fix: desktop template improvements

- Add AppArmor user namespace fix for Chrome/Brave/VSCode on Ubuntu 24.04
- Fix duplicate browser icons by removing com.google.Chrome.desktop and
  com.brave.Browser.desktop after installation
- Improve avatar deployment with proper AccountsService config
- Change LibreOffice default filter from true to false
- Add handler for update-desktop-database

Author: Derek

ansible/roles/developer/handlers/main.yml

@@ -1,8 +1,13 @@
 ---
-# Docker role handlers
+# Developer role handlers
 
 - name: Inform user to logout
   ansible.builtin.debug:
     msg: |
       IMPORTANT: Log out and back in for Docker group membership to take effect.
       You can then run Docker commands without sudo.
+
+- name: update desktop database
+  ansible.builtin.command:
+    cmd: update-desktop-database /usr/share/applications
+  changed_when: true

ansible/roles/developer/tasks/apparmor_userns.yml

@@ -0,0 +1,44 @@
+---
+# AppArmor User Namespace Fix for Ubuntu 24.04+
+#
+# Ubuntu 24.04 restricts unprivileged user namespace creation by default,
+# which breaks Chromium-based apps (Chrome, Brave, VSCode, Electron apps),
+# Flatpak, Snap sandboxes, and many other applications.
+#
+# Error: apparmor="DENIED" operation="userns_create"
+#
+# This task disables the restriction via sysctl.
+# Reference: https://ubuntu.com/blog/ubuntu-24-04-lts-and-unprivileged-user-namespace-restrictions
+#
+# Note: This is the recommended approach for developer workstations.
+# For servers, use per-application AppArmor profiles instead.
+
+- name: Check if AppArmor userns restriction sysctl exists
+  ansible.builtin.stat:
+    path: /proc/sys/kernel/apparmor_restrict_unprivileged_userns
+  register: userns_sysctl
+
+- name: Disable AppArmor unprivileged user namespace restriction
+  when: userns_sysctl.stat.exists
+  block:
+    - name: Create sysctl config to allow unprivileged user namespaces
+      ansible.builtin.copy:
+        content: |
+          # Allow unprivileged user namespace creation
+          # Required for Chromium-based apps (Chrome, Brave, VSCode, Electron),
+          # Flatpak, Snap sandboxes, and many other applications.
+          #
+          # Ubuntu 24.04+ restricts this by default for security, but it breaks
+          # too many legitimate desktop applications.
+          #
+          # Reference: https://ubuntu.com/blog/ubuntu-24-04-lts-and-unprivileged-user-namespace-restrictions
+          kernel.apparmor_restrict_unprivileged_userns = 0
+        dest: /etc/sysctl.d/99-allow-unprivileged-userns.conf
+        mode: '0644'
+      register: sysctl_file
+
+    - name: Apply sysctl setting immediately
+      ansible.builtin.command:
+        cmd: sysctl -p /etc/sysctl.d/99-allow-unprivileged-userns.conf
+      when: sysctl_file.changed
+      changed_when: true

ansible/roles/developer/tasks/avatar.yml

@@ -19,12 +19,38 @@
     - branding_enabled | default(true)
     - avatar_file | default('') | length > 0
 
+- name: Ensure AccountsService user config file exists
+  ansible.builtin.file:
+    path: "/var/lib/AccountsService/users/{{ actual_user }}"
+    state: touch
+    mode: '0600'
+    modification_time: preserve
+    access_time: preserve
+  when:
+    - ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
+    - has_gnome | default(false)
+    - branding_enabled | default(true)
+    - avatar_file | default('') | length > 0
+
+- name: Ensure [User] section exists in AccountsService config
+  ansible.builtin.lineinfile:
+    path: "/var/lib/AccountsService/users/{{ actual_user }}"
+    regexp: '^\[User\]'
+    line: "[User]"
+    insertbefore: BOF
+    mode: '0600'
+  when:
+    - ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
+    - has_gnome | default(false)
+    - branding_enabled | default(true)
+    - avatar_file | default('') | length > 0
+
 - name: Configure AccountsService to use custom avatar for current user
   ansible.builtin.lineinfile:
     path: "/var/lib/AccountsService/users/{{ actual_user }}"
     regexp: '^Icon='
     line: "Icon=/var/lib/AccountsService/icons/{{ actual_user }}"
-    create: true
+    insertafter: '^\[User\]'
     mode: '0600'
   when:
     - ansible_facts['distribution'] in ['Fedora', 'Ubuntu']

ansible/roles/developer/tasks/brave.yml

@@ -49,6 +49,15 @@
         state: present
         update_cache: true
 
+    # Remove duplicate desktop file that causes two icons in GNOME app menu
+    # Brave packages com.brave.Browser.desktop for XDG portal but puts NoDisplay=true
+    # at the end of the file (after Actions) where GNOME doesn't parse it
+    - name: Remove duplicate Brave desktop file
+      ansible.builtin.file:
+        path: /usr/share/applications/com.brave.Browser.desktop
+        state: absent
+      notify: update desktop database
+
   when: ansible_facts['distribution'] == 'Ubuntu'
 
 # ============================================================================

ansible/roles/developer/tasks/chrome.yml

@@ -52,6 +52,15 @@
         state: present
         update_cache: true
 
+    # Remove duplicate desktop file that causes two icons in GNOME app menu
+    # Chrome packages com.google.Chrome.desktop for XDG portal but puts NoDisplay=true
+    # at the end of the file (after Actions) where GNOME doesn't parse it
+    - name: Remove duplicate Chrome desktop file
+      ansible.builtin.file:
+        path: /usr/share/applications/com.google.Chrome.desktop
+        state: absent
+      notify: update desktop database
+
   when: ansible_facts['distribution'] == 'Ubuntu'
 
 # ============================================================================

ansible/roles/developer/tasks/desktop.yml

@@ -18,7 +18,7 @@
     state: present
   when:
     - ansible_facts['distribution'] == 'Fedora'
-    - install_libreoffice | default(true)
+    - install_libreoffice | default(false)
 
 - name: Set default target to graphical (Fedora)
   ansible.builtin.command:
@@ -59,7 +59,7 @@
     state: present
   when:
     - ansible_facts['distribution'] == 'Ubuntu'
-    - install_libreoffice | default(true)
+    - install_libreoffice | default(false)
 
 - name: Set default target to graphical (Ubuntu)
   ansible.builtin.command:

ansible/roles/developer/tasks/main.yml

@@ -77,6 +77,17 @@
     - ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
     - has_gnome | default(false)
 
+# Fix AppArmor user namespace restriction (Ubuntu 24.04+)
+# This allows Chromium-based apps (Chrome, Brave, VSCode, Electron) to work
+# Uses global sysctl: kernel.apparmor_restrict_unprivileged_userns = 0
+- name: Fix AppArmor user namespace restriction for desktop apps
+  ansible.builtin.include_tasks:
+    file: apparmor_userns.yml
+    apply:
+      tags: ['security', 'apparmor']
+  tags: ['security', 'apparmor']
+  when: ansible_facts['distribution'] == 'Ubuntu'
+
 - name: Configure OS repositories (mirrors, performance)
   ansible.builtin.include_tasks:
     file: repository.yml