Usage

Prerequisites

• A control machine with Ansible installed.
• A target host running Arch Linux (or an Arch-based distro such as CachyOS), reachable over SSH with a user that can become root (sudo).

1. Install required Ansible collections

The playbook depends on a few community Ansible collections:

ansible-galaxy collection install -r requirenments.yml

This installs kewlfft.aur, community.general, community.crypto, and ansible.posix.

2. Configure your inventory

inventory.ini describes the host(s) you want to target. A key-based example:

[arch]
myhost ansible_host=<target-ip> ansible_user=<user> ansible_ssh_private_key_file=~/.ssh/private_key ansible_port=<ssh-port> ansible_ssh_common_args='-o IdentitiesOnly=yes'

A simpler password-based entry works too — see the commented-out line in inventory.ini for reference.

3. Provide your secrets via Ansible Vault

The git/GPG setup play needs a handful of secret variables: ssh_key_passphrase, usr_pass, gpg_passphrase, git_user_name, git_user_email, and TAILTOKEN. These are kept out of the repository in an Ansible Vault–encrypted file (spo-pc-ls.yml in this repo is my own, and won’t decrypt for anyone else).

Create your own:

cat > myvars.yml <<'EOF'
ssh_key_passphrase: "..."
usr_pass: "..."
gpg_passphrase: "..."
git_user_name: "Your Name"
git_user_email: "you@example.com"
TAILTOKEN: "..."
EOF
ansible-vault encrypt myvars.yml

Then point the relevant play’s vars_files at your file (it’s currently spo-pc-ls.yml in archPostInstall.yml), or pass the variables another way, e.g. --extra-vars @myvars.yml.

4. Run the playbook

Full run:

ansible-playbook -i inventory.ini archPostInstall.yml --ask-become-pass --ask-vault-pass

Or run a single concern via one of the standalone playbooks under snippets/, e.g. only hardening:

ansible-playbook -i inventory.ini snippets/configuration/hardening.yml --ask-become-pass

After it runs

A few steps aren’t (and shouldn’t be) automated:

• Add the printed SSH and GPG public keys to your Codeberg account (the playbook prints them at the end of the git/GPG play).
• Open a new shell session and run p10k configure to finish theming Powerlevel10k.
• If the hardening play changed your SSH port or disabled password authentication, test the new connection in a separate terminal before closing your current session — don’t lock yourself out.