mw-pfeddersheim-workstation/ansible/roles/common/tasks/main.yml

---
- name: Check current swap file size
  stat:
    path: "{{ swap_file_path }}"
  register: swap_stat
  tags: [swap, optimization]

- name: Check if swap is active
  command: swapon --show
  register: swapon_status
  changed_when: false
  tags: [swap, optimization]

- name: Turn off swap before resize
  command: "swapoff {{ swap_file_path }}"
  when: swap_stat.stat.exists and (swap_stat.stat.size != (swap_file_size_gb | int * 1024 * 1024 * 1024)) and (swap_file_path in swapon_status.stdout)
  become: yes
  tags: [swap, optimization]

- name: Create or resize swap file
  command: "fallocate -l {{ swap_file_size_gb }}G {{ swap_file_path }}"
  when: not swap_stat.stat.exists or (swap_stat.stat.size != (swap_file_size_gb | int * 1024 * 1024 * 1024))
  become: yes
  register: swap_resized
  tags: [swap, optimization]

- name: Set permissions on swap file
  file:
    path: "{{ swap_file_path }}"
    mode: '0600'
    owner: root
    group: root
  become: yes
  tags: [swap, optimization]

- name: Format swap file (if resized or new)
  command: "mkswap {{ swap_file_path }}"
  when: swap_resized.changed
  become: yes
  tags: [swap, optimization]

- name: Enable swap file
  command: "swapon {{ swap_file_path }}"
  when: swap_resized.changed
  become: yes
  tags: [swap, optimization]

- name: Ensure swap is in fstab
  mount:
    name: none
    src: "{{ swap_file_path }}"
    fstype: swap
    opts: defaults
    passno: 0
    dump: 0
    state: present
  become: yes
  tags: [swap, optimization]

- name: Check current root mount options
  command:
    argv:
      - findmnt
      - -no
      - OPTIONS
      - /
  register: root_mount_options
  changed_when: false
  tags: [filesystem, optimization, trim]

- name: Ensure root filesystem uses periodic TRIM settings in fstab
  mount:
    path: /
    src: "UUID={{ root_filesystem_uuid }}"
    fstype: ext4
    opts: "{{ root_filesystem_mount_opts }}"
    passno: 1
    dump: 0
    state: present
  become: yes
  tags: [filesystem, optimization, trim]

- name: Reload systemd after fstab updates
  systemd:
    daemon_reload: yes
  changed_when: false
  become: yes
  tags: [filesystem, optimization, trim]

- name: Remount root filesystem without continuous discard
  mount:
    path: /
    opts: "{{ root_filesystem_mount_opts }},nodiscard"
    state: remounted
  when: "'discard' in (root_mount_options.stdout.split(','))"
  become: yes
  tags: [filesystem, optimization, trim]

- name: Optimize kernel parameters
  sysctl:
    name: "{{ item.name }}"
    value: "{{ item.value }}"
    state: present
    reload: yes
  with_items:
    - { name: 'vm.swappiness', value: '10' }
    - { name: 'fs.inotify.max_user_watches', value: '524288' }
    - { name: 'vm.vfs_cache_pressure', value: '50' }
    - { name: 'vm.dirty_ratio', value: '10' }
    - { name: 'vm.dirty_background_ratio', value: '5' }
    - { name: 'vm.watermark_scale_factor', value: '100' }
  become: yes
  tags: [optimization, sysctl]

- name: Set logind configuration for faster user logins
  lineinfile:
    path: /etc/systemd/logind.conf
    regexp: '^#?KillUserProcesses='
    line: 'KillUserProcesses=no'
  become: yes
  tags: [systemd, optimization]

- name: Ensure systemd drop-in directories exist
  file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: '0755'
  with_items:
    - /etc/systemd/logind.conf.d
    - /etc/systemd/sleep.conf.d
  become: yes
  tags: [systemd, power]

- name: Configure systemd-logind to prevent sleep on keys/lid
  copy:
    dest: /etc/systemd/logind.conf.d/prevent-sleep.conf
    content: |
      [Login]
      HandleSuspendKey=ignore
      HandleHibernateKey=ignore
      HandleLidSwitch=ignore
    owner: root
    group: root
    mode: '0644'
  become: yes
  notify: Restart systemd-logind
  tags: [systemd, power]

- name: Configure systemd-sleep to disable sleep/hibernation
  copy:
    dest: /etc/systemd/sleep.conf.d/prevent-sleep.conf
    content: |
      [Sleep]
      AllowSuspend=no
      AllowHibernation=no
      AllowSuspendThenHibernate=no
      AllowHybridSleep=no
    owner: root
    group: root
    mode: '0644'
  become: yes
  tags: [systemd, power]

- name: Ensure systemd directories exist
  file:
    path: "{{ item }}"
    state: directory
  with_items:
    - /etc/systemd/system/user.slice.d
  become: yes
  tags: [oomd, systemd, stability]

- name: Configure ManagedOOM for user.slice
  template:
    src: 10-oomd-user.slice.conf.j2
    dest: /etc/systemd/system/user.slice.d/10-oomd-user.slice.conf
  become: yes
  notify: Reload systemd
  tags: [oomd, systemd, stability]

- name: Enable systemd-oomd
  systemd:
    name: systemd-oomd
    enabled: yes
    state: started
  become: yes
  tags: [systemd, oomd, stability]

- name: Configure kernel features in GRUB (Safe script)
  shell: |
    # Extract current cmdline
    CURRENT_CMDLINE=$(grep '^GRUB_CMDLINE_LINUX_DEFAULT=' /etc/default/grub | cut -d'"' -f2)
    
    # Remove our target parameters to avoid duplicates
    NEW_CMDLINE=$(echo "$CURRENT_CMDLINE" | sed -E 's/\bzswap\.(enabled|max_pool_percent)=[0-9]+\b//g' | sed -E 's/\btransparent_hugepage=[a-z]+\b//g' | xargs)
    
    # Append the desired parameters
    FINAL_CMDLINE="$NEW_CMDLINE zswap.enabled=1 zswap.max_pool_percent=30 transparent_hugepage=madvise"
    
    # Update the file if changed
    if [ "$CURRENT_CMDLINE" != "$FINAL_CMDLINE" ]; then
      sed -i "s|^GRUB_CMDLINE_LINUX_DEFAULT=.*|GRUB_CMDLINE_LINUX_DEFAULT=\"$FINAL_CMDLINE\"|" /etc/default/grub
      echo "changed"
    fi
  become: yes
  register: grub_cmdline_safe
  changed_when: grub_cmdline_safe.stdout == "changed"
  tags: [grub, boot, optimization, stability]

- name: Apply GRUB changes (Update GRUB)
  command: update-grub
  when: grub_cmdline_safe.changed
  become: yes
  tags: [grub, boot, optimization, stability]

- name: Set runtime Transparent Hugepages to madvise
  shell: echo madvise > /sys/kernel/mm/transparent_hugepage/enabled
  become: yes
  changed_when: false
  tags: [optimization, thp]

- name: Set runtime zswap max_pool_percent
  shell: echo 30 > /sys/module/zswap/parameters/max_pool_percent
  become: yes
  changed_when: false
  tags: [optimization, zswap]

- name: Ensure secrets management tools are installed
  community.general.pacman:
    name:
      # Secrets bridge (KWallet migration)
      - gnome-keyring
      # Bitwarden CLI client
      - rbw
    state: present
  tags: [secrets, bitwarden]