# Debian setup

Ansible playbooks for a fresh Debian trixie (GNOME) machine. Targets the
current user on localhost; sudo is prompted via `--ask-become-pass`.

## First run (new machine)

```bash
sudo apt-get install -y git
git clone https://tangled.sh/seth.computer/dotfiles ~/dotfiles
~/dotfiles/debian/bootstrap.sh
```

## Later runs

`setup.yml` is idempotent; re-run it anytime (also picks up new ghostty and
obsidian releases, which have no apt repo).

```bash
ansible-playbook ~/dotfiles/debian/ansible/setup.yml --ask-become-pass
```

Update all apt packages:

```bash
ansible-playbook ~/dotfiles/debian/ansible/update.yml --ask-become-pass
```

## What setup.yml does

- apt packages: thunderbird, zsh, git, curl, gnupg, jq, wl-clipboard,
  xdg-utils
- apt repos + install: Helium (`helium-bin`), 1Password (+ `op` CLI),
  Tailscale, Signal (amd64 only — no arm64 build)
- Docker Engine (rootless): installs the engine from Docker's apt repo,
  disables the rootful system daemon, and runs the daemon as the login user
  via `dockerd-rootless-setuptool.sh` + a user systemd service with lingering
  enabled
- ghostty and obsidian: latest GitHub-release .debs
  ([mkasberg/ghostty-ubuntu](https://github.com/mkasberg/ghostty-ubuntu),
  [obsidianmd/obsidian-releases](https://github.com/obsidianmd/obsidian-releases))
- Helium extensions (1Password, Vimium, Margin, Dark Reader) via Chromium
  force-install policy
- clones dotfiles to `~/dotfiles` and runs `sync.sh`
- homebrew at `/home/linuxbrew/.linuxbrew`, then brewsync
  (`brew bundle --zap --force-cleanup`; app casks and `mas` entries are
  skipped on Linux — font casks are not, they install to
  `~/.local/share/fonts`, which is how ghostty's Iosevka nerd font gets
  there; mac-only formulae need an `if OS.mac?` guard in the Brewfile)
- `mise install` for all tools in the mise config
- caps lock → ctrl (kernel-level udev hwdb remap, applies in every session)
- login shell → zsh; default browser → Helium
- unattended security upgrades (daily, Debian's stock config)
- pi Umans login: API key pulled from 1Password (`umans-api-key` item,
  `password` field) into `~/.pi/agent/auth.json`

## Manual steps

- Sign in to the 1Password desktop app, then enable **Integrate with
  1Password CLI** in its developer settings. Until then, setup skips the pi
  Umans login (it prints a note); re-run setup afterwards.
- The `op` key fetch triggers a 1Password approval prompt — approve it while
  setup runs.
- Authenticate tailscale: `sudo tailscale up` (opens a browser login).
  The service itself is enabled by the package.
- If the Helium extensions don't auto-install, that's the upstream
  force-install bug — install them manually from the Chrome Web Store.

## Caveats

- Helium extension force-installs are currently broken upstream
  ([helium#1737](https://github.com/imputnet/helium/issues/1737)). The policy
  file is in place and correct; until the bug is fixed, install the
  extensions manually from the Chrome Web Store.
- Ghostty and Obsidian ship no apt repo on Debian, so `apt upgrade` will not
  update them. Re-run `setup.yml` to pick up new releases.
- 1Password sign-in and developer settings (CLI, SSH agent) are manual.
- Homebrew's `docker`/`docker-buildx`/`lima`/`colima` are macOS-only in the
  Brewfile; on Linux the Docker Engine from apt provides the CLI and daemon.