cook: ship the fscrypt stack by default in Phyllome OS

- ingredients/repo/phyllome.ks: add the git.phyllo.me roots registry as a
  downstream repo (install-time only; the phyllome-fscrypt package owns
  /etc/yum.repos.d/phyllome.repo on the installed system)
- ingredients/packages/fscrypt.ks: install phyllome-fscrypt, which pulls
  fscrypt + pam_fscrypt via Requires
- recipe_templates: new 'fscrypt' feature mapping the two fragments
- recipes_manifest: enable fscrypt for phyllomeos and phyllomeos-headless
  (default tier, repository 44)

make lint/validate/test pass; both default dishes regenerate with the
phyllome repo and phyllome-fscrypt included.

.gitea/workflows/build-image.yaml

@@ -0,0 +1,147 @@
+name: build-image
+
+# A full build takes ~25 min on the runner and executes the checked-out code
+# as root there, so it never runs on a plain push. Recipes are still linted
+# and validated on every push and PR by ci.yml. Images are built:
+#   - on a release tag (v*.*.*): build, smoke test, publish as a release;
+#   - on a PR into main carrying the `build-image` label, i.e. once a
+#     maintainer has reviewed it (Gitea does not let authors approve their
+#     own PRs, so approval cannot be the gate). Re-runs on every new push to
+#     the PR while the label stays. Only for changes that affect images;
+#   - weekly, to catch breakage from upstream Fedora package changes;
+#   - by hand (workflow_dispatch) on any branch.
+on:
+  push:
+    tags: ["v*.*.*"]
+  pull_request:
+    branches: [main]
+    types: [labeled, synchronize, reopened]
+    paths:
+      - "cook/**"
+      - "build-image.sh"
+      - "smoke-test.sh"
+      - ".gitea/workflows/build-image.yaml"
+  schedule:
+    - cron: "0 3 * * 1" # Mondays 03:00
+  workflow_dispatch:
+
+# Builds raw disk images of the two default-tier editions (see
+# cook/recipes_manifest.yaml) with build-image.sh, i.e.
+# `livemedia-creator --no-virt --make-disk`. Other tiers (guest, experimental)
+# are built on demand with `./build-image.sh --tier <tier>`.
+#
+# The build job runs on the registered `fedora:host` runner (a Fedora VM, jobs
+# run as root), not in a container: --make-disk needs real loop devices and a
+# live systemd-udevd. The runner needs lorax-lmc-novirt, qemu-img, make,
+# python3-pip, pykickstart and xz installed, plus qemu-system-x86_64,
+# /dev/kvm and edk2-ovmf for smoke-test.sh. It must run with SELinux enabled:
+# anaconda inherits the runner's own selinux=0, if any (smoke-test.sh fails
+# such images).
+
+jobs:
+  validate:
+    # On PRs, only once the `build-image` label is set (see `on:` above), and
+    # not again when some other label is added to an already-labeled PR.
+    if: >-
+      github.event_name != 'pull_request' ||
+      (contains(github.event.pull_request.labels.*.name, 'build-image') &&
+       (github.event.action != 'labeled' || github.event.label.name == 'build-image'))
+    runs-on: fedora
+    defaults:
+      run:
+        shell: bash
+    container:
+      image: git.phyllo.me/devops/fedora-runner-image:latest
+
+    steps:
+      - uses: https://git.phyllo.me/devops/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Install Python deps
+        run: pip install -r cook/requirements.txt
+
+      - name: Generate, lint, and validate dishes
+        run: |
+          cd cook
+          make all
+
+  build-image:
+    needs: validate
+    runs-on: fedora
+    strategy:
+      fail-fast: false
+      # NB: Gitea runs every matrix entry as its own task, so `max-parallel`
+      # does not serialize them; build-image.sh takes a host-wide flock instead.
+      matrix:
+        include:
+          - edition: phyllomeos
+            root_size: 16384
+          - edition: phyllomeos-headless
+            root_size: 8192
+    defaults:
+      run:
+        shell: bash
+    env:
+      # /tmp is a small tmpfs on the runner; livemedia-creator writes the whole
+      # disk image under $TMPDIR
+      TMPDIR: /var/tmp
+
+    steps:
+      - uses: https://git.phyllo.me/devops/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Check runner prerequisites
+        run: |
+          missing=0
+          for tool in livemedia-creator qemu-img make pip xz sudo qemu-system-x86_64 debugfs; do
+            command -v "$tool" >/dev/null || { echo "missing on runner: $tool"; missing=1; }
+          done
+          [ -e /dev/loop-control ] || { echo "missing on runner: /dev/loop-control"; missing=1; }
+          [ -e /dev/kvm ] || { echo "missing on runner: /dev/kvm"; missing=1; }
+          [ -e /usr/share/edk2/ovmf/OVMF_CODE.fd ] || { echo "missing on runner: edk2-ovmf"; missing=1; }
+          [ "$missing" = 0 ] || exit 1
+
+      - name: Install Python deps
+        run: pip install -r cook/requirements.txt
+
+      - name: Build raw image
+        run: |
+          # Editions are named "<edition>_<values...>.cfg"; the trailing "_" keeps
+          # "phyllomeos" from matching "phyllomeos-headless".
+          (cd cook && make all)
+          dish="$(basename "$(ls cook/dishes/${{ matrix.edition }}_*.cfg)" .cfg)"
+          echo "DISH=$dish" >> "$GITHUB_ENV"
+          ./build-image.sh --dish "$dish" --root-size ${{ matrix.root_size }}
+
+      - name: Smoke test (static checks + boot)
+        run: ./smoke-test.sh "build/$DISH.img"
+
+      - name: Compress image
+        run: xz -T0 "build/$DISH.img"
+
+      - name: Upload image and kickstart as artifact
+        if: "!startsWith(github.ref, 'refs/tags/')"
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ matrix.edition }}
+          path: |
+            build/${{ env.DISH }}.img.xz
+            cook/dishes/${{ env.DISH }}.cfg
+          if-no-files-found: error
+          retention-days: 7
+
+      - name: Publish image and kickstart as release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: https://git.phyllo.me/devops/action-gh-release@v2
+        with:
+          files: |
+            build/${{ env.DISH }}.img.xz
+            cook/dishes/${{ env.DISH }}.cfg
+          draft: false
+          prerelease: false
+
+      - name: Clean up build products
+        if: always()
+        run: rm -rf build /var/tmp/lmc-result.*

.gitea/workflows/build-iso.yaml

@@ -1,76 +0,0 @@
-name: release
-
-on: 
-  push:
-    branches:
-      - main  # Or your desired branch
-
-jobs:
-  checkout:
-    runs-on: fedora-cloud-42
-    defaults:
-      run:
-        shell: bash
-    container: 
-      image: git.phyllo.me/devops/fedora-runner-image:latest
-
-    steps:
-      - uses: https://git.phyllo.me/devops/checkout@v5
-        with:
-          fetch-depth: 0
-   
-      - name: Initialize mock
-        run: |
-          mock -r fedora-43-x86_64 --init
-
-      - name: Install required packages
-        run: |
-          mock -r fedora-43-x86_64 --install lorax-lmc-novirt vim-minimal pykickstart livecd-tools
-
-      - name: Copy configuration file to mock
-        run: |
-          mock -r fedora-43-x86_64 --copyin dishes/live-server.cfg /builddir
-
-      - name: Build ISO with livemedia-creator
-        run: |
-          mock -r fedora-43-x86_64 --shell --enable-network --isolation=simple << 'EOF'
-          cd /builddir
-          livemedia-creator --ks live-server.cfg --no-virt --resultdir /var/lmc --project live-desktop-hypervisor --make-iso --volid live-desktop-hypervisor --iso-only --iso-name server-43.iso --releasever 43 --macboot
-          EOF
-
-      - name: Upload ISO as artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: server-43.iso
-          path: /var/lmc/server-43.iso
-          if-no-files-found: error
-
-      - name: Create Release
-        if: github.ref == 'refs/heads/main'
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: iso-build-${{ github.run_number }}
-          release_name: ISO Build ${{ github.run_number }}
-          body: |
-            Build artifact from workflow run ${{ github.run_number }}
-            ISO file: server-43.iso
-          draft: false
-          prerelease: false
-
-      - name: Upload ISO to Release
-        if: github.ref == 'refs/heads/main'
-        uses: actions/upload-release-asset@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: /var/lmc/server-43.iso
-          asset_name: server-43.iso
-          asset_content_type: application/x-iso9660-image
-
-      - name: Cleanup mock environment
-        if: always()
-        run: |
-          mock -r fedora-43-x86_64 --clean

.gitea/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  # Bump when the recipe language changes; both jobs share the runner.
+  cook:
+    runs-on: fedora
+    defaults:
+      run:
+        shell: bash
+    container:
+      image: git.phyllo.me/devops/fedora-runner-image:latest
+    steps:
+      - uses: https://git.phyllo.me/devops/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Install Python deps
+        run: pip install -r cook/requirements.txt
+      - name: Lint manifest + templates
+        run: make -C cook lint
+      - name: Generate recipes + dishes, validate every dish
+        run: make -C cook all
+      - name: Run the pytest suite
+        run: make -C cook test

.gitignore

@@ -1 +1,15 @@
-.aider*
+# Generated build products (created by `make all` in cook/)
+cook/recipes/*.cfg
+cook/dishes/*.cfg
+
+# Generated build products (created by build-image.sh)
+build/
+
+# Python
+__pycache__/
+*.py[cod]
+.pytest_cache/
+# Build artifacts (livemedia-creator side effects)
+anaconda/
+livemedia.log
+program.log

README.md

@@ -7,188 +7,182 @@ Provided that some dependencies are met (`libvirt` is running on your computer,
 - Make the script executable:
 
 ```
-chmod +x deploy-vm.sh
+chmod +x deploy.sh
 ```
 
-- Execute it and pick `virtual-desktop-hypervisor` when prompted:
+- Execute it and pick a dish when prompted (by default the two Phyllome OS editions; see [Editions and tiers](#editions-and-tiers)). The example below is from an earlier, larger matrix:
 
 ```
-./deploy-vm.sh
+./deploy.sh
 
-Executing: ./scripts/core-count.sh
+Executing: ./deploy/core-count.sh
 System has more than 2 core (nproc --all: 6).
 [...]
-10. virtual-desktop-hypervisor
+Available files:
+1. desktop_44_standard_grub_gnome
 [...]
-Enter the number of the file you want to select: 10
-You selected: virtual-desktop-hypervisor
+8. desktop_44_standard_grub_gnome_guest-agents
+[...]
+Enter the number of the file you want to select: 8
+You selected: desktop_44_standard_grub_gnome_guest-agents
 
 Starting install...
 Retrieving 'vmlinuz'                                                                                     |  16 MB  00:00:00     
 Retrieving 'initrd.img'                                                                                  | 161 MB  00:00:05     
 Allocating 'virtinst-n0km88yy-vmlinuz'                                                                   |  16 MB  00:00:00     
-Transferring 'virtinst-n0km88yy-vmlinuz'                                                                 |  16 MB  00:00:00     
-Allocating 'virtinst-qxr2jxcb-initrd.img'                                                                | 161 MB  00:00:00     
 Transferring 'virtinst-qxr2jxcb-initrd.img'                                                              | 161 MB  00:00:00     
-Allocating 'virtual-desktop-hypervisor.img'                                                              |  10 GB  00:00:00     
+Allocating 'desktop_44_standard_grub_gnome_guest-agents.img'                                             |  10 GB  00:00:00     
 Creating domain...                              
 ```
+
+`deploy.sh` regenerates the `recipes` and `dishes` (they are build products) before deploying. Pass `--tier guest` to deploy a plain Fedora server or desktop VM on a Phyllome OS host instead.
 After a successfull installation, the virtual machine will shutdown and be ready to use when powered on again.
 
+## Editions and tiers
+
+The repo ships a recipe to deploy Phyllome OS on a target host, not a general-purpose kickstart collection. Only two dishes are generated by default (Fedora 44, UEFI, systemd-boot, both with hardware support and guest agents so they also run as VMs):
+
+| Dish (prefix) | What it is |
+|---|---|
+| `phyllomeos` | Phyllome OS with a GUI (GNOME + virt-manager) |
+| `phyllomeos-headless` | Headless Phyllome OS |
+
+Every group in `cook/recipes_manifest.yaml` belongs to a *tier*, and only the requested tier is generated:
+
+| Tier | Contents | Build with |
+|---|---|---|
+| `default` | the two editions above | `make all` |
+| `guest` | `guest-server`, `guest-desktop`: Fedora VMs to deploy on a Phyllome OS host | `make all TIER=guest` |
+| `experimental` | single hand-written variants to try new dishes (BIOS/GRUB, encrypted root, rawhide) | `make all TIER=experimental` |
+
+`TIER=all` (or `TIER="default guest"`) combines tiers; `deploy.sh` and `build-image.sh` take `--tier`. Lint always covers every tier, so inactive tiers cannot rot. To test a new dish, add one variant (no list-valued matrices) to an `experimental` group.
+
+## Building a disk image (no libvirt/virt-install)
+
+`deploy.sh` drives a live `virt-install`/libvirt session. If you just want a
+raw or qcow2 disk image — e.g. to hand to another VM manager such as
+wonder-vm via virtpull's `virtpull local ... --wonder-vm NAME` —
+use `build-image.sh` instead. It runs `livemedia-creator --no-virt
+--make-disk` directly on the host, producing a disk image instead of a
+bootable ISO:
+
+```
+./build-image.sh [--dish NAME] [--tier TIER] [--as qcow2] [--root-size MiB] [--extra-ks FILE]
+```
+
+It picks a dish the same way `deploy.sh` does (or takes `--dish NAME`) and writes the result under
+`./build/`. `smoke-test.sh IMAGE` then checks the result: read-only static checks (no `selinux=0` on any kernel command line and labeled files when the image declares SELinux; builds on a host with SELinux disabled fail this), then a KVM boot with `-snapshot` that waits for qemu-guest-agent to answer.
+
+The `build-image` CI workflow builds, smoke-tests and compresses both default editions. It does not run on plain pushes (a build takes ~25 min and runs as root on the runner); `ci.yml` lints and validates every push instead. It runs on:
+
+* `v*.*.*` tags: attaches the compressed raw images (`.img.xz`) and the flattened kickstart files to the release;
+* PRs into `main` labeled `build-image` (set it once the PR is reviewed; it re-runs on every new push while the label stays), for changes under `cook/`, to `build-image.sh`, `smoke-test.sh` or the workflow itself;
+* a weekly schedule (Mondays 03:00), to catch breakage from upstream Fedora packages;
+* manual dispatch from the Actions tab, on any branch.
+
+Non-tag runs keep the images as 7-day workflow artifacts. Requires `lorax-lmc-novirt` (heavier than `deploy.sh`'s plain
+QEMU/libvirt prerequisites, not installed by
+`deploy/install-prerequisites-on-linux.sh`) and root — the `--no-virt` disk
+install needs real loop-device access (`/dev/loop-control`), which a
+`mock` chroot cannot provide (no live `systemd-udevd` inside it, which
+breaks blivet's device scan) and neither can a rootless container.
+`--root-size` (default 8192 MiB) sizes the root partition, needed because
+livemedia-creator computes the image size up front, unlike virt-install
+which pre-creates the disk at a known size. `--extra-ks FILE` appends
+local content (e.g. a bespoke `user`/`rootpw` override) to the dish before
+building, without touching the tracked ingredients — see the "bespoke
+dish" pattern below; never commit a file used here if it carries real
+credentials.
+
 ## Repository structure
 
 This repository contains such files broken down as:
 
-* `ingredients`🥑 🥥 🥭 🥝 🥦 🥬 🥒 🧄: the basic building blocks for assembling Phyllome OS and other derivatives.
+* `cook/ingredients`🥑 🥥 🥭 🥝 🥦 🥬 🥒 🧄: the basic building blocks for assembling Phyllome OS and other derivatives.
 
-* `recipes`🧾 🧩: lists of ingredients to compose several editions
+* `cook/recipes`🧾 🧩: lists of ingredients to compose several editions. **Build product**: generated by `make all`.
 
-* `dishes`🥨 🥐 🥖 🥧 🥞 🥯 🧆 🧁: read-to-consume and standalone kickstart artifacts, which can be used to deploy complete systems
+* `cook/dishes`🥨 🥐 🥖 🥧 🥞 🥯 🧆 🧁: ready-to-consume and standalone kickstart artifacts, which can be used to deploy complete systems. **Build product**: generated by `make all`.
 
 Each ingredient represents a feature or a set of integrated features, such as a specific Desktop Environment or a storage configuration.
-    - Ingredients prefixed with *live* such as `live-core.cfg` are to be used with live editions only
-    - *core* ingredients are meant be used in all their respective recipes, *base* ingredients, recommended but optional, and extra provides more stuff (sic)
 
 ## Development
 
-Using a pull request, you can suggest a modification to an existing ingredient or create a new ingredient from scratch.
+Using a pull request, you can suggest a modification to an existing ingredient or create a new ingredient from scratch. The cooking pipeline is fully data-driven:
+
+* `cook/recipes_manifest.yaml` declares which editions (groups) and which variant matrix to build.
+* `cook/recipe_templates.yaml` ("Proteus") wires variant values and flags to ingredient fragments: `base` (always included), `choices` (exactly-one per category), `features` (additive).
+* `make all` (in `cook/`) composes recipes, flattens them into dishes with pykickstart in-process, lints the invariants pykickstart can't check, and validates every dish.
 
 ### Requirements
 
 - `qemu`
 - `libvirt`
 - `virt-install`
-- `pykickstart`
+- `pykickstart` (needed to flatten and validate; `pip install -r cook/requirements.txt`)
 
-### Example 1: add a new package and include it into a recipe
+### Example: add a new package and include it into a recipe
 
-- Add [Luanti](https://www.luanti.org/), a free and open-source sandbox video game engine formerly known as Minetest, as a standalone ingredient, using the `echo` command
+- Add [Luanti](https://www.luanti.org/), a free and open-source sandbox video game engine formerly known as Minetest, as a standalone ingredient:
 
 ```
 echo "%packages --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies
 
 luanti # Multiplayer infinite-world block sandbox with survival mode
 
-%end # End of the packages section" > ingredients/extra-luanti.cfg
+%end # End of the packages section" > cook/ingredients/extra-luanti.ks
 ```
 
-Instead of creating a recipe from scratch, let's make a copy of the `virtual-desktop.cfg` recipe, which provide a Desktop environment necessary for *luanti* to function
+- Wire it as a new optional feature in `cook/recipe_templates.yaml`:
 
-```
-cp recipes/virtual-desktop.cfg recipes/virtual-desktop-luanti.cfg
+```yaml
+features:
+  luanti: extra-luanti.ks
 ```
 
-- Add the extra ingredient to the new recipe:
+- Regenerate:
 
 ```
-echo "%include ../ingredients/extra-luanti.cfg # Sandbox video game engine" >> recipes/virtual-desktop-luanti.cfg
+cd cook && make all
 ```
 
-#### Flatten
+- Every dish that enables the `luanti` feature now contains the new ingredient. To name such dishes distinctly, enable the flag in the manifest, e.g. add `luanti: [true, false]` to a variant list.
 
-- Prepare the dish by following the recipe, a process called 'flattening'
+Alternatively, for a bespoke dish not part of the matrix, append the ingredient directly to an existing recipe and re-flatten it:
 
 ```
-ksflatten -c recipes/virtual-desktop-luanti.cfg -o dishes/virtual-desktop-luanti.cfg
+echo "%include ../ingredients/extra-luanti.ks # Sandbox video game engine" >> cook/recipes/<recipe>.cfg
+cd cook && make generate
 ```
 
-> If any errors are detected, go back and fix them.
+### Example: create a new edition from the existing list of ingredients
 
-It is time to test the new dish!
-
-#### Kickstart
-
-- Make the `deploy-vm.sh` script executable
+- Print the full ingredient inventory derived from the templates:
 
 ```
-chmod +x deploy-vm.sh
+cd cook && make inventory
 ```
 
-- Execute the script
+- Define a new group in `cook/recipes_manifest.yaml` with a `tier` (use `experimental` for anything that should not be built by default); the cartesian product of its list values generates one dish per combination, so keep it to a single variant.
+
+### Useful targets (in `cook/`)
 
 ```
-./deploy-vm.sh
+make all         # generate the default tier's dishes, lint, and validate
+make all TIER=guest   # ... or the guest / experimental / all tiers
+make lint        # check the manifest/templates without writing files
+make validate    # validate existing dishes
+make inventory   # print the ingredient catalog derived from the templates
+make test        # run the pytest test suite
 ```
 
-- Select the new dish, *virtual-desktop-luanti*
-
-```
-[...]
-Available files:
-1. desktop-hypervisor-amdcpu
-[...]
-14. virtual-desktop-luanti
-```
-
-- When the installation is done, the machine will shut down
-
-- Start it again, and ensure that Luanti has correctly been installed
-
-That's it !
-
-### Example 2: Create a new recipe from the existing list of ingredients
-
-The file `recipes/_list-of-ingredients.cfg` can be copied and edited to create your own remix of Phyllome OS, which itself is a remix of Fedora.
-
-```
-cp recipes/_list-of-ingredients.cfg recipes/my-new-distro.cfg
-```
-
-Then edit the said file to include your favorite ingredient
-
-```
-nano recipes/my-new-distro.cfg
-```
-
-```
-#            __          ____                        ____  _____
-#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
-#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
-#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
-#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
-# /_/          /____/
-
-# The list of ingredients for composing Phyllome OS
-# Uncomment lines with "%include" to enable ingredient
-
-# Installation method
-# Exactly one option has to be picked
-# %include ../ingredients/core.cfg # Text mode
-# %include ../ingredients/live-core.cfg # For live systems only
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#graphical-or-text-or-cmdline
-
-# Storage configuration 
-# Exactly one option has to be picked
-# WARNING !!! Will erase local disks!
-# %include ../ingredients/core-storage.cfg # Basic ext4 partition layout for UEFI-based systems
-# %include ../ingredients/live-core-storage.cfg # For live systems only
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#part-or-partition
-[...]
-```
-
-- Once you are done, you can [flatten](#flatten) the file and [kickstart](#kickstart) it as explained in the previous section.
-
 ## FAQ
 
-If multiple dishes are affected by your ingredient, you can flatten them all
+- **I change one ingredient and many dishes are affected** — just run `make all` to regenerate the full matrix; recipes and dishes are derived from the templates, so they cannot drift.
 
-- Navigate to the recipes' directory
+- **I want to inspect what a dish contains** — forget `git diff`: generated files are intentionally untracked. Open `cook/recipes/<name>.cfg` for the include list or `cook/dishes/<name>.cfg` for the flattened kickstart.
 
-```
-cd recipes
-```
-
-- Then use the following
-
-```
-for filename in *.cfg; do ksflatten -c "$filename" -o "../dishes/$filename"; done
-```
-
-The following message can safetly be ignored:
-
-```
-/usr/lib/python3.13/site-packages/pykickstart/commands/partition.py:461: KickstartParseWarning: A partition with the mountpoint / has already been defined.
-```
+- **The `%packages` sections are merged and sorted by pykickstart** — that is expected canonical output.
 
 ## Acknowledgement
 

all-ingredients.cfg

@@ -1,100 +0,0 @@
-#            __          ____                        ____  _____
-#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
-#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
-#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
-#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
-# /_/          /____/
-
-# The list of ingredients for composing Phyllome OS
-# Uncomment lines with "%include" to enable ingredient
-
-# Installation method
-# Exactly one option has to be picked
-# %include ../ingredients/core.cfg # Text mode
-# %include ../ingredients/live-core.cfg # For live systems only
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#graphical-or-text-or-cmdline
-
-# Storage configuration 
-# Exactly one option has to be picked
-# WARNING !!! Will erase local disks!
-# %include ../ingredients/core-storage.cfg # Basic ext4 partition layout for UEFI-based systems
-# %include ../ingredients/live-core-storage.cfg # For live systems only
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#part-or-partition
-
-# Booloader configuration
-# Exactly one option has to be picked
-# %include ../ingredients/core-bootloader-grub.cfg # GNU GRUB bootloader
-# %include ../ingredients/core-bootloader-systemd-boot.cfg # systemd-boot, an EFI-only bootloader 
-# %include ../ingredients/live-core-bootloader-grub.cfg # GNU GRUB for live systems
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#bootloader
-
-# System locale configuration
-# Exactly one option has to be picked
-# %include ../ingredients/core-locale.cfg # System locale sets to Swiss French as keyboard layout and English as language. Timezone is also set. Can be changed during by end-user during first boot
-
-# Security mode 
-# Exactly one option has to be picked
-# %include ../ingredients/core-security-off.cfg # Sets security to low
-# %include ../ingredients/core-security-on.cfg # Sets security to medium
-
-# System services 
-# Optional
-# %include ../ingredients/core-services.cfg # List of systemd services that are explicitly enabled
-
-# Network configuration
-# %include ../ingredients/core-network.cfg # Network configuration
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#id123
-
-# Repositories 
-# Exactly one option has to be picked
-# %include ../ingredients/core-fedora-repo.cfg # Official repositories for Fedora
-# %include ../ingredients/core-fedora-repo-rawhide.cfg # Official repositories for Fedora Rawhide
-
-# Packages 
-# Exactly one option has to be picked
-# %include ../ingredients/core-packages-mandatory.cfg # Mandatory packages
-# %include ../ingredients/core-packages-mandatory-trimming-attempt.cfg # Trimming attempt for the mandatory packages
-# Mandatory packages for live editions
-# %include ../ingredients/live-core-mandatory-packages.cfg # For live systems
-# Other optional packages
-# Recommended but not strictly required
-# %include ../ingredients/core-packages-default.cfg # Recommended extra packages
-# %include ../ingredients/core-packages-hardware-support.cfg # Extended hardware support. Recommended for non-virtual systems
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#chapter-9-package-selection
-
-# Pre- and post-installation sections
-# Optional
-# All options can be picked
-# %include ../ingredients/pre.cfg # Triggered just after the kickstart file has been parsed
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#chapter-4-pre-installation-script
-# %include ../ingredients/pre-install.cfg # Script triggered just after the system storage has been set up
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#chapter-5-pre-install-script
-# %include ../ingredients/core-post-nochroot.cfg # Triggered after the installation no chroot
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#chapter-6-post-installation-script
-# %include ../ingredients/core-post.cfg # Triggered after the installation
-# Documentation: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#chapter-6-post-installation-script
-# Two options have to be picked, for live systems only
-# %include ../ingredients/live-core-post.cfg # Post configuration script for a live system only
-# %include ../ingredients/live-core-post-live-session.cfg # Live session script
-
-# OEM setup
-# Exactly one option has to be picked
-# %include ../ingredients/core-desktop-initial-setup.cfg # Ensures that GNOME initial setup will launch on the first system start-up
-# %include ../ingredients/core-server-initial-setup.cfg # For headless systems
-
-# A GNOME Shell-based desktop environment
-# Optional
-# %include ../ingredients/base-desktop-gnome.cfg # A GNOME Shell-based desktop environment
-# Documentation: https://fedoraproject.org/wiki/InitialSetup
-
-# Virtualization-related packages
-# Optional
-# %include ../ingredients/base-desktop-virtual-machine-manager.cfg # Virtual Machine Manager
-# %include ../ingredients/base-hypervisor.cfg # Generic building block to build a virtualization host
-
-# Virtualization-related options
-# Optional
-# %include ../ingredients/base-hypervisor-amdcpu.cfg # Virtualization configuration for AMD (tm) CPUs
-# %include ../ingredients/base-hypervisor-intelcpu.cfg # Virtualization configuration for Intel (tm) CPUs
-# %include ../ingredients/base-hypervisor-intelgpu.cfg # Virtualization configuration for Intel (tm) GPUs from 4th to the 9th generation (compatible with vfio-mdev)
-# %include ../ingredients/base-guest-agents.cfg # Guest agents

build-image.sh

@@ -0,0 +1,233 @@
+#!/bin/bash
+# Build a raw (or qcow2) disk image from a dish, without libvirt/virt-install.
+#
+# Runs `livemedia-creator --no-virt --make-disk` directly on the host, so
+# the result is a disk image you can hand to another VM manager directly
+# (e.g. `virtpull local ./build/<dish>.img --wonder-vm NAME`) instead of a
+# bootable ISO.
+#
+# Usage: ./build-image.sh [--dish NAME] [--tier TIER] [--as qcow2]
+#                         [--root-size MiB] [--extra-ks FILE]
+#
+# --dish skips the interactive picker (used by CI); --tier selects which
+# manifest tier of dishes to generate (default: default; see
+# cook/recipes_manifest.yaml).
+#
+# Requires: lorax-lmc-novirt (livemedia-creator), qemu-img, and root (the
+# --no-virt disk install needs real loop-device access via
+# /dev/loop-control; individual commands below run under sudo — passwordless
+# sudo, or run this whole script as root).
+#
+# Earlier iteration wrapped this in `mock` (mirroring
+# .gitea/workflows/build-iso.yaml's ISO build) to pin the target release's
+# toolchain. That does not work for --make-disk: mock's chroot has no live
+# systemd-udevd, so udev never populates properties for the loop device
+# livemedia-creator creates for the image, and blivet's device scan
+# crashes (blivet/udev.py device_get_name: "TypeError: argument of type
+# 'NoneType' is not a container or iterable") — reproduced identically on
+# Fedora 44 and 43 mock chroots, and confirmed absent when run directly on
+# the host instead. --make-iso never hits this: ISO building doesn't touch
+# block devices at all, only --make-disk (and other disk/appliance modes)
+# does. The consequence: this script now builds using whatever
+# anaconda/lorax the host has installed — the kickstart's own repo/url
+# lines still pin the actual package set to the target Fedora release
+# regardless, same as any other direct (non-mock) livemedia-creator use.
+
+set -euo pipefail
+
+AS_FORMAT=""
+DISH=""
+TIER="${TIER:-default}"
+ROOT_SIZE=8192
+EXTRA_KS=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dish)
+      DISH="$2"
+      shift 2
+      ;;
+    --tier)
+      TIER="$2"
+      shift 2
+      ;;
+    --as)
+      AS_FORMAT="$2"
+      shift 2
+      ;;
+    --root-size)
+      ROOT_SIZE="$2"
+      shift 2
+      ;;
+    --extra-ks)
+      EXTRA_KS="$2"
+      shift 2
+      ;;
+    *)
+      echo "Unknown argument: $1"
+      echo "Usage: $0 [--dish NAME] [--tier TIER] [--as qcow2] [--root-size MiB] [--extra-ks FILE]"
+      exit 1
+      ;;
+  esac
+done
+if [[ -n "$AS_FORMAT" && "$AS_FORMAT" != "qcow2" ]]; then
+  echo "--as only supports 'qcow2' (the build itself always produces raw)"
+  exit 1
+fi
+if ! [[ "$ROOT_SIZE" =~ ^[0-9]+$ ]]; then
+  echo "--root-size must be a whole number of MiB, got '$ROOT_SIZE'"
+  exit 1
+fi
+if [[ -n "$EXTRA_KS" && ! -f "$EXTRA_KS" ]]; then
+  echo "--extra-ks file not found: $EXTRA_KS"
+  exit 1
+fi
+
+for tool in livemedia-creator qemu-img; do
+  if ! command -v "$tool" &> /dev/null; then
+    echo "Missing required tool: $tool"
+    echo "Fedora: sudo dnf install lorax-lmc-novirt qemu-img"
+    exit 1
+  fi
+done
+if [[ $EUID -ne 0 ]] && ! sudo -n true 2>/dev/null; then
+  echo "This needs root (loop-device access for the --no-virt disk install)."
+  echo "Re-run as root, or ensure passwordless sudo is available."
+  exit 1
+fi
+
+# Regenerate recipes and dishes before building (they are build products)
+if ! (cd cook && make all TIER="$TIER"); then
+  echo "Failed to generate dishes in cook/ (see 'make all' in cook/)"
+  exit 1
+fi
+
+# Pick a dish: --dish, or interactively (shared with deploy/deploy-distro.sh)
+if [[ -n "$DISH" ]]; then
+  dish="${DISH%.cfg}"
+  if [[ ! -f "cook/dishes/${dish}.cfg" ]]; then
+    echo "Dish not found: cook/dishes/${dish}.cfg (is --tier '$TIER' right?)"
+    exit 1
+  fi
+else
+  # shellcheck source=./deploy/select-dish.sh
+  source "$(dirname "$0")/deploy/select-dish.sh"
+  dish="$selected_dish"
+fi
+
+# Derive the target release, same convention as
+# deploy/deploy-distro.sh's find_fedora_iso() (used for --releasever, which
+# substitutes @VERSION@ in bootloader/template text — the kickstart's own
+# repo/url lines are what actually pin the package set).
+if [[ "$dish" == *"rawhide"* ]]; then
+  releasever="rawhide"
+elif [[ "$dish" =~ _([0-9]+) ]]; then
+  releasever="${BASH_REMATCH[1]}"
+else
+  echo "Could not determine a Fedora release version from dish name '$dish'."
+  echo "Expected a '_<NN>' segment (e.g. desktop_44_standard...) or 'rawhide'."
+  exit 1
+fi
+
+out_dir="./build"
+mkdir -p "$out_dir"
+out_dir="$(cd "$out_dir" && pwd)"
+
+# Adjustments needed only for this --no-virt disk-image path, applied to a
+# scratch copy rather than the shared dish:
+#
+# 1. cook/ingredients/core/base.ks sets `text` for deploy/deploy-distro.sh's
+#    virt-install netinstall console; livemedia-creator manages the display
+#    mode itself and refuses a kickstart that also sets one ("The kickstart
+#    must not set a display mode").
+#
+# 2. cook/ingredients' storage layout uses `part / --grow` with no explicit
+#    --size: fine for virt-install, which pre-creates the disk at a known
+#    size for anaconda to grow into. livemedia-creator instead computes the
+#    total image size up front by summing partition sizes, and crashes
+#    (TypeError: unsupported operand type(s) for +: 'int' and 'NoneType')
+#    on a --grow partition with no size to add. Give it one via --root-size
+#    (default 8192 MiB; the desktop dishes likely need more).
+#
+# 3. --extra-ks appends arbitrary local content (e.g. a bespoke `user`/
+#    `rootpw`/`security` override) after the above. Kickstart's singular
+#    commands take the last occurrence, so this can override anything the
+#    dish already set without touching the shared ingredients — see the
+#    README's "bespoke dish not part of the matrix" pattern. Never commit
+#    a file used here if it carries real credentials.
+disk_ks="$(mktemp "${TMPDIR:-/tmp}/${dish}.disk-build.XXXXXX.cfg")"
+trap 'rm -f "$disk_ks"' EXIT
+grep -v -E '^(text|cmdline|graphical)([[:space:]]|$)' "cook/dishes/${dish}.cfg" \
+  | awk -v size="$ROOT_SIZE" '
+      /^part / && /--grow/ && !/--size=/ { $0 = $0 " --size=" size }
+      { print }
+    ' > "$disk_ks"
+if [[ -n "$EXTRA_KS" ]]; then
+  {
+    echo
+    cat "$EXTRA_KS"
+  } >> "$disk_ks"
+fi
+
+if command -v ksvalidator &> /dev/null; then
+  echo "Validating kickstart (informational; a build failure is the real test)..."
+  ksvalidator "$disk_ks" || true
+fi
+
+resultdir="$(mktemp -u "${TMPDIR:-/tmp}/lmc-result.XXXXXX")"
+
+# Only one livemedia-creator run per host at a time. It and anaconda use
+# host-global resources (/mnt/sysroot, /mnt/sysimage, loop and device-mapper
+# devices), so concurrent builds corrupt each other -- e.g. bootctl failing with
+# "Couldn't find EFI system partition" when the CI matrix started both editions
+# at once on a shared runner (Gitea expands each matrix entry into its own
+# task, so `max-parallel` does not serialize them). A host-wide flock does.
+# Under the lock, first clear mounts/devices a previously failed build left
+# behind, which would otherwise poison this one.
+LOCK=/run/lock/phyllomeos-build-image.lock
+echo "Building disk image for '$dish' (target release $releasever)..."
+echo "Waiting for the host build lock ($LOCK) if another build is running..."
+sudo flock "$LOCK" env DISH="$dish" bash -c '
+  for mnt in /mnt/sysimage /mnt/sysroot; do
+    if findmnt -rn "$mnt" >/dev/null 2>&1; then
+      echo "Cleaning stale mount $mnt from a failed build"
+      umount -R "$mnt" || true
+    fi
+  done
+  for dm in $(dmsetup ls 2>/dev/null | awk -v d="$DISH" "index(\$1, d) == 1 {print \$1}" | sort -r); do
+    echo "Removing stale device-mapper device $dm"
+    dmsetup remove --retry "$dm" || true
+  done
+  for lo in $(losetup -a | awk -F: "/lmc-result\\./ {print \$1}"); do
+    echo "Detaching stale loop device $lo"
+    losetup -d "$lo" || true
+  done
+  exec livemedia-creator "$@"
+' _ --ks "$disk_ks" --no-virt --resultdir "$resultdir" \
+  --make-disk --image-name "${dish}.img" --releasever "$releasever"
+
+# livemedia-creator's exact output filename depends on the installed lorax
+# version; don't assume --image-name is honored verbatim, take whatever
+# single disk image landed in the resultdir.
+produced=$(sudo find "$resultdir" -maxdepth 1 -type f \( -iname '*.img' -o -iname '*disk*' \) | head -n 1)
+if [[ -z "$produced" ]]; then
+  echo "livemedia-creator did not produce a recognizable disk image under $resultdir"
+  exit 1
+fi
+
+raw_out="${out_dir}/${dish}.img"
+sudo cp --reflink=auto "$produced" "$raw_out"
+sudo chown "$(id -u):$(id -g)" "$raw_out"
+sudo rm -rf "$resultdir"
+echo "Built: $raw_out"
+
+if [[ "$AS_FORMAT" == "qcow2" ]]; then
+  qcow2_out="${out_dir}/${dish}.qcow2"
+  qemu-img convert -O qcow2 "$raw_out" "$qcow2_out"
+  echo "Converted: $qcow2_out"
+  final="$qcow2_out"
+else
+  final="$raw_out"
+fi
+
+echo
+echo "Next: virtpull local $final --wonder-vm <NAME>"

cook/Makefile

@@ -0,0 +1,56 @@
+.PHONY: help generate lint validate inventory test install-deps clean clean-recipes clean-dishes all
+
+PYTHON ?= python3
+# Manifest tier(s) to generate: default, guest, experimental, all (space-separated)
+TIER ?= default
+TIER_ARGS = $(foreach t,$(TIER),--tier $(t))
+
+default: all
+
+help:
+	@echo "Phyllome OS Recipe Generator"
+	@echo ""
+	@echo "Available targets:"
+	@echo "  all          - Generate recipes and dishes, lint, and validate (default)"
+	@echo "                 TIER=default|guest|experimental|all picks the manifest tier(s)"
+	@echo "  generate     - Same as 'all'"
+	@echo "  lint         - Lint manifest and templates without writing files"
+	@echo "  validate     - Validate existing dishes without regenerating"
+	@echo "  inventory    - Print the ingredient inventory derived from recipe_templates.yaml"
+	@echo "  test         - Run the pytest test suite"
+	@echo "  install-deps - Install Python dependencies"
+	@echo "  clean        - Remove generated recipes and dishes"
+	@echo "  clean-recipes- Remove generated recipes only"
+	@echo "  clean-dishes - Remove generated dishes only"
+
+all: generate
+
+generate:
+	@$(PYTHON) generate_recipe.py $(TIER_ARGS)
+
+lint:
+	@$(PYTHON) generate_recipe.py --no-generate --no-validate
+
+validate:
+	@$(PYTHON) generate_recipe.py $(TIER_ARGS) --no-generate --no-lint
+
+inventory:
+	@$(PYTHON) generate_recipe.py --inventory
+
+test:
+	@$(PYTHON) -m pytest tests
+
+install-deps:
+	@pip install -r requirements.txt
+
+clean:
+	@rm -f recipes/*.cfg dishes/*.cfg
+	@echo "Generated recipes and dishes removed. Run 'make all' to regenerate."
+
+clean-recipes:
+	@rm -f recipes/*.cfg
+	@echo "Generated recipes removed. Run 'make generate' to regenerate."
+
+clean-dishes:
+	@rm -f dishes/*.cfg
+	@echo "Generated dishes removed. Run 'make generate' to regenerate."

cook/generate_recipe.py

@@ -0,0 +1,388 @@
+#!/usr/bin/env python3
+"""
+Recipe and dish generator for Phyllome OS.
+
+Reads recipes_manifest.yaml (the variant matrix) and recipe_templates.yaml
+(the ingredient wiring) to:
+
+  1. compose kickstart "recipes" (%include lists) under recipes/,
+  2. flatten them into standalone "dishes" under dishes/ using pykickstart
+     in-process (no external ksflatten binary), and
+  3. lint the invariants pykickstart cannot check (exactly-one per choice
+     category, known keys, existing fragments, unique filenames) and
+     validate every generated dish.
+
+Everything is derived from YAML; ingredient names, order and filenames are
+pure functions of the manifest and templates.
+"""
+
+import argparse
+import itertools
+import os
+import sys
+
+import yaml
+
+from pykickstart.version import DEVEL, returnClassForVersion
+from pykickstart.parser import KickstartParser
+
+HEADER = """#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \\/ ___/
+#    / __ \\/ __ \\/ / / / / / __ \\/ __ `__ \\/ _ \\   / / / /\\__ \\
+#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\\__, /_/_/\\____/_/ /_/ /_/\\___/   \\____//____/
+# /_/          /____/
+
+"""
+
+
+def load_yaml(path):
+    with open(path) as f:
+        return yaml.safe_load(f)
+
+
+def expand_variants(variant_config):
+    """Expand a variant config into its cartesian product.
+
+    Keys holding a list of values expand to one variant per combination;
+    scalar and boolean keys are fixed across every combination.
+    """
+    keys = variant_config.keys()
+    values = []
+    for key in keys:
+        val = variant_config[key]
+        if isinstance(val, list):
+            values.append([(key, v) for v in val])
+        else:
+            values.append([(key, val)])
+    combos = itertools.product(*values)
+    return [dict(combo) for combo in combos]
+
+
+def default_choice(choices):
+    """Return the first declared value of a choices category."""
+    return next(iter(choices))
+
+
+def collect_fragments(templates, variant):
+    """Resolve a variant to the ordered list of ingredient fragments.
+
+    Returns (fragments, problems) where problems is a list of human-readable
+    lint messages. Choices default to their first declared value when the
+    variant omits them.
+    """
+    fragments = list(templates.get('base', []))
+    problems = []
+
+    for category, mapping in templates.get('choices', {}).items():
+        value = variant.get(category)
+        if value is None:
+            value = default_choice(mapping)
+        path = mapping.get(value)
+        if path is None:
+            problems.append(
+                "choice '%s': unknown value '%s' (expected one of %s)"
+                % (category, value, ', '.join(sorted(mapping))))
+        else:
+            fragments.append(path)
+
+    for feature, body in templates.get('features', {}).items():
+        value = variant.get(feature)
+        if value is None or isinstance(value, bool) and not value:
+            continue
+        if isinstance(body, str):
+            fragments.append(body)
+        else:
+            rendered = body.get(value)
+            if rendered is None:
+                problems.append(
+                    "feature '%s': unknown value '%s' (expected one of %s)"
+                    % (feature, value, ', '.join(sorted(body))))
+            elif isinstance(rendered, list):
+                fragments.extend(rendered)
+            else:
+                fragments.append(rendered)
+
+    fragments = list(dict.fromkeys(fragments))
+    return fragments, problems
+
+
+def render_filename(templates, group_name, variant):
+    """Build a deterministic, collision-free dish name for a variant.
+
+    Tokens follow the canonical category order from the templates (choices
+    first, then features), independent of the key order the manifest uses, so
+    reordering the manifest -- or YAML tools that sort keys -- never renames
+    dishes. Boolean True renders the key itself, boolean False is omitted,
+    other values render str(value). The group name prefixes every dish,
+    making names unique across groups.
+    """
+    order = list(templates.get('choices', {})) + list(templates.get('features', {}))
+    tokens = []
+    for key in order:
+        if key not in variant:
+            continue
+        value = variant[key]
+        if isinstance(value, bool):
+            if value:
+                tokens.append(key)
+        else:
+            tokens.append(str(value))
+    return "%s_%s.cfg" % (group_name, '_'.join(tokens))
+
+
+def render_recipe(fragments):
+    """Render a recipe (%include list) for the given ingredient fragments."""
+    includes = '\n'.join(f'%include ../ingredients/{slug}' for slug in fragments)
+    return HEADER + includes + '\n'
+
+
+def lint_manifest(manifest, templates, ingredients_root):
+    """Return a list of lint problems across the whole manifest."""
+    problems = []
+    group_names = set()
+
+    for group in manifest.get('recipes', []):
+        group_name = group.get('name', 'unknown')
+        if group_name in group_names:
+            problems.append("duplicate group name '%s'" % group_name)
+        group_names.add(group_name)
+
+        for config in group.get('variants', []):
+            for variant in expand_variants(config):
+                known = set(templates.get('choices')) | set(templates.get('features'))
+                for key in variant:
+                    if key not in known:
+                        problems.append(
+                            "unknown variant key '%s' (group '%s')" % (key, group_name))
+                _, probs = collect_fragments(templates, variant)
+                problems.extend(probs)
+                name = render_filename(templates, group_name, variant)
+                problems.extend(check_fragments_exist(templates, variant, ingredients_root))
+
+    filenames = []
+    for group in manifest.get('recipes', []):
+        group_name = group.get('name', 'unknown')
+        for config in group.get('variants', []):
+            for variant in expand_variants(config):
+                filenames.append(render_filename(templates, group_name, variant))
+    seen = set()
+    for name in filenames:
+        if name in seen:
+            problems.append("duplicate dish name '%s'" % name)
+        seen.add(name)
+
+    return problems
+
+
+def check_fragments_exist(templates, variant, ingredients_root):
+    fragments, _ = collect_fragments(templates, variant)
+    problems = []
+    for slug in fragments:
+        path = os.path.join(ingredients_root, slug)
+        if not os.path.isfile(path):
+            problems.append("missing ingredient fragment '%s'" % slug)
+    return problems
+
+
+def flatten_recipe(recipe_path):
+    """Flatten a recipe (%include list) into a standalone kickstart string."""
+    handler = returnClassForVersion(DEVEL)()
+    parser = KickstartParser(handler)
+    parser.readKickstart(recipe_path)
+    return str(handler)
+
+
+def validate_dish(dish_path):
+    """Return (ok, error) for a standalone kickstart dish."""
+    try:
+        handler = returnClassForVersion(DEVEL)()
+        parser = KickstartParser(handler)
+        parser.readKickstart(dish_path)
+        return True, None
+    except Exception as exc:  # noqa: BLE001 - report any parse failure
+        return False, str(exc)
+
+
+DEFAULT_TIER = 'default'
+
+
+def group_tier(group):
+    """Return the tier of a manifest group (groups default to 'default')."""
+    return group.get('tier', DEFAULT_TIER)
+
+
+def select_groups(manifest, tiers):
+    """Return the manifest groups belonging to the requested tiers.
+
+    tiers is a collection of tier names; 'all' selects every group.
+    """
+    groups = manifest.get('recipes', [])
+    if 'all' in tiers:
+        return groups
+    return [g for g in groups if group_tier(g) in tiers]
+
+
+def clean_output(directory):
+    """Remove previously generated .cfg files so stale dishes never linger."""
+    if not os.path.isdir(directory):
+        return
+    for entry in os.listdir(directory):
+        if entry.endswith('.cfg'):
+            os.remove(os.path.join(directory, entry))
+
+
+def generate(manifest_path, templates_path, recipes_dir, dishes_dir,
+             ingredients_dir, do_generate=True, do_lint=True, do_validate=True,
+             tiers=(DEFAULT_TIER,)):
+    """Full cooking pipeline. Returns an exit code (0 on success).
+
+    Only groups in the requested tiers are written; lint always covers the
+    whole manifest so inactive tiers cannot rot.
+    """
+    manifest = load_yaml(manifest_path)
+    templates = load_yaml(templates_path)
+    ingredients_root = os.path.join(os.path.dirname(os.path.abspath(manifest_path)),
+                                    ingredients_dir)
+
+    if do_lint:
+        problems = lint_manifest(manifest, templates, ingredients_root)
+    else:
+        problems = []
+
+    failures = []
+    generated = []
+
+    recipe_dir = os.path.abspath(recipes_dir)
+    dish_dir = os.path.abspath(dishes_dir)
+    if do_generate:
+        os.makedirs(recipe_dir, exist_ok=True)
+        os.makedirs(dish_dir, exist_ok=True)
+        clean_output(recipe_dir)
+        clean_output(dish_dir)
+
+    for group in select_groups(manifest, tiers):
+        group_name = group.get('name', 'unknown')
+        for config in group.get('variants', []):
+            for variant in expand_variants(config):
+                fragments, probs = collect_fragments(templates, variant)
+                problems.extend(probs)
+                name = render_filename(templates, group_name, variant)
+                generated.append(name)
+                if not do_generate:
+                    continue
+
+                recipe_path = os.path.join(recipe_dir, name)
+                with open(recipe_path, 'w') as f:
+                    f.write(render_recipe(fragments))
+
+                dish_path = os.path.join(dish_dir, name)
+                try:
+                    dish = flatten_recipe(recipe_path)
+                    with open(dish_path, 'w') as f:
+                        f.write(dish)
+                except Exception as exc:  # noqa: BLE001
+                    failures.append('%s: flatten failed: %s' % (name, exc))
+
+    if do_validate and do_generate:
+        for name in generated:
+            dish_path = os.path.join(dish_dir, name)
+            if not os.path.isfile(dish_path):
+                continue
+            ok, error = validate_dish(dish_path)
+            if not ok:
+                problems.append('%s: invalid dish: %s' % (name, error))
+
+    if do_generate:
+        print("Generated %d recipes and %d dishes" % (len(generated), len(generated)))
+    if problems:
+        for problem in problems:
+            print("lint: %s" % problem, file=sys.stderr)
+    if failures:
+        for failure in failures:
+            print(failure, file=sys.stderr)
+    return 1 if (problems or failures) else 0
+
+
+def print_inventory(templates_path, ingredients_dir):
+    templates = load_yaml(templates_path)
+    root = os.path.abspath(ingredients_dir)
+    out = []
+    out.append("Ingredient inventory for Phyllome OS (from %s)" % templates_path)
+    out.append("=" * 60)
+    out.append("\nBase (always included, in order):")
+    for slug in templates.get('base', []):
+        out.append("  %-40s %s" % (slug, os.path.exists(os.path.join(root, slug)) and "ok" or "MISSING"))
+    out.append("\nChoices (exactly one per category):")
+    for category, mapping in templates.get('choices', {}).items():
+        out.append("  %s:" % category)
+        for value, slug in mapping.items():
+            out.append("    %-12s %-30s %s" % (value, slug,
+                       os.path.exists(os.path.join(root, slug)) and "ok" or "MISSING"))
+    out.append("\nFeatures (additive):")
+    for feature, body in templates.get('features', {}).items():
+        out.append("  %s:" % feature)
+        if isinstance(body, str):
+            out.append("    (flag) %-30s %s" % (body,
+                       os.path.exists(os.path.join(root, body)) and "ok" or "MISSING"))
+        else:
+            for value, slugs in body.items():
+                if isinstance(slugs, list):
+                    for slug in slugs:
+                        out.append("    %-12s %-30s %s" % (value, slug,
+                                   os.path.exists(os.path.join(root, slug)) and "ok" or "MISSING"))
+                else:
+                    out.append("    %-12s %-30s %s" % (value, slugs,
+                               os.path.exists(os.path.join(root, slugs)) and "ok" or "MISSING"))
+    print('\n'.join(out))
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(
+        description='Generate Phyllome OS recipes and dishes')
+    parser.add_argument('--manifest', default='recipes_manifest.yaml',
+                        help='recipe variant manifest (default: recipes_manifest.yaml)')
+    parser.add_argument('--templates', default='recipe_templates.yaml',
+                        help='ingredient templates (default: recipe_templates.yaml)')
+    parser.add_argument('--recipes-dir', default='recipes',
+                        help='output directory for recipe include lists (default: recipes)')
+    parser.add_argument('--dishes-dir', default='dishes',
+                        help='output directory for flattened dishes (default: dishes)')
+    parser.add_argument('--ingredients-dir', default='ingredients',
+                        help='ingredient fragments directory (default: ingredients)')
+    parser.add_argument('--tier', action='append', metavar='TIER',
+                        help="manifest tier to generate: default, guest, experimental "
+                             "or all; repeatable (default: default)")
+    parser.add_argument('--no-generate', action='store_true',
+                        help='do not write recipes or dishes (lint/validate only)')
+    parser.add_argument('--no-lint', action='store_true',
+                        help='skip manifest linting')
+    parser.add_argument('--no-validate', action='store_true',
+                        help='skip dish validation')
+    parser.add_argument('--inventory', action='store_true',
+                        help='print the ingredient inventory from templates and exit')
+    args = parser.parse_args(argv)
+
+    script_dir = os.path.dirname(os.path.abspath(__file__))
+    os.chdir(script_dir)
+
+    manifest_path = args.manifest if os.path.isabs(args.manifest) \
+        else os.path.join(script_dir, args.manifest)
+    templates_path = args.templates if os.path.isabs(args.templates) \
+        else os.path.join(script_dir, args.templates)
+
+    if args.inventory:
+        print_inventory(templates_path, args.ingredients_dir)
+        return 0
+
+    return generate(
+        manifest_path, templates_path, args.recipes_dir, args.dishes_dir,
+        args.ingredients_dir,
+        do_generate=not args.no_generate,
+        do_lint=not args.no_lint,
+        do_validate=not args.no_validate,
+        tiers=tuple(args.tier or (DEFAULT_TIER,)))
+
+
+if __name__ == '__main__':
+    sys.exit(main())

cook/ingredients/bootloader/grub.ks

@@ -1 +1,3 @@
+# GRUB bootloader configuration
+
 bootloader --timeout=1 # Set the GNU GRUB bootloader timeout to 1

cook/ingredients/bootloader/systemd-boot.ks

@@ -0,0 +1,3 @@
+# systemd-boot bootloader configuration
+
+bootloader --sdboot --location=mbr --timeout=1 # Use systemd-boot and set a timeout to 1

cook/ingredients/core/base.ks

@@ -0,0 +1,5 @@
+# Core base kickstart configuration
+# Common settings for all Phyllome OS installations
+
+text # Kickstart installation in text mode
+poweroff # Shut down the system after a successful installation

cook/ingredients/core/locale.ks

@@ -0,0 +1,5 @@
+# Keyboard, language, and timezone configuration
+
+keyboard --vckeymap=ch-fr --xlayouts='ch (fr)' # Set keyboard layouts for Romandy: --vckeymap for the text console (tty login, headless), --xlayouts for graphical sessions
+lang en_US.UTF-8 # Set system language to American English. More languages could be supported: --addsupport=cs_CZ,de_DE,en_UK
+timezone Europe/Zurich --utc # Set system timezone to Zurich

cook/ingredients/core/network.ks

@@ -0,0 +1,3 @@
+# Network configuration
+
+network  --onboot=yes --bootproto=dhcp --device=link --activate --hostname=phyllomeos # Configure network devices, enable them at boot time device and sets a generic hostname (rename per machine after install). "link" selects the first device reaching an up state

cook/ingredients/core/security/disabled.ks

@@ -0,0 +1,5 @@
+# Security configuration - disabled mode
+
+rootpw --plaintext 1234 --allow-ssh # Root account is enabled with weak password and allow ssh
+selinux --disabled # Disable SELinux
+firewall --enabled --ssh # Reject incoming connections that are not in response to outbound requests except SSH

cook/ingredients/core/security/enabled.ks

@@ -0,0 +1,5 @@
+# Security configuration - enabled mode
+
+rootpw --lock # No root login from the console
+selinux --enforcing # Set SELinux to enforcing mode
+firewall --enabled # Enable firewall

cook/ingredients/core/services.ks

@@ -1 +1,3 @@
+# System services
+
 services --enabled=NetworkManager,systemd-resolved # List of comma-separated systemd services that can be explicitly enabled

cook/ingredients/desktop/gnome/config.ks

@@ -0,0 +1 @@
+xconfig --startxonboot --defaultdesktop=GNOME # Start the display session on boot. Although it says --startx, which seems to imply xorg, it is actually generic and thus works also with Wayland.

cook/ingredients/desktop/gnome/packages.ks

@@ -0,0 +1,51 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# GNOME desktop packages
+
+%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies
+
+@base-graphical
+## provides the following as mandatory packages:
+# mesa-dri-drivers
+# mesa-vulkan-drivers
+# plymouth-system-theme
+
+# @critical-path-gnome not using this group but hand-picking packages 
+## Mandatory packages found in hidden `@critical-path-gnome` group (`dnf group info --hidden critical-path-gnome`)
+## Not using 
+## provides the following as mandatory packages:
+bash-color-prompt # Color prompt for bash shell
+dconf # A configuration system
+gdm # The GNOME Display Manager
+# gnome-classic-session # GNOME "classic" mode session
+gnome-control-center # Utilities to configure the GNOME desktop
+# gnome-initial-setup # Bootstrapping your OS
+gnome-shell # Window management and application launching for GNOME
+gvfs-fuse # FUSE support for gvfs
+# ptyxis # A container oriented terminal for GNOME
+### and the following as default packages
+# NetworkManager-pptp # NetworkManager VPN plugin for PPTP
+# avahi # Local network service discovery
+# gnome-bluetooth # Bluetooth graphical utilities
+gnome-session-wayland-session # Desktop file for wayland based gnome session
+# gnome-software # A software center for GNOME
+nautilus # File manager for GNOME
+# toolbox # Tool for interactive command line environments on Linux
+
+## Extra hand-picked packages
+gnome-backgrounds.noarch # wallpapers from the GNOME project
+gnome-terminal # Terminal emulator for GNOME
+dejavu-sans-mono-fonts # the gnome-shell package doesn't include much fonts by default, resulting in weird spacings in GNOME Terminal. GNOME Terminal unfortunately doesn't automatically pick this font 
+firefox # Mozilla Firefox Web browser
+mozilla-ublock-origin.noarch # An efficient blocker for Firefox
+
+pipewire-alsa # PipeWire media server ALSA support
+pipewire-pulseaudio # PipeWire PulseAudio implementation
+pipewire-jack-audio-connection-kit # PipeWire JACK implementation
+
+%end # End of the packagages section

cook/ingredients/desktop/gnome/post-scripts.ks

@@ -1,30 +1,6 @@
-xconfig --startxonboot --defaultdesktop=GNOME # Start the display session on boot. Although it says --startx, which seems to imply xorg, it is actually generic and thus works also with Wayland.
+# GNOME desktop post-installation configuration
 
-%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak dependencies
-
-gnome-shell # the version 3 of the GNOME desktop environment, without any presintalled applications
-gnome-terminal # install the default terminal for GNOME Shell
-gnome-control-center # Utilities to configure the GNOME desktop
--gnome-tour # delete GNOME Tour so it doesn't automatically launch on boot 
-mesa-dri-drivers # add mesa drivers otherwise there is a blank screen when first booting a desktop-based kickstart without virtualization tools 
-dejavu-sans-mono-fonts # the gnome-shell package doesn't include much fonts by default, resulting in weird spacings in GNOME Terminal. GNOME Terminal unfortunately doesn't automatically pick this font 
-gnome-backgrounds.noarch # wallpapers from the GNOME project
-wpa_supplicant # WPA Supplicant for Linux. It is not packaged by default in GNOME Shell, but necessary to configure wireless networks using the Network Manager
-NetworkManager-wifi # Provides the plugin to manage Wireless networking within GNOME Shell
-firefox # Internet browser
-mozilla-ublock-origin.noarch # An efficient ad blocker for Firefox
-pipewire-alsa # PipeWire media server ALSA support
-pipewire-pulseaudio # PipeWire PulseAudio implementation
-pipewire-jack-audio-connection-kit # PipeWire JACK implementation
-
-%end # End of the packagages section
-
-%post --nochroot --log=/mnt/sysimage/root/base-desktop-gnome.log # Beginning of %post section. Those commands are executed outside the chroot environment
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
+%post --nochroot --log=/mnt/sysimage/root/gnome-desktop-post.log # Beginning of %post section. Those commands are executed outside the chroot environment
 
 cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
 [org.gnome.desktop.media-handling]
@@ -36,7 +12,7 @@ cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.overr
 [org.gnome.Terminal.Legacy.Profile]
 font='DejaVu Sans Mono 12'
 use-system-font=false
-audible-bell=false
+auditable-bell=false
 EOF
 
 cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
@@ -57,7 +33,7 @@ EOF
 cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
 [org.gnome.desktop.privacy]
 remove-old-temp-files=true
-remember-recent-files=false
+remember-recent-file=false
 remember-app-usage=false
 disable-camera=true
 disable-microphone=true

cook/ingredients/desktop/labwc/config.ks

@@ -0,0 +1,19 @@
+# Untested
+
+xconfig --startxonboot # Start the display session on boot. Although it says --startx, which seems to imply xorg, it is actually generic and thus works also with Wayland.
+
+%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies.
+
+@base-graphical
+## provides the following as mandatory packages:
+# mesa-dri-drivers
+# mesa-vulkan-drivers
+# plymouth-system-theme
+
+labwc # A Wayland window-stacking compositor
+
+## Extra hand-picked packages
+firefox # Mozilla Firefox Web browser
+mozilla-ublock-origin.noarch # An efficient blocker for Firefox
+
+%end # End of the packagages section

cook/ingredients/guest-agents/base.ks

@@ -0,0 +1,6 @@
+# Guest agents for virtual machines
+
+%packages --exclude-weakdeps
+qemu-guest-agent
+spice-vdagent
+%end

cook/ingredients/hypervisor/amdcpu.ks

@@ -0,0 +1,28 @@
+# AMD CPU optimization for hypervisor
+
+%post --nochroot --log=/mnt/sysimage/root/hypervisor-amdcpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
+
+# Kernel arguments cannot be attached to a single canonical location at %post time:
+# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
+# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
+# generated from it by the kernel package scriptlets, and non-BLS flows still read
+# /etc/default/grub. Update every surface idempotently, guarded by file existence.
+
+IOMMU_ARGS="iommu=pt rd.driver.pre=vfio-pci"
+
+if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
+    grep -q "iommu=pt" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
+fi
+
+if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
+    grep -q "iommu=pt" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
+fi
+
+for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
+    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
+    grep -q "iommu=pt" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
+done
+
+grep -q "nested=1" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on AMD CPUs, exactly once
+
+%end # End of the %post section

cook/ingredients/hypervisor/base/packages.ks

@@ -0,0 +1,30 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# Virtualization packages
+
+%packages --exclude-weakdeps # Beginning of the packages section. Does not include weak dependencies.
+
+qemu-kvm # QEMU metapackage for KVM support
+libvirt # Library providing a simple virtualization API
+libvirt-client # Client side utilities of the libvirt library
+libvirt-client-qemu # Additional client side utilities for QEMU. Used to interact with some QEMU specific features of libvirt.
+libvirt-daemon # Server side daemon and supporting files for libvirt library
+libvirt-daemon-common # Miscellaneous files and utilities used by other libvirt daemons
+libvirt-daemon-config-network # Default configuration files for the libvirtd daemon. Provides NAT based networking
+libvirt-daemon-driver-interface # Interface driver plugin for the libvirtd daemon
+libvirt-daemon-driver-network # The network driver plugin for the libvirtd daemon, providing an implementation of the virtual network APIs using the Linux bridge capabilities.
+libvirt-daemon-driver-qemu # QEMU driver plugin for the libvirtd daemon
+libvirt-daemon-kvm # Server side daemon & driver required to run KVM guests
+libvirt-daemon-log # Server side daemon for managing logs
+libvirt-daemon-qemu # Server side daemon and driver required to manage the virtualization capabilities of the QEMU TCG emulators
+libvirt-nss # Libvirt plugin for Name Service Switch
+libvirt-dbus # libvirt D-Bus API binding
+libvirt-daemon-driver-ch # Cloud-Hypervisor driver plugin for libvirtd daemon
+virt-install # Utilities for installing virtual machines
+
+%end # End of the packages section

cook/ingredients/hypervisor/base/post-scripts.ks

@@ -0,0 +1,31 @@
+# Hypervisor base post-installation configuration
+
+%post --nochroot --log=/mnt/sysimage/root/hypervisor-base-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
+
+# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
+echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
+echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
+echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
+echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
+
+mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
+
+# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
+
+# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
+# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
+# virsh pool-build isos # Build the pool
+# virsh pool-start isos # Start it
+# virsh pool-autostart isos # Set-it to autostart
+
+# fetch custom script and make it executable
+# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
+# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
+
+# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
+# virsh define linux.xml
+
+# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
+# virsh define windows.xml
+
+%end # End of the %post section

cook/ingredients/hypervisor/base/services.ks

@@ -0,0 +1,3 @@
+# Hypervisor base configuration
+
+services --enabled="NetworkManager,systemd-resolved,libvirtd" # Without libvirtd here, it appears the service won't automatically start

cook/ingredients/hypervisor/cpu-agnostic.ks

@@ -0,0 +1,33 @@
+# CPU-agnostic optimization for hypervisor (Intel and AMD)
+#
+# One ingredient for both CPU vendors, so a single dish can be installed on either:
+#   * intel_iommu=on is ignored by AMD kernels (amd_iommu is enabled by default).
+#   * "options kvm_intel"/"options kvm_amd" only apply to the module that actually loads.
+
+%post --nochroot --log=/mnt/sysimage/root/hypervisor-cpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
+
+# Kernel arguments cannot be attached to a single canonical location at %post time:
+# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
+# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
+# generated from it by the kernel package scriptlets, and non-BLS flows still read
+# /etc/default/grub. Update every surface idempotently, guarded by file existence.
+
+IOMMU_ARGS="intel_iommu=on iommu=pt rd.driver.pre=vfio-pci"
+
+if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
+    grep -q "iommu=pt" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
+fi
+
+if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
+    grep -q "iommu=pt" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
+fi
+
+for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
+    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
+    grep -q "iommu=pt" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
+done
+
+grep -q "kvm_intel" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs, exactly once
+grep -q "kvm_amd" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on AMD CPUs, exactly once
+
+%end # End of the %post section

cook/ingredients/hypervisor/intelcpu.ks

@@ -0,0 +1,28 @@
+# Intel CPU optimization for hypervisor
+
+%post --nochroot --log=/mnt/sysimage/root/hypervisor-intelcpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
+
+# Kernel arguments cannot be attached to a single canonical location at %post time:
+# anaconda always creates /etc/kernel/cmdline (kernel-install source for both
+# systemd-boot and GRUB+BLS layouts), but GRUB+BLS boot entries have already been
+# generated from it by the kernel package scriptlets, and non-BLS flows still read
+# /etc/default/grub. Update every surface idempotently, guarded by file existence.
+
+IOMMU_ARGS="intel_iommu=on iommu=pt rd.driver.pre=vfio-pci"
+
+if [ -f /mnt/sysimage/etc/kernel/cmdline ]; then # kernel-install source (systemd-boot now, GRUB+BLS for future kernels)
+    grep -q "intel_iommu=on" /mnt/sysimage/etc/kernel/cmdline || echo " $IOMMU_ARGS" >> /mnt/sysimage/etc/kernel/cmdline # Append IOMMU arguments once
+fi
+
+if [ -f /mnt/sysimage/etc/default/grub ]; then # GRUB: arguments for grub.cfg-based boot flows
+    grep -q "intel_iommu=on" /mnt/sysimage/etc/default/grub || sed -i "s/\(quiet\)/\1 $IOMMU_ARGS/i" /mnt/sysimage/etc/default/grub # Append IOMMU arguments once
+fi
+
+for bls_entry in /mnt/sysimage/boot/loader/entries/*.conf; do # Already-generated boot entries share one "options" line shape
+    [ -e "$bls_entry" ] || continue # Nothing matched: the glob stays literal
+    grep -q "intel_iommu=on" "$bls_entry" || sed -i "s/^\(options .*\)/\1 $IOMMU_ARGS/" "$bls_entry" # Patch the options line of each entry once
+done
+
+grep -q "nested=1" /mnt/sysimage/etc/modprobe.d/kvm.conf 2>/dev/null || echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs, exactly once
+
+%end # End of the %post section

cook/ingredients/hypervisor/intelgpu.ks

@@ -1,4 +1,6 @@
-%post --nochroot --log=/mnt/sysimage/root/base-hypervisor-intelgpu.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installtion troubleshooting
+# Intel GPU passthrough configuration
+
+%post --nochroot --log=/mnt/sysimage/root/hypervisor-intelgpu-post.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installtion troubleshooting
 
 sed -i 's/\(vfio-pci\)/\1 i915.enable_gvt=1/i' /mnt/sysimage/etc/default/grub # Load kernel modules in grub.
 

cook/ingredients/initial-setup/generic-wayland/config.ks

@@ -0,0 +1,11 @@
+# Initial setup - generic wayland desktop mode
+
+firstboot --enable # Initial Setup will start after the first reboot
+
+%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies.
+
+# TO BE TESTED -> initial-setup-gui # Graphical user interface for the initial-setup utility
+# TO BE TESTED -> initial-setup-gui-wayland-generic.x86_64 # Run the initial-setup GUI in Wayland
+gnome-initial-setup # Add GNOME initial setup too to let user create local account.
+
+%end # End of the packages section

cook/ingredients/initial-setup/gnome/config.ks

@@ -1,12 +1,16 @@
-firstboot --reconfig # Initial Setup will start after the first reboot
+# Initial setup - GNOME desktop mode
 
-%packages --exclude-weakdeps # Beginning of the packages section. Do not include weak dependencies.
+firstboot --enable # Initial Setup will start after the first reboot
 
+%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies.
+
+# TO BE TESTED -> initial-setup-gui # Graphical user interface for the initial-setup utility
+# TO BE TESTED -> initial-setup-gui-wayland-generic.x86_64 # Run the initial-setup GUI in Wayland
 gnome-initial-setup # Add GNOME initial setup too to let user create local account.
 
 %end # End of the packages section
 
-%post --nochroot --log=/mnt/sysimage/root/base-initial-setup-gnome.log # Beginning of %post section. Those commands are executed outside the chroot environment. Add logging.
+%post --nochroot --log=/mnt/sysimage/root/initial-setup-gnome.log # Beginning of %post section. Those commands are executed outside the chroot environment. Add logging.
 
 truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
 

cook/ingredients/initial-setup/server/config.ks

@@ -0,0 +1,9 @@
+# Initial setup - server mode
+
+firstboot --enable --reconfig # Enable the Setup Agent to start at boot time in reconfiguration mode. This mode enables the language, mouse, keyboard, root password, security level, time zone, and networking configuration options in addition to the default ones
+
+%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies.
+
+initial-setup # Initial setup package
+
+%end # End of the packages section

cook/ingredients/live/core/base.ks

@@ -0,0 +1,3 @@
+# Live core base configuration
+
+poweroff # Shut down the system after a successful installation

cook/ingredients/live/core/bootloader/grub.ks

@@ -0,0 +1,3 @@
+# Live core bootloader configuration
+
+bootloader --timeout=1 # Set the GNU GRUB bootloader timeout to 1 and to location to none

cook/ingredients/live/core/bootloader/systemd-boot.ks

@@ -0,0 +1,3 @@
+# Live core systemd-boot configuration
+
+bootloader --sdboot --location=none --timeout=1 # Use systemd-boot and set location to none

cook/ingredients/live/core/packages.ks

@@ -1,3 +1,5 @@
+# Anaconda tools and kernel packages for live media
+
 %packages # Beginning of the package section. Include weak dependencies. Description courtesy of the Fedora project
 
 @anaconda-tools

cook/ingredients/live/core/storage.ks

@@ -1,3 +1,5 @@
+# Live core storage configuration
+
 zerombr # WARNING : Dangerous command ! Will clear the Master Boot Record
 clearpart --all --initlabel # Partition clearing information. This setup uses GPT by default.
 

cook/ingredients/live/post/base.ks

@@ -1,4 +1,6 @@
-%post --log=/mnt/sysimage/root/post-live-core.log # Beginning of the post-installation section. Add logging.
+# Live core post-installation configuration
+
+%post --log=/mnt/sysimage/root/live-core-post.log # Beginning of the post-installation section. Add logging.
 
 # Enable livesys services
 systemctl enable livesys.service

cook/ingredients/live/post/session.ks

@@ -1,3 +1,5 @@
+# Live session configuration
+
 %post --log=/mnt/sysimage/root/post-live-session.log # Beginning of the post-installation section. Add logging.
 
 # set livesys session type

cook/ingredients/packages/core-explicit.ks

@@ -0,0 +1,93 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# Core packages, broken down explicitly instead of using the `@core` group.
+#
+# Why: dishes that keep the Fedora remix packages (generic-release,
+# generic-logos, fedora-remix-logos) cannot coexist with fedora-release /
+# fedora-logos — both pairs hard-conflict. Listing the core packages
+# explicitly deselects the Fedora release/branding packages while the
+# remix packages provide `system-release`, `system-release(44)`,
+# `fedora-release-identity` and `system-logos` in their place.
+#
+# Package list mirrors the Fedora 44 `core` comps group (mandatory +
+# default packages), plus `basesystem`, `kernel` and `dhcp-client` from
+# the hidden core group, plus `fedora-repos` (usually pulled in via
+# fedora-release-common, which is deselected here), plus session-system
+# essentials (`dbus-daemon`, `systemd-pam`) that would otherwise be
+# dropped by --exclude-weakdeps.
+
+%packages --exclude-weakdeps # Beginning of the packages section. Package description courtesy of the Fedora project
+
+## Mandatory packages found in `core` group (dnf group info --hidden core)
+audit # User space tools for kernel auditing
+basesystem # The skeleton package which defines a simple Fedora system
+bash # The Bourne Again SHell, a command-line interpreter.
+coreutils # A set of basic GNU tools commonly used in shell scripts
+curl # A utility for getting files from remote servers (FTP, HTTP, and others)
+dhcp-client # Provides the ISC DHCP client daemon and dhclient-script
+dnf5 # Command-line package manager
+e2fsprogs # Utilities for managing ext2, ext3, and ext4 file systems
+filesystem # The basic directory layout for a Linux system
+glibc # The GNU libc libraries
+hostname # Utility to set/show the host name or domain name
+iproute # Advanced IP routing and network device configuration tools
+iputils # Network monitoring tools including ping
+kbd # Tools for configuring the console (keyboard, virtual terminals, etc.)
+kernel # The Linux kernel
+less # A text file browser similar to more, but better. Can be excluded
+man-db # Tools for searching and reading man pages. Can be excluded
+ncurses # Ncurses support utilities
+openssh-clients # An open source SSH client applications. Can be excluded
+openssh-server # An open source SSH server daemon. Can be excluded
+parted # The GNU disk partition manipulation program
+policycoreutils # SELinux policy core utilities. Can be excluded
+procps-ng # System and process monitoring utilities
+rootfiles # The basic required files for the root user's directory
+rpm # The RPM package management system
+selinux-policy-targeted # SELinux targeted policy. Can be excluded
+setup # A set of system configuration and setup files
+shadow-utils # Utilities for managing accounts and shadow password files
+sssd-common # Common files for the SSSD. Can be excluded
+sssd-kcm # An implementation of a Kerberos KCM server. Can be excluded
+sudo # Allows restricted root access for specified users
+systemd # System and Service Manager
+util-linux # Collection of basic system utilities
+vim-minimal # A minimal version of the VIM editor
+
+## Default packages found in `core` group (dnf group info --hidden core)
+NetworkManager # Network connection manager and user applications
+dnf5-plugins # Plugins for dnf5
+dracut-config-rescue # dracut configuration to turn on rescue image generation
+firewalld # A firewall daemon with D-Bus interface providing a dynamic firewall
+fwupd # Firmware update daemon
+plymouth # Graphical Boot Animation and Logger
+prefixdevname # Udev helper utility that provides network interface naming using user defined prefix
+systemd-resolved # Network Name Resolution manager
+zram-generator-defaults # Default configuration for zram-generator
+
+## Repository definitions, pulled explicitly since fedora-release is deselected
+fedora-repos # Fedora package repositories
+
+## Session-system essentials that nothing else hard-requires: with
+## --exclude-weakdeps they would be dropped (systemd merely recommends
+## systemd-pam; only anaconda requires dbus-daemon during installation).
+## Without them, login sessions never register with logind (no
+## pam_systemd.so) and display managers cannot spawn the session bus
+## (no /usr/bin/dbus-run-session), which yields a silent black screen.
+dbus-daemon # D-BUS message bus (provides /usr/bin/dbus-run-session, used by gdm-wayland-session et al.)
+systemd-pam # systemd PAM module (pam_systemd.so — registers login sessions with logind, starts user@.service)
+
+## Deselect Fedora release/branding packages — the remix packages below
+## provide system-release, system-release(44), fedora-release-identity and
+## system-logos instead
+-fedora-release
+-fedora-release-common
+-fedora-release-identity-basic
+-fedora-logos
+
+%end # End of the packages section

cook/ingredients/packages/core.ks

@@ -0,0 +1,67 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# Core DNF package group
+# More information: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#id240
+
+%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies. Package description courtesy of the Fedora project
+
+@core
+## Mandatory packages found in hidden `core` group (`dnf group info --hidden core`)
+# audit # User space tools for kernel auditing
+# basesystem # The skeleton package which defines a simple Fedora system
+# bash # The Bourne Again SHell, a command-line interpreter.
+# coreutils # A set of basic GNU tools commonly used in shell scripts
+# curl # A utility for getting files from remote servers (FTP, HTTP, and others)
+# dhcp-client # Provides the ISC DHCP client daemon and dhclient-script
+# dnf5 # Command-line package manager
+# e2fsprogs # Utilities for managing ext2, ext3, and ext4 file systems
+# filesystem # The basic directory layout for a Linux system
+# glibc # The GNU libc libraries
+# hostname # Utility to set/show the host name or domain name
+# iproute # Advanced IP routing and network device configuration tools
+# iputils # Network monitoring tools including ping
+# kbd # Tools for configuring the console (keyboard, virtual terminals, etc.)
+# kernel # The Linux kernel
+# less # A text file browser similar to more, but better. Can be excluded
+# man-db # Tools for searching and reading man pages. Can be excluded
+# ncurses # Ncurses support utilities
+# openssh-clients # An open source SSH client applications. Can be excluded
+# openssh-server # An open source SSH server daemon. Can be excluded
+# parted # The GNU disk partition manipulation program
+# policycoreutils # SELinux policy core utilities. Can be excluded
+# procps-ng # System and process monitoring utilities
+# rootfiles # The basic required files for the root user's directory
+# rpm # The RPM package management system
+# selinux-policy-targeted # SELinux targeted policy. Can be excluded
+# setup # A set of system configuration and setup files
+# shadow-utils # Utilities for managing accounts and shadow password files
+# sssd-common # Common files for the SSSD. Can be excluded
+# sssd-kcm # An implementation of a Kerberos KCM server. Can be excluded
+# sudo # Allows restricted root access for specified users
+# systemd # System and Service Manager
+# util-linux # Collection of basic system utilities
+# vim-minimal # A minimal version of the VIM editor
+
+## Default packages found in hidden `core` group (`dnf group info --hidden core`)
+# NetworkManager # Network connection manager and user applications
+# dnf5-plugins # Plugins for dnf5
+# dracut-config-rescue # dracut configuration to turn on rescue image generation
+# firewalld # A firewall daemon with D-Bus interface providing a dynamic firewall
+# fwupd # Firmware update daemon
+# plymouth # Graphical Boot Animation and Logger
+# prefixdevname # Udev helper utility that provides network interface naming using user defined prefix
+# systemd-resolved # Network Name Resolution manager
+# zram-generator-defaults # Default configuration for zram-generator
+
+## Optionnal packages found in hidden `core` group (`dnf group info --hidden core`)
+## Not installed by default unless "@core --optional" is used
+# dracut-config-generic
+# initial-setup
+# initscripts
+
+%end # End of the packages section

cook/ingredients/packages/fedora-remix.ks

@@ -0,0 +1,18 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# Packages to be used to create a Fedora Remix and comply Fedora Remix legal guidelines: https://fedoraproject.org/wiki/Remix
+
+%packages --exclude-weakdeps
+
+fedora-remix-logos # Fedora Remix logos
+generic-release # Generic release files
+generic-logos # Icons and pictures
+generic-release-common # Generic release files
+generic-release-notes # Release Notes
+
+%end # End of the packages section

cook/ingredients/packages/fscrypt.ks

@@ -0,0 +1,16 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# fscrypt stack: CLI, PAM module and the Phyllome OS configuration package.
+# phyllome-fscrypt depends on fscrypt + pam_fscrypt + authselect, so installing
+# it alone pulls the whole stack.
+
+%packages --exclude-weakdeps
+
+phyllome-fscrypt # SELinux, PAM, repo + first-boot activation for fscrypt
+
+%end # End of the packages section

cook/ingredients/packages/hand-picked.ks

@@ -0,0 +1,13 @@
+# Hand-picked packages
+
+%packages --exclude-weakdeps
+
+grub2-tools # Provides grub2-mkconfig and grub2-editenv, required by the grub2-common %posttrans scriptlet (exit 127 otherwise, which fails the whole dnf transaction)
+pciutils # PCI bus related utilities
+libusb # Library for accessing USB devices
+usbutils # Linux USB utilities
+curl # transfer a URL
+wget # An advanced file and recursive website downloader
+nano # A small text editor
+
+%end # End of the packages section

cook/ingredients/packages/hardware-support.ks

@@ -0,0 +1,61 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# Extended physical hardware support. Useful for bare metal deployments.
+
+%packages --exclude-weakdeps
+
+@hardware-support
+## Mandatory packages found in hidden `hardware-support` group
+# alsa-sof-firmware # Audio drivers and firmware for ALSA. Essential for audio functionality.
+# amd-gpu-firmware # Firmware for AMD GPUs.  Required for proper GPU operation.
+# atheros-firmware # Firmware for Atheros wireless network adapters.  Critical for wireless connectivity.
+# b43-fwcutter # Utility for cutting firmware files for B43 drivers.  Needed for driver compatibility.
+# b43-openfwwf # Driver and firmware for B43 network cards.  Essential for network card operation.
+# brcmfmac-firmware # Firmware for Broadcom MAC controllers.  Required for wireless and wired network performance.
+# cirrus-audio-firmware # Firmware for Cirrus Logic audio chips.  Necessary for audio hardware support.
+# intel-audio-firmware # Firmware for Intel audio processors.  Required for integrated audio functionality.
+# intel-gpu-firmware # Firmware for Intel GPUs. Essential for GPU operation.
+# intel-vsc-firmware # Firmware for Intel Video Scheduling Controller. Required for GPU performance.
+# iwlegacy-firmware # Legacy firmware for older Intel wireless cards.  Needed for compatibility.
+# iwlwifi-dvm-firmware # Firmware for Intel Wireless Link 5100/5200 series. Crucial for wireless connectivity.
+# iwlwifi-mvm-firmware # Firmware for Intel Wireless Link 5300/5400 series. Required for wireless performance.
+# libertas-firmware # Firmware for Broadcom wireless network cards.  Essential for wireless connectivity.
+# mt7xxx-firmware # Firmware for MediaTek wireless network adapters.  Required for wireless connectivity.
+# nvidia-gpu-firmware # Firmware for NVIDIA GPUs. Essential for GPU operation.
+# nxpwireless-firmware # Firmware for NXP wireless network adapters. Required for wireless connectivity.
+# realtek-firmware # Firmware for Realtek network adapters and audio devices.  Essential for various device support.
+# tiwilink-firmware # Firmware for TI WiLink wireless network adapters. Required for wireless connectivity.
+
+## Optional packages found in hidden `hardware-support` group
+## Not installed by default unless "@hardware-support --optional" is used
+# acpi # Command-line ACPI client
+# acpitool # Command line ACPI client
+# alsa-firmware # Firmware for several ALSA-supported sound cards
+# atmel-firmware # Firmware for Atmel at76c50x wireless network chips
+# cmospwd # BIOS password cracker utility
+# dvb-firmware # Firmware for various DVB broadcast receivers
+# gpsd # Service daemon for mediating access to a GPS
+# gpsd-clients # Clients for gpsd
+# hddtemp # Hard disk temperature tool
+# hdparm # A utility for displaying and/or setting hard disk parameters
+# iscan-firmware # Firmware for Epson flatbed scanners
+# libifp # General-purpose library-driver for iRiver's iFP portable audio players
+# lsscsi # List SCSI devices (or hosts) and associated information
+# mlxsw_spectrum-firmware # Firmware for Mellanox Spectrum 1/2/3 Switches
+# mrvlprestera-firmware # Firmware for Marvell Prestera Switchdev/ASIC devices
+# netronome-firmware # Firmware for Netronome Smart NICs
+# opensc # Smart card library and applications
+# pcsc-lite # PC/SC Lite smart card framework and applications
+# pcsc-lite-ccid # Generic USB CCID smart card reader driver
+# qcom-accel-firmware # Firmware for Qualcomm Technologies data center / Open-vRAN Accelerators
+# qed-firmware # Firmware for Marvell FastLinQ adapters family
+# radeontop # AMD Radeon video cards monitoring utility
+# wpan-tools # Userspace tools for the Linux IEEE 802.15.4 stack
+# zd1211-firmware # Firmware for wireless devices based on zd1211 chipset
+
+%end # End of the packages section

cook/ingredients/packages/virtual-machine-manager/packages.ks

@@ -0,0 +1,5 @@
+%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies.
+
+virt-manager # Install virt-manager, a graphical front-end for QEMU/KVM
+
+%end

cook/ingredients/packages/virtual-machine-manager/post-scripts.ks

@@ -1,10 +1,6 @@
-%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies
+# Virt-manager post-installation configuration
 
-virt-manager # Install virt-manager, a graphical front-end for QEMU/KVM
-
-%end
-
-%post --nochroot --log=/mnt/sysimage/root/base-desktop-gnome-virtual-machine-manager.log # Beginning of %post section. Those commands are executed outside the chroot environment. Add logging.
+%post --nochroot --log=/mnt/sysimage/root/vmm-post-scripts.log # Beginning of %post section
 
 # Create a file to autostart virt-manager
 cat > /mnt/sysimage/etc/xdg/autostart/virt-manager.desktop << EOF
@@ -17,45 +13,37 @@ EOF
 # Modify the default virt-manager behavior for misc. options
 cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.virt-manager.virt-manager.gschema.override<< EOF
 
-# Modify the default virt-manager behavior for misc. options
 [org.virt-manager.virt-manager]
 xmleditor-enabled=true
 manager-window-height=600
 manager-window-width=200
 
-# Libvirt URIs listed in the manager window
 [org.virt-manager.virt-manager.connections]
 uris=['qemu:///system', 'qemu:///session']
 autoconnect=['qemu:///session']
 
-# Show usage in the domain list
 [org.virt-manager.virt-manager.vmlist-fields]
 cpu-usage=false
 
-# Settings related to statistics
 [org.virt-manager.virt-manager.stats]
 update-interval=3
 enable-disk-poll=true
 enable-memory-poll=true
 enable-net-poll=true
 
-# Default behavior for the console
 [org.virt-manager.virt-manager.console]
 scaling=2
 resize-guest=1
 autoconnect=false
 
-# Do not show toolbar
 [org.virt-manager.virt-manager.details]
 show-toolbar=false
 
-# Modify default values for new VMs
 [org.virt-manager.virt-manager.new-vm]
 storage-format='raw'
 cpu-default='host-model'
 graphics-type='spice'
 
-# Modify the default virt-manager behavior for confirmation dialogues
 [org.virt-manager.virt-manager.confirm]
 forcepoweroff=false
 removedev=false

cook/ingredients/repo/fedora-43-mirrors.ks

@@ -1,3 +1,5 @@
+# Fedora 43 repositories
+
 repo --name=fedora --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64 # Official Fedora mirror
 repo --name=updates --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64 # Official Fedora updates mirror
 url --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64 # Official Fedora updates mirror

cook/ingredients/repo/fedora-44-mirrors.ks

@@ -0,0 +1,5 @@
+# Fedora 44 repositories
+
+repo --name=fedora --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-44&arch=x86_64 # Official Fedora mirror
+repo --name=updates --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f44&arch=x86_64 # Official Fedora updates mirror
+url --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-44&arch=x86_64 # Official Fedora updates mirror

cook/ingredients/repo/phyllome.ks

@@ -0,0 +1,16 @@
+#            __          ____                        ____  _____
+#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
+#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
+#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
+#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
+# /_/          /____/
+
+# Phyllome OS downstream repository: the fscrypt / phyllome-fscrypt RPMs
+# published to the git.phyllo.me roots registry.
+#
+# gpgcheck stays at the anaconda default (enforced by the registry's TLS end-to-
+# end; Gitea's RPM registry does not sign its repodata, see
+# fscrypt-fedora/rpm/README.md). Noverifyssl is not set: the registry presents
+# a valid TLS certificate.
+
+repo --name=phyllome --baseurl=https://git.phyllo.me/api/packages/roots/rpm # Phyllome OS repository (fscrypt stack)

cook/ingredients/repo/rawhide-mirrors.ks

@@ -1,2 +1,4 @@
+# Fedora Rawhide repositories
+
 repo --name=rawhide --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=rawhide&arch=x86_64
 url --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=rawhide&arch=x86_64

cook/ingredients/storage/biosboot.ks

@@ -0,0 +1,8 @@
+# BIOS boot storage configuration (GPT disk label with a BIOS boot partition)
+
+zerombr # Destroy all the contents of disks with invalid partition tables or other formatting unrecognizable to the installer
+clearpart --all --initlabel --disklabel=gpt # Erase all partitions, initialize a GPT disk label, and initialize the disk label to the default for the target architecture
+
+part biosboot --fstype="biosboot" --size=2 --label=biosboot # Creates a 2 MiB BIOS boot partition, required to install GRUB on a GPT-labelled disk under legacy BIOS firmware
+part /boot --fstype="ext4" --size=2048 --label=boot # Creates a 2048 MiB ext4 boot partition
+part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit" # Create a single root partition with the remaining space

cook/ingredients/storage/encrypted.ks

@@ -0,0 +1,75 @@
+# Encrypted storage configuration
+
+zerombr # Destroy all the contents of disks with invalid partition tables or other formatting unrecognizable to the installer
+clearpart --all --initlabel # Erase all partitions and Initializes the disk label to the default for the target architecture
+
+part /boot/efi --fstype="efi" --size=512 --fsoptions="umask=0077,shortname=winnt" --label=efi # Creates a 512 MiB EFI system partition
+part /boot --fstype="ext4" --size=2048 --label=boot # Creates a 2048 MiB ext4 boot partition
+part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit" --encrypted --passphrase= # Create a single encrypted root partition with the remaining space.
+
+# Tools for LUKS management and TPM2-based auto-unlock
+%packages --exclude-weakdeps
+
+cryptsetup # Userspace tool for dm-crypt, required to open and manage the LUKS root device
+tpm2-tools # TPM2 tools, provides the dracut tpm2-tss module needed to rebuild the initrd for TPM2 auto-unlock
+tpm2-tss # TPM2 TSS libraries, runtime dependency of tpm2-tools and systemd-cryptenroll
+
+%end # End of the packages section
+
+# Stash a preseeded LUKS passphrase so the %post below can enroll TPM2-based
+# auto-unlock. Only acts when `--passphrase=` was preseeded on the encrypted
+# `part /` line; with the interactive default (empty passphrase) nothing is
+# stashed and the %post enrollment is skipped cleanly.
+%pre --logfile=/tmp/luks-tpm-pre.log
+
+KS_FILE=""
+for candidate in /run/install/ks.cfg /tmp/ks.cfg; do
+    if [ -f "$candidate" ]; then
+        KS_FILE="$candidate"
+        break
+    fi
+done
+
+if [ -n "$KS_FILE" ]; then
+    LINE=$(grep -E '^[[:space:]]*part[[:space:]]+/[[:space:]].*--encrypted' "$KS_FILE" | grep -- '--passphrase=' | head -n 1)
+    if [ -n "$LINE" ]; then
+        PW=${LINE#*--passphrase=}
+        case "$PW" in
+            \"*) PW=${PW#\"}; PW=${PW%%\"*} ;;
+            *)   PW=${PW%%[[:space:]]*} ;;
+        esac
+        if [ -n "$PW" ]; then
+            printf '%s' "$PW" > /tmp/.luks-passphrase
+            chmod 600 /tmp/.luks-passphrase
+        fi
+    fi
+fi
+
+%end
+
+# Enroll TPM2-based LUKS auto-unlock (PCR 7-bound) when both guards hold: a
+# TPM2 device is available at install time and a passphrase was preseeded in
+# the kickstart (stashed by the %pre above). Otherwise the system keeps the
+# regular passphrase prompt at boot. On any failure the LUKS configuration is
+# left untouched, so the worst case is a passphrase prompt on every boot.
+%post --logfile=/root/luks-tpm-post.log
+
+if [ -e /dev/tpmrm0 ] && [ -s /tmp/.luks-passphrase ]; then
+    set -x
+    LUKSUUID=$(awk '$2 ~ /^UUID=/ {sub(/^UUID=/, "", $2); print $2}' /etc/crypttab)
+    LUKSDEV="/dev/disk/by-uuid/$LUKSUUID"
+    if systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --unlock-key-file=/tmp/.luks-passphrase "$LUKSDEV"; then
+        sed -i 's| none discard,x-initrd.attach| tpm2-device=auto,discard,x-initrd.attach|' /etc/crypttab
+        if ! grep -q 'tpm2-device=auto' /etc/crypttab; then
+            sed -i -E 's|[[:space:]]none([[:space:]]|$)| tpm2-device=auto,discard\1|' /etc/crypttab
+        fi
+        if grep -q 'tpm2-device=auto' /etc/crypttab; then
+            MID=$(cat /etc/machine-id)
+            KVER=$(ls /usr/lib/modules | head -n 1)
+            dracut -f --kver "$KVER" "/boot/efi/$MID/$KVER/initrd"
+        fi
+    fi
+    shred -u /tmp/.luks-passphrase 2>/dev/null || true
+fi
+
+%end

cook/ingredients/storage/standard.ks

@@ -0,0 +1,8 @@
+# Standard storage configuration
+
+zerombr # Destroy all the contents of disks with invalid partition tables or other formatting unrecognizable to the installer
+clearpart --all --initlabel # Erase all partitions and Initializes the disk label to the default for the target architecture
+
+part /boot/efi --fstype="efi" --size=512 --fsoptions="umask=0077,shortname=winnt" --label=efi # Creates a 512 MiB EFI system partition
+part /boot --fstype="ext4" --size=2048 --label=boot # Creates a 2048 MiB ext4 boot partition
+part / --fstype="ext4" --grow --label=root --mkfsoptions="-O encrypt,fast_commit" # Create a single root partition with the remaining space

cook/recipe_templates.yaml

@@ -0,0 +1,86 @@
+# Phyllome OS ingredient templates ("Proteus")
+#
+# Maps recipe variants to kickstart ingredient fragments. Every fragment path
+# is relative to the ingredients/ directory.
+#
+# Sections:
+#   base     -- fragments included in every recipe, in declaration order.
+#   choices  -- "exactly-one" categories. Each variant must resolve to a single
+#               value per category; pykickstart cannot detect two variants of a
+#               choice being enabled at once, so the generator enforces it.
+#               When a variant omits a category, the first declared value is used.
+#   features -- additive fragments a variant enables independently:
+#                 * a plain string  => boolean flag; included when the variant
+#                                      value is truthy (e.g. hardware-support)
+#                 * a dict          => one-of; the variant value selects the
+#                                      matching fragment(s)
+
+name: proteus
+description: "Universal template to generate kickstart recipes for a server, a desktop or a hypervisor system"
+
+base:
+  - core/base.ks
+  - core/locale.ks
+  - core/network.ks
+  - core/services.ks
+  - packages/core-explicit.ks
+  - packages/fedora-remix.ks
+  - packages/hand-picked.ks
+
+choices:
+  repository:
+    "43": repo/fedora-43-mirrors.ks
+    "44": repo/fedora-44-mirrors.ks
+    rawhide: repo/rawhide-mirrors.ks
+  storage:
+    standard: storage/standard.ks
+    encrypted: storage/encrypted.ks
+    biosboot: storage/biosboot.ks
+    livefs: live/core/storage.ks
+  bootloader:
+    grub: bootloader/grub.ks
+    systemd-boot: bootloader/systemd-boot.ks
+  security:
+    enabled: core/security/enabled.ks
+    disabled: core/security/disabled.ks
+  initial-setup:
+    server: initial-setup/server/config.ks
+    gnome: initial-setup/gnome/config.ks
+    generic-wayland: initial-setup/generic-wayland/config.ks
+
+features:
+  desktop:
+    gnome:
+      - desktop/gnome/config.ks
+      - desktop/gnome/packages.ks
+      - desktop/gnome/post-scripts.ks
+    labwc:
+      - desktop/labwc/config.ks
+  hypervisor:
+    base:
+      - hypervisor/base/packages.ks
+      - hypervisor/base/services.ks
+      - hypervisor/base/post-scripts.ks
+    desktop:
+      - hypervisor/base/packages.ks
+      - hypervisor/base/services.ks
+      - hypervisor/base/post-scripts.ks
+      - packages/virtual-machine-manager/packages.ks
+      - packages/virtual-machine-manager/post-scripts.ks
+  hypervisor_type:
+    any: hypervisor/cpu-agnostic.ks
+    amdcpu: hypervisor/amdcpu.ks
+    intelcpu: hypervisor/intelcpu.ks
+    intelgpu: hypervisor/intelgpu.ks
+  hardware-support: packages/hardware-support.ks
+  guest-agents: guest-agents/base.ks
+  fscrypt:
+    true:
+      - repo/phyllome.ks
+      - packages/fscrypt.ks
+  live:
+    true:
+      - live/core/base.ks
+      - live/core/packages.ks
+      - live/post/base.ks
+      - live/post/session.ks

cook/recipes_manifest.yaml

@@ -0,0 +1,126 @@
+# Recipe Manifest for Phyllome OS
+# Define all recipe variants using ingredients from recipe_templates.yaml.
+# Edit this file to add new variants, then run: make all
+#
+# Tiers: every group belongs to a tier (default: "default"). Only the requested
+# tier is generated, so the default build stays tiny:
+#   default       -- the two shipping editions (phyllomeos, phyllomeos-headless)
+#   guest         -- Fedora VM guests to deploy on a Phyllome OS host
+#   experimental  -- one-off variants for testing new dishes
+# Build a tier with:  make all TIER=guest   (or: TIER="default guest", TIER=all)
+# Lint always covers every tier.
+#
+# Syntax:
+# - Single values: repository: "44"
+# - List values: repository: ["43", "44"] (expands to multiple variants)
+# - Booleans: hardware-support: true / false (feature flags)
+#
+# NOTE: List values create a cartesian product. Keep it out of the default and
+# guest tiers; prefer one hand-written variant per experimental dish.
+#
+# NOTE: The 'name' field prefixes every generated dish/recipe filename, e.g.
+# the "phyllomeos" group yields phyllomeos_44_standard_systemd-boot_...cfg.
+
+recipes:
+  # --- default tier: the two shipping editions -------------------------------
+
+  # Phyllome OS with a GUI (GNOME + virt-manager)
+  - name: phyllomeos
+    tier: default
+    variants:
+      - repository: "44"
+        desktop: gnome
+        storage: standard
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: gnome
+        hardware-support: true
+        guest-agents: true
+        fscrypt: true
+        hypervisor: desktop
+        hypervisor_type: any
+
+  # Headless Phyllome OS
+  - name: phyllomeos-headless
+    tier: default
+    variants:
+      - repository: "44"
+        storage: standard
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: server
+        hardware-support: true
+        guest-agents: true
+        fscrypt: true
+        hypervisor: base
+        hypervisor_type: any
+
+  # --- guest tier: VMs to deploy on a Phyllome OS host -------------------------
+
+  - name: guest-server
+    tier: guest
+    variants:
+      - repository: "44"
+        storage: standard
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: server
+        hardware-support: false
+        guest-agents: true
+
+  - name: guest-desktop
+    tier: guest
+    variants:
+      - repository: "44"
+        desktop: gnome
+        storage: standard
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: gnome
+        hardware-support: false
+        guest-agents: true
+
+  # --- experimental tier: single variants, no matrices -------------------------
+
+  # BIOS (legacy firmware) laptop: GPT + biosboot partition, GRUB
+  - name: exp-bios-desktop-hypervisor
+    tier: experimental
+    variants:
+      - repository: "44"
+        desktop: gnome
+        storage: biosboot
+        bootloader: grub
+        security: enabled
+        initial-setup: gnome
+        hardware-support: true
+        guest-agents: false
+        hypervisor: desktop
+        hypervisor_type: any
+
+  # Encrypted root
+  - name: exp-encrypted-headless
+    tier: experimental
+    variants:
+      - repository: "44"
+        storage: encrypted
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: server
+        hardware-support: true
+        guest-agents: true
+        hypervisor: base
+        hypervisor_type: any
+
+  # Rawhide
+  - name: exp-rawhide-headless
+    tier: experimental
+    variants:
+      - repository: rawhide
+        storage: standard
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: server
+        hardware-support: true
+        guest-agents: true
+        hypervisor: base
+        hypervisor_type: any

cook/requirements.txt

@@ -0,0 +1,3 @@
+PyYAML>=6.0
+pykickstart>=1.99
+pytest>=7.0

cook/tests/conftest.py

@@ -0,0 +1,5 @@
+import os
+import sys
+
+COOK_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, COOK_DIR)

cook/tests/test_generator.py

@@ -0,0 +1,354 @@
+"""Tests for the Phyllome OS recipe generator (cook/generate_recipe.py)."""
+
+import os
+
+import pytest
+import yaml
+
+import generate_recipe as gen
+
+COOK_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+
+@pytest.fixture
+def templates():
+    return gen.load_yaml(os.path.join(COOK_DIR, "recipe_templates.yaml"))
+
+
+BASE_FRAGMENTS = [
+    "core/base.ks",
+    "core/locale.ks",
+    "core/network.ks",
+    "core/services.ks",
+    "packages/core-explicit.ks",
+    "packages/fedora-remix.ks",
+    "packages/hand-picked.ks",
+]
+
+
+def desktop_group(variants):
+    return {"recipes": [{"name": "desktop", "variants": variants}]}
+
+
+# ---------------------------------------------------------------------------
+# expand_variants
+# ---------------------------------------------------------------------------
+
+def test_expand_variants_cartesian_count():
+    config = {
+        "repository": ["43", "rawhide"],
+        "desktop": "gnome",
+        "storage": ["standard", "encrypted"],
+        "bootloader": ["grub", "systemd-boot"],
+        "hardware-support": [True, False],
+        "guest-agents": [True, False],
+    }
+    variants = gen.expand_variants(config)
+    assert len(variants) == 2 * 2 * 2 * 2 * 2
+    # Every variant keeps the scalar key and resolves one value per list key.
+    for variant in variants:
+        assert variant["desktop"] == "gnome"
+        assert variant["repository"] in ("43", "rawhide")
+        assert variant["storage"] in ("standard", "encrypted")
+        assert variant["bootloader"] in ("grub", "systemd-boot")
+        assert isinstance(variant["hardware-support"], bool)
+        assert isinstance(variant["guest-agents"], bool)
+
+
+def test_expand_variants_all_combos_present():
+    config = {
+        "storage": ["standard", "encrypted"],
+        "bootloader": ["grub", "systemd-boot"],
+    }
+    combos = {(v["storage"], v["bootloader"]) for v in gen.expand_variants(config)}
+    assert combos == {
+        ("standard", "grub"),
+        ("standard", "systemd-boot"),
+        ("encrypted", "grub"),
+        ("encrypted", "systemd-boot"),
+    }
+
+
+# ---------------------------------------------------------------------------
+# collect_fragments
+# ---------------------------------------------------------------------------
+
+def test_collect_fragments_gnome_standard(templates):
+    variant = {
+        "repository": "43",
+        "desktop": "gnome",
+        "storage": "standard",
+        "bootloader": "grub",
+        "hardware-support": False,
+        "guest-agents": False,
+    }
+    fragments, problems = gen.collect_fragments(templates, variant)
+    assert problems == []
+    assert fragments[:7] == BASE_FRAGMENTS
+    assert "repo/fedora-43-mirrors.ks" in fragments
+    assert "storage/standard.ks" in fragments
+    assert "storage/encrypted.ks" not in fragments
+    assert "bootloader/grub.ks" in fragments
+    assert "core/security/enabled.ks" in fragments
+    assert "core/security/disabled.ks" not in fragments
+    assert "initial-setup/server/config.ks" in fragments
+    assert "guest-agents/base.ks" not in fragments
+    assert "packages/hardware-support.ks" not in fragments
+    for slug in ("desktop/gnome/config.ks", "desktop/gnome/packages.ks",
+                 "desktop/gnome/post-scripts.ks"):
+        assert slug in fragments
+
+
+@pytest.mark.parametrize("release", ["43", "44"])
+def test_collect_fragments_release_repository(templates, release):
+    variant = {"repository": release}
+    fragments, problems = gen.collect_fragments(templates, variant)
+    assert problems == []
+    assert f"repo/fedora-{release}-mirrors.ks" in fragments
+
+
+def test_collect_fragments_choices_default_to_first(templates):
+    variant = {"repository": "43"}
+    fragments, problems = gen.collect_fragments(templates, variant)
+    assert problems == []
+    # Omitted choices fall back to their first declared value.
+    assert "storage/standard.ks" in fragments
+    assert "bootloader/grub.ks" in fragments
+    assert "core/security/enabled.ks" in fragments
+    assert "initial-setup/server/config.ks" in fragments
+
+
+def test_collect_fragments_flags(templates):
+    off, off_problems = gen.collect_fragments(
+        templates, {"repository": "43", "hardware-support": False, "guest-agents": False})
+    on, on_problems = gen.collect_fragments(
+        templates, {"repository": "43", "hardware-support": True, "guest-agents": True})
+    assert off_problems == [] and on_problems == []
+    assert "packages/hardware-support.ks" not in off
+    assert "guest-agents/base.ks" not in off
+    assert "packages/hardware-support.ks" in on
+    assert "guest-agents/base.ks" in on
+
+
+def test_collect_fragments_unknown_choice_reports_problem(templates):
+    _, problems = gen.collect_fragments(templates, {"repository": "sid"})
+    assert any("repository" in p and "sid" in p for p in problems)
+
+
+def test_collect_fragments_unknown_feature_reports_problem(templates):
+    _, problems = gen.collect_fragments(templates, {"repository": "43", "desktop": "kde"})
+    assert any("desktop" in p and "kde" in p for p in problems)
+
+
+def test_collect_fragments_dedups(templates):
+    variant = {"repository": "43", "desktop": "gnome"}
+    fragments, _ = gen.collect_fragments(templates, variant)
+    assert len(fragments) == len(set(fragments))
+
+
+# ---------------------------------------------------------------------------
+# render_filename
+# ---------------------------------------------------------------------------
+
+def test_render_filename(templates):
+    manifest = desktop_group([
+        {"repository": "43", "desktop": "gnome", "storage": "standard",
+         "bootloader": "grub", "hardware-support": True, "guest-agents": False},
+    ])
+    group = manifest["recipes"][0]
+    name = gen.render_filename(templates, group["name"],
+                               gen.expand_variants(group["variants"][0])[0])
+    assert name == "desktop_43_standard_grub_gnome_hardware-support.cfg"
+
+
+def test_render_filename_key_order_irrelevant(templates):
+    # Naming must not depend on the order keys appear in the manifest.
+    a = {"repository": "43", "storage": "standard", "bootloader": "grub",
+         "desktop": "gnome"}
+    b = {"desktop": "gnome", "bootloader": "grub", "storage": "standard",
+         "repository": "43"}
+    assert gen.render_filename(templates, "desktop", a) == \
+        gen.render_filename(templates, "desktop", b)
+
+
+def test_render_filenames_unique_across_matrix(templates):
+    manifest = desktop_group([
+        {"repository": ["43", "rawhide"], "desktop": "gnome",
+         "storage": ["standard", "encrypted"],
+         "bootloader": ["grub", "systemd-boot"],
+         "hardware-support": [True, False], "guest-agents": [True, False]},
+    ])
+    names = []
+    for group in manifest["recipes"]:
+        for config in group["variants"]:
+            for variant in gen.expand_variants(config):
+                names.append(gen.render_filename(templates, group["name"], variant))
+    assert len(names) == 32
+    assert len(set(names)) == 32
+
+
+# ---------------------------------------------------------------------------
+# lint_manifest
+# ---------------------------------------------------------------------------
+
+def test_lint_clean_manifest(templates):
+    manifest = desktop_group([
+        {"repository": "43", "desktop": "gnome", "storage": "standard",
+         "bootloader": "grub", "hardware-support": False, "guest-agents": False},
+    ])
+    problems = gen.lint_manifest(manifest, templates, os.path.join(COOK_DIR, "ingredients"))
+    assert problems == []
+
+
+def test_lint_catches_missing_ingredient(templates, tmp_path):
+    # Point lint at an empty ingredients dir so every fragment is missing.
+    manifest = desktop_group([
+        {"repository": "43", "desktop": "gnome", "storage": "standard",
+         "bootloader": "grub"},
+    ])
+    problems = gen.lint_manifest(manifest, templates, str(tmp_path))
+    assert any("missing ingredient fragment" in p for p in problems)
+
+
+def test_lint_catches_unknown_key_and_duplicates(templates):
+    manifest = {
+        "recipes": [
+            {"name": "desktop", "variants": [
+                {"repository": "43", "storage": "btrfs", "bootloader": "grub",
+                 "desktop": "kde", "typo-key": True}]},
+            {"name": "desktop", "variants": [
+                {"repository": "43", "storage": "standard", "bootloader": "grub"}]},
+        ]
+    }
+    problems = gen.lint_manifest(manifest, templates, os.path.join(COOK_DIR, "ingredients"))
+    text = "\n".join(problems)
+    assert "unknown variant key 'typo-key'" in text
+    assert "unknown value 'btrfs'" in text
+    assert "unknown value 'kde'" in text
+    assert "duplicate group name 'desktop'" in text
+
+
+# ---------------------------------------------------------------------------
+# flatten / validate via pykickstart
+# ---------------------------------------------------------------------------
+
+def test_flatten_and_validate(tmp_path):
+    ingredients = tmp_path / "ingredients"
+    recipes = tmp_path / "recipes"
+    ingredients.mkdir()
+    recipes.mkdir()
+    (ingredients / "core.ks").write_text("text\nrootpw --lock\n")
+    (ingredients / "locale.ks").write_text("lang en_US.UTF-8\n")
+
+    recipe = recipes / "desktop_43.cfg"
+    recipe.write_text(
+        "%include ../ingredients/core.ks\n%include ../ingredients/locale.ks\n")
+
+    dish = gen.flatten_recipe(str(recipe))
+    assert "text" in dish
+    assert "rootpw --lock" in dish
+    assert "lang en_US.UTF-8" in dish
+    # The flattened output is standalone: no %include may survive.
+    assert "%include" not in dish
+
+    dish_path = tmp_path / "desktop_43.dish"
+    dish_path.write_text(dish)
+    ok, error = gen.validate_dish(str(dish_path))
+    assert ok, error
+
+
+def test_generate_writes_recipes_and_dishes(tmp_path, templates):
+    manifest = tmp_path / "manifest.yaml"
+    manifest.write_text(yaml.safe_dump(desktop_group([
+        {"repository": "43", "desktop": "gnome", "storage": "standard",
+         "bootloader": "grub", "hardware-support": False, "guest-agents": False},
+    ])))
+    # recipes/ must be a sibling of ingredients/ for %include resolution, so
+    # symlink the real ingredients tree next to the generated recipes.
+    (tmp_path / "ingredients").symlink_to(os.path.join(COOK_DIR, "ingredients"),
+                                          target_is_directory=True)
+    recipes = tmp_path / "recipes"
+    dishes = tmp_path / "dishes"
+    recipes.mkdir()
+    dishes.mkdir()
+
+    code = gen.generate(str(manifest), os.path.join(COOK_DIR, "recipe_templates.yaml"),
+                        str(recipes), str(dishes), "ingredients")
+    assert code == 0
+    assert len(list(recipes.glob("*.cfg"))) == 1
+    assert len(list(dishes.glob("*.cfg"))) == 1
+    dish = (dishes / "desktop_43_standard_grub_gnome.cfg").read_text()
+    assert "%include" not in dish
+
+# ---------------------------------------------------------------------------
+# tiers and the real manifest
+# ---------------------------------------------------------------------------
+
+def real_manifest():
+    return gen.load_yaml(os.path.join(COOK_DIR, "recipes_manifest.yaml"))
+
+
+def dish_names(manifest, templates, tiers):
+    return sorted(
+        gen.render_filename(templates, group["name"], variant)
+        for group in gen.select_groups(manifest, tiers)
+        for config in group["variants"]
+        for variant in gen.expand_variants(config))
+
+
+def test_select_groups_defaults_untiered_groups_to_default():
+    manifest = {"recipes": [{"name": "a"}, {"name": "b", "tier": "guest"}]}
+    assert [g["name"] for g in gen.select_groups(manifest, ("default",))] == ["a"]
+    assert [g["name"] for g in gen.select_groups(manifest, ("guest",))] == ["b"]
+    assert [g["name"] for g in gen.select_groups(manifest, ("all",))] == ["a", "b"]
+
+
+def test_real_manifest_lints_clean_across_all_tiers(templates):
+    problems = gen.lint_manifest(real_manifest(), templates,
+                                 os.path.join(COOK_DIR, "ingredients"))
+    assert problems == []
+
+
+def test_default_tier_is_the_two_editions(templates):
+    names = dish_names(real_manifest(), templates, ("default",))
+    assert len(names) == 2
+    assert sorted(n.split("_")[0] for n in names) == ["phyllomeos", "phyllomeos-headless"]
+
+
+def test_guest_tier_is_server_and_desktop(templates):
+    names = dish_names(real_manifest(), templates, ("guest",))
+    assert sorted(n.split("_")[0] for n in names) == ["guest-desktop", "guest-server"]
+    assert all("guest-agents" in n for n in names)
+
+
+def test_shipping_dishes_contents(templates):
+    manifest = real_manifest()
+    for group in gen.select_groups(manifest, ("default",)):
+        variant = gen.expand_variants(group["variants"][0])[0]
+        fragments, problems = gen.collect_fragments(templates, variant)
+        assert problems == []
+        assert "hypervisor/cpu-agnostic.ks" in fragments
+        assert "bootloader/systemd-boot.ks" in fragments
+        assert "storage/standard.ks" in fragments
+        assert ("desktop/gnome/config.ks" in fragments) == (group["name"] == "phyllomeos")
+
+
+def test_generate_only_writes_requested_tier_and_clears_stale(tmp_path):
+    (tmp_path / "ingredients").symlink_to(os.path.join(COOK_DIR, "ingredients"),
+                                          target_is_directory=True)
+    recipes = tmp_path / "recipes"
+    dishes = tmp_path / "dishes"
+    recipes.mkdir()
+    dishes.mkdir()
+    (dishes / "stale.cfg").write_text("stale")
+    (recipes / "stale.cfg").write_text("stale")
+    templates_path = os.path.join(COOK_DIR, "recipe_templates.yaml")
+    manifest_path = os.path.join(COOK_DIR, "recipes_manifest.yaml")
+
+    code = gen.generate(manifest_path, templates_path, str(recipes), str(dishes),
+                        "ingredients", tiers=("guest",))
+    assert code == 0
+    names = sorted(p.name.split("_")[0] for p in dishes.glob("*.cfg"))
+    assert names == ["guest-desktop", "guest-server"]
+    assert not (dishes / "stale.cfg").exists()
+    assert not (recipes / "stale.cfg").exists()

deploy.sh

@@ -11,12 +11,36 @@ execute_script() {
   return 0  # Indicate success
 }
 
+# Usage: ./deploy.sh [--tier default|guest|experimental|all]
+# Tier of dishes to generate and offer (default: default). Use "guest" to
+# deploy a plain Fedora server/desktop VM on a Phyllome OS host.
+TIER="${TIER:-default}"
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --tier)
+      TIER="$2"
+      shift 2
+      ;;
+    *)
+      echo "Unknown argument: $1"
+      echo "Usage: $0 [--tier default|guest|experimental|all]"
+      exit 1
+      ;;
+  esac
+done
+
+# Generate recipes and dishes before deployment (they are build products)
+if ! (cd cook && make all TIER="$TIER"); then
+  echo "Failed to generate dishes in cook/ (see 'make all' in cook/)"
+  exit 1
+fi
+
 # Array of scripts
 scripts=(
-  "./scripts/install-prerequisites-on-linux.sh"
-  "./scripts/core-count.sh"
-  "./scripts/system-memory.sh"
-  "./scripts/deploy-distro.sh"
+  "./deploy/install-prerequisites-on-linux.sh"
+  "./deploy/core-count.sh"
+  "./deploy/system-memory.sh"
+  "./deploy/deploy-distro.sh"
 )
 
 # Iterate through the scripts and execute them

deploy/deploy-distro.sh

@@ -0,0 +1,201 @@
+#!/bin/bash
+
+# Default values
+DEFAULT_MEMORY=4096
+DEFAULT_DISK_SIZE=10
+
+# Function to find Fedora ISO based on dish name
+find_fedora_iso() {
+    local iso_dir="/var/lib/libvirt/isos"
+    local dish_name="$1"
+    local fedora_iso=""
+    
+    # Check if directory exists
+    if [ -d "$iso_dir" ]; then
+        # Parse dish name to extract version or "rawhide"
+        local version=""
+        if [[ "$dish_name" == *"rawhide"* ]]; then
+            version="Rawhide"
+        elif [[ "$dish_name" == *"_43"* ]]; then
+            version="43"
+        elif [[ "$dish_name" == *"_44"* ]]; then
+            version="44"
+        elif [[ "$dish_name" == *"_45"* ]]; then
+            version="45"
+        fi
+        
+        # If we found a version, try to match with that version in ISO name
+        if [ -n "$version" ]; then
+            if [ "$version" = "Rawhide" ]; then
+                # For rawhide, look for ISO with "Rawhide" in the name
+                fedora_iso=$(find "$iso_dir" -maxdepth 1 -name "Fedora-Everything*.iso" -type f | grep -i "rawhide" | head -n 1)
+            else
+                # For regular versions, look for ISO with that version number in the name
+                fedora_iso=$(find "$iso_dir" -maxdepth 1 -name "Fedora-Everything*.iso" -type f | grep -i "$version" | head -n 1)
+            fi
+            
+            # If no specific version match found, fallback to any Fedora-Everything ISO
+            if [ -z "$fedora_iso" ] || [ ! -f "$fedora_iso" ]; then
+                fedora_iso=$(find "$iso_dir" -maxdepth 1 -name "Fedora-Everything*.iso" -type f | head -n 1)
+            fi
+        else
+            # No version match found, fallback to any Fedora-Everything ISO
+            fedora_iso=$(find "$iso_dir" -maxdepth 1 -name "Fedora-Everything*.iso" -type f | head -n 1)
+        fi
+        
+        # If found, return the full path
+        if [ -n "$fedora_iso" ] && [ -f "$fedora_iso" ]; then
+            echo "$fedora_iso"
+            return 0
+        fi
+    fi
+    
+    # Return empty if no ISO found
+    echo ""
+    return 1
+}
+
+# Function to find Fedora ISO (backward compatibility)
+find_fedora_iso_old() {
+    local iso_dir="/var/lib/libvirt/isos"
+    local fedora_iso=""
+    
+    # Check if directory exists
+    if [ -d "$iso_dir" ]; then
+        # Find the first Fedora-Everything*.iso file
+        fedora_iso=$(find "$iso_dir" -maxdepth 1 -name "Fedora-Everything*.iso" -type f | head -n 1)
+        
+        # If found, return the full path
+        if [ -n "$fedora_iso" ] && [ -f "$fedora_iso" ]; then
+            echo "$fedora_iso"
+            return 0
+        fi
+    fi
+    
+    # Return empty if no ISO found
+    echo ""
+    return 1
+}
+
+# Prompt user for VM memory size
+read -r -p "Provide desired VM memory in MB or press Enter to keep default value of $DEFAULT_MEMORY MB): " memory_size
+memory_size=${memory_size:-$DEFAULT_MEMORY}
+
+# Validate memory size
+if ! [[ "$memory_size" =~ ^[0-9]+$ ]] || (( memory_size < 2048 )); then
+    echo "Invalid memory size.  Must be a number greater than or equal to 2048. Using default value of $DEFAULT_MEMORY MB."
+    memory_size=$DEFAULT_MEMORY
+fi
+
+# Prompt user for VM disk size
+read -r -p "Provide desired disk size of VM in GB or press Enter to use default disk size of $DEFAULT_DISK_SIZE GB: " disk_size
+disk_size=${disk_size:-$DEFAULT_DISK_SIZE}
+
+# Validate disk size
+if ! [[ "$disk_size" =~ ^[0-9]+$ ]] || (( disk_size < 10 )); then
+    echo "Invalid disk size.  Must be a number greater than or equal to 10 GiB. Using default value of $DEFAULT_DISK_SIZE."
+    disk_size=$DEFAULT_DISK_SIZE
+fi
+
+# Set the choices
+CHOICE_SYSTEM="qemu:///system"
+CHOICE_SESSION="qemu:///session"
+
+# Display the choices to the user
+echo "Please select an option or press Enter to keep default value of $CHOICE_SESSION):"
+echo "1) $CHOICE_SYSTEM (system-based or rootfull virtual machine)"
+echo "2) $CHOICE_SESSION (session-based or rootless virtual machine)"
+
+# Prompt the user for input
+IFS= read -r -p "Enter your choice (1 or 2): " user_choice
+
+# Validate the user's input
+if [[ ! "$user_choice" =~ ^[12]$ ]]; then
+  echo "Invalid choice.  Defaulting to session-based VM."
+  uri="$CHOICE_SESSION"  # Default to session-based if input is invalid
+else
+  # Determine the selected option
+  case "$user_choice" in
+    1)
+      uri="$CHOICE_SYSTEM"
+      ;;
+    2)
+      uri="$CHOICE_SESSION"
+      ;;
+    *)
+      echo "Unexpected error: Invalid choice. This should not happen due to validation."
+      exit 1
+      ;;
+  esac
+
+  # Conditional variable assignment based on URI
+  if [[ "$uri" == "qemu:///system" ]]; then
+    disk_path="/var/lib/libvirt/images/"
+    network_type="default"
+  elif [[ "$uri" == "qemu:///session" ]]; then
+    disk_path="$HOME/.local/share/libvirt/images/"
+    network_type="user"
+  fi
+fi
+
+# Display the selected option (optional)
+echo "You selected: $uri"
+
+# Pick a dish (shared with build-image.sh)
+# shellcheck source=./select-dish.sh
+source "$(dirname "$0")/select-dish.sh"
+vm_name="$selected_dish"
+
+# Find Fedora ISO based on the dish name
+fedora_iso=$(find_fedora_iso "$vm_name")
+if [ -n "$fedora_iso" ]; then
+    location_param="$fedora_iso"
+    echo "Using local ISO: $fedora_iso"
+else
+    # Fallback to original behavior if no specific ISO found
+    fedora_iso=$(find_fedora_iso_old)
+    if [ -n "$fedora_iso" ]; then
+        location_param="$fedora_iso"
+        echo "Using local ISO: $fedora_iso"
+    else
+        location_param="https://download.fedoraproject.org/pub/fedora/linux/releases/44/Everything/x86_64/os/"
+        echo "Using default online repository"
+    fi
+fi
+
+# virt-install command with user-defined VM name
+virt-install \
+    --connect "$uri" \
+    --os-variant fedora-unknown \
+    --virt-type kvm \
+    --arch x86_64 \
+    --machine q35 \
+    --name "$vm_name" \
+    --boot uefi,firmware.feature0.name=secure-boot,firmware.feature0.enabled=no \
+    --cpu host-model,topology.sockets=1,topology.cores=1,topology.threads=1 \
+    --vcpus 1 \
+    --cpu host-passthrough,cache.mode=passthrough \
+    --memory "$memory_size" \
+    --video virtio \
+    --graphics spice,listen=0.0.0.0 \
+    --channel unix,target.type=virtio,target.name=org.qemu.guest_agent.0 \
+    --autoconsole none \
+    --console pty,target.type=virtio \
+    --sound none \
+    --network type="$network_type",model=virtio \
+    --controller type=virtio-serial \
+    --controller type=usb,model=none \
+    --controller type=scsi,model=virtio-scsi \
+    --input type=keyboard,bus=virtio \
+    --input type=mouse,bus=virtio \
+    --rng /dev/urandom,model=virtio \
+    --tpm none \
+    --iommu model=virtio \
+    --watchdog none \
+    --memballoon none \
+    --disk path="${disk_path}/${vm_name}.img",format=raw,bus=virtio,cache=writeback,size="$disk_size" \
+    --location="$location_param" \
+    --initrd-inject cook/dishes/"$vm_name".cfg \
+    --extra-args "inst.ks=file:/$vm_name.cfg" 
+
+echo "virt-install command executed with VM name: $vm_name"

deploy/select-dish.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Lists cook/dishes/*guest-agents*.cfg and prompts the user to pick one.
+# Meant to be sourced (not executed) from repo root, after `cook && make all`
+# has regenerated dishes. Sets $selected_dish to the chosen dish's basename
+# (no extension) on success, or exits non-zero.
+
+mapfile -t dish_name < <(find "cook/dishes/" -maxdepth 1 -type f \( -name "*guest-agents*" \) -printf "%f\n" | sed 's/\.[^.]*$//')
+
+if [ ${#dish_name[@]} -eq 0 ]; then
+  echo "No files found in cook/dishes/."
+  exit 1
+fi
+
+echo "Available dishes:"
+for i in "${!dish_name[@]}"; do
+  echo "$((i + 1)). ${dish_name[$i]}"
+done
+
+read -r -p "Enter the number of the dish you want to select: " choice
+
+if ! [[ "$choice" =~ ^[0-9]+$ ]] || (( choice < 1 )) || (( choice > ${#dish_name[@]} )); then
+  echo "Invalid choice. Please enter a number from 1 to ${#dish_name[@]}."
+  exit 1
+fi
+
+selected_dish="${dish_name[$((choice - 1))]}"
+echo "You selected: $selected_dish"

dishes/desktop-hypervisor-amdcpu.cfg

@@ -1,342 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved,libvirtd"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=mbr --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part /boot --fstype="ext4" --size=512 --label=boot
-part / --fstype="ext4" --grow --label=root
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome-virtual-machine-manager.log
-
-# Create a file to autostart virt-manager
-cat > /mnt/sysimage/etc/xdg/autostart/virt-manager.desktop << EOF
-[Desktop Entry]
-Type=Application
-Name=Virtual Machine Manager
-Exec=virt-manager
-EOF
-
-# Modify the default virt-manager behavior for misc. options
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.virt-manager.virt-manager.gschema.override<< EOF
-
-# Modify the default virt-manager behavior for misc. options
-[org.virt-manager.virt-manager]
-xmleditor-enabled=true
-manager-window-height=600
-manager-window-width=200
-
-# Libvirt URIs listed in the manager window
-[org.virt-manager.virt-manager.connections]
-uris=['qemu:///system', 'qemu:///session']
-autoconnect=['qemu:///session']
-
-# Show usage in the domain list
-[org.virt-manager.virt-manager.vmlist-fields]
-cpu-usage=false
-
-# Settings related to statistics
-[org.virt-manager.virt-manager.stats]
-update-interval=3
-enable-disk-poll=true
-enable-memory-poll=true
-enable-net-poll=true
-
-# Default behavior for the console
-[org.virt-manager.virt-manager.console]
-scaling=2
-resize-guest=1
-autoconnect=false
-
-# Do not show toolbar
-[org.virt-manager.virt-manager.details]
-show-toolbar=false
-
-# Modify default values for new VMs
-[org.virt-manager.virt-manager.new-vm]
-storage-format='raw'
-cpu-default='host-model'
-graphics-type='spice'
-
-# Modify the default virt-manager behavior for confirmation dialogues
-[org.virt-manager.virt-manager.confirm]
-forcepoweroff=false
-removedev=false
-unapplied-dev=false
-
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor-amdcpu.log
-
-sed -i 's/\(quiet\)/\1 iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB. 
-
-echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization
-
-%end
-
-%packages --exclude-weakdeps
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-alsa-sof-firmware
-amd-gpu-firmware
-atheros-firmware
-audit
-b43-fwcutter
-b43-openfwwf
-basesystem
-bash
-brcmfmac-firmware
-cirrus-audio-firmware
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-intel-audio-firmware
-intel-gpu-firmware
-intel-vsc-firmware
-iproute
-iputils
-iwlegacy-firmware
-iwlwifi-dvm-firmware
-iwlwifi-mvm-firmware
-kbd
-kernel
-less
-libertas-firmware
-libusb
-libvirt
-libvirt-client
-libvirt-client-qemu
-libvirt-daemon
-libvirt-daemon-common
-libvirt-daemon-config-network
-libvirt-daemon-driver-ch
-libvirt-daemon-driver-interface
-libvirt-daemon-driver-network
-libvirt-daemon-driver-qemu
-libvirt-daemon-kvm
-libvirt-daemon-log
-libvirt-daemon-qemu
-libvirt-dbus
-libvirt-nss
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-mt7xxx-firmware
-nano
-ncurses
-nvidia-gpu-firmware
-nxpwireless-firmware
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-kvm
-realtek-firmware
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-tiwilink-firmware
-usbutils
-util-linux
-vim-minimal
-virt-install
-virt-manager
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/desktop-hypervisor-intelcpu-intelgpu.cfg

@@ -1,352 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved,libvirtd"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=mbr --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part /boot --fstype="ext4" --size=512 --label=boot
-part / --fstype="ext4" --grow --label=root
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome-virtual-machine-manager.log
-
-# Create a file to autostart virt-manager
-cat > /mnt/sysimage/etc/xdg/autostart/virt-manager.desktop << EOF
-[Desktop Entry]
-Type=Application
-Name=Virtual Machine Manager
-Exec=virt-manager
-EOF
-
-# Modify the default virt-manager behavior for misc. options
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.virt-manager.virt-manager.gschema.override<< EOF
-
-# Modify the default virt-manager behavior for misc. options
-[org.virt-manager.virt-manager]
-xmleditor-enabled=true
-manager-window-height=600
-manager-window-width=200
-
-# Libvirt URIs listed in the manager window
-[org.virt-manager.virt-manager.connections]
-uris=['qemu:///system', 'qemu:///session']
-autoconnect=['qemu:///session']
-
-# Show usage in the domain list
-[org.virt-manager.virt-manager.vmlist-fields]
-cpu-usage=false
-
-# Settings related to statistics
-[org.virt-manager.virt-manager.stats]
-update-interval=3
-enable-disk-poll=true
-enable-memory-poll=true
-enable-net-poll=true
-
-# Default behavior for the console
-[org.virt-manager.virt-manager.console]
-scaling=2
-resize-guest=1
-autoconnect=false
-
-# Do not show toolbar
-[org.virt-manager.virt-manager.details]
-show-toolbar=false
-
-# Modify default values for new VMs
-[org.virt-manager.virt-manager.new-vm]
-storage-format='raw'
-cpu-default='host-model'
-graphics-type='spice'
-
-# Modify the default virt-manager behavior for confirmation dialogues
-[org.virt-manager.virt-manager.confirm]
-forcepoweroff=false
-removedev=false
-unapplied-dev=false
-
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor-intelcpu.log
-
-sed -i 's/\(quiet\)/\1 intel_iommu=on iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB.
-
-echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor-intelgpu.log
-
-sed -i 's/\(vfio-pci\)/\1 i915.enable_gvt=1/i' /mnt/sysimage/etc/default/grub # Load kernel modules in grub.
-
-# Load extra kernel modules to enable vfio-mdev on selected hardware
-echo "kvmgt" > /mnt/sysimage/etc/modules-load.d/kvmgt.conf # Load specific kernel modules kvmgt and vfio-mdev, for Intel (tm) GVT-g and Nvidia (tm)
-echo "vfio-mdev" > /mnt/sysimage/etc/modules-load.d/vfio-mdev.conf # Load specific kernel modules kvmgt and vfio-mdev, for Intel (tm) GVT-g and Nvidia (tm)
-
-%end
-
-%packages --exclude-weakdeps
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-alsa-sof-firmware
-amd-gpu-firmware
-atheros-firmware
-audit
-b43-fwcutter
-b43-openfwwf
-basesystem
-bash
-brcmfmac-firmware
-cirrus-audio-firmware
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-intel-audio-firmware
-intel-gpu-firmware
-intel-vsc-firmware
-iproute
-iputils
-iwlegacy-firmware
-iwlwifi-dvm-firmware
-iwlwifi-mvm-firmware
-kbd
-kernel
-less
-libertas-firmware
-libusb
-libvirt
-libvirt-client
-libvirt-client-qemu
-libvirt-daemon
-libvirt-daemon-common
-libvirt-daemon-config-network
-libvirt-daemon-driver-ch
-libvirt-daemon-driver-interface
-libvirt-daemon-driver-network
-libvirt-daemon-driver-qemu
-libvirt-daemon-kvm
-libvirt-daemon-log
-libvirt-daemon-qemu
-libvirt-dbus
-libvirt-nss
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-mt7xxx-firmware
-nano
-ncurses
-nvidia-gpu-firmware
-nxpwireless-firmware
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-kvm
-realtek-firmware
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-tiwilink-firmware
-usbutils
-util-linux
-vim-minimal
-virt-install
-virt-manager
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/desktop-hypervisor-intelcpu.cfg

@@ -1,342 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved,libvirtd"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=mbr --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part /boot --fstype="ext4" --size=512 --label=boot
-part / --fstype="ext4" --grow --label=root
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome-virtual-machine-manager.log
-
-# Create a file to autostart virt-manager
-cat > /mnt/sysimage/etc/xdg/autostart/virt-manager.desktop << EOF
-[Desktop Entry]
-Type=Application
-Name=Virtual Machine Manager
-Exec=virt-manager
-EOF
-
-# Modify the default virt-manager behavior for misc. options
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.virt-manager.virt-manager.gschema.override<< EOF
-
-# Modify the default virt-manager behavior for misc. options
-[org.virt-manager.virt-manager]
-xmleditor-enabled=true
-manager-window-height=600
-manager-window-width=200
-
-# Libvirt URIs listed in the manager window
-[org.virt-manager.virt-manager.connections]
-uris=['qemu:///system', 'qemu:///session']
-autoconnect=['qemu:///session']
-
-# Show usage in the domain list
-[org.virt-manager.virt-manager.vmlist-fields]
-cpu-usage=false
-
-# Settings related to statistics
-[org.virt-manager.virt-manager.stats]
-update-interval=3
-enable-disk-poll=true
-enable-memory-poll=true
-enable-net-poll=true
-
-# Default behavior for the console
-[org.virt-manager.virt-manager.console]
-scaling=2
-resize-guest=1
-autoconnect=false
-
-# Do not show toolbar
-[org.virt-manager.virt-manager.details]
-show-toolbar=false
-
-# Modify default values for new VMs
-[org.virt-manager.virt-manager.new-vm]
-storage-format='raw'
-cpu-default='host-model'
-graphics-type='spice'
-
-# Modify the default virt-manager behavior for confirmation dialogues
-[org.virt-manager.virt-manager.confirm]
-forcepoweroff=false
-removedev=false
-unapplied-dev=false
-
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor-intelcpu.log
-
-sed -i 's/\(quiet\)/\1 intel_iommu=on iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB.
-
-echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs
-
-%end
-
-%packages --exclude-weakdeps
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-alsa-sof-firmware
-amd-gpu-firmware
-atheros-firmware
-audit
-b43-fwcutter
-b43-openfwwf
-basesystem
-bash
-brcmfmac-firmware
-cirrus-audio-firmware
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-intel-audio-firmware
-intel-gpu-firmware
-intel-vsc-firmware
-iproute
-iputils
-iwlegacy-firmware
-iwlwifi-dvm-firmware
-iwlwifi-mvm-firmware
-kbd
-kernel
-less
-libertas-firmware
-libusb
-libvirt
-libvirt-client
-libvirt-client-qemu
-libvirt-daemon
-libvirt-daemon-common
-libvirt-daemon-config-network
-libvirt-daemon-driver-ch
-libvirt-daemon-driver-interface
-libvirt-daemon-driver-network
-libvirt-daemon-driver-qemu
-libvirt-daemon-kvm
-libvirt-daemon-log
-libvirt-daemon-qemu
-libvirt-dbus
-libvirt-nss
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-mt7xxx-firmware
-nano
-ncurses
-nvidia-gpu-firmware
-nxpwireless-firmware
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-kvm
-realtek-firmware
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-tiwilink-firmware
-usbutils
-util-linux
-vim-minimal
-virt-install
-virt-manager
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/desktop-hypervisor.cfg

@@ -1,334 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved,libvirtd"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=mbr --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part /boot --fstype="ext4" --size=512 --label=boot
-part / --fstype="ext4" --grow --label=root
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome-virtual-machine-manager.log
-
-# Create a file to autostart virt-manager
-cat > /mnt/sysimage/etc/xdg/autostart/virt-manager.desktop << EOF
-[Desktop Entry]
-Type=Application
-Name=Virtual Machine Manager
-Exec=virt-manager
-EOF
-
-# Modify the default virt-manager behavior for misc. options
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.virt-manager.virt-manager.gschema.override<< EOF
-
-# Modify the default virt-manager behavior for misc. options
-[org.virt-manager.virt-manager]
-xmleditor-enabled=true
-manager-window-height=600
-manager-window-width=200
-
-# Libvirt URIs listed in the manager window
-[org.virt-manager.virt-manager.connections]
-uris=['qemu:///system', 'qemu:///session']
-autoconnect=['qemu:///session']
-
-# Show usage in the domain list
-[org.virt-manager.virt-manager.vmlist-fields]
-cpu-usage=false
-
-# Settings related to statistics
-[org.virt-manager.virt-manager.stats]
-update-interval=3
-enable-disk-poll=true
-enable-memory-poll=true
-enable-net-poll=true
-
-# Default behavior for the console
-[org.virt-manager.virt-manager.console]
-scaling=2
-resize-guest=1
-autoconnect=false
-
-# Do not show toolbar
-[org.virt-manager.virt-manager.details]
-show-toolbar=false
-
-# Modify default values for new VMs
-[org.virt-manager.virt-manager.new-vm]
-storage-format='raw'
-cpu-default='host-model'
-graphics-type='spice'
-
-# Modify the default virt-manager behavior for confirmation dialogues
-[org.virt-manager.virt-manager.confirm]
-forcepoweroff=false
-removedev=false
-unapplied-dev=false
-
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end
-
-%packages --exclude-weakdeps
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-alsa-sof-firmware
-amd-gpu-firmware
-atheros-firmware
-audit
-b43-fwcutter
-b43-openfwwf
-basesystem
-bash
-brcmfmac-firmware
-cirrus-audio-firmware
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-intel-audio-firmware
-intel-gpu-firmware
-intel-vsc-firmware
-iproute
-iputils
-iwlegacy-firmware
-iwlwifi-dvm-firmware
-iwlwifi-mvm-firmware
-kbd
-kernel
-less
-libertas-firmware
-libusb
-libvirt
-libvirt-client
-libvirt-client-qemu
-libvirt-daemon
-libvirt-daemon-common
-libvirt-daemon-config-network
-libvirt-daemon-driver-ch
-libvirt-daemon-driver-interface
-libvirt-daemon-driver-network
-libvirt-daemon-driver-qemu
-libvirt-daemon-kvm
-libvirt-daemon-log
-libvirt-daemon-qemu
-libvirt-dbus
-libvirt-nss
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-mt7xxx-firmware
-nano
-ncurses
-nvidia-gpu-firmware
-nxpwireless-firmware
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-kvm
-realtek-firmware
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-tiwilink-firmware
-usbutils
-util-linux
-vim-minimal
-virt-install
-virt-manager
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/desktop.cfg

@@ -1,223 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=mbr --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part /boot --fstype="ext4" --size=512 --label=boot
-part / --fstype="ext4" --grow --label=root
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%packages --exclude-weakdeps
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-alsa-sof-firmware
-amd-gpu-firmware
-atheros-firmware
-audit
-b43-fwcutter
-b43-openfwwf
-basesystem
-bash
-brcmfmac-firmware
-cirrus-audio-firmware
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-intel-audio-firmware
-intel-gpu-firmware
-intel-vsc-firmware
-iproute
-iputils
-iwlegacy-firmware
-iwlwifi-dvm-firmware
-iwlwifi-mvm-firmware
-kbd
-kernel
-less
-libertas-firmware
-libusb
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-mt7xxx-firmware
-nano
-ncurses
-nvidia-gpu-firmware
-nxpwireless-firmware
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-realtek-firmware
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-tiwilink-firmware
-usbutils
-util-linux
-vim-minimal
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/live-desktop-hypervisor.cfg

@@ -1,397 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved,libvirtd"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=none --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part / --fstype="ext4" --size=5120
-part / --size=8576
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --logfile=/mnt/sysimage/root/post-live-core.log
-
-# Enable livesys services
-systemctl enable livesys.service
-systemctl enable livesys-late.service
-
-# enable tmpfs for /tmp
-systemctl enable tmp.mount
-
-# make it so that we don't do writing to the overlay for things which
-# are just tmpdirs/caches
-# note https://bugzilla.redhat.com/show_bug.cgi?id=1135475
-cat >> /etc/fstab << EOF
-vartmp   /var/tmp    tmpfs   defaults   0  0
-EOF
-
-# work around for poor key import UI in PackageKit
-rm -f /var/lib/rpm/__db*
-echo "Packages within this LiveCD"
-rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn
-# Note that running rpm recreates the rpm db files which aren't needed or wanted
-rm -f /var/lib/rpm/__db*
-
-# go ahead and pre-make the man -k cache (#455968)
-/usr/bin/mandb
-
-# make sure there aren't core files lying around
-rm -f /core*
-
-# remove random seed, the newly installed instance should make it's own
-rm -f /var/lib/systemd/random-seed
-
-# convince readahead not to collect
-# FIXME: for systemd
-
-echo 'File created by kickstart. See systemd-update-done.service(8).' \
-    | tee /etc/.updated >/var/.updated
-
-# Drop the rescue kernel and initramfs, we don't need them on the live media itself.
-# See bug 1317709
-rm -f /boot/*-rescue*
-
-# Disable network service here, as doing it in the services line
-# fails due to RHBZ #1369794
-systemctl disable network
-
-# Remove machine-id on pre generated images
-rm -f /etc/machine-id
-touch /etc/machine-id
-
-%end
-
-%post --logfile=/mnt/sysimage/root/post-live-session.log
-
-# set livesys session type
-sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome-virtual-machine-manager.log
-
-# Create a file to autostart virt-manager
-cat > /mnt/sysimage/etc/xdg/autostart/virt-manager.desktop << EOF
-[Desktop Entry]
-Type=Application
-Name=Virtual Machine Manager
-Exec=virt-manager
-EOF
-
-# Modify the default virt-manager behavior for misc. options
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.virt-manager.virt-manager.gschema.override<< EOF
-
-# Modify the default virt-manager behavior for misc. options
-[org.virt-manager.virt-manager]
-xmleditor-enabled=true
-manager-window-height=600
-manager-window-width=200
-
-# Libvirt URIs listed in the manager window
-[org.virt-manager.virt-manager.connections]
-uris=['qemu:///system', 'qemu:///session']
-autoconnect=['qemu:///session']
-
-# Show usage in the domain list
-[org.virt-manager.virt-manager.vmlist-fields]
-cpu-usage=false
-
-# Settings related to statistics
-[org.virt-manager.virt-manager.stats]
-update-interval=3
-enable-disk-poll=true
-enable-memory-poll=true
-enable-net-poll=true
-
-# Default behavior for the console
-[org.virt-manager.virt-manager.console]
-scaling=2
-resize-guest=1
-autoconnect=false
-
-# Do not show toolbar
-[org.virt-manager.virt-manager.details]
-show-toolbar=false
-
-# Modify default values for new VMs
-[org.virt-manager.virt-manager.new-vm]
-storage-format='raw'
-cpu-default='host-model'
-graphics-type='spice'
-
-# Modify the default virt-manager behavior for confirmation dialogues
-[org.virt-manager.virt-manager.confirm]
-forcepoweroff=false
-removedev=false
-unapplied-dev=false
-
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end
-
-%packages --exclude-weakdeps
-@anaconda-tools
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-aajohan-comfortaa-fonts
-alsa-sof-firmware
-amd-gpu-firmware
-atheros-firmware
-audit
-b43-fwcutter
-b43-openfwwf
-basesystem
-bash
-brcmfmac-firmware
-cirrus-audio-firmware
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-dracut-live
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-glibc-all-langpacks
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-intel-audio-firmware
-intel-gpu-firmware
-intel-vsc-firmware
-iproute
-iputils
-iwlegacy-firmware
-iwlwifi-dvm-firmware
-iwlwifi-mvm-firmware
-kbd
-kernel
-kernel-modules
-kernel-modules-extra
-less
-libertas-firmware
-libusb
-libvirt
-libvirt-client
-libvirt-client-qemu
-libvirt-daemon
-libvirt-daemon-common
-libvirt-daemon-config-network
-libvirt-daemon-driver-ch
-libvirt-daemon-driver-interface
-libvirt-daemon-driver-network
-libvirt-daemon-driver-qemu
-libvirt-daemon-kvm
-libvirt-daemon-log
-libvirt-daemon-qemu
-libvirt-dbus
-libvirt-nss
-livesys-scripts
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-mt7xxx-firmware
-nano
-ncurses
-nvidia-gpu-firmware
-nxpwireless-firmware
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-kvm
-realtek-firmware
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-tiwilink-firmware
-usbutils
-util-linux
-vim-minimal
-virt-install
-virt-manager
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/live-desktop.cfg

@@ -1,286 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=none --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part / --fstype="ext4" --size=5120
-part / --size=8576
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --logfile=/mnt/sysimage/root/post-live-core.log
-
-# Enable livesys services
-systemctl enable livesys.service
-systemctl enable livesys-late.service
-
-# enable tmpfs for /tmp
-systemctl enable tmp.mount
-
-# make it so that we don't do writing to the overlay for things which
-# are just tmpdirs/caches
-# note https://bugzilla.redhat.com/show_bug.cgi?id=1135475
-cat >> /etc/fstab << EOF
-vartmp   /var/tmp    tmpfs   defaults   0  0
-EOF
-
-# work around for poor key import UI in PackageKit
-rm -f /var/lib/rpm/__db*
-echo "Packages within this LiveCD"
-rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn
-# Note that running rpm recreates the rpm db files which aren't needed or wanted
-rm -f /var/lib/rpm/__db*
-
-# go ahead and pre-make the man -k cache (#455968)
-/usr/bin/mandb
-
-# make sure there aren't core files lying around
-rm -f /core*
-
-# remove random seed, the newly installed instance should make it's own
-rm -f /var/lib/systemd/random-seed
-
-# convince readahead not to collect
-# FIXME: for systemd
-
-echo 'File created by kickstart. See systemd-update-done.service(8).' \
-    | tee /etc/.updated >/var/.updated
-
-# Drop the rescue kernel and initramfs, we don't need them on the live media itself.
-# See bug 1317709
-rm -f /boot/*-rescue*
-
-# Disable network service here, as doing it in the services line
-# fails due to RHBZ #1369794
-systemctl disable network
-
-# Remove machine-id on pre generated images
-rm -f /etc/machine-id
-touch /etc/machine-id
-
-%end
-
-%post --logfile=/mnt/sysimage/root/post-live-session.log
-
-# set livesys session type
-sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%packages --exclude-weakdeps
-@anaconda-tools
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-aajohan-comfortaa-fonts
-alsa-sof-firmware
-amd-gpu-firmware
-atheros-firmware
-audit
-b43-fwcutter
-b43-openfwwf
-basesystem
-bash
-brcmfmac-firmware
-cirrus-audio-firmware
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-dracut-live
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-glibc-all-langpacks
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-intel-audio-firmware
-intel-gpu-firmware
-intel-vsc-firmware
-iproute
-iputils
-iwlegacy-firmware
-iwlwifi-dvm-firmware
-iwlwifi-mvm-firmware
-kbd
-kernel
-kernel-modules
-kernel-modules-extra
-less
-libertas-firmware
-libusb
-livesys-scripts
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-mt7xxx-firmware
-nano
-ncurses
-nvidia-gpu-firmware
-nxpwireless-firmware
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-realtek-firmware
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-tiwilink-firmware
-usbutils
-util-linux
-vim-minimal
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/live-server-hypervisor.cfg

@@ -1,234 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved,libvirtd"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# System bootloader configuration
-bootloader --location=none --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part / --fstype="ext4" --size=5120
-part / --size=8576
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --logfile=/mnt/sysimage/root/post-live-core.log
-
-# Enable livesys services
-systemctl enable livesys.service
-systemctl enable livesys-late.service
-
-# enable tmpfs for /tmp
-systemctl enable tmp.mount
-
-# make it so that we don't do writing to the overlay for things which
-# are just tmpdirs/caches
-# note https://bugzilla.redhat.com/show_bug.cgi?id=1135475
-cat >> /etc/fstab << EOF
-vartmp   /var/tmp    tmpfs   defaults   0  0
-EOF
-
-# work around for poor key import UI in PackageKit
-rm -f /var/lib/rpm/__db*
-echo "Packages within this LiveCD"
-rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn
-# Note that running rpm recreates the rpm db files which aren't needed or wanted
-rm -f /var/lib/rpm/__db*
-
-# go ahead and pre-make the man -k cache (#455968)
-/usr/bin/mandb
-
-# make sure there aren't core files lying around
-rm -f /core*
-
-# remove random seed, the newly installed instance should make it's own
-rm -f /var/lib/systemd/random-seed
-
-# convince readahead not to collect
-# FIXME: for systemd
-
-echo 'File created by kickstart. See systemd-update-done.service(8).' \
-    | tee /etc/.updated >/var/.updated
-
-# Drop the rescue kernel and initramfs, we don't need them on the live media itself.
-# See bug 1317709
-rm -f /boot/*-rescue*
-
-# Disable network service here, as doing it in the services line
-# fails due to RHBZ #1369794
-systemctl disable network
-
-# Remove machine-id on pre generated images
-rm -f /etc/machine-id
-touch /etc/machine-id
-
-%end
-
-%post --logfile=/mnt/sysimage/root/post-live-session.log
-
-# set livesys session type
-sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end
-
-%packages --exclude-weakdeps
-@anaconda-tools
-NetworkManager
-NetworkManager-config-connectivity-fedora
-aajohan-comfortaa-fonts
-alsa-sof-firmware
-amd-gpu-firmware
-atheros-firmware
-audit
-b43-fwcutter
-b43-openfwwf
-basesystem
-bash
-brcmfmac-firmware
-cirrus-audio-firmware
-coreutils
-curl
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-dracut-live
-e2fsprogs
-fedora-remix-logos
-filesystem
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-glibc-all-langpacks
-hostname
-initial-setup
-intel-audio-firmware
-intel-gpu-firmware
-intel-vsc-firmware
-iproute
-iputils
-iwlegacy-firmware
-iwlwifi-dvm-firmware
-iwlwifi-mvm-firmware
-kbd
-kernel
-kernel-modules
-kernel-modules-extra
-less
-libertas-firmware
-libusb
-libvirt
-libvirt-client
-libvirt-client-qemu
-libvirt-daemon
-libvirt-daemon-common
-libvirt-daemon-config-network
-libvirt-daemon-driver-ch
-libvirt-daemon-driver-interface
-libvirt-daemon-driver-network
-libvirt-daemon-driver-qemu
-libvirt-daemon-kvm
-libvirt-daemon-log
-libvirt-daemon-qemu
-libvirt-dbus
-libvirt-nss
-livesys-scripts
-man-db
-mt7xxx-firmware
-nano
-ncurses
-nvidia-gpu-firmware
-nxpwireless-firmware
-openssh-clients
-openssh-server
-parted
-pciutils
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-kvm
-realtek-firmware
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-tiwilink-firmware
-usbutils
-util-linux
-vim-minimal
-virt-install
-wget
-zram-generator-defaults
-
-%end

dishes/live-server.cfg

@@ -1,168 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# System bootloader configuration
-bootloader --location=none --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part / --fstype="ext4" --size=5120
-part / --size=8576
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --logfile=/mnt/sysimage/root/post-live-core.log
-
-# Enable livesys services
-systemctl enable livesys.service
-systemctl enable livesys-late.service
-
-# enable tmpfs for /tmp
-systemctl enable tmp.mount
-
-# make it so that we don't do writing to the overlay for things which
-# are just tmpdirs/caches
-# note https://bugzilla.redhat.com/show_bug.cgi?id=1135475
-cat >> /etc/fstab << EOF
-vartmp   /var/tmp    tmpfs   defaults   0  0
-EOF
-
-# work around for poor key import UI in PackageKit
-rm -f /var/lib/rpm/__db*
-echo "Packages within this LiveCD"
-rpm -qa --qf '%{size}\t%{name}-%{version}-%{release}.%{arch}\n' |sort -rn
-# Note that running rpm recreates the rpm db files which aren't needed or wanted
-rm -f /var/lib/rpm/__db*
-
-# go ahead and pre-make the man -k cache (#455968)
-/usr/bin/mandb
-
-# make sure there aren't core files lying around
-rm -f /core*
-
-# remove random seed, the newly installed instance should make it's own
-rm -f /var/lib/systemd/random-seed
-
-# convince readahead not to collect
-# FIXME: for systemd
-
-echo 'File created by kickstart. See systemd-update-done.service(8).' \
-    | tee /etc/.updated >/var/.updated
-
-# Drop the rescue kernel and initramfs, we don't need them on the live media itself.
-# See bug 1317709
-rm -f /boot/*-rescue*
-
-# Disable network service here, as doing it in the services line
-# fails due to RHBZ #1369794
-systemctl disable network
-
-# Remove machine-id on pre generated images
-rm -f /etc/machine-id
-touch /etc/machine-id
-
-%end
-
-%post --logfile=/mnt/sysimage/root/post-live-session.log
-
-# set livesys session type
-sed -i 's/^livesys_session=.*/livesys_session="gnome"/' /etc/sysconfig/livesys
-
-%end
-
-%packages --exclude-weakdeps
-@anaconda-tools
-NetworkManager
-NetworkManager-config-connectivity-fedora
-aajohan-comfortaa-fonts
-audit
-basesystem
-bash
-coreutils
-curl
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-dracut-live
-e2fsprogs
-fedora-remix-logos
-filesystem
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-glibc-all-langpacks
-hostname
-initial-setup
-iproute
-iputils
-kbd
-kernel
-kernel-modules
-kernel-modules-extra
-less
-libusb
-livesys-scripts
-man-db
-nano
-ncurses
-openssh-clients
-openssh-server
-parted
-pciutils
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-usbutils
-util-linux
-vim-minimal
-wget
-zram-generator-defaults
-
-%end

dishes/virtual-desktop-hypervisor.cfg

@@ -1,317 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved,libvirtd"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=mbr --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part /boot --fstype="ext4" --size=512 --label=boot
-part / --fstype="ext4" --grow --label=root
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome-virtual-machine-manager.log
-
-# Create a file to autostart virt-manager
-cat > /mnt/sysimage/etc/xdg/autostart/virt-manager.desktop << EOF
-[Desktop Entry]
-Type=Application
-Name=Virtual Machine Manager
-Exec=virt-manager
-EOF
-
-# Modify the default virt-manager behavior for misc. options
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.virt-manager.virt-manager.gschema.override<< EOF
-
-# Modify the default virt-manager behavior for misc. options
-[org.virt-manager.virt-manager]
-xmleditor-enabled=true
-manager-window-height=600
-manager-window-width=200
-
-# Libvirt URIs listed in the manager window
-[org.virt-manager.virt-manager.connections]
-uris=['qemu:///system', 'qemu:///session']
-autoconnect=['qemu:///session']
-
-# Show usage in the domain list
-[org.virt-manager.virt-manager.vmlist-fields]
-cpu-usage=false
-
-# Settings related to statistics
-[org.virt-manager.virt-manager.stats]
-update-interval=3
-enable-disk-poll=true
-enable-memory-poll=true
-enable-net-poll=true
-
-# Default behavior for the console
-[org.virt-manager.virt-manager.console]
-scaling=2
-resize-guest=1
-autoconnect=false
-
-# Do not show toolbar
-[org.virt-manager.virt-manager.details]
-show-toolbar=false
-
-# Modify default values for new VMs
-[org.virt-manager.virt-manager.new-vm]
-storage-format='raw'
-cpu-default='host-model'
-graphics-type='spice'
-
-# Modify the default virt-manager behavior for confirmation dialogues
-[org.virt-manager.virt-manager.confirm]
-forcepoweroff=false
-removedev=false
-unapplied-dev=false
-
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end
-
-%packages --exclude-weakdeps
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-audit
-basesystem
-bash
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-iproute
-iputils
-kbd
-kernel
-less
-libusb
-libvirt
-libvirt-client
-libvirt-client-qemu
-libvirt-daemon
-libvirt-daemon-common
-libvirt-daemon-config-network
-libvirt-daemon-driver-ch
-libvirt-daemon-driver-interface
-libvirt-daemon-driver-network
-libvirt-daemon-driver-qemu
-libvirt-daemon-kvm
-libvirt-daemon-log
-libvirt-daemon-qemu
-libvirt-dbus
-libvirt-nss
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-nano
-ncurses
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-guest-agent
-qemu-kvm
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-spice-vdagent
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-usbutils
-util-linux
-vim-minimal
-virt-install
-virt-manager
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/virtual-desktop.cfg

@@ -1,206 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# X Window System configuration information
-xconfig  --defaultdesktop=GNOME --startxonboot
-# System bootloader configuration
-bootloader --location=mbr --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part /boot --fstype="ext4" --size=512 --label=boot
-part / --fstype="ext4" --grow --label=root
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-initial-setup-gnome.log
-
-truncate -s 0 /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf # remove content of vendor.conf so that all options are made available
-
-## Append lines to existing vendor.conf file, so that options are skipped upon reboot
-cat >> /mnt/sysimage/usr/share/gnome-initial-setup/vendor.conf<< EOF
-[pages]
-skip=privacy
-[goa]
-providers=local-first!
-EOF
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-desktop-gnome.log
-
-# cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.background.gschema.override<< EOF
-# [org.gnome.desktop.background]
-# picture-uri='file:///usr/share/backgrounds/elementary/Morskie Oko.jpg'
-# EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.media-handling.gschema.override<< EOF
-[org.gnome.desktop.media-handling]
-automount-open=false
-autorun-never=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.Terminal.gschema.override<< EOF
-[org.gnome.Terminal.Legacy.Profile]
-font='DejaVu Sans Mono 12'
-use-system-font=false
-audible-bell=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.wm.preferences.gschema.override<< EOF
-[org.gnome.desktop.wm.preferences]
-button-layout=':minimize,maximize,close'
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.a11y.gschema.override<< EOF
-[org.gnome.desktop.a11y]
-always-show-universal-access-status=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.interface.gschema.override<< EOF
-[org.gnome.desktop.interface]
-enable-animations=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.privacy.gschema.override<< EOF
-[org.gnome.desktop.privacy]
-remove-old-temp-files=true
-remember-recent-files=false
-remember-app-usage=false
-disable-camera=true
-disable-microphone=true
-disable-sound-output=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.search-providers.gschema.override<< EOF
-[org.gnome.desktop.search-providers]
-disable-external=true
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.notifications.gschema.override<< EOF
-[org.gnome.desktop.notifications.application]
-enable-sound-alerts=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.sound.gschema.override<< EOF
-[org.gnome.desktop.sound]
-event-sounds=false
-EOF
-
-cat >> /mnt/sysimage/usr/share/glib-2.0/schemas/org.gnome.desktop.thumbnailers.gschema.override<< EOF
-[org.gnome.desktop.thumbnailers]
-disable-all=true
-EOF
-
-glib-compile-schemas /mnt/sysimage/usr/share/glib-2.0/schemas/
-
-%end
-
-%packages --exclude-weakdeps
-NetworkManager
-NetworkManager-config-connectivity-fedora
-NetworkManager-wifi
-audit
-basesystem
-bash
-coreutils
-curl
-dejavu-sans-mono-fonts
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-e2fsprogs
-fedora-remix-logos
-filesystem
-firefox
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-gnome-backgrounds.noarch
-gnome-control-center
-gnome-initial-setup
-gnome-shell
-gnome-terminal
-hostname
-iproute
-iputils
-kbd
-kernel
-less
-libusb
-man-db
-mesa-dri-drivers
-mozilla-ublock-origin.noarch
-nano
-ncurses
-openssh-clients
-openssh-server
-parted
-pciutils
-pipewire-alsa
-pipewire-jack-audio-connection-kit
-pipewire-pulseaudio
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-guest-agent
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-spice-vdagent
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-usbutils
-util-linux
-vim-minimal
-wget
-wpa_supplicant
-zram-generator-defaults
--gnome-tour
-
-%end

dishes/virtual-server-hypervisor.cfg

@@ -1,154 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Firewall configuration
-firewall --disabled
-# Run the Setup Agent on first boot
-firstboot --reconfig
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Network information
-network  --bootproto=dhcp --device=link --hostname=phyllome-alpha --activate
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --iscrypted --lock locked
-# SELinux configuration
-selinux --disabled
-# System services
-services --enabled="NetworkManager,systemd-resolved,libvirtd"
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# System bootloader configuration
-bootloader --location=mbr --timeout=1
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part /boot --fstype="ext4" --size=512 --label=boot
-part / --fstype="ext4" --grow --label=root
-
-%post --logfile=/mnt/sysimage/root/post.log
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end
-
-%post --nochroot --logfile=/mnt/sysimage/root/base-hypervisor.log
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end
-
-%packages --exclude-weakdeps
-NetworkManager
-NetworkManager-config-connectivity-fedora
-audit
-basesystem
-bash
-coreutils
-curl
-dhcp-client
-dnf5
-dnf5-plugins
-dracut
-dracut-config-rescue
-e2fsprogs
-fedora-remix-logos
-filesystem
-firewalld
-fwupd
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-hostname
-initial-setup
-iproute
-iputils
-kbd
-kernel
-less
-libusb
-libvirt
-libvirt-client
-libvirt-client-qemu
-libvirt-daemon
-libvirt-daemon-common
-libvirt-daemon-config-network
-libvirt-daemon-driver-ch
-libvirt-daemon-driver-interface
-libvirt-daemon-driver-network
-libvirt-daemon-driver-qemu
-libvirt-daemon-kvm
-libvirt-daemon-log
-libvirt-daemon-qemu
-libvirt-dbus
-libvirt-nss
-man-db
-nano
-ncurses
-openssh-clients
-openssh-server
-parted
-pciutils
-plymouth
-policycoreutils
-prefixdevname
-procps-ng
-qemu-guest-agent
-qemu-kvm
-rootfiles
-rpm
-selinux-policy-targeted
-setup
-shadow-utils
-spice-vdagent
-sssd-common
-sssd-kcm
-sudo
-systemd
-systemd-resolved
-usbutils
-util-linux
-vim-minimal
-virt-install
-wget
-zram-generator-defaults
-
-%end

dishes/virtual-server.cfg

@@ -1,47 +0,0 @@
-# Generated by pykickstart v3.62
-#version=DEVEL
-# Use text mode install
-text
-# Keyboard layouts
-keyboard --xlayouts='ch (fr)'
-# System language
-lang en_US.UTF-8
-# Shutdown after installation
-shutdown
-repo --name="fedora" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64
-repo --name="updates" --mirrorlist=https://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f43&arch=x86_64
-# Root password
-rootpw --plaintext 1234 # Root account is enabled with weak password
-# System timezone
-timezone Europe/Zurich --utc
-# Use network installation
-url --mirrorlist="https://mirrors.fedoraproject.org/mirrorlist?repo=fedora-43&arch=x86_64"
-# System bootloader configuration
-bootloader --sdboot
-# Clear the Master Boot Record
-zerombr
-# Partition clearing information
-clearpart --all --initlabel
-# Disk partitioning information
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi
-part / --fstype="ext4" --grow --label=root
-
-%packages --nocore --inst-langs=en --exclude-weakdeps
-basesystem
-bash
-dracut
-fedora-remix-logos
-filesystem
-generic-logos
-generic-release
-generic-release-common
-generic-release-notes
-glibc
-kernel
-rootfiles
-rpm
-setup
-systemd
-zram-generator-defaults
-
-%end

ingredients/base-guest-agents.cfg

@@ -1,6 +0,0 @@
-%packages --exclude-weakdeps # Beginning of the packages section. Does not include weak dependencies.
-
-qemu-guest-agent # "QEMU guest agent" The qemu-guest agent is unnecessary for a bare-metal system. However, it is included here to cover cases where this kickstart file is used to deploy a virtual machine 
-spice-vdagent # "Agent for Spice guests" The spice agent is unnecessary for a bare-metal system. However, it is included here to cover cases where this kickstart file is used to deploy a virtual machine 
-
-%end # End of the packages section

ingredients/base-hypervisor-amdcpu.cfg

@@ -1,7 +0,0 @@
-%post --nochroot --log=/mnt/sysimage/root/base-hypervisor-amdcpu.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
-
-sed -i 's/\(quiet\)/\1 iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB. 
-
-echo "options kvm_amd nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization
-
-%end # End of the %post section

ingredients/base-hypervisor-intelcpu.cfg

@@ -1,7 +0,0 @@
-%post --nochroot --log=/mnt/sysimage/root/base-hypervisor-intelcpu.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
-
-sed -i 's/\(quiet\)/\1 intel_iommu=on iommu=pt rd.driver.pre=vfio-pci/i' /mnt/sysimage/etc/default/grub # Load kernel modules in GRUB.
-
-echo "options kvm_intel nested=1" >> /mnt/sysimage/etc/modprobe.d/kvm.conf # Add support for nested virtualization on Intel CPUs
-
-%end # End of the %post section

ingredients/base-hypervisor.cfg

@@ -1,53 +0,0 @@
-services --enabled="NetworkManager,systemd-resolved,libvirtd" # Without libvirtd here, it appears the service won't automatically start
-
-%packages --exclude-weakdeps # Beginning of the packages section. Does not include weak dependencies.
-
-qemu-kvm # QEMU metapackage for KVM support
-libvirt # Library providing a simple virtualization API
-libvirt-client # Client side utilities of the libvirt library
-libvirt-client-qemu # Additional client side utilities for QEMU. Used to interact with some QEMU specific features of libvirt.
-libvirt-daemon # Server side daemon and supporting files for libvirt library
-libvirt-daemon-common # Miscellaneous files and utilities used by other libvirt daemons
-libvirt-daemon-config-network # Default configuration files for the libvirtd daemon. Provides NAT based networking
-libvirt-daemon-driver-interface # Interface driver plugin for the libvirtd daemon
-libvirt-daemon-driver-network # The network driver plugin for the libvirtd daemon, providing an implementation of the virtual network APIs using the Linux bridge capabilities.
-libvirt-daemon-driver-qemu # QEMU driver plugin for the libvirtd daemon
-libvirt-daemon-kvm # Server side daemon & driver required to run KVM guests
-libvirt-daemon-log # Server side daemon for managing logs
-libvirt-daemon-qemu # Server side daemon and driver required to manage the virtualization capabilities of the QEMU TCG emulators
-libvirt-nss # Libvirt plugin for Name Service Switch
-libvirt-dbus # libvirt D-Bus API binding
-libvirt-daemon-driver-ch # Cloud-Hypervisor driver plugin for libvirtd daemon
-virt-install # Utilities for installing virtual machines
-
-%end # End of the packages section
-
-%post --nochroot --log=/mnt/sysimage/root/base-hypervisor.log # Beginning of %post section. Those commands are executed outside the chroot environment. Logging is enabled to help with post-installation troubleshooting
-
-# Load kernel modules by adding vfio, vfio_pci, vfio_iommu_type1, vfio_virqfd
-echo "vfio" > /mnt/sysimage/etc/modules-load.d/vfio.conf
-echo "vfio-pci" > /mnt/sysimage/etc/modules-load.d/vfio-pci.conf
-echo "vfio_iommu_type1" > /mnt/sysimage/etc/modules-load.d/vfio_iommu_type1.conf
-echo "vfio_virqfd" > /mnt/sysimage/etc/modules-load.d/vfio_virqfd.conf
-
-mkdir /mnt/sysimage/var/lib/libvirt/isos # Create a directory to store iso images. SELinux is already taking this one into account. 
-
-# wget https://boot.netboot.xyz/ipxe/netboot.xyz.iso -P /mnt/sysimage/var/lib/libvirt/isos/ # fetch netboot.xyz iso and store it to the newly created iso directory
-
-# # virsh commands fail in a kickstart environment (chroot or not it seems). would need to fetch a script and execute post-launch with a delay, for example using a systemd unit 
-# virsh pool-define-as isos dir - - - - /mnt/sysimage/var/lib/libvirt/isos/ # Make libvirt aware of this new directory by creating a so-called 'pool'.
-# virsh pool-build isos # Build the pool
-# virsh pool-start isos # Start it
-# virsh pool-autostart isos # Set-it to autostart
-
-# fetch custom script and make it executable
-# wget https://raw.githubusercontent.com/PhyllomeOS/phyllomeos/main/post-first-startup-scripts/virtualization-tweaks-root-needed.sh -P /mnt/sysimage/usr/local/bin/
-# chmod +x /mnt/sysimage/usr/local/bin/virtualization-tweaks-root-needed.sh
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/linux.xml
-# virsh define linux.xml
-
-# wget https://raw.githubusercontent.com/PhyllomeOS/xml-definition-for-domains/main/xml/system/windows.xml
-# virsh define windows.xml
-
-%end # End of the %post section

ingredients/core-bootloader-systemd-boot.cfg

@@ -1 +0,0 @@
-bootloader --sdboot --timeout=1 # Use systemd-boot and set a timeout to 1

ingredients/core-fedora-iso-repo-43.cfg

@@ -1 +0,0 @@
-liveimg --url=file:///mnt/iso/LiveOS/squashfs.img

ingredients/core-initial-setup-server.cfg

@@ -1,7 +0,0 @@
-firstboot --reconfig # Enable the Setup Agent to start at boot time in reconfiguration mode. This mode enables the language, mouse, keyboard, root password, security level, time zone, and networking configuration options in addition to the default ones
-
-%packages --exclude-weakdeps # Beginning of the packages section. Do not include weak dependencies
-
-initial-setup # Initial setup package
-
-%end # End of the packages section

ingredients/core-locale.cfg

@@ -1,3 +0,0 @@
-keyboard --xlayouts='ch (fr)' # Set keyboard layouts for Romandy
-lang en_US.UTF-8 # Set system language to American English. More languages could be supported: --addsupport=cs_CZ,de_DE,en_UK
-timezone Europe/Zurich --utc # Set system timezone to Zurich

ingredients/core-network.cfg

@@ -1 +0,0 @@
-network  --onboot=yes --bootproto=dhcp --device=link --activate --hostname=phyllome-alpha # Configure network devices, enable them at boot time device and sets a particular hostname. "link" selects the first device reaching an up state

ingredients/core-packages-hardware-support.cfg

@@ -1,33 +0,0 @@
-#            __          ____                        ____  _____
-#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
-#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
-#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
-#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
-# /_/          /____/
-#
-# Provides extended hardware support
-
-%packages --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies
-
-# hardware-support group. Mandatory packages # Provides extended hardware support, and especially extra wireless drivers
-alsa-sof-firmware # Audio drivers and firmware for ALSA. Essential for audio functionality.
-amd-gpu-firmware # Firmware for AMD GPUs.  Required for proper GPU operation.
-atheros-firmware # Firmware for Atheros wireless network adapters.  Critical for wireless connectivity.
-b43-fwcutter # Utility for cutting firmware files for B43 drivers.  Needed for driver compatibility.
-b43-openfwwf # Driver and firmware for B43 network cards.  Essential for network card operation.
-brcmfmac-firmware # Firmware for Broadcom MAC controllers.  Required for wireless and wired network performance.
-cirrus-audio-firmware # Firmware for Cirrus Logic audio chips.  Necessary for audio hardware support.
-intel-audio-firmware # Firmware for Intel audio processors.  Required for integrated audio functionality.
-intel-gpu-firmware # Firmware for Intel GPUs. Essential for GPU operation.
-intel-vsc-firmware # Firmware for Intel Video Scheduling Controller. Required for GPU performance.
-iwlegacy-firmware # Legacy firmware for older Intel wireless cards.  Needed for compatibility.
-iwlwifi-dvm-firmware # Firmware for Intel Wireless Link 5100/5200 series. Crucial for wireless connectivity.
-iwlwifi-mvm-firmware # Firmware for Intel Wireless Link 5300/5400 series. Required for wireless performance.
-libertas-firmware # Firmware for Broadcom wireless network cards.  Essential for wireless connectivity.
-mt7xxx-firmware # Firmware for MediaTek wireless network adapters.  Required for wireless connectivity.
-nvidia-gpu-firmware # Firmware for NVIDIA GPUs. Essential for GPU operation.
-nxpwireless-firmware # Firmware for NXP wireless network adapters. Required for wireless connectivity.
-realtek-firmware # Firmware for Realtek network adapters and audio devices.  Essential for various device support.
-tiwilink-firmware # Firmware for TI WiLink wireless network adapters. Required for wireless connectivity.
-
-%end # End of the packages section

ingredients/core-packages.cfg

@@ -1,64 +0,0 @@
-#            __          ____                        ____  _____
-#     ____  / /_  __  __/ / /___  ____ ___  ___     / __ \/ ___/
-#    / __ \/ __ \/ / / / / / __ \/ __ `__ \/ _ \   / / / /\__ \
-#   / /_/ / / / / /_/ / / / /_/ / / / / / /  __/  / /_/ /___/ /
-#  / .___/_/ /_/\__, /_/_/\____/_/ /_/ /_/\___/   \____//____/
-# /_/          /____/
-#
-# Provides the mandatory packages that are part of the core DNF group
-# More information: https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html#id240
-
-%packages --excludedocs --inst-langs=en --nocore --exclude-weakdeps # Beginning of the package section. Does not include weak dependencies. Description courtesy of the Fedora project
-
-# Mandatory packages found in hidden `core` group (`dnf group info --hidden core`)
-basesystem # The skeleton package which defines a simple Fedora system
-bash # The Bourne Again SHell, a command-line interpreter.
-curl # A utility for getting files from remote servers (FTP, HTTP, and others)
-# dhcp-client # Provides the ISC DHCP client daemon and dhclient-script
-dnf5 # Command-line package manager
-dracut # Initramfs generator using udev
-filesystem # The basic directory layout for a Linux system
-glibc # The GNU libc libraries
-# hostname # Utility to set/show the host name or domain name
-# iproute # Advanced IP routing and network device configuration tools
-# iputils # Network monitoring tools including ping
-# kbd # Tools for configuring the console (keyboard, virtual terminals, etc.)
-kernel # The Linux kernel
-# ncurses # Ncurses support utilities
-# parted # The GNU disk partition manipulation program
-# procps-ng # System and process monitoring utilities
-rootfiles # The basic required files for the root user's directory
-rpm # The RPM package management system
-setup # A set of system configuration and setup files
-shadow-utils # Utilities for managing accounts and shadow password files
-systemd # System and Service Manager
-# util-linux # Collection of basic system utilities
-
-# Default packages fom core dnf group not marked as mandatory (`dnf group info --hidden core`)
-# NetworkManager # Network connection manager and user applications
-# NetworkManager-config-connectivity-fedora # NetworkManager config file for connectivity checking via Fedora servers
-# dnf5-plugins # Plugins for dnf5
-# dracut-config-rescue # dracut configuration to turn on rescue image generation
-# firewalld # A firewall daemon with D-Bus interface providing a dynamic firewall
-# fwupd # Firmware update daemon
-# plymouth # Graphical Boot Animation and Logger
-# prefixdevname # Udev helper utility that provides network interface naming using user defined prefix
-# systemd-resolved # Network Name Resolution manager
-zram-generator-defaults # Default configuration for zram-generator
-
-# Hand-picked packages
-# pciutils # PCI bus related utilities
-# libusb # Library for accessing USB devices
-# usbutils # Linux USB utilities
-# wget # An advanced file and recursive website downloader
-# nano # A small text editor
-
-# Packages to make Phyllome OS a generic distro
-# Adds packages to comply with Fedora Remix legal guidelines: https://fedoraproject.org/wiki/Remix 
-fedora-remix-logos # Fedora Remix logos
-generic-release # Generic release files
-generic-logos # Icons and pictures
-generic-release-common # Generic release files
-generic-release-notes # Release Notes
-
-%end # End of the packages section

ingredients/core-post-nochroot.cfg

@@ -1,3 +0,0 @@
-%post --nochroot --log=/mnt/sysimage/root/post-nochroot.log # Beginning of the post-installation section. Log all messages to a given file
-
-%end # End of the %post section

ingredients/core-post.cfg

@@ -1,6 +0,0 @@
-%post --log=/mnt/sysimage/root/post.log # Beginning of the post-installation section. Log all messages to a given file
-
-localectl set-keymap ch-fr # Set keymap to `ch-fr`. Alternatively, `us` can be picked.
-dnf update -y # Update the system 
-
-%end # End of the %post section

ingredients/core-pre-install.cfg

@@ -1,3 +0,0 @@
-%pre --log=/mnt/sysimage/root/pre-install.log Beginning of the pre-installation section. Log all messages to a given file
-
-%end # End of the %post section

ingredients/core-pre.cfg

@@ -1,3 +0,0 @@
-%pre --log=/mnt/sysimage/root/pre.log Beginning of the pre section. Log all messages to a given file
-
-%end # End of the %post section

ingredients/core-security-off.cfg

@@ -1,3 +0,0 @@
-rootpw --lock --iscrypted locked # Lock the root account. Can still be undone by end-user during initial setup
-selinux --disabled # Disable SELinux ; other option: --enable
-firewall --disabled # Disable firewall

ingredients/core-security-on.cfg

@@ -1,3 +0,0 @@
-rootpw --lock --iscrypted locked # Lock the root account. Can still be undone by end-user during initial setup
-selinux --enabled # Enable SELinux ; other option: --disabled
-firewall --enabled # Enable firewall

ingredients/core-storage.cfg

@@ -1,6 +0,0 @@
-zerombr # Destroy all the contents of disks with invalid partition tables or other formatting unrecognizable to the installer
-clearpart --all --initlabel # Erase all partitions and Initializes the disk label to the default for the target architecture
-
-part /boot/efi --fstype="efi" --size=2048 --fsoptions="umask=0077,shortname=winnt" --label=efi # Creates a 2 GB EFI system partition
-part /boot --fstype="ext4" --size=512 --label=boot # Creates a 512 MiB ext4 boot partition
-part / --fstype="ext4" --grow --label=root # Create a single root partition with the remaining space

ingredients/core.cfg

@@ -1,2 +0,0 @@
-text # Kickstart installation in text mode
-poweroff # Shut down the system after a successful installation

ingredients/extra-fedora-repos-nonfree.cfg

@@ -1,19 +0,0 @@
-# RPM fusion repositories
-# For the current release tree
-repo --name=rpmfusion-nonfree --mirrorlist=https://mirrors.rpmfusion.org/mirrorlist?repo=nonfree-fedora-$releasever&arch=$basearch --includepkgs=rpmfusion-nonfree-release
-# Updates for the current release tree
-repo --name=rpmfusion-nonfree-updates --mirrorlist=https://mirrors.rpmfusion.org/mirrorlist?repo=nonfree-fedora-updates-released-$releasever&arch=$basearch --includepkgs=rpmfusion-nonfree-release
-
-%post
-
-# Import RPM Fusion PGP Key. Courtesy of https://github.com/rpmfusion/rpmfusion-nonfree-remix-kickstarts/blob/master/rpmfusion-nonfree-live-base.ks
-echo "== RPM Fusion Nonfree: Base section =="
-echo "Importing RPM Fusion keys"
-rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-rpmfusion-nonfree-fedora-*-primary
-echo "List of packages from RPM Fusion Nonfree:"
-rpm -qa --qf '%{NAME} %{SIGGPG:pgpsig} %{SIGPGP:pgpsig} \n' | grep -e 3DE8C682E38EE9BC0FDFEA47FCAE2EA87F858107 | awk ' { print $1 } ' | sort
-echo "List of incuded RPM Fusion packages with their size:"
-rpm -q --qf '%{SIZE} %{NAME}\n' $(rpm -qa --qf '%{NAME} %{SIGGPG:pgpsig} %{SIGPGP:pgpsig} \n' | grep -e 3DE8C682E38EE9BC0FDFEA47FCAE2EA87F858107 | awk ' { print $1 } ') | sort -n
-echo
-
-%end

ingredients/live-core-bootloader-grub.cfg

@@ -1 +0,0 @@
-bootloader --location=none --timeout=1 # Set the GNU GRUB bootloader timeout to 1 and to location to none

ingredients/live-core-bootloader-systemd-boot.cfg

@@ -1 +0,0 @@
-bootloader --sdboot --location=none --timeout=1 # Use systemd-boot and set location to none