FAQ

Can I run this on a different distro?

No. It relies on pacman, and specifically bootstraps the CachyOS and BlackArch pacman repositories. It will not work on Debian/Fedora/etc.

Do I have to run the entire playbook?

No — run only what you need via the standalone playbooks in snippets/. See Code Explanation for the full list, and Usage for an example command.

Where do my secrets go?

In an Ansible Vault–encrypted variables file, referenced via vars_files and decrypted at runtime with --ask-vault-pass (or a vault password file). See Usage.

The hardening play changes my SSH port and disables password login — how do I avoid getting locked out?

Make sure the SSH key and port in your inventory.ini entry actually work before running the hardening play, and keep your existing session open while you test a fresh connection on the new port. The handlers reload sshd rather than restart it, so your current session won’t be dropped mid-play — but a broken inventory entry will still leave you unable to connect afterwards.

Why is there a dedicated aur_builder user?

yay (like makepkg) refuses to build packages as root. Rather than running it as your personal user (and needing your password mid-playbook), the playbook creates an aur_builder user with passwordless sudo scoped only to pacman, and builds everything as that user.

An AUR or pacman task failed — what now?

Pacman tasks have retries/delay/until to tolerate flaky mirrors, but AUR builds can still fail on transient network issues or upstream package changes. The playbook is idempotent — re-running it will skip already-completed steps and retry the failed one.

I don’t want a package the playbook installs — how do I remove it?

Edit the relevant package list directly, either in archPostInstall.yml or in the matching file under snippets/installation/ (e.g. pacmanInstall.yml, AurInstaller.yml, flatpakInstall.yml), then re-run.

Does the playbook reboot my machine?

No. A couple of changes need a new session to take effect (the SSH port change, the default shell switching to zsh) — no automatic reboot is performed.