Use aws-cli v2

It's now available in the official repos

.gitmodules

@@ -1,6 +1,3 @@
-[submodule "ansible_roles/firefox"]
-	path = ansible_roles/firefox
-	url = https://github.com/staticdev/ansible-role-firefox
 [submodule "pkgbuilds/spotify"]
 	path = pkgbuilds/spotify
 	url = https://aur.archlinux.org/spotify.git
@@ -10,9 +7,6 @@
 [submodule "pkgbuilds/portfolio-performance-bin"]
 	path = pkgbuilds/portfolio-performance-bin
 	url = https://aur.archlinux.org/portfolio-performance-bin.git
-[submodule "pkgbuilds/vim-plug"]
-	path = pkgbuilds/vim-plug
-	url = https://aur.archlinux.org/vim-plug.git
 [submodule "pkgbuilds/terraform-ls-bin"]
 	path = pkgbuilds/terraform-ls-bin
 	url = https://aur.archlinux.org/terraform-ls-bin.git
@@ -22,3 +16,45 @@
 [submodule "pkgbuilds/screencfg-git"]
 	path = pkgbuilds/screencfg-git
 	url = https://aur.archlinux.org/screencfg-git.git
+[submodule "pkgbuilds/google-earth-pro"]
+	path = pkgbuilds/google-earth-pro
+	url = https://aur.archlinux.org/google-earth-pro.git
+[submodule "pkgbuilds/aws-sam-cli"]
+	path = pkgbuilds/aws-sam-cli
+	url = https://aur.archlinux.org/aws-sam-cli.git
+[submodule "pkgbuilds/python-boto3-stubs"]
+	path = pkgbuilds/python-boto3-stubs
+	url = https://aur.archlinux.org/python-boto3-stubs.git
+[submodule "pkgbuilds/python-botocore-stubs"]
+	path = pkgbuilds/python-botocore-stubs
+	url = https://aur.archlinux.org/python-botocore-stubs.git
+[submodule "pkgbuilds/python-chevron"]
+	path = pkgbuilds/python-chevron
+	url = https://aur.archlinux.org/python-chevron.git
+[submodule "pkgbuilds/python-aws-lambda-builders"]
+	path = pkgbuilds/python-aws-lambda-builders
+	url = https://aur.archlinux.org/python-aws-lambda-builders.git
+[submodule "pkgbuilds/python-vdf"]
+	path = pkgbuilds/python-vdf
+	url = https://aur.archlinux.org/python-vdf.git
+[submodule "pkgbuilds/protontricks"]
+	path = pkgbuilds/protontricks
+	url = https://aur.archlinux.org/protontricks.git
+[submodule "pkgbuilds/slack-desktop"]
+	path = pkgbuilds/slack-desktop
+	url = https://aur.archlinux.org/slack-desktop.git
+[submodule "pkgbuilds/backblaze-b2"]
+	path = pkgbuilds/backblaze-b2
+	url = https://aur.archlinux.org/backblaze-b2.git
+[submodule "pkgbuilds/python-class-registry"]
+	path = pkgbuilds/python-class-registry
+	url = https://aur.archlinux.org/python-class-registry.git
+[submodule "pkgbuilds/python-rst2ansi"]
+	path = pkgbuilds/python-rst2ansi
+	url = https://aur.archlinux.org/python-rst2ansi.git
+[submodule "pkgbuilds/claude-code"]
+	path = pkgbuilds/claude-code
+	url = https://aur.archlinux.org/claude-code.git
+[submodule "pkgbuilds/aws-session-manager-plugin"]
+	path = pkgbuilds/aws-session-manager-plugin
+	url = https://aur.archlinux.org/aws-session-manager-plugin.git

Makefile

@@ -1,36 +1,24 @@
-ansible_run = ansible-playbook -e ansible_python_interpreter=/usr/bin/python3 --inventory localhost, --diff ./playbook.yml ${ANSIBLE_EXTRA_ARGS}
+# Make sure to standardize locale, regardless of the machine config
+#
+# Having a different locale broke "yes | pacman -S" to force-install
+# iptables, for example
+export LC_ALL = en_US.UTF-8
 
-.PHONY: all
-all:
-	$(ansible_run)
+ansible_run = ansible-playbook --inventory localhost, --diff ./playbook.yml ${ANSIBLE_EXTRA_ARGS}
 
 .PHONY: config
 config:
-	$(ansible_run) --skip-tags system-update
+	$(ansible_run)
 
-.PHONY: system-update
-system-update:
-	$(ansible_run) --tags system-update
-
-.PHONY: reboot
-reboot:
-	sudo reboot
-
-.PHONY: poweroff
-poweroff:
-	sudo poweroff
-
-.PHONY: weekend
-weekend: | update poweroff
-
-.PHONY: packages
-packages:
-	$(ansible_run) --tags packages
-
-.PHONY: dotfiles
-dotfiles:
-	$(ansible_run) --tags dotfiles
+.PHONY: maintenance
+maintenance:
+	./maintenance.sh
 
 .PHONY: test
 test:
 	./test-in-docker.sh
+
+.PHONY: fmt
+fmt:
+	git ls-files -z '*.md'   | xargs -0 prettier --print-width 80 --prose-wrap always --write
+	git ls-files -z '*.toml' | xargs -0 taplo format

README.md

@@ -1,8 +1,27 @@
 # dotfiles
 
-My configuration files.
+My configuration files for my systems. Uses Ansible for local configuration.
 
-# Installation
+## Supported OS
+
+Only Arch Linux is supported
+
+## Bootstrapping
+
+Bootstrapping is specific to the exact machine that is installed. See
+`_machines/` for machine-specific configuration, and `install_scripts/` for the
+machine install scripts.
+
+They are keyed by hostname.
+
+For easier installation, the install scripts are available via shortlinks. To
+(re)install a new machine from a Arch live environment:
+
+```
+curl --proto '=https' -O -sSfL https://s.hkoerber.de/i/bootstrap.sh && bash bootstrap.sh {host}
+```
+
+## Manual Installation
 
 Because it manages multiple users on the system, the directory is supposed to be
 at `/var/lib/dotfiles`.
@@ -12,14 +31,13 @@ To setup the dotfiles:
 1. `git clone https://github.com/hakoerber/dotfiles.git ~/dotfiles`
 2. `cd ~/dotfiles && ./install.sh`
 
-# Partial application
+## Partial application
 
 To apply only a subset of the changes, use ansible tags that are available via
 the Makefile:
 
 | Command         | Description                                        |
-| --- | --- |
-| `make update` | Updates the system with the latest packages |
+| --------------- | -------------------------------------------------- |
 | `make packages` | Installs all defined packages (see `packages.yml`) |
 | `make dotfiles` | Manages the users' dotfiles                        |
 

_machines/ares.yml

@@ -2,6 +2,7 @@ font_size: 11
 
 gpu: amd
 cpu: amd
+encrypted_root: true
 
 users:
 - name: hannes
@@ -11,22 +12,11 @@ users:
       extensions:
         - ublock-origin
         - passff
-        - privacy-badger17
         - tree-style-tab
         - i-dont-care-about-cookies
         - floccus
       manage_css: true
-    media:
-      extensions:
-        - ublock-origin
-        - passff
-        - privacy-badger17
-        - tree-style-tab
-        - i-dont-care-about-cookies
-      manage_css: true
-      bigger_font: true
   mail: hannes@hkoerber.de
-  git_gpg_sign: false
   ssh_agent: false
   gpg_agent: true
   gpg_agent_for_ssh: true
@@ -34,11 +24,8 @@ users:
     email: hannes@hkoerber.de
     id: "0xB5C002530C6A2053"
     fingerprint: "973AE48D71B76735C4712B5BB5C002530C6A2053"
-  enable_passwordstore: true
   environment:
     MACHINE_HAS_NEXTCLOUD: "true"
-  repositories:
-    - personal_projects
 
 screen:
   1: DisplayPort-0
@@ -59,7 +46,7 @@ workspace:
 
 environment:
   MACHINE_TYPE: "workstation"
-  MACHINE_HAS_KEEPASSX: "false"
+  MACHINE_HAS_KEEPASSXC: "false"
   MACHINE_HAS_NEXTCLOUD: "true"
   MACHINE_HAS_STEAM: "true"
   MACHINE_RESOLUTION_X: "2560"

_machines/dionysus.yml

@@ -0,0 +1,61 @@
+font_size: 11
+
+gpu: intel
+cpu: intel
+encrypted_root: true
+
+users:
+- name: hannes
+  vt: 1
+  firefox_profiles:
+    default:
+      extensions:
+        - ublock-origin
+        - passff
+        - tree-style-tab
+        - i-dont-care-about-cookies
+        - floccus
+      manage_css: true
+    media:
+      extensions:
+        - ublock-origin
+        - passff
+        - tree-style-tab
+        - i-dont-care-about-cookies
+      manage_css: true
+      bigger_font: true
+  mail: hannes@hkoerber.de
+  ssh_agent: false
+  gpg_agent: true
+  gpg_agent_for_ssh: true
+  gpg_key:
+    email: hannes@hkoerber.de
+    id: "0xB5C002530C6A2053"
+    fingerprint: "973AE48D71B76735C4712B5BB5C002530C6A2053"
+  environment:
+    MACHINE_HAS_NEXTCLOUD: "true"
+
+screen:
+  1: HDMI-1
+  2: HDMI-1
+  3: HDMI-1
+  4: HDMI-1
+  5: HDMI-1
+  6: HDMI-1
+  7: HDMI-1
+  8: HDMI-1
+  9: HDMI-1
+  0: HDMI-1
+
+workspace:
+  1: ""
+  2: ""
+  3: ""
+
+environment:
+  MACHINE_TYPE: "tv"
+  MACHINE_HAS_KEEPASSXC: "false"
+  MACHINE_HAS_NEXTCLOUD: "true"
+  MACHINE_HAS_STEAM: "false"
+  MACHINE_RESOLUTION_X: "1920"
+  MACHINE_RESOLUTION_Y: "1080"

_machines/hera-tasks.yml

@@ -0,0 +1,265 @@
+---
+- name: Autoupdate
+  block:
+    - name: Deploy autoupdate script
+      copy:
+        owner: root
+        group: root
+        mode: "0755"
+        dest: /usr/local/bin/pacman-autoupdate
+        content: |
+          #!/usr/bin/env bash
+
+          set -o errexit
+          set -o nounset
+          set -o pipefail
+
+          # Prevent failures when not battery present
+          shopt -s nullglob
+
+          for battery in /sys/class/power_supply/*/capacity ; do
+              capacity="$(< "$battery")"
+              if (( "${capacity}" < 40 )) ; then
+                  printf "Battery at %s%%, exiting\n" "${capacity}" >&2
+                  exit 0
+              fi
+          done
+
+          if nmcli --terse --fields GENERAL.METERED dev show 2>/dev/null | grep -q "yes" ; then
+              printf "Detected metered connection, exiting\n" >&2
+              exit 0
+          fi
+
+          # Make sure that keys are up to date, otherwise sig checks may fail
+          pacman --sync --noprogressbar --noconfirm --refresh --needed archlinux-keyring
+
+          pacman --noprogressbar --noconfirm --sysupgrade
+
+    - name: Install pacman autoupdate service
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/pacman-autoupdate.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/local/bin/pacman-autoupdate
+      become: true
+
+    - name: Install pacman autoupdate timer
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/pacman-autoupdate.timer
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Timer]
+          OnCalendar=daily
+          OnBootSec=5min
+          OnUnitInactiveSec=120min
+
+          [Install]
+          WantedBy=multi-user.target
+
+    - name: Enable pacman autoupdate timer
+      ansible.builtin.systemd:
+        name: pacman-autoupdate.timer
+        enabled: true
+        state: started
+        daemon_reload: true
+      become: true
+  become: true
+
+- name: User configuration
+  block:
+    - name: Create user group
+      ansible.builtin.group:
+        name: "herta"
+        state: present
+      become: true
+
+    - name: Create user
+      ansible.builtin.user:
+        name: "herta"
+        state: present
+        home: "/home/herta"
+        create_home: true
+        groups:
+          - dotfiles
+          - libvirt
+          - wheel
+          - wireshark
+          - docker
+          - sudonopw
+          - games
+          - kvm
+          - video
+        shell: /usr/bin/zsh
+        skeleton: /dev/null
+      become: true
+
+- name: Display Manager
+  block:
+    - name: Enable sddm
+      ansible.builtin.systemd:
+        name: sddm.service
+        enabled: true
+        daemon_reload: true
+      become: true
+
+    - name: Create sddm config folder
+      ansible.builtin.file:
+        state: directory
+        path: /etc/sddm.conf.d/
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Enable autologin
+      ansible.builtin.copy:
+        dest: /etc/sddm.conf.d/autologin.conf
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Autologin]
+          User=herta
+          Session=plasma
+
+    - name: Lock on startup
+      ansible.builtin.copy:
+        dest: /etc/xdg/kscreenlockerrc
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Daemon]
+          LockOnStart=true
+
+- name: Backup
+  block:
+    - name: create restic config directory
+      file:
+        path: /etc/restic
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+      become: true
+
+    - name: create restic exclude file
+      copy:
+        dest: /etc/restic/exclude.lst
+        content: |
+          /home/*/.cache/**
+          /home/*/.mozilla/firefox/*/Cache/**
+        owner: root
+        group: root
+        mode: "0755"
+      become: true
+
+    - name: create restic cache directory
+      file:
+        path: /var/cache/restic
+        state: directory
+        owner: root
+        group: root
+        mode: "0700"
+      become: true
+
+    - name: create restic wrapper script
+      copy:
+        owner: root
+        group: root
+        mode: "0700"
+        dest: /usr/local/bin/restic-cmd
+        content: |
+          #!/usr/bin/env bash
+          source /etc/restic/env
+
+          set -o nounset
+          set -o errexit
+          set -o pipefail
+
+          export B2_ACCOUNT_ID
+          export B2_ACCOUNT_KEY
+
+          export RESTIC_PASSWORD_FILE=/etc/restic/repopassword
+
+          restic \
+            --cache-dir=/var/cache/restic/ \
+            --repo="b2:${BUCKET_NAME}:hera" \
+            --password-file=/etc/restic/repopassword \
+            --verbose \
+            "${@}"
+      become: true
+
+    - name: add backup script
+      copy:
+        owner: root
+        group: root
+        mode: "0700"
+        dest: /usr/local/bin/restic-backup
+        content: |
+          #!/usr/bin/env bash
+
+          set -o nounset
+          set -o errexit
+          set -o pipefail
+
+          run() {
+            name="${1}" ; shift
+            printf '[%s] %s - start\n' "${name}" "$(date --utc --iso-8601=seconds)"
+            "${@}"
+            printf '[%s] %s - end\n' "${name}" "$(date --utc --iso-8601=seconds)"
+          }
+
+          run backup restic-cmd \
+              backup \
+              --exclude-file /etc/restic/exclude.lst \
+              /home/
+
+          run forget restic-cmd \
+              forget \
+              --prune \
+              --keep-daily 30 \
+              --keep-monthly 12 \
+              --keep-yearly 3
+      become: true
+
+
+    - name: Install restic backup service
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/restic-backup.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Service]
+          Type=oneshot
+          ExecStart=systemd-inhibit /usr/local/bin/restic-backup
+      become: true
+
+    - name: Install restic backup timer
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/restic-backup.timer
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Timer]
+          OnCalendar=daily
+          Persistent=true
+
+          [Install]
+          WantedBy=multi-user.target
+      become: true
+
+    - name: Enable restic backup timer
+      ansible.builtin.systemd:
+        name: restic-backup.timer
+        enabled: true
+        state: started
+        daemon_reload: true
+      become: true

_machines/hera.yml

@@ -0,0 +1,81 @@
+font_size: 11
+
+gpu: intel
+cpu: intel
+encrypted_root: false
+
+# make sure that display manager works
+system_default_target: "graphical.target"
+
+additional_packages:
+  - plasma-desktop
+  - konsole
+  - dolphin
+  - kdeplasma-addons
+  - plasma-nm
+  - plasma-pa
+  - plasma-systemmonitor
+  - sddm
+  - sddm-kcm
+  - thunderbird
+  # kde archive manager
+  - ark
+  # kde image viewer
+  - gwenview
+  # german language packs
+  - hunspell-de
+  - thunderbird-i18n-de
+  - firefox-i18n-de
+
+users:
+- name: hannes
+  vt: 1
+  firefox_profiles:
+    default:
+      extensions:
+        - ublock-origin
+        - passff
+        - tree-style-tab
+        - i-dont-care-about-cookies
+        - floccus
+      manage_css: true
+    media:
+      extensions:
+        - ublock-origin
+        - passff
+        - tree-style-tab
+        - i-dont-care-about-cookies
+      manage_css: true
+      bigger_font: true
+  mail: hannes@hkoerber.de
+  autologin: false
+  ssh_agent: false
+  gpg_agent: true
+  gpg_agent_for_ssh: true
+  gpg_key:
+    email: hannes@hkoerber.de
+    id: "0xB5C002530C6A2053"
+    fingerprint: "973AE48D71B76735C4712B5BB5C002530C6A2053"
+  environment: {}
+
+screen:
+  1: HDMI-1
+  2: HDMI-1
+  3: HDMI-1
+  4: HDMI-1
+  5: HDMI-1
+  6: HDMI-1
+  7: HDMI-1
+  8: HDMI-1
+  9: HDMI-1
+  0: HDMI-1
+
+workspace: []
+
+environment:
+  MACHINE_TYPE: "workstation"
+  MACHINE_HAS_KEEPASSXC: "false"
+  MACHINE_HAS_NEXTCLOUD: "false"
+  MACHINE_HAS_STEAM: "false"
+  MACHINE_RESOLUTION_X: "1920"
+  MACHINE_RESOLUTION_Y: "1080"

_machines/neptune.yml

@@ -2,6 +2,7 @@ font_size: 11
 
 gpu: nvidia
 cpu: intel
+encrypted_root: true
 
 users:
 - name: hannes-work
@@ -10,7 +11,6 @@ users:
     default:
       extensions:
         - ublock-origin
-        - privacy-badger17
         - tree-style-tab
         - i-dont-care-about-cookies
       manage_css: true
@@ -19,14 +19,12 @@ users:
         - ublock-origin
       manage_css: false
   mail: h.koerber@clipmyhorse.tv
-  git_gpg_sign: false
   ssh_agent: true
   gpg_agent: false
   gpg_agent_for_ssh: false
   environment:
     MACHINE_HAS_NEXTCLOUD: "false"
-    MACHINE_HAS_KEEPASSX: "false"
-  repositories: []
+    MACHINE_HAS_KEEPASSXC: "true"
 
 - name: hannes-private
   vt: 2
@@ -35,13 +33,11 @@ users:
       extensions:
         - ublock-origin
         - passff
-        - privacy-badger17
         - tree-style-tab
         - i-dont-care-about-cookies
         - floccus
       manage_css: true
   mail: hannes@hkoerber.de
-  git_gpg_sign: false
   ssh_agent: false
   gpg_agent: true
   gpg_agent_for_ssh: true
@@ -49,12 +45,9 @@ users:
     email: hannes@hkoerber.de
     id: "0xB5C002530C6A2053"
     fingerprint: "973AE48D71B76735C4712B5BB5C002530C6A2053"
-  enable_passwordstore: true
   environment:
     MACHINE_HAS_NEXTCLOUD: "true"
-    MACHINE_HAS_KEEPASSX: "false"
-  repositories:
-    - personal_projects
+    MACHINE_HAS_KEEPASSXC: "false"
 
 screen:
   1: DP-4-1-6

alacritty/alacritty.toml.j2

@@ -1,3 +1,4 @@
+[general]
 live_config_reload = true
 
 import = [

alacritty/themes/monokai.toml

@@ -21,4 +21,3 @@ blue = "#66d9ef"
 magenta = "#ae81ff"
 cyan = "#a1efe4"
 white = "#f9f8f5"
-

ansible.cfg

@@ -2,5 +2,4 @@
 retry_files_enabled = False
 nocows = 1
 roles_path = ./ansible_roles
-library = ./ansible_roles/firefox/library
-remote_tmp = ${XDG_CONFIG_HOME}/ansible/tmp
+interpreter_python = "auto_silent"

applications/firefox.desktop

@@ -0,0 +1,4 @@
+[Desktop Entry]
+Type=Application
+Name=Firefox
+Exec=firefox-default --new-tab %u

autostart/autostart.target.j2

@@ -16,7 +16,7 @@ Wants=firefox-gtk-override-bigger-font@{{ profile }}.service
 {% endfor %}
 Wants=gpg-agent.service
 Wants=gnome-keyring.service
-Wants=keepassx.service
+Wants=keepassxc.service
 Wants=keyboard.service
 Wants=laptop-lid.service
 Wants=nextcloud.service
@@ -30,3 +30,5 @@ Wants=xresources.service
 Wants=yubikey-touch-detector.service
 Wants=kdeconnect.service
 Wants=color-theme-dark.service
+Wants=workstation-mgr.service
+Wants=screencfg.service

autostart/services/firefox-gtk-override-bigger-font@.service

@@ -3,7 +3,7 @@ BindsTo=autostart.target
 After=windowmanager.target
 
 [Service]
-ExecStart=/usr/bin/env firefox --setDefaultBrowser -P %i
+ExecStart=/usr/bin/env firefox --profile %h/.mozilla/firefox/profile-%i
 PassEnvironment=DISPLAY
 Environment=XDG_CONFIG_HOME=%h/.config/gtk-3.0-overrides/bigger-font/
 Restart=always

autostart/services/firefox@.service

@@ -3,6 +3,6 @@ BindsTo=autostart.target
 After=windowmanager.target
 
 [Service]
-ExecStart=/usr/bin/env firefox --setDefaultBrowser -P %i
+ExecStart=/usr/bin/env firefox --profile %h/.mozilla/firefox/profile-%i
 PassEnvironment=DISPLAY
 Restart=always

autostart/services/keepassx.service

@@ -1,9 +0,0 @@
-[Unit]
-BindsTo=autostart.target
-After=windowmanager.target
-ConditionPathExists=%t/features/keepassx
-
-[Service]
-ExecStart=/usr/bin/env keepassx --keyfile %h/.secret/main.key %h/.secret/main.kdbx
-PassEnvironment=DISPLAY
-Restart=always

autostart/services/keepassxc.service

@@ -0,0 +1,9 @@
+[Unit]
+BindsTo=autostart.target
+After=windowmanager.target
+ConditionPathExists=%t/features/keepassxc
+
+[Service]
+ExecStart=/usr/bin/env keepassxc --keyfile %h/.secrets/main.keyx %h/.secrets/main.kdbx
+PassEnvironment=DISPLAY
+Restart=always

autostart/services/screencfg.service

@@ -0,0 +1,8 @@
+[Unit]
+BindsTo=autostart.target
+After=windowmanager.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/screencfg watch --best
+Restart=always

autostart/services/steam.service

@@ -6,6 +6,7 @@ After=i3.service
 ConditionPathExists=%t/features/steam
 
 [Service]
-ExecStart=/usr/bin/env steam
+# `-system-composer`: https://github.com/ValveSoftware/steam-for-linux/issues/10806
+ExecStart=/usr/bin/env steam -system-composer
 PassEnvironment=DISPLAY
 Restart=always

autostart/services/workstation-mgr.service

@@ -0,0 +1,8 @@
+[Unit]
+BindsTo=autostart.target
+After=windowmanager.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/workstation-mgr serve
+Restart=always

bin/firefox-default

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+exec /usr/bin/firefox --profile "$HOME/.mozilla/firefox/profile-default" "${@}"

bin/markdown-to-pdf

@@ -43,7 +43,7 @@ pandoc \
     --variable papersize=a4 \
     --variable date=$(date --iso-8601=date) \
     --variable fontsize=12pt \
-    --variable fontfamily=libertine \
+    --variable fontfamily=libertinus \
     --variable familydefault=sfdefault \
     --variable documentclass=scrartcl \
     --variable fontfamilyoptions= \

bin/terraform-get-targets

@@ -11,7 +11,7 @@ do
   RESOURCE=$(sed -n 's/^resource "\([^"]*\)" "\([^"]*\)".*/-target=\1.\2 /gp' "$FILE")
   MODULE=$(sed -n 's/^module "\([^"]*\)".*/-target=module.\1 /gp' "$FILE")
   if [[ -z "$RESOURCE" ]] && [[ -z "$MODULE" ]]; then
-    echo "Cannot detect terraform resource and module in $FILE"
+    echo "Cannot detect terraform resource and module in $FILE" >&2
     exit 1
   fi
 

cargo/config.toml

@@ -0,0 +1,6 @@
+[build]
+rustc-wrapper = "sccache"
+
+[target.x86_64-unknown-linux-gnu]
+linker = "/usr/bin/clang"
+rustflags = ["-Clink-arg=--ld-path=/usr/bin/wild"]

check-aur-updates.sh

@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-git submodule update --remote pkgbuilds/*

dotfiles.yml

@@ -1,5 +1,4 @@
 empty_directories:
-  - name: .config/nvim
   - name: .config/rofi
   - name: .config/gtk-3.0
   - name: .config/gtk-3.0-overrides
@@ -17,6 +16,7 @@ empty_directories:
   - name: .config/alacritty
   - name: .local/state/gnupg/
     mode: '0700'
+  - name: .local/state/cargo/
 dotfiles:
   - from: git/gitconfig
     to: .config/git/config
@@ -43,10 +43,9 @@ dotfiles:
     to: .config/i3status-rust/icons/awesome.toml
   - from: i3/scripts
     to: .config/i3/scripts
+    dir: true
   - from: tmux/tmux.conf
     to: .config/tmux/tmux.conf
-  - from: vim/vimrc
-    to: .config/nvim/init.vim
   - from: x/Xresources
     to: .config/Xresources
   - from: x/xinitrc
@@ -75,6 +74,7 @@ dotfiles:
     template: true
   - from: alacritty/themes
     to: .config/alacritty/themes
+    dir: true
   - from: rofi/config
     to: .config/rofi/config
   - from: gtk/gtk-3.0.ini
@@ -90,13 +90,22 @@ dotfiles:
     to: .config/qt5ct/qt5ct.conf
   - from: scripts
     to: scripts
+    dir: true
   - from: helix/config.toml
     to: .config/helix/config.toml
   - from: helix/languages.toml
     to: .config/helix/languages.toml
+  - from: screencfg/screencfg.toml
+    to: .config/screencfg.toml
+  - from: cargo/config.toml
+    to: .local/state/cargo/config.toml
+  - from: applications
+    to: .local/share/applications
+    dir: true
 dotfiles_remove:
   - .gitconfig
   - .vimrc
+  - .config/nvim/init.vim
   - .tmux.conf
   - .i3
   - .gtkrc-2.0

drivers.yml

@@ -26,3 +26,9 @@ gpu:
     - lib32-vulkan-nouveau
     - vulkan-headers
     - vulkan-tools
+  intel:
+    - mesa
+    - mesa-utils
+    - lib32-mesa
+    - vulkan-intel
+    - lib32-vulkan-intel

dunst/dunstrc.j2

@@ -84,7 +84,7 @@
 
     ### Text ###
 
-    font = JetBrains Mono {{ machine.font_size }}
+    font = JetBrainsMono, Fontawesome {{ machine.font_size }}
 
     # The spacing between lines.  If the height is smaller than the
     # font height, it will get raised to the font height.

git/gitconfig.j2

@@ -2,9 +2,6 @@
     name = Hannes Körber
     email = {{ user.mail }}
     useConfigOnly = true
-{% if user.git_gpg_sign|bool %}
-    signingkey = {{ user.gpg_key.id }}
-{% endif %}
 [github]
     user = hakoerber
 [alias]
@@ -44,7 +41,7 @@
 
     pushall = "!bash -c 'for r in $(git remote) ; do [[ "$r" != "upstream" ]] && { echo \"--- [$r] ---\" ; git push $r \"$@\" ; } ; done' -"
 
-    branch-clean = "!sh -c 'git branch --merged | grep -v -e master -e develop -e '^*' | xargs --no-run-if-empty git branch -d'"
+    branch-clean = "!sh -c 'git branch --merged | grep -v -e master -e develop -e main -e '^*' | xargs --no-run-if-empty git branch -d'"
     brc = "!git branch-clean"
 
     graph = log --graph --pretty=format:'%C(yellow)%h%Creset%C(bold red)% D%Creset %C(green)(%cr) %C(blue)%an<%ae>%Creset%n        %C(bold white)%s%Creset' --all
@@ -80,6 +77,7 @@
     ui = auto
 [push]
     default = simple
+    autoSetupRemote = true
 [merge]
     conflictstyle = diff3
 [gc]
@@ -91,7 +89,7 @@
     commitBeforeMerge = false
     detachedHead = false
 [commit]
-    gpgSign = {{ user.git_gpg_sign|bool }}
+    gpgSign = false
     cleanup = strip
     status = true
 [status]
@@ -120,11 +118,19 @@
 [url "ssh://git@code.hkoerber.de:2222/"]
     insteadOf = https://code.hkoerber.de/
 
+# https://stackoverflow.com/a/71971739
+[url "https://github.com/"]
+    insteadOf = "git@github.com:"
+[url "git@github.com:"]
+    pushInsteadOf = "https://github.com/"
+    pushInsteadOf = "git@github.com:"
+
 [init]
-	defaultBranch = master
+	defaultBranch = main
 [safe]
 	directory = /var/lib/dotfiles
-[includeIf "gitdir:/var/lib/dotfiles"]
+	directory = /var/lib/dotfiles/*
+[includeIf "gitdir:/var/lib/dotfiles/.git"]
     path = /var/lib/dotfiles/gitcfg
 [delta]
     navigate = true # use n and N to move between diff sections
@@ -132,3 +138,5 @@
     # delta detects terminal colors automatically; set one of these to disable auto-detection
     # dark = true
     # light = true
+[rerere]
+    enabled = true

grm/github.toml

@@ -2,6 +2,7 @@ provider = "github"
 token_command = "pass show github | ~/bin/yaml2json | jq -r '.personal_access_token.grm.value'"
 root = "~/code/github.com"
 worktree = true
+force_ssh = true
 
 [filters]
 owner = true

helix/config.toml

@@ -5,12 +5,7 @@ idle-timeout = 0
 completion-trigger-len = 2
 
 [editor.statusline]
-left = [
-  "mode",
-  "separator",
-  "file-name",
-  "file-modification-indicator",
-]
+left = ["mode", "separator", "file-name", "file-modification-indicator"]
 
 right = [
   "spinner",

i3/config.j2

@@ -95,7 +95,6 @@
 
     set $screenshot o
 
-
 ################################################################################
 ### WORKSPACE ASSIGNMENTS ######################################################
 ################################################################################
@@ -111,8 +110,7 @@ workspace $workspace8 output {{ machine.screen.8 }}
 workspace $workspace9 output {{ machine.screen.9 }}
 workspace $workspace10 output {{ machine.screen.0 }}
 
-
-assign [class="^Keepassx$"] $workspace8
+assign [class="^KeePassXC$"] $workspace8
 
 # See https://github.com/i3/i3/issues/2060
 for_window [class="^Spotify$"] move to workspace $workspace9
@@ -120,8 +118,8 @@ assign [class="^Spotify$"] $workspace9
 
 assign [class="^Google-chrome$"] $workspace7
 assign [class="^Chromium$"] $workspace7
-assign [class="^Steam"] $workspace5
-for_window [class="^Steam$"] move to workspace $workspace5
+assign [class="^[Ss]team$"] $workspace5
+for_window [class="^[Ss]team$"] move to workspace $workspace5
 
 assign [class="^dota2$"] $workspace10
 assign [class="^Wine$"] $workspace10
@@ -206,22 +204,18 @@ assign [class="^Wine$"] $workspace10
 
     ### START APPLICATIONS #####################################################
 
-    bindsym $mod+d exec --no-startup-id $scriptdir/appmenu
+    bindsym $mod+d exec --no-startup-id rofi -show combi -combi-modi run -display-combi "run"
+
     bindsym $mod+Return       exec $terminal
     bindsym $mod+Shift+Return exec $calc
 
-    bindsym F1 exec --no-startup-id $scriptdir/shutdown-menu
-    bindsym F2 exec --no-startup-id $scriptdir/screenmenu
+    bindsym F1 exec --no-startup-id workstation-client power menu
 
-    bindsym $mod+F1 exec --no-startup-id $scriptdir/i3exit lock
-    bindsym $mod+F4 exec --no-startup-id $scriptdir/i3exit suspend
-    bindsym $mod+Home exec --no-startup-id $scriptdir/shutdown-menu
+    bindsym $mod+F1 exec --no-startup-id workstation-client power lock
 
     bindsym $mod+$screenshot exec --no-startup-id sh -c 'maim | xclip -selection clipboard -t image/png'
     bindsym $mod+Shift+$screenshot exec --no-startup-id sh -c 'maim --select | xclip -selection clipboard -t image/png'
 
-    bindsym $mod+Shift+v exec --no-startup-id redshift-toggle
-
     bindsym $mod+$pim_toggle exec --no-startup-id $scriptdir/swap-from-workspace $workspace10
 
 ################################################################################
@@ -314,22 +308,22 @@ bindsym $mod+F9 exec --no-startup-id evolution
 ### SPECIAL KEYBINDS ###########################################################
 ################################################################################
 
-bindsym XF86Sleep exec --no-startup-id $scriptdir/i3exit suspend
-bindsym XF86AudioMute exec --no-startup-id pactl set-sink-mute '@DEFAULT_SINK@' toggle
-bindsym XF86AudioRaiseVolume exec --no-startup-id pactl set-sink-volume '@DEFAULT_SINK@' +5%
-bindsym XF86AudioLowerVolume exec --no-startup-id pactl set-sink-volume '@DEFAULT_SINK@' -5%
+bindsym XF86Sleep exec --no-startup-id workstation-client power lock
 
-bindsym XF86AudioPlay exec --no-startup-id playerctl -p spotify play-pause
-bindsym XF86AudioNext exec --no-startup-id playerctl -p spotify next
-bindsym XF86AudioPrev exec --no-startup-id playerctl -p spotify previous
+bindsym XF86AudioMute exec        --no-startup-id workstation-client pulseaudio output toggle
+bindsym XF86AudioRaiseVolume exec --no-startup-id workstation-client pulseaudio output inc
+bindsym XF86AudioLowerVolume exec --no-startup-id workstation-client pulseaudio output dec
 
-# keys seemingly switched
-bindsym XF86MonBrightnessUp   exec --no-startup-id xbacklight -inc 8 ; exec --no-startup-id $scriptdir/update-status
-bindsym XF86MonBrightnessDown exec --no-startup-id xbacklight -dec 8 ; exec --no-startup-id $scriptdir/update-status
+bindsym XF86AudioPlay exec --no-startup-id workstation-client spotify toggle
+bindsym XF86AudioNext exec --no-startup-id workstation-client spotify next
+bindsym XF86AudioPrev exec --no-startup-id workstation-client spotify previous
 
-bindsym $mod+m exec     --no-startup-id pactl set-source-mute '@DEFAULT_SOURCE@' toggle
-bindsym $mod+space exec --no-startup-id pactl set-source-mute '@DEFAULT_SOURCE@' toggle
-bindsym KP_Enter   exec --no-startup-id pactl set-source-mute '@DEFAULT_SOURCE@' toggle
+bindsym XF86MonBrightnessUp   exec --no-startup-id workstation-client brightness inc
+bindsym XF86MonBrightnessDown exec --no-startup-id workstation-client brightness dec
+
+bindsym $mod+m     exec --no-startup-id workstation-client pulseaudio input toggle
+bindsym $mod+space exec --no-startup-id workstation-client pulseaudio input toggle
+bindsym KP_Enter   exec --no-startup-id workstation-client pulseaudio input toggle
 
 ##############################################################################
 ### BARS #######################################################################

i3/i3status-rust/config.toml.j2

@@ -33,7 +33,7 @@ format = " $icon{ $volume.eng(w:2)|} "
 
 [[block.click]]
 button = "left"
-cmd = "pactl set-sink-mute '@DEFAULT_SINK@' toggle"
+cmd = "workstation-client pulseaudio output toggle"
 update = true
 
 [[block]]
@@ -50,7 +50,7 @@ idle_bg = { link = "warning_bg" }
 
 [[block.click]]
 button = "left"
-cmd = "pactl set-source-mute '@DEFAULT_SOURCE@' toggle"
+cmd = "workstation-client pulseaudio input toggle"
 update = true
 
 [[block]]
@@ -67,31 +67,32 @@ missing_format = ""
 [[block]]
 block = "toggle"
 format = "   $icon "
-command_on = "$XDG_CONFIG_HOME/i3/scripts/presentation-mode toggle ; pkill -SIGRTMIN+0 i3status-rs"
-command_off = "$XDG_CONFIG_HOME/i3/scripts/presentation-mode toggle ; pkill -SIGRTMIN+0 i3status-rs"
-command_state = "[[ $($XDG_CONFIG_HOME/i3/scripts/presentation-mode status) == on ]] && echo active"
+signal = 1
+command_on = "workstation-client present toggle ; pkill -SIGRTMIN+1 i3status-rs"
+command_off = "workstation-client present toggle ; pkill -SIGRTMIN+1 i3status-rs"
+command_state = "[[ $(workstation-client present status) == on ]] && echo active"
 
 [[block]]
 block = "toggle"
 format = "   $icon "
-command_on = "systemctl --user start color-theme-light"
-command_off = "systemctl --user start color-theme-dark"
-command_state = "[[ $(systemctl --user is-active color-theme-light) == active ]] && echo active"
+command_on = "workstation-client theme light"
+command_off = "workstation-client theme dark"
+command_state = "[[ $(workstation-client theme status) == light ]] && echo 1"
 
 [[block]]
 block = "toggle"
 format = "   $icon "
-command_on = "systemctl --user start redshift"
-command_off = "systemctl --user stop redshift"
-command_state = "[[ $(systemctl --user is-active redshift) == active ]] && echo active"
+command_on = "workstation-client redshift start"
+command_off = "workstation-client redshift stop"
+command_state = "[[ $(workstation-client redshift status) == active ]] && echo 1"
 signal = 0
 
 [[block]]
 block = "toggle"
 format = "   $icon "
-command_on = "systemctl --user start spotify"
-command_off = "systemctl --user stop spotify"
-command_state = "[[ $(systemctl --user is-active spotify) == active ]] && echo active"
+command_on = "workstation-client spotify start"
+command_off = "workstation-client spotify stop"
+command_state = "[[ $(workstation-client spotify status) == active ]] && echo 1"
 signal = 0
 
 [[block]]
@@ -99,11 +100,6 @@ block = "custom"
 json = true
 command = "ping -n -q -w 2 -c 1 8.8.8.8 >/dev/null 2>/dev/null && printf '{\"text\":\"\",\"state\":\"Info\"}' || printf '{\"text\":\"\",\"state\":\"Critical\"}'"
 
-[[block]]
-block = "custom"
-command = "curl -s 'https://wttr.in/Stockholm?m&T&format=%c%t' | sed 's/  / /g'"
-interval = 3600
-
 [[block]]
 block = "time"
 interval = 1

i3/i3status-rust/themes/native.toml

@@ -0,0 +1 @@
+

i3/scripts/appmenu

@@ -1,2 +0,0 @@
-#!/usr/bin/env bash
-rofi -show combi -combi-modi run -display-combi "run"

i3/scripts/i3exit

@@ -1,84 +0,0 @@
-#!/bin/bash
-
-### From http://www.archlinux.org/index.php/i3
-
-_logfile="$XDG_RUNTIME_DIR/i3exit.log"
-
-touch "$_logfile"
-
-log()
-{
-    echo "$*"
-    echo "[$(date +%FT%T)] $*" >> "$_logfile"
-}
-
-lock()
-{
-    set -x
-    playerctl -p spotify pause
-
-    i3lock --nofork --show-failed-attempts --ignore-empty-password \
-        --color "000000"
-}
-
-screen_off() {
-    xset dpms force off
-}
-
-reset_screen() {
-    systemctl --user restart dpms.service
-}
-
-lock_and_screen_off() {
-    lock &
-    _pid=$!
-    dunst_paused=$(dunstctl is-paused)
-    [[ "${dunst_paused}" != "true" ]] && dunstctl set-paused true
-    screen_off
-    wait $_pid
-    [[ "${dunst_paused}" != "true" ]] && dunstctl set-paused false
-    reset_screen
-}
-
-signal="$1"
-log "[I] Received signal \"$signal\"."
-
-case "$signal" in
-    lock)
-        log "[I] Locking session."
-        lock_and_screen_off
-        ;;
-    logout)
-        log "[I] Exiting i3."
-        i3-msg exit
-        ;;
-    suspend)
-        log "[I] Suspending."
-        lock &
-        sleep 0.1
-        systemctl suspend
-        ;;
-    hibernate)
-        log "[I] Hibernating."
-        sudo systemctl hibernate
-        ;;
-    reboot)
-        log "[I] Rebooting."
-        systemctl reboot
-        ;;
-    shutdown)
-        log "[I] Shutting down."
-        systemctl poweroff
-        ;;
-    screen-off)
-        log "[I] Turning screen off."
-        screen_off
-        ;;
-    *)
-        echo "Usage: $0 {lock|logout|suspend|hibernate|reboot|shutdown}"
-        log "[E] Signal \"$signal\" unknown. Aborting."
-        exit 2
-esac
-
-log "[I] Done."
-exit 0

i3/scripts/presentation-mode

@@ -1,47 +0,0 @@
-#!/usr/bin/env bash
-
-_status_file="${XDG_RUNTIME_DIR}/presentation-mode-on"
-
-is_on() {
-    [[ -e "${_status_file}" ]]
-}
-
-switch_on() {
-    touch "${_status_file}"
-    dunstctl set-paused true &
-    systemctl --user --no-block stop redshift.service
-    systemctl --user --no-block stop spotify.service
-}
-
-switch_off() {
-    rm -f "${_status_file}"
-    dunstctl set-paused false &
-    systemctl --user --no-block start redshift.service
-    systemctl --user --no-block start spotify.service
-}
-
-
-case "$1" in
-    status)
-        if is_on ; then
-            printf "on\n"
-        else
-            printf "off\n"
-        fi
-        ;;
-    toggle)
-        if is_on ; then
-            switch_off
-        else
-            switch_on
-        fi
-        ;;
-    off)
-        switch_off
-        ;;
-    on)
-        switch_on
-        ;;
-esac
-
-

i3/scripts/shutdown-menu

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-options=(
-"lock"
-"logout"
-"suspend"
-"hibernate"
-"reboot"
-"shutdown"
-"screen-off")
-
-i=1
-output=$(
-for option in "${options[@]}"; do
-    echo "($i) $option"
-    (( i++ ))
-done | rofi -dmenu -p "action" -no-custom)
-
-[[ "$output" ]] && "$(dirname "$0")"/i3exit "${output#(*) }"

install.sh

@@ -8,6 +8,12 @@
 set -o errexit
 set -o nounset
 
+# Make sure to standardize locale, regardless of the machine config
+#
+# Having a different locale broke "yes | pacman -S" to force-install
+# iptables, for example
+export LC_ALL="en_US.UTF-8"
+
 DOTDIR="/var/lib/dotfiles"
 
 os_release_file=/etc/os-release

install_scripts/ares.sh

@@ -25,7 +25,7 @@ sed -e 's/\s*\([^#]*\).*/\1/' << EOF | sfdisk ${DEVICE}
     device: ${DEVICE}
 
     ${DEVICE}1 : name=uefi      , size=512M , type=uefi
-    ${DEVICE}2 : name=boot      , size=512M , type=linux
+    ${DEVICE}2 : name=boot      , size=1G   , type=linux
     ${DEVICE}3 : name=cryptpart ,             type=linux
 EOF
 
@@ -89,7 +89,7 @@ cat <<EOF > /etc/hosts
 127.0.1.1 ares
 EOF
 
-sed -i 's/^HOOKS=.*$/HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt lvm2 filesystems resume fsck)/' /etc/mkinitcpio.conf
+sed -i 's/^HOOKS=.*$/HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt lvm2 filesystems resume fsck)/' /etc/mkinitcpio.conf
 
 mkinitcpio -P
 

install_scripts/dionysus.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+
+set -o xtrace
+set -o nounset
+set -o errexit
+
+DEVICE="/dev/nvme0n1"
+
+if [[ ! -b "${DEVICE}" ]] ; then
+    printf '%s does not look like a device\n' "${DEVICE}"
+    exit 1
+fi
+
+if [[ ! -d /sys/firmware/efi/efivars ]] ; then
+    printf 'efivars does not exist, looks like the system is not booted in EFI mode\n'
+    exit 1
+fi
+
+loadkeys de-latin1
+
+timedatectl set-ntp true
+
+sed -e 's/\s*\([^#]*\).*/\1/' << EOF | sfdisk ${DEVICE}
+    label: gpt
+    device: ${DEVICE}
+
+    ${DEVICE}p1 : name=uefi      , size=512M , type=uefi
+    ${DEVICE}p2 : name=boot      , size=1G   , type=linux
+    ${DEVICE}p3 : name=cryptpart ,             type=linux
+EOF
+
+# might take a bit for the new partion table to be updated in-kernel
+sleep 1
+
+while : ; do
+    cryptsetup --batch-mode luksFormat --iter-time 1000 ${DEVICE}p3
+    cryptsetup --batch-mode open --tries 1 ${DEVICE}p3 cryptpart && break
+done
+
+pvcreate /dev/mapper/cryptpart
+vgcreate vgbase /dev/mapper/cryptpart
+
+lvcreate -L 16G vgbase -n swap
+lvcreate -l 100%FREE vgbase -n root
+
+yes | mkfs.fat -F32 ${DEVICE}p1
+yes | mkfs.ext4 ${DEVICE}p2
+yes | mkfs.ext4 /dev/vgbase/swap
+yes | mkfs.ext4 /dev/vgbase/root
+
+mount /dev/vgbase/root /mnt
+
+mkdir /mnt/efi
+mount ${DEVICE}p1 /mnt/efi
+
+mkdir /mnt/boot
+mount ${DEVICE}p2 /mnt/boot
+
+mkswap /dev/vgbase/swap
+swapon /dev/vgbase/swap
+
+pacstrap /mnt base linux-zen linux-firmware networkmanager intel-ucode lvm2 grub efibootmgr
+
+genfstab -U /mnt >> /mnt/etc/fstab
+
+cat << CHROOTSCRIPT > /mnt/chroot-script.sh
+
+set -o xtrace
+set -o errexit
+set -o nounset
+
+ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime
+hwclock --systohc
+
+sed -i 's/^#de_DE.UTF-8 UTF-8/de_DE.UTF-8 UTF-8/' /etc/locale.gen
+sed -i 's/^#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
+
+locale-gen
+
+printf 'LANG=en_US.UTF-8\n' > /etc/locale.conf
+
+printf 'KEYMAP=de-latin1\nFONT=lat2-16\n' > /etc/vconsole.conf
+
+printf 'dionysus\n' > /etc/hostname
+
+cat <<EOF > /etc/hosts
+127.0.0.1 localhost
+::1       localhost
+127.0.1.1 dionysus
+EOF
+
+sed -i 's/^HOOKS=.*$/HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt lvm2 filesystems resume fsck)/' /etc/mkinitcpio.conf
+
+mkinitcpio -P
+
+grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=GRUB
+
+sed -i "s/^GRUB_CMDLINE_LINUX=.*$/GRUB_CMDLINE_LINUX=\"cryptdevice=UUID=\$(blkid -s UUID -o value ${DEVICE}p3):cryptpart root=UUID=\$(blkid -s UUID -o value /dev/vgbase/root)\"/" /etc/default/grub
+sed -i "s/^GRUB_CMDLINE_LINUX_DEFAULT=.*$/GRUB_CMDLINE_LINUX_DEFAULT=\"resume=UUID=\$(blkid -s UUID -o value /dev/vgbase/swap)\"/" /etc/default/grub
+sed -i 's/^GRUB_DISABLE_RECOVERY=.*$/GRUB_DISABLE_RECOVERY=/' /etc/default/grub
+
+grub-mkconfig -o /boot/grub/grub.cfg
+
+systemctl enable NetworkManager
+
+passwd
+
+# enable root autologin on first boot
+
+mkdir /etc/systemd/system/getty@tty1.service.d/
+cat << EOF > /etc/systemd/system/getty@tty1.service.d/autologin.conf
+[Service]
+ExecStart=
+ExecStart=-/sbin/agetty -o '-p -f -- \\u' --noclear --autologin root %I $TERM
+EOF
+# ExecStartPost=/bin/rm /etc/systemd/system/getty@tty1.service.d/autologin.conf
+# ExecStartPost=/bin/rmdir /etc/systemd/system/getty@tty1.service.d/
+
+# Run
+cat << 'EOF' > /root/.bash_profile
+    if [[ "\$(tty)" == "/dev/tty1" ]] ; then
+        while ! ping -w 3 -c 3 8.8.8.8 ; do
+            nmtui
+            sleep 5
+        done
+        rm -rf /etc/systemd/system/getty@tty1.service.d/
+        if /var/lib/dotfiles/install.sh ; then
+            rm -f /root/.bash_profile
+            reboot
+        fi
+    fi
+EOF
+CHROOTSCRIPT
+
+chmod +x /mnt/chroot-script.sh
+arch-chroot /mnt /chroot-script.sh
+rm -f /mnt/chroot-script.sh

install_scripts/hera.sh

@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+
+set -o xtrace
+set -o nounset
+set -o errexit
+
+DEVICE="/dev/nvme0n1"
+
+if [[ ! -b "${DEVICE}" ]] ; then
+    printf '%s does not look like a device\n' "${DEVICE}"
+    exit 1
+fi
+
+if [[ ! -d /sys/firmware/efi/efivars ]] ; then
+    printf 'efivars does not exist, looks like the system is not booted in EFI mode\n'
+    exit 1
+fi
+
+loadkeys de-latin1
+
+timedatectl set-ntp true
+
+sed -e 's/\s*\([^#]*\).*/\1/' << EOF | sfdisk ${DEVICE}
+    label: gpt
+    device: ${DEVICE}
+
+    ${DEVICE}p1 : name=uefi, size=512M , type=uefi
+    ${DEVICE}p2 : name=boot, size=1G   , type=linux
+    ${DEVICE}p3 : name=swap, size=16G  , type=linux
+    ${DEVICE}p4 : name=root, size=60G  , type=linux
+    ${DEVICE}p5 : name=home,             type=linux
+EOF
+
+# might take a bit for the new partion table to be updated in-kernel
+sleep 1
+
+yes | mkfs.fat -F32 /dev/disk/by-partlabel/uefi
+yes | mkfs.ext4 /dev/disk/by-partlabel/boot
+yes | mkfs.ext4 /dev/disk/by-partlabel/root
+yes | mkfs.ext4 /dev/disk/by-partlabel/home
+
+mkswap /dev/disk/by-partlabel/swap
+swapon /dev/disk/by-partlabel/swap
+
+mount /dev/disk/by-partlabel/root /mnt
+
+mkdir /mnt/efi
+mount /dev/disk/by-partlabel/uefi /mnt/efi
+
+mkdir /mnt/boot
+mount /dev/disk/by-partlabel/boot /mnt/boot
+
+mkdir /mnt/home
+mount /dev/disk/by-partlabel/home /mnt/home
+
+pacstrap /mnt base linux-zen linux-firmware networkmanager intel-ucode grub efibootmgr
+
+genfstab -U /mnt >> /mnt/etc/fstab
+
+cat << CHROOTSCRIPT > /mnt/chroot-script.sh
+
+set -o xtrace
+set -o errexit
+set -o nounset
+
+ln -sf /usr/share/zoneinfo/Europe/Berlin /etc/localtime
+hwclock --systohc
+
+sed -i 's/^#de_DE.UTF-8 UTF-8/de_DE.UTF-8 UTF-8/' /etc/locale.gen
+sed -i 's/^#en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
+
+locale-gen
+
+printf 'LANG=de_DE.UTF-8\n' > /etc/locale.conf
+
+printf 'KEYMAP=de-latin1\nFONT=lat2-16\n' > /etc/vconsole.conf
+
+printf 'hera\n' > /etc/hostname
+
+cat <<EOF > /etc/hosts
+127.0.0.1 localhost
+::1       localhost
+127.0.1.1 hera
+EOF
+
+sed -i 's/^HOOKS=.*$/HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block filesystems resume fsck)/' /etc/mkinitcpio.conf
+
+mkinitcpio -P
+
+grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=GRUB
+
+sed -i 's/^GRUB_DISABLE_RECOVERY=.*$/GRUB_DISABLE_RECOVERY=/' /etc/default/grub
+sed -i "s/^GRUB_CMDLINE_LINUX_DEFAULT=.*$/GRUB_CMDLINE_LINUX_DEFAULT=\"resume=UUID=\$(blkid -s UUID -o value /dev/disk/by-partlabel/swap)\"/" /etc/default/grub
+
+grub-mkconfig -o /boot/grub/grub.cfg
+
+systemctl enable NetworkManager
+
+passwd
+
+# enable root autologin on first boot
+
+mkdir /etc/systemd/system/getty@tty1.service.d/
+cat << EOF > /etc/systemd/system/getty@tty1.service.d/autologin.conf
+[Service]
+ExecStart=
+ExecStart=-/sbin/agetty -o '-p -f -- \\u' --noclear --autologin root %I $TERM
+EOF
+# ExecStartPost=/bin/rm /etc/systemd/system/getty@tty1.service.d/autologin.conf
+# ExecStartPost=/bin/rmdir /etc/systemd/system/getty@tty1.service.d/
+
+# Run
+cat << 'EOF' > /root/.bash_profile
+    if [[ "\$(tty)" == "/dev/tty1" ]] ; then
+        while ! ping -w 3 -c 3 8.8.8.8 ; do
+            nmtui
+            sleep 5
+        done
+        rm -rf /etc/systemd/system/getty@tty1.service.d/
+        if /var/lib/dotfiles/install.sh ; then
+            rm -f /root/.bash_profile
+            reboot
+        fi
+    fi
+EOF
+CHROOTSCRIPT
+
+chmod +x /mnt/chroot-script.sh
+arch-chroot /mnt /chroot-script.sh
+rm -f /mnt/chroot-script.sh

install_scripts/neptune.sh

@@ -25,7 +25,7 @@ sed -e 's/\s*\([^#]*\).*/\1/' << EOF | sfdisk ${DEVICE}
     device: ${DEVICE}
 
     ${DEVICE}p1 : name=uefi      , size=512M , type=uefi
-    ${DEVICE}p2 : name=boot      , size=512M , type=linux
+    ${DEVICE}p2 : name=boot      , size=1G   , type=linux
     ${DEVICE}p3 : name=cryptpart ,             type=linux
 EOF
 
@@ -33,8 +33,8 @@ EOF
 sleep 1
 
 while : ; do
-    cryptsetup --batch-mode luksFormat --iter-time 1000 ${DEVICE}3
-    cryptsetup --batch-mode open --tries 1 ${DEVICE}3 cryptpart && break
+    cryptsetup --batch-mode luksFormat --iter-time 1000 ${DEVICE}p3
+    cryptsetup --batch-mode open --tries 1 ${DEVICE}p3 cryptpart && break
 done
 
 pvcreate /dev/mapper/cryptpart
@@ -89,7 +89,7 @@ cat <<EOF > /etc/hosts
 127.0.1.1 neptune
 EOF
 
-sed -i 's/^HOOKS=.*$/HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt lvm2 filesystems resume fsck)/' /etc/mkinitcpio.conf
+sed -i 's/^HOOKS=.*$/HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt lvm2 filesystems resume fsck)/' /etc/mkinitcpio.conf
 
 mkinitcpio -P
 

maintenance.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -o nounset
+set -o errexit
+
+sudo bash -c "pacman -Sy --needed --noconfirm archlinux-keyring && pacman -Su"
+
+./update-aur-pkgs.sh
+
+ANSIBLE_DISPLAY_OK_HOSTS=false \
+ANSIBLE_DISPLAY_SKIPPED_HOSTS=false \
+ANSIBLE_EXTRA_ARGS='' \
+make

mgr/.gitignore

@@ -0,0 +1 @@
+/target

mgr/Cargo.lock

@@ -0,0 +1,503 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bytes"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+
+[[package]]
+name = "cc"
+version = "1.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "590f9024a68a8c40351881787f1934dc11afd69090f5edb6831464694d836ea3"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fd1289c04a9ea8cb22300a459a72a385d7c73d3259e2ed7dcb2af674838cfa9"
+
+[[package]]
+name = "deranged"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d630bccd429a5bb5a64b5e94f693bfc48c9f8566418fda4c494cc94f911f87cc"
+dependencies = [
+ "powerfmt",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e178e4fba8a2726903f6ba98a6d221e76f9c12c650d5dc0e6afdc50677b49650"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "getrandom"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "http"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "itoa"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libc"
+version = "0.2.175"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
+
+[[package]]
+name = "log"
+version = "0.4.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+
+[[package]]
+name = "mgr"
+version = "0.1.0"
+dependencies = [
+ "thiserror",
+ "time",
+ "tracing",
+ "tracing-subscriber",
+ "ureq",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89ae43fd86e4158d6db51ad8e2b80f313af9cc74f5c0e03ccb87de09998732de"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom",
+ "libc",
+ "untrusted",
+ "windows-sys",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0ebcbd2f03de0fc1122ad9bb24b127a5a6cd51d72604a3f3c50ac459762b6cc"
+dependencies = [
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a17884ae0c1b773f1ccd2bd4a8c72f16da897310a98b0e84bf349ad5ead92fc"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.219"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.219"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3467d614147380f2e4e374161426ff399c91084acd2363eaf549172b3d5e60c0"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c5e1be1c48b9172ee610da68fd9cd2770e7a4056cb3fc98710ee6906f0c7960"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83bde6f1ec10e72d583d91623c939f623002284ef622b87de38cfd546cbf2031"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
+
+[[package]]
+name = "time-macros"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tracing"
+version = "0.1.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+dependencies = [
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
+dependencies = [
+ "sharded-slab",
+ "thread_local",
+ "tracing-core",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "ureq"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00432f493971db5d8e47a65aeb3b02f8226b9b11f1450ff86bb772776ebadd70"
+dependencies = [
+ "base64",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf-8",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe120bb823a0061680e66e9075942fcdba06d46551548c2c259766b9558bc9a"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "zeroize"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"

mgr/Cargo.toml

@@ -0,0 +1,184 @@
+[package]
+name = "mgr"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+thiserror = { version = "2.0.16", default-features = false }
+time = { version = "0.3.43", default-features = false, features = ["formatting", "parsing", "std"] }
+tracing = { version = "0.1.41", default-features = false }
+tracing-subscriber = { version = "0.3.20", default-features = false, features = ["fmt"] }
+ureq = { version = "3.1.0", default-features = false, features = ["rustls"] }
+
+[[bin]]
+name = "workstation-mgr"
+path = "src/bin/main.rs"
+
+[[bin]]
+name = "workstation-client"
+path = "src/bin/client.rs"
+
+[profile.release]
+strip = true
+lto = true
+codegen-units = 1
+panic = "abort"
+
+[lints.clippy]
+# enabled groups
+correctness = { level = "deny", priority = -1 }
+suspicious = { level = "warn", priority = -1 }
+style = { level = "warn", priority = -1 }
+complexity = { level = "warn", priority = -1 }
+perf = { level = "warn", priority = -1 }
+cargo = { level = "warn", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
+nursery = { level = "warn", priority = -1 }
+
+# pedantic overrides
+too_many_lines = "allow"
+must_use_candidate = "allow"
+map_unwrap_or = "allow"
+missing_errors_doc = "allow"
+if_not_else = "allow"
+similar_names = "allow"
+redundant_else = "allow"
+
+# nursery overrides
+missing_const_for_fn = "allow"
+option_if_let_else = "allow"
+redundant_pub_crate = "allow"
+
+# complexity overrides
+too_many_arguments = "allow"
+
+# style overrides
+new_without_default = "allow"
+redundant_closure = "allow"
+
+# cargo overrides
+multiple_crate_versions = "allow"
+cargo_common_metadata = "allow"
+
+# selected restrictions
+allow_attributes = "warn"
+allow_attributes_without_reason = "warn"
+arithmetic_side_effects = "warn"
+as_conversions = "warn"
+assertions_on_result_states = "warn"
+cfg_not_test = "warn"
+clone_on_ref_ptr = "warn"
+create_dir = "warn"
+dbg_macro = "warn"
+decimal_literal_representation = "warn"
+default_numeric_fallback = "warn"
+deref_by_slicing = "warn"
+disallowed_script_idents = "warn"
+empty_drop = "warn"
+empty_enum_variants_with_brackets = "warn"
+empty_structs_with_brackets = "warn"
+exit = "warn"
+filetype_is_file = "warn"
+float_arithmetic = "warn"
+float_cmp_const = "warn"
+fn_to_numeric_cast_any = "warn"
+format_push_string = "warn"
+get_unwrap = "warn"
+indexing_slicing = "warn"
+infinite_loop = "warn"
+inline_asm_x86_att_syntax = "warn"
+inline_asm_x86_intel_syntax = "warn"
+integer_division = "warn"
+iter_over_hash_type = "warn"
+large_include_file = "warn"
+let_underscore_must_use = "warn"
+let_underscore_untyped = "warn"
+little_endian_bytes = "warn"
+lossy_float_literal = "warn"
+map_err_ignore = "warn"
+mem_forget = "warn"
+missing_assert_message = "warn"
+missing_asserts_for_indexing = "warn"
+mixed_read_write_in_expression = "warn"
+modulo_arithmetic = "warn"
+multiple_inherent_impl = "warn"
+multiple_unsafe_ops_per_block = "warn"
+mutex_atomic = "warn"
+panic = "warn"
+partial_pub_fields = "warn"
+pattern_type_mismatch = "warn"
+print_stderr = "warn"
+print_stdout = "warn"
+pub_without_shorthand = "warn"
+rc_buffer = "warn"
+rc_mutex = "warn"
+redundant_type_annotations = "warn"
+renamed_function_params = "warn"
+rest_pat_in_fully_bound_structs = "warn"
+same_name_method = "warn"
+self_named_module_files = "warn"
+semicolon_inside_block = "warn"
+str_to_string = "warn"
+string_add = "warn"
+string_lit_chars_any = "warn"
+string_slice = "warn"
+implicit_clone = "warn"
+suspicious_xor_used_as_pow = "warn"
+tests_outside_test_module = "warn"
+todo = "warn"
+try_err = "warn"
+undocumented_unsafe_blocks = "warn"
+unimplemented = "warn"
+unnecessary_safety_comment = "warn"
+unnecessary_safety_doc = "warn"
+unnecessary_self_imports = "warn"
+unneeded_field_pattern = "warn"
+unseparated_literal_suffix = "warn"
+unused_result_ok = "warn"
+unwrap_used = "warn"
+use_debug = "warn"
+verbose_file_reads = "warn"
+
+# restrictions explicit allows
+absolute_paths = "allow"
+alloc_instead_of_core = "allow"
+as_underscore = "allow"
+big_endian_bytes = "allow"
+default_union_representation = "allow"
+error_impl_error = "allow"
+exhaustive_enums = "allow"
+exhaustive_structs = "allow"
+expect_used = "allow"
+field_scoped_visibility_modifiers = "allow"
+host_endian_bytes = "allow"
+if_then_some_else_none = "allow"
+impl_trait_in_params = "allow"
+implicit_return = "allow"
+integer_division_remainder_used = "allow"
+min_ident_chars = "allow"
+missing_docs_in_private_items = "allow"
+missing_inline_in_public_items = "allow"
+missing_trait_methods = "allow"
+mod_module_files = "allow"
+needless_raw_strings = "allow"
+non_ascii_literal = "allow"
+non_zero_suggestions = "allow"
+panic_in_result_fn = "allow"
+pathbuf_init_then_push = "allow"
+pub_use = "allow"
+pub_with_shorthand = "allow"
+question_mark_used = "allow"
+ref_patterns = "allow"
+semicolon_outside_block = "allow"
+separated_literal_suffix = "allow"
+shadow_reuse = "allow"
+shadow_same = "allow"
+shadow_unrelated = "allow"
+single_call_fn = "allow"
+single_char_lifetime_names = "allow"
+std_instead_of_alloc = "allow"
+std_instead_of_core = "allow"
+unreachable = "allow"
+unused_trait_names = "allow"
+unwrap_in_result = "allow"
+wildcard_enum_match_arm = "allow"

mgr/src/bin/client.rs

@@ -0,0 +1,87 @@
+#![expect(
+    clippy::print_stderr,
+    clippy::print_stdout,
+    reason = "output is fine for cli"
+)]
+
+use std::{
+    env,
+    io::{self, Read as _},
+    net,
+    os::unix::net::UnixStream,
+    process, str,
+};
+
+use thiserror::Error;
+
+use mgr::{
+    Action,
+    cli::{self, CliCommand as _, ParseError},
+    wire::{client, socket},
+};
+
+#[derive(Debug, Error)]
+enum Error {
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error(transparent)]
+    Socket(#[from] socket::Error),
+    #[error(transparent)]
+    Send(#[from] client::SendError),
+    #[error(transparent)]
+    CliParse(#[from] cli::ParseError),
+    #[error("response is not valid utf8: {0}")]
+    ResponseNonUtf8(#[from] str::Utf8Error),
+}
+
+enum MainResult {
+    Success,
+    Failure(Error),
+}
+
+impl process::Termination for MainResult {
+    fn report(self) -> process::ExitCode {
+        match self {
+            Self::Success => process::ExitCode::SUCCESS,
+            Self::Failure(e) => {
+                eprintln!("Error: {e}");
+                process::ExitCode::FAILURE
+            }
+        }
+    }
+}
+
+fn main() -> MainResult {
+    fn inner() -> Result<(), Error> {
+        let mut args = env::args().skip(1);
+
+        let action =
+            Action::parse_str(args.next().ok_or(ParseError::MissingAction)?.as_str(), args)?;
+
+        let socket = socket::get_socket_path()?;
+        let mut stream = UnixStream::connect(socket)?;
+
+        action.send(&mut stream)?;
+
+        stream.shutdown(net::Shutdown::Write)?;
+
+        let response = {
+            let mut buf = Vec::new();
+            stream.read_to_end(&mut buf)?;
+            let response = str::from_utf8(&buf)?.to_owned();
+            drop(stream);
+            response
+        };
+
+        if !response.is_empty() {
+            println!("{response}");
+        }
+
+        Ok(())
+    }
+
+    match inner() {
+        Ok(()) => MainResult::Success,
+        Err(e) => MainResult::Failure(e),
+    }
+}

mgr/src/bin/main.rs

@@ -0,0 +1,105 @@
+#![expect(
+    clippy::print_stderr,
+    clippy::print_stdout,
+    reason = "output is fine for cli"
+)]
+
+use std::{env, process};
+
+use thiserror::Error;
+use tracing::Level;
+
+use mgr::{
+    self, Action, Exec as _,
+    cli::{CliCommand as _, ParseError},
+};
+
+#[derive(Debug, Error)]
+enum Error {
+    #[error(transparent)]
+    Power(#[from] mgr::power::Error),
+    #[error(transparent)]
+    Dmenu(#[from] mgr::dmenu::Error),
+    #[error(transparent)]
+    Server(#[from] mgr::wire::server::Error),
+    #[error(transparent)]
+    Presentation(#[from] mgr::present::Error),
+    #[error(transparent)]
+    Exec(#[from] mgr::ExecError),
+    #[error(transparent)]
+    ParseParse(#[from] ParseError),
+    #[error(transparent)]
+    Tracing(#[from] tracing::dispatcher::SetGlobalDefaultError),
+}
+
+enum MainResult {
+    Success,
+    Failure(Error),
+}
+
+impl process::Termination for MainResult {
+    fn report(self) -> process::ExitCode {
+        match self {
+            Self::Success => process::ExitCode::SUCCESS,
+            Self::Failure(e) => {
+                eprintln!("Error: {e}");
+                process::ExitCode::FAILURE
+            }
+        }
+    }
+}
+
+impl From<Error> for MainResult {
+    fn from(value: Error) -> Self {
+        Self::Failure(value)
+    }
+}
+
+fn init_tracing() -> Result<(), Error> {
+    tracing::subscriber::set_global_default(
+        tracing_subscriber::fmt()
+            .with_max_level(Level::DEBUG)
+            .event_format(
+                tracing_subscriber::fmt::format()
+                    .with_ansi(false)
+                    .with_target(false)
+                    .compact(),
+            )
+            .finish(),
+    )?;
+    Ok(())
+}
+
+fn main() -> MainResult {
+    fn inner() -> Result<(), Error> {
+        init_tracing()?;
+
+        let mut args = env::args().skip(1);
+
+        match args.next().ok_or(ParseError::MissingAction)?.as_str() {
+            "serve" => {
+                mgr::wire::server::run()?;
+                Ok(())
+            }
+            "run" => {
+                let action = Action::parse_str(
+                    args.next().ok_or(ParseError::MissingAction)?.as_str(),
+                    args,
+                )?;
+                if let Some(output) = action.execute()? {
+                    println!("{output}");
+                }
+                Ok(())
+            }
+            input => Err(ParseError::UnknownAction {
+                action: input.to_owned(),
+            }
+            .into()),
+        }
+    }
+
+    match inner() {
+        Ok(()) => MainResult::Success,
+        Err(e) => MainResult::Failure(e),
+    }
+}

mgr/src/brightness.rs

@@ -0,0 +1,77 @@
+use thiserror::Error;
+
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd,
+    wire::{WireCommand, server},
+};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    Inc,
+    Dec,
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => Ok(Self::Inc),
+            0x02 => Ok(Self::Dec),
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::Inc => vec![0x01],
+            Self::Dec => vec![0x02],
+        }
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(input: &str, rest: impl Iterator<Item = String>) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "inc" => Self::Inc,
+            "dec" => Self::Dec,
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::Inc => cmd::command("brightnessctl", &["set", "8%+"])?,
+            Self::Dec => cmd::command("brightnessctl", &["set", "8%-"])?,
+        }
+        Ok(None)
+    }
+}

mgr/src/cli.rs

@@ -0,0 +1,23 @@
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum ParseError {
+    #[error("no action given")]
+    MissingAction,
+    #[error("unknown action: {action}")]
+    UnknownAction { action: String },
+    #[error("unexpected input: {rest:?}")]
+    UnexpectedInput { rest: Vec<String> },
+    #[error("missing argument")]
+    MissingArgument,
+    #[error("error parsing argument: {message}")]
+    ArgumentParse { message: String },
+}
+
+pub trait CliCommand {
+    type ExecErr: From<ParseError>;
+
+    fn parse_str(input: &str, rest: impl Iterator<Item = String>) -> Result<Self, ParseError>
+    where
+        Self: Sized;
+}

mgr/src/cmd.rs

@@ -0,0 +1,183 @@
+use std::{io, panic, process, str, thread};
+
+use thiserror::Error;
+use tracing::{Level, event};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error("command \"{command}\" failed: {error}")]
+    CommandInvocation {
+        command: &'static str,
+        error: io::Error,
+    },
+    #[error("command \"{command}\" was terminated by signal")]
+    CommandTerminatedBySignal { command: &'static str },
+    #[error(
+        "command \"{command}\" failed [{code}]: {stderr}",
+        code = match *.code {
+            Some(code) => &.code.to_string(),
+            _ => "unknown exit code",
+        },
+        stderr = if .stderr.is_empty() {
+            "[stderr empty]"
+        } else {
+            .stderr
+    })]
+    CommandFailed {
+        command: &'static str,
+        code: Option<i32>,
+        stderr: String,
+    },
+    #[error("{command} produced non-utf8 output: {error}")]
+    CommandOutputNonUtf8 {
+        command: &'static str,
+        error: str::Utf8Error,
+    },
+    #[error("failed writing to stdin of command \"{command}\": {error}")]
+    StdinWriteFailed {
+        command: &'static str,
+        error: io::Error,
+    },
+}
+
+pub(crate) fn command(command: &'static str, args: &[&str]) -> Result<(), Error> {
+    let _: FinishedProcess = run_command_checked(command, args)?;
+    Ok(())
+}
+
+pub(crate) fn run_command(command: &'static str, args: &[&str]) -> Result<FinishedProcess, Error> {
+    event!(Level::DEBUG, "running {command} {args:?}");
+    let proc = process::Command::new(command)
+        .args(args)
+        .output()
+        .map_err(|error| Error::CommandInvocation { command, error })?;
+
+    Ok(FinishedProcess {
+        exit_code: proc
+            .status
+            .code()
+            .ok_or(Error::CommandTerminatedBySignal { command })?,
+        stdout: str::from_utf8(&proc.stdout)
+            .map_err(|error| Error::CommandOutputNonUtf8 { command, error })?
+            .to_owned(),
+        stderr: str::from_utf8(&proc.stderr)
+            .map_err(|error| Error::CommandOutputNonUtf8 { command, error })?
+            .to_owned(),
+    })
+}
+
+pub(crate) fn run_command_checked(
+    command: &'static str,
+    args: &[&str],
+) -> Result<FinishedProcess, Error> {
+    let output = run_command(command, args)?;
+
+    if output.exit_code != 0_i32 {
+        event!(Level::DEBUG, "{command} {args:?} failed");
+        return Err(Error::CommandFailed {
+            command,
+            code: Some(output.exit_code),
+            stderr: output.stderr,
+        });
+    }
+
+    Ok(output)
+}
+
+pub(crate) fn command_output(command: &'static str, args: &[&str]) -> Result<String, Error> {
+    let output = run_command_checked(command, args)?;
+    Ok(output.stdout)
+}
+
+#[derive(Debug)]
+pub(crate) struct FinishedProcess {
+    pub exit_code: i32,
+    pub stdout: String,
+    pub stderr: String,
+}
+
+pub(crate) fn command_output_with_stdin_write(
+    command: &'static str,
+    args: &[&str],
+    input: &[u8],
+) -> Result<FinishedProcess, Error> {
+    use io::Write as _;
+
+    let process = process::Command::new(command)
+        .args(args)
+        .stdin(process::Stdio::piped())
+        .stdout(process::Stdio::piped())
+        .stderr(process::Stdio::null())
+        .spawn()
+        .map_err(|error| Error::CommandInvocation { command, error })?;
+
+    let mut stdin = process
+        .stdin
+        .as_ref()
+        .expect("stdin handle must be present");
+
+    stdin
+        .write_all(input)
+        .map_err(|error| Error::StdinWriteFailed { command, error })?;
+
+    let output = process
+        .wait_with_output()
+        .map_err(|error| Error::CommandInvocation { command, error })?;
+
+    let exit_code = output
+        .status
+        .code()
+        .ok_or(Error::CommandTerminatedBySignal { command })?;
+
+    let stdout = str::from_utf8(&output.stdout)
+        .map_err(|error| Error::CommandOutputNonUtf8 { command, error })?
+        .to_owned();
+
+    let stderr = str::from_utf8(&output.stderr)
+        .map_err(|error| Error::CommandOutputNonUtf8 { command, error })?
+        .to_owned();
+
+    Ok(FinishedProcess {
+        exit_code,
+        stdout,
+        stderr,
+    })
+}
+
+pub(crate) struct RunningProcess {
+    command: &'static str,
+    join_handle: thread::JoinHandle<Result<FinishedProcess, Error>>,
+}
+
+impl RunningProcess {
+    pub fn with<F: Fn() -> Result<(), E>, E: From<Error>>(
+        self,
+        f: F,
+    ) -> Result<FinishedProcess, E> {
+        f()?;
+        event!(
+            Level::DEBUG,
+            "waiting for process {} to finish",
+            self.command
+        );
+        let ret = match self.join_handle.join() {
+            Ok(ret) => ret?,
+            Err(e) => panic::resume_unwind(e),
+        };
+        event!(Level::DEBUG, "process {} finished", self.command);
+        Ok(ret)
+    }
+}
+
+pub(crate) fn start_command(
+    command: &'static str,
+    args: &'static [&'static str],
+) -> RunningProcess {
+    event!(Level::DEBUG, "starting {command} {args:?}");
+    let join_handle = thread::spawn(move || run_command_checked(command, args));
+
+    RunningProcess {
+        command,
+        join_handle,
+    }
+}

mgr/src/dirs.rs

@@ -0,0 +1,29 @@
+use std::path::PathBuf;
+
+use thiserror::Error;
+
+use super::env;
+
+const ENV_XDG_RUNTIME_DIR: &str = "XDG_RUNTIME_DIR";
+const ENV_XDG_CACHE_DIR: &str = "XDG_CACHE_HOME";
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error(transparent)]
+    Env(#[from] env::Error),
+}
+
+pub(crate) fn xdg_runtime_dir() -> Result<Option<PathBuf>, Error> {
+    Ok(env::get(ENV_XDG_RUNTIME_DIR)?.map(PathBuf::from))
+}
+
+pub(crate) fn require_xdg_runtime_dir() -> Result<PathBuf, Error> {
+    Ok(PathBuf::from(env::require(ENV_XDG_RUNTIME_DIR)?))
+}
+
+pub(crate) fn xdg_cache_dir() -> Result<PathBuf, Error> {
+    Ok(match env::get(ENV_XDG_CACHE_DIR)? {
+        Some(value) => PathBuf::from(value),
+        None => PathBuf::from(env::require("HOME")?).join(".cache"),
+    })
+}

mgr/src/dmenu.rs

@@ -0,0 +1,66 @@
+use std::{fmt::Write as _, num};
+
+use thiserror::Error;
+use tracing::{Level, event};
+
+use super::cmd;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("rofi did not return an integer: {error}")]
+    RofiNonIntOutput { error: num::ParseIntError },
+    #[error("rofi returned an invalid indexx: {index}")]
+    RofiInvalidIndex { index: usize },
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+}
+
+pub(crate) fn get_choice(actions: &[&'static str]) -> Result<Option<&'static str>, Error> {
+    const ROFI: &str = "rofi";
+
+    event!(Level::DEBUG, "starting rofi");
+
+    let process = cmd::command_output_with_stdin_write(
+        ROFI,
+        &[
+            "-dmenu",
+            "-p",
+            "action",
+            "-l",
+            &actions.len().to_string(),
+            "-no-custom",
+            "-sync",
+            "-format",
+            "i",
+        ],
+        actions
+            .iter()
+            .enumerate()
+            .fold(String::new(), |mut output, (i, action)| {
+                writeln!(
+                    output,
+                    "({i}) {action}",
+                    i = i.checked_add(1).expect("too many action")
+                )
+                .expect("writing to string cannot fail");
+                output
+            })
+            .as_bytes(),
+    )?;
+
+    if process.exit_code == 1 {
+        Ok(None)
+    } else {
+        let choice = process
+            .stdout
+            .trim()
+            .parse::<usize>()
+            .map_err(|error| Error::RofiNonIntOutput { error })?;
+
+        Ok(Some(
+            actions
+                .get(choice)
+                .ok_or(Error::RofiInvalidIndex { index: choice })?,
+        ))
+    }
+}

mgr/src/dunst.rs

@@ -0,0 +1,40 @@
+use thiserror::Error;
+
+use super::cmd;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error("dunstctl is-paused returned unknown output: {output}")]
+    DunstctlIsPausedUnknownOutput { output: String },
+}
+
+#[derive(Clone, Copy)]
+pub(crate) enum Status {
+    Paused,
+    Unpaused,
+}
+
+pub(crate) fn set_status(status: Status) -> Result<(), Error> {
+    Ok(cmd::command(
+        "dunstctl",
+        &[
+            "set-paused",
+            match status {
+                Status::Paused => "true",
+                Status::Unpaused => "false",
+            },
+        ],
+    )?)
+}
+
+pub(crate) fn is_paused() -> Result<bool, Error> {
+    let output = cmd::command_output("dunstctl", &["is-paused"])?;
+
+    match output.trim() {
+        "true" => Ok(true),
+        "false" => Ok(false),
+        _ => Err(Error::DunstctlIsPausedUnknownOutput { output }),
+    }
+}

mgr/src/env.rs

@@ -0,0 +1,28 @@
+use std::{env, ffi::OsString};
+
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error(
+        "env variable \"{name}\" is not valid unicode: \"{value}\"",
+        value = value.to_string_lossy()
+    )]
+    EnvNotUnicode { name: &'static str, value: OsString },
+    #[error("env variable \"{name}\" not found")]
+    EnvNotFound { name: &'static str },
+}
+
+pub(crate) fn get(var: &'static str) -> Result<Option<String>, Error> {
+    match env::var(var) {
+        Ok(value) => Ok(Some(value)),
+        Err(e) => match e {
+            env::VarError::NotPresent => Ok(None),
+            env::VarError::NotUnicode(value) => Err(Error::EnvNotUnicode { name: var, value }),
+        },
+    }
+}
+
+pub(crate) fn require(var: &'static str) -> Result<String, Error> {
+    get(var)?.ok_or(Error::EnvNotFound { name: var })
+}

mgr/src/lib.rs

@@ -0,0 +1,205 @@
+use thiserror::Error;
+
+pub(crate) mod brightness;
+pub mod cli;
+pub(crate) mod cmd;
+pub(crate) mod dirs;
+pub mod dmenu;
+pub(crate) mod dunst;
+pub(crate) mod env;
+pub mod power;
+pub mod present;
+pub(crate) mod pulseaudio;
+pub(crate) mod redshift;
+pub(crate) mod sleep;
+pub(crate) mod spotify;
+pub(crate) mod systemd;
+pub(crate) mod theme;
+pub(crate) mod weather;
+pub mod wire;
+
+#[derive(Debug, Error)]
+pub enum ExecError {
+    #[error(transparent)]
+    Power(#[from] power::Error),
+    #[error(transparent)]
+    Presentation(#[from] present::Error),
+    #[error(transparent)]
+    Pulseaudio(#[from] pulseaudio::Error),
+    #[error(transparent)]
+    Theme(#[from] theme::Error),
+    #[error(transparent)]
+    Spotify(#[from] spotify::Error),
+    #[error(transparent)]
+    Redshift(#[from] redshift::Error),
+    #[error(transparent)]
+    Weather(#[from] weather::Error),
+    #[error(transparent)]
+    Brightness(#[from] brightness::Error),
+    #[error(transparent)]
+    Sleep(#[from] sleep::Error),
+    #[error(transparent)]
+    Parse(#[from] cli::ParseError),
+}
+
+#[derive(Debug)]
+pub enum Action {
+    Power(power::Action),
+    Present(present::Action),
+    Pulseaudio(pulseaudio::Action),
+    Theme(theme::Action),
+    Spotify(spotify::Action),
+    Redshift(redshift::Action),
+    Weather(weather::Action),
+    Brightness(brightness::Action),
+    Sleep(sleep::Action),
+}
+
+impl wire::WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, wire::server::ParseError> {
+        match input.next().ok_or(wire::server::ParseError::Eof)? {
+            0x01 => Ok(Self::Power(power::Action::parse_wire(input)?)),
+            0x02 => Ok(Self::Present(present::Action::parse_wire(input)?)),
+            0x03 => Ok(Self::Pulseaudio(pulseaudio::Action::parse_wire(input)?)),
+            0x04 => Ok(Self::Theme(theme::Action::parse_wire(input)?)),
+            0x05 => Ok(Self::Spotify(spotify::Action::parse_wire(input)?)),
+            0x06 => Ok(Self::Redshift(redshift::Action::parse_wire(input)?)),
+            0x07 => Ok(Self::Weather(weather::Action::parse_wire(input)?)),
+            0x08 => Ok(Self::Brightness(brightness::Action::parse_wire(input)?)),
+            0x09 => Ok(Self::Sleep(sleep::Action::parse_wire(input)?)),
+            other => Err(wire::server::ParseError::Unknown(other)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::Power(action) => {
+                let mut v = vec![0x01];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+            Self::Present(action) => {
+                let mut v = vec![0x02];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+            Self::Pulseaudio(action) => {
+                let mut v = vec![0x03];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+            Self::Theme(action) => {
+                let mut v = vec![0x04];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+            Self::Spotify(action) => {
+                let mut v = vec![0x05];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+            Self::Redshift(action) => {
+                let mut v = vec![0x06];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+            Self::Weather(action) => {
+                let mut v = vec![0x07];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+            Self::Brightness(action) => {
+                let mut v = vec![0x08];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+            Self::Sleep(action) => {
+                let mut v = vec![0x09];
+                v.extend_from_slice(&action.to_wire());
+                v
+            }
+        }
+    }
+}
+
+impl cli::CliCommand for Action {
+    type ExecErr = ExecError;
+
+    fn parse_str(
+        input: &str,
+        mut rest: impl Iterator<Item = String>,
+    ) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        match input {
+            "power" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Power(power::Action::parse_str(&choice, rest)?))
+            }
+            "present" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Present(present::Action::parse_str(&choice, rest)?))
+            }
+            "pulseaudio" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Pulseaudio(pulseaudio::Action::parse_str(
+                    &choice, rest,
+                )?))
+            }
+            "theme" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Theme(theme::Action::parse_str(&choice, rest)?))
+            }
+            "spotify" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Spotify(spotify::Action::parse_str(&choice, rest)?))
+            }
+            "redshift" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Redshift(redshift::Action::parse_str(&choice, rest)?))
+            }
+            "weather" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Weather(weather::Action::parse_str(&choice, rest)?))
+            }
+            "brightness" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Brightness(brightness::Action::parse_str(
+                    &choice, rest,
+                )?))
+            }
+            "sleep" => {
+                let choice = rest.next().ok_or(cli::ParseError::MissingAction)?;
+                Ok(Self::Sleep(sleep::Action::parse_str(&choice, rest)?))
+            }
+            s => Err(cli::ParseError::UnknownAction {
+                action: s.to_owned(),
+            }),
+        }
+    }
+}
+
+pub trait Exec {
+    type ExecErr: Into<ExecError>;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr>;
+}
+
+impl Exec for Action {
+    type ExecErr = ExecError;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::Power(action) => Ok(action.execute()?),
+            Self::Present(action) => Ok(action.execute()?),
+            Self::Pulseaudio(action) => Ok(action.execute()?),
+            Self::Theme(action) => Ok(action.execute()?),
+            Self::Spotify(action) => Ok(action.execute()?),
+            Self::Redshift(action) => Ok(action.execute()?),
+            Self::Weather(action) => Ok(action.execute()?),
+            Self::Brightness(action) => Ok(action.execute()?),
+            Self::Sleep(action) => Ok(action.execute()?),
+        }
+    }
+}

mgr/src/power.rs

@@ -0,0 +1,227 @@
+use thiserror::Error;
+use tracing::{Level, event};
+
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd, dmenu, dunst, spotify,
+    wire::{WireCommand, server},
+};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Dunst(#[from] dunst::Error),
+    #[error("unknown action: {action}")]
+    UnknownAction { action: String },
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error(transparent)]
+    Dmenu(#[from] dmenu::Error),
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+    #[error(transparent)]
+    Spotify(#[from] spotify::Error),
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    Menu,
+    Lock,
+    Suspend,
+    Hibernate,
+    Reboot,
+    Poweroff,
+}
+
+impl Action {
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::Menu => "menu",
+            Self::Lock => "lock",
+            Self::Suspend => "suspend",
+            Self::Hibernate => "hibernate",
+            Self::Reboot => "reboot",
+            Self::Poweroff => "poweroff",
+        }
+    }
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => Ok(Self::Menu),
+            0x02 => Ok(Self::Lock),
+            0x03 => Ok(Self::Suspend),
+            0x04 => Ok(Self::Hibernate),
+            0x05 => Ok(Self::Reboot),
+            0x06 => Ok(Self::Poweroff),
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::Menu => vec![0x01],
+            Self::Lock => vec![0x02],
+            Self::Suspend => vec![0x03],
+            Self::Hibernate => vec![0x04],
+            Self::Reboot => vec![0x05],
+            Self::Poweroff => vec![0x06],
+        }
+    }
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::Menu => menu()?,
+            Self::Lock => lock_and_screen_off()?,
+            Self::Suspend => lock_and_suspend()?,
+            Self::Hibernate => hibernate()?,
+            Self::Reboot => reboot()?,
+            Self::Poweroff => poweroff()?,
+        }
+        Ok(None)
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(input: &str, rest: impl Iterator<Item = String>) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "menu" => Self::Menu,
+            "lock" => Self::Lock,
+            "suspend" => Self::Suspend,
+            "hibernate" => Self::Hibernate,
+            "reboot" => Self::Reboot,
+            "shutdown" => Self::Poweroff,
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}
+
+const MENU_ACTIONS: &[Action] = &[
+    Action::Lock,
+    Action::Suspend,
+    Action::Hibernate,
+    Action::Reboot,
+    Action::Poweroff,
+];
+
+fn menu() -> Result<(), Error> {
+    let choice = dmenu::get_choice(
+        &MENU_ACTIONS
+            .iter()
+            .map(|action| action.as_str())
+            .collect::<Vec<&str>>(),
+    )?;
+
+    if let Some(choice) = choice {
+        MENU_ACTIONS
+            .iter()
+            .find(|action| action.as_str() == choice)
+            .copied()
+            .expect("choice must be one of the valid values")
+            .execute()?;
+    } else {
+        event!(Level::DEBUG, "rofi was cancelled");
+    }
+
+    Ok(())
+}
+
+fn screen_off() -> Result<(), Error> {
+    Ok(cmd::command("xset", &["dpms", "force", "off"])?)
+}
+
+fn lock() -> Result<cmd::RunningProcess, Error> {
+    match spotify::pause() {
+        Ok(_) => (),
+        Err(spotify::Error::NotFound) => (),
+        Err(e) => return Err(e.into()),
+    }
+
+    let lock_handle = cmd::start_command(
+        "i3lock",
+        &[
+            "--nofork",
+            "--show-failed-attempts",
+            "--ignore-empty-password",
+            "--color",
+            "000000",
+        ],
+    );
+
+    Ok(lock_handle)
+}
+
+fn reset_screen() -> Result<(), Error> {
+    Ok(cmd::command(
+        "systemctl",
+        &["--user", "restart", "dpms.service"],
+    )?)
+}
+
+fn lock_and_screen_off() -> Result<(), Error> {
+    let dunst_paused = dunst::is_paused()?;
+    if dunst_paused {
+        dunst::set_status(dunst::Status::Paused)?;
+    }
+
+    lock()?.with(|| -> Result<(), Error> {
+        screen_off()?;
+        Ok(())
+    })?;
+
+    if dunst_paused {
+        dunst::set_status(dunst::Status::Unpaused)?;
+    }
+
+    reset_screen()?;
+
+    Ok(())
+}
+
+fn suspend() -> Result<(), Error> {
+    Ok(cmd::command("systemctl", &["suspend"])?)
+}
+
+fn hibernate() -> Result<(), Error> {
+    Ok(cmd::command("systemctl", &["hibernate"])?)
+}
+
+fn reboot() -> Result<(), Error> {
+    Ok(cmd::command("systemctl", &["reboot"])?)
+}
+
+fn poweroff() -> Result<(), Error> {
+    Ok(cmd::command("systemctl", &["poweroff"])?)
+}
+
+fn lock_and_suspend() -> Result<(), Error> {
+    lock()?.with(|| -> Result<(), Error> {
+        screen_off()?;
+        suspend()?;
+        Ok(())
+    })?;
+
+    Ok(())
+}

mgr/src/present.rs

@@ -0,0 +1,154 @@
+use std::{fs, io, path::PathBuf};
+
+use thiserror::Error;
+
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd, dirs, dunst, redshift, spotify,
+    wire::{WireCommand, server},
+};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error("unknown action: {action}")]
+    UnknownAction { action: String },
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+    #[error(transparent)]
+    Dirs(#[from] dirs::Error),
+    #[error(transparent)]
+    Dunst(#[from] dunst::Error),
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error(transparent)]
+    Redshift(#[from] redshift::Error),
+    #[error(transparent)]
+    Spotify(#[from] spotify::Error),
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    On,
+    Off,
+    Toggle,
+    Status,
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => Ok(Self::On),
+            0x02 => Ok(Self::Off),
+            0x03 => Ok(Self::Toggle),
+            0x04 => Ok(Self::Status),
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::On => vec![0x01],
+            Self::Off => vec![0x02],
+            Self::Toggle => vec![0x03],
+            Self::Status => vec![0x04],
+        }
+    }
+}
+
+fn status_file() -> Result<PathBuf, Error> {
+    Ok(dirs::require_xdg_runtime_dir()?.join("presentation-mode-on"))
+}
+
+#[derive(Debug, Clone, Copy)]
+enum Status {
+    On,
+    Off,
+}
+
+fn status() -> Result<Status, Error> {
+    Ok(if status_file()?.exists() {
+        Status::On
+    } else {
+        Status::Off
+    })
+}
+
+fn on() -> Result<(), Error> {
+    drop(fs::File::create(status_file()?)?);
+    dunst::set_status(dunst::Status::Paused)?;
+    redshift::set(redshift::Status::Off)?;
+    spotify::set(spotify::Status::Off)?;
+    Ok(())
+}
+
+fn off() -> Result<(), Error> {
+    fs::remove_file(status_file()?)?;
+    dunst::set_status(dunst::Status::Unpaused)?;
+    redshift::set(redshift::Status::On)?;
+    spotify::set(spotify::Status::On)?;
+    Ok(())
+}
+
+fn toggle() -> Result<(), Error> {
+    match status()? {
+        Status::On => off()?,
+        Status::Off => on()?,
+    }
+    Ok(())
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::On => {
+                on()?;
+                Ok(None)
+            }
+            Self::Off => {
+                off()?;
+                Ok(None)
+            }
+            Self::Toggle => {
+                toggle()?;
+                Ok(None)
+            }
+            Self::Status => Ok(match status()? {
+                Status::On => Some("on".to_owned()),
+                Status::Off => Some("off".to_owned()),
+            }),
+        }
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(input: &str, rest: impl Iterator<Item = String>) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "on" => Self::On,
+            "off" => Self::Off,
+            "toggle" => Self::Toggle,
+            "status" => Self::Status,
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}

mgr/src/pulseaudio.rs

@@ -0,0 +1,112 @@
+use thiserror::Error;
+
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd,
+    wire::{WireCommand, server},
+};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    InputToggle,
+    OutputToggle,
+    OutputInc,
+    OutputDec,
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => Ok(Self::InputToggle),
+            0x02 => Ok(Self::OutputToggle),
+            0x03 => Ok(Self::OutputInc),
+            0x04 => Ok(Self::OutputDec),
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::InputToggle => vec![0x01],
+            Self::OutputToggle => vec![0x02],
+            Self::OutputInc => vec![0x03],
+            Self::OutputDec => vec![0x04],
+        }
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(
+        input: &str,
+        mut rest: impl Iterator<Item = String>,
+    ) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "input" => match rest.next().ok_or(cli::ParseError::MissingAction)?.as_str() {
+                "toggle" => Self::InputToggle,
+                s => {
+                    return Err(cli::ParseError::UnknownAction {
+                        action: s.to_owned(),
+                    });
+                }
+            },
+            "output" => match rest.next().ok_or(cli::ParseError::MissingAction)?.as_str() {
+                "toggle" => Self::OutputToggle,
+                "inc" => Self::OutputInc,
+                "dec" => Self::OutputDec,
+                s => {
+                    return Err(cli::ParseError::UnknownAction {
+                        action: s.to_owned(),
+                    });
+                }
+            },
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::InputToggle => {
+                cmd::command("pactl", &["set-source-mute", "@DEFAULT_SOURCE@", "toggle"])?;
+            }
+            Self::OutputToggle => {
+                cmd::command("pactl", &["set-sink-mute", "@DEFAULT_SINK@", "toggle"])?;
+            }
+            Self::OutputInc => {
+                cmd::command("pactl", &["set-sink-volume", "@DEFAULT_SINK@", "+5%"])?;
+            }
+            Self::OutputDec => {
+                cmd::command("pactl", &["set-sink-volume", "@DEFAULT_SINK@", "-5%"])?;
+            }
+        }
+        Ok(None)
+    }
+}

mgr/src/redshift.rs

@@ -0,0 +1,116 @@
+use thiserror::Error;
+
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd, systemd,
+    wire::{WireCommand, server},
+};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+    #[error(transparent)]
+    Systemd(#[from] systemd::Error),
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    Start,
+    Stop,
+    Status,
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => Ok(Self::Start),
+            0x02 => Ok(Self::Stop),
+            0x03 => Ok(Self::Status),
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::Start => vec![0x01],
+            Self::Stop => vec![0x02],
+            Self::Status => vec![0x03],
+        }
+    }
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::Start => {
+                set(Status::On)?;
+                Ok(None)
+            }
+            Self::Stop => {
+                set(Status::Off)?;
+                Ok(None)
+            }
+            Self::Status => Ok(
+                if systemd::user::unit_status("redshift.service")?.is_active() {
+                    Some("active".to_owned())
+                } else {
+                    Some("inactive".to_owned())
+                },
+            ),
+        }
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(input: &str, rest: impl Iterator<Item = String>) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "start" => Self::Start,
+            "stop" => Self::Stop,
+            "status" => Self::Status,
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum Status {
+    On,
+    Off,
+}
+
+pub(crate) fn set(status: Status) -> Result<(), Error> {
+    Ok(cmd::command(
+        "systemctl",
+        &[
+            "--user",
+            "--no-block",
+            match status {
+                Status::On => "start",
+                Status::Off => "stop",
+            },
+            "redshift.service",
+        ],
+    )?)
+}

mgr/src/sleep.rs

@@ -0,0 +1,104 @@
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd,
+    wire::{WireCommand, server},
+};
+
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    Sleep(std::time::Duration),
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => {
+                const BYTES: usize = (u64::BITS / 8) as usize;
+                let input = input.take(BYTES).collect::<Vec<u8>>();
+                let input: [u8; BYTES] =
+                    input
+                        .try_into()
+                        .map_err(|vec: Vec<u8>| server::ParseError::MissingBytes {
+                            expected: BYTES,
+                            received: vec.len(),
+                        })?;
+
+                let secs = u64::from_le_bytes(input);
+                let duration = std::time::Duration::from_secs(secs);
+                Ok(Self::Sleep(duration))
+            }
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::Sleep(duration) => {
+                let mut v = vec![0x01];
+                v.extend(duration.as_secs().to_le_bytes());
+                v
+            }
+        }
+    }
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::Sleep(duration) => {
+                std::thread::sleep(duration);
+                Ok(None)
+            }
+        }
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(
+        input: &str,
+        mut rest: impl Iterator<Item = String>,
+    ) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "sleep" => {
+                let input = rest.next().ok_or(cli::ParseError::MissingArgument)?;
+                let seconds =
+                    input
+                        .parse::<u64>()
+                        .map_err(|err| cli::ParseError::ArgumentParse {
+                            message: err.to_string(),
+                        })?;
+                Self::Sleep(std::time::Duration::from_secs(seconds))
+            }
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}

mgr/src/spotify.rs

@@ -0,0 +1,173 @@
+use thiserror::Error;
+
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd, systemd,
+    wire::{WireCommand, server},
+};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+    #[error(transparent)]
+    Systemd(#[from] systemd::Error),
+    #[error("spotify does not seem to be running")]
+    NotFound,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    Start,
+    Stop,
+    Status,
+    Play,
+    Pause,
+    Toggle,
+    Previous,
+    Next,
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => Ok(Self::Start),
+            0x02 => Ok(Self::Stop),
+            0x03 => Ok(Self::Status),
+            0x04 => Ok(Self::Play),
+            0x05 => Ok(Self::Pause),
+            0x06 => Ok(Self::Toggle),
+            0x07 => Ok(Self::Previous),
+            0x08 => Ok(Self::Next),
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::Start => vec![0x01],
+            Self::Stop => vec![0x02],
+            Self::Status => vec![0x03],
+            Self::Play => vec![0x04],
+            Self::Pause => vec![0x05],
+            Self::Toggle => vec![0x06],
+            Self::Previous => vec![0x07],
+            Self::Next => vec![0x08],
+        }
+    }
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::Start => {
+                set(Status::On)?;
+                Ok(None)
+            }
+            Self::Stop => {
+                set(Status::Off)?;
+                Ok(None)
+            }
+            Self::Status => Ok(
+                if systemd::user::unit_status("spotify.service")?.is_active() {
+                    Some("active".to_owned())
+                } else {
+                    Some("inactive".to_owned())
+                },
+            ),
+            Self::Play => {
+                playerctl("play")?;
+                Ok(None)
+            }
+            Self::Pause => {
+                playerctl("pause")?;
+                Ok(None)
+            }
+            Self::Toggle => {
+                playerctl("play-pause")?;
+                Ok(None)
+            }
+            Self::Previous => {
+                playerctl("previous")?;
+                Ok(None)
+            }
+            Self::Next => {
+                playerctl("next")?;
+                Ok(None)
+            }
+        }
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(input: &str, rest: impl Iterator<Item = String>) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "start" => Self::Start,
+            "stop" => Self::Stop,
+            "status" => Self::Status,
+            "play" => Self::Play,
+            "pause" => Self::Pause,
+            "toggle" => Self::Toggle,
+            "previous" => Self::Previous,
+            "next" => Self::Next,
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum Status {
+    On,
+    Off,
+}
+
+pub(crate) fn set(status: Status) -> Result<(), Error> {
+    Ok(cmd::command(
+        "systemctl",
+        &[
+            "--user",
+            "--no-block",
+            match status {
+                Status::On => "start",
+                Status::Off => "stop",
+            },
+            "spotify.service",
+        ],
+    )?)
+}
+
+fn playerctl(cmd: &str) -> Result<(), Error> {
+    if cmd::run_command("playerctl", &["-p", "spotify", cmd])?
+        .stderr
+        .contains("No players found")
+    {
+        Err(Error::NotFound)
+    } else {
+        Ok(())
+    }
+}
+
+pub(crate) fn pause() -> Result<(), Error> {
+    playerctl("pause")
+}

mgr/src/systemd.rs

@@ -0,0 +1,40 @@
+use thiserror::Error;
+
+use super::cmd;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error("unknown status output: \"{output}\"")]
+    UnknownStatusOutput { output: String },
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum UnitStatus {
+    Active,
+    Inactive,
+    Failed,
+}
+
+impl UnitStatus {
+    pub(crate) fn is_active(self) -> bool {
+        matches!(self, Self::Active)
+    }
+}
+
+pub(crate) mod user {
+    use super::{super::cmd, Error, UnitStatus};
+
+    pub(crate) fn unit_status(unit: &str) -> Result<UnitStatus, Error> {
+        let output = cmd::run_command("systemctl", &["--user", "is-active", unit])?;
+        match output.stdout.as_str().trim() {
+            "active" | "activating" | "reloading" | "refreshing" => Ok(UnitStatus::Active),
+            "inactive" | "deactivating" | "maintenance" => Ok(UnitStatus::Inactive),
+            "failed" => Ok(UnitStatus::Failed),
+            other => Err(Error::UnknownStatusOutput {
+                output: other.to_owned(),
+            }),
+        }
+    }
+}

mgr/src/theme.rs

@@ -0,0 +1,101 @@
+use thiserror::Error;
+
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd, systemd,
+    wire::{WireCommand, server},
+};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error(transparent)]
+    Systemd(#[from] systemd::Error),
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    Dark = 0x01,
+    Light = 0x02,
+    Status = 0x03,
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => Ok(Self::Dark),
+            0x02 => Ok(Self::Light),
+            0x03 => Ok(Self::Status),
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::Dark => vec![0x01],
+            Self::Light => vec![0x02],
+            Self::Status => vec![0x03],
+        }
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(input: &str, rest: impl Iterator<Item = String>) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "dark" => Self::Dark,
+            "light" => Self::Light,
+            "status" => Self::Status,
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::Dark => {
+                cmd::command(
+                    "systemctl",
+                    &["--user", "--no-block", "start", "color-theme-dark.service"],
+                )?;
+                Ok(None)
+            }
+            Self::Light => {
+                cmd::command(
+                    "systemctl",
+                    &["--user", "--no-block", "start", "color-theme-light.service"],
+                )?;
+                Ok(None)
+            }
+            Self::Status => Ok(
+                if systemd::user::unit_status("color-theme-light.service")?.is_active() {
+                    Some("light".to_owned())
+                } else {
+                    Some("dark".to_owned())
+                },
+            ),
+        }
+    }
+}

mgr/src/weather.rs

@@ -0,0 +1,198 @@
+use std::{
+    fs, io,
+    ops::Sub as _,
+    path::{Path, PathBuf},
+};
+
+use thiserror::Error;
+use time::format_description::well_known::Iso8601;
+use tracing::{Level, event};
+
+const CACHE_AGE: time::Duration = time::Duration::hours(1);
+const CACHE_DELIMITER: char = '|';
+
+use super::{
+    Exec,
+    cli::{self, CliCommand},
+    cmd, dirs, systemd,
+    wire::{WireCommand, server},
+};
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    Cmd(#[from] cmd::Error),
+    #[error(transparent)]
+    Cli(#[from] cli::ParseError),
+    #[error(transparent)]
+    Systemd(#[from] systemd::Error),
+    #[error(transparent)]
+    Http(#[from] ureq::Error),
+    #[error(transparent)]
+    Dirs(#[from] dirs::Error),
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error("delimiter not found in cache file")]
+    CacheDelimitedNotFound,
+    #[error("invalid timestamp \"{input}\" in cache file: {error}")]
+    CacheTimestampParse {
+        input: String,
+        error: time::error::Parse,
+    },
+    #[error("cache timestamp ({cache_timestamp}) is from the future (now: {now})")]
+    CacheTimestampOverflow {
+        now: time::UtcDateTime,
+        cache_timestamp: time::UtcDateTime,
+    },
+    #[error("formatting cache timestamp failed: {error}")]
+    CacheTimestampFormat { error: time::error::Format },
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum Action {
+    Get,
+}
+
+impl WireCommand for Action {
+    fn parse_wire(mut input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError> {
+        match input.next().ok_or(server::ParseError::Eof)? {
+            0x01 => Ok(Self::Get),
+            byte => Err(server::ParseError::Unknown(byte)),
+        }
+    }
+
+    fn to_wire(&self) -> Vec<u8> {
+        match *self {
+            Self::Get => vec![0x01],
+        }
+    }
+}
+
+impl Exec for Action {
+    type ExecErr = Error;
+
+    fn execute(&self) -> Result<Option<String>, Self::ExecErr> {
+        match *self {
+            Self::Get => Ok(Some(get()?)),
+        }
+    }
+}
+
+impl CliCommand for Action {
+    type ExecErr = Error;
+
+    fn parse_str(input: &str, rest: impl Iterator<Item = String>) -> Result<Self, cli::ParseError>
+    where
+        Self: Sized,
+    {
+        let result = match input {
+            "get" => Self::Get,
+            s => {
+                return Err(cli::ParseError::UnknownAction {
+                    action: s.to_owned(),
+                });
+            }
+        };
+
+        let rest = rest.collect::<Vec<String>>();
+        if rest.is_empty() {
+            Ok(result)
+        } else {
+            Err(cli::ParseError::UnexpectedInput { rest })
+        }
+    }
+}
+
+#[derive(Debug)]
+struct Cache {
+    timestamp: time::UtcDateTime,
+    value: String,
+}
+
+fn cache_file() -> Result<PathBuf, Error> {
+    Ok(dirs::xdg_cache_dir()?.join("workstation-mgr.wttr.cache"))
+}
+
+fn store_cache(path: &Path, timestamp: &time::UtcDateTime, value: &str) -> Result<(), Error> {
+    event!(Level::DEBUG, "storing in cache: {timestamp} {value}");
+    Ok(fs::write(
+        path,
+        format!(
+            "{timestamp}{CACHE_DELIMITER}{value}",
+            timestamp = timestamp
+                .format(&Iso8601::DEFAULT)
+                .map_err(|error| Error::CacheTimestampFormat { error })?,
+        ),
+    )?)
+}
+
+fn get_cache(path: &Path) -> Result<Option<Cache>, Error> {
+    match fs::read_to_string(path) {
+        Ok(content) => {
+            let (timestamp, value) = content
+                .split_once(CACHE_DELIMITER)
+                .ok_or(Error::CacheDelimitedNotFound)?;
+
+            let cache_timestamp =
+                time::UtcDateTime::parse(timestamp, &Iso8601::DEFAULT).map_err(|error| {
+                    Error::CacheTimestampParse {
+                        input: timestamp.to_owned(),
+                        error,
+                    }
+                })?;
+
+            Ok(Some(Cache {
+                timestamp: cache_timestamp,
+                value: value.to_owned(),
+            }))
+        }
+        Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(None),
+        Err(e) => Err(e.into()),
+    }
+}
+
+fn request() -> Result<String, Error> {
+    Ok(ureq::get("https://wttr.in/Ansbach?m&T&format=%c%t")
+        .call()?
+        .body_mut()
+        .read_to_string()?)
+}
+
+fn get_and_update_cache(cache_file: &Path, now: &time::UtcDateTime) -> Result<String, Error> {
+    event!(Level::DEBUG, "refreshing cache");
+    let value = request()?;
+    store_cache(cache_file, now, &value)?;
+    Ok(value)
+}
+
+fn get() -> Result<String, Error> {
+    let cache_file = cache_file()?;
+    event!(Level::DEBUG, "using cache file {cache_file:?}");
+
+    let cache = get_cache(&cache_file)?;
+    event!(Level::DEBUG, "read from cache: {cache:?}");
+
+    let now = time::UtcDateTime::now();
+
+    match cache {
+        Some(cache) => {
+            let cache_age = now.sub(cache.timestamp);
+            event!(Level::DEBUG, "cache age: {cache_age}");
+
+            if cache_age.is_negative() {
+                return Err(Error::CacheTimestampOverflow {
+                    now,
+                    cache_timestamp: cache.timestamp,
+                });
+            }
+
+            if cache_age <= CACHE_AGE {
+                event!(Level::DEBUG, "reusing cache");
+                Ok(cache.value)
+            } else {
+                get_and_update_cache(&cache_file, &now)
+            }
+        }
+        None => get_and_update_cache(&cache_file, &now),
+    }
+}

mgr/src/wire/client.rs

@@ -0,0 +1,20 @@
+use std::{
+    io::{self, Write as _},
+    os::unix::net::UnixStream,
+};
+
+use thiserror::Error;
+
+use super::{super::Action, WireCommand as _};
+
+#[derive(Debug, Error)]
+pub enum SendError {
+    #[error(transparent)]
+    Io(#[from] io::Error),
+}
+
+impl Action {
+    pub fn send(&self, stream: &mut UnixStream) -> Result<(), SendError> {
+        Ok(stream.write_all(&self.to_wire())?)
+    }
+}

mgr/src/wire/mod.rs

@@ -0,0 +1,11 @@
+pub mod client;
+pub mod server;
+pub mod socket;
+
+pub(crate) trait WireCommand {
+    fn parse_wire(input: impl Iterator<Item = u8>) -> Result<Self, server::ParseError>
+    where
+        Self: Sized;
+
+    fn to_wire(&self) -> Vec<u8>;
+}

mgr/src/wire/server.rs

@@ -0,0 +1,90 @@
+use std::{
+    io::{self, Read, Write},
+    os::unix::net::{SocketAddr, UnixListener, UnixStream},
+    thread,
+};
+
+use thiserror::Error;
+use tracing::{Level, event};
+
+use super::{
+    super::{Action, Exec as _},
+    WireCommand, socket,
+};
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error(transparent)]
+    Parse(#[from] ParseError),
+    #[error(transparent)]
+    Socket(#[from] socket::Error),
+    #[error(transparent)]
+    Exec(#[from] crate::ExecError),
+}
+
+#[derive(Debug, Error)]
+pub enum ParseError {
+    #[error("received unexpected eof")]
+    Eof,
+    #[error("received unknown byte: {0:#X}")]
+    Unknown(u8),
+    #[error("received surplus input: {0:?}")]
+    Surplus(Vec<u8>),
+    #[error("expected {expected} bytes, received only {received}")]
+    MissingBytes { expected: usize, received: usize },
+}
+
+fn handle_client(stream: &mut UnixStream) -> Result<(), Error> {
+    let input = {
+        let mut buf = Vec::new();
+        stream.read_to_end(&mut buf)?;
+        buf
+    };
+
+    event!(Level::DEBUG, "request data: {input:?}");
+
+    let action = Action::parse_wire(input.into_iter())?;
+
+    event!(Level::DEBUG, "parsed request: {action:?}");
+
+    if let Some(output) = action.execute()? {
+        stream.write_all(output.as_bytes())?;
+    }
+
+    Ok(())
+}
+
+pub fn run() -> Result<(), Error> {
+    event!(Level::DEBUG, "starting server");
+
+    let socket_path = socket::get_socket_path()?;
+
+    socket::try_remove_socket(&socket_path)?;
+
+    let socket_addr = SocketAddr::from_pathname(socket_path)?;
+
+    event!(Level::DEBUG, "socket address {socket_addr:?}");
+
+    let listener = UnixListener::bind_addr(&socket_addr)?;
+
+    for stream in listener.incoming() {
+        let mut stream = stream?;
+        thread::spawn(move || {
+            event!(Level::DEBUG, "received request");
+            let result = handle_client(&mut stream);
+            if let Err(e) = result {
+                let msg = e.to_string();
+                event!(Level::ERROR, "action failed: {msg}");
+                if let Err(e) = stream.write_all(msg.as_bytes()) {
+                    event!(Level::ERROR, "sending \"{msg}\" failed: {e}");
+                }
+            }
+            event!(Level::DEBUG, "closing stream");
+            drop(stream);
+        });
+    }
+
+    unreachable!()
+}

mgr/src/wire/socket.rs

@@ -0,0 +1,35 @@
+use std::{
+    fs, io,
+    path::{Path, PathBuf},
+};
+
+use thiserror::Error;
+
+use super::super::dirs;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("could not find a suitable socket path")]
+    NoSocketPathFound,
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error(transparent)]
+    Dirs(#[from] dirs::Error),
+}
+
+pub fn get_socket_path() -> Result<PathBuf, Error> {
+    if let Some(mut dir) = dirs::xdg_runtime_dir()? {
+        dir.push("workstation-mgr.sock");
+        return Ok(dir);
+    }
+
+    Err(Error::NoSocketPathFound)
+}
+
+pub(crate) fn try_remove_socket(path: &Path) -> Result<(), Error> {
+    match fs::remove_file(path) {
+        Ok(()) => Ok(()),
+        Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(()),
+        Err(e) => Err(e.into()),
+    }
+}

packages.yml

@@ -49,6 +49,7 @@ ansible:
   archlinux:
     - ansible
     - ansible-language-server
+    - ansible-lint
     - python-jmespath
 xdotool:
   archlinux: ["xdotool"]
@@ -73,7 +74,13 @@ font-dejavu:
     - ttf-dejavu-nerd
 font-libertine:
   archlinux:
-    - ttf-linux-libertine
+    - libertinus-font
+font-awesome:
+  archlinux:
+    - woff2-font-awesome
+font-noto:
+  archlinux:
+    - noto-fonts
 git:
   # tk required for gitk
   archlinux: ["git", "tk", "git-delta", "git-filter-repo"]
@@ -103,8 +110,6 @@ pavucontrol:
   archlinux: ["pavucontrol-qt"]
 pinentry-qt:
   archlinux: ["pinentry"]
-pinta:
-  archlinux: ["pinta"]
 pass:
   archlinux: ["pass", "passff-host", "xclip"]
 urxvt:
@@ -148,6 +153,7 @@ python:
     - python-pylint
     - flake8
     - mypy
+    - uv
 python-modules:
   archlinux:
     - python-ruamel-yaml
@@ -155,8 +161,8 @@ python-modules:
     - python-semver
 black:
   archlinux: ["python-black"]
-xbacklight:
-  archlinux: ["acpilight"]
+brightnessctl:
+  archlinux: ["brightnessctl"]
 wireshark:
   archlinux: ["wireshark-cli", "wireshark-qt"]
 nmap:
@@ -211,7 +217,7 @@ ruby:
 acpi:
   archlinux: ["acpi", "acpid"]
 nodejs:
-  archlinux: ["nodejs", "npm"]
+  archlinux: ["nodejs-lts-jod", "npm", "yarn"]
 xdg:
   archlinux: ["xdg-utils"]
 dunst:
@@ -220,8 +226,6 @@ cloc:
   archlinux: ["cloc"]
 bwm-ng:
   archlinux: ["bwm-ng"]
-virtualbox:
-  archlinux: ["virtualbox"]
 ssh:
   archlinux: ["openssh"]
 sshfs:
@@ -233,20 +237,23 @@ inotify:
 rclone:
   archlinux: ["rclone"]
 dnf:
-  archlinux: ["dnf"]
+  archlinux: ["dnf5"]
 rust:
   archlinux:
     - rustup
     - rust-analyzer
     - cargo-edit
+    - cargo-expand
     - cargo-msrv
     - cargo-watch
     - cargo-release
     - cargo-sort
+    - cargo-hack
+    - cargo-dist
+    - cargo-binstall
+    - rust-script
 musescore:
   archlinux: ["musescore"]
-sipcalc:
-  archlinux: ["sipcalc"]
 rofi:
   archlinux: ["rofi"]
 imv:
@@ -311,8 +318,6 @@ fzf:
   archlinux: ["fzf"]
 chromium:
   archlinux: ["chromium"]
-signal:
-  archlinux: ["signal-desktop"]
 go:
   archlinux: ["go", "gopls", "delve"]
 helix:
@@ -320,12 +325,12 @@ helix:
 keepassxc:
   archlinux: ["keepassxc"]
 awscli:
-  archlinux: ["aws-cli"]
+  archlinux: ["aws-cli-v2"]
 mariadb-client:
   archlinux: ["mariadb-clients"]
 php:
-  archlinux: ["php"]
-exa:
+  archlinux: ["php", "composer"]
+eza:
   archlinux: ["eza"]
 just:
   archlinux: ["just"]
@@ -369,6 +374,7 @@ json:
 markdown:
   archlinux:
     - marksman
+    - mdformat
 lldb:
   archlinux:
     - lldb
@@ -440,6 +446,9 @@ mold:
   archlinux:
     - clang
     - mold
+wild:
+  archlinux:
+    - wild
 arch-packaging:
   archlinux:
     - namcap
@@ -461,6 +470,7 @@ watchexec:
 postgresql:
   archlinux:
     - postgresql
+    - pgformatter
 tokei:
   archlinux:
     - tokei
@@ -514,3 +524,69 @@ geeqie:
 xpath:
   archlinux:
     - perl-xml-xpath
+apache: # for apachebench
+  archlinux:
+    - apache
+xfce4-screenshooter:
+  archlinux:
+    - xfce4-screenshooter
+picom:
+  archlinux:
+    - picom
+fuseiso:
+  archlinux:
+    - fuseiso
+7zip:
+  archlinux:
+    - p7zip
+unrar:
+  archlinux:
+    - unrar
+taplo:
+  archlinux:
+    - taplo-cli
+prettier:
+  archlinux:
+    - prettier
+sccache:
+  archlinux:
+    - sccache
+btop:
+  archlinux:
+    - btop
+dua:
+  archlinux:
+    - dua-cli
+hexyl:
+  archlinux:
+    - hexyl
+yq:
+  archlinux:
+    - go-yq
+kolourpaint:
+  archlinux:
+    - kolourpaint
+podman:
+  archlinux:
+    - podman
+    - podman-compose
+pulumi:
+  archlinux:
+    - pulumi
+reflector:
+  archlinux:
+    - reflector
+yazi:
+  archlinux:
+    - yazi
+    - ffmpeg
+    - 7zip
+    - jq
+    - poppler
+    - fd
+    - ripgrep
+    - fzf
+    - xsel
+    - zoxide
+    - resvg
+    - imagemagick

pkgbuilds/workstation-mgr/.gitignore

@@ -0,0 +1,3 @@
+*
+!.gitignore
+!PKGBUILD

pkgbuilds/workstation-mgr/PKGBUILD

@@ -0,0 +1,42 @@
+# Maintainer: Hannes Körber <hannes@hkoerber.de>
+pkgname='workstation-mgr'
+pkgver=5
+pkgrel=1
+pkgdesc=''
+arch=('x86_64')
+depends=('glibc' 'gcc-libs')
+makedepends=('cargo')
+options=(!lto)
+source=()
+sha256sums=()
+
+pkgver() {
+  cd "/var/lib/dotfiles/mgr/"
+  git log --oneline . | wc -l
+}
+
+prepare() {
+  cd "/var/lib/dotfiles/mgr/"
+  export RUSTUP_TOOLCHAIN=stable
+  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
+}
+
+build() {
+  cd "/var/lib/dotfiles/mgr/"
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=/var/lib/makepkg/${pkgname}/build/target
+  cargo build --frozen --release
+}
+
+check() {
+  cd "/var/lib/dotfiles/mgr/"
+  export RUSTUP_TOOLCHAIN=stable
+  cargo test --frozen
+}
+
+package() {
+  cd "/var/lib/dotfiles/mgr/"
+  export CARGO_TARGET_DIR=/var/lib/makepkg/${pkgname}/build/target
+  install -Dm0755 -t "$pkgdir/usr/bin/" "${CARGO_TARGET_DIR}/release/${pkgname}"
+  install -Dm0755 -t "$pkgdir/usr/bin/" "${CARGO_TARGET_DIR}/release/workstation-client"
+}

playbook.yml

@@ -1,27 +1,28 @@
+---
 - name: configure system
   hosts: localhost
   connection: local
   become: false
   tasks:
-    - name: read machine-specific variables
-      include_vars:
-        file: _machines/{{ ansible_hostname }}.yml
+    - name: Read machine-specific variables
+      ansible.builtin.include_vars:
+        file: _machines/{{ ansible_facts['hostname'] }}.yml
         name: machine
       tags:
         - always
 
-    - set_fact:
-        distro: "{{ ansible_distribution|lower }}"
+    - ansible.builtin.set_fact:
+        distro: "{{ ansible_facts['distribution'] | lower }}"
       tags:
         - always
 
-    - name: check for valid distro
-      assert:
+    - name: Check for valid distro
+      ansible.builtin.assert:
         that: distro in ('archlinux')
 
     - block:
-      - name: install ansible requirements
-        package:
+        - name: Install ansible requirements
+          ansible.builtin.package:
             name: "{{ packages[distro] }}"
             state: present
           become: true
@@ -30,51 +31,46 @@
               archlinux:
                 - python-jmespath
 
-    - name: pacman
+    - name: Pacman
       tags:
         - pacman
       block:
-        - name: enable multilib repository
-          blockinfile:
+        - name: Enable multilib repository
+          ansible.builtin.blockinfile:
             path: /etc/pacman.conf
             block: |
               [multilib]
               Include = /etc/pacman.d/mirrorlist
             marker: "# {mark} ANSIBLE MANAGED multilib"
+          notify:
+            - refresh package lists
           become: true
 
-        - name: enable parallel download
-          blockinfile:
+        - name: Make sure that package lists are refreshed if necessary
+          ansible.builtin.meta: flush_handlers
+
+        - name: Enable parallel download
+          ansible.builtin.blockinfile:
             path: /etc/pacman.conf
-            insertafter: '\[options\]'
+            insertafter: "\\[options\\]"
             block: |
               ParallelDownloads = 5
             marker: "# {mark} ANSIBLE MANAGED parallel_download"
           become: true
 
-        - block:
-          - name: upgrade system
-            pacman:
-              upgrade: true
-              update_cache: true
-            become: true
-            changed_when: false
-
-          tags: [system-update]
-
-        - name: install pacman-contrib for paccache
-          package:
+        - name: Install pacman-contrib for paccache
+          ansible.builtin.package:
             name: pacman-contrib
             state: present
           become: true
 
         - block:
-          - name: install pacman cache clean service
-            copy:
+            - name: Install pacman cache clean service
+              ansible.builtin.copy:
                 dest: /etc/systemd/system/pacman-cache-cleanup.service
                 owner: root
                 group: root
-              mode: '0644'
+                mode: "0644"
                 content: |
                   [Service]
                   Type=oneshot
@@ -82,12 +78,12 @@
                   RemainAfterExit=true
               become: true
 
-          - name: install pacman cache clean timer
-            copy:
+            - name: Install pacman cache clean timer
+              ansible.builtin.copy:
                 dest: /etc/systemd/system/pacman-cache-cleanup.timer
                 owner: root
                 group: root
-              mode: '0644'
+                mode: "0644"
                 content: |
                   [Timer]
                   OnCalendar=daily
@@ -96,14 +92,15 @@
                   WantedBy=multi-user.target
               become: true
 
-          - name: enable pacman cache clean timer
-            systemd:
+            - ansible.builtin.systemd:
                 name: pacman-cache-cleanup.timer
                 enabled: true
                 state: started
                 daemon_reload: true
               become: true
 
+              name: Enable pacman cache clean timer
+
     - name: dotfiles directory
       tags:
         - dotfiles-directory
@@ -132,21 +129,33 @@
             path: /var/lib/dotfiles
             owner: dotfiles
             group: dotfiles
-            mode: '0775' # group needs write access!
+            mode: "0775" # group needs write access!
           become: true
           become_user: root
 
-        - name: fix permissions for dotfiles directory
+        - name: fix group for dotfiles directory
           shell: |
-            chown --changes --recursive dotfiles:dotfiles .
-            chmod --changes --recursive g+rwX .
+            chgrp --changes --recursive dotfiles . | grep -Ev "changed group of ('./.git/index'|'./.git/modules/)"
+          args:
+            executable: /bin/bash
+            chdir: /var/lib/dotfiles
+          register: dotfiles_group_change
+          become: true
+          become_user: root
+          failed_when: dotfiles_group_change.rc not in (0, 1)
+          changed_when: dotfiles_group_change.rc == 0 # == lines selected, i.e. some output
+
+        - name: fix group permissions for dotfiles directory
+          shell: |
+            chmod --changes --recursive g+rwX . | grep -Ev "mode of ('./.git/index'|'./.git/modules/)"
           args:
             executable: /bin/bash
             chdir: /var/lib/dotfiles
           register: dotfiles_permission_change
           become: true
           become_user: root
-          changed_when: dotfiles_permission_change.stdout_lines|length > 0
+          failed_when: dotfiles_permission_change.rc not in (0, 1)
+          changed_when: dotfiles_permission_change.rc == 0 # == lines selected, i.e. some output
 
     - name: packages
       tags:
@@ -179,11 +188,17 @@
 
         - name: install packages
           package:
-            name: "{{ defined_packages|json_query(query) }}"
+            name: "{{ defined_packages|json_query(pkg_query) }}"
             state: present
           become: true
           vars:
-            query: "{{ '*.%s[]'|format(distro) }}"
+            pkg_query: "{{ '*.%s[]'|format(distro) }}"
+
+        - name: install additional packages
+          package:
+            name: "{{ machine.additional_packages|default([]) }}"
+            state: present
+          become: true
 
         - name: remove unconfigured packages
           script:
@@ -193,6 +208,30 @@
           changed_when: unconfigured_packages_cmd.rc == 123
           become: true
 
+    - name: reflector
+      block:
+      - name: Configure reflector
+        ansible.builtin.copy:
+          dest: /etc/xdg/reflector/reflector.conf
+          owner: root
+          group: root
+          mode: "0644"
+          content: |
+            --save /etc/pacman.d/mirrorlist
+            --protocol https
+            --country Germany
+            --latest 5
+            --sort age
+        become: true
+
+      - name: Enable reflector timer
+        ansible.builtin.systemd:
+          name: reflector.timer
+          enabled: true
+          state: started
+          daemon_reload: true
+        become: true
+
     - name: aur
       tags:
         - aur
@@ -208,6 +247,9 @@
 
         - set_fact:
             aur_packages:
+              # local packages:
+              - name: workstation-mgr
+
               - name: portfolio-performance-bin
                 preexec: |
                   #!/usr/bin/env bash
@@ -218,13 +260,41 @@
                 preexec: |
                   #!/usr/bin/env bash
                   source ./env
-                  curl -sSf --proto '=https' https://download.spotify.com/debian/pubkey_6224F9941A8AA6D1.gpg | gpg --import -
+                  echo lel
+                  curl -sSf --proto '=https' https://download.spotify.com/debian/pubkey_5384CE82BA52C83A.gpg | gpg --import -
 
               - name: nodejs-intelephense
-              - name: vim-plug
               - name: terraform-ls-bin
               - name: grm-git
               - name: screencfg-git
+              - name: google-earth-pro
+
+              # ===
+              - name: python-botocore-stubs
+              # dependency of
+              - name: python-boto3-stubs
+
+              - name: python-chevron
+              - name: python-aws-lambda-builders
+              # === dependencies of
+              - name: aws-sam-cli
+
+              # ===
+              - name: python-vdf
+              # dependency of
+              - name: protontricks
+
+              # ===
+              - name: slack-desktop
+
+              # ===
+              - name: python-class-registry
+              - name: python-rst2ansi
+              # dependency of
+              - name: backblaze-b2
+
+              # ===
+              - name: claude-code
 
         - set_fact:
             aur_packages: "{{ aur_packages|map(attribute='dependencies', default=[]) | flatten + aur_packages }}"
@@ -237,7 +307,7 @@
 
             installed=0
 
-            dependencies=(${depends[@]} ${makedepends[@]})
+            dependencies=(${depends[@]} ${makedepends[@]} ${checkdepends[@]})
             for dep in "${dependencies[@]}" ; do
               aur=0
               for aur_pkg in "${aur_packages[@]}" ; do
@@ -276,7 +346,7 @@
           file:
             path: "/var/lib/makepkg/{{ item.name }}/"
             state: directory
-            mode: '0700'
+            mode: "0700"
             owner: makepkg
             group: makepkg
           become_user: makepkg
@@ -289,7 +359,7 @@
           file:
             path: "/var/lib/makepkg/{{ item.name }}/gnupg"
             state: directory
-            mode: '0700'
+            mode: "0700"
             owner: makepkg
             group: makepkg
           become_user: makepkg
@@ -354,9 +424,7 @@
             chdir: "{{ item.1.stat.path | dirname }}"
           become_user: makepkg
           become: true
-          when:
-            - not item[0].stat.exists
-            - item[0].stat.checksum|default('') != item[1].stat.checksum
+          when: not item[0].stat.exists or (item[0].stat.checksum|default('') != item[1].stat.checksum)
           loop: "{{ preexec_before.results| reject('skipped')|zip(preexec_after.results| reject('skipped')) }}"
           loop_control:
             label: "{{ item.1.stat.path }}"
@@ -381,13 +449,14 @@
 
               source ./PKGBUILD
 
-              for arch in "${arch[@]}" ; do
-                if [[ "${arch}" == "any" ]] ; then
+              for a in "${arch[@]}" ; do
+                if [[ "${a}" == "any" ]] ; then
                   arch="any"
                   break
                 fi
-                if [[ "${arch}" == "x86_64" ]] ; then
+                if [[ "${a}" == "x86_64" ]] ; then
                   arch="x86_64"
+                  break
                 fi
               done
 
@@ -404,9 +473,7 @@
 
               filename="${PKGDEST%/}/${pkgname}-${version}-${arch}${PKGEXT}"
 
-              needed_build=0
               if [[ ! -e "${filename}" ]] ; then
-                needed_build=1
                 makepkg \
                   --clean \
                   --nosign || exit 1
@@ -464,8 +531,7 @@
           become: true
           with_nested:
             - "{{ aur_packages }}"
-            -
-              - build
+            - - build
               - src
           loop_control:
             label: "{{ item[0].name }}/{{ item[1] }}"
@@ -488,48 +554,124 @@
         state: present
       become: true
 
+    - name: set mkinitcpio hooks
+      set_fact:
+        mkinitcpio_hooks: "base udev autodetect microcode modconf kms keyboard keymap consolefont block encrypt lvm2 filesystems resume fsck"
+      when: machine.encrypted_root|bool
+
+    - name: set mkinitcpio hooks
+      set_fact:
+        mkinitcpio_hooks: "base udev autodetect microcode modconf kms keyboard keymap consolefont block filesystems resume fsck"
+      when: not machine.encrypted_root|bool
+
+    - name: configure mkinitcpio hooks
+      lineinfile:
+        path: /etc/mkinitcpio.conf
+        regexp: "^#?HOOKS=.*$"
+        line: 'HOOKS=({{ mkinitcpio_hooks }})'
+      become: true
+      notify:
+        - rebuild initrd
+
     - name: use vz4 for mkinitcpio compression
       lineinfile:
         path: /etc/mkinitcpio.conf
-        regexp: '^#?COMPRESSION=.*$'
+        regexp: "^#?COMPRESSION=.*$"
         line: 'COMPRESSION="lz4"'
       become: true
       notify:
         - rebuild initrd
 
+    - name: libvirtd
+      tags:
+        - libvirtd
+      # Arch defaults to systemd socket activation. Hate that stuff, just run the
+      # damn daemon (so I notice early when something is wrong, not just when I
+      # want to use it).
+      block:
+        - name: mask sockets
+          service:
+            state: stopped
+            enabled: false
+            masked: true
+            name: "{{ item }}"
+          loop:
+            - libvirtd.socket
+            - libvirtd-tls.socket
+            - libvirtd-tcp.socket
+            - libvirtd-ro.socket
+            - libvirtd-admin.socket
+          become: true
+
+        # the libvirtd unit file contains the following setting:
+        #
+        # Environment=LIBVIRTD_ARGS="--timeout 120"
+        #
+        # This will make libvirtd stop after 120 seconds without connections or running
+        # domains. To convince the daemon to just keep being a daemon, this needs to be
+        # removed. Fortunately, the unit also contains the following:
+        #
+        # EnvironmentFile=-/etc/conf.d/libvirtd
+        #
+        # And `EnvironmentFile` trumps `Environment`. Otherwise we'd need to do some
+        # damn systemd override shenanigans.
+        - name: configure libvirtd env variable override
+          copy:
+            owner: root
+            group: root
+            mode: "0600"
+            dest: /etc/conf.d/libvirtd
+            content: |
+              LIBVIRTD_ARGS=
+          become: true
+          notify:
+            - restart libvirtd
+
+        - name: enable libvirtd
+          service:
+            state: started
+            enabled: true
+            name: libvirtd.service
+          become: true
+
     - name: services
       tags:
         - services
       block:
         - set_fact:
             disable_services:
-              - sshd.service
+              - sshd
 
         - name: disable services
           service:
             state: stopped
             enabled: false
-            name: "{{ item }}"
+            name: "{{ item }}.service"
           with_items: "{{ disable_services }}"
           become: true
-          when: manage_services|default(true)|bool
 
         - set_fact:
             enable_services:
               - NetworkManager
               - docker
-              - libvirtd
               - systemd-timesyncd
-              - pcscd
 
         - name: enable services
           service:
             state: started
             enabled: true
-            name: "{{ item }}"
+            name: "{{ item }}.service"
           with_items: "{{ enable_services }}"
           become: true
-          when: manage_services|default(true)|bool
+
+        - name: enable sockets
+          service:
+            state: started
+            enabled: true
+            name: "{{ item }}.socket"
+          loop:
+            - pcscd
+          become: true
 
     - name: get systemd boot target
       command: systemctl get-default
@@ -537,8 +679,9 @@
       changed_when: false
       check_mode: false
 
-    - set_fact:
-        default_target: multi-user.target
+    - name: define systemd default target
+      set_fact:
+        default_target: "{{ machine.system_default_target|default('multi-user.target') }}"
 
     - name: set systemd boot target
       command: systemctl set-default {{ default_target }}
@@ -548,22 +691,22 @@
     - name: handle lid switch
       lineinfile:
         path: /etc/systemd/logind.conf
-        regexp: '^HandleLidSwitch='
-        line: 'HandleLidSwitch=ignore'
+        regexp: "^HandleLidSwitch="
+        line: "HandleLidSwitch=ignore"
       become: true
 
     - name: handle power key
       lineinfile:
         path: /etc/systemd/logind.conf
-        regexp: '^HandlePowerKey='
-        line: 'HandlePowerKey=suspend'
+        regexp: "^HandlePowerKey="
+        line: "HandlePowerKey=suspend"
       become: true
 
     - name: limit journald size
       lineinfile:
         path: /etc/systemd/journald.conf
-        regexp: '^#?SystemMaxUse=.*$'
-        line: 'SystemMaxUse=50M'
+        regexp: "^#?SystemMaxUse=.*$"
+        line: "SystemMaxUse=50M"
       become: true
       notify:
         - restart journald
@@ -661,20 +804,24 @@
                     name: "{{ drivers.gpu.nvidia }}"
                     state: present
                   become: true
+
+            - name: Intel configuration
+              when: machine.gpu == 'intel'
+              block:
+                - name: install intel packages
+                  package:
+                    name: "{{ drivers.gpu.intel }}"
+                    state: present
+                  become: true
           when:
             - machine.gpu is defined
 
-    - set_fact:
-        users: "{{ machine.users }}"
-      tags:
-        - always
-
     # See https://bbs.archlinux.org/viewtopic.php?id=259764
     - block:
         - name: configure pacman to skip installing nextcloud dbus file
           blockinfile:
             path: /etc/pacman.conf
-          insertafter: '^#NoExtract'
+            insertafter: "^#NoExtract"
             block: |
               NoExtract = usr/share/dbus-1/services/com.nextcloudgmbh.Nextcloud.service
             marker: "# {mark} ANSIBLE MANAGED noextract nextcloud"
@@ -691,7 +838,7 @@
         - name: configure pacman to skip installing gpg user units
           blockinfile:
             path: /etc/pacman.conf
-          insertafter: '^#NoExtract'
+            insertafter: "^#NoExtract"
             block: |
               NoExtract = usr/lib/systemd/user/gpg-agent*
             marker: "# {mark} ANSIBLE MANAGED noextract gpg-agent"
@@ -707,11 +854,185 @@
             dest: /etc/udev/rules.d/backlight.rules
             owner: root
             group: root
-            mode: '0644'
+            mode: "0644"
             content: |
               ACTION=="add", SUBSYSTEM=="backlight", RUN+="/bin/chgrp video $sys$devpath/brightness", RUN+="/bin/chmod g+w $sys$devpath/brightness"
           become: true
 
+    - name: Firefox
+      tags:
+        - firefox
+      block:
+        - name: create firefox directories
+          file:
+            state: directory
+            path: "{{ item }}"
+            owner: root
+            group: root
+            mode: "0775"
+          become: true
+          become_user: root
+          loop:
+            - /etc/firefox
+            - /etc/firefox/policies
+
+        - set_fact:
+            firefox_policy:
+              policies:
+                AutofillAddressEnabled: false
+                AutofillCreditCardEnabled: false
+                DefaultDownloadDirectory: "${home}/download"
+                DisableFeedbackCommands: true
+                DisableFirefoxAccounts: true
+                DisableFirefoxStudies: true
+                DisableForgetButton: true
+                DisableMasterPasswordCreation: true
+                DisableProfileImport: true
+                DisableProfileRefresh: true
+                DisableSafeMode: true
+                DisableSetDesktopBackground: true
+                DisableTelemetry: true
+                DisplayBookmarksToolbar: "always"
+                DisplayMenuBar: "default-off"
+                DontCheckDefaultBrowser: true
+                EnableTrackingProtection:
+                  Value: true
+                  Locked: false
+                  Category: "strict"
+                  BaselineExceptions: true
+                  ConvenienceExceptions: false
+                ExtensionSettings:
+                  "*":
+                    allowed_types:
+                      - extension
+                  "jid1-KKzOGWgsW3Ao4Q@jetpack": # I don't care about cookies
+                    installation_mode: "normal_installed"
+                    install_url: "https://addons.mozilla.org/firefox/downloads/file/4202634/i_dont_care_about_cookies.xpi"
+                    default_area: "menupanel"
+                    private_browsing: true
+                    updates_disabled: false
+                  "uBlock0@raymondhill.net": # Ublock origin
+                    installation_mode: "normal_installed"
+                    install_url: "https://addons.mozilla.org/firefox/downloads/file/4598854/ublock_origin-1.67.0.xpi"
+                    default_area: "navbar"
+                    private_browsing: true
+                    updates_disabled: false
+                  "treestyletab@piro.sakura.ne.jp": # I don't care about cookies
+                    installation_mode: "normal_installed"
+                    install_url: "https://addons.mozilla.org/firefox/downloads/file/4602712/tree_style_tab-4.2.7.xpi"
+                    default_area: "navbar"
+                    private_browsing: true
+                    updates_disabled: false
+                  "{9063c2e9-e07c-4c2c-9646-cfe7ca8d0498}": # Old Reddit redirect
+                    installation_mode: "normal_installed"
+                    install_url: "https://addons.mozilla.org/firefox/downloads/file/4526031/old_reddit_redirect-2.0.9.xpi"
+                    default_area: "menupanel"
+                    private_browsing: true
+                    updates_disabled: false
+                FirefoxHome:
+                  Search: false
+                  TopSites: false
+                  SponsoredTopSites: false
+                  Highlights: false
+                  Pocket: false
+                  Stories: false
+                  SponsoredPocket: false
+                  SponsoredStories: false
+                  Snippets: false
+                  Locked: true
+                GenerativeAI:
+                  Enabled: false
+                  Chatbot: false
+                  LinkPreviews: false
+                  TabGroups: false
+                Homepage:
+                  URL: "about:newtab"
+                  StartPage: "previous-session"
+                MicrosoftEntraSSO: false
+                NewTabPage: false
+                NoDefaultBookmarks: true
+                OfferToSaveLogins: false
+                OverrideFirstRunPage: ""
+                PasswordManagerEnabled: false
+                Preferences:
+                  "browser.translations.automaticallyPopup":
+                    Value: false
+                    Status: "default"
+                    Type: "boolean"
+                  "browser.aboutConfig.showWarning":
+                    Value: false
+                    Status: "default"
+                    Type: "boolean"
+                  "general.smoothScroll":
+                    Value: true
+                    Status: "default"
+                    Type: "boolean"
+                  # "Play DRM-controlled content"
+                  "media.eme.enabled":
+                    Value: true
+                    Status: "default"
+                    Type: "boolean"
+                  # Restore last session on startup
+                  # https://support.mozilla.org/de/questions/1235263
+                  "browser.startup.page":
+                    Value: 3
+                    Status: "default"
+                    Type: "number"
+                  # reload the tabs properly when restoring
+                  "browser.sessionstore.restore_on_demand":
+                    Value: false
+                    Status: "default"
+                    Type: "boolean"
+                  # "Check spelling as you type"
+                  "layout.spellcheckDefault":
+                    Value: 0
+                    Status: "default"
+                    Type: "number"
+                  # remove ad tracking garbage
+                  "dom.private-attribution.submission.enabled":
+                    Value: false
+                    Status: "default"
+                    Type: "boolean"
+                  # (Try to) disable automatic update, as firefox is pulling a Windows
+                  "app.update.auto":
+                    Value: false
+                    Status: "default"
+                    Type: "boolean"
+                  "app.update.service.enabled": 
+                    Value: false
+                    Status: "default"
+                    Type: "boolean"
+                PromptForDownloadLocation: false
+                RequestedLocales:
+                  - en-US
+                  - de
+                SearchSuggestEnabled: false
+                ShowHomeButton: false
+                SkipTermsOfUse: true
+                UserMessaging:
+                  ExtensionRecommendations: false
+                  FeatureRecommendations: false
+                  UrlbarInterventions: false
+                  SkipOnboarding: true
+                  MoreFromMozilla: false
+                  FirefoxLabs: false
+                VisualSearchEnabled: false
+
+        - name: Firefox global policies
+          ansible.builtin.copy:
+            dest: "/etc/firefox/policies/policies.json"
+            owner: root
+            group: root
+            mode: "0644"
+            content: "{{ firefox_policy | to_nice_json }}"
+          become: true
+          become_user: root
+
+    - set_fact:
+        users: "{{ machine.users }}"
+      tags:
+        - always
+
     - include_tasks: user.yml
       args:
         apply:
@@ -720,13 +1041,26 @@
           tags:
             - user
       with_items: "{{ users }}"
-      no_log: True # less spam
+      no_log: true # less spam
       loop_control:
         loop_var: user
       tags:
         - always
 
+    - include_tasks: "{{ item }}"
+      with_first_found:
+        - files:
+            - "_machines/{{ ansible_facts['hostname'] }}-tasks.yml"
+          skip: true
+      tags:
+        - always
+
   handlers:
+    - name: refresh package lists
+      community.general.pacman:
+        update_cache: true
+      become: true
+
     - name: rebuild initrd
       command: mkinitcpio -P
       become: true
@@ -741,3 +1075,9 @@
         name: systemd-journald
         state: restarted
       become: true
+
+    - name: restart libvirtd
+      service:
+        name: libvirtd
+        state: restarted
+      become: true

remove-unconfigured-packages.sh

@@ -21,15 +21,18 @@ proctected=(
 )
 
 for pkgbuild in pkgbuilds/*/PKGBUILD ; do
+  set +o nounset
   # shellcheck disable=SC1090
   source "${pkgbuild}"
-  aurdeps+=("${depends[@]%%[<=>]*}" "${makedepends[@]%%[<=>]*}" "${pkgname}")
+  set -o nounset
+  aurdeps+=("${depends[@]%%[<=>]*}" "${makedepends[@]%%[<=>]*}" "${checkdepends[@]%%[<=>]*}" "${pkgname}")
 done
 
 declare -a packages_to_remove=()
 
 readarray -d $'\0' -t packages_to_remove < <(comm --zero-terminated -13 \
   <(cat \
+    <(<_machines/"$(hostname --short)".yml yaml2json | jq --raw-output0 '(.additional_packages // [])[]') \
     <(<packages.yml yaml2json | jq --raw-output0 'map(.archlinux) | flatten[]') \
     <(for dep in "${aurdeps[@]}" "${cpu_packages[@]}" "${gpu_packages[@]}" ; do printf '%s\0' "${dep}" ; done) \
   | while IFS= read -r -d $'\0' package; do
@@ -59,12 +62,29 @@ readarray -d $'\0' -t packages_to_remove < <(comm --zero-terminated -13 \
     printf '%s\0' "${package}"
   done) 
 
+packages_removed=0
+
 if (( "${#packages_to_remove[@]}" > 0 )) ; then
     echo "found the following explicitly installed packages that are not configured:"
     for pkg in "${packages_to_remove[@]}" ; do
       echo "${pkg}"
     done
     sudo pacman -Rcns "${packages_to_remove[@]}" "${@}" || exit $?
+    packages_removed=1
+fi
+
+readarray -t orphans < <(pacman -Qdtq)
+
+if (( "${#orphans[@]}" > 0 )) ; then
+    echo "found the following orphaned packages:"
+    for pkg in "${orphans[@]}" ; do
+      echo "${pkg}"
+    done
+    sudo pacman -Rcns "${orphans[@]}" "${@}" || exit $?
+    packages_removed=1
+fi
+
+if (( packages_removed)) ; then
     exit 123
 fi
 

screencfg/screencfg.toml

@@ -0,0 +1,4 @@
+post_commands = [
+  "systemctl --user restart keyboard.service",
+  "systemctl --user restart touchpad.service",
+]

scripts/garmin.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -o nounset
+
+gid=$(id -g)
+uid=$(id -u)
+
+DEV=/dev/disk/by-label/GARMIN
+MOUNTPOINT=/mnt
+MOUNTOPTS="uid=${uid},gid=${gid}"
+
+SYNC_FOLDERS=(
+    Activity
+    Settings
+    Courses
+    Records
+    Totals
+    Workouts
+)
+
+RSYNCOPTS=(
+    --verbose
+    --recursive
+    --checksum
+    --itemize-changes
+)
+
+if [[ ! -e "${DEV}" ]]; then
+    printf "no garmin device present\n" >&2
+    exit 1
+fi
+
+mnt=$(findmnt --noheadings --first-only --options "${MOUNTOPTS}" --output TARGET "${DEV}")
+
+if [[ -n "${mnt}" ]]; then
+    if [[ "${mnt}" == "${MOUNTPOINT}" ]]; then
+        printf '%s already correctly mounted\n' "${DEV}"
+    else
+        printf '%s already mounted somewhere else, aborting\n' "${DEV}" >&2
+        exit 1
+    fi
+else
+    if findmnt --mountpoint "${MOUNTPOINT}" >/dev/null; then
+        printf "%s already in use\n" "${MOUNTPOINT}" >&2
+        exit 1
+    else
+        sudo mount -o "${MOUNTOPTS}" "${DEV}" "${MOUNTPOINT}"
+    fi
+fi
+
+for folder in "${SYNC_FOLDERS[@]}"; do
+    rsync "${RSYNCOPTS[@]}" "${MOUNTPOINT}/GARMIN/${folder}/" "${HOME}/sync/garmin/${folder}/"
+done

scripts/install-gothic.sh

@@ -7,7 +7,7 @@
 
 STEAMAPPS=$XDG_DATA_HOME/Steam/steamapps/
 
-read -p "Make sure that gothic was installed via Steam and started once! <Enter> to continue, <CTRL+C> to abort "
+read -rp "Make sure that gothic was installed via Steam and started once! <Enter> to continue, <CTRL+C> to abort "
 
 set -o nounset
 set -o xtrace
@@ -21,59 +21,51 @@ cd "${downloaddir}"
 curl -C - -L -o gothic_patch_108k.exe "https://www.worldofgothic.de/download.php?id=15"
 curl -C - -L -o gothic1_playerkit-1.08k.exe "https://www.worldofgothic.de/download.php?id=61"
 
-curl -C - -L -o Definitive_Edition_1_4_5.exe "https://www.worldofgothic.de/download.php?id=1586"
+curl -C - -L -o Definitive_Edition_2_2_8.exe "https://www.worldofgothic.de/download.php?id=1586"
 
 # superseded by union
-curl -C - -L -O https://github.com/GothicFixTeam/GothicFix/releases/download/v1.8/G1Classic-SystemPack-1.8.exe
+# curl -C - -L -O https://github.com/GothicFixTeam/GothicFix/releases/download/v1.8/G1Classic-SystemPack-1.8.exe
 
-# curl -C - -L -O https://github.com/GothicFixTeam/GothicFix/releases/download/v1.8/Gothic1_PlayerKit-2.8.exe
+curl -C - -L -o LaaHack.zip https://www.worldofgothic.de/download.php?id=1457
 
-curl -C - -L -o Ninja-2.5.09.exe "https://www.worldofgothic.de/download.php?id=1626"
-# curl -C - -L -o Union_1.0j_22.02.2021.exe "https://www.worldofgothic.de/download.php?id=1625"
+curl -C - -L -O https://github.com/GothicFixTeam/GothicFix/releases/download/v1.8/Gothic1_PlayerKit-2.8.exe
 
-curl -C - -L -o G1CP-1.0.0.exe "https://www.worldofgothic.de/download.php?id=1636"
+curl -C - -L -o Ninja-2.9.14.exe "https://www.worldofgothic.de/download.php?id=1626"
+curl -C - -L -o Union_1.0m_26.06.2022.exe "https://www.worldofgothic.de/download.php?id=1625"
 
-#curl -C - -L -o Spine_1.29.0.exe "https://www.worldofgothic.de/download.php?id=1417"
+curl -C - -L -o G1CP-1.2.0.exe "https://www.worldofgothic.de/download.php?id=1636"
 
-curl -C - -L -o Gothic1-GD3D11-17.7-dev16.zip https://github.com/Kirides/GD3D11/releases/download/v17.7-dev16/Gothic1-GD3D11-17.7-dev16.zip
+curl -C - -L -o GD3D11-v17.8-dev9.zip https://github.com/kirides/GD3D11/releases/download/v17.8-dev9/GD3D11-v17.8-dev9.zip
 curl -C - -L -o RiisisGothic1TextureMixV1.1.zip "https://www.worldofgothic.de/download.php?id=1458"
 
-read -p 'During installation, use "Z:\var\games\steamapps\common\Gothic\" as the install directory! <Enter> to continue, <CTRL+C> to abort '
+read -rp "During installation, use \"${STEAMAPPS}/common/Gothic\" as the install directory! <Enter> to continue, <CTRL+C> to abort "
 
 
 export WINEPREFIX="${STEAMAPPS}/compatdata/65540/pfx/"
 
-#winetricks dxvk
+winetricks dotnet7
 winetricks directmusic
 
-#read -p "In winecfg, go to Libraries tab, in 'existing overrides' search for 'dsound', select it and press remove button "
-#winecfg
+wine "${downloaddir}"/gothic_patch_108k.exe
+wine "${downloaddir}"/gothic1_playerkit-1.08k.exe
 
-# wine "${downloaddir}"/gothic_patch_108k.exe
-# wine "${downloaddir}"/gothic1_playerkit-1.08k.exe
-
-# wine "${downloaddir}"/Gothic1_PlayerKit-2.8.exe
+wine "${downloaddir}"/Gothic1_PlayerKit-2.8.exe
 wine "${downloaddir}"/G1Classic-SystemPack-1.8.exe
 
-wine "${downloaddir}"/Ninja-2.5.09.exe
+unzip -u "${downloaddir}"/LaaHack.zip -d "${STEAMAPPS}/common/Gothic/system"
 
-# cmd="${WINEPREFIX}/dosdevices/c:/windows/syswow64/cmd.exe"
-# cmdtarget="$(readlink "${cmd}")"
-# rm "${WINEPREFIX}/dosdevices/c:/windows/syswow64/cmd.exe"
-# winetricks cmd # for union install
-# wine "${downloaddir}"/Union_1.0j_22.02.2021.exe
-# ln -sf "$cmdtarget" "$cmd"
+# wine "${downloaddir}"/Union_1.0m_26.06.2022.exe
+wine "${downloaddir}"/Ninja-2.9.14.exe
 
-wine "${downloaddir}"/G1CP-1.0.0.exe
-wine "${downloaddir}"/Definitive_Edition_1_4_5.exe
+wine "${downloaddir}"/G1CP-1.2.0.exe
+wine "${downloaddir}"/Definitive_Edition_2_2_8.exe
 
-unzip -u "${downloaddir}"/Gothic1-GD3D11-17.7-dev16.zip -d "${STEAMAPPS}/common/Gothic/system"
+unzip -u "${downloaddir}"/GD3D11-v17.8-dev9.zip -d "${STEAMAPPS}/common/Gothic/system"
 unzip -u "${downloaddir}"/RiisisGothic1TextureMixV1.1.zip -d "${STEAMAPPS}/common/Gothic/Data"
 
+read -rp "Now run the game once and exit! <Enter> to continue, <CTRL+C> to abort "
 
-read -p "Now run the game once and exit! <Enter> to continue, <CTRL+C> to abort "
-
-cd /var/games/steamapps/common/Gothic
+cd "${STEAMAPPS}"/common/Gothic
 
 sed -i 's/^playLogoVideos=.*$/playLogoVideos=0\r/' system/Gothic.ini
 sed -i 's/^sightValue=.*$/sightValue=14\r/' system/Gothic.ini