nocore everywhere

Reviewed-on: #4

.gitignore

@@ -1,3 +1,3 @@
 .aider*
-dishes/
+# dishes/
-!dishes/
+# !dishes/

dishes/desktop-hypervisor-amdcpu.cfg

@@ -3,7 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -17,9 +17,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved,libvirtd"
 # System timezone
@@ -230,7 +230,7 @@ echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add s
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 NetworkManager-wifi

dishes/desktop-hypervisor-intelcpu-intelgpu.cfg

@@ -3,7 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -17,9 +17,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved,libvirtd"
 # System timezone
@@ -240,7 +240,7 @@ echo "vfio-mdev" > /mnt/sysimage/etc/modules-load.d/vfio-mdev.conf # Load specif
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 NetworkManager-wifi

dishes/desktop-hypervisor-intelcpu.cfg

@@ -3,7 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -17,9 +17,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved,libvirtd"
 # System timezone
@@ -230,7 +230,7 @@ echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 NetworkManager-wifi

dishes/desktop-hypervisor.cfg

@@ -3,7 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -17,9 +17,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved,libvirtd"
 # System timezone
@@ -222,7 +222,7 @@ mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso image
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 NetworkManager-wifi

dishes/desktop.cfg

@@ -3,7 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -17,9 +17,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved"
 # System timezone
@@ -129,7 +129,7 @@ glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 NetworkManager-wifi

dishes/live-desktop-hypervisor.cfg

@@ -1,7 +1,7 @@
 # Generated by pykickstart v3.62
 #version=DEVEL
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -15,9 +15,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved,libvirtd"
 # System timezone
@@ -278,7 +278,7 @@ mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso image
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 @anaconda-tools
 NetworkManager
 NetworkManager-config-connectivity-fedora

dishes/live-desktop.cfg

@@ -1,7 +1,7 @@
 # Generated by pykickstart v3.62
 #version=DEVEL
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -15,9 +15,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved"
 # System timezone
@@ -185,7 +185,7 @@ glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 @anaconda-tools
 NetworkManager
 NetworkManager-config-connectivity-fedora

dishes/live-server-hypervisor.cfg

@@ -1,7 +1,7 @@
 # Generated by pykickstart v3.62
 #version=DEVEL
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -15,9 +15,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved,libvirtd"
 # System timezone
@@ -130,7 +130,7 @@ mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso image
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 @anaconda-tools
 NetworkManager
 NetworkManager-config-connectivity-fedora

dishes/live-server.cfg

@@ -1,7 +1,7 @@
 # Generated by pykickstart v3.62
 #version=DEVEL
 # Firewall configuration
-firewall --disabled
+firewall --enabled
 # Run the Setup Agent on first boot
 firstboot --reconfig
 # Keyboard layouts
@@ -15,9 +15,9 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 #Root password
-rootpw --plaintext 1234
+rootpw --lock
 # SELinux configuration
-selinux --disabled
+selinux --enforcing
 # System services
 services --enabled="NetworkManager,systemd-resolved"
 # System timezone
@@ -100,7 +100,7 @@ sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 @anaconda-tools
 NetworkManager
 NetworkManager-config-connectivity-fedora

dishes/virtual-desktop-hypervisor.cfg

@@ -3,9 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled --service=ssh
-# Run the Setup Agent on first boot
-firstboot --reconfig
 # Keyboard layouts
 keyboard --xlayouts='ch (fr)'
 # System language
@@ -17,7 +15,7 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 # Root password
-rootpw --plaintext 1234
+rootpw --plaintext --allow-ssh 1234
 # SELinux configuration
 selinux --disabled
 # System services
@@ -39,27 +37,6 @@ part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winn
 part /boot --fstype="ext4" --size=512 --label=boot
 part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit"
 
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
 %post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
 
 # cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
@@ -222,7 +199,7 @@ mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso image
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 NetworkManager-wifi
@@ -250,7 +227,6 @@ generic-release-notes
 glibc
 gnome-backgrounds.noarch
 gnome-control-center
-gnome-initial-setup
 gnome-shell
 gnome-terminal
 hostname

dishes/virtual-desktop.cfg

@@ -3,9 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled --service=ssh
-# Run the Setup Agent on first boot
-firstboot --reconfig
 # Keyboard layouts
 keyboard --xlayouts='ch (fr)'
 # System language
@@ -17,7 +15,7 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 # Root password
-rootpw --plaintext 1234
+rootpw --plaintext --allow-ssh 1234
 # SELinux configuration
 selinux --disabled
 # System services
@@ -39,27 +37,6 @@ part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winn
 part /boot --fstype="ext4" --size=512 --label=boot
 part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit"
 
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
 %post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
 
 # cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
@@ -129,7 +106,7 @@ glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 NetworkManager-wifi
@@ -157,7 +134,6 @@ generic-release-notes
 glibc
 gnome-backgrounds.noarch
 gnome-control-center
-gnome-initial-setup
 gnome-shell
 gnome-terminal
 hostname

dishes/virtual-server-hypervisor.cfg

@@ -3,9 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled --service=ssh
-# Run the Setup Agent on first boot
-firstboot --reconfig
 # Keyboard layouts
 keyboard --xlayouts='ch (fr)'
 # System language
@@ -17,7 +15,7 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 # Root password
-rootpw --plaintext 1234
+rootpw --plaintext --allow-ssh 1234
 # SELinux configuration
 selinux --disabled
 # System services
@@ -37,13 +35,6 @@ part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winn
 part /boot --fstype="ext4" --size=512 --label=boot
 part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit"
 
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
 %post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
 
 # Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
@@ -74,7 +65,7 @@ mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso image
 
 %end
 
-%packages --exclude-weakdeps
+%packages --nocore --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 audit
@@ -98,7 +89,6 @@ generic-release-common
 generic-release-notes
 glibc
 hostname
-initial-setup
 iproute
 iputils
 kbd

dishes/virtual-server.cfg

@@ -3,9 +3,7 @@
 # Use text mode install
 text
 # Firewall configuration
-firewall --disabled
+firewall --enabled --service=ssh
-# Run the Setup Agent on first boot
-firstboot --reconfig
 # Keyboard layouts
 keyboard --xlayouts='ch (fr)'
 # System language
@@ -17,7 +15,7 @@ shutdown
 repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
 repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
 # Root password
-rootpw --plaintext 1234
+rootpw --plaintext --allow-ssh 1234
 # SELinux configuration
 selinux --disabled
 # System services
@@ -37,14 +35,7 @@ part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winn
 part /boot --fstype="ext4" --size=512 --label=boot
 part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit"
 
-%post --logfile=/mnt/sysimage/root/post.log
+%packages --nocore --exclude-weakdeps
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%packages --exclude-weakdeps
 NetworkManager
 NetworkManager-config-connectivity-fedora
 audit
@@ -68,7 +59,6 @@ generic-release-common
 generic-release-notes
 glibc
 hostname
-initial-setup
 iproute
 iputils
 kbd

ingredients/base-desktop-gnome.cfg

@@ -1,6 +1,6 @@
 xconfig --startxonboot --defaultdesktop=GNOME # Start the display session on boot. Although it says --startx, which seems to imply xorg, it is actually generic and thus works also with Wayland.
 
-%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak dependencies
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 gnome-shell # the version 3 of the GNOME desktop environment, without any presintalled applications
 gnome-terminal # install the default terminal for GNOME Shell

ingredients/base-desktop-virtual-machine-manager.cfg

@@ -1,4 +1,4 @@
-%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 virt-manager # Install virt-manager, a graphical front-end for QEMU/KVM
 

ingredients/base-guest-agents.cfg

@@ -1,4 +1,4 @@
-%packages --exclude-weakdeps # Beginning of the packages section. Does not include weak dependencies.
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 qemu-guest-agent # "QEMU guest agent" The qemu-guest agent is unnecessary for a bare-metal system. However, it is included here to cover cases where this kickstart file is used to deploy a virtual machine 
 spice-vdagent # "Agent for Spice guests" The spice agent is unnecessary for a bare-metal system. However, it is included here to cover cases where this kickstart file is used to deploy a virtual machine 

ingredients/base-hypervisor.cfg

@@ -1,6 +1,6 @@
 services --enabled="NetworkManager,systemd-resolved,libvirtd" # Without libvirtd here, it appears the service won't automatically start
 
-%packages --exclude-weakdeps # Beginning of the packages section. Does not include weak dependencies.
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 qemu-kvm # QEMU metapackage for KVM support
 libvirt # Library providing a simple virtualization API

ingredients/core-initial-setup-desktop.cfg

@@ -1,6 +1,6 @@
 firstboot --enable --reconfig # Initial Setup will start after the first reboot
 
-%packages --exclude-weakdeps # Beginning of the packages section. Do not include weak dependencies.
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 gnome-initial-setup # Add GNOME initial setup too to let user create local account.
 

ingredients/core-initial-setup-server.cfg

@@ -1,6 +1,6 @@
 firstboot --enable --reconfig # Enable the Setup Agent to start at boot time in reconfiguration mode. This mode enables the language, mouse, keyboard, root password, security level, time zone, and networking configuration options in addition to the default ones
 
-%packages --exclude-weakdeps # Beginning of the packages section. Do not include weak dependencies
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 initial-setup # Initial setup package
 

ingredients/core-packages-default.cfg

@@ -1,4 +1,4 @@
-%packages --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies. Description courtesy of the Fedora project
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 # Default packages fom core dnf group not marked as mandatory (`dnf group info --hidden core`)
 NetworkManager # Network connection manager and user applications

ingredients/core-packages-hardware-support.cfg

@@ -7,7 +7,7 @@
 #
 # Provides extended hardware support
 
-%packages --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 # hardware-support group. Mandatory packages # Provides extended hardware support, and especially extra wireless drivers
 alsa-sof-firmware # Audio drivers and firmware for ALSA. Essential for audio functionality.

ingredients/core-packages-mandatory.cfg

@@ -8,7 +8,7 @@
 # Provides the mandatory packages that are part of the core DNF group
 # More information: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#id240
 
-%packages --ignoremissing --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies. Description courtesy of the Fedora project
+%packages --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies or the core packages. Description courtesy of the Fedora project
 
 # Mandatory packages found in hidden `core` group (`dnf group info --hidden core`)
 audit # User space tools for kernel auditing

ingredients/core-security-off.cfg

@@ -1,3 +1,3 @@
-rootpw --plaintext 1234 # Root account is enabled with weak password
+rootpw --plaintext 1234 --allow-ssh # Root account is enabled with weak password and allow ssh
 selinux --disabled # Disable SELinux
-firewall --disabled # Disable firewall
+firewall --enabled --ssh # Reject incoming connections that are not in response to outbound requests except SSH

ingredients/core-security-on.cfg

@@ -1,3 +1,3 @@
 rootpw --lock # No root login from the console
-selinux --enabled # Enable SELinux
+selinux --enforcing # Set SELinux to enforcing mode
 firewall --enabled # Enable firewall

recipes/desktop-hypervisor-amdcpu.cfg

@@ -11,7 +11,7 @@
 %include ../ingredients/core-storage.cfg # Storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/desktop-hypervisor-intelcpu-intelgpu.cfg

@@ -12,7 +12,7 @@
 %include ../ingredients/core-storage.cfg # ext4-based storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/desktop-hypervisor-intelcpu.cfg

@@ -11,7 +11,7 @@
 %include ../ingredients/core-storage.cfg # ext4-based storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/desktop-hypervisor.cfg

@@ -11,7 +11,7 @@
 %include ../ingredients/core-storage.cfg # ext4-based storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/desktop.cfg

@@ -11,7 +11,7 @@
 %include ../ingredients/core-storage.cfg # ext4-based storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/live-desktop-hypervisor.cfg

@@ -11,7 +11,7 @@
 %include ../ingredients/live-core-storage.cfg # For live systems only
 %include ../ingredients/live-core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/live-desktop.cfg

@@ -11,7 +11,7 @@
 %include ../ingredients/live-core-storage.cfg # For live systems only
 %include ../ingredients/live-core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/live-server-hypervisor.cfg

@@ -11,7 +11,7 @@
 %include ../ingredients/live-core-storage.cfg # For live systems only
 %include ../ingredients/live-core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/live-server.cfg

@@ -11,7 +11,7 @@
 %include ../ingredients/live-core-storage.cfg # For live systems only
 %include ../ingredients/live-core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-on.cfg # Lock root account, enable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 

recipes/virtual-desktop-hypervisor.cfg

@@ -5,20 +5,18 @@
 #  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
 # /_/          /____/
 
-# A recipe for virtual desktop hypervisor
+# Unsafe. Development-only. A recipe for a virtual desktop hypervisor
 
 %include ../ingredients/core.cfg # Text mode
 %include ../ingredients/core-storage.cfg # ext4-based storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-off.cfg # Enable root account, disable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 
 %include ../ingredients/core-packages-default.cfg # Default but not necessary packages
 %include ../ingredients/core-fedora-repo-43.cfg # Offical repositories for Fedora
-%include ../ingredients/core-post.cfg # Triggered after the installation
-%include ../ingredients/core-initial-setup-desktop.cfg # OEM setup for GNOME Shell
 %include ../ingredients/base-desktop-gnome.cfg # A GNOME Shell-based desktop environment
 %include ../ingredients/base-desktop-virtual-machine-manager.cfg # Virtual Machine Manager
 %include ../ingredients/base-hypervisor.cfg # Base hypervisor

recipes/virtual-desktop.cfg

@@ -5,19 +5,17 @@
 #  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
 # /_/          /____/
 
-# A recipe for a virtual desktop
+# Unsafe. Development-only. A recipe for a virtual desktop
 
 %include ../ingredients/core.cfg # Text mode
 %include ../ingredients/core-storage.cfg # ext4-based storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-off.cfg # Enable root account, disable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 
 %include ../ingredients/core-packages-default.cfg # Default but not necessary packages
 %include ../ingredients/core-fedora-repo-43.cfg # Offical repositories for Fedora
-%include ../ingredients/core-post.cfg # Triggered after the installation
-%include ../ingredients/core-initial-setup-desktop.cfg # OEM setup for GNOME Shell
 %include ../ingredients/base-desktop-gnome.cfg # A GNOME Shell-based desktop environment
 %include ../ingredients/base-guest-agents.cfg # Guest agents

recipes/virtual-server-hypervisor.cfg

@@ -5,19 +5,17 @@
 #  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
 # /_/          /____/
 
-# A recipe for a virtual headless hypervisor
+# # Unsafe. Development-only. A recipe for a virtual headless hypervisor
 
 %include ../ingredients/core.cfg # Text mode
 %include ../ingredients/core-storage.cfg # ext4-based storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-off.cfg # Enable root account, disable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 
 %include ../ingredients/core-packages-default.cfg # Default but not necessary packages
 %include ../ingredients/core-fedora-repo-43.cfg # Offical repositories for Fedora
-%include ../ingredients/core-post.cfg # Triggered after the installation
-%include ../ingredients/core-initial-setup-server.cfg # For headless systems
 %include ../ingredients/base-hypervisor.cfg # Base hypervisor
 %include ../ingredients/base-guest-agents.cfg # Guest agents

recipes/virtual-server.cfg

@@ -5,18 +5,16 @@
 #  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
 # /_/          /____/
 
-# A recipe for a virtual desktop
+# # Unsafe. Development-only. A recipe for a virtual server
 
 %include ../ingredients/core.cfg # Text mode
 %include ../ingredients/core-storage.cfg # ext4-based storage configuration
 %include ../ingredients/core-bootloader-grub.cfg # Set bootloader to GRUB
 %include ../ingredients/core-locale.cfg # System locale set to Swiss French as keyboard layout and English as language
-%include ../ingredients/core-security-off.cfg # Lock root account, disable firewall and SELinux
+%include ../ingredients/core-security-off.cfg # Enable root account, disable firewall and SELinux
 %include ../ingredients/core-services.cfg # Required systemd services
 %include ../ingredients/core-network.cfg # Network configuration
 %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages 
 %include ../ingredients/core-packages-default.cfg # Default but not necessary packages
 %include ../ingredients/core-fedora-repo-43.cfg # Offical repositories for Fedora
-%include ../ingredients/core-post.cfg # Triggered after the installation
-%include ../ingredients/core-initial-setup-server.cfg # For headless systems
 %include ../ingredients/base-guest-agents.cfg # Guest agents

scripts/deploy-distro.sh

@@ -4,6 +4,28 @@
 DEFAULT_MEMORY=4096
 DEFAULT_DISK_SIZE=10
 
+# Function to find Fedora ISO
+find_fedora_iso() {
+    local iso_dir="/var/lib/libvirt/isos"
+    local fedora_iso=""
+    
+    # Check if directory exists
+    if [ -d "$iso_dir" ]; then
+        # Find the first Fedora-Server*.iso file
+        fedora_iso=$(find "$iso_dir" -maxdepth 1 -name "Fedora-Server*.iso" -type f | head -n 1)
+        
+        # If found, return the full path
+        if [ -n "$fedora_iso" ] && [ -f "$fedora_iso" ]; then
+            echo "$fedora_iso"
+            return 0
+        fi
+    fi
+    
+    # Return empty if no ISO found
+    echo ""
+    return 1
+}
+
 # Prompt user for VM memory size
 read -r -p "Provide desired VM memory in MB or press Enter to keep default value of $DEFAULT_MEMORY MB): " memory_size
 memory_size=${memory_size:-$DEFAULT_MEMORY}
@@ -98,6 +120,16 @@ vm_name="${dish_name[$((choice - 1))]}"
 # Output the selected filename
 echo "You selected: $vm_name"
 
+# Find Fedora ISO or use default location
+fedora_iso=$(find_fedora_iso)
+if [ -n "$fedora_iso" ]; then
+    location_param="$fedora_iso"
+    echo "Using local ISO: $fedora_iso"
+else
+    location_param="https://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/"
+    echo "Using default online repository"
+fi
+
 # virt-install command with user-defined VM name
 virt-install \
     --connect "$uri" \
@@ -129,7 +161,7 @@ virt-install \
     --watchdog none \
     --memballoon none \
     --disk path="${disk_path}/${vm_name}.img",format=raw,bus=virtio,cache=writeback,size="$disk_size" \
-    --location=https://download.fedoraproject.org/pub/fedora/linux/releases/43/Everything/x86_64/os/ \
+    --location="$location_param" \
     --initrd-inject ./dishes/"$vm_name".cfg \
     --extra-args "inst.ks=file:/$vm_name.cfg"