AFPI is a modular and intelligent system for Fedora Workstation post-installation (Validated on Fedora 41-43). It uses an architecture based on Roles and Dynamic Templates, allowing your desktop customization and hardware optimizations to be applied consistently, making your workstation deployment fully automated and "hardware-aware".
Warning
Disclaimer: This project is tailored specifically for my personal environment, preferences, and hardware configuration. If you choose to use it, you must thoroughly review all roles, configurations, and variables, and customize them to fit your own specific requirements and hardware setup. Use it at your own risk.
- Current Version: 2.4.0
- Last Update: May 24, 2026
- Latest Improvement: Added system security audit and diagnostics tools (chkrootkit, lynis, rkhunter, unhide, htop, Burp Suite Community) and cleaned up deprecated gemini-cli aliases.
- Stability: Production-ready for Fedora 41, 42, and 43.
The project is organized to isolate responsibilities, ensuring idempotency and ease of maintenance:
-
common: System optimizations (DNF, RPM Fusion), kernel cleanup, and Zero-Config ZSH setup (Oh-My-Zsh with Kali-like theme and self-managed plugins). -
hardware: Driver detection and installation (Signed NVIDIA for Secure Boot, Intel, AMD), multimedia codecs, and ASUS ROG support. -
desktop:- Universal Cedilla (ç) Fix: Fine-tuned in three layers (System, Flatpak, and Ozone/X11) to ensure the cedilla works perfectly across all applications.
- Visual: Unified management of wallpapers (Desktop/SDDM), profile pictures, and terminal profiles (Konsole/PTYxis).
-
apps: Complete suite via DNF and Flatpak, featuring GPU automation for Steam, VirtualBox group management (vboxusers/vboxsf), and productivity tools (Brave, VS Code). -
ai_tools: Integration of the AI ecosystem (Gemini CLI and extensions) and specialized Python libraries viapipx.
AFPI features a comprehensive tagging system that allows you to run specific parts of the configuration:
| Category | Primary Tags | Description |
|---|---|---|
| Maintenance | update, cleanup |
System upgrades, DNF optimization, and kernel cleanup. |
| Hardware | nvidia, drivers, power, asus |
GPU drivers, power management, and ASUS-specific tools. |
| Shell | shell, zsh, omz, aliases |
ZSH installation, Oh-My-Zsh theme, and custom aliases. |
| Desktop | desktop, visual, fonts, cedilla |
UI themes, wallpapers, fonts, and the universal cedilla fix. |
| Software | apps, software, dnf, flatpak |
Application installation via DNF or Flatpak. |
| AI | ai, gemini, extensions, python |
Gemini CLI, extensions, and AI-related Python libraries. |
AFPI uses Ansible Vault to protect sensitive information. Since the provided group_vars/all/secrets.yml is encrypted, you must create your own if you fork this project.
| Variable | Description | Example / Usage |
|---|---|---|
api_keys |
Block of environment exports for your shell | export SERVICE_API_KEY="your_value_here" |
mok_password |
Password for NVIDIA MOK enrollment | Used to sign drivers for Secure Boot |
user_profile_picture_base64 |
Base64 string of your profile photo | Optional |
Prepare the Ansible environment:
./bootstrap.shApply the full configuration (the provided ansible.cfg is optimized for faster deployment):
ansible-playbook -i inventory.ini site.yml -K --ask-vault-passImportant
NVIDIA Users: To ensure compatibility of proprietary drivers with the latest kernel and Secure Boot signing, follow this specific 3-step workflow using tags:
- Update System:
ansible-playbook -i inventory.ini site.yml --tags update -K --ask-vault-pass - Reboot to load the new kernel.
- Install NVIDIA Drivers:
ansible-playbook -i inventory.ini site.yml --tags nvidia -K --ask-vault-pass - Reboot to enroll the MOK key (if Secure Boot is enabled).
- Finish Setup:
ansible-playbook -i inventory.ini site.yml --skip-tags update,nvidia -K --ask-vault-pass
Some laptops (especially those with hybrid graphics or specific ASUS/NVIDIA combinations) may experience a system freeze during the hardware role.
- Hard Reboot the machine (hold power button).
- Run the playbook skipping the power management and hardware-specific tags to isolate the issue:
ansible-playbook site.yml --skip-tags power,asus --ask-vault-pass
- If the playbook finishes successfully with these skips, the conflict is likely in the NVIDIA Deep Power Management settings or the
supergfxdservice.
AFPI doesn't just run blindly. The env_setup.yml core task dynamically discovers your machine's profile:
- Hardware Detection: Identifies NVIDIA, Intel, or AMD GPUs and applies specific acceleration packages.
- Vendor Awareness: Specifically detects ASUS ROG/TUF systems to enable
asusctlandsupergfxctltools. - Desktop Agnostic: Automatically identifies if you are running GNOME or KDE Plasma and applies environment-specific terminal profiles (PTYxis or Konsole) and apps.
ZSH configuration has been simplified. The kali-like-alt theme manages its own dependencies (syntax highlighting and autosuggestions), reducing playbook complexity and execution time.
The system handles common installation failures automatically, such as external repository synchronization (ProtonVPN). It implements a Double-Guard logic (repository validation + intelligent retries) to mitigate mirror instabilities.
The nvidia role implements an advanced MOK (Machine Owner Key) management system entirely via Ansible:
- Intelligent Detection: Detects existing keys, pending enrollments, and kernel status to avoid redundant operations.
- Integrated Signing: Automatically triggers
akmodsanddracutto ensure modules are signed and included in the initramfs immediately. - Secure Pipe: Uses high-reliability password injection for
mokutilvia Vault secrets.
Fine-tuned in three layers (System, Flatpak, and Ozone/X11) to ensure the cedilla works perfectly across all applications.