# Minimal GNOME workstation where users sign in with their Entra ID account
# (Himmelblau), with Microsoft Edge and Microsoft Defender for Endpoint.
# Himmelblau joins the device to Entra ID at the first sign-in and, with
# apply_policy, enrolls it in Intune and reports compliance.

metadata:
  summary: Fedora minimal GNOME workstation with Entra ID sign-in and Intune

variables:
  # Opt out of the upstream fedora.yaml so we don't pull the Firefox RPM.
  distro: "fedora-intune"
  variant: "intune"

# Keep it small: no weak/optional dependencies.
recommends: false

default_target: graphical.target

ref: fedora-intune/${releasever_ref}/${basearch}/intune

# Ship /opt as a plain read-only directory instead of a symlink to /var/opt.
# Defender installs to /opt/microsoft/mdatp and keeps its state in
# /var/opt/microsoft/mdatp; with the default symlink those are the same,
# read-only directory. Needs composefs, which upstream enables. The vendor
# directories are linked into /opt by finalize.d/60-opt-links.
opt-usrlocal: root

repos:
  - himmelblau
  - microsoft-fedora44
  - microsoft-edge

include:
  - base-atomic.yaml
  - custom.yaml
  # Entra ID sign-in and Intune.
  - himmelblau.yaml
  - microsoft-edge.yaml
  - defender.yaml