# Minimal GNOME workstation, shared by the fedora-intune images. Include it
# from a manifest that sets `opt-usrlocal: root` (finalize.d/60-opt-links).

packages:
  # Fedora integration normally provided by the upstream fedora.yaml (which we
  # opt out of to avoid the Firefox RPM).
  - fedora-release
  - fedora-release-ostree-desktop
  - fedora-flathub-remote

  # GNOME desktop: gdm pulls gnome-session, gnome-settings-daemon,
  # accountsservice, dconf and gnome-keyring-pam. gnome-initial-setup creates
  # the first local user on first boot.
  - gdm
  - gnome-shell
  - gnome-control-center
  - gnome-initial-setup
  - nautilus
  - ptyxis
  - pipewire
  - pipewire-pulseaudio
  - wireplumber
  - xdg-desktop-portal-gnome
  - xdg-user-dirs-gtk
  - flatpak

  # Session infrastructure base-atomic lacks with recommends off; see
  # fedora-remote/custom.yaml.
  - dbus-daemon
  - systemd-pam
  - mesa-dri-drivers
  - mesa-libEGL

  # The upstream initramfs config adds dracut's tpm2-tss module, which needs the
  # tpm2 binary. fedora-remote gets it through Kanidm; list it explicitly here.
  - tpm2-tools

  # Proxmox guest integration (agent, console clipboard and resizing).
  - qemu-guest-agent
  - spice-vdagent

# Microsoft Edge is the browser (Conditional Access needs it).
exclude-packages:
  - firefox

add-files:
  - ["50-workstation.preset", "/usr/lib/systemd/system-preset/50-workstation.preset"]
  # Key-only SSH for local accounts.
  - ["10-workstation-sshd.conf", "/etc/ssh/sshd_config.d/10-workstation-sshd.conf"]

postprocess:
  # uresourced breaks the GDM greeter's user manager; see fedora-remote.
  - |
    #!/usr/bin/env bash
    set -xeuo pipefail
    ln -sf /dev/null /etc/systemd/system/uresourced.service