mios.toml

# mios-bootstrap/mios.toml -- 'MiOS' User Profile (single source of user truth)
#
# IMPORTANT: this file is the SSOT for code, not just runtime config.
# Every .ps1 / .sh / .py in mios.git + mios-bootstrap.git that reads a
# string, verb, option, arg, var, env export, venv path, dotfile body,
# version, image ref, package name, tag, glyph, dimension, color, or
# install path resolves through Get-MiosTomlValue / mios_toml_get
# against this file (with /etc/mios + ~/.config/mios as overlays).
#
# Hardcoded literals that match a TOML-shaped value are bugs -- lift
# them. Vendor defaults are allowed only as the resolver's -Default
# argument, never as the canonical value.
#
# THIS IS THE ONE FILE YOU EDIT. Every script in 'mios.git' and
# 'mios-bootstrap.git' that needs to know your username, hostname,
# base image, AI endpoint, flatpaks, profile features, free-form
# environment variables, etc. resolves through this file via a
# three-layer overlay:
#
#     /usr/share/mios/mios.toml       (vendor defaults, baked into image; lowest)
#     /etc/mios/mios.toml             (host-local overlay, written by bootstrap)
#     ~/.config/mios/mios.toml        (per-user overlay; highest)
#
# Higher layers shadow lower layers field-by-field. Bootstrap ships THIS
# file at the repo root as the canonical user-edit copy and stages it
# into /etc/mios/mios.toml at install time. The per-user copy is seeded
# from /etc/skel/.config/mios/mios.toml at useradd -m time.
#
# Resolver: tools/lib/userenv.sh (reads all three layers, exports MIOS_*
# env vars, merges [env] table verbatim). Sourced by Justfile,
# /etc/profile.d, and any tool that needs the resolved values.
#
# Format: TOML 1.0 -- https://toml.io/en/v1.0.0.
#
# Secrets policy. password_hash, luks_passphrase, and github_pat are
# NEVER read from a checked-in copy of this file. The bootstrap
# installer prompts interactively for them and writes them to
# root-owned mode-0600 files outside this profile. Leave the fields
# empty here.

# ----------------------------------------------------------------------------
# [meta] -- version + provenance scalars consumed by every framed surface
# (dashboard banner, install help, configurator chrome, fastfetch).
# ----------------------------------------------------------------------------
[meta]
mios_version  = "0.2.4"

# ----------------------------------------------------------------------------
# [branding] -- taglines + frame chars. Per feedback_mios_messages_section_ssot.md
# frame_chars feeds every framed surface (dashboard, agreement banner, post-bootstrap
# pane). Operator-locked palette + glyph set; do not hardcode literals elsewhere.
# ----------------------------------------------------------------------------
[branding]
tagline       = "My Personal Operating System"
tagline_long  = "My Personal Operating System  --  Immutable Fedora AI Workstation"
tagline_app   = "My Personal Operating System"

[branding.dashboard]
frame_chars   = "╭─╮│╰╯"

# ----------------------------------------------------------------------------
# [terminal] -- entry-point WT MiOS app geometry + scrollback. Operator
# 2026-05-09: the MiOS app window is 80 cols x 20 rows (the entry-point
# dashboard fits in 19 rows; row 20 is the prompt). [terminal.install] is
# the install-time dashboard window (40 rows) used during phase rendering.
#
# Chrome flags (acrylic / frameless / no scrollbar / no titlebar / focus mode)
# live in [theme] below.
# ----------------------------------------------------------------------------
[terminal]
cols              = 80
rows              = 20
scrollback_rows   = 9000
frame_width       = 80
frame_height      = 19
right_margin      = 0

[terminal.install]
cols              = 80
rows              = 40

# Reading mode -- larger centered window for outputs that don't fit in
# the canonical 80x20 portal (btop, long log tails, code review,
# multi-pane fastfetch, etc). `mios reading` resizes + re-centers the
# CURRENT MiOS window to these dims; `mios portal` flips it back to
# [terminal].cols/.rows. btop's launcher invokes `mios reading`
# automatically because btop's hardcoded minimum is 80x24 -- WSLg's
# effective viewport at the portal-size 80x20 is 75x18, below the
# minimum, so btop refuses to render.
[terminal.reading]
cols              = 100
rows              = 50

# Interactive-shell startup. The Windows pwsh profile body and the
# Linux bash login dotfile each invoke ONE thing on console spawn:
# the verb here, dispatched through the unified `mios <verb>`
# entry. Profile bodies do NOT inline-print anything (no
# Write-Host / no echo banners) -- the verb command is what
# renders. This keeps the profile a thin function-definition layer
# and makes "what shows up when I open MiOS" a single TOML edit.
#
# Vendor default = `mios mini` -- the compact framed banner +
# fastfetch info dashboard that fits inside the 80x20 portal. The
# FULL `mios dash` invocation (ASCII banner + per-service status +
# extended sys specs) is reserved for explicit operator-triggered
# render -- it doesn't fit in 80x20 and would push the prompt
# off-viewport on every shell spawn.
#
# Operators who want a silent shell set this to "" -- the profile
# body becomes truly inert. Operators who want a different first
# impression point it at any other MiOS verb (e.g. `mios help`).
#
# Same TOML key drives Windows pwsh + Linux bash. Per-platform
# overrides: [terminal.startup].windows / [terminal.startup].linux
# win over the global `verb` key if set. SSOT remains mios.toml --
# `mios update` re-bakes the startup verb dispatch on next bootstrap.
[terminal.startup]
verb              = "mini"
windows           = "mini"
linux             = "mini"

# Minimum window size for WSLg-hosted GUI apps. Read by
# M:\MiOS\bin\mios-gui-watch.ps1 -- a background daemon that polls
# msrdc.exe processes and auto-resizes any newly-spawned RDP-RAIL
# window smaller than these dims to exactly these dims, centered
# on the cursor monitor.
#
# Operator 2026-05-10: months of "GUI windows never render" was
# actually "windows render at native X11 default sizes (e.g.
# 129x113 for xeyes) at arbitrary positions and look invisible
# against acrylic/transparent backgrounds." Force-resizing tiny
# windows to a sane minimum makes them findable.
#
# Once a window is auto-adopted (resized once) the operator can
# drag/resize freely -- the daemon only touches each window's
# initial spawn frame.
[terminal.gui_min]
# Vendor default sized for a ~3000x1700 work area (typical 1440p/QHD or
# 4K with 1.5x scaling); covers ~55% width and 60% height -- comfortable
# to read + manage without dominating the desktop. Operator override
# in ~/.config/mios/mios.toml or /etc/mios/mios.toml.
width             = 1600
height            = 1000

# ----------------------------------------------------------------------------
# [theme] -- WT MiOS profile chrome. Per feedback_mios_terminal_global_chrome.md
# the look is acrylic 50% transparent + frameless + no scrollbar + no titlebar
# + focus mode + bar cursor. Both useAcrylic + systemBackdrop are set so WT
# 1.16-1.18+ all render correctly. Apply per-profile only (don't pollute
# operator's other WT profiles).
# ----------------------------------------------------------------------------
[theme]
acrylic           = true
opacity           = 50
system_backdrop   = "acrylic"
scrollbar_state   = "hidden"
padding           = "0"
launch_mode       = "focus"
cursor_shape      = "vintage"     # steady half-block (operator 2026-05-10: make terminal cursor thicker -- thin "bar" was almost too thin on 4K)

[theme.font]
family            = "GeistMono Nerd Font Mono"
size              = 12
weight            = "normal"
cell_w_px         = 10
cell_h_px         = 20
chrome_w_px       = 20
chrome_h_px       = 12

[theme.terminal]
scheme_name           = "MiOS"
profile_name          = "MiOS-WIN"
dev_profile_name      = "MiOS-DEV"
hub_target_profile    = "MiOS-DEV"
summon_keys           = "win+space"
summon_window_name    = "MiOS-DEV"

# Powerline glyphs feeding the rounded-powerline omp.json template at install
# time. Lift any hardcoded .. in omp templates to references here.
[theme.prompt]
powerline_left        = ""
powerline_right       = ""
leading_diamond       = ""
trailing_diamond      = ""

# ----------------------------------------------------------------------------
# [apps] -- native Windows app surface (Start Menu + Desktop + Pin to Start).
# AUMID controls Win11 taskbar grouping + Pin-to-Start identity.
# ----------------------------------------------------------------------------
[apps]
aumid                = "MiOS.Workstation"
start_menu_folder    = "MiOS"
hub_shortcut_name    = "MiOS"

# ----------------------------------------------------------------------------
# [identity] -- Linux account, hostname, GECOS, login shell, group membership.
# Maps to MIOS_USER, MIOS_HOSTNAME, MIOS_USER_FULLNAME, MIOS_USER_SHELL,
# MIOS_USER_GROUPS.
# ----------------------------------------------------------------------------
[identity]
username  = "mios"
fullname  = "'MiOS' User"
hostname  = "mios"
shell     = "/bin/bash"
groups    = ["wheel", "libvirt", "kvm", "video", "render", "input", "dialout", "docker"]

# ----------------------------------------------------------------------------
# [locale] -- system-wide defaults applied via systemd-localed at first boot.
# Maps to MIOS_TIMEZONE, MIOS_KEYBOARD, MIOS_LOCALE.
# ----------------------------------------------------------------------------
[locale]
timezone        = "UTC"
keyboard_layout = "us"
language        = "en_US.UTF-8"

# ----------------------------------------------------------------------------
# [auth] -- credential and SSH key policy.
#   ssh_key_action: generate | existing | skip
#   password_policy: interactive | hashed | none
#     - interactive : prompt at install (recommended)
#     - hashed      : use the literal hash in password_hash (openssl passwd -6)
#     - none        : no password set; useful for kiosk / CI builds
# All secret fields stay empty in any tracked copy of this file.
# ----------------------------------------------------------------------------
[auth]
ssh_key_type     = "ed25519"
ssh_key_action   = "generate"
existing_ssh_key = ""
password_policy  = "interactive"
password_hash    = ""           # never tracked; bootstrap writes mode-0600
luks_passphrase  = ""           # never tracked; FHS installer + LUKS only
github_pat       = ""           # never tracked; configures git credential helper

# ----------------------------------------------------------------------------
# [network] -- firewalld posture.
# Defaults match SECURITY.md (default zone "drop", ssh + cockpit allowed).
# ----------------------------------------------------------------------------
[network]
firewalld_default_zone = "drop"
allow_ssh              = true
allow_cockpit          = true   # opens 9090/tcp
allow_libvirt_bridge   = true   # for VM networking

# ----------------------------------------------------------------------------
# [ports] -- SSOT for the canonical MiOS service ports. Used by:
#   * 15-render-quadlets.sh    -- substitutes MIOS_PORT_* env vars into
#                                 Quadlet PublishPort= lines at image build.
#   * build-mios.ps1 Phase 4   -- adds Windows Firewall inbound rules so
#                                 LAN devices (phone, laptop, etc) can
#                                 reach the dev VM's services.
#   * mios.html configurator   -- editable knobs for operator overrides.
# Each port is TCP. IPv4-bound (0.0.0.0:NNNN) inside the dev VM; WSL2's
# mirrored networking makes them reachable on Windows' all interfaces.
# ----------------------------------------------------------------------------
[ports]
forge       = 3000     # Forgejo (self-hosted Forgejo Forge git+CI surface)
webui       = 3030     # Open WebUI (operator-facing chat / agent UI)
ai          = 8080     # LocalAI (OpenAI-compatible /v1 endpoint)
hermes      = 8642     # Hermes-Agent OpenAI-compatible gateway
searxng     = 8888     # SearXNG meta-search (Hermes web_search tool)
cockpit     = 9090     # Cockpit web console (TLS; self-signed)
ollama      = 11434    # Ollama HTTP API (raw model server)

# [ports.lan_firewall] -- Windows Firewall rule scope for the ports above.
# profiles: which Windows Firewall profiles get the inbound TCP allow rule.
#   "Private"  -- home / personal LAN
#   "Domain"   -- AD-joined corporate LAN
#   "Public"   -- coffee-shop wifi / airports (DEFAULT-EXCLUDED for security:
#                 Cockpit at :9090 over self-signed TLS is a juicy target on
#                 an untrusted SSID; leave this off unless you know why).
# expose: which service keys to expose. Default = every key in [ports].
#   Operator can narrow this list to lock down individual services without
#   moving the port number itself.
[ports.lan_firewall]
profiles = ["Private", "Domain"]
expose   = ["forge", "webui", "ai", "hermes", "searxng", "cockpit", "ollama"]

# ----------------------------------------------------------------------------
# [ai] -- Local AI surface (Architectural Law 5: UNIFIED-AI-REDIRECTS).
# endpoint MUST stay on localhost; vendor cloud URLs are forbidden by audit
# (postcheck #12 enforces this in the active config).
# Maps to MIOS_AI_ENDPOINT, MIOS_AI_MODEL, MIOS_AI_EMBED_MODEL, MIOS_AI_KEY,
# MIOS_SYSTEM_PROMPT_FILE, MIOS_MCP_REGISTRY.
# ----------------------------------------------------------------------------
[ai]
endpoint            = "http://localhost:8080/v1"
model               = "qwen3.5:2b"
embed_model         = "nomic-embed-text"
api_key             = ""                # empty for localhost; cloud needs a key
enable_ollama       = true
enable_localai      = true
mcp_registry        = "/usr/share/mios/ai/v1/mcp.json"
system_prompt_file  = ""                # optional override; empty = use canonical

# Host RAM-driven default model selection. The bootstrap reads detected RAM
# and picks big_ram_model (>= big_ram_gb), mid_ram_model (>= mid_ram_gb),
# or small_ram_model otherwise. Operator can override the picked model in
# [ai].model above; these thresholds are the auto-picker's table.
[ai.host_thresholds]
big_ram_gb         = 32
mid_ram_gb         = 12
big_ram_model      = "qwen3.5:14b"
mid_ram_model      = "qwen3.5:2b"
small_ram_model    = "phi4-mini:3.8b-q4_K_M"

# ----------------------------------------------------------------------------
# [containers.quadlets] -- Quadlet (.container) service auto-start lists.
#
# Operator-editable via mios.html in the browser. build-mios.ps1's
# overlay phase reads BOTH lists below and explicitly
# `systemctl start --no-block`s every named service after the Quadlet
# generator has rendered units from etc/containers/systemd/ +
# usr/share/containers/systemd/. The .service suffix is appended
# automatically -- name entries WITHOUT it.
#
# autostart : workstation-core services that come up on every fresh
#             dev VM. No operator config required beyond mios.toml.
#             Vendor default = cockpit-link + Forgejo git host +
#             SearXNG metasearch + OpenWebUI + LocalAI + Ollama.
#
# optin     : heavier / specialty services that EITHER require
#             operator-supplied config (runner-token, ceph.conf,
#             hermes/api.env, crowdsec/config.yaml) OR are heavy
#             substrates (k3s, guacamole stack, pxe-hub) that don't
#             make sense as dev-VM defaults. Add a name here to
#             flip it on; remove to keep dormant.
#
# Operator-flagged 2026-05-10: "bake into mios.toml so operators
# can edit the list -- EVERYTHING is sourced from the mios.toml
# file and edited in the mios.html in live environments browser".
# ----------------------------------------------------------------------------
[containers.quadlets]
autostart = ["mios-cockpit-link", "mios-forge", "mios-searxng", "mios-webui", "mios-ai", "ollama"]
optin     = []
# Available opt-in candidates (uncomment + add to `optin` above to enable):
#   "mios-forgejo-runner"  -- needs /etc/mios/forge/runner-token
#   "mios-k3s"             -- Kubernetes control plane (heavy on WSL)
#   "guacd"                -- Apache Guacamole daemon
#   "guacamole-postgres"   -- Postgres backend for Guacamole
#   "mios-guacamole"       -- Browser-RDP gateway (needs the 2 above)
#   "mios-ceph"            -- needs /etc/ceph/ceph.conf
#   "mios-pxe-hub"         -- PXE/iPXE boot server
#   "mios-hermes"          -- needs /etc/mios/hermes/api.env
#   "crowdsec-dashboard"   -- needs /etc/crowdsec/config.yaml

# ----------------------------------------------------------------------------
# [desktop] -- session preferences and Flatpak picks.
# desktop.flatpaks -> MIOS_FLATPAKS (comma-joined for the Containerfile arg).
# ----------------------------------------------------------------------------
[desktop]
session       = "gnome"
color_scheme  = "prefer-dark"   # libadwaita / dconf color-scheme
# PROJECT INVARIANT: applications ship STRICTLY as Flatpaks. Only system
# dependencies (drivers, daemons, libraries, kernel, container runtime,
# system services) ship as RPMs in usr/share/mios/PACKAGES.md. Add every
# user-facing app here, never to PACKAGES.md.
flatpaks      = [
    # ── GTK theme extensions (so flatpaks honor host dark theme) ──
    # Without these, every flatpak GTK app uses its bundled Adwaita
    # fallback and ignores host dconf gtk-theme=adw-gtk3-dark.
    # Operator-flagged 2026-05-10 "Nautilus STILL has olde GTK/CSS/
    # Decorations/theming" -- root cause was missing flatpak theme
    # extensions. Combined with mios.git's /etc/dconf/db/local.d/
    # 00-mios-theme + per-flatpak GTK_THEME env override these
    # produce a unified dark Adwaita look across system + flatpak.
    "org.gtk.Gtk3theme.adw-gtk3-dark",                 # the dark theme itself
    "org.gtk.Gtk3theme.adw-gtk3",                      # the light variant (for ADW_DEBUG_COLOR_SCHEME=force-light)
    # ── Default session apps ──
    "app.devsuite.Ptyxis",                             # terminal (renamed from org.gnome.Ptyxis 2026-Q1)
    # Nautilus + Epiphany: install from the FEDORA flatpak remote, NOT
    # flathub. Flathub's org.gnome.Nautilus / org.gnome.Epiphany are
    # END-OF-LIFE (pinned to GNOME 3.28 runtime, years out of date) --
    # that's why operator saw "old GTK / CSS / Decorations" on Nautilus
    # despite all the dconf + override fixes. Fedora's flatpak remote
    # tracks current GNOME (50.x as of Fedora 44+), built against the
    # current libadwaita with modern rounded-corner decorations.
    # build-mios.ps1's install loop routes any "fedora:<id>" prefix
    # through `flatpak install fedora` instead of flathub.
    # Nautilus modern: ONLY available as org.gnome.Nautilus.Devel on the
    # gnome-nightly remote (Fedora flatpak registry doesn't carry Nautilus;
    # Flathub's org.gnome.Nautilus is EOL on GNOME 3.28). Devel = nightly
    # builds against current GNOME (50.x as of 2026-05) -- modern
    # libadwaita CSS + rounded corner decorations.
    "gnome-nightly:org.gnome.Nautilus.Devel",          # file manager (gnome-nightly, current 50.x)
    "fedora:org.gnome.Epiphany",                       # default browser (Fedora flatpak, current 50.3)
    # ── App store / Flatpak management ──
    # NOTE: "org.gnome.Software" was here but Flathub returns
    # "Nothing matches" as of 2026-05 -- delisted or renamed.
    # Operators add a Flatpak browser via mios.html (e.g. Warehouse).
    "com.github.tchx84.Flatseal",                      # Flatpak permissions UI
    "com.mattjakeman.ExtensionManager",                # GNOME shell extensions (replaces gnome-tweaks)
    # ── Developer (FOSS rebuild of VS Code; only IDE shipped globally) ──
    "com.vscodium.codium",                             # VSCodium (replaces removed VSCodium RPM)
    # ── Virt GUI front-ends (libvirt/qemu daemons stay as RPMs) ──
    "org.virt_manager.Manager",                        # virt-manager (replaces RPM)
    "org.remmina.Remmina",                             # SPICE/VNC/RDP viewer (replaces virt-viewer RPM)
    # ── Gaming clients (Wine/Proton bundled inside Steam + Bottles) ──
    "com.valvesoftware.Steam",                         # Steam (replaces RPM; bundles Proton)
    "net.lutris.Lutris",                               # Lutris (replaces RPM)
    "com.usebottles.bottles",                          # Wine/DXVK/winetricks for non-Steam apps
    "io.github.dosbox_staging.dosbox-staging",         # DOSBox (replaces RPM)
    "com.github.Matoking.protontricks",                # protontricks (replaces RPM)
    # MangoHud ships as a Flatpak extension auto-pulled by Steam/Lutris/Bottles:
    "org.freedesktop.Platform.VulkanLayer.MangoHud",
]

# ----------------------------------------------------------------------------
# [image] -- image references used at every layer of the pipeline.
#   ref / branch  : Day-2 'bootc switch' target on the deployed host.
#   base          : OCI base image used by Containerfile FROM.
#   bib           : bootc-image-builder image used by 'just iso/qcow2/wsl2/...'
#   name / tag    : remote registry path + tag for 'just push'.
#   local_tag     : local podman tag for 'just build' output.
# Maps to MIOS_IMAGE_REF, MIOS_BRANCH, MIOS_BASE_IMAGE, MIOS_BIB_IMAGE,
# MIOS_IMAGE_NAME, MIOS_IMAGE_TAG, MIOS_LOCAL_TAG.
# ----------------------------------------------------------------------------
[image]
ref             = "ghcr.io/mios-dev/mios:latest"
branch          = "main"
base            = "ghcr.io/ublue-os/ucore-hci:stable-nvidia"
base_nvidia     = "ghcr.io/ublue-os/ucore-hci:stable-nvidia"
base_no_nvidia  = "ghcr.io/ublue-os/ucore-hci:stable"
bib             = "quay.io/centos-bootc/bootc-image-builder:latest"
name            = "ghcr.io/mios-dev/mios"
tag             = "latest"
local_tag       = "localhost/mios:latest"
machine_os_repo = "quay.io/podman/machine-os"
machine_os_tag  = "6.0"

# ----------------------------------------------------------------------------
# [packages] -- SSOT mapping mios.toml -> usr/share/mios/PACKAGES.md sections.
# See mios.git/usr/share/mios/mios.toml for the canonical comment block;
# this file is the bootstrap-overlay default for new installs.
# Always-skipped (regardless of selection): kernel, boot, moby, bloat,
# critical.
# ----------------------------------------------------------------------------
[packages]
sections = [
    "base", "security", "utils", "build-toolchain", "containers",
    "cockpit", "storage", "virt", "guests",
    "gpu-mesa", "gpu-nvidia", "gpu-amd-compute", "gpu-intel-compute",
    "gnome", "gnome-core-apps", "phosh",
    "ai", "k3s", "k3s-selinux-build", "cockpit-plugins-build",
    "sbom-tools", "uki", "self-build", "network-discovery", "updater",
    "wintools", "gaming", "nut", "ceph", "freeipa", "ha",
    "looking-glass-build", "android",
]

[packages.dev_overlay]
# MiOS-DEV (podman-WSL2 backend on Windows) minimal-but-complete: every
# operator/dev/security daemon + GPU CDI plumbing + GNOME Flatpak
# runtime (portals/audio/theming for WSLg-routed Flatpaks: Ptyxis,
# Nautilus, Software, Epiphany, Flatseal, VSCodium). NO full GNOME session
# (gnome-shell / GDM / control-center) -- WSLg IS the compositor.
sections = [
    "base", "security", "utils", "build-toolchain", "containers",
    "cockpit", "storage", "virt",
    "gpu-mesa", "gpu-nvidia", "gpu-amd-compute", "gpu-intel-compute",
    "gnome-flatpak-runtime",
    "ai", "sbom-tools", "self-build", "network-discovery", "updater",
    "cockpit-plugins-build", "k3s-selinux-build", "uki",
]

# ----------------------------------------------------------------------------
# [packages.<section>] -- DEFINITIVE SSOT (v0.2.4+)
#
# Edit any [packages.<section>].pkgs list below to ADD, REMOVE, or
# REPLACE packages for that section. mios-bootstrap/mios.toml IS the
# user-edit copy -- changes here apply to every MiOS host that gets
# bootstrapped from this clone, no mios.git fork needed.
#
# Resolution order (TOML doesn't merge tables -- the highest layer
# REPLACES the section field-for-field):
#   ~/.config/mios/mios.toml   per-user override     (highest)
#   /etc/mios/mios.toml        host/admin override
#   /usr/share/mios/mios.toml  vendor defaults       (lowest)
#
# To EXTEND a section without re-typing the vendor list, copy the
# vendor list and append your additions; vendor changes flow forward
# on the next bootstrap (the resolver always reads your file as a
# whole table, not as a delta).
# ----------------------------------------------------------------------------

# ─────────────────────────────────────────────────────────────────────
# [packages.*] -- DEFINITIVE SSOT for the MiOS package surface.
# Each section below is a DNF install list. The packages.sh resolver
# (automation/lib/packages.sh) consumes these tables; PACKAGES.md is
# now a documentation shim that points operators here.
# ─────────────────────────────────────────────────────────────────────

[packages.repos]
pkgs = [
    "rpmfusion-free-release-rawhide",
    "rpmfusion-nonfree-release-rawhide",
    "fedora-workstation-repositories",
    "dnf-plugins-core",
    "dnf5-plugins",
]

[packages.base]
pkgs = [
    "policycoreutils-python-utils",
    "selinux-policy-targeted",
    "firewalld",
    "audit",
    "fapolicyd",
    "crowdsec",
    "usbguard",
]

[packages.moby]
pkgs = [
    "moby-engine",
]

[packages.uki]
pkgs = [
    "systemd-ukify",
]

[packages.sbom-tools]
pkgs = [
    "syft",
]

[packages.k3s-selinux-build]
pkgs = [
    "selinux-policy-devel",
    "git",
    "make",
]

[packages.kernel]
pkgs = [
    "kernel-modules-extra",
    "kernel-devel",
    "kernel-headers",
    "kernel-tools",
    "glibc-headers",
    "glibc-devel",
    "python3",
]

[packages.gnome]
pkgs = [
    "gnome-shell",
    "gnome-session-wayland-session",
    "gnome-control-center",
    "gnome-keyring",
    "gdm",
    "gnome-remote-desktop",
    "gnome-backgrounds",
    "gnome-shell-extension-appindicator",
    "gnome-shell-extension-dash-to-dock",
    "xdg-user-dirs",
    "xdg-utils",
    "xdg-desktop-portal",
    "xdg-desktop-portal-gnome",
    "xdg-desktop-portal-gtk",
    "pipewire-alsa",
    "pipewire-pulseaudio",
    "wireplumber",
    "gstreamer1",
    "gstreamer1-plugins-base",
    "gstreamer1-plugins-good",
    "upower",
    "gnome-bluetooth",
    "bluez",
    "bluez-tools",
    "flatpak",
    "gvfs",
    "gvfs-smb",
    "gvfs-mtp",
    "NetworkManager-wifi",
    "NetworkManager-openvpn-gnome",
    "nm-connection-editor",
    "glibc-langpack-en",
    "qt6-qtbase-gui",
    "qt6-qtwayland",
    "qadwaitadecorations-qt5",
    "adw-gtk3-theme",
]

[packages.gnome-flatpak-runtime]
pkgs = [
    "xdg-user-dirs",
    "xdg-utils",
    "xdg-desktop-portal",
    "xdg-desktop-portal-gnome",
    "xdg-desktop-portal-gtk",
    "pipewire-alsa",
    "pipewire-pulseaudio",
    "wireplumber",
    "gstreamer1",
    "gstreamer1-plugins-base",
    "gstreamer1-plugins-good",
    "gvfs",
    "gvfs-smb",
    "gvfs-mtp",
    "glibc-langpack-en",
    "qt6-qtbase-gui",
    "qt6-qtwayland",
    "qadwaitadecorations-qt5",
    "adw-gtk3-theme",
    "flatpak",
]

[packages.gnome-core-apps]
pkgs = [
    # GNOME Software via Fedora repos (dnf), not Flathub. The Flathub
    # `org.gnome.Software` ID returns "Nothing matches" as of 2026-05.
    # dnf-installed gnome-software still browses Flathub apps via its
    # flatpak plugin -- same UX, vendor install channel.
    "gnome-software",
]

[packages.gpu-mesa]
pkgs = [
    "mesa-vulkan-drivers",
    "mesa-dri-drivers",
    "mesa-va-drivers",
    "vulkan-loader",
    "vulkan-tools",
    "libva-utils",
    "linux-firmware",
]

[packages.gpu-amd-compute]
pkgs = [
    "rocm-opencl",
    "rocm-hip",
    "rocm-runtime",
    "rocm-smi",
    "rocminfo",
]

[packages.gpu-intel-compute]
pkgs = [
    "intel-compute-runtime",
    "intel-media-driver",
    "intel-level-zero",
    "igt-gpu-tools",
]

[packages.gpu-nvidia]
pkgs = [
    "akmod-nvidia",
    "xorg-x11-drv-nvidia-cuda",
    "nvidia-container-toolkit",
    "nvidia-persistenced",
    "nvidia-settings",
    "xorg-x11-drv-nvidia-power",
    "nvidia-container-selinux",
]

[packages.gpu-cdi-toolkits]
pkgs = [
]

[packages.virt]
pkgs = [
    "qemu-kvm",
    "libvirt",
    "libvirt-daemon",
    "virt-install",
    "edk2-ovmf",
    "swtpm",
    "swtpm-tools",
    "dnsmasq",
    "mdevctl",
    "libguestfs-tools",
    "virt-v2v",
    "qemu-device-display-virtio-gpu",
    "virt-firmware",
    "python3-cryptography",
]

[packages.containers]
pkgs = [
    "podman",
    "podman-compose",
    "buildah",
    "skopeo",
    "bootc",
    "osbuild",
    "osbuild-composer",
    "osbuild-selinux",
    "composer-cli",
    "rpm-ostree",
    "crun",
    "netavark",
    "aardvark-dns",
    "slirp4netns",
    "composefs",
    "container-selinux",
    "qemu-img",
    "image-builder",
    "bootc-image-builder",
    "dracut-live",
    "squashfs-tools",
    "containers-common",
    "toolbox",
    "kubectl",
    "helm",
    "podman-plugins",
    "cosign",
]

[packages.build-toolchain]
pkgs = [
    "make",
    "gcc",
    "gcc-c++",
    "cmake",
    "golang",
    "selinux-policy-devel",
    "binutils",
    "pkgconf-pkg-config",
]

[packages.self-build]
pkgs = [
    "bootc-base-imagectl",
    "konflux-image-tools",
]

[packages.boot]
pkgs = [
    "bootupd",
    "dnf5-plugins",
    "systemd-boot-unsigned",
    "efibootmgr",
    "systemd-ukify",
    "binutils",
    "efitools",
    "sbsigntools",
    "tpm2-tss",
]

[packages.cockpit]
pkgs = [
    "cockpit",
    "cockpit-system",
    "cockpit-ws",
    "cockpit-bridge",
    "cockpit-storaged",
    "cockpit-networkmanager",
    "cockpit-podman",
    "cockpit-machines",
    "cockpit-ostree",
    "cockpit-selinux",
    "cockpit-files",
    "pcp",
    "pcp-system-tools",
]

[packages.wintools]
pkgs = [
    "hyperv-tools",
    "samba",
    "samba-client",
    "cifs-utils",
    "freerdp-libs",
]

[packages.security]
pkgs = [
    "crowdsec",
    "crowdsec-firewall-bouncer-nftables",
    "firewalld",
    "fapolicyd",
    "fapolicyd-selinux",
    "usbguard",
    "setroubleshoot-server",
    "policycoreutils-python-utils",
    "audit",
    "tpm2-tools",
    "clevis",
    "clevis-luks",
    "aide",
    "openscap-scanner",
    "scap-security-guide",
    "libpwquality",
    "nftables",
    "policycoreutils",
    "setools-console",
    "cosign",
    "iptables-legacy",
]

[packages.gaming]
pkgs = [
    "gamemode",
    "gnome-shell-extension-gamemode",
    "vulkan-tools",
    "steam-devices",
]

[packages.guests]
pkgs = [
    "qemu-guest-agent",
    "hyperv-daemons",
    "open-vm-tools",
    "spice-vdagent",
    "spice-webdavd",
    "libvirt-nss",
]

[packages.storage]
pkgs = [
    "nfs-utils",
    "rpcbind",
    "glusterfs",
    "glusterfs-fuse",
    "glusterfs-server",
    "ceph-common",
    "iscsi-initiator-utils",
    "targetcli",
    "device-mapper-multipath",
    "sg3_utils",
    "lvm2",
    "stratis-cli",
    "stratisd",
    "xfsprogs",
    "btrfs-progs",
    "e2fsprogs",
    "mdadm",
    "ntfs-3g",
]

[packages.ceph]
pkgs = [
    "ceph-common",
    "cephadm",
    "ceph-fuse",
    "ceph-selinux",
]

[packages.k3s]
pkgs = [
    "container-selinux",
]

[packages.ha]
pkgs = [
    "pacemaker",
    "corosync",
    "pcs",
    "fence-agents-all",
    "fence-virt",
    "resource-agents",
    "sbd",
    "booth",
    "booth-core",
    "booth-test",
    "dlm",
    "corosync-qdevice",
    "corosync-qnetd",
    "libqb",
    "libibverbs",
]

[packages.utils]
pkgs = [
    "git",
    "tmux",
    "vim-enhanced",
    "wget2-wget",
    "curl",
    "btop",
    "nvtop",
    "fastfetch",
    "lm_sensors",
    "smartmontools",
    "tuned",
    "tuned-ppd",
    "fuse",
    "fuse3",
    "7zip-standalone",
    "unzip",
    "zstd",
    "rsync",
    "tree",
    "jq",
    "yq",
    "bc",
    "patch",
    "openssl",
    "distrobox",
    "just",
    "driverctl",
    "tmt",
    "ansible-core",
    "wslu",
    "python3-pip",
    "python3-requests",
    "cloud-init",
    "libei",
    "strace",
    "lsof",
    "iotop",
    "socat",
    "syft",
    "oras-cli",
]

[packages.android]
pkgs = [
    "waydroid",
]

[packages.looking-glass-build]
pkgs = [
    "cmake",
    "gcc",
    "gcc-c++",
    "make",
    "binutils",
    "pkgconf-pkg-config",
    "libglvnd-devel",
    "fontconfig",
    "fontconfig-devel",
    "spice-protocol",
    "nettle-devel",
    "gnutls-devel",
    "libXi-devel",
    "libXinerama-devel",
    "libXcursor-devel",
    "libXpresent-devel",
    "libXScrnSaver-devel",
    "libxkbcommon-x11-devel",
    "wayland-devel",
    "wayland-protocols-devel",
    "libdecor-devel",
    "pipewire-devel",
    "libsamplerate-devel",
]

[packages.cockpit-plugins-build]
pkgs = [
    "npm",
    "gettext",
]

[packages.network-discovery]
pkgs = [
    "avahi",
    "avahi-tools",
    "nss-mdns",
]

[packages.phosh]
pkgs = [
    "phosh",
    "phoc",
    "gnome-calls",
    "feedbackd",
]

[packages.updater]
pkgs = [
    "uupd",
    "greenboot",
    "greenboot-default-health-checks",
]

[packages.freeipa]
pkgs = [
    "freeipa-client",
    "sssd",
    "sssd-tools",
    "libsss_nss_idmap",
]

[packages.ai]
pkgs = [
    "python3-openai",
    "nodejs",           # required by claude-code + gemini-cli (npm-installed)
    "npm",
]
# AI assistant CLIs installed globally via npm. ON by default --
# operator can remove from this list to skip. Each entry is an npm
# package id (passed to `npm install -g`). Installed by
# /usr/libexec/mios/install-ai-clis.sh which runs once during the
# overlay phase (build-mios.ps1) and is also re-runnable any time.
npm_globals = [
    "@anthropic-ai/claude-code",     # Anthropic Claude Code CLI
    "@google/gemini-cli",            # Google Gemini CLI
]

[packages.critical]
pkgs = [
    "gnome-shell",
    "gdm",
    "podman",
    "bootc",
    "libvirt",
    "kernel-core",
    "firewalld",
    "cockpit",
    "NetworkManager",
    "pipewire",
    "tuned",
    "chrony",
    "openssh-server",
]

[packages.bloat]
pkgs = [
    "malcontent-control",
    "malcontent-pam",
    "malcontent-tools",
    "gnome-tour",
    "gnome-initial-setup",
    "PackageKit",
    "PackageKit-command-not-found",
]

[packages.nut]
pkgs = [
    "nut",
    "nut-client",
    "nut-xml",
    "usbutils",
]


# ----------------------------------------------------------------------------
# [colors] -- MiOS unified palette. Operator neutrals (#1A407F, #E0E0E0,
# #B7C9D7, #948E8E, #734F39) + Hokusai "Great Wave" (#3E7765, #E7DFD3,
# #F35C15, #DC271B, #282262), combined into one 16-slot ANSI mapping
# applied across every console / terminal via /etc/profile.d/mios-colors.sh.
# Vendor canonical block lives at mios.git/usr/share/mios/mios.toml; this
# is the bootstrap-overlay default for first install.
# ----------------------------------------------------------------------------
[colors]
bg          = "#282262"
fg          = "#E7DFD3"
accent      = "#1A407F"
cursor      = "#F35C15"
success     = "#3E7765"
warning     = "#F35C15"
error       = "#DC271B"
info        = "#1A407F"
muted       = "#948E8E"
subtle      = "#B7C9D7"
earth       = "#734F39"
silver      = "#E0E0E0"

ansi_0_black            = "#282262"
ansi_1_red              = "#DC271B"
ansi_2_green            = "#3E7765"
ansi_3_yellow           = "#F35C15"
ansi_4_blue             = "#1A407F"
ansi_5_magenta          = "#734F39"
ansi_6_cyan             = "#B7C9D7"
ansi_7_white            = "#E7DFD3"
ansi_8_bright_black     = "#948E8E"
ansi_9_bright_red       = "#FF6B5C"
ansi_10_bright_green    = "#5FAA8E"
ansi_11_bright_yellow   = "#FF8540"
ansi_12_bright_blue     = "#3D6BA8"
ansi_13_bright_magenta  = "#9D7660"
ansi_14_bright_cyan     = "#E0E0E0"
ansi_15_bright_white    = "#FFFFFF"

# ----------------------------------------------------------------------------
# [bootstrap] -- behavior of mios-bootstrap.git/install.sh during Phase-0.
#   mode: auto | bootc | fhs
#     - auto  : detect host kind, prefer 'bootc switch' when available
#     - bootc : force 'bootc switch' (fail if not bootc-managed)
#     - fhs   : force the Total Root Merge path (clone + overlay)
# Maps to MIOS_BOOTSTRAP_MODE, MIOS_REPO_URL, MIOS_BOOTSTRAP_REPO_URL.
# ----------------------------------------------------------------------------
[bootstrap]
mode             = "auto"
mios_repo        = "https://github.com/mios-dev/mios.git"
bootstrap_repo   = "https://github.com/mios-dev/mios-bootstrap.git"
dev_distro       = "MiOS-DEV"             # WSL distro name for podman-MiOS-DEV machine
install_packages = true                   # run dnf install on PACKAGES.md after FHS overlay
reboot_on_finish = true                   # interactive y/N prompt at end of install

# Host data-disk provisioning (Initialize-DataDisk). Operator-locked at 256 GiB
# + 512 MB buffer so Windows Explorer rounds Capacity to "256 GB" not "255 GB".
# NTFS reserves ~16 MB for boot sector / alignment / $MFT.
[bootstrap.host_storage]
shrink_mb         = 262656
drive_letter      = "M"
volume_label      = "MIOS-DEV"

# Dev VM (podman-MiOS-DEV) provisioning. base_image is the Fedora bootc base
# the podman-machine VHDX is bootstrapped from before mios-build-driver
# bootc-switches it to localhost/mios:latest.
[bootstrap.dev_vm]
base_image        = "quay.io/podman/machine-os:6.0"

# ----------------------------------------------------------------------------
# [smoke_tests] -- attempts + interval the dev-VM smoketests use during
# bootstrap. Phase-3 brings up the podman-MiOS-DEV machine and runs four
# smoketests (responsive / systemd / overlay / podman API) before declaring
# the dev VM ready. Tunables live here so operators don't need to edit code.
# ----------------------------------------------------------------------------
[smoke_tests]
systemd_attempts        = 15
podman_api_attempts     = 15
interval_seconds        = 2

# ----------------------------------------------------------------------------
# [network.retry] -- backoff schedule for podman pull / git clone / curl
# retries during bootstrap. Each integer is delay-before-next-attempt in
# seconds; len(delays_seconds) = total attempts.
# ----------------------------------------------------------------------------
[network.retry]
delays_seconds          = [0, 5, 15, 30]

# ----------------------------------------------------------------------------
# [profile] -- developer-vs-server-vs-kiosk flavor and feature toggles.
# Maps to MIOS_PROFILE_ROLE, MIOS_PROFILE_FEATURES (comma-joined).
# ----------------------------------------------------------------------------
[profile]
role     = "developer"
features = ["ai", "virtualization", "k3s"]

# ----------------------------------------------------------------------------
# [quadlets.enable] -- per-Quadlet first-boot enablement flags.
# Defaults are all true; the system never disables a service via static
# config. Incompatible deployments are gated via systemd Condition*
# directives in the Quadlet itself. Set a flag to false here only to
# force-disable a service even when it would otherwise run.
# ----------------------------------------------------------------------------
[quadlets.enable]
mios-ai            = true
mios-ceph          = true
mios-k3s           = true
mios-forge         = true
crowdsec-dashboard = true
ollama             = true
cloudws-guacamole  = true
cloudws-pxe-hub    = true
guacamole-postgres = true
guacd              = true

# ----------------------------------------------------------------------------
# [env] -- free-form environment-variable additions. Keys must match POSIX
# env-var rules ([A-Za-z_][A-Za-z0-9_]*). Anything you put here is exported
# verbatim to every script that sources tools/lib/userenv.sh, so it
# propagates throughout the build / install / runtime chain.
# Examples:
#   MIOS_BUILDER_DISTRO = "MiOS-DEV"
#   MIOS_RECHUNK_MAX_LAYERS = "67"
#   MIOS_AI_GRADER = "o3"
# ----------------------------------------------------------------------------
[env]