias qall  quitall
+alias qall! quitall!
+alias setl  setlocal
+
+alias filter     scout -prts
+alias find       scout -aets
+alias mark       scout -mr
+alias unmark     scout -Mr
+alias search     scout -rs
+alias search_inc scout -rts
+alias travel     scout -aefklst
+
+# ===================================================================
+# == Define keys for the browser
+# ===================================================================
+
+# Basic
+map     Q quitall
+map     q quit
+copymap q ZZ ZQ
+
+map R     reload_cwd
+map F     set freeze_files!
+map <C-r> reset
+map <C-l> redraw_window
+map <C-c> abort
+map <esc> change_mode normal
+map ~ set viewmode!
+
+map i display_file
+map <A-j> scroll_preview 1
+map <A-k> scroll_preview -1
+map ? help
+map W display_log
+map w taskview_open
+map S shell $SHELL
+
+map :  console
+map ;  console
+map !  console shell%space
+map @  console -p6 shell  %%s
+map #  console shell -p%space
+map s  console shell%space
+map r  chain draw_possible_programs; console open_with%space
+map f  console find%space
+map cd console cd%space
+
+map <C-p> chain console; eval fm.ui.console.history_move(-1)
+
+# Change the line mode
+map Mf linemode filename
+map Mi linemode fileinfo
+map Mm linemode mtime
+map Mh linemode humanreadablemtime
+map Mp linemode permissions
+map Ms linemode sizemtime
+map MH linemode sizehumanreadablemtime
+map Mt linemode metatitle
+
+# Tagging / Marking
+map t       tag_toggle
+map ut      tag_remove
+map "<any>  tag_toggle tag=%any
+map <Space> mark_files toggle=True
+map v       mark_files all=True toggle=True
+map uv      mark_files all=True val=False
+map V       toggle_visual_mode
+map uV      toggle_visual_mode reverse=True
+
+# For the nostalgics: Midnight Commander bindings
+map <F1> help
+map <F2> rename_append
+map <F3> display_file
+map <F4> edit
+map <F5> copy
+map <F6> cut
+map <F7> console mkdir%space
+map <F8> console delete
+#map <F8> console trash
+map <F10> exit
+
+# In case you work on a keyboard with dvorak layout
+map <UP>       move up=1
+map <DOWN>     move down=1
+map <LEFT>     move left=1
+map <RIGHT>    move right=1
+map <HOME>     move to=0
+map <END>      move to=-1
+map <PAGEDOWN> move down=1   pages=True
+map <PAGEUP>   move up=1     pages=True
+map <CR>       move right=1
+#map <DELETE>   console delete
+map <INSERT>   console touch%space
+
+# VIM-like
+copymap <UP>       k
+copymap <DOWN>     j
+copymap <LEFT>     h
+copymap <RIGHT>    l
+copymap <HOME>     gg
+copymap <END>      G
+copymap <PAGEDOWN> <C-F>
+copymap <PAGEUP>   <C-B>
+
+map J  move down=0.5  pages=True
+map K  move up=0.5    pages=True
+copymap J <C-D>
+copymap K <C-U>
+
+# Jumping around
+map H     history_go -1
+map L     history_go 1
+map ]     move_parent 1
+map [     move_parent -1
+map }     traverse
+map {     traverse_backwards
+map )     jump_non
+
+map gh cd ~
+map ge cd /etc
+map gu cd /usr
+map gd cd /dev
+map gl cd -r .
+map gL cd -r %f
+map go cd /opt
+map gv cd /var
+map gm cd /media
+map gi eval fm.cd('/run/media/' + os.getenv('USER'))
+map gM cd /mnt
+map gs cd /srv
+map gp cd /tmp
+map gr cd /
+map gR eval fm.cd(ranger.RANGERDIR)
+map g/ cd /
+map g? cd /usr/share/doc/ranger
+
+# External Programs
+map E  edit
+map du shell -p du --max-depth=1 -h --apparent-size
+map dU shell -p du --max-depth=1 -h --apparent-size | sort -rh
+map yp yank path
+map yd yank dir
+map yn yank name
+map y. yank name_without_extension
+
+# Filesystem Operations
+map =  chmod
+
+map cw console rename%space
+map a  rename_append
+map A  eval fm.open_console('rename ' + fm.thisfile.relative_path.replace("%", "%%"))
+map I  eval fm.open_console('rename ' + fm.thisfile.relative_path.replace("%", "%%"), position=7)
+
+map pp paste
+map po paste overwrite=True
+map pP paste append=True
+map pO paste overwrite=True append=True
+map pl paste_symlink relative=False
+map pL paste_symlink relative=True
+map phl paste_hardlink
+map pht paste_hardlinked_subtree
+map pd console paste dest=
+map p`<any> paste dest=%any_path
+map p'<any> paste dest=%any_path
+
+map dD console delete
+map dT console trash
+
+map dd cut
+map ud uncut
+map da cut mode=add
+map dr cut mode=remove
+map dt cut mode=toggle
+
+map yy copy
+map uy uncut
+map ya copy mode=add
+map yr copy mode=remove
+map yt copy mode=toggle
+
+# Temporary workarounds
+map dgg eval fm.cut(dirarg=dict(to=0), narg=quantifier)
+map dG  eval fm.cut(dirarg=dict(to=-1), narg=quantifier)
+map dj  eval fm.cut(dirarg=dict(down=1), narg=quantifier)
+map dk  eval fm.cut(dirarg=dict(up=1), narg=quantifier)
+map ygg eval fm.copy(dirarg=dict(to=0), narg=quantifier)
+map yG  eval fm.copy(dirarg=dict(to=-1), narg=quantifier)
+map yj  eval fm.copy(dirarg=dict(down=1), narg=quantifier)
+map yk  eval fm.copy(dirarg=dict(up=1), narg=quantifier)
+
+# Searching
+map /  console search%space
+map n  search_next
+map N  search_next forward=False
+map ct search_next order=tag
+map cs search_next order=size
+map ci search_next order=mimetype
+map cc search_next order=ctime
+map cm search_next order=mtime
+map ca search_next order=atime
+
+# Tabs
+map <C-n>     tab_new
+map <C-w>     tab_close
+map <TAB>     tab_move 1
+map <S-TAB>   tab_move -1
+map <A-Right> tab_move 1
+map <A-Left>  tab_move -1
+map gt        tab_move 1
+map gT        tab_move -1
+map gn        tab_new
+map gc        tab_close
+map uq        tab_restore
+map <a-1>     tab_open 1
+map <a-2>     tab_open 2
+map <a-3>     tab_open 3
+map <a-4>     tab_open 4
+map <a-5>     tab_open 5
+map <a-6>     tab_open 6
+map <a-7>     tab_open 7
+map <a-8>     tab_open 8
+map <a-9>     tab_open 9
+map <a-r>     tab_shift 1
+map <a-l>     tab_shift -1
+
+# Sorting
+map or set sort_reverse!
+map oz set sort=random
+map os chain set sort=size;      set sort_reverse=False
+map ob chain set sort=basename;  set sort_reverse=False
+map on chain set sort=natural;   set sort_reverse=False
+map om chain set sort=mtime;     set sort_reverse=False
+map oc chain set sort=ctime;     set sort_reverse=False
+map oa chain set sort=atime;     set sort_reverse=False
+map ot chain set sort=type;      set sort_reverse=False
+map oe chain set sort=extension; set sort_reverse=False
+
+map oS chain set sort=size;      set sort_reverse=True
+map oB chain set sort=basename;  set sort_reverse=True
+map oN chain set sort=natural;   set sort_reverse=True
+map oM chain set sort=mtime;     set sort_reverse=True
+map oC chain set sort=ctime;     set sort_reverse=True
+map oA chain set sort=atime;     set sort_reverse=True
+map oT chain set sort=type;      set sort_reverse=True
+map oE chain set sort=extension; set sort_reverse=True
+
+map dc get_cumulative_size
+
+# Settings
+map zc    set collapse_preview!
+map zd    set sort_directories_first!
+map zh    set show_hidden!
+map <C-h> set show_hidden!
+copymap <C-h> <backspace>
+copymap <backspace> <backspace2>
+map zI    set flushinput!
+map zi    set preview_images!
+map zm    set mouse_enabled!
+map zp    set preview_files!
+map zP    set preview_directories!
+map zs    set sort_case_insensitive!
+map zu    set autoupdate_cumulative_size!
+map zv    set use_preview_script!
+map zf    console filter%space
+copymap zf zz
+
+# Filter stack
+map .d filter_stack add type d
+map .f filter_stack add type f
+map .l filter_stack add type l
+map .m console filter_stack add mime%space
+map .n console filter_stack add name%space
+map .# console filter_stack add hash%space
+map ." filter_stack add duplicate
+map .' filter_stack add unique
+map .| filter_stack add or
+map .& filter_stack add and
+map .! filter_stack add not
+map .r filter_stack rotate
+map .c filter_stack clear
+map .* filter_stack decompose
+map .p filter_stack pop
+map .. filter_stack show
+
+# Bookmarks
+map `<any>  enter_bookmark %any
+map '<any>  enter_bookmark %any
+map m<any>  set_bookmark %any
+map um<any> unset_bookmark %any
+
+map m<bg>   draw_bookmarks
+copymap m<bg>  um<bg> `<bg> '<bg>
+
+# Generate all the chmod bindings with some python help:
+eval for arg in "rwxXst": cmd("map +u{0} shell -f chmod u+{0} %s".format(arg))
+eval for arg in "rwxXst": cmd("map +g{0} shell -f chmod g+{0} %s".format(arg))
+eval for arg in "rwxXst": cmd("map +o{0} shell -f chmod o+{0} %s".format(arg))
+eval for arg in "rwxXst": cmd("map +a{0} shell -f chmod a+{0} %s".format(arg))
+eval for arg in "rwxXst": cmd("map +{0}  shell -f chmod u+{0} %s".format(arg))
+
+eval for arg in "rwxXst": cmd("map -u{0} shell -f chmod u-{0} %s".format(arg))
+eval for arg in "rwxXst": cmd("map -g{0} shell -f chmod g-{0} %s".format(arg))
+eval for arg in "rwxXst": cmd("map -o{0} shell -f chmod o-{0} %s".format(arg))
+eval for arg in "rwxXst": cmd("map -a{0} shell -f chmod a-{0} %s".format(arg))
+eval for arg in "rwxXst": cmd("map -{0}  shell -f chmod u-{0} %s".format(arg))
+
+# ===================================================================
+# == Define keys for the console
+# ===================================================================
+# Note: Unmapped keys are passed directly to the console.
+
+# Basic
+cmap <tab>   eval fm.ui.console.tab()
+cmap <s-tab> eval fm.ui.console.tab(-1)
+cmap <ESC>   eval fm.ui.console.close()
+cmap <CR>    eval fm.ui.console.execute()
+cmap <C-l>   redraw_window
+
+copycmap <ESC> <C-c>
+copycmap <CR>  <C-j>
+
+# Move around
+cmap <up>    eval fm.ui.console.history_move(-1)
+cmap <down>  eval fm.ui.console.history_move(1)
+cmap <left>  eval fm.ui.console.move(left=1)
+cmap <right> eval fm.ui.console.move(right=1)
+cmap <home>  eval fm.ui.console.move(right=0, absolute=True)
+cmap <end>   eval fm.ui.console.move(right=-1, absolute=True)
+cmap <a-b> eval fm.ui.console.move_word(left=1)
+cmap <a-f> eval fm.ui.console.move_word(right=1)
+
+copycmap <a-b> <a-left>
+copycmap <a-f> <a-right>
+
+# Line Editing
+cmap <backspace>  eval fm.ui.console.delete(-1)
+cmap <delete>     eval fm.ui.console.delete(0)
+cmap <C-w>        eval fm.ui.console.delete_word()
+cmap <A-d>        eval fm.ui.console.delete_word(backward=False)
+cmap <C-k>        eval fm.ui.console.delete_rest(1)
+cmap <C-u>        eval fm.ui.console.delete_rest(-1)
+cmap <C-y>        eval fm.ui.console.paste()
+
+# And of course the emacs way
+copycmap <ESC>       <C-g>
+copycmap <up>        <C-p>
+copycmap <down>      <C-n>
+copycmap <left>      <C-b>
+copycmap <right>     <C-f>
+copycmap <home>      <C-a>
+copycmap <end>       <C-e>
+copycmap <delete>    <C-d>
+copycmap <backspace> <C-h>
+
+# Note: There are multiple ways to express backspaces.  <backspace> (code 263)
+# and <backspace2> (code 127).  To be sure, use both.
+copycmap <backspace> <backspace2>
+
+# This special expression allows typing in numerals:
+cmap <allow_quantifiers> false
+
+# ===================================================================
+# == Pager Keybindings
+# ===================================================================
+
+# Movement
+pmap  <down>      pager_move  down=1
+pmap  <up>        pager_move  up=1
+pmap  <left>      pager_move  left=4
+pmap  <right>     pager_move  right=4
+pmap  <home>      pager_move  to=0
+pmap  <end>       pager_move  to=-1
+pmap  <pagedown>  pager_move  down=1.0  pages=True
+pmap  <pageup>    pager_move  up=1.0    pages=True
+pmap  <C-d>       pager_move  down=0.5  pages=True
+pmap  <C-u>       pager_move  up=0.5    pages=True
+
+copypmap <UP>       k  <C-p>
+copypmap <DOWN>     j  <C-n> <CR>
+copypmap <LEFT>     h
+copypmap <RIGHT>    l
+copypmap <HOME>     g
+copypmap <END>      G
+copypmap <C-d>      d
+copypmap <C-u>      u
+copypmap <PAGEDOWN> n  f  <C-F>  <Space>
+copypmap <PAGEUP>   p  b  <C-B>
+
+# Basic
+pmap     <C-l> redraw_window
+pmap     <ESC> pager_close
+copypmap <ESC> q Q i <F3>
+pmap E      edit_file
+
+# ===================================================================
+# == Taskview Keybindings
+# ===================================================================
+
+# Movement
+tmap <up>        taskview_move up=1
+tmap <down>      taskview_move down=1
+tmap <home>      taskview_move to=0
+tmap <end>       taskview_move to=-1
+tmap <pagedown>  taskview_move down=1.0  pages=True
+tmap <pageup>    taskview_move up=1.0    pages=True
+tmap <C-d>       taskview_move down=0.5  pages=True
+tmap <C-u>       taskview_move up=0.5    pages=True
+
+copytmap <UP>       k  <C-p>
+copytmap <DOWN>     j  <C-n> <CR>
+copytmap <HOME>     g
+copytmap <END>      G
+copytmap <C-u>      u
+copytmap <PAGEDOWN> n  f  <C-F>  <Space>
+copytmap <PAGEUP>   p  b  <C-B>
+
+# Changing priority and deleting tasks
+tmap J          eval -q fm.ui.taskview.task_move(-1)
+tmap K          eval -q fm.ui.taskview.task_move(0)
+tmap dd         eval -q fm.ui.taskview.task_remove()
+tmap <pagedown> eval -q fm.ui.taskview.task_move(-1)
+tmap <pageup>   eval -q fm.ui.taskview.task_move(0)
+tmap <delete>   eval -q fm.ui.taskview.task_remove()
+
+# Basic
+tmap <C-l> redraw_window
+tmap <ESC> taskview_close
+copytmap <ESC> q Q w <C-c>

roles/update_configs/files/ranger_config/rifle.conf

@@ -0,0 +1,272 @@
+# vim: ft=cfg
+#
+# This is the configuration file of "rifle", ranger's file executor/opener.
+# Each line consists of conditions and a command.  For each line the conditions
+# are checked and if they are met, the respective command is run.
+#
+# Syntax:
+#   <condition1> , <condition2> , ... = command
+#
+# The command can contain these environment variables:
+#   $1-$9 | The n-th selected file
+#   $@    | All selected files
+#
+# If you use the special command "ask", rifle will ask you what program to run.
+#
+# Prefixing a condition with "!" will negate its result.
+# These conditions are currently supported:
+#   match <regexp> | The regexp matches $1
+#   ext <regexp>   | The regexp matches the extension of $1
+#   mime <regexp>  | The regexp matches the mime type of $1
+#   name <regexp>  | The regexp matches the basename of $1
+#   path <regexp>  | The regexp matches the absolute path of $1
+#   has <program>  | The program is installed (i.e. located in $PATH)
+#   env <variable> | The environment variable "variable" is non-empty
+#   file           | $1 is a file
+#   directory      | $1 is a directory
+#   number <n>     | change the number of this command to n
+#   terminal       | stdin, stderr and stdout are connected to a terminal
+#   X              | A graphical environment is available (darwin, Xorg, or Wayland)
+#
+# There are also pseudo-conditions which have a "side effect":
+#   flag <flags>  | Change how the program is run. See below.
+#   label <label> | Assign a label or name to the command so it can
+#                 | be started with :open_with <label> in ranger
+#                 | or `rifle -p <label>` in the standalone executable.
+#   else          | Always true.
+#
+# Flags are single characters which slightly transform the command:
+#   f | Fork the program, make it run in the background.
+#     |   New command = setsid $command >& /dev/null &
+#   r | Execute the command with root permissions
+#     |   New command = sudo $command
+#   t | Run the program in a new terminal.  If $TERMCMD is not defined,
+#     | rifle will attempt to extract it from $TERM.
+#     |   New command = $TERMCMD -e $command
+# Note: The "New command" serves only as an illustration, the exact
+# implementation may differ.
+# Note: When using rifle in ranger, there is an additional flag "c" for
+# only running the current file even if you have marked multiple files.
+
+#-------------------------------------------
+# Websites
+#-------------------------------------------
+# Rarely installed browsers get higher priority; It is assumed that if you
+# install a rare browser, you probably use it.  Firefox/konqueror/w3m on the
+# other hand are often only installed as fallback browsers.
+ext x?html?, has surf,             X, flag f = surf -- file://"$1"
+ext x?html?, has vimprobable,      X, flag f = vimprobable -- "$@"
+ext x?html?, has vimprobable2,     X, flag f = vimprobable2 -- "$@"
+ext x?html?, has qutebrowser,      X, flag f = qutebrowser -- "$@"
+ext x?html?, has dwb,              X, flag f = dwb -- "$@"
+ext x?html?, has jumanji,          X, flag f = jumanji -- "$@"
+ext x?html?, has luakit,           X, flag f = luakit -- "$@"
+ext x?html?, has uzbl,             X, flag f = uzbl -- "$@"
+ext x?html?, has uzbl-tabbed,      X, flag f = uzbl-tabbed -- "$@"
+ext x?html?, has uzbl-browser,     X, flag f = uzbl-browser -- "$@"
+ext x?html?, has uzbl-core,        X, flag f = uzbl-core -- "$@"
+ext x?html?, has midori,           X, flag f = midori -- "$@"
+ext x?html?, has opera,            X, flag f = opera -- "$@"
+ext x?html?, has firefox,          X, flag f = firefox -- "$@"
+ext x?html?, has seamonkey,        X, flag f = seamonkey -- "$@"
+ext x?html?, has iceweasel,        X, flag f = iceweasel -- "$@"
+ext x?html?, has chromium-browser, X, flag f = chromium-browser -- "$@"
+ext x?html?, has chromium,         X, flag f = chromium -- "$@"
+ext x?html?, has google-chrome,    X, flag f = google-chrome -- "$@"
+ext x?html?, has epiphany,         X, flag f = epiphany -- "$@"
+ext x?html?, has konqueror,        X, flag f = konqueror -- "$@"
+ext x?html?, has elinks,            terminal = elinks "$@"
+ext x?html?, has links2,            terminal = links2 "$@"
+ext x?html?, has links,             terminal = links "$@"
+ext x?html?, has lynx,              terminal = lynx -- "$@"
+ext x?html?, has w3m,               terminal = w3m "$@"
+
+#-------------------------------------------
+# Misc
+#-------------------------------------------
+# Define the "editor" for text files as first action
+mime ^text,  label editor = ${VISUAL:-$EDITOR} -- "$@"
+mime ^text,  label pager  = "$PAGER" -- "$@"
+!mime ^text, label editor, ext yml|yaml|xml|json|csv|tex|py|pl|rb|js|sh|php = ${VISUAL:-$EDITOR} -- "$@"
+!mime ^text, label pager,  ext yml|yaml|xml|json|csv|tex|py|pl|rb|js|sh|php = "$PAGER" -- "$@"
+
+ext 1                         = man "$1"
+ext s[wmf]c, has zsnes, X     = zsnes "$1"
+ext s[wmf]c, has snes9x-gtk,X = snes9x-gtk "$1"
+ext nes, has fceux, X         = fceux "$1"
+ext exe                       = wine "$1"
+name ^[mM]akefile$            = make
+
+#--------------------------------------------
+# Scripts
+#-------------------------------------------
+ext py  = python3 -- "$1"
+ext pl  = perl -- "$1"
+ext rb  = ruby -- "$1"
+ext js  = node -- "$1"
+ext sh  = sh -- "$1"
+ext php = php -- "$1"
+
+#--------------------------------------------
+# Audio without X
+#-------------------------------------------
+mime ^audio|ogg$, terminal, has mpv      = mpv --no-audio-display -- "$@"
+mime ^audio|ogg$, terminal, has mpv      = mpv --no-audio-display --shuffle -- "$@"
+ext midi?,        terminal, has wildmidi = wildmidi -- "$@"
+
+#--------------------------------------------
+# Video/Audio with a GUI
+#-------------------------------------------
+mime ^video,       has mpv,      X, flag f = mpv --no-audio-display -- "$@"
+mime ^video,       has mpv,      X, flag f = mpv --shuffle --no-audio-display -- "$@"
+mime ^video,       has mpv,      X, flag f = mpv --fs -- "$@"
+mime ^video|audio, has vlc,      X, flag f = vlc -- "$@"
+
+#--------------------------------------------
+# Video without X
+#-------------------------------------------
+mime ^video, terminal, !X, has mpv       = mpv -- "$@"
+
+#-------------------------------------------
+# Documents
+#-------------------------------------------
+ext pdf, has llpp,     X, flag f = llpp "$@"
+ext pdf, has zathura,  X, flag f = zathura -- "$@"
+ext pdf, has mupdf,    X, flag f = mupdf "$@"
+ext pdf, has mupdf-x11,X, flag f = mupdf-x11 "$@"
+ext pdf, has apvlv,    X, flag f = apvlv -- "$@"
+ext pdf, has xpdf,     X, flag f = xpdf -- "$@"
+ext pdf, has evince,   X, flag f = evince -- "$@"
+ext pdf, has atril,    X, flag f = atril -- "$@"
+ext pdf, has okular,   X, flag f = okular -- "$@"
+ext pdf, has epdfview, X, flag f = epdfview -- "$@"
+ext pdf, has qpdfview, X, flag f = qpdfview "$@"
+ext pdf, has open,     X, flag f = open "$@"
+
+ext                        sxc|xlsx?|xlt|xlw|gnm|gnumeric, has gnumeric,    X, flag f = gnumeric -- "$@"
+ext                        sxc|xlsx?|xlt|xlw|gnm|gnumeric, has kspread,     X, flag f = kspread -- "$@"
+ext pptx?|od[dfgpst]|docx?|sxc|xlsx?|xlt|xlw|gnm|gnumeric, has libreoffice, X, flag f = libreoffice "$@"
+ext pptx?|od[dfgpst]|docx?|sxc|xlsx?|xlt|xlw|gnm|gnumeric, has soffice,     X, flag f = soffice "$@"
+ext pptx?|od[dfgpst]|docx?|sxc|xlsx?|xlt|xlw|gnm|gnumeric, has ooffice,     X, flag f = ooffice "$@"
+
+ext djvu, has zathura,X, flag f = zathura -- "$@"
+ext djvu, has evince, X, flag f = evince -- "$@"
+ext djvu, has atril,  X, flag f = atril -- "$@"
+ext djvu, has djview, X, flag f = djview -- "$@"
+
+ext epub, has ebook-viewer, X, flag f = ebook-viewer -- "$@"
+ext epub, has zathura,      X, flag f = zathura -- "$@"
+ext epub, has mupdf,        X, flag f = mupdf -- "$@"
+ext mobi, has ebook-viewer, X, flag f = ebook-viewer -- "$@"
+
+ext cbr,  has zathura,      X, flag f = zathura -- "$@"
+ext cbz,  has zathura,      X, flag f = zathura -- "$@"
+
+#-------------------------------------------
+# Images
+#-------------------------------------------
+mime ^image/svg, has inkscape, X, flag f = inkscape -- "$@"
+mime ^image/svg, has display,  X, flag f = display -- "$@"
+
+mime ^image, has imv,       X, flag f = /usr/libexec/imv/imv -- "$@"
+mime ^image, has pqiv,      X, flag f = pqiv -- "$@"
+mime ^image, has sxiv,      X, flag f = sxiv -- "$@"
+mime ^image, has feh,       X, flag f = feh -- "$@"
+mime ^image, has mirage,    X, flag f = mirage -- "$@"
+mime ^image, has ristretto, X, flag f = ristretto "$@"
+mime ^image, has eog,       X, flag f = eog -- "$@"
+mime ^image, has eom,       X, flag f = eom -- "$@"
+mime ^image, has nomacs,    X, flag f = nomacs -- "$@"
+mime ^image, has geeqie,    X, flag f = geeqie -- "$@"
+mime ^image, has gpicview,  X, flag f = gpicview -- "$@"
+mime ^image, has gwenview,  X, flag f = gwenview -- "$@"
+mime ^image, has gimp,      X, flag f = gimp -- "$@"
+ext xcf,                    X, flag f = gimp -- "$@"
+
+#-------------------------------------------
+# Archives
+#-------------------------------------------
+
+# avoid password prompt by providing empty password
+ext 7z, has 7z = 7z -p l "$@" | "$PAGER"
+# This requires atool
+ext ace|ar|arc|bz2?|cab|cpio|cpt|deb|dgc|dmg|gz,     has atool = atool --list --each -- "$@" | "$PAGER"
+ext iso|jar|msi|pkg|rar|shar|tar|tgz|xar|xpi|xz|zip, has atool = atool --list --each -- "$@" | "$PAGER"
+ext 7z|ace|ar|arc|bz2?|cab|cpio|cpt|deb|dgc|dmg|gz,  has atool = atool --extract --each -- "$@"
+ext iso|jar|msi|pkg|rar|shar|tar|tgz|xar|xpi|xz|zip, has atool = atool --extract --each -- "$@"
+
+# Listing and extracting archives without atool:
+ext tar|gz|bz2|xz, has tar = tar vvtf "$1" | "$PAGER"
+ext tar|gz|bz2|xz, has tar = for file in "$@"; do tar vvxf "$file"; done
+ext bz2, has bzip2 = for file in "$@"; do bzip2 -dk "$file"; done
+ext zip, has unzip = unzip -l "$1" | "$PAGER"
+ext zip, has unzip = for file in "$@"; do unzip -d "${file%.*}" "$file"; done
+ext ace, has unace = unace l "$1" | "$PAGER"
+ext ace, has unace = for file in "$@"; do unace e "$file"; done
+ext rar, has unrar = unrar l "$1" | "$PAGER"
+ext rar, has unrar = for file in "$@"; do unrar x "$file"; done
+
+#-------------------------------------------
+# Fonts
+#-------------------------------------------
+mime ^font, has fontforge, X, flag f = fontforge "$@"
+
+#-------------------------------------------
+# Flag t fallback terminals
+#-------------------------------------------
+# Rarely installed terminal emulators get higher priority; It is assumed that
+# if you install a rare terminal emulator, you probably use it.
+# gnome-terminal/konsole/xterm on the other hand are often installed as part of
+# a desktop environment or as fallback terminal emulators.
+mime ^ranger/x-terminal-emulator, has terminology = terminology -e "$@"
+mime ^ranger/x-terminal-emulator, has kitty = kitty -- "$@"
+mime ^ranger/x-terminal-emulator, has alacritty = alacritty -e "$@"
+mime ^ranger/x-terminal-emulator, has sakura = sakura -e "$@"
+mime ^ranger/x-terminal-emulator, has lilyterm = lilyterm -e "$@"
+#mime ^ranger/x-terminal-emulator, has cool-retro-term = cool-retro-term -e "$@"
+mime ^ranger/x-terminal-emulator, has termite = termite -x '"$@"'
+#mime ^ranger/x-terminal-emulator, has yakuake = yakuake -e "$@"
+mime ^ranger/x-terminal-emulator, has guake = guake -ne "$@"
+mime ^ranger/x-terminal-emulator, has tilda = tilda -c "$@"
+mime ^ranger/x-terminal-emulator, has st = st -e "$@"
+mime ^ranger/x-terminal-emulator, has terminator = terminator -x "$@"
+mime ^ranger/x-terminal-emulator, has urxvt = urxvt -e "$@"
+mime ^ranger/x-terminal-emulator, has pantheon-terminal = pantheon-terminal -e "$@"
+mime ^ranger/x-terminal-emulator, has lxterminal = lxterminal -e "$@"
+mime ^ranger/x-terminal-emulator, has mate-terminal = mate-terminal -x "$@"
+mime ^ranger/x-terminal-emulator, has xfce4-terminal = xfce4-terminal -x "$@"
+mime ^ranger/x-terminal-emulator, has konsole = konsole -e "$@"
+mime ^ranger/x-terminal-emulator, has gnome-terminal = gnome-terminal -- "$@"
+mime ^ranger/x-terminal-emulator, has xterm = xterm -e "$@"
+
+#-------------------------------------------
+# Misc
+#-------------------------------------------
+label wallpaper, number 11, mime ^image, has feh, X = feh --bg-scale "$1"
+label wallpaper, number 12, mime ^image, has feh, X = feh --bg-tile "$1"
+label wallpaper, number 13, mime ^image, has feh, X = feh --bg-center "$1"
+label wallpaper, number 14, mime ^image, has feh, X = feh --bg-fill "$1"
+
+#-------------------------------------------
+# Generic file openers
+#-------------------------------------------
+label open, has xdg-open = xdg-open -- "$@"
+label open, has open     = open -- "$@"
+
+# Define the editor for non-text files + pager as last action
+              !mime ^text, !ext xml|json|csv|tex|py|pl|rb|js|sh|php  = ask
+label editor, !mime ^text, !ext xml|json|csv|tex|py|pl|rb|js|sh|php  = ${VISUAL:-$EDITOR} -- "$@"
+label pager,  !mime ^text, !ext xml|json|csv|tex|py|pl|rb|js|sh|php  = "$PAGER" -- "$@"
+
+
+######################################################################
+# The actions below are left so low down in this file on purpose, so #
+# they are never triggered accidentally.                             #
+######################################################################
+
+# Execute a file as program/script.
+mime application/x-executable = "$1"
+
+# Move the file to trash using trash-cli.
+label trash, has trash-put = trash-put -- "$@"
+label trash = mkdir -p -- ${XDG_DATA_DIR:-$HOME/.ranger}/ranger-trash; mv -- "$@" ${XDG_DATA_DIR:-$HOME/.ranger}/ranger-trash

roles/update_configs/files/ranger_config/scope.sh

@@ -0,0 +1,349 @@
+#!/usr/bin/env bash
+
+set -o noclobber -o noglob -o nounset -o pipefail
+IFS=$'\n'
+
+## If the option `use_preview_script` is set to `true`,
+## then this script will be called and its output will be displayed in ranger.
+## ANSI color codes are supported.
+## STDIN is disabled, so interactive scripts won't work properly
+
+## This script is considered a configuration file and must be updated manually.
+## It will be left untouched if you upgrade ranger.
+
+## Because of some automated testing we do on the script #'s for comments need
+## to be doubled up. Code that is commented out, because it's an alternative for
+## example, gets only one #.
+
+## Meanings of exit codes:
+## code | meaning    | action of ranger
+## -----+------------+-------------------------------------------
+## 0    | success    | Display stdout as preview
+## 1    | no preview | Display no preview at all
+## 2    | plain text | Display the plain content of the file
+## 3    | fix width  | Don't reload when width changes
+## 4    | fix height | Don't reload when height changes
+## 5    | fix both   | Don't ever reload
+## 6    | image      | Display the image `$IMAGE_CACHE_PATH` points to as an image preview
+## 7    | image      | Display the file directly as an image
+
+## Script arguments
+FILE_PATH="${1}"         # Full path of the highlighted file
+PV_WIDTH="${2}"          # Width of the preview pane (number of fitting characters)
+## shellcheck disable=SC2034 # PV_HEIGHT is provided for convenience and unused
+PV_HEIGHT="${3}"         # Height of the preview pane (number of fitting characters)
+IMAGE_CACHE_PATH="${4}"  # Full path that should be used to cache image preview
+PV_IMAGE_ENABLED="${5}"  # 'True' if image previews are enabled, 'False' otherwise.
+
+FILE_EXTENSION="${FILE_PATH##*.}"
+FILE_EXTENSION_LOWER="$(printf "%s" "${FILE_EXTENSION}" | tr '[:upper:]' '[:lower:]')"
+
+## Settings
+HIGHLIGHT_SIZE_MAX=262143  # 256KiB
+HIGHLIGHT_TABWIDTH=${HIGHLIGHT_TABWIDTH:-8}
+HIGHLIGHT_STYLE=${HIGHLIGHT_STYLE:-pablo}
+HIGHLIGHT_OPTIONS="--replace-tabs=${HIGHLIGHT_TABWIDTH} --style=${HIGHLIGHT_STYLE} ${HIGHLIGHT_OPTIONS:-}"
+PYGMENTIZE_STYLE=${PYGMENTIZE_STYLE:-autumn}
+OPENSCAD_IMGSIZE=${RNGR_OPENSCAD_IMGSIZE:-1000,1000}
+OPENSCAD_COLORSCHEME=${RNGR_OPENSCAD_COLORSCHEME:-Tomorrow Night}
+
+handle_extension() {
+    case "${FILE_EXTENSION_LOWER}" in
+        ## Archive
+        a|ace|alz|arc|arj|bz|bz2|cab|cpio|deb|gz|jar|lha|lz|lzh|lzma|lzo|\
+        rpm|rz|t7z|tar|tbz|tbz2|tgz|tlz|txz|tZ|tzo|war|xpi|xz|Z|zip)
+            atool --list -- "${FILE_PATH}" && exit 5
+            bsdtar --list --file "${FILE_PATH}" && exit 5
+            exit 1;;
+        rar)
+            ## Avoid password prompt by providing empty password
+            unrar lt -p- -- "${FILE_PATH}" && exit 5
+            exit 1;;
+        7z)
+            ## Avoid password prompt by providing empty password
+            7z l -p -- "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## PDF
+        pdf)
+            ## Preview as text conversion
+            pdftotext -l 10 -nopgbrk -q -- "${FILE_PATH}" - | \
+              fmt -w "${PV_WIDTH}" && exit 5
+            mutool draw -F txt -i -- "${FILE_PATH}" 1-10 | \
+              fmt -w "${PV_WIDTH}" && exit 5
+            exiftool "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## BitTorrent
+        torrent)
+            transmission-show -- "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## OpenDocument
+        odt|ods|odp|sxw)
+            ## Preview as text conversion
+            odt2txt "${FILE_PATH}" && exit 5
+            ## Preview as markdown conversion
+            pandoc -s -t markdown -- "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## XLSX
+        xlsx)
+            ## Preview as csv conversion
+            ## Uses: https://github.com/dilshod/xlsx2csv
+            xlsx2csv -- "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## HTML
+        htm|html|xhtml)
+            ## Preview as text conversion
+            w3m -dump "${FILE_PATH}" && exit 5
+            lynx -dump -- "${FILE_PATH}" && exit 5
+            elinks -dump "${FILE_PATH}" && exit 5
+            pandoc -s -t markdown -- "${FILE_PATH}" && exit 5
+            ;;
+
+        ## JSON
+        json)
+            jq --color-output . "${FILE_PATH}" && exit 5
+            python -m json.tool -- "${FILE_PATH}" && exit 5
+            ;;
+
+        ## Direct Stream Digital/Transfer (DSDIFF) and wavpack aren't detected
+        ## by file(1).
+        dff|dsf|wv|wvc)
+            mediainfo "${FILE_PATH}" && exit 5
+            exiftool "${FILE_PATH}" && exit 5
+            ;; # Continue with next handler on failure
+    esac
+}
+
+handle_image() {
+    ## Size of the preview if there are multiple options or it has to be
+    ## rendered from vector graphics. If the conversion program allows
+    ## specifying only one dimension while keeping the aspect ratio, the width
+    ## will be used.
+    local DEFAULT_SIZE="1920x1080"
+
+    local mimetype="${1}"
+    case "${mimetype}" in
+        ## SVG
+        # image/svg+xml|image/svg)
+        #     convert -- "${FILE_PATH}" "${IMAGE_CACHE_PATH}" && exit 6
+        #     exit 1;;
+
+        ## DjVu
+        # image/vnd.djvu)
+        #     ddjvu -format=tiff -quality=90 -page=1 -size="${DEFAULT_SIZE}" \
+        #           - "${IMAGE_CACHE_PATH}" < "${FILE_PATH}" \
+        #           && exit 6 || exit 1;;
+
+        ## Image
+        image/*)
+            local orientation
+            orientation="$( identify -format '%[EXIF:Orientation]\n' -- "${FILE_PATH}" )"
+            ## If orientation data is present and the image actually
+            ## needs rotating ("1" means no rotation)...
+            if [[ -n "$orientation" && "$orientation" != 1 ]]; then
+                ## ...auto-rotate the image according to the EXIF data.
+                convert -- "${FILE_PATH}" -auto-orient "${IMAGE_CACHE_PATH}" && exit 6
+            fi
+
+            ## `w3mimgdisplay` will be called for all images (unless overriden
+            ## as above), but might fail for unsupported types.
+            exit 7;;
+
+        ## Video
+        # video/*)
+        #     # Thumbnail
+        #     ffmpegthumbnailer -i "${FILE_PATH}" -o "${IMAGE_CACHE_PATH}" -s 0 && exit 6
+        #     exit 1;;
+
+        ## PDF
+        # application/pdf)
+        #     pdftoppm -f 1 -l 1 \
+        #              -scale-to-x "${DEFAULT_SIZE%x*}" \
+        #              -scale-to-y -1 \
+        #              -singlefile \
+        #              -jpeg -tiffcompression jpeg \
+        #              -- "${FILE_PATH}" "${IMAGE_CACHE_PATH%.*}" \
+        #         && exit 6 || exit 1;;
+
+
+        ## ePub, MOBI, FB2 (using Calibre)
+        # application/epub+zip|application/x-mobipocket-ebook|\
+        # application/x-fictionbook+xml)
+        #     # ePub (using https://github.com/marianosimone/epub-thumbnailer)
+        #     epub-thumbnailer "${FILE_PATH}" "${IMAGE_CACHE_PATH}" \
+        #         "${DEFAULT_SIZE%x*}" && exit 6
+        #     ebook-meta --get-cover="${IMAGE_CACHE_PATH}" -- "${FILE_PATH}" \
+        #         >/dev/null && exit 6
+        #     exit 1;;
+
+        ## Font
+        application/font*|application/*opentype)
+            preview_png="/tmp/$(basename "${IMAGE_CACHE_PATH%.*}").png"
+            if fontimage -o "${preview_png}" \
+                         --pixelsize "120" \
+                         --fontname \
+                         --pixelsize "80" \
+                         --text "  ABCDEFGHIJKLMNOPQRSTUVWXYZ  " \
+                         --text "  abcdefghijklmnopqrstuvwxyz  " \
+                         --text "  0123456789.:,;(*!?') ff fl fi ffi ffl  " \
+                         --text "  The quick brown fox jumps over the lazy dog.  " \
+                         "${FILE_PATH}";
+            then
+                convert -- "${preview_png}" "${IMAGE_CACHE_PATH}" \
+                    && rm "${preview_png}" \
+                    && exit 6
+            else
+                exit 1
+            fi
+            ;;
+
+        ## Preview archives using the first image inside.
+        ## (Very useful for comic book collections for example.)
+        # application/zip|application/x-rar|application/x-7z-compressed|\
+        #     application/x-xz|application/x-bzip2|application/x-gzip|application/x-tar)
+        #     local fn=""; local fe=""
+        #     local zip=""; local rar=""; local tar=""; local bsd=""
+        #     case "${mimetype}" in
+        #         application/zip) zip=1 ;;
+        #         application/x-rar) rar=1 ;;
+        #         application/x-7z-compressed) ;;
+        #         *) tar=1 ;;
+        #     esac
+        #     { [ "$tar" ] && fn=$(tar --list --file "${FILE_PATH}"); } || \
+        #     { fn=$(bsdtar --list --file "${FILE_PATH}") && bsd=1 && tar=""; } || \
+        #     { [ "$rar" ] && fn=$(unrar lb -p- -- "${FILE_PATH}"); } || \
+        #     { [ "$zip" ] && fn=$(zipinfo -1 -- "${FILE_PATH}"); } || return
+        #
+        #     fn=$(echo "$fn" | python -c "import sys; import mimetypes as m; \
+        #             [ print(l, end='') for l in sys.stdin if \
+        #               (m.guess_type(l[:-1])[0] or '').startswith('image/') ]" |\
+        #         sort -V | head -n 1)
+        #     [ "$fn" = "" ] && return
+        #     [ "$bsd" ] && fn=$(printf '%b' "$fn")
+        #
+        #     [ "$tar" ] && tar --extract --to-stdout \
+        #         --file "${FILE_PATH}" -- "$fn" > "${IMAGE_CACHE_PATH}" && exit 6
+        #     fe=$(echo -n "$fn" | sed 's/[][*?\]/\\\0/g')
+        #     [ "$bsd" ] && bsdtar --extract --to-stdout \
+        #         --file "${FILE_PATH}" -- "$fe" > "${IMAGE_CACHE_PATH}" && exit 6
+        #     [ "$bsd" ] || [ "$tar" ] && rm -- "${IMAGE_CACHE_PATH}"
+        #     [ "$rar" ] && unrar p -p- -inul -- "${FILE_PATH}" "$fn" > \
+        #         "${IMAGE_CACHE_PATH}" && exit 6
+        #     [ "$zip" ] && unzip -pP "" -- "${FILE_PATH}" "$fe" > \
+        #         "${IMAGE_CACHE_PATH}" && exit 6
+        #     [ "$rar" ] || [ "$zip" ] && rm -- "${IMAGE_CACHE_PATH}"
+        #     ;;
+    esac
+
+    # openscad_image() {
+    #     TMPPNG="$(mktemp -t XXXXXX.png)"
+    #     openscad --colorscheme="${OPENSCAD_COLORSCHEME}" \
+    #         --imgsize="${OPENSCAD_IMGSIZE/x/,}" \
+    #         -o "${TMPPNG}" "${1}"
+    #     mv "${TMPPNG}" "${IMAGE_CACHE_PATH}"
+    # }
+
+    # case "${FILE_EXTENSION_LOWER}" in
+    #     ## 3D models
+    #     ## OpenSCAD only supports png image output, and ${IMAGE_CACHE_PATH}
+    #     ## is hardcoded as jpeg. So we make a tempfile.png and just
+    #     ## move/rename it to jpg. This works because image libraries are
+    #     ## smart enough to handle it.
+    #     csg|scad)
+    #         openscad_image "${FILE_PATH}" && exit 6
+    #         ;;
+    #     3mf|amf|dxf|off|stl)
+    #         openscad_image <(echo "import(\"${FILE_PATH}\");") && exit 6
+    #         ;;
+    # esac
+}
+
+handle_mime() {
+    local mimetype="${1}"
+    case "${mimetype}" in
+        ## RTF and DOC
+        text/rtf|*msword)
+            ## Preview as text conversion
+            ## note: catdoc does not always work for .doc files
+            ## catdoc: http://www.wagner.pp.ru/~vitus/software/catdoc/
+            catdoc -- "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## DOCX, ePub, FB2 (using markdown)
+        ## You might want to remove "|epub" and/or "|fb2" below if you have
+        ## uncommented other methods to preview those formats
+        *wordprocessingml.document|*/epub+zip|*/x-fictionbook+xml)
+            ## Preview as markdown conversion
+            pandoc -s -t markdown -- "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## XLS
+        *ms-excel)
+            ## Preview as csv conversion
+            ## xls2csv comes with catdoc:
+            ##   http://www.wagner.pp.ru/~vitus/software/catdoc/
+            xls2csv -- "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## Text
+        text/* | */xml)
+            ## Syntax highlight
+            if [[ "$( stat --printf='%s' -- "${FILE_PATH}" )" -gt "${HIGHLIGHT_SIZE_MAX}" ]]; then
+                exit 2
+            fi
+            if [[ "$( tput colors )" -ge 256 ]]; then
+                local pygmentize_format='terminal256'
+                local highlight_format='xterm256'
+            else
+                local pygmentize_format='terminal'
+                local highlight_format='ansi'
+            fi
+            env HIGHLIGHT_OPTIONS="${HIGHLIGHT_OPTIONS}" highlight \
+                --out-format="${highlight_format}" \
+                --force -- "${FILE_PATH}" && exit 5
+            env COLORTERM=8bit bat --color=always --style="plain" \
+                -- "${FILE_PATH}" && exit 5
+            pygmentize -f "${pygmentize_format}" -O "style=${PYGMENTIZE_STYLE}"\
+                -- "${FILE_PATH}" && exit 5
+            exit 2;;
+
+        ## DjVu
+        image/vnd.djvu)
+            ## Preview as text conversion (requires djvulibre)
+            djvutxt "${FILE_PATH}" | fmt -w "${PV_WIDTH}" && exit 5
+            exiftool "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## Image
+        image/*)
+            ## Preview as text conversion
+            # img2txt --gamma=0.6 --width="${PV_WIDTH}" -- "${FILE_PATH}" && exit 4
+            exiftool "${FILE_PATH}" && exit 5
+            exit 1;;
+
+        ## Video and audio
+        video/* | audio/*)
+            mediainfo "${FILE_PATH}" && exit 5
+            exiftool "${FILE_PATH}" && exit 5
+            exit 1;;
+    esac
+}
+
+handle_fallback() {
+    echo '----- File Type Classification -----' && file --dereference --brief -- "${FILE_PATH}" && exit 5
+}
+
+
+MIMETYPE="$( file --dereference --brief --mime-type -- "${FILE_PATH}" )"
+if [[ "${PV_IMAGE_ENABLED}" == 'True' ]]; then
+    handle_image "${MIMETYPE}"
+fi
+handle_extension
+handle_mime "${MIMETYPE}"
+handle_fallback
+
+exit 1

roles/update_configs/tasks/main.yaml

@@ -0,0 +1,13 @@
+---
+- name: Configure oh my zsh, by pushing the config file
+  ansible.builtin.include_tasks: omz.yaml
+
+- name: Configure vim, by pushing the config
+  ansible.builtin.include_tasks: vim.yaml
+
+- name: Configure ranger, by pushing the config
+  ansible.builtin.include_tasks: ranger.yaml
+
+- name: Configure Neovim, by pushing the config
+  ansible.builtin.include_tasks: nvim.yaml
+

roles/update_configs/tasks/nvim.yaml

@@ -0,0 +1,14 @@
+---
+
+- name: Clear old Neovim config
+  ansible.builtin.file:
+    state: absent
+    path: "/home/{{ human_admin_user }}/.config/nvim"
+
+- name: Configure neovim, by pushing the config
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/nvim_config/"
+    dest: "/home/{{ human_admin_user }}/.config/nvim"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx

roles/update_configs/tasks/omz.yaml

@@ -0,0 +1,8 @@
+---
+- name: Configure oh my zsh, by pushing the config file
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.zshrc"
+    dest: "/home/{{ human_admin_user }}/.zshrc"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx

roles/update_configs/tasks/ranger.yaml

@@ -0,0 +1,22 @@
+---
+
+- name: Clear old config
+  ansible.builtin.file:
+    state: absent
+    path: "/home/{{ human_admin_user }}/.config/ranger"
+
+- name: Configure ranger, by pushing the config
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/ranger_config/"
+    dest: "/home/{{ human_admin_user }}/.config/ranger"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx
+
+- name: Make sure ~/.config/ranger/scope.sh is executable
+  ansible.builtin.file:
+    path: "/home/{{ human_admin_user }}/.config/ranger/scope.sh"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rwx,g=rx,o-rwx
+

roles/update_configs/tasks/vim.yaml

@@ -0,0 +1,10 @@
+---
+
+- name: Configure vim, by pushing the config
+  ansible.builtin.copy:
+    src: "{{ role_path }}/files/.vimrc"
+    dest: "/home/{{ human_admin_user }}/.vimrc"
+    owner: "{{ human_admin_user }}"
+    group: "{{ human_admin_user }}"
+    mode: u=rw,g=r,o-rwx
+

roles/update_system/tasks/main.yaml

@@ -0,0 +1,19 @@
+---
+- name: Update Debian systems
+  when: ansible_facts['os_family'] == "Debian"
+  ansible.builtin.apt:
+    name: "*"
+    state: latest
+    update-cache: true
+
+- name: Update Alpine systems
+  when: (ansible_facts['distribution'] == "Alpine")
+  community.general.apk:
+    upgrade: true
+    update-cache: true
+
+- name: Update RedHat systems
+  when: ansible_facts['os_family'] == "RedHat"
+  ansible.builtin.dnf:
+    name: "*"
+    state: latest

run_playbook.sh

@@ -1,4 +0,0 @@
-#!/bin/sh
-ansible-playbook -i inventory/hosts.yaml $1 \
-    --private-key inventory/group_vars/secret/ansible_key \
-    --vault-password-file inventory/group_vars/secret/.vault_pass

scripts/run_maintain_playbook.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+# 1 - Pull the latest code
+git pull origin main
+
+# 2 - Update dependencies and modules
+./scripts/update_modules.sh
+
+# 3 - Run the job
+source .venv/bin/activate
+ansible-playbook playbooks/maintain.yaml --vault-pass-file ~/vault_password -i inventory/hosts.yaml --private-key ~/.ssh/ansible_key

scripts/update_modules.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+source .venv/bin/activate
+
+# Install python packages
+pip install -r requirements.txt
+
+# Install collections from the file
+ansible-galaxy collection install -r requirements.yaml -p ./collections/
+
+# Install roles
+ansible-galaxy role install -r requirements.yaml -p ./roles/

systemd/ansible-maintenance.service

@@ -6,10 +6,10 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 # CAHNGE TO MATCH YOUR REQUIREMENTS
-User=max
+User=ansible
-Group=max
+Group=ansible
-WorkingDirectory=/home/max/projects/ansible_home
+WorkingDirectory=/home/ansible/ansible-production
-ExecStart=/home/max/projects/ansible_home/run_playbook.sh /home/max/projects/ansible_home/playbooks/maintain.yaml 
+ExecStart=/home/ansible/ansible-production/run_maintain_playbook.sh 
 StandardOutput=journal
 StandardError=journal
 # Optional: prevent runaway if the playbook hangs

systemd/ansible-maintenance.timer

@@ -1,9 +1,9 @@
 [Unit]
-Description=Timer for Ansible maintenance playbook, runs every 10 minutes
+Description=Timer for Ansible maintenance playbook, runs every day
 Requires=ansible-maintenance.service
 
 [Timer]
-OnUnitActiveSec=10min
+OnUnitActiveSec=1d
 Persistent=true
 Unit=ansible-maintenance.service