refactor(vars): add system/hypervisor dict inputs

roles/bootstrap/tasks/almalinux.yml

@@ -1,20 +1,35 @@
 ---
-- name: Bootstrap AlmaLinux 9
+- name: Bootstrap AlmaLinux
   vars:
-    bootstrap_alma_extra: >-
+    bootstrap_almalinux_extra: >-
       {{
         lookup('vars', bootstrap_var_key)
         | reject('equalto', '')
         | join(' ')
       }}
-  ansible.builtin.command: "{{ item }}"
-  loop:
-    - >-
-        dnf --releasever=9 --best --repo=alma-baseos --installroot=/mnt
-        --setopt=install_weak_deps=False groupinstall -y base core
-    - ln -sf /run/NetworkManager/resolv.conf /mnt/etc/resolv.conf
-    - >-
-        {{ chroot_command }} /mnt dnf --releasever=9 --setopt=install_weak_deps=False
-        install -y {{ bootstrap_alma_extra }}
-  register: bootstrap_result
-  changed_when: bootstrap_result.rc == 0
+  block:
+    - name: Install AlmaLinux base system
+      ansible.builtin.command: >-
+        dnf --releasever={{ os_version }} --best --repo=baseos --repo=appstream
+        --installroot=/mnt --setopt=install_weak_deps=False
+        groupinstall -y core
+      register: bootstrap_almalinux_base_result
+      changed_when: bootstrap_almalinux_base_result.rc == 0
+
+    - name: Ensure chroot has resolv.conf
+      ansible.builtin.file:
+        src: /run/NetworkManager/resolv.conf
+        dest: /mnt/etc/resolv.conf
+        state: link
+
+    - name: Install extra packages
+      ansible.builtin.command: >-
+        {{ chroot_command }} dnf --releasever={{ os_version }} --setopt=install_weak_deps=False
+        install -y {{ bootstrap_almalinux_extra }}
+      register: bootstrap_almalinux_extra_result
+      changed_when: bootstrap_almalinux_extra_result.rc == 0
+
+    - name: Reinstall kernel core
+      ansible.builtin.command: "{{ chroot_command }} dnf reinstall -y kernel-core"
+      register: bootstrap_almalinux_kernel_result
+      changed_when: bootstrap_almalinux_kernel_result.rc == 0

roles/bootstrap/tasks/alpine.yml

@@ -0,0 +1,33 @@
+---
+- name: Bootstrap Alpine Linux
+  vars:
+    bootstrap_alpine_packages: >-
+      {{
+        lookup('vars', 'bootstrap_alpine') | reject('equalto', '') | join(' ')
+      }}
+  block:
+    - name: Ensure chroot has resolv.conf
+      ansible.builtin.file:
+        src: /run/NetworkManager/resolv.conf
+        dest: /mnt/etc/resolv.conf
+        state: link
+        force: true
+
+    - name: Install Alpine Linux packages
+      ansible.builtin.command: >
+        apk --root /mnt --no-cache add alpine-base
+      register: bootstrap_alpine_bootstrap_result
+      changed_when: bootstrap_alpine_bootstrap_result.rc == 0
+
+    - name: Install extra packages
+      when: bootstrap_alpine_packages | length > 0
+      ansible.builtin.command: >
+        apk --root /mnt add {{ bootstrap_alpine_packages }}
+      register: bootstrap_alpine_extra_result
+      changed_when: bootstrap_alpine_extra_result.rc == 0
+
+    - name: Install bootloader
+      ansible.builtin.command: >
+        apk --root /mnt add grub grub-efi efibootmgr
+      register: bootstrap_alpine_bootloader_result
+      changed_when: bootstrap_alpine_bootloader_result.rc == 0

roles/bootstrap/tasks/debian.yml

@@ -3,13 +3,27 @@
   vars:
     bootstrap_debian_release: >-
       {{
-        'bullseye' if bootstrap_os_key == 'debian11'
-        else 'bookworm' if bootstrap_os_key == 'debian12'
+        'buster' if (os_version | string) == '10'
+        else 'bullseye' if (os_version | string) == '11'
+        else 'bookworm' if (os_version | string) == '12'
+        else 'trixie' if (os_version | string) == '13'
+        else 'sid' if (os_version | string) == 'unstable'
         else 'trixie'
       }}
-    bootstrap_debian_base_list: "{{ lookup('vars', bootstrap_var_key).base | default([]) }}"
-    bootstrap_debian_extra_list: "{{ lookup('vars', bootstrap_var_key).extra | default([]) }}"
-    bootstrap_debian_base: "{{ bootstrap_debian_base_list | reject('equalto', '') | join(',') }}"
+    bootstrap_debian_version_packages: >-
+      {{
+        lookup('vars', bootstrap_var_key)
+        | reject('equalto', '')
+        | list
+      }}
+    bootstrap_debian_base_list: >-
+      {{
+        bootstrap_debian_base
+        | reject('equalto', '')
+        | list
+      }}
+    bootstrap_debian_extra_list: "{{ bootstrap_debian_version_packages | difference(bootstrap_debian_base_list) }}"
+    bootstrap_debian_base: "{{ bootstrap_debian_base_list | join(',') }}"
     bootstrap_debian_extra: >-
       {{
         (
@@ -18,12 +32,20 @@
         | reject('equalto', '')
         | join(' ')
       }}
-  ansible.builtin.command: "{{ item }}"
-  loop:
-    - >-
+  block:
+    - name: Install Debian base system
+      ansible.builtin.command: >-
         debootstrap --include={{ bootstrap_debian_base }}
         {{ bootstrap_debian_release }} /mnt http://deb.debian.org/debian/
-    - "{{ chroot_command }} /mnt apt install -y {{ bootstrap_debian_extra }}"
-    - "{{ chroot_command }} /mnt apt remove -y libcups2 libavahi-common3 libavahi-common-data"
-  register: bootstrap_result
-  changed_when: bootstrap_result.rc == 0
+      register: bootstrap_debian_base_result
+      changed_when: bootstrap_debian_base_result.rc == 0
+
+    - name: Install extra packages
+      ansible.builtin.command: "{{ chroot_command }} apt install -y {{ bootstrap_debian_extra }}"
+      register: bootstrap_debian_extra_result
+      changed_when: bootstrap_debian_extra_result.rc == 0
+
+    - name: Remove unnecessary packages
+      ansible.builtin.command: "{{ chroot_command }} apt remove -y libcups2 libavahi-common3 libavahi-common-data"
+      register: bootstrap_debian_remove_result
+      changed_when: bootstrap_debian_remove_result.rc == 0

roles/bootstrap/tasks/fedora.yml

@@ -1,5 +1,5 @@
 ---
-- name: Bootstrap Fedora 43
+- name: Bootstrap Fedora
   vars:
     bootstrap_fedora_extra: >-
       {{
@@ -7,16 +7,29 @@
         | reject('equalto', '')
         | join(' ')
       }}
-  ansible.builtin.command: "{{ item }}"
-  loop:
-    - >-
-        dnf --releasever=43 --best --repo=fedora --repo=fedora-updates
+  block:
+    - name: Install Fedora base system
+      ansible.builtin.command: >-
+        dnf --releasever={{ os_version }} --best --repo=fedora --repo=fedora-updates
         --installroot=/mnt --setopt=install_weak_deps=False
         groupinstall -y critical-path-base core
-    - ln -sf /run/NetworkManager/resolv.conf /mnt/etc/resolv.conf
-    - >-
-        {{ chroot_command }} /mnt dnf --releasever=43 --setopt=install_weak_deps=False
+      register: bootstrap_fedora_base_result
+      changed_when: bootstrap_fedora_base_result.rc == 0
+
+    - name: Ensure chroot has resolv.conf
+      ansible.builtin.file:
+        src: /run/NetworkManager/resolv.conf
+        dest: /mnt/etc/resolv.conf
+        state: link
+
+    - name: Install extra packages
+      ansible.builtin.command: >-
+        {{ chroot_command }} dnf --releasever={{ os_version }} --setopt=install_weak_deps=False
         install -y {{ bootstrap_fedora_extra }}
-    - "{{ chroot_command }} /mnt dnf reinstall -y kernel-core"
-  register: bootstrap_result
-  changed_when: bootstrap_result.rc == 0
+      register: bootstrap_fedora_extra_result
+      changed_when: bootstrap_fedora_extra_result.rc == 0
+
+    - name: Reinstall kernel core
+      ansible.builtin.command: "{{ chroot_command }} dnf reinstall -y kernel-core"
+      register: bootstrap_fedora_kernel_result
+      changed_when: bootstrap_fedora_kernel_result.rc == 0

roles/bootstrap/tasks/main.yml

@@ -1,27 +1,35 @@
 ---
 - name: Run OS-specific bootstrap process
   vars:
-    bootstrap_os_key: "{{ os | lower }}"
-    bootstrap_var_key: "{{ 'bootstrap_' + (os | lower | replace('-', '_')) }}"
+    bootstrap_os_key: "{{ (os_resolved | default(os)) | lower }}"
+    bootstrap_var_key: "{{ 'bootstrap_' + ((os_resolved | default(os)) | lower | replace('-', '_')) }}"
   block:
     - name: Include AlmaLinux bootstrap tasks
-      when: bootstrap_os_key == 'almalinux'
+      when: bootstrap_os_key in ['almalinux', 'almalinux8', 'almalinux9', 'almalinux10']
       ansible.builtin.include_tasks: almalinux.yml
 
+    - name: Include Alpine bootstrap tasks
+      when: bootstrap_os_key == 'alpine'
+      ansible.builtin.include_tasks: alpine.yml
+
     - name: Include ArchLinux bootstrap tasks
       when: bootstrap_os_key == 'archlinux'
       ansible.builtin.include_tasks: archlinux.yml
 
     - name: Include Debian bootstrap tasks
-      when: bootstrap_os_key in ['debian11', 'debian12', 'debian13']
+      when: bootstrap_os_key in ['debian10', 'debian11', 'debian12', 'debian13', 'debianunstable']
       ansible.builtin.include_tasks: debian.yml
 
     - name: Include Fedora bootstrap tasks
-      when: bootstrap_os_key == 'fedora'
+      when: bootstrap_os_key in ['fedora', 'fedora40', 'fedora41', 'fedora42', 'fedora43']
       ansible.builtin.include_tasks: fedora.yml
 
+    - name: Include openSUSE bootstrap tasks
+      when: bootstrap_os_key == 'opensuse'
+      ansible.builtin.include_tasks: opensuse.yml
+
     - name: Include Rocky bootstrap tasks
-      when: bootstrap_os_key == 'rocky'
+      when: bootstrap_os_key in ['rocky', 'rocky8', 'rocky9', 'rocky10']
       ansible.builtin.include_tasks: rocky.yml
 
     - name: Include RHEL bootstrap tasks
@@ -31,3 +39,7 @@
     - name: Include Ubuntu bootstrap tasks
       when: bootstrap_os_key in ['ubuntu', 'ubuntu-lts']
       ansible.builtin.include_tasks: ubuntu.yml
+
+    - name: Include Void bootstrap tasks
+      when: bootstrap_os_key == 'void'
+      ansible.builtin.include_tasks: void.yml

roles/bootstrap/tasks/opensuse.yml

@@ -0,0 +1,33 @@
+---
+- name: Bootstrap openSUSE
+  vars:
+    bootstrap_opensuse_packages: >-
+      {{
+        lookup('vars', 'bootstrap_opensuse') | reject('equalto', '') | join(' ')
+      }}
+  block:
+    - name: Ensure chroot has resolv.conf
+      ansible.builtin.file:
+        src: /run/NetworkManager/resolv.conf
+        dest: /mnt/etc/resolv.conf
+        state: link
+        force: true
+
+    - name: Install openSUSE base packages
+      ansible.builtin.command: >
+        zypper --root /mnt --non-interactive install -t pattern patterns-base-base
+      register: bootstrap_opensuse_base_result
+      changed_when: bootstrap_opensuse_base_result.rc == 0
+
+    - name: Install openSUSE extra packages
+      when: bootstrap_opensuse_packages | length > 0
+      ansible.builtin.command: >
+        zypper --root /mnt --non-interactive install {{ bootstrap_opensuse_packages }}
+      register: bootstrap_opensuse_extra_result
+      changed_when: bootstrap_opensuse_extra_result.rc == 0
+
+    - name: Install bootloader
+      ansible.builtin.command: >
+        zypper --root /mnt --non-interactive install grub2 grub2-efi efibootmgr
+      register: bootstrap_opensuse_bootloader_result
+      changed_when: bootstrap_opensuse_bootloader_result.rc == 0

roles/bootstrap/tasks/rhel.yml

@@ -17,7 +17,6 @@
         src: /run/NetworkManager/resolv.conf
         dest: /mnt/etc/resolv.conf
         state: link
-        force: true
 
     - name: Ensure chroot RHEL DVD directory exists
       ansible.builtin.file:
@@ -34,7 +33,7 @@
         state: mounted
 
     - name: Rebuild RPM database inside chroot
-      ansible.builtin.command: "{{ chroot_command }} /mnt rpm --rebuilddb"
+      ansible.builtin.command: "{{ chroot_command }} rpm --rebuilddb"
       register: bootstrap_rpm_rebuild_result
       changed_when: bootstrap_rpm_rebuild_result.rc == 0
 
@@ -55,7 +54,7 @@
             | join(' ')
           }}
       ansible.builtin.command: >-
-        {{ chroot_command }} /mnt dnf --releasever={{ bootstrap_rhel_release }}
+        {{ chroot_command }} dnf --releasever={{ bootstrap_rhel_release }}
         --setopt=install_weak_deps=False install -y {{ bootstrap_rhel_extra }}
       register: bootstrap_result
       changed_when: bootstrap_result.rc == 0

roles/bootstrap/tasks/rocky.yml

@@ -1,5 +1,5 @@
 ---
-- name: Bootstrap RockyLinux 9
+- name: Bootstrap Rocky Linux
   vars:
     bootstrap_rocky_extra: >-
       {{
@@ -7,15 +7,29 @@
         | reject('equalto', '')
         | join(' ')
       }}
-  ansible.builtin.command: "{{ item }}"
-  loop:
-    - >-
-        dnf --releasever=9 --best --repo=rocky-baseos --installroot=/mnt
-        --setopt=install_weak_deps=False --setopt=optional_metadata_types=filelists
-        groupinstall -y base core
-    - ln -sf /run/NetworkManager/resolv.conf /mnt/etc/resolv.conf
-    - >-
-        {{ chroot_command }} /mnt dnf --releasever=9 --setopt=install_weak_deps=False
+  block:
+    - name: Install Rocky Linux base system
+      ansible.builtin.command: >-
+        dnf --releasever={{ os_version }} --best --repo=baseos --repo=appstream
+        --installroot=/mnt --setopt=install_weak_deps=False
+        groupinstall -y core
+      register: bootstrap_rocky_base_result
+      changed_when: bootstrap_rocky_base_result.rc == 0
+
+    - name: Ensure chroot has resolv.conf
+      ansible.builtin.file:
+        src: /run/NetworkManager/resolv.conf
+        dest: /mnt/etc/resolv.conf
+        state: link
+
+    - name: Install extra packages
+      ansible.builtin.command: >-
+        {{ chroot_command }} dnf --releasever={{ os_version }} --setopt=install_weak_deps=False
         install -y {{ bootstrap_rocky_extra }}
-  register: bootstrap_result
-  changed_when: bootstrap_result.rc == 0
+      register: bootstrap_rocky_extra_result
+      changed_when: bootstrap_rocky_extra_result.rc == 0
+
+    - name: Reinstall kernel core
+      ansible.builtin.command: "{{ chroot_command }} dnf reinstall -y kernel-core"
+      register: bootstrap_rocky_kernel_result
+      changed_when: bootstrap_rocky_kernel_result.rc == 0

roles/bootstrap/tasks/ubuntu.yml

@@ -3,25 +3,38 @@
   vars:
     bootstrap_ubuntu_release: >-
       {{ 'plucky' if bootstrap_os_key == 'ubuntu' else 'noble' }}
-    bootstrap_ubuntu_base_list: "{{ lookup('vars', bootstrap_var_key).base | default([]) }}"
-    bootstrap_ubuntu_extra_list: "{{ lookup('vars', bootstrap_var_key).extra | default([]) }}"
-    bootstrap_ubuntu_base: "{{ bootstrap_ubuntu_base_list | reject('equalto', '') | join(',') }}"
     bootstrap_ubuntu_extra: >-
       {{
-        (
-          bootstrap_ubuntu_extra_list
-        )
+        lookup('vars', bootstrap_var_key)
         | reject('equalto', '')
         | join(' ')
       }}
-  ansible.builtin.command: "{{ item }}"
-  loop:
-    - >-
-        debootstrap --include={{ bootstrap_ubuntu_base }}
-        {{ bootstrap_ubuntu_release }} /mnt http://archive.ubuntu.com/ubuntu/
-    - ln -sf /run/NetworkManager/resolv.conf /mnt/etc/resolv.conf
-    - "{{ chroot_command }} /mnt sed -i '1s|$| universe|' /etc/apt/sources.list"
-    - "{{ chroot_command }} /mnt apt update"
-    - "{{ chroot_command }} /mnt apt install -y {{ bootstrap_ubuntu_extra }}"
-  register: bootstrap_result
-  changed_when: bootstrap_result.rc == 0
+  block:
+    - name: Install Ubuntu base system
+      ansible.builtin.command: >-
+        debootstrap --include=linux-image-generic
+        {{ bootstrap_ubuntu_release }} /mnt
+        http://archive.ubuntu.com/ubuntu/
+      register: bootstrap_ubuntu_base_result
+      changed_when: bootstrap_ubuntu_base_result.rc == 0
+
+    - name: Ensure chroot has resolv.conf
+      ansible.builtin.file:
+        src: /run/NetworkManager/resolv.conf
+        dest: /mnt/etc/resolv.conf
+        state: link
+
+    - name: Enable universe repository
+      ansible.builtin.command: "{{ chroot_command }} sed -i '1s|$| universe|' /etc/apt/sources.list"
+      register: bootstrap_ubuntu_repo_result
+      changed_when: bootstrap_ubuntu_repo_result.rc == 0
+
+    - name: Update package lists
+      ansible.builtin.command: "{{ chroot_command }} apt update"
+      register: bootstrap_ubuntu_update_result
+      changed_when: bootstrap_ubuntu_update_result.rc == 0
+
+    - name: Install extra packages
+      ansible.builtin.command: "{{ chroot_command }} apt install -y {{ bootstrap_ubuntu_extra }}"
+      register: bootstrap_ubuntu_extra_result
+      changed_when: bootstrap_ubuntu_extra_result.rc == 0

roles/bootstrap/tasks/void.yml

@@ -0,0 +1,33 @@
+---
+- name: Bootstrap Void Linux
+  vars:
+    bootstrap_void_packages: >-
+      {{
+        lookup('vars', 'bootstrap_void') | reject('equalto', '') | join(' ')
+      }}
+  block:
+    - name: Ensure chroot has resolv.conf
+      ansible.builtin.file:
+        src: /run/NetworkManager/resolv.conf
+        dest: /mnt/etc/resolv.conf
+        state: link
+        force: true
+
+    - name: Install Void Linux base packages
+      ansible.builtin.command: >
+        xbps-install -Sy -r /mnt -R https://repo-default.voidlinux.org/current void-repo-nonfree base-system
+      register: bootstrap_void_base_result
+      changed_when: bootstrap_void_base_result.rc == 0
+
+    - name: Install extra packages
+      when: bootstrap_void_packages | length > 0
+      ansible.builtin.command: >
+        xbps-install -Su -r /mnt {{ bootstrap_void_packages }}
+      register: bootstrap_void_extra_result
+      changed_when: bootstrap_void_extra_result.rc == 0
+
+    - name: Install bootloader
+      ansible.builtin.command: >
+        xbps-install -Sy -r /mnt grub-x86_64-efi efibootmgr
+      register: bootstrap_void_bootloader_result
+      changed_when: bootstrap_void_bootloader_result.rc == 0

roles/bootstrap/vars/main.yml

@@ -1,21 +1,20 @@
 ---
-bootstrap_almalinux:
+bootstrap_rhel_base:
   - bind-utils
-  - dbus-daemon
   - dhcp-client
   - efibootmgr
-  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
+  - "{{ 'firewalld' if firewall_backend == 'firewalld' and firewall_enabled | bool else '' }}"
+  - "{{ 'ufw' if firewall_backend == 'ufw' and firewall_enabled | bool else '' }}"
+  - "{{ 'iptables' if firewall_toolkit == 'iptables' else '' }}"
+  - "{{ 'nftables' if firewall_toolkit == 'nftables' else '' }}"
   - glibc-langpack-de
   - glibc-langpack-en
-  - grub2
-  - grub2-efi
   - lrzsz
   - lvm2
-  - nc
-  - nfs-utils
-  - nfsv4-client-utils
   - mtr
-  - ppp
+  - ncurses-term
+  - nfs-utils
+  - policycoreutils-python-utils
   - shim
   - tmux
   - "{{ 'cryptsetup' if luks_enabled else '' }}"
@@ -23,10 +22,162 @@ bootstrap_almalinux:
   - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
   - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
   - vim
-  - wget
   - zram-generator
   - zstd
 
+bootstrap_rhel_versioned:
+  - grub2
+  - "{{ 'grub2-efi-x64' if os_version_major | default('') == '8' else 'grub2-efi' }}"
+  - "{{ 'grub2-tools-extra' if os_version_major | default('') in ['8', '9'] else '' }}"
+  - "{{ 'python39' if os_version_major | default('') == '8' else 'python' }}"
+  - "{{ 'kernel' if os_version_major | default('') == '10' else '' }}"
+
+bootstrap_rhel_common: "{{ bootstrap_rhel_base + bootstrap_rhel_versioned }}"
+
+bootstrap_rhel8: "{{ bootstrap_rhel_common }}"
+bootstrap_rhel9: "{{ bootstrap_rhel_common }}"
+bootstrap_rhel10: "{{ bootstrap_rhel_common }}"
+
+bootstrap_almalinux:
+  "{{ bootstrap_rhel_base + ['grub2', 'grub2-efi', 'dbus-daemon', 'lrzsz', 'nfsv4-client-utils', 'nc', 'ppp'] }}"
+
+bootstrap_rocky:
+  "{{ bootstrap_rhel_base + ['grub2', 'grub2-efi', 'nfsv4-client-utils', 'nc', 'ppp', 'telnet', 'util-linux-core', 'wget'] }}"
+
+bootstrap_almalinux8: "{{ bootstrap_almalinux }}"
+bootstrap_almalinux9: "{{ bootstrap_almalinux }}"
+bootstrap_almalinux10: "{{ bootstrap_almalinux }}"
+
+bootstrap_rocky8: "{{ bootstrap_rocky }}"
+bootstrap_rocky9: "{{ bootstrap_rocky }}"
+bootstrap_rocky10: "{{ bootstrap_rocky }}"
+
+bootstrap_fedora:
+  - bat
+  - bind-utils
+  - btrfs-progs
+  - cronie
+  - dhcp-client
+  - duf
+  - efibootmgr
+  - entr
+  - "{{ 'firewalld' if firewall_backend == 'firewalld' and firewall_enabled | bool else '' }}"
+  - "{{ 'ufw' if firewall_backend == 'ufw' and firewall_enabled | bool else '' }}"
+  - "{{ 'iptables' if firewall_toolkit == 'iptables' else '' }}"
+  - "{{ 'nftables' if firewall_toolkit == 'nftables' else '' }}"
+  - fish
+  - fzf
+  - glibc-langpack-de
+  - glibc-langpack-en
+  - grub2
+  - grub2-efi
+  - htop
+  - iperf3
+  - logrotate
+  - lrzsz
+  - lvm2
+  - nc
+  - nfs-utils
+  - nfsv4-client-utils
+  - polkit
+  - ppp
+  - ripgrep
+  - shim
+  - tmux
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
+  - vim-default-editor
+  - wget
+  - zoxide
+  - zram-generator
+  - zstd
+
+bootstrap_fedora40: "{{ bootstrap_fedora }}"
+bootstrap_fedora41: "{{ bootstrap_fedora }}"
+bootstrap_fedora42: "{{ bootstrap_fedora }}"
+bootstrap_fedora43: "{{ bootstrap_fedora }}"
+
+bootstrap_debian_base:
+  - btrfs-progs
+  - cron
+  - gnupg
+  - grub-efi
+  - grub-efi-amd64-signed
+  - grub2-common
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
+  - locales
+  - logrotate
+  - lvm2
+  - "{{ 'iptables' if firewall_toolkit == 'iptables' else '' }}"
+  - "{{ 'nftables' if firewall_toolkit == 'nftables' else '' }}"
+  - "{{ 'openssh-server' if ssh_enabled | bool else '' }}"
+  - python3
+  - xfsprogs
+
+bootstrap_debian_extra:
+  - apparmor-utils
+  - bat
+  - chrony
+  - curl
+  - duf
+  - entr
+  - "{{ 'firewalld' if firewall_backend == 'firewalld' and firewall_enabled | bool else '' }}"
+  - "{{ 'ufw' if firewall_backend == 'ufw' and firewall_enabled | bool else '' }}"
+  - fish
+  - fzf
+  - htop
+  - jq
+  - libpam-pwquality
+  - lrzsz
+  - mtr
+  - ncdu
+  - net-tools
+  - network-manager
+  - python-is-python3
+  - ripgrep
+  - rsync
+  - screen
+  - software-properties-common
+  - sudo
+  - syslog-ng
+  - systemd-zram-generator
+  - tcpd
+  - tldr
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
+  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
+  - vim
+  - wget
+  - zstd
+
+bootstrap_debian_versioned:
+  - "{{ 'linux-image-amd64' if (os_version | string) in ['10', '11', '13', 'unstable'] else '' }}"
+  - "{{ 'fastfetch' if (os_version | string) in ['12', '13', 'unstable'] else '' }}"
+  - "{{ 'neofetch' if (os_version | string) == '12' else '' }}"
+
+bootstrap_debian_common: "{{ bootstrap_debian_base + bootstrap_debian_extra + bootstrap_debian_versioned }}"
+
+bootstrap_debian10: "{{ bootstrap_debian_common }}"
+bootstrap_debian11: "{{ bootstrap_debian_common }}"
+bootstrap_debian12: "{{ bootstrap_debian_common }}"
+bootstrap_debian13: "{{ bootstrap_debian_common }}"
+bootstrap_debianunstable: "{{ bootstrap_debian_common }}"
+
+bootstrap_ubuntu:
+  "{{
+    bootstrap_debian_base + bootstrap_debian_extra +
+    ['bash-completion', 'dnsutils', 'eza', 'fdupes', 'fio', 'ncurses-term', 'traceroute', 'util-linux-extra', 'yq', 'zoxide']
+  }}"
+
+bootstrap_ubuntu_lts:
+  "{{
+    bootstrap_debian_base + bootstrap_debian_extra +
+    ['bash-completion', 'dnsutils', 'eza', 'fdupes', 'fio', 'ncurses-term', 'traceroute', 'util-linux-extra', 'yq', 'zoxide']
+  }}"
+
 bootstrap_archlinux:
   - base
   - btrfs-progs
@@ -34,7 +185,10 @@ bootstrap_archlinux:
   - dhcpcd
   - efibootmgr
   - fastfetch
-  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
+  - "{{ 'firewalld' if firewall_backend == 'firewalld' and firewall_enabled | bool else '' }}"
+  - "{{ 'ufw' if firewall_backend == 'ufw' and firewall_enabled | bool else '' }}"
+  - "{{ 'iptables' if firewall_toolkit == 'iptables' else '' }}"
+  - "{{ 'iptables-nft' if firewall_toolkit == 'nftables' else '' }}"
   - fish
   - fzf
   - grub
@@ -65,436 +219,39 @@ bootstrap_archlinux:
   - wireguard-tools
   - zram-generator
 
-bootstrap_debian11:
-  base:
-    - apparmor-utils
-    - btrfs-progs
-    - chrony
-    - cron
-    - gnupg
-    - grub-efi
-    - grub-efi-amd64-signed
-    - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
-    - linux-image-amd64
-    - locales
-    - logrotate
-    - lvm2
-    - net-tools
-    - "{{ 'openssh-server' if ssh_enabled | bool else '' }}"
-    - python3
-    - sudo
-    - xfsprogs
-
-  extra:
-    - bat
-    - curl
-    - entr
-    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-    - fish
-    - fzf
-    - htop
-    - jq
-    - libpam-pwquality
-    - lrzsz
-    - mtr
-    - ncdu
-    - neofetch
-    - network-manager
-    - python-is-python3
-    - ripgrep
-    - rsync
-    - screen
-    - software-properties-common
-    - syslog-ng
-    - tcpd
-    - tldr
-    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-    - vim
-    - wget
-    - zstd
-
-bootstrap_debian12:
-  base:
-    - btrfs-progs
-    - cron
-    - gnupg
-    - grub-efi
-    - grub-efi-amd64-signed
-    - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
-    - linux-image-amd64
-    - locales
-    - logrotate
-    - lvm2
-    - xfsprogs
-
-  extra:
-    - apparmor-utils
-    - bat
-    - chrony
-    - curl
-    - duf
-    - entr
-    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-    - fish
-    - fzf
-    - htop
-    - jq
-    - libpam-pwquality
-    - logrotate
-    - lrzsz
-    - mtr
-    - ncdu
-    - neofetch
-    - net-tools
-    - network-manager
-    - "{{ 'openssh-server' if ssh_enabled | bool else '' }}"
-    - python-is-python3
-    - python3
-    - ripgrep
-    - rsync
-    - screen
-    - software-properties-common
-    - sudo
-    - syslog-ng
-    - systemd-zram-generator
-    - tcpd
-    - tldr
-    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-    - vim
-    - wget
-    - zstd
-
-bootstrap_debian13:
-  base:
-    - btrfs-progs
-    - cron
-    - gnupg
-    - grub-efi
-    - grub-efi-amd64-signed
-    - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
-    - linux-image-amd64
-    - locales
-    - logrotate
-    - lvm2
-    - xfsprogs
-
-  extra:
-    - apparmor-utils
-    - bat
-    - chrony
-    - curl
-    - duf
-    - entr
-    - fastfetch
-    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-    - fish
-    - fzf
-    - htop
-    - jq
-    - libpam-pwquality
-    - logrotate
-    - lrzsz
-    - mtr
-    - ncdu
-    - net-tools
-    - network-manager
-    - "{{ 'openssh-server' if ssh_enabled | bool else '' }}"
-    - python-is-python3
-    - python3
-    - ripgrep
-    - rsync
-    - screen
-    - sudo
-    - syslog-ng
-    - systemd-zram-generator
-    - tcpd
-    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-    - vim
-    - wget
-    - zstd
-
-bootstrap_fedora:
-  - bat
-  - bind-utils
-  - btrfs-progs
-  - cronie
-  - dhcp-client
-  - duf
-  - efibootmgr
-  - entr
-  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-  - fish
-  - fzf
-  - glibc-langpack-de
-  - glibc-langpack-en
-  - grub2
-  - grub2-efi
-  - htop
-  - iperf3
-  - logrotate
-  - lrzsz
-  - lvm2
-  - nc
-  - nfs-utils
-  - nfsv4-client-utils
-  - polkit
-  - ppp
-  - ripgrep
-  - shim
-  - tmux
-  - "{{ 'cryptsetup' if luks_enabled else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-  - vim-default-editor
-  - wget
-  - zoxide
-  - zram-generator
-  - zstd
-
-bootstrap_rhel8:
-  - bind-utils
-  - dhcp-client
-  - efibootmgr
-  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-  - glibc-langpack-de
-  - glibc-langpack-en
-  - grub2
-  - grub2-efi-x64
-  - grub2-tools-extra
-  - lrzsz
-  - lvm2
-  - mtr
-  - ncurses-term
-  - nfs-utils
-  - policycoreutils-python-utils
-  - python39
-  - shim
-  - tmux
-  - "{{ 'cryptsetup' if luks_enabled else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
-  - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
-  - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
+bootstrap_alpine:
+  - alpine-base
   - vim
-  - zstd
-
-bootstrap_rhel9:
-  - bind-utils
-  - dhcp-client
-  - efibootmgr
-  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-  - glibc-langpack-de
-  - glibc-langpack-en
-  - grub2
-  - grub2-efi
-  - grub2-tools-extra
-  - lrzsz
-  - lvm2
-  - mtr
-  - ncurses-term
-  - nfs-utils
-  - policycoreutils-python-utils
-  - python
-  - shim
-  - tmux
-  - "{{ 'cryptsetup' if luks_enabled else '' }}"
-  - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+  - "{{ 'openssh' if ssh_enabled | bool else '' }}"
   - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
   - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-  - vim
-  - zram-generator
-  - zstd
-
-bootstrap_rhel10:
-  - bind-utils
-  - efibootmgr
-  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-  - glibc-langpack-de
-  - glibc-langpack-en
-  - grub2
-  - grub2-efi
-  - kernel
-  - lrzsz
-  - lvm2
-  - mtr
-  - ncurses-term
-  - nfs-utils
-  - policycoreutils-python-utils
-  - python
-  - shim
-  - tmux
+  - "{{ 'firewalld' if firewall_backend == 'firewalld' and firewall_enabled | bool else '' }}"
+  - "{{ 'ufw' if firewall_backend == 'ufw' and firewall_enabled | bool else '' }}"
+  - "{{ 'iptables' if firewall_toolkit == 'iptables' else '' }}"
+  - "{{ 'nftables' if firewall_toolkit == 'nftables' else '' }}"
   - "{{ 'cryptsetup' if luks_enabled else '' }}"
   - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+
+bootstrap_opensuse:
+  - vim
+  - "{{ 'openssh' if ssh_enabled | bool else '' }}"
   - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
   - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-  - vim
-  - zram-generator
-  - zstd
-
-bootstrap_rocky:
-  - bind-utils
-  - dbus-daemon
-  - dhcp-client
-  - efibootmgr
-  - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-  - glibc-langpack-de
-  - glibc-langpack-en
-  - grub2
-  - grub2-efi
-  - lrzsz
-  - lvm2
-  - mtr
-  - nc
-  - nfs-utils
-  - nfsv4-client-utils
-  - ppp
-  - shim
-  - telnet
-  - tmux
+  - "{{ 'firewalld' if firewall_backend == 'firewalld' and firewall_enabled | bool else '' }}"
+  - "{{ 'ufw' if firewall_backend == 'ufw' and firewall_enabled | bool else '' }}"
+  - "{{ 'iptables' if firewall_toolkit == 'iptables' else '' }}"
+  - "{{ 'nftables' if firewall_toolkit == 'nftables' else '' }}"
   - "{{ 'cryptsetup' if luks_enabled else '' }}"
   - "{{ 'tpm2-tools' if luks_enabled else '' }}"
+
+bootstrap_void:
+  - vim
+  - "{{ 'openssh' if ssh_enabled | bool else '' }}"
   - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
   - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-  - util-linux-core
-  - vim
-  - wget
-  - zram-generator
-  - zstd
-
-bootstrap_ubuntu:
-  base:
-    - btrfs-progs
-    - cron
-    - gnupg
-    - grub-efi
-    - grub-efi-amd64-signed
-    - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
-    - linux-image-generic
-    - locales
-    - lvm2
-    - xfsprogs
-
-  extra:
-    - apparmor-utils
-    - bash-completion
-    - bat
-    - chrony
-    - curl
-    - dnsutils
-    - duf
-    - entr
-    - eza
-    - fdupes
-    - fio
-    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-    - fish
-    - htop
-    - jq
-    - libpam-pwquality
-    - logrotate
-    - lrzsz
-    - mtr
-    - ncdu
-    - ncurses-term
-    - net-tools
-    - network-manager
-    - "{{ 'openssh-server' if ssh_enabled | bool else '' }}"
-    - python-is-python3
-    - python3
-    - ripgrep
-    - rsync
-    - screen
-    - software-properties-common
-    - sudo
-    - syslog-ng
-    - systemd-zram-generator
-    - tcpd
-    - tldr
-    - tmux
-    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-    - traceroute
-    - util-linux-extra
-    - vim
-    - wget
-    - yq
-    - zoxide
-    - zstd
-
-bootstrap_ubuntu_lts:
-  base:
-    - btrfs-progs
-    - cron
-    - gnupg
-    - grub-efi
-    - grub-efi-amd64-signed
-    - grub2-common
-    - "{{ 'cryptsetup' if luks_enabled else '' }}"
-    - "{{ 'cryptsetup-initramfs' if luks_enabled else '' }}"
-    - linux-image-generic
-    - locales
-    - lvm2
-    - xfsprogs
-
-  extra:
-    - apparmor-utils
-    - bash-completion
-    - bat
-    - chrony
-    - curl
-    - dnsutils
-    - duf
-    - entr
-    - eza
-    - fdupes
-    - fio
-    - "{{ 'firewalld' if firewalld_enabled | bool else '' }}"
-    - fish
-    - htop
-    - jq
-    - libpam-pwquality
-    - logrotate
-    - lrzsz
-    - mtr
-    - ncdu
-    - ncurses-term
-    - net-tools
-    - network-manager
-    - "{{ 'openssh-server' if ssh_enabled | bool else '' }}"
-    - python-is-python3
-    - python3
-    - ripgrep
-    - rsync
-    - screen
-    - software-properties-common
-    - sudo
-    - syslog-ng
-    - systemd-zram-generator
-    - tcpd
-    - tldr
-    - tmux
-    - "{{ 'tpm2-tools' if luks_enabled else '' }}"
-    - "{{ 'qemu-guest-agent' if hypervisor | lower in ['libvirt', 'proxmox'] else '' }}"
-    - "{{ 'open-vm-tools' if hypervisor | lower == 'vmware' else '' }}"
-    - traceroute
-    - util-linux-extra
-    - vim
-    - wget
-    - yq
-    - zoxide
-    - zstd
+  - "{{ 'firewalld' if firewall_backend == 'firewalld' and firewall_enabled | bool else '' }}"
+  - "{{ 'ufw' if firewall_backend == 'ufw' and firewall_enabled | bool else '' }}"
+  - "{{ 'iptables' if firewall_toolkit == 'iptables' else '' }}"
+  - "{{ 'nftables' if firewall_toolkit == 'nftables' else '' }}"
+  - "{{ 'cryptsetup' if luks_enabled else '' }}"
+  - "{{ 'tpm2-tools' if luks_enabled else '' }}"