# Minimal GNOME workstation with the Microsoft Intune app, Microsoft Edge and
# Microsoft Defender for Endpoint, for testing Intune enrollment and Linux
# compliance policies. Local accounts only: no Kanidm, because the Intune app
# needs its own authselect profile (pam_intune) for the password checks.

metadata:
  summary: Fedora minimal GNOME workstation with Microsoft Intune and Defender

variables:
  # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
  distro: "fedora-intune"
  variant: "intune"

# Keep it small: no weak/optional dependencies.
recommends: false

default_target: graphical.target

ref: fedora-intune/${releasever_ref}/${basearch}/intune

# Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
# Defender installs to /opt/microsoft/mdatp and keeps its state in
# /var/opt/microsoft/mdatp; with the default symlink those are the same,
# read-only directory. Needs composefs, which upstream enables.
opt-usrlocal: root

repos:
  - microsoft-rhel10
  - microsoft-edge

include:
  - base-atomic.yaml
  # Shared with fedora-intune-himmelblau (images/shared).
  - workstation.yaml
  - microsoft-edge.yaml
  - defender.yaml
  # Microsoft Intune app.
  - intune.yaml