docs: refresh bootstrap examples and README

fix: encryption, partitioning, cis and virtualization hardening
fix(users): accept plaintext or pre-hashed passwords uniformly
2026-05-30 18:05:14 +02:00 · 2026-05-30 18:05:14 +02:00 · 2026-05-30 18:05:05 +02:00 · 2026-05-30 18:05:05 +02:00 · 2026-05-30 18:05:05 +02:00 · 2026-05-30 18:04:00 +02:00
55 changed files with 1180 additions and 493 deletions
--- a/README.md
+++ b/README.md
@@ -30,16 +30,13 @@ Non-Arch targets require the appropriate package manager available from the ISO
 | `system.os`  | Distribution             | `system.version`                      |
 | ------------ | ------------------------ | ------------------------------------- |
 | `almalinux`  | AlmaLinux                | `8`, `9`, `10`                        |
-| `alpine`     | Alpine Linux             | latest (rolling)                      |
 | `archlinux`  | Arch Linux               | latest (rolling)                      |
 | `debian`     | Debian                   | `10`-`13`, `unstable`                 |
 | `fedora`     | Fedora                   | `38`-`45`                             |
-| `opensuse`   | openSUSE Tumbleweed      | latest (rolling)                      |
 | `rhel`       | Red Hat Enterprise Linux | `8`, `9`, `10`                        |
 | `rocky`      | Rocky Linux              | `8`, `9`, `10`                        |
 | `ubuntu`     | Ubuntu (latest non-LTS)  | optional (e.g. `24.04`)              |
 | `ubuntu-lts` | Ubuntu LTS               | optional (e.g. `24.04`)              |
-| `void`       | Void Linux               | latest (rolling)                      |

 ### Hypervisors

@@ -122,7 +119,7 @@ all:
                  path: /data
                  fstype: xfs
            users:
-              - name: ops
+              ops:
                password: !vault |
                  $ANSIBLE_VAULT...
                keys:
@@ -167,7 +164,7 @@ Top-level variables outside `system`/`hypervisor`/`cis`.
 | `type`       | string     | `virtual`          | `virtual` or `physical`                                |
 | `os`         | string     | --                 | Target distribution (see [table](#distributions))      |
 | `version`    | string     | --                 | Version selector for versioned distros                 |
-| `filesystem` | string     | --                 | `btrfs`, `ext4`, or `xfs`                              |
+| `filesystem` | string     | `ext4`             | `btrfs`, `ext4`, or `xfs`                              |
 | `name`       | string     | inventory hostname | Final hostname                                         |
 | `timezone`   | string     | `Europe/Vienna`    | System timezone (tz database name)                     |
 | `locale`     | string     | `en_US.UTF-8`      | System locale                                          |
@@ -176,11 +173,12 @@ Top-level variables outside `system`/`hypervisor`/`cis`.
 | `cpus`       | int        | `0`                | vCPU count (required for virtual)                      |
 | `memory`     | int        | `0`                | Memory in MiB (required for virtual)                   |
 | `balloon`    | int        | `0`                | Balloon memory in MiB (Proxmox)                        |
-| `path`       | string     | --                 | Hypervisor folder/path                                 |
+| `path`       | string     | --                 | Hypervisor folder/path (falls back to `hypervisor.folder`) |
+| `mirror`     | string     | per-distro default | Override package mirror (Debian/Ubuntu)                |
 | `packages`   | list       | `[]`               | Additional packages installed post-reboot              |
 | `network`    | dict       | see below          | Network configuration                                  |
 | `disks`      | list       | `[]`               | Disk layout (see [Multi-Disk Schema](#46-multi-disk-schema)) |
-| `users`      | list       | `[]`               | User accounts                                          |
+| `users`      | dict       | `{}`               | User accounts (keyed by username)                      |
 | `root`       | dict       | see below          | Root account settings                                  |
 | `luks`       | dict       | see below          | Encryption settings                                    |
 | `features`   | dict       | see below          | Feature toggles                                        |
@@ -228,9 +226,10 @@ Users must be defined in inventory. The dict format enables additive merging acr

 #### `system.root`

-| Key        | Type   | Default | Description   |
-| ---------- | ------ | ------- | ------------- |
-| `password` | string | --      | Root password |
+| Key        | Type   | Default     | Description   |
+| ---------- | ------ | ----------- | ------------- |
+| `password` | string | --          | Root password |
+| `shell`    | string | `/bin/bash` | Login shell   |

 #### `system.luks`

@@ -249,8 +248,6 @@ Users must be defined in inventory. The dict format enables additive merging acr
 | `iter`       | int    | `4000`             | PBKDF iteration time (ms)                  |
 | `bits`       | int    | `512`              | Key size (bits)                            |
 | `pbkdf`      | string | `argon2id`         | PBKDF algorithm                            |
-| `urandom`    | bool   | `true`             | Use urandom during key generation          |
-| `verify`     | bool   | `true`             | Verify passphrase during format            |

 #### `system.luks.tpm2`

@@ -283,9 +280,17 @@ The bootstrap auto-switches to dracut when `method: tpm2` is set. Override via `
 | `banner.sudo`      | bool   | `true`         | Sudo banner                          |
 | `chroot.tool`      | string | `arch-chroot`  | `arch-chroot`, `chroot`, or `systemd-nspawn` |
 | `initramfs.generator` | string | auto-detected | Override initramfs generator (see below) |
+| `rhel_repo.source` | string | `iso`          | RHEL post-install repo source: `iso`, `satellite`, or `none` |
+| `rhel_repo.url`    | string | --             | Satellite/custom repo URL when `source: satellite` |
+| `secure_boot.enabled` | bool | `false`       | Enable Secure Boot (Arch via sbctl, others via shim) |
+| `secure_boot.method`  | string | --           | Arch only: `sbctl` (default) or `uki`              |
 | `desktop.*`        | dict   | see below      | Desktop environment settings (see [4.2.5](#425-systemfeaturesdesktop)) |
+| `firmware.*`       | dict   | see below      | Vendor firmware blobs and CPU microcode (see [4.2.6](#426-systemfeaturesfirmware)) |
+| `gpu.*`            | dict   | see below      | Mesa/Vulkan and per-vendor GPU userspace (see [4.2.7](#427-systemfeaturesgpu)) |
+| `peripherals.*`    | dict   | see below      | Fingerprint readers, webcams, DisplayLink (see [4.2.8](#428-systemfeaturesperipherals)) |
+| `hardware.*`       | dict   | see below      | Hardware-detection profile override (see [4.2.9](#429-systemfeatureshardware)) |

-**Initramfs generator auto-detection:** RedHat → dracut, Arch → mkinitcpio, Debian/Ubuntu → initramfs-tools.
+**Initramfs generator auto-detection:** RedHat -> dracut, Arch -> mkinitcpio, Debian/Ubuntu -> initramfs-tools.
 Override with `dracut`, `mkinitcpio`, or `initramfs-tools`. When LUKS TPM2 auto-unlock is enabled and the
 native generator does not support `tpm2-device`, the generator is automatically upgraded to dracut.
 On distros with older dracut (no `tpm2-tss` module), clevis is used as a fallback for TPM2 binding.
@@ -295,13 +300,98 @@ On distros with older dracut (no `tpm2-tss` module), clevis is used as a fallbac
 | Key               | Type   | Default        | Description                               |
 | ----------------- | ------ | -------------- | ----------------------------------------- |
 | `enabled`         | bool   | `false`        | Install desktop environment               |
-| `environment`     | string | --             | `gnome`, `kde`, `xfce`, `sway`, `hyprland`, `cinnamon`, `mate`, `lxqt`, `budgie` |
-| `display_manager` | string | auto-detected  | Override DM: `gdm`, `sddm`, `lightdm`, `ly`, `greetd` |
+| `environment`     | string | `""`           | `gnome`, `kde`, `sway`, or `hyprland`     |
+| `display_manager` | string | auto-detected  | Override DM: `gdm`, `sddm`, or `greetd`   |
+| `autologin`       | bool \| string | `false` | `false` to disable, or a username from `system.users` to auto-login that user |
+| `session`         | string | auto-from-environment | Session to autologin into; overrides the per-environment default (sddm `.desktop` basename / greetd command) |
+| `groups`          | list   | `[]`           | Opt-in package groups installed on top of the base set (keys of `desktop_package_groups`, e.g. `dev`) |
+
+All desktop environments are Wayland-only. `sway` and `hyprland` are available on Arch only;
+`gnome` and `kde` are available on all three families.

 When `enabled: true`, the bootstrap installs the desktop environment packages, enables the display manager
 and bluetooth services, and sets the systemd default target to `graphical.target`.

-Display manager auto-detection: gnome→gdm, kde→sddm, xfce→lightdm, sway→greetd, hyprland→ly.
+Display manager auto-detection: gnome to gdm, kde to sddm, sway to greetd, hyprland to greetd.
+
+When `autologin` names a user, the matching display manager is configured to log that user in without a
+password prompt. `session` is resolved automatically per environment when left empty (gdm picks its default,
+sddm uses `plasma.desktop` for kde, greetd runs the compositor command for sway/hyprland), so it only needs
+setting to override that choice.
+
+#### 4.2.6 `system.features.firmware`
+
+| Key         | Type            | Default | Description                                                       |
+| ----------- | --------------- | ------- | ----------------------------------------------------------------- |
+| `enabled`   | bool \| `auto`  | `auto`  | Install vendor firmware blobs. `auto` = on for `physical`, off for `virtual` |
+| `microcode` | bool \| `auto`  | `auto`  | Install CPU microcode. `auto` follows `firmware.enabled`          |
+
+Defaults are designed so a baremetal install picks up firmware automatically with no inventory entry needed,
+while VMs skip it (the hypervisor handles those). The environment role detects CPU/GPU/wireless vendors from
+the live host (via `lscpu` and `lspci`) and the bootstrap role installs only the matching firmware packages.
+On Arch, this uses the vendor splits (`linux-firmware-amdgpu`, `linux-firmware-realtek`, etc.) so the install
+stays minimal. On Debian, it uses the equivalent `firmware-*` packages. Distros without firmware splits fall
+back to a single meta package.
+
+#### 4.2.7 `system.features.gpu`
+
+| Key             | Type   | Default | Description                                          |
+| --------------- | ------ | ------- | ---------------------------------------------------- |
+| `enabled`       | bool   | `false` | Install Mesa, Vulkan, and per-GPU userspace          |
+| `nvidia_driver` | string | `auto`  | One of `auto`, `open`, `proprietary`, `nouveau`      |
+
+Pair with `desktop.enabled: true` for a working desktop. The package set is determined by the same hardware
+profile as `firmware`. The `nvidia_driver: auto` default picks **`open`** (`nvidia-open` kernel modules) for
+Turing or newer GPUs, falls back to **`proprietary`** for older cards on distros that ship the proprietary
+driver, and falls back to **`nouveau`** elsewhere. Force a specific flavor by setting the value explicitly.
+
+Proprietary and open Nvidia drivers on Fedora require RPMFusion non-free, which the bootstrap enables
+automatically when needed. Debian uses `nvidia-driver` from the `non-free` component (already enabled in the
+managed `sources.list`). Ubuntu uses `restricted`. Arch ships both `nvidia-open-dkms` and `nvidia-dkms` in
+the `extra` repository - no third-party setup required.
+
+#### 4.2.8 `system.features.peripherals`
+
+| Key           | Type            | Default | Description                                                |
+| ------------- | --------------- | ------- | ---------------------------------------------------------- |
+| `enabled`     | bool \| `auto`  | `auto`  | Master switch. `auto` follows `desktop.enabled`            |
+| `fingerprint` | bool \| `auto`  | `auto`  | `fprintd`/`libfprint`. `auto` = install when reader detected |
+| `webcam`      | bool \| `auto`  | `auto`  | `v4l-utils` and userspace tooling. `auto` follows `enabled` |
+| `displaylink` | bool            | `false` | DisplayLink dock support (explicit opt-in; see notes)      |
+
+Fingerprint detection scans `lsusb` for known reader vendor IDs (Synaptics, Validity, Goodix, Elan, Egis,
+Broadcom, AuthenTec, Upek, Futronic). When `fingerprint: auto` and a reader is present, `fprintd` and the
+PAM helper are installed. PAM enrollment must be done post-install (`fprintd-enroll`).
+
+DisplayLink ships proprietary userspace that distros do not package consistently. The bootstrap installs the
+in-tree `evdi-dkms` kernel module on Debian/Ubuntu and the `evdi` module on Fedora, but the userspace blob
+must still be installed manually from DisplayLink's site after first boot. Arch users typically use AUR
+(`displaylink`); this is not wired into the bootstrap.
+
+#### 4.2.9 `system.features.hardware`
+
+| Key       | Type | Default | Description                                                          |
+| --------- | ---- | ------- | -------------------------------------------------------------------- |
+| `profile` | dict | `{}`    | Hardware-detection override; empty means autodetect from live host   |
+
+When empty, hardware is detected at the start of the bootstrap. When set, detection is skipped and the
+supplied profile drives package selection - this is the **golden-image** flow: bake an image with a fixed
+profile, snapshot it, and reuse the same profile on every deploy of that hardware class.
+
+Profile shape:
+
+```yaml
+system:
+  features:
+    hardware:
+      profile:
+        cpu: intel                    # intel | amd
+        gpus: [intel, nvidia]         # any of: intel, amd, nvidia
+        nvidia_supports_open: true    # set false to force proprietary/nouveau
+        wireless: [intel]             # any of: intel, amd, atheros, broadcom,
+                                      # mediatek, marvell, realtek, qcom, cirrus
+        fingerprint: false            # set true to force fprintd install
+```

 ### 4.3 `hypervisor` Dictionary

@@ -315,7 +405,7 @@ Display manager auto-detection: gnome→gdm, kde→sddm, xfce→lightdm, sway→
 | `storage`    | string | --      | Storage identifier (Proxmox/VMware)                  |
 | `datacenter` | string | --      | VMware datacenter                                    |
 | `cluster`    | string | --      | VMware cluster                                       |
-| `certs`      | bool   | `true`  | TLS certificate validation (VMware)                  |
+| `certs`      | bool   | `false` | TLS certificate validation (VMware)                  |
 | `ssh`        | bool   | `false` | Enable SSH on guest and switch connection (VMware)   |

 ### 4.4 `cis` Dictionary
@@ -379,7 +469,7 @@ When `hypervisor.type: vmware` uses the `vmware_tools` connection:
 | ------------- | ------ | ------------------------------------------------------ |
 | `size`        | number | Disk size in GB (required for virtual)                 |
 | `device`      | string | Block device path (required for physical data disks)   |
-| `partition`   | string | Partition device path (required for physical data disks) |
+| `partition`   | string | Derived from `device` during normalization (not user input) |
 | `mount.path`  | string | Mount point (additional disks only)                    |
 | `mount.fstype`| string | `btrfs`, `ext4`, or `xfs`                              |
 | `mount.label` | string | Filesystem label                                       |
@@ -427,9 +517,9 @@ Roles execute in this order:
 1. **global_defaults** -- normalize inputs, validate, set OS flags
 2. **system_check** -- detect installer environment, verify live/non-prod target
 3. **virtualization** -- create VM (if virtual), attach disks, cloud-init
-4. **environment** -- prepare installer: mount ISO, configure repos, setup pacman
+4. **environment** -- prepare installer: mount ISO, configure repos, setup pacman, detect hardware
 5. **partitioning** -- create partitions, LVM, LUKS, mount filesystems
-6. **bootstrap** -- install base system and packages (OS-specific)
+6. **bootstrap** -- install base system, packages, and vendor-matched hardware bits
 7. **configuration** -- users, fstab, locales, bootloader, encryption enrollment, networking
 8. **cis** -- CIS hardening (when `system.features.cis.enabled: true`)
 9. **cleanup** -- unmount, shutdown installer, remove media, verify boot
--- a/inventory_baremetal_example.yml
+++ b/inventory_baremetal_example.yml
@@ -9,8 +9,11 @@ all:
    baremetal01.example.com:
      ansible_host: 10.0.0.162
      ansible_user: root
-      ansible_password: "1234"
-      ansible_become_password: "1234"
+      ansible_password: "CHANGE_ME"
+      ansible_become_password: "CHANGE_ME"
+      # Required for physical installs: confirms the operator accepts that
+      # install_drive will be wiped. system_check refuses to run without it.
+      physical_install_confirmed: true
      system:
        type: "physical"
        os: "archlinux"
@@ -18,3 +21,10 @@ all:
        disks:
          - device: "/dev/sda"
            size: 120
+        users:
+          admin:
+            password: "CHANGE_ME"
+            keys:
+              - "ssh-ed25519 AAAA..."
+        root:
+          password: "CHANGE_ME"
--- a/inventory_example.yml
+++ b/inventory_example.yml
@@ -43,7 +43,7 @@ all:
                  label: DATA
                  opts: defaults
            users:
-              - name: "ops"
+              ops:
                password: "CHANGE_ME"
                keys:
                  - "ssh-ed25519 AAAA..."
@@ -100,7 +100,7 @@ all:
                  path: /srv/data
                  fstype: ext4
            users:
-              - name: "dbadmin"
+              dbadmin:
                password: "CHANGE_ME"
                keys:
                  - "ssh-ed25519 AAAA..."
--- a/inventory_libvirt_example.yml
+++ b/inventory_libvirt_example.yml
@@ -6,7 +6,6 @@ all:
      url: "localhost"
      username: ""
      password: ""
-      host: ""
      storage: "default"
    boot_iso: "/var/lib/libvirt/images/archlinux-x86_64.iso"
  children:
@@ -40,7 +39,7 @@ all:
                  path: /var/www
                  fstype: xfs
            users:
-              - name: "web"
+              web:
                password: "CHANGE_ME"
                keys:
                  - "ssh-ed25519 AAAA..."
@@ -82,7 +81,7 @@ all:
                  path: /data
                  fstype: ext4
            users:
-              - name: "db"
+              db:
                password: "CHANGE_ME"
                keys:
                  - "ssh-ed25519 AAAA..."
@@ -123,7 +122,7 @@ all:
                  path: /data
                  fstype: btrfs
            users:
-              - name: "compute"
+              compute:
                password: "CHANGE_ME"
                keys:
                  - "ssh-ed25519 AAAA..."
--- a/main.yml
+++ b/main.yml
@@ -1,14 +1,14 @@
 ---
-# Bootstrap pipeline — role execution order:
-#   1. global_defaults  — normalize + validate system/hypervisor/disk input
-#   2. system_check     — pre-flight hardware/environment safety checks
-#   3. virtualization   — create VM on hypervisor (libvirt/proxmox/vmware/xen)
-#   4. environment      — detect live ISO, configure installer network, install tools
-#   5. partitioning     — partition disk, create FS, LUKS, LVM, mount everything
-#   6. bootstrap        — debootstrap/pacstrap/dnf install the target OS into /mnt
-#   7. configuration    — users, network, encryption, fstab, bootloader, services
-#   8. cis              — CIS hardening (optional, per system.features.cis.enabled)
-#   9. cleanup          — unmount, remove cloud-init artifacts, reboot/shutdown
+# Bootstrap pipeline - role execution order:
+#   1. global_defaults  - normalize + validate system/hypervisor/disk input
+#   2. system_check     - pre-flight hardware/environment safety checks
+#   3. virtualization   - create VM on hypervisor (libvirt/proxmox/vmware/xen)
+#   4. environment      - detect live ISO, configure installer network, install tools, detect hardware
+#   5. partitioning     - partition disk, create FS, LUKS, LVM, mount everything
+#   6. bootstrap        - debootstrap/pacstrap/dnf install the target OS into /mnt
+#   7. configuration    - users, network, encryption, fstab, bootloader, services
+#   8. cis              - CIS hardening (optional, per system.features.cis.enabled)
+#   9. cleanup          - unmount, remove cloud-init artifacts, reboot/shutdown
 - name: Create and configure VMs
  hosts: "{{ bootstrap_target | default('all') }}"
  strategy: free # noqa: run-once[play]
--- a/roles/bootstrap/defaults/main.yml
+++ b/roles/bootstrap/defaults/main.yml
@@ -1,15 +1,12 @@
 ---
-# OS → task file mapping for bootstrap dispatch.
+# OS -> task file mapping for bootstrap dispatch.
 # Each key matches a supported `os` value; value is the task file to include.
 bootstrap_os_task_map:
  almalinux: _dnf_family.yml
-  alpine: alpine.yml
  archlinux: archlinux.yml
  debian: debian.yml
  fedora: _dnf_family.yml
-  opensuse: opensuse.yml
  rocky: _dnf_family.yml
  rhel: rhel.yml
  ubuntu: ubuntu.yml
  ubuntu-lts: ubuntu.yml
-  void: void.yml
--- a/roles/bootstrap/tasks/_desktop.yml
+++ b/roles/bootstrap/tasks/_desktop.yml
@@ -8,14 +8,37 @@
    _de: "{{ system_cfg.features.desktop.environment }}"
    _family_pkgs: "{{ bootstrap_desktop_packages[os_family] | default({}) }}"
    _de_config: "{{ _family_pkgs[_de] | default({}) }}"
+    _base: "{{ bootstrap_desktop_base_packages[os_family] | default([]) }}"
+    _requested_groups: "{{ system_cfg.features.desktop.groups | default([]) }}"
+    _group_pkgs: >-
+      {{
+        _requested_groups
+        | select('in', desktop_package_groups)
+        | map('extract', desktop_package_groups)
+        | map(attribute=os_family, default=[])
+        | list
+        | sum(start=[])
+      }}
  ansible.builtin.set_fact:
-    _desktop_groups: "{{ _de_config.groups | default([]) }}"
-    _desktop_packages: "{{ _de_config.packages | default([]) }}"
+    # GNOME ships under different dnf environment groups: Fedora uses
+    # workstation-product-environment, enterprise RHEL/Rocky/Alma use
+    # graphical-server-environment ("Server with GUI").
+    _desktop_groups: >-
+      {{ ['graphical-server-environment']
+         if (_de == 'gnome' and os_family == 'RedHat' and os != 'fedora')
+         else (_de_config.groups | default([])) }}
+    _desktop_packages: >-
+      {{
+        ((_de_config.packages | default([])) + _base + _group_pkgs)
+        | reject('equalto', '')
+        | unique
+        | list
+      }}

 - name: Validate desktop environment is supported
  ansible.builtin.assert:
    that:
-      - (_desktop_groups | length > 0) or (_desktop_packages | length > 0)
+      - system_cfg.features.desktop.environment in (bootstrap_desktop_packages[os_family] | default({}))
    fail_msg: >-
      Desktop environment '{{ system_cfg.features.desktop.environment }}'
      is not defined for os_family '{{ os_family }}'.
@@ -25,7 +48,7 @@
 - name: Install desktop package groups
  when: _desktop_groups | length > 0
  ansible.builtin.command: >-
-    {{ chroot_command }} dnf --releasever={{ os_version }}
+    {{ chroot_command }} dnf --releasever={{ os_version_major }}
    --setopt=install_weak_deps=False group install -y {{ _desktop_groups | join(' ') }}
  register: _desktop_group_result
  changed_when: _desktop_group_result.rc == 0
@@ -35,14 +58,12 @@
  vars:
    _install_commands:
      RedHat: >-
-        {{ chroot_command }} dnf --releasever={{ os_version }}
+        {{ chroot_command }} dnf --releasever={{ os_version_major }}
        --setopt=install_weak_deps=False install -y {{ _desktop_packages | join(' ') }}
      Debian: >-
-        {{ chroot_command }} apt install -y {{ _desktop_packages | join(' ') }}
+        {{ chroot_command }} apt install -y --install-recommends {{ _desktop_packages | join(' ') }}
      Archlinux: >-
        pacstrap /mnt {{ _desktop_packages | join(' ') }}
-      Suse: >-
-        {{ chroot_command }} zypper install -y {{ _desktop_packages | join(' ') }}
  ansible.builtin.command: "{{ _install_commands[os_family] }}"
  register: _desktop_pkg_result
  changed_when: _desktop_pkg_result.rc == 0
--- a/roles/bootstrap/tasks/_dnf_family.yml
+++ b/roles/bootstrap/tasks/_dnf_family.yml
@@ -13,7 +13,7 @@
  block:
    - name: "Install base system for {{ os | capitalize }}"
      ansible.builtin.command: >-
-        dnf --releasever={{ os_version }} --best {{ _dnf_repos }}
+        dnf --releasever={{ os_version_major }} --best {{ _dnf_repos }}
        --installroot=/mnt --setopt=install_weak_deps=False
        groupinstall -y {{ _dnf_groups }}
      register: bootstrap_dnf_base_result
@@ -31,7 +31,7 @@

    - name: Install extra packages
      ansible.builtin.command: >-
-        {{ chroot_command }} dnf --releasever={{ os_version }} --setopt=install_weak_deps=False
+        {{ chroot_command }} dnf --releasever={{ os_version_major }} --setopt=install_weak_deps=False
        install -y {{ _dnf_extra }}
      register: bootstrap_dnf_extra_result
      changed_when: bootstrap_dnf_extra_result.rc == 0
--- a/roles/bootstrap/tasks/_hardware.yml
+++ b/roles/bootstrap/tasks/_hardware.yml
@@ -0,0 +1,181 @@
+---
+# Installs vendor-matched microcode/firmware/GPU/peripheral packages into /mnt
+# based on hardware_profile_active set by environment/_detect_hardware.yml.
+- name: Load hardware package definitions
+  ansible.builtin.include_vars:
+    file: hardware.yml
+
+- name: Validate hardware support for current os_family
+  ansible.builtin.assert:
+    that:
+      - os_family in bootstrap_hardware_packages
+      - hardware_profile_active is defined
+    fail_msg: >-
+      Hardware feature requested but no package map for os_family
+      '{{ os_family }}'. Extend roles/bootstrap/vars/hardware.yml.
+    quiet: true
+
+# nvidia_driver: auto -> open (Turing+) -> proprietary (older, if family ships it)
+#                -> nouveau (fallback). Explicit value falls back to nouveau when
+#                the family lacks packages for it.
+- name: Resolve Nvidia driver flavor
+  vars:
+    _family: "{{ bootstrap_hardware_packages[os_family] }}"
+    _user_driver: "{{ system_cfg.features.gpu.nvidia_driver | default('auto') }}"
+    _has_nvidia: "{{ 'nvidia' in (hardware_profile_active.gpus | default([])) }}"
+    _supports_open: "{{ hardware_profile_active.nvidia_supports_open | default(true) | bool }}"
+    _open_pkgs: "{{ _family.gpu_nvidia.open | default([]) }}"
+    _prop_pkgs: "{{ _family.gpu_nvidia.proprietary | default([]) }}"
+    _auto_choice: >-
+      {{
+        ('open' if _supports_open and _open_pkgs | length > 0
+         else ('proprietary' if _prop_pkgs | length > 0
+               else 'nouveau'))
+      }}
+    _user_choice: >-
+      {{
+        _auto_choice if _user_driver == 'auto'
+        else (_user_driver
+              if (_family.gpu_nvidia[_user_driver] | default([]) | length > 0)
+              else 'nouveau')
+      }}
+  ansible.builtin.set_fact:
+    _nvidia_driver_resolved: "{{ _user_choice if _has_nvidia else 'nouveau' }}"
+
+# Fedora's akmod-nvidia* packages live in RPMFusion non-free, which is not
+# enabled out of the box; install the release RPM before the package step.
+- name: Enable RPMFusion non-free for Fedora Nvidia install
+  when:
+    - os_family == 'RedHat'
+    - os == 'fedora'
+    - system_cfg.features.gpu.enabled | bool
+    - _nvidia_driver_resolved in ['open', 'proprietary']
+  ansible.builtin.command: >-
+    {{ chroot_command }} dnf install -y
+    https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-{{ os_version_major }}.noarch.rpm
+    https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-{{ os_version_major }}.noarch.rpm
+  register: _rpmfusion_result
+  changed_when: _rpmfusion_result.rc == 0
+
+- name: Resolve hardware package set
+  vars:
+    _family: "{{ bootstrap_hardware_packages[os_family] }}"
+    _cpu: "{{ hardware_profile_active.cpu | default('') | string }}"
+    _gpus: "{{ hardware_profile_active.gpus | default([]) | list }}"
+    _wifi: "{{ hardware_profile_active.wireless | default([]) | list }}"
+    _fp_detected: "{{ hardware_profile_active.fingerprint | default(false) | bool }}"
+    _firmware_on: "{{ system_cfg.features.firmware.enabled | bool }}"
+    _microcode_on: "{{ _firmware_on and (system_cfg.features.firmware.microcode | bool) }}"
+    _gpu_on: "{{ system_cfg.features.gpu.enabled | bool }}"
+    _peripherals_on: "{{ system_cfg.features.peripherals.enabled | bool }}"
+    _webcam_pref: "{{ system_cfg.features.peripherals.webcam | default('auto') }}"
+    _fp_pref: "{{ system_cfg.features.peripherals.fingerprint | default('auto') }}"
+    _dl_on: "{{ system_cfg.features.peripherals.displaylink | bool }}"
+    _webcam_on: >-
+      {{
+        _peripherals_on
+        and (_webcam_pref == 'true' or (_webcam_pref == 'auto' and _peripherals_on))
+      }}
+    _fp_on: >-
+      {{
+        _peripherals_on
+        and (_fp_pref == 'true' or (_fp_pref == 'auto' and _fp_detected))
+      }}
+    # Union of GPU/wireless/CPU vendors; CPU vendor is included so Intel-CPU
+    # systems pull i915/iwlwifi firmware via the same vendor split.
+    _cpu_vendor_list: "{{ ([_cpu] if (_cpu | length > 0) else []) | list }}"
+    _firmware_vendors: >-
+      {{
+        (_firmware_on | ternary(
+          (_gpus + _wifi + _cpu_vendor_list)
+          | reject('equalto', '') | unique | list,
+          []
+        ))
+      }}
+    _microcode_pkgs: >-
+      {{
+        ((_microcode_on and _cpu | length > 0) | ternary(
+          _family.cpu_microcode[_cpu] | default([]),
+          []
+        )) | list
+      }}
+    _firmware_pkgs: >-
+      {{
+        (_firmware_on | ternary(
+          (_family.firmware_base | default([]) | list)
+          + (_firmware_vendors
+             | map('extract', _family.firmware | default({}))
+             | select('truthy')
+             | list
+             | sum(start=[])),
+          []
+        )) | list
+      }}
+    _gpu_base_pkgs: "{{ (_gpu_on | ternary(_family.gpu_base | default([]), [])) | list }}"
+    _gpu_vendor_pkgs: >-
+      {{
+        (_gpu_on | ternary(
+          (_gpus | reject('equalto', 'nvidia') | list)
+          | map('extract', _family.gpu | default({}))
+          | select('truthy')
+          | list
+          | sum(start=[]),
+          []
+        )) | list
+      }}
+    _gpu_nvidia_pkgs: >-
+      {{
+        ((_gpu_on and ('nvidia' in _gpus)) | ternary(
+          _family.gpu_nvidia[_nvidia_driver_resolved] | default([]),
+          []
+        )) | list
+      }}
+    _peripherals_base_pkgs: >-
+      {{
+        (_webcam_on | ternary(_family.peripherals_base | default([]), [])) | list
+      }}
+    _peripherals_fingerprint_pkgs: >-
+      {{
+        (_fp_on | ternary(_family.peripherals_fingerprint | default([]), [])) | list
+      }}
+    _peripherals_displaylink_pkgs: >-
+      {{
+        (_dl_on | ternary(_family.peripherals_displaylink | default([]), [])) | list
+      }}
+  ansible.builtin.set_fact:
+    _hardware_packages: >-
+      {{
+        (_microcode_pkgs + _firmware_pkgs
+         + _gpu_base_pkgs + _gpu_vendor_pkgs + _gpu_nvidia_pkgs
+         + _peripherals_base_pkgs + _peripherals_fingerprint_pkgs
+         + _peripherals_displaylink_pkgs)
+        | reject('equalto', '')
+        | unique
+        | list
+      }}
+
+- name: Report hardware package selection
+  ansible.builtin.debug:
+    msg: >-
+      Hardware install ({{ os_family }}):
+      cpu={{ hardware_profile_active.cpu | default('-') }},
+      gpus={{ hardware_profile_active.gpus | default([]) | join(',') | default('-', true) }},
+      nvidia_driver={{ _nvidia_driver_resolved }},
+      wireless={{ hardware_profile_active.wireless | default([]) | join(',') | default('-', true) }},
+      fingerprint={{ hardware_profile_active.fingerprint | default(false) }}
+      -> {{ _hardware_packages | length }} package(s)
+
+- name: Install hardware packages
+  when: _hardware_packages | length > 0
+  vars:
+    _install_commands:
+      RedHat: >-
+        {{ chroot_command }} dnf --releasever={{ os_version_major }}
+        --setopt=install_weak_deps=False install -y {{ _hardware_packages | join(' ') }}
+      Debian: >-
+        {{ chroot_command }} apt install -y {{ _hardware_packages | join(' ') }}
+      Archlinux: >-
+        pacstrap /mnt {{ _hardware_packages | join(' ') }}
+  ansible.builtin.command: "{{ _install_commands[os_family] }}"
+  register: _hardware_install_result
+  changed_when: _hardware_install_result.rc == 0
--- a/roles/bootstrap/tasks/alpine.yml
+++ b/roles/bootstrap/tasks/alpine.yml
@@ -1,30 +0,0 @@
---
- name: Bootstrap Alpine Linux
-  vars:
-    _config: "{{ lookup('vars', bootstrap_var_key) }}"
-    _base_packages: "{{ _config.base | join(' ') }}"
-    _extra_packages: >-
-      {{
-        ((_config.extra | default([])) + (_config.conditional | default([])))
-        | reject('equalto', '')
-        | join(' ')
-      }}
-  block:
-    - name: Install Alpine Linux base
-      ansible.builtin.command: >
-        apk --root /mnt --no-cache add {{ _base_packages }}
-      register: bootstrap_alpine_bootstrap_result
-      changed_when: bootstrap_alpine_bootstrap_result.rc == 0
-
-    - name: Install extra packages
-      when: _extra_packages | trim | length > 0
-      ansible.builtin.command: >
-        apk --root /mnt add {{ _extra_packages }}
-      register: bootstrap_alpine_extra_result
-      changed_when: bootstrap_alpine_extra_result.rc == 0
-
-    - name: Install bootloader
-      ansible.builtin.command: >
-        apk --root /mnt add grub grub-efi efibootmgr
-      register: bootstrap_alpine_bootloader_result
-      changed_when: bootstrap_alpine_bootloader_result.rc == 0
--- a/roles/bootstrap/tasks/debian.yml
+++ b/roles/bootstrap/tasks/debian.yml
@@ -66,7 +66,10 @@
      register: bootstrap_debian_extra_result
      changed_when: bootstrap_debian_extra_result.rc == 0

+    # Printing (libcups2) and mDNS (libavahi*) are needed by a desktop session,
+    # so keep them when a desktop is requested.
    - name: Remove unnecessary packages
+      when: not (system_cfg.features.desktop.enabled | bool)
      ansible.builtin.command: "{{ chroot_command }} apt remove -y libcups2 libavahi-common3 libavahi-common-data"
      register: bootstrap_debian_remove_result
      changed_when: bootstrap_debian_remove_result.rc == 0
--- a/roles/bootstrap/tasks/main.yml
+++ b/roles/bootstrap/tasks/main.yml
@@ -34,6 +34,13 @@
    bootstrap_var_key: "{{ 'bootstrap_' + (os | replace('-lts', '') | replace('-', '_')) }}"
  ansible.builtin.include_tasks: "{{ bootstrap_os_task_map[os] }}"

+- name: Install hardware-matched firmware/microcode/GPU/peripheral packages
+  when: >-
+    (system_cfg.features.firmware.enabled | bool)
+    or (system_cfg.features.gpu.enabled | bool)
+    or (system_cfg.features.peripherals.enabled | bool)
+  ansible.builtin.include_tasks: _hardware.yml
+
 - name: Install desktop environment packages
  when: system_cfg.features.desktop.enabled | bool
  ansible.builtin.include_tasks: _desktop.yml
--- a/roles/bootstrap/tasks/opensuse.yml
+++ b/roles/bootstrap/tasks/opensuse.yml
@@ -1,30 +0,0 @@
---
- name: Bootstrap openSUSE
-  vars:
-    _config: "{{ lookup('vars', bootstrap_var_key) }}"
-    _base_patterns: "{{ _config.base | join(' ') }}"
-    _extra_packages: >-
-      {{
-        ((_config.extra | default([])) + (_config.conditional | default([])))
-        | reject('equalto', '')
-        | join(' ')
-      }}
-  block:
-    - name: Install openSUSE base patterns
-      ansible.builtin.command: >
-        zypper --root /mnt --non-interactive install -t pattern {{ _base_patterns }}
-      register: bootstrap_opensuse_base_result
-      changed_when: bootstrap_opensuse_base_result.rc == 0
-
-    - name: Install extra packages
-      when: _extra_packages | trim | length > 0
-      ansible.builtin.command: >
-        zypper --root /mnt --non-interactive install {{ _extra_packages }}
-      register: bootstrap_opensuse_extra_result
-      changed_when: bootstrap_opensuse_extra_result.rc == 0
-
-    - name: Install bootloader
-      ansible.builtin.command: >
-        zypper --root /mnt --non-interactive install grub2 grub2-efi efibootmgr
-      register: bootstrap_opensuse_bootloader_result
-      changed_when: bootstrap_opensuse_bootloader_result.rc == 0
--- a/roles/bootstrap/tasks/void.yml
+++ b/roles/bootstrap/tasks/void.yml
@@ -1,30 +0,0 @@
---
- name: Bootstrap Void Linux
-  vars:
-    _config: "{{ lookup('vars', bootstrap_var_key) }}"
-    _base_packages: "{{ _config.base | join(' ') }}"
-    _extra_packages: >-
-      {{
-        ((_config.extra | default([])) + (_config.conditional | default([])))
-        | reject('equalto', '')
-        | join(' ')
-      }}
-  block:
-    - name: Install Void Linux base
-      ansible.builtin.command: >
-        xbps-install -Sy -r /mnt -R https://repo-default.voidlinux.org/current {{ _base_packages }}
-      register: bootstrap_void_base_result
-      changed_when: bootstrap_void_base_result.rc == 0
-
-    - name: Install extra packages
-      when: _extra_packages | trim | length > 0
-      ansible.builtin.command: >
-        xbps-install -Su -r /mnt {{ _extra_packages }}
-      register: bootstrap_void_extra_result
-      changed_when: bootstrap_void_extra_result.rc == 0
-
-    - name: Install bootloader
-      ansible.builtin.command: >
-        xbps-install -Sy -r /mnt grub-x86_64-efi efibootmgr
-      register: bootstrap_void_bootloader_result
-      changed_when: bootstrap_void_bootloader_result.rc == 0
--- a/roles/bootstrap/vars/desktop.yml
+++ b/roles/bootstrap/vars/desktop.yml
@@ -1,7 +1,10 @@
 ---
 # Per-family desktop environment package definitions.
-# Keyed by os_family -> environment -> groups (dnf groupinstall) / packages.
-# Kept intentionally minimal: base DE + essential tools, no full suites.
+# Keyed by os_family -> environment -> groups (dnf group install) / packages.
+# Wayland only: gnome, kde, sway, hyprland. No X11/xorg-server, no X11-only DEs.
+# DE sets carry the session bits + the DE-specific xdg portal backend; the
+# shared base below (fonts/audio/portal core/power/viewer apps) is layered on
+# top for every DE via bootstrap_desktop_base_packages.
 bootstrap_desktop_packages:
  RedHat:
    gnome:
@@ -24,13 +27,6 @@ bootstrap_desktop_packages:
        - xdg-user-dirs
        - xdg-desktop-portal-kde
        - bluez
-        - pipewire
-        - wireplumber
-    xfce:
-      groups:
-        - xfce-desktop-environment
-      packages:
-        - lightdm
  Debian:
    gnome:
      groups: []
@@ -53,15 +49,6 @@ bootstrap_desktop_packages:
        - xdg-user-dirs
        - xdg-desktop-portal-kde
        - bluez
-        - pipewire
-        - wireplumber
-    xfce:
-      groups: []
-      packages:
-        - xfce4
-        - xfce4-goodies
-        - lightdm
-        - xdg-user-dirs
  Archlinux:
    gnome:
      groups: []
@@ -84,15 +71,6 @@ bootstrap_desktop_packages:
        - xdg-user-dirs
        - xdg-desktop-portal-kde
        - bluez
-        - pipewire
-        - wireplumber
-    xfce:
-      groups: []
-      packages:
-        - xfce4
-        - xfce4-goodies
-        - lightdm
-        - xdg-user-dirs
    sway:
      groups: []
      packages:
@@ -100,12 +78,13 @@ bootstrap_desktop_packages:
        - waybar
        - foot
        - wofi
+        - nautilus
        - greetd
+        - greetd-tuigreet
        - xdg-user-dirs
        - xdg-desktop-portal-wlr
+        - polkit-gnome
        - bluez
-        - pipewire
-        - wireplumber
    hyprland:
      groups: []
      packages:
@@ -113,37 +92,80 @@ bootstrap_desktop_packages:
        - kitty
        - wofi
        - waybar
-        - ly
+        - nautilus
+        - greetd
+        - greetd-tuigreet
        - xdg-user-dirs
        - xdg-desktop-portal-hyprland
        - polkit-kde-agent
        - qt5-wayland
        - qt6-wayland
        - bluez
-        - pipewire
-        - wireplumber
-  Suse:
-    gnome:
-      groups: []
-      packages:
-        - patterns-gnome-gnome_basic
-        - gdm
-        - xdg-user-dirs
-    kde:
-      groups: []
-      packages:
-        - patterns-kde-kde_plasma
-        - sddm
-        - xdg-user-dirs

-# Display manager auto-detection from desktop environment.
-bootstrap_desktop_dm_map:
-  gnome: gdm
-  kde: sddm
-  xfce: lightdm
-  sway: greetd
-  hyprland: ly@tty2
-  cinnamon: lightdm
-  mate: lightdm
-  lxqt: sddm
-  budgie: gdm
+# Shared desktop base, installed for EVERY DE whenever desktop.enabled.
+# Fonts (noto + emoji + one nerd font), audio stack (pipewire + wireplumber +
+# pipewire-pulse), xdg portal core, power-profiles-daemon, and viewer-only base
+# apps (browser, PDF/image/video viewers). DE metas (gnome/plasma) bundle their
+# own file manager + settings, so no file manager is added here - the wlroots
+# DE sets above carry their own (nautilus).
+bootstrap_desktop_base_packages:
+  RedHat:
+    - google-noto-sans-fonts
+    - google-noto-emoji-fonts
+    - fira-code-fonts
+    - pipewire
+    - wireplumber
+    - pipewire-pulseaudio
+    - xdg-desktop-portal
+    - power-profiles-daemon
+    - firefox
+    - evince
+    - eog
+    - mpv
+  Debian:
+    - fonts-noto
+    - fonts-noto-color-emoji
+    - fonts-firacode
+    - pipewire
+    - wireplumber
+    - pipewire-pulse
+    - xdg-desktop-portal
+    - power-profiles-daemon
+    - firefox-esr
+    - evince
+    - eog
+    - mpv
+  Archlinux:
+    - noto-fonts
+    - noto-fonts-emoji
+    - ttf-nerd-fonts-symbols
+    - pipewire
+    - wireplumber
+    - pipewire-pulse
+    - xdg-desktop-portal
+    - power-profiles-daemon
+    - firefox
+    - evince
+    - loupe
+    - mpv
+
+# Opt-in package groups, selected per host via features.desktop.groups (a list
+# of group names). _desktop.yml installs the union of the requested groups'
+# packages. Empty selection by default.
+desktop_package_groups:
+  dev:
+    RedHat:
+      - git
+      - "@development-tools"
+      - neovim
+      - python3-pip
+    Debian:
+      - git
+      - build-essential
+      - neovim
+      - python3-pip
+    Archlinux:
+      - git
+      - base-devel
+      - neovim
+      - python-pip
--- a/roles/bootstrap/vars/hardware.yml
+++ b/roles/bootstrap/vars/hardware.yml
@@ -0,0 +1,108 @@
+---
+# Hardware-aware package definitions keyed by os_family. Schema:
+#   cpu_microcode[intel|amd]       CPU vendor microcode
+#   firmware_base                  unconditional firmware packages
+#   firmware[<vendor>]             vendor-split firmware (intel|amd|nvidia|
+#                                  atheros|broadcom|mediatek|marvell|realtek|
+#                                  qcom|cirrus|other)
+#   gpu_base                       mesa + vulkan loader
+#   gpu[intel|amd]                 per-GPU userspace
+#   gpu_nvidia[open|proprietary|nouveau]   nvidia driver flavor
+#   peripherals_base               webcam/scanner stack
+#   peripherals_fingerprint        fprintd + libfprint
+#   peripherals_displaylink        evdi kernel module + DisplayLink helpers
+# Only packages matching detected hardware are installed; families without
+# vendor splits collapse to a single firmware meta package.
+bootstrap_hardware_packages:
+  Archlinux:
+    cpu_microcode:
+      intel: [intel-ucode]
+      amd: [amd-ucode]
+    firmware_base: []
+    firmware:
+      intel: [linux-firmware-other]      # iwlwifi + i915 firmware live here
+      amd: [linux-firmware-amdgpu]
+      nvidia: [linux-firmware-nvidia]
+      atheros: [linux-firmware-atheros]
+      broadcom: [linux-firmware-broadcom]
+      mediatek: [linux-firmware-mediatek]
+      marvell: [linux-firmware-marvell]
+      realtek: [linux-firmware-realtek]
+      qcom: [linux-firmware-qcom]
+      cirrus: [linux-firmware-cirrus]
+      other: [linux-firmware-other]
+    gpu_base: [mesa, vulkan-icd-loader]
+    gpu:
+      intel: [vulkan-intel, intel-media-driver]
+      amd: [vulkan-radeon, libva-mesa-driver]
+    gpu_nvidia:
+      open: [nvidia-open-dkms, nvidia-utils]
+      proprietary: [nvidia-dkms, nvidia-utils]
+      # Wayland-only: kernel nouveau module + mesa/gbm drive the display; no Xorg DDX.
+      nouveau: [vulkan-nouveau]
+    peripherals_base: [v4l-utils]
+    peripherals_fingerprint: [fprintd, libfprint]
+    peripherals_displaylink: []          # AUR only; user must wire in AUR helper
+
+  Debian:
+    cpu_microcode:
+      intel: [intel-microcode]
+      amd: [amd64-microcode]
+    firmware_base: [firmware-linux-free]
+    firmware:
+      intel: [firmware-iwlwifi, firmware-misc-nonfree]
+      amd: [firmware-amd-graphics, firmware-misc-nonfree]
+      nvidia: [firmware-misc-nonfree]
+      atheros: [firmware-atheros]
+      broadcom: [firmware-brcm80211]
+      mediatek: [firmware-misc-nonfree]
+      marvell: [firmware-misc-nonfree]
+      realtek: [firmware-realtek]
+      qcom: [firmware-misc-nonfree]
+      cirrus: [firmware-misc-nonfree]
+      other: [firmware-misc-nonfree]
+    gpu_base: [mesa-vulkan-drivers, libgl1-mesa-dri]
+    gpu:
+      intel: [intel-media-va-driver, i965-va-driver]
+      amd: [libva-glx2, mesa-va-drivers]
+    gpu_nvidia:
+      # Debian trixie+ ships nvidia-open-kernel-dkms; older releases only have
+      # the proprietary nvidia-driver. Both come from the non-free component.
+      open: [nvidia-open-kernel-dkms, nvidia-driver, nvidia-vulkan-icd]
+      proprietary: [nvidia-driver, nvidia-vulkan-icd]
+      # Wayland-only: kernel module + mesa (gpu_base) cover it; no Xorg DDX, no extra pkg.
+      nouveau: []
+    peripherals_base: [v4l-utils]
+    peripherals_fingerprint: [fprintd, libpam-fprintd]
+    peripherals_displaylink: [evdi-dkms]  # userspace driver still needs vendor .run
+
+  RedHat:
+    cpu_microcode:
+      intel: [microcode_ctl]
+      amd: [microcode_ctl]
+    firmware_base: [linux-firmware]
+    firmware:
+      intel: []
+      amd: []
+      nvidia: []
+      atheros: []
+      broadcom: []
+      mediatek: []
+      marvell: []
+      realtek: []
+      qcom: []
+      cirrus: []
+      other: []
+    gpu_base: [mesa-dri-drivers, mesa-vulkan-drivers, vulkan-loader]
+    gpu:
+      intel: [intel-media-driver, libva-intel-driver]
+      amd: [mesa-va-drivers]
+    gpu_nvidia:
+      # akmod packages from RPMFusion non-free; repo enabled by _hardware.yml.
+      open: [akmod-nvidia-open, xorg-x11-drv-nvidia, xorg-x11-drv-nvidia-cuda]
+      proprietary: [akmod-nvidia, xorg-x11-drv-nvidia, xorg-x11-drv-nvidia-cuda]
+      # Wayland-only: kernel module + mesa (gpu_base) cover it; no Xorg DDX, no extra pkg.
+      nouveau: []
+    peripherals_base: [v4l-utils]
+    peripherals_fingerprint: [fprintd, fprintd-pam]
+    peripherals_displaylink: [evdi]      # COPR-supplied; repo enablement deferred
--- a/roles/bootstrap/vars/main.yml
+++ b/roles/bootstrap/vars/main.yml
@@ -328,73 +328,3 @@ bootstrap_archlinux:
      + (['sbctl'] if system_cfg.features.secure_boot.enabled | bool else [])
      + (bootstrap_common_conditional | reject('equalto', 'nftables') | list)
    }}
-
-bootstrap_alpine:
-  base:
-    - alpine-base
-  extra:
-    - btrfs-progs
-    - chrony
-    - curl
-    - e2fsprogs
-    - linux-lts
-    - logrotate
-    - lvm2
-    - python3
-    - rsync
-    - sudo
-    - util-linux
-    - vim
-    - xfsprogs
-  conditional: >-
-    {{
-      (['openssh'] if system_cfg.features.ssh.enabled | bool else [])
-      + bootstrap_common_conditional
-    }}
-
-bootstrap_opensuse:
-  base:
-    - patterns-base-base
-  extra:
-    - btrfs-progs
-    - chrony
-    - curl
-    - e2fsprogs
-    - glibc-locale
-    - kernel-default
-    - logrotate
-    - lvm2
-    - NetworkManager
-    - python3
-    - rsync
-    - sudo
-    - vim
-    - xfsprogs
-  conditional: >-
-    {{
-      (['openssh'] if system_cfg.features.ssh.enabled | bool else [])
-      + bootstrap_common_conditional
-    }}
-
-bootstrap_void:
-  base:
-    - base-system
-    - void-repo-nonfree
-  extra:
-    - btrfs-progs
-    - chrony
-    - curl
-    - dhcpcd
-    - e2fsprogs
-    - logrotate
-    - lvm2
-    - python3
-    - rsync
-    - sudo
-    - vim
-    - xfsprogs
-  conditional: >-
-    {{
-      (['openssh'] if system_cfg.features.ssh.enabled | bool else [])
-      + bootstrap_common_conditional
-    }}
--- a/roles/cis/defaults/main.yml
+++ b/roles/cis/defaults/main.yml
@@ -1,6 +1,6 @@
 ---
 # User-facing API: override via top-level `cis` dict in inventory.
-# Merged with these defaults in _normalize.yml → cis_cfg.
+# Merged with these defaults in _normalize.yml -> cis_cfg.
 cis_defaults:
  modules_blacklist:
    - freevxfs
--- a/roles/cis/tasks/modules.yml
+++ b/roles/cis/tasks/modules.yml
@@ -1,7 +1,7 @@
 ---
 - name: Disable Kernel Modules
  vars:
-    # Ubuntu uses squashfs for snap packages — blacklisting it breaks snap entirely
+    # Ubuntu uses squashfs for snap packages - blacklisting it breaks snap entirely
    cis_modules_squashfs: "{{ [] if os in ['ubuntu', 'ubuntu-lts'] else ['squashfs'] }}"
    cis_modules_all: "{{ cis_cfg.modules_blacklist + cis_modules_squashfs }}"
  ansible.builtin.copy:
--- a/roles/configuration/defaults/main.yml
+++ b/roles/configuration/defaults/main.yml
@@ -1,7 +1,5 @@
 ---
-# Network configuration dispatch — maps OS name to the task file
+# Network configuration dispatch - maps OS name to the task file
 # that writes network config. Default (NetworkManager) applies to
 # all OSes not explicitly listed.
-configuration_network_task_map:
-  alpine: network_alpine.yml
-  void: network_void.yml
+configuration_network_task_map: {}
--- a/roles/configuration/tasks/encryption.yml
+++ b/roles/configuration/tasks/encryption.yml
@@ -155,5 +155,5 @@
      ansible.builtin.include_tasks: encryption/dracut.yml

    - name: Configure GRUB for LUKS
-      when: _initramfs_generator | default('') != 'dracut' or os_family != 'RedHat'
+      when: _initramfs_generator | default('') != 'dracut'
      ansible.builtin.include_tasks: encryption/grub.yml
--- a/roles/configuration/tasks/encryption/initramfs.yml
+++ b/roles/configuration/tasks/encryption/initramfs.yml
@@ -8,8 +8,18 @@
  when:
    - configuration_luks_auto_method == 'tpm2'
    - _tpm2_method | default('') == 'clevis'
-  ansible.builtin.command: >-
-    {{ chroot_command }} apt install -y clevis clevis-luks clevis-tpm2 clevis-initramfs tpm2-tools
+  vars:
+    _clevis_install_cmd:
+      Debian: >-
+        {{ chroot_command }} apt install -y
+        clevis clevis-luks clevis-tpm2 clevis-initramfs tpm2-tools
+      RedHat: >-
+        {{ chroot_command }} dnf install -y
+        clevis clevis-luks clevis-systemd tpm2-tools
+      Archlinux: >-
+        {{ chroot_command }} pacman -S --noconfirm --needed
+        clevis tpm2-tools
+  ansible.builtin.command: "{{ _clevis_install_cmd[os_family] }}"
  register: _clevis_install_result
  changed_when: _clevis_install_result.rc == 0

--- a/roles/configuration/tasks/encryption/initramfs_detect.yml
+++ b/roles/configuration/tasks/encryption/initramfs_detect.yml
@@ -3,7 +3,7 @@
 # Sets _initramfs_generator and _tpm2_method facts.
 #
 # Generator detection: derived from the platform's initramfs_cmd
-#   (dracut → dracut, mkinitcpio → mkinitcpio, else → initramfs-tools)
+#   (dracut -> dracut, mkinitcpio -> mkinitcpio, else -> initramfs-tools)
 # TPM2 method: systemd-cryptenroll when generator supports tpm2-device,
 #   clevis fallback otherwise. Non-native dracut installed automatically.

--- a/roles/configuration/tasks/encryption/keyfile.yml
+++ b/roles/configuration/tasks/encryption/keyfile.yml
@@ -107,7 +107,7 @@
      when: (configuration_luks_keyfile_unlock_test_after.rc | default(1)) != 0
      ansible.builtin.debug:
        msg: >-
-          LUKS keyfile enrollment failed — falling back to manual unlock at boot.
+          LUKS keyfile enrollment failed - falling back to manual unlock at boot.
          The system will prompt for the LUKS passphrase during startup.

    - name: Fallback to manual LUKS unlock if keyfile enrollment failed
--- a/roles/configuration/tasks/encryption/tpm2.yml
+++ b/roles/configuration/tasks/encryption/tpm2.yml
@@ -1,7 +1,7 @@
 ---
 # TPM2 enrollment via systemd-cryptenroll.
 # Works with dracut and mkinitcpio (sd-encrypt). The user-set passphrase
-# remains as a backup unlock method — no auto-generated keyfiles.
+# remains as a backup unlock method - no auto-generated keyfiles.
 - name: Enroll TPM2 for LUKS
  block:
    - name: Create temporary passphrase file for TPM2 enrollment
--- a/roles/configuration/tasks/extras.yml
+++ b/roles/configuration/tasks/extras.yml
@@ -30,7 +30,6 @@
 - name: Create zram config
  when:
    - (os != "debian" or (os_version | string) != "11") and os != "rhel"
-    - os not in ["alpine", "void"]
    - system_cfg.features.swap.enabled | bool
  ansible.builtin.copy:
    dest: /mnt/etc/systemd/zram-generator.conf
--- a/roles/configuration/tasks/network_alpine.yml
+++ b/roles/configuration/tasks/network_alpine.yml
@@ -1,36 +0,0 @@
---
- name: Write Alpine network interfaces
-  ansible.builtin.copy:
-    dest: /mnt/etc/network/interfaces
-    mode: "0644"
-    content: |
-      auto lo
-      iface lo inet loopback
-      {% for iface in system_cfg.network.interfaces %}
-      {% set inv_name = iface.name | default('') | string %}
-      {% set det_name = configuration_detected_interfaces[loop.index0] | default('eth' ~ loop.index0) %}
-      {% set iface_name = inv_name if inv_name | length > 0 else det_name %}
-      {% set has_static = (iface.ip | default('') | string | length) > 0 %}
-
-      auto {{ iface_name }}
-      iface {{ iface_name }} inet {{ 'static' if has_static else 'dhcp' }}
-      {% if has_static %}
-        address {{ iface.ip }}/{{ iface.prefix }}
-      {% if iface.gateway | default('') | string | length %}
-        gateway {{ iface.gateway }}
-      {% endif %}
-      {% endif %}
-      {% endfor %}
-
- name: Set Alpine DNS resolvers
-  when: configuration_dns_list | length > 0 or configuration_dns_search | length > 0
-  ansible.builtin.copy:
-    dest: /mnt/etc/resolv.conf
-    mode: "0644"
-    content: |
-      {% if configuration_dns_search | length > 0 %}
-      search {{ configuration_dns_search | join(' ') }}
-      {% endif %}
-      {% for resolver in configuration_dns_list %}
-      nameserver {{ resolver }}
-      {% endfor %}
--- a/roles/configuration/tasks/network_void.yml
+++ b/roles/configuration/tasks/network_void.yml
@@ -1,26 +0,0 @@
---
- name: Write dhcpcd configuration
-  ansible.builtin.copy:
-    dest: /mnt/etc/dhcpcd.conf
-    mode: "0644"
-    content: |
-      {% for iface in system_cfg.network.interfaces %}
-      {% set inv_name = iface.name | default('') | string %}
-      {% set det_name = configuration_detected_interfaces[loop.index0] | default('eth' ~ loop.index0) %}
-      {% set iface_name = inv_name if inv_name | length > 0 else det_name %}
-      {% set has_static = (iface.ip | default('') | string | length) > 0 %}
-      {% if has_static %}
-      interface {{ iface_name }}
-      static ip_address={{ iface.ip }}/{{ iface.prefix }}
-      {% if iface.gateway | default('') | string | length %}
-      static routers={{ iface.gateway }}
-      {% endif %}
-      {% if loop.index0 == 0 and configuration_dns_list | length > 0 %}
-      static domain_name_servers={{ configuration_dns_list | join(' ') }}
-      {% endif %}
-      {% if loop.index0 == 0 and configuration_dns_search | length > 0 %}
-      static domain_search={{ configuration_dns_search | join(' ') }}
-      {% endif %}
-
-      {% endif %}
-      {% endfor %}
--- a/roles/configuration/tasks/secure_boot.yml
+++ b/roles/configuration/tasks/secure_boot.yml
@@ -1,4 +1,15 @@
 ---
+- name: Validate Secure Boot is supported on this OS
+  ansible.builtin.assert:
+    that:
+      - os in ['archlinux', 'debian', 'ubuntu', 'ubuntu-lts',
+              'rhel', 'rocky', 'almalinux', 'fedora']
+    fail_msg: >-
+      Secure Boot is not supported on {{ os }} in this bootstrap. Supported:
+      Arch (sbctl) and Debian/Ubuntu/RHEL/Rocky/Alma/Fedora (shim). Disable
+      system.features.secure_boot.enabled or pick a supported OS.
+    quiet: true
+
 - name: Configure shim-based Secure Boot
  when: os != 'archlinux'
  ansible.builtin.include_tasks: secure_boot/shim.yml
--- a/roles/configuration/tasks/services.yml
+++ b/roles/configuration/tasks/services.yml
@@ -1,13 +1,34 @@
 ---
- name: Enable systemd services
-  when: _configuration_platform.init_system == 'systemd'
+- name: Resolve desktop facts
+  when: system_cfg.features.desktop.enabled | bool
  vars:
+    _autologin: "{{ system_cfg.features.desktop.autologin | default(false) }}"
+  ansible.builtin.set_fact:
    _desktop_dm: >-
      {{
        system_cfg.features.desktop.display_manager
        if (system_cfg.features.desktop.display_manager | length > 0)
        else (configuration_desktop_dm_map[system_cfg.features.desktop.environment] | default(''))
      }}
+    _desktop_session: "{{ system_cfg.features.desktop.session | default('') }}"
+    # Explicit session wins, else the per-environment command. Single source of
+    # truth for the greetd assert, the config gate, and the template.
+    _greetd_session: >-
+      {{
+        system_cfg.features.desktop.session
+        if (system_cfg.features.desktop.session | default('') | length > 0)
+        else (configuration_desktop_session_cmd_map[system_cfg.features.desktop.environment] | default(''))
+      }}
+    _desktop_autologin_user: >-
+      {{
+        _autologin
+        if (_autologin | string | lower not in ['', 'false'] and _autologin in system_cfg.users)
+        else ''
+      }}
+
+- name: Enable systemd services
+  when: _configuration_platform.init_system == 'systemd'
+  vars:
    configuration_systemd_services: >-
      {{
        ['NetworkManager']
@@ -15,13 +36,31 @@
        + (['ufw'] if system_cfg.features.firewall.backend == 'ufw' and system_cfg.features.firewall.enabled | bool else [])
        + ([_configuration_platform.ssh_service] if system_cfg.features.ssh.enabled | bool else [])
        + (['logrotate', 'systemd-timesyncd'] if os == 'archlinux' else [])
-        + ([_desktop_dm] if system_cfg.features.desktop.enabled | bool and _desktop_dm | length > 0 else [])
        + (['bluetooth'] if system_cfg.features.desktop.enabled | bool else [])
      }}
  ansible.builtin.command: "{{ chroot_command }} systemctl enable {{ item }}"
  loop: "{{ configuration_systemd_services }}"
  register: configuration_enable_service_result
  changed_when: configuration_enable_service_result.rc == 0
+  failed_when: >-
+    configuration_enable_service_result.rc != 0
+    and 'No such file or directory' not in (configuration_enable_service_result.stderr | default(''))
+    and 'does not exist' not in (configuration_enable_service_result.stderr | default(''))
+
+- name: Enable display manager for selected desktop
+  when:
+    - _configuration_platform.init_system == 'systemd'
+    - system_cfg.features.desktop.enabled | bool
+    - _desktop_dm | length > 0
+  ansible.builtin.command: "{{ chroot_command }} systemctl enable {{ _desktop_dm }}"
+  register: configuration_enable_dm_result
+  changed_when: configuration_enable_dm_result.rc == 0
+  # Unlike optional services above, a missing/unenabled DM is fatal: chroot
+  # systemctl can exit 0 while only warning on stderr, so check both.
+  failed_when: >-
+    configuration_enable_dm_result.rc != 0
+    or 'No such file or directory' in (configuration_enable_dm_result.stderr | default(''))
+    or 'does not exist' in (configuration_enable_dm_result.stderr | default(''))

 - name: Activate UFW firewall
  when:
@@ -40,66 +79,108 @@
  register: _desktop_target_result
  changed_when: _desktop_target_result.rc == 0

- name: Enable OpenRC services
-  when: _configuration_platform.init_system == 'openrc'
-  vars:
-    configuration_openrc_services: >-
-      {{
-        ['networking']
-        + (['sshd'] if system_cfg.features.ssh.enabled | bool else [])
-        + ([system_cfg.features.firewall.backend] if system_cfg.features.firewall.enabled | bool else [])
-      }}
+- name: Enable PipeWire user services globally
+  when:
+    - _configuration_platform.init_system == 'systemd'
+    - system_cfg.features.desktop.enabled | bool
+  ansible.builtin.command: "{{ chroot_command }} systemctl --global enable {{ item }}"
+  loop: "{{ configuration_desktop_audio_units }}"
+  register: _desktop_audio_result
+  changed_when: _desktop_audio_result.rc == 0
+  failed_when: >-
+    _desktop_audio_result.rc != 0
+    and 'No such file or directory' not in (_desktop_audio_result.stderr | default(''))
+    and 'does not exist' not in (_desktop_audio_result.stderr | default(''))
+
+- name: Assert greetd has a real session command to launch
+  when:
+    - system_cfg.features.desktop.enabled | bool
+    - _desktop_dm == 'greetd'
+  ansible.builtin.assert:
+    that:
+      - _greetd_session | length > 0
+      - not (_greetd_session | trim | regex_search('\\.desktop$'))
+    fail_msg: >-
+      greetd needs an executable session command, but the resolved command for desktop
+      environment '{{ system_cfg.features.desktop.environment }}' is
+      '{{ _greetd_session }}'. greetd suits wlroots compositors (sway, hyprland) that
+      launch from a plain command; kde/gnome ship a '.desktop' session and should use
+      their own display manager (sddm, gdm). Set features.desktop.session to an
+      executable, or pick a different display manager.
+
+- name: Generate greetd configuration
+  when:
+    - _configuration_platform.init_system == 'systemd'
+    - system_cfg.features.desktop.enabled | bool
+    - _desktop_dm == 'greetd'
+    - _greetd_session | length > 0
  block:
-    - name: Ensure OpenRC runlevel directory exists
+    - name: Ensure greetd config directory exists
      ansible.builtin.file:
-        path: /mnt/etc/runlevels/default
+        path: /mnt/etc/greetd
        state: directory
        mode: "0755"

-    - name: Check OpenRC init scripts
-      ansible.builtin.stat:
-        path: "/mnt/etc/init.d/{{ item }}"
-      loop: "{{ configuration_openrc_services }}"
-      register: configuration_openrc_service_stats
+    - name: Write greetd config.toml
+      ansible.builtin.template:
+        src: greetd-config.toml.j2
+        dest: /mnt/etc/greetd/config.toml
+        mode: "0644"

-    - name: Enable OpenRC services
-      ansible.builtin.file:
-        src: "/mnt/etc/init.d/{{ item.item }}"
-        dest: "/mnt/etc/runlevels/default/{{ item.item }}"
-        state: link
-      loop: "{{ configuration_openrc_service_stats.results }}"
-      loop_control:
-        label: "{{ item.item }}"
-      when: item.stat.exists
-
- name: Enable runit services
-  when: _configuration_platform.init_system == 'runit'
+- name: Configure GDM autologin
+  when:
+    - _configuration_platform.init_system == 'systemd'
+    - system_cfg.features.desktop.enabled | bool
+    - _desktop_dm == 'gdm'
+    - _desktop_autologin_user | length > 0
  vars:
-    configuration_runit_services: >-
-      {{
-        ['dhcpcd']
-        + (['sshd'] if system_cfg.features.ssh.enabled | bool else [])
-        + ([system_cfg.features.firewall.backend] if system_cfg.features.firewall.enabled | bool else [])
-      }}
+    # Debian's gdm3 reads /etc/gdm3/daemon.conf; RedHat/Arch GDM read
+    # /etc/gdm/custom.conf. The keys are identical, only the path differs.
+    _gdm_dir: "/mnt/etc/{{ 'gdm3' if os_family == 'Debian' else 'gdm' }}"
+    _gdm_conf: "{{ 'daemon.conf' if os_family == 'Debian' else 'custom.conf' }}"
  block:
-    - name: Ensure runit service directory exists
+    - name: Ensure GDM config directory exists
      ansible.builtin.file:
-        path: /mnt/var/service
+        path: "{{ _gdm_dir }}"
        state: directory
        mode: "0755"

-    - name: Check runit service definitions
-      ansible.builtin.stat:
-        path: "/mnt/etc/sv/{{ item }}"
-      loop: "{{ configuration_runit_services }}"
-      register: configuration_runit_service_stats
+    - name: Write GDM autologin config
+      ansible.builtin.template:
+        src: gdm-custom.conf.j2
+        dest: "{{ _gdm_dir }}/{{ _gdm_conf }}"
+        mode: "0644"

-    - name: Enable runit services
+- name: Configure SDDM autologin
+  when:
+    - _configuration_platform.init_system == 'systemd'
+    - system_cfg.features.desktop.enabled | bool
+    - _desktop_dm == 'sddm'
+    - _desktop_autologin_user | length > 0
+  block:
+    - name: Ensure SDDM config directory exists
      ansible.builtin.file:
-        src: "/mnt/etc/sv/{{ item.item }}"
-        dest: "/mnt/var/service/{{ item.item }}"
-        state: link
-      loop: "{{ configuration_runit_service_stats.results }}"
-      loop_control:
-        label: "{{ item.item }}"
-      when: item.stat.exists
+        path: /mnt/etc/sddm.conf.d
+        state: directory
+        mode: "0755"
+
+    # Plasma 6 ships the Wayland session as plasma.desktop; Plasma 5 ships it as
+    # plasmawayland.desktop (plasma.desktop is the X11 session there). Pick the
+    # installed Wayland session so autologin never lands on X11.
+    - name: Discover installed KDE Wayland sessions
+      ansible.builtin.find:
+        paths: /mnt/usr/share/wayland-sessions
+        patterns: "plasma.desktop,plasmawayland.desktop"
+      register: _kde_wayland_sessions
+
+    - name: Resolve the KDE Wayland session file
+      ansible.builtin.set_fact:
+        _sddm_session: >-
+          {%- set names = _kde_wayland_sessions.files | map(attribute='path') | map('basename') | list -%}
+          {{ 'plasma.desktop' if 'plasma.desktop' in names else (names | first | default('')) }}
+
+    - name: Write SDDM autologin drop-in
+      ansible.builtin.template:
+        src: sddm-autologin.conf.j2
+        dest: /mnt/etc/sddm.conf.d/10-autologin.conf
+        mode: "0644"
--- a/roles/configuration/tasks/sudo.yml
+++ b/roles/configuration/tasks/sudo.yml
@@ -15,7 +15,8 @@
    validate: /usr/sbin/visudo --check --file=%s

 - name: Deploy per-user sudoers rules
-  when: item.value.sudo is defined and (item.value.sudo | string | length > 0)
+  # Jinja truthiness: bool true / a rule string => deploy; false / '' / unset => skip.
+  when: item.value.sudo | default(false)
  vars:
    configuration_sudoers_rule: >-
      {{ item.value.sudo if item.value.sudo is string else 'ALL=(ALL) NOPASSWD: ALL' }}
--- a/roles/configuration/tasks/users.yml
+++ b/roles/configuration/tasks/users.yml
@@ -3,7 +3,8 @@
  when: (system_cfg.root.password | default('') | string | length) > 0
  ansible.builtin.shell: >-
    set -o pipefail &&
-    echo 'root:{{ system_cfg.root.password | password_hash("sha512") }}' | {{ chroot_command }} /usr/sbin/chpasswd -e
+    echo 'root:{{ system_cfg.root.password if (system_cfg.root.password | string)[:1] == "$" else system_cfg.root.password | password_hash("sha512") }}'
+    | {{ chroot_command }} /usr/sbin/chpasswd -e
  args:
    executable: /bin/bash
  register: configuration_root_result
@@ -26,11 +27,15 @@
 - name: Create user accounts
  vars:
    configuration_user_group: "{{ _configuration_platform.user_group }}"
+    # plaintext is hashed; a pre-computed crypt hash ($6$/$y$/...) passes through.
+    configuration_user_pw: >-
+      {{ item.value.password if (item.value.password | string)[:1] == '$'
+         else item.value.password | password_hash('sha512') }}
    configuration_useradd_cmd: >-
      {{ chroot_command }} /usr/sbin/useradd --create-home --user-group
      --uid {{ 1000 + _idx }}
      --groups {{ configuration_user_group }} {{ item.key }}
-      {{ ('--password ' ~ (item.value.password | password_hash('sha512'))) if (item.value.password | default('') | string | length > 0) else '' }}
+      {{ ('--password ' ~ configuration_user_pw) if (item.value.password | default('') | string | length > 0) else '' }}
      --shell {{ item.value.shell | default('/bin/bash') }}
  ansible.builtin.command: "{{ configuration_useradd_cmd }}"
  loop: "{{ system_cfg.users | dict2items }}"
--- a/roles/configuration/templates/gdm-custom.conf.j2
+++ b/roles/configuration/templates/gdm-custom.conf.j2
@@ -0,0 +1,4 @@
+[daemon]
+WaylandEnable=true
+AutomaticLoginEnable=true
+AutomaticLogin={{ _desktop_autologin_user }}
--- a/roles/configuration/templates/greetd-config.toml.j2
+++ b/roles/configuration/templates/greetd-config.toml.j2
@@ -0,0 +1,12 @@
+[terminal]
+vt = 1
+
+[default_session]
+command = "tuigreet --time --remember --cmd {{ _greetd_session }}"
+user = "greeter"
+{% if _desktop_autologin_user | length > 0 %}
+
+[initial_session]
+command = "{{ _greetd_session }}"
+user = "{{ _desktop_autologin_user }}"
+{% endif %}
--- a/roles/configuration/templates/sddm-autologin.conf.j2
+++ b/roles/configuration/templates/sddm-autologin.conf.j2
@@ -0,0 +1,6 @@
+{% set _session = _desktop_session if (_desktop_session | length > 0) else _sddm_session %}
+[Autologin]
+User={{ _desktop_autologin_user }}
+{% if _session | length > 0 %}
+Session={{ _session }}
+{% endif %}
--- a/roles/configuration/vars/main.yml
+++ b/roles/configuration/vars/main.yml
@@ -35,45 +35,24 @@ configuration_platform_config:
    grub_mkconfig_prefix: grub-mkconfig
    locale_gen: true
    init_system: systemd
-  Suse:
-    user_group: wheel
-    sudo_group: "%wheel"
-    ssh_service: sshd
-    efi_loader: grubx64.efi
-    grub_install: true
-    initramfs_cmd: "/usr/bin/dracut --regenerate-all --force"
-    grub_mkconfig_prefix: grub-mkconfig
-    locale_gen: true
-    init_system: systemd
-  Alpine:
-    user_group: wheel
-    sudo_group: "%wheel"
-    ssh_service: sshd
-    efi_loader: grubx64.efi
-    grub_install: true
-    initramfs_cmd: ""
-    grub_mkconfig_prefix: grub-mkconfig
-    locale_gen: false
-    init_system: openrc
-  Void:
-    user_group: wheel
-    sudo_group: "%wheel"
-    ssh_service: sshd
-    efi_loader: grubx64.efi
-    grub_install: true
-    initramfs_cmd: ""
-    grub_mkconfig_prefix: grub-mkconfig
-    locale_gen: false
-    init_system: runit

 # Display manager auto-detection from desktop environment name.
 configuration_desktop_dm_map:
  gnome: gdm
  kde: sddm
-  xfce: lightdm
  sway: greetd
-  hyprland: ly@tty2
-  cinnamon: lightdm
-  mate: lightdm
-  lxqt: sddm
-  budgie: gdm
+  hyprland: greetd
+
+# Per-environment session command for greetd-launched compositors (sway/hyprland):
+# the executable greetd starts. kde/gnome use a display manager (sddm/gdm) whose
+# Wayland session is resolved separately, so they are not in this map.
+configuration_desktop_session_cmd_map:
+  sway: sway
+  hyprland: Hyprland
+
+# PipeWire user units enabled globally when a desktop is installed.
+# pipewire/pipewire-pulse are socket-activated; wireplumber ships no socket.
+configuration_desktop_audio_units:
+  - pipewire.socket
+  - pipewire-pulse.socket
+  - wireplumber.service
--- a/roles/environment/defaults/main.yml
+++ b/roles/environment/defaults/main.yml
@@ -8,3 +8,36 @@ environment_parallel_downloads: 20
 environment_pacman_lock_timeout: 120
 environment_pacman_retries: 4
 environment_pacman_retry_delay: 15
+
+# PCI vendor IDs -> vendor codes used by hardware detection.
+# Only vendors that drive distinct firmware/driver packages are mapped.
+environment_pci_vendor_map:
+  "8086": intel
+  "1002": amd
+  "1022": amd
+  "10de": nvidia
+  "14e4": broadcom
+  "10ec": realtek
+  "168c": atheros
+  "0cf3": atheros
+  "168d": atheros
+  "14c3": mediatek
+  "11ab": marvell
+  "1b4b": marvell
+  "17cb": qcom
+  "105b": qcom
+  "1cf3": cirrus
+  "13d7": cirrus
+
+# USB vendor IDs of fingerprint readers supported by libfprint / fprintd.
+# Lowercase, four-digit hex; matched against `lsusb` output.
+environment_fingerprint_vendor_ids:
+  - "06cb"  # Synaptics (modern ThinkPad/Dell)
+  - "138a"  # Validity Sensors (older ThinkPad)
+  - "1c7a"  # LighTuning / Egis
+  - "27c6"  # Goodix
+  - "04f3"  # Elan
+  - "0a5c"  # Broadcom
+  - "08ff"  # AuthenTec (legacy)
+  - "147e"  # Upek (legacy)
+  - "1491"  # Futronic
--- a/roles/environment/handlers/main.yml
+++ b/roles/environment/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: Restart sshd
+  ansible.builtin.service:
+    name: sshd
+    state: restarted
--- a/roles/environment/tasks/_detect_hardware.yml
+++ b/roles/environment/tasks/_detect_hardware.yml
@@ -0,0 +1,149 @@
+---
+# Hardware detection on the live installer host.
+#
+# Resolves system_cfg.features.hardware.profile when not explicitly set, so
+# downstream bootstrap can install vendor-matched microcode/firmware/GPU/
+# peripheral packages. When the user supplies an override profile, detection
+# is skipped (golden-image flow: bake an image with a fixed profile).
+#
+# Output fact: hardware_profile_active = {
+#   cpu: 'intel'|'amd'|'',
+#   gpus: list of 'intel'|'amd'|'nvidia',
+#   nvidia_supports_open: bool,    # true when all detected Nvidia GPUs are
+#                                  # Turing or newer (device id >= 0x1e00)
+#   wireless: list of vendor codes ('intel'|'realtek'|'atheros'|...),
+#   fingerprint: bool,             # USB fingerprint reader detected
+# }
+#
+# Skipped entirely when neither firmware/gpu/peripherals features are enabled.
+
+- name: Resolve hardware detection requirement
+  ansible.builtin.set_fact:
+    _hardware_detection_needed: >-
+      {{
+        (system_cfg.features.firmware.enabled | bool)
+        or (system_cfg.features.gpu.enabled | bool)
+        or (system_cfg.features.peripherals.enabled | bool)
+      }}
+    _hardware_profile_override: "{{ system_cfg.features.hardware.profile | default({}) }}"
+
+- name: Use supplied hardware profile (override)
+  when:
+    - _hardware_detection_needed | bool
+    - _hardware_profile_override | length > 0
+  ansible.builtin.set_fact:
+    hardware_profile_active:
+      cpu: "{{ _hardware_profile_override.cpu | default('') | string | lower }}"
+      gpus: "{{ _hardware_profile_override.gpus | default([]) | map('lower') | list }}"
+      nvidia_supports_open: "{{ _hardware_profile_override.nvidia_supports_open | default(true) | bool }}"
+      wireless: "{{ _hardware_profile_override.wireless | default([]) | map('lower') | list }}"
+      fingerprint: "{{ _hardware_profile_override.fingerprint | default(false) | bool }}"
+
+- name: Detect hardware from live host
+  when:
+    - _hardware_detection_needed | bool
+    - _hardware_profile_override | length == 0
+  block:
+    - name: Read CPU vendor
+      ansible.builtin.command: lscpu
+      register: _hardware_lscpu
+      changed_when: false
+
+    - name: Read PCI device list
+      ansible.builtin.command: lspci -nn
+      register: _hardware_lspci
+      changed_when: false
+
+    - name: Read USB device list
+      ansible.builtin.command: lsusb
+      register: _hardware_lsusb
+      changed_when: false
+      failed_when: false
+
+    - name: Resolve detected hardware profile
+      vars:
+        _vendor_keys: "{{ environment_pci_vendor_map.keys() | list }}"
+        _cpu_vendor_raw: >-
+          {{
+            _hardware_lscpu.stdout
+            | regex_search('(?im)^Vendor ID:\\s*(\\S+)', '\\1')
+            | default([''], true)
+            | first
+          }}
+        _cpu_vendor: >-
+          {{
+            'intel' if _cpu_vendor_raw == 'GenuineIntel'
+            else ('amd' if _cpu_vendor_raw == 'AuthenticAMD' else '')
+          }}
+        # PCI classes: 0300 = VGA, 0302 = 3D, 0280 = wireless network controller.
+        _gpu_lines: "{{ _hardware_lspci.stdout_lines | select('search', '\\[(0300|0302)\\]:') | list }}"
+        _gpu_pairs: >-
+          {{
+            _gpu_lines
+            | map('regex_search', '\\[([0-9a-f]{4}):([0-9a-f]{4})\\]', '\\1', '\\2')
+            | select('truthy')
+            | list
+          }}
+        _gpu_vendor_ids: "{{ _gpu_pairs | map('first') | select('in', _vendor_keys) | list }}"
+        _gpu_vendors: "{{ _gpu_vendor_ids | map('extract', environment_pci_vendor_map) | unique | list }}"
+        _nvidia_device_ids: >-
+          {{
+            _gpu_pairs
+            | selectattr('0', 'equalto', '10de')
+            | map(attribute=1)
+            | list
+          }}
+        _nvidia_min_id: >-
+          {{
+            (_nvidia_device_ids | map('int', base=16) | list | min)
+            if _nvidia_device_ids | length > 0 else 0
+          }}
+        # 0x1e00 = 7680 = first Turing device id; Turing+ supports nvidia-open.
+        _nvidia_supports_open: "{{ _nvidia_device_ids | length > 0 and (_nvidia_min_id | int) >= 7680 }}"
+        _wifi_lines: "{{ _hardware_lspci.stdout_lines | select('search', '\\[0280\\]:') | list }}"
+        _wifi_vendor_ids: >-
+          {{
+            _wifi_lines
+            | map('regex_search', '\\[([0-9a-f]{4}):[0-9a-f]{4}\\]', '\\1')
+            | select('truthy')
+            | map('first')
+            | select('in', _vendor_keys)
+            | list
+          }}
+        _wifi_vendors: "{{ _wifi_vendor_ids | map('extract', environment_pci_vendor_map) | unique | list }}"
+        _fingerprint_present: >-
+          {{
+            (_hardware_lsusb.stdout | default(''))
+            | regex_search(
+                '(?i)ID (' ~ (environment_fingerprint_vendor_ids | join('|')) ~ '):'
+              )
+            is not none
+          }}
+      ansible.builtin.set_fact:
+        hardware_profile_active:
+          cpu: "{{ _cpu_vendor }}"
+          gpus: "{{ _gpu_vendors }}"
+          nvidia_supports_open: "{{ _nvidia_supports_open | bool }}"
+          wireless: "{{ _wifi_vendors }}"
+          fingerprint: "{{ _fingerprint_present | bool }}"
+
+- name: Initialize empty hardware profile when detection skipped
+  when: not (_hardware_detection_needed | bool)
+  ansible.builtin.set_fact:
+    hardware_profile_active:
+      cpu: ""
+      gpus: []
+      nvidia_supports_open: true
+      wireless: []
+      fingerprint: false
+
+- name: Report active hardware profile
+  when: _hardware_detection_needed | bool
+  ansible.builtin.debug:
+    msg: >-
+      Hardware profile {{ 'override' if _hardware_profile_override | length > 0 else 'detected' }}:
+      cpu={{ hardware_profile_active.cpu | default('-') }},
+      gpus={{ hardware_profile_active.gpus | default([]) | join(',') | default('-', true) }}
+      {{ '(open-supported)' if hardware_profile_active.nvidia_supports_open | bool else '(legacy)' }},
+      wireless={{ hardware_profile_active.wireless | default([]) | join(',') | default('-', true) }},
+      fingerprint={{ hardware_profile_active.fingerprint | default(false) }}
--- a/roles/environment/tasks/_detect_live.yml
+++ b/roles/environment/tasks/_detect_live.yml
@@ -77,13 +77,10 @@
      MaxStartups 50:30:100
      ClientAliveInterval 30
      ClientAliveCountMax 10
-  register: _sshd_config_result
+  notify: Restart sshd

- name: Restart sshd immediately if config was changed
-  when: _sshd_config_result is changed
-  ansible.builtin.service:
-    name: sshd
-    state: restarted
+- name: Apply pending sshd restart before continuing
+  ansible.builtin.meta: flush_handlers

 - name: Abort if the host is not booted from the Arch install media
  when:
--- a/roles/environment/tasks/main.yml
+++ b/roles/environment/tasks/main.yml
@@ -11,5 +11,8 @@
    - name: Prepare installer environment
      ansible.builtin.include_tasks: _prepare_installer.yml

+    - name: Detect hardware for firmware/GPU package selection
+      ansible.builtin.include_tasks: _detect_hardware.yml
+
    - name: Run third-party preparation tasks
      ansible.builtin.include_tasks: _thirdparty.yml
--- a/roles/global_defaults/defaults/main.yml
+++ b/roles/global_defaults/defaults/main.yml
@@ -1,5 +1,5 @@
 ---
-# OS family lists — single source of truth for platform detection and validation
+# OS family lists - single source of truth for platform detection and validation
 os_family_rhel:
  - almalinux
  - fedora
@@ -10,33 +10,27 @@ os_family_debian:
  - ubuntu
  - ubuntu-lts

-# OS → family mapping — aligns with the main project's ansible_os_family pattern.
+# OS -> family mapping - aligns with the main project's ansible_os_family pattern.
 # Enables platform_config dict lookups per role instead of inline when: is_rhel chains.
 os_family_map:
  almalinux: RedHat
-  alpine: Alpine
  archlinux: Archlinux
  debian: Debian
  fedora: RedHat
-  opensuse: Suse
  rhel: RedHat
  rocky: RedHat
  ubuntu: Debian
  ubuntu-lts: Debian
-  void: Void

 os_supported:
  - almalinux
-  - alpine
  - archlinux
  - debian
  - fedora
-  - opensuse
  - rhel
  - rocky
  - ubuntu
  - ubuntu-lts
-  - void

 # User input. Normalized into hypervisor_cfg + hypervisor_type.
 hypervisor:
@@ -106,8 +100,6 @@ system_defaults:
    iter: 4000
    bits: 512
    pbkdf: "argon2id"
-    urandom: true
-    verify: true
  features:
    cis:
      enabled: false
@@ -127,25 +119,37 @@ system_defaults:
      motd: false
      sudo: true
    rhel_repo:
-      source: "iso" # iso|satellite|none — how RHEL systems get packages post-install
+      source: "iso" # iso|satellite|none - how RHEL systems get packages post-install
      url: ""       # Satellite/custom repo URL when source=satellite
-    aur:
-      enabled: false
-      helper: "yay"  # yay|paru
-      user: "_aur_builder"
    chroot:
      tool: "arch-chroot" # arch-chroot|chroot|systemd-nspawn
    initramfs:
      generator: "" # auto-detected; override: dracut|mkinitcpio|initramfs-tools
    desktop:
      enabled: false
-      environment: ""       # gnome|kde|xfce|sway|hyprland|cinnamon|mate|lxqt|budgie
-      display_manager: ""   # auto from environment when empty; override: gdm|sddm|lightdm|greetd
+      environment: ""       # gnome|kde|sway|hyprland
+      display_manager: ""   # auto from environment when empty; override: gdm|sddm|greetd
+      autologin: false      # false | username from system.users
+      session: ""           # session name/command for the autologin user
+      groups: []            # opt-in package groups (keys of desktop_package_groups)
    secure_boot:
      enabled: false
      method: ""            # arch only: sbctl (default) or uki; ignored for other distros
+    firmware:
+      enabled: "auto"       # auto = on for physical, off for virtual
+      microcode: "auto"
+    gpu:
+      enabled: "auto"       # auto = follows desktop.enabled
+      nvidia_driver: "auto" # auto | open | proprietary | nouveau
+    peripherals:
+      enabled: "auto"       # auto = follows desktop.enabled
+      fingerprint: "auto"
+      webcam: "auto"
+      displaylink: false
+    hardware:
+      profile: {}           # empty = autodetect; set to override (golden image)

-# Per-hypervisor required fields — drives data-driven validation.
+# Per-hypervisor required fields - drives data-driven validation.
 # All virtual types additionally require network bridge or interfaces.
 hypervisor_required_fields:
  proxmox:
@@ -169,7 +173,7 @@ hypervisor_disk_device_map:
  proxmox: "/dev/sd"
  vmware: "/dev/sd"

-# Mountpoints managed by the partitioning role — forbidden for extra disks.
+# Mountpoints managed by the partitioning role - forbidden for extra disks.
 reserved_mounts:
  - /boot
  - /boot/efi
--- a/roles/global_defaults/tasks/_normalize_system.yml
+++ b/roles/global_defaults/tasks/_normalize_system.yml
@@ -28,21 +28,41 @@
      memory: "{{ [system_raw.memory | default(0) | int, 0] | max }}"
      balloon: "{{ [system_raw.balloon | default(0) | int, 0] | max }}"
      # --- Network ---
-      # Flat fields (bridge, ip, etc.) and interfaces[] are mutually exclusive.
-      # When interfaces[] is set, flat fields are populated from the first
-      # interface in the "Populate primary network fields" task below.
-      # When only flat fields are set, a synthetic interfaces[] entry is built.
+      # Flat fields (bridge, ip, etc.) and interfaces[] express the same primary NIC.
+      # When only flat fields are set, a synthetic interfaces[] entry is built below.
+      # When interfaces[] is set, the flat ip/prefix/gateway are backfilled from
+      # interfaces[0] so consumers reading the flat fields (e.g. the post-reboot
+      # reconnect block) still work.
      network:
-        bridge: "{{ system_raw.network.bridge | default('') | string }}"
+        bridge: >-
+          {{
+            (system_raw.network.bridge | default('') | string)
+            if (system_raw.network.bridge | default('') | string | length) > 0
+            else (system_raw.network.interfaces[0].bridge | default('') | string
+                  if (system_raw.network.interfaces | default([]) | length) > 0 else '')
+          }}
        vlan: "{{ system_raw.network.vlan | default('') | string }}"
-        ip: "{{ system_raw.network.ip | default('') | string }}"
+        ip: >-
+          {{
+            (system_raw.network.ip | default('') | string)
+            if (system_raw.network.ip | default('') | string | length) > 0
+            else (system_raw.network.interfaces[0].ip | default('') | string
+                  if (system_raw.network.interfaces | default([]) | length) > 0 else '')
+          }}
        prefix: >-
          {{
            (system_raw.network.prefix | int | string)
            if (system_raw.network.prefix | default('') | string | length) > 0
-            else ''
+            else (system_raw.network.interfaces[0].prefix | default('') | string
+                  if (system_raw.network.interfaces | default([]) | length) > 0 else '')
+          }}
+        gateway: >-
+          {{
+            (system_raw.network.gateway | default('') | string)
+            if (system_raw.network.gateway | default('') | string | length) > 0
+            else (system_raw.network.interfaces[0].gateway | default('') | string
+                  if (system_raw.network.interfaces | default([]) | length) > 0 else '')
          }}
-        gateway: "{{ system_raw.network.gateway | default('') | string }}"
        dns:
          servers: "{{ system_raw.network.dns.servers | default([]) }}"
          search: "{{ system_raw.network.dns.search | default([]) }}"
@@ -118,8 +138,6 @@
        iter: "{{ system_raw.luks.iter | int }}"
        bits: "{{ system_raw.luks.bits | int }}"
        pbkdf: "{{ system_raw.luks.pbkdf | string }}"
-        urandom: "{{ system_raw.luks.urandom | bool }}"
-        verify: "{{ system_raw.luks.verify | bool }}"
      # --- Feature flags ---
      features:
        cis:
@@ -150,9 +168,61 @@
          enabled: "{{ system_raw.features.desktop.enabled | bool }}"
          environment: "{{ system_raw.features.desktop.environment | default('') | string | lower }}"
          display_manager: "{{ system_raw.features.desktop.display_manager | default('') | string | lower }}"
+          autologin: "{{ system_raw.features.desktop.autologin | default(false) }}"
+          session: "{{ system_raw.features.desktop.session | default('') | string }}"
+          groups: "{{ system_raw.features.desktop.groups | default([]) }}"
        secure_boot:
          enabled: "{{ system_raw.features.secure_boot.enabled | bool }}"
          method: "{{ system_raw.features.secure_boot.method | default('') | string | lower }}"
+        firmware:
+          enabled: >-
+            {{
+              (system_type == 'physical')
+              if (system_raw.features.firmware.enabled | string | lower) == 'auto'
+              else (system_raw.features.firmware.enabled | bool)
+            }}
+          microcode: >-
+            {{
+              (
+                (system_type == 'physical')
+                if (system_raw.features.firmware.enabled | string | lower) == 'auto'
+                else (system_raw.features.firmware.enabled | bool)
+              )
+              if (system_raw.features.firmware.microcode | string | lower) == 'auto'
+              else (system_raw.features.firmware.microcode | bool)
+            }}
+        gpu:
+          enabled: >-
+            {{
+              (system_raw.features.desktop.enabled | bool)
+              if (system_raw.features.gpu.enabled | string | lower) == 'auto'
+              else (system_raw.features.gpu.enabled | bool)
+            }}
+          nvidia_driver: "{{ system_raw.features.gpu.nvidia_driver | default('auto') | string | lower }}"
+        peripherals:
+          enabled: >-
+            {{
+              (system_raw.features.desktop.enabled | bool)
+              if (system_raw.features.peripherals.enabled | string | lower) == 'auto'
+              else (system_raw.features.peripherals.enabled | bool)
+            }}
+          # fingerprint/webcam stay tri-state ('auto'|'true'|'false') because the
+          # 'auto' branch is resolved at install time using detection results.
+          fingerprint: >-
+            {{
+              'auto'
+              if (system_raw.features.peripherals.fingerprint | string | lower) == 'auto'
+              else (system_raw.features.peripherals.fingerprint | bool | string | lower)
+            }}
+          webcam: >-
+            {{
+              'auto'
+              if (system_raw.features.peripherals.webcam | string | lower) == 'auto'
+              else (system_raw.features.peripherals.webcam | bool | string | lower)
+            }}
+          displaylink: "{{ system_raw.features.peripherals.displaylink | bool }}"
+        hardware:
+          profile: "{{ system_raw.features.hardware.profile | default({}) }}"
    hostname: "{{ system_name }}"
    os: "{{ system_os_input if system_os_input | length > 0 else (physical_default_os if system_type == 'physical' else '') }}"
    os_version: "{{ system_raw.version | default('') | string }}"
--- a/roles/global_defaults/tasks/main.yml
+++ b/roles/global_defaults/tasks/main.yml
@@ -1,5 +1,5 @@
 ---
-# Centralized normalization — all input dicts (system, hypervisor, disks)
+# Centralized normalization - all input dicts (system, hypervisor, disks)
 # are normalized here into system_cfg, hypervisor_cfg, etc.
 # Downstream roles consume these computed facts directly and do NOT need
 # per-role _normalize.yml (except CIS, which has its own input dict).
--- a/roles/global_defaults/tasks/system.yml
+++ b/roles/global_defaults/tasks/system.yml
@@ -56,7 +56,7 @@
    - _bootstrap_needs_enrichment | default(false) | bool
    - system_cfg.mirror | default('') | string | trim | length == 0
  vars:
-    # Same as _normalize_system.yml — kept in sync manually.
+    # Same as _normalize_system.yml - kept in sync manually.
    _mirror_defaults:
      debian: "https://deb.debian.org/debian/"
      ubuntu: "http://archive.ubuntu.com/ubuntu/"
--- a/roles/global_defaults/tasks/validation.yml
+++ b/roles/global_defaults/tasks/validation.yml
@@ -123,7 +123,7 @@
        or (
          os == "debian" and (os_version | string) in ["10", "11", "12", "13", "unstable"]
        ) or (
-          os == "fedora" and (os_version | int) >= 38 and (os_version | int) <= 43
+          os == "fedora" and (os_version | int) >= 38 and (os_version | int) <= 45
        ) or (
          os in ["rocky", "almalinux"]
          and (os_version | string) is match("^(8|9|10)(\\.\\d+)?$")
@@ -140,7 +140,7 @@
          os in ["ubuntu", "ubuntu-lts"]
          and (os_version | default('') | string | length) == 0
        ) or (
-          os in ["alpine", "archlinux", "opensuse", "void"]
+          os == "archlinux"
        )
    fail_msg: "Invalid os/version specified. Please check README.md for supported values."
    quiet: true
@@ -232,6 +232,69 @@
    fail_msg: Invalid feature flags were specified, please check your inventory/vars.
    quiet: true

+- name: Validate hardware feature flags
+  ansible.builtin.assert:
+    that:
+      - system_cfg.features.firmware.enabled is defined
+      - system_cfg.features.firmware.microcode is defined
+      - system_cfg.features.gpu.enabled is defined
+      - system_cfg.features.gpu.nvidia_driver in ["auto", "open", "proprietary", "nouveau"]
+      - system_cfg.features.peripherals.enabled is defined
+      - system_cfg.features.peripherals.fingerprint in ["auto", "true", "false"]
+      - system_cfg.features.peripherals.webcam in ["auto", "true", "false"]
+      - system_cfg.features.peripherals.displaylink is defined
+      - system_cfg.features.hardware.profile is mapping
+    fail_msg: >-
+      Invalid hardware feature flags. firmware.enabled/microcode,
+      peripherals.enabled and peripherals.displaylink must be bool (or 'auto'
+      sentinel for firmware); gpu.nvidia_driver in
+      [auto|open|proprietary|nouveau]; peripherals.fingerprint and
+      peripherals.webcam in [auto|true|false]; hardware.profile must be a dict.
+    quiet: true
+
+- name: Validate desktop environment
+  when: system_cfg.features.desktop.enabled | bool
+  ansible.builtin.assert:
+    that:
+      - system_cfg.features.desktop.environment in ["gnome", "kde", "sway", "hyprland"]
+      - >-
+        system_cfg.features.desktop.environment not in ["sway", "hyprland"]
+        or os_family_map[os] | default('') == "Archlinux"
+      - >-
+        system_cfg.features.desktop.display_manager | default('') | length == 0
+        or system_cfg.features.desktop.display_manager in ["gdm", "sddm", "greetd"]
+      - >-
+        system_cfg.features.desktop.display_manager | default('') != "greetd"
+        or system_cfg.features.desktop.environment in ["sway", "hyprland"]
+      - >-
+        system_cfg.features.desktop.environment != "gnome"
+        or system_cfg.features.desktop.display_manager | default('') in ["", "gdm"]
+      - >-
+        system_cfg.features.desktop.environment != "kde"
+        or system_cfg.features.desktop.display_manager | default('') in ["", "sddm"]
+    fail_msg: >-
+      Invalid desktop config: environment '{{ system_cfg.features.desktop.environment }}'
+      for os_family '{{ os_family_map[os] | default('Unknown') }}',
+      display_manager '{{ system_cfg.features.desktop.display_manager | default('') }}'.
+      gnome and kde are available on all families; sway and hyprland are Archlinux only.
+      display_manager must be empty (auto) or match the environment's native DM:
+      gnome->gdm, kde->sddm, sway/hyprland->greetd. Only that DM's package is
+      installed, so a mismatched override fails at enable time.
+    quiet: true
+
+- name: Validate desktop autologin
+  when: system_cfg.features.desktop.enabled | bool
+  vars:
+    _autologin: "{{ system_cfg.features.desktop.autologin | default(false) }}"
+  ansible.builtin.assert:
+    that:
+      - _autologin is boolean and not _autologin or (_autologin is string and _autologin | length > 0 and _autologin in system_cfg.users)
+    fail_msg: >-
+      desktop.autologin must be false or a username string present in
+      system.users; got '{{ _autologin }}'. Bool true is not accepted - the
+      resolver matches the value against system.users by name.
+    quiet: true
+
 - name: Validate virtual system sizing
  when: system_cfg.type == "virtual"
  ansible.builtin.assert:
@@ -242,7 +305,7 @@
      - (system_cfg.disks[0].size | float) > 0
      - (system_cfg.disks[0].size | float) >= 20
      # Btrfs minimum disk: swap_size + 5.5 GiB overhead (subvolumes + metadata).
-      # Swap sizing: memory < 16 GiB → max(memory_GiB, 2); memory >= 16 GiB → memory/2.
+      # Swap sizing: memory < 16 GiB -> max(memory_GiB, 2); memory >= 16 GiB -> memory/2.
      - >-
        system_cfg.filesystem != "btrfs"
        or (
--- a/roles/partitioning/defaults/main.yml
+++ b/roles/partitioning/defaults/main.yml
@@ -1,7 +1,7 @@
 ---
 partitioning_btrfs_compress_opt: "{{ 'compress=zstd:15' if system_cfg.features.zstd.enabled | bool else '' }}"
 # Partition separator: 'p' for NVMe/mmcblk (device path ends in digit), empty for SCSI/virtio.
-# Examples: /dev/sda → /dev/sda1, /dev/nvme0n1 → /dev/nvme0n1p1
+# Examples: /dev/sda -> /dev/sda1, /dev/nvme0n1 -> /dev/nvme0n1p1
 partitioning_part_sep: "{{ 'p' if (install_drive | default('') | regex_search('\\d$')) else '' }}"
 partitioning_boot_partition_suffix: 1
 partitioning_main_partition_suffix: 2
--- a/roles/partitioning/tasks/_create_lvm.yml
+++ b/roles/partitioning/tasks/_create_lvm.yml
@@ -4,14 +4,14 @@
 # Sizes are computed from disk_size_gb, memory_mb, and feature flags.
 #
 # Swap sizing:
-#   - RAM >= 16 GB → swap = RAM/2 (in GB)
-#   - RAM <  16 GB → swap = max(RAM_GB, 2)
+#   - RAM >= 16 GB -> swap = RAM/2 (in GB)
+#   - RAM <  16 GB -> swap = max(RAM_GB, 2)
 #   - Capped to: min(target, 4 + max(disk - overhead, 0))
 #   - Further capped to: max available after subtracting reserved + CIS + extent reserve + 4 GB buffer
 #
 # Root sizing:
 #   - Full-disk mode (default): disk - reserved - swap - extent_reserve - (CIS volumes if enabled)
-#   - Partial mode: tiered — <4 GB available → 4 GB, 4-12 GB → all available, >12 GB → 40% of disk
+#   - Partial mode: tiered - <4 GB available -> 4 GB, 4-12 GB -> all available, >12 GB -> 40% of disk
 #
 # CIS volumes (only when CIS enabled):
 #   - /home: max(min(home_raw, home_max), home_min) where home_raw = (disk - overhead) * 10%
--- a/roles/partitioning/tasks/btrfs.yml
+++ b/roles/partitioning/tasks/btrfs.yml
@@ -59,9 +59,12 @@
        label: "{{ item.subvol }}"

    - name: Set default btrfs subvolume to @
-      ansible.builtin.shell: >-
-        btrfs subvolume list /mnt | awk '/ path @$/ {print $2}'
-        | xargs -I{} btrfs subvolume set-default {} /mnt
+      ansible.builtin.shell:
+        cmd: >-
+          set -o pipefail &&
+          btrfs subvolume list /mnt | awk '/ path @$/ {print $2}'
+          | xargs -I{} btrfs subvolume set-default {} /mnt
+        executable: /bin/bash
      register: partitioning_btrfs_default_result
      changed_when: partitioning_btrfs_default_result.rc == 0

--- a/roles/virtualization/defaults/main.yml
+++ b/roles/virtualization/defaults/main.yml
@@ -1,9 +1,9 @@
 ---
 # Cloud-init support matrix:
-#   libvirt  — cloud-init ISO attached as CDROM (user-data + network-config)
-#   proxmox  — cloud-init via Proxmox API (cicustom, ciuser, cipassword, etc.)
-#   vmware   — no cloud-init; configuration is applied post-install via chroot
-#   xen      — no cloud-init; configuration is applied post-install via chroot
+#   libvirt  - cloud-init ISO attached as CDROM (user-data + network-config)
+#   proxmox  - cloud-init via Proxmox API (cicustom, ciuser, cipassword, etc.)
+#   vmware   - no cloud-init; configuration is applied post-install via chroot
+#   xen      - no cloud-init; configuration is applied post-install via chroot
 virtualization_libvirt_image_dir: >-
  {{
    system_cfg.path
@@ -17,8 +17,18 @@ virtualization_libvirt_cloudinit_path: >-
 virtualization_xen_disk_path: /var/lib/xen/images

 virtualization_libvirt_machine_type: q35
-virtualization_libvirt_ovmf_code: /usr/share/edk2/x64/OVMF_CODE.secboot.4m.fd
-virtualization_libvirt_ovmf_vars: /usr/share/edk2/x64/OVMF_VARS.4m.fd
+# Secboot OVMF firmware candidates, ordered Arch, Debian/Ubuntu, Fedora/RHEL.
+# libvirt.yml resolves these to the first file present on the controller.
+virtualization_libvirt_ovmf_code_candidates:
+  - /usr/share/edk2/x64/OVMF_CODE.secboot.4m.fd
+  - /usr/share/OVMF/OVMF_CODE_4M.secboot.fd
+  - /usr/share/edk2/ovmf/OVMF_CODE.secboot.fd
+  - /usr/share/OVMF/OVMF_CODE.secboot.fd
+virtualization_libvirt_ovmf_vars_candidates:
+  - /usr/share/edk2/x64/OVMF_VARS.4m.fd
+  - /usr/share/OVMF/OVMF_VARS_4M.fd
+  - /usr/share/edk2/ovmf/OVMF_VARS.fd
+  - /usr/share/OVMF/OVMF_VARS.fd

 virtualization_tpm2_enabled: >-
  {{
--- a/roles/virtualization/tasks/libvirt.yml
+++ b/roles/virtualization/tasks/libvirt.yml
@@ -70,6 +70,19 @@
    - /tmp/cloud-user-data-{{ hostname }}.yml
    - /tmp/cloud-network-config-{{ hostname }}.yml

+# Resolve OVMF firmware to the first candidate present on the controller
+# unless the user pinned an explicit path. first_found needs the localhost
+# delegation since the candidates live on the libvirt host, not the target.
+- name: Resolve OVMF firmware paths
+  delegate_to: localhost
+  ansible.builtin.set_fact:
+    virtualization_libvirt_ovmf_code: >-
+      {{ virtualization_libvirt_ovmf_code if virtualization_libvirt_ovmf_code | default('', true) | length > 0
+         else lookup('ansible.builtin.first_found', virtualization_libvirt_ovmf_code_candidates) }}
+    virtualization_libvirt_ovmf_vars: >-
+      {{ virtualization_libvirt_ovmf_vars if virtualization_libvirt_ovmf_vars | default('', true) | length > 0
+         else lookup('ansible.builtin.first_found', virtualization_libvirt_ovmf_vars_candidates) }}
+
 # uri defaults to qemu:///system (local libvirtd)
 - name: Create VM using libvirt
  delegate_to: localhost
--- a/roles/virtualization/tasks/vmware.yml
+++ b/roles/virtualization/tasks/vmware.yml
@@ -36,7 +36,7 @@
        esxi_hostname: "{{ hypervisor_cfg.node if (hypervisor_cfg.node | default('') | length > 0) else omit }}"
        folder: "{{ system_cfg.path if system_cfg.path | string | length > 0 else omit }}"
        name: "{{ hostname }}"
-        # Generic guest ID — VMware auto-detects OS post-install
+        # Generic guest ID - VMware auto-detects OS post-install
        guest_id: otherLinux64Guest
        annotation: |
          {{ note if note is defined else '' }}
--- a/roles/virtualization/templates/cloud-user-data.yml.j2
+++ b/roles/virtualization/templates/cloud-user-data.yml.j2
@@ -8,7 +8,10 @@ users:
  - name: "{{ username }}"
    primary_group: "{{ username }}"
    groups: users
-{% if attrs.sudo | default(false) | bool %}
+{% set _sudo = attrs.sudo | default(false) %}
+{% if _sudo is string %}
+    sudo: "{{ _sudo }}"
+{% elif _sudo | bool %}
    sudo: "ALL=(ALL) NOPASSWD:ALL"
 {% endif %}
 {% if attrs.password | default('') | length > 0 %}
--- a/vars_baremetal_example.yml
+++ b/vars_baremetal_example.yml
@@ -26,7 +26,7 @@ system:
        path: /data
        fstype: ext4
  users:
-    - name: "admin"
+    admin:
      password: "CHANGE_ME"
      keys:
        - "ssh-ed25519 AAAA..."
@@ -61,3 +61,17 @@ system:
      sudo: true
    chroot:
      tool: "arch-chroot"
+    desktop:
+      enabled: false
+      environment: ""    # gnome|kde|sway|hyprland (sway/hyprland are Archlinux only)
+      autologin: false   # false | a username from system.users (not bool true)
+    # firmware/microcode default to "auto" - on for physical, off for virtual.
+    # gpu and peripherals.* default to "auto" tied to desktop.enabled.
+    # Override only when you want non-default behavior.
+    gpu:
+      enabled: "auto"        # auto = follows desktop.enabled; set true to force
+      nvidia_driver: "auto"  # auto = open|proprietary|nouveau by GPU generation
+    peripherals:
+      displaylink: false  # explicit opt-in for DisplayLink docks
+    hardware:
+      profile: {}         # autodetect; or set to bake a golden-image profile
--- a/vars_example.yml
+++ b/vars_example.yml
@@ -56,7 +56,7 @@ system:
        label: DATA
        opts: defaults
  users:
-    - name: "ops"
+    ops:
      password: "CHANGE_ME"
      keys:
        - "ssh-ed25519 AAAA..."
@@ -79,8 +79,6 @@ system:
    iter: 4000
    bits: 512
    pbkdf: "argon2id"
-    urandom: true
-    verify: true
  packages:
    - jq
    - tmux
Author	SHA1	Message	Date
Sandwich	37df881daa	docs: refresh bootstrap examples and README	2026-05-30 18:05:14 +02:00
Sandwich	55b21eae5d	fix: encryption, partitioning, cis and virtualization hardening	2026-05-30 18:05:14 +02:00
Sandwich	b1e938b7f0	fix(users): accept plaintext or pre-hashed passwords uniformly	2026-05-30 18:05:05 +02:00
Sandwich	c843f5289b	feat: hardware/firmware/gpu/peripherals detection and packages	2026-05-30 18:05:05 +02:00
Sandwich	9757ed3785	feat: complete wayland desktop deployment (gnome/kde/sway/hyprland)	2026-05-30 18:05:05 +02:00
Sandwich	876e90ce2b	refactor: trim bootstrap OS support to core three distro families	2026-05-30 18:04:00 +02:00
Sandwich	7c44cb1ff0	docs(bootstrap): fix users dict format in examples, sync schema defaults, document secure_boot/rhel_repo	2026-05-30 09:25:34 +02:00
Sandwich	5d0630a386	refactor(global_defaults): drop orphan luks.urandom/verify and aur feature, bump fedora to 45	2026-05-30 09:25:34 +02:00
Sandwich	3eaf918a53	fix(lint): convert sshd restart to handler, add pipefail to btrfs subvol set	2026-05-30 09:25:34 +02:00
Sandwich	382e82ff85	fix(configuration): tolerate missing units, gate Secure Boot to supported OSes, fix clevis install per family	2026-05-30 09:25:34 +02:00
Sandwich	db7dc53bd7	docs(bootstrap): document firmware/gpu/peripherals/hardware features	2026-05-30 09:25:34 +02:00
Sandwich	7d45f25a7e	feat(bootstrap): install vendor-matched hardware packages	2026-05-30 09:25:34 +02:00
Sandwich	3880b8f41e	feat(environment): detect cpu/gpu/wireless/fingerprint hardware	2026-05-30 09:25:34 +02:00
Sandwich	dc3c4a901f	feat(global_defaults): firmware/gpu/peripherals/hardware schema	2026-05-30 09:25:34 +02:00