Enhance Linux and macOS development station configurations:

- Add user management and Oh My Zsh settings
- Update service scripts to use Zsh
- Include new packages and environment variables
- Modify Terraform configuration for upstream services

ansible/roles/linux_dev_station/defaults/main.yml

@@ -25,6 +25,9 @@ linux_dev_station_dnf_packages:
   - golang
   - ripgrep
   - fzf
+  - sqlite3
+  - opentofu
+  - kubectl
 
 linux_dev_station_tool_packages:
   - name: uv
@@ -39,6 +42,9 @@ linux_dev_station_tool_packages:
   - name: opencode
     version: "1.17.18"
     sha256: ""
+  - name: sectool
+    version: "1.1.2"
+    sha256: ""
 
 linux_dev_station_code_server_host: "0.0.0.0"
 linux_dev_station_code_server_port: 3000
@@ -63,6 +69,26 @@ linux_dev_station_copilot_fail_on_error: false
 
 linux_dev_station_oh_my_zsh_enabled: true
 linux_dev_station_oh_my_zsh_install_url: "https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh"
+linux_dev_station_oh_my_zsh_theme: "agnoster"
+linux_dev_station_oh_my_zsh_plugins:
+  - git
+  - fzf
+  - common-aliases
+  - sudo
+  - tmux
+  - extract
+  - colored-man-pages
+  - history-substring-search
+  - kubectl
+  - microk8s
+  - docker
+  - docker-compose
+  - ansible
+  - aws
+  - golang
+  - dnf
+  - bgnotify
+linux_dev_station_zshrc_extra_env: {}
 
 linux_dev_station_npm_packages: []
 

ansible/roles/linux_dev_station/tasks/main.yml

@@ -175,6 +175,80 @@
     - linux_dev_station_service_user_enabled | bool
     - linux_dev_station_oh_my_zsh_enabled | bool
 
+- name: Ensure .zshrc sets PATH for tool binaries
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ linux_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: linux_dev_station path
+      if ! [[ "$PATH" =~ "$HOME/.local/bin:" ]]; then
+        PATH="$HOME/.local/bin:$PATH"
+      fi
+      if ! [[ "$PATH" =~ "$HOME/bin:" ]]; then
+        PATH="$HOME/bin:$PATH"
+      fi
+      export PATH
+    marker: "# {mark} ansible: linux_dev_station path"
+    create: true
+    mode: "0644"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+
+- name: Ensure .zshrc unsets history vars before Oh My Zsh
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ linux_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: linux_dev_station unset history before oh-my-zsh
+      unset HISTFILE HISTSIZE SAVEHIST
+    marker: "# {mark} ansible: linux_dev_station unset history before oh-my-zsh"
+    create: true
+    mode: "0644"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_oh_my_zsh_enabled | bool
+
+- name: Ensure .zshrc sources Oh My Zsh
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ linux_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: linux_dev_station oh-my-zsh
+      export ZSH="$HOME/.oh-my-zsh"
+      ZSH_THEME="{{ linux_dev_station_oh_my_zsh_theme }}"
+      plugins=({{ linux_dev_station_oh_my_zsh_plugins | join(' ') }})
+      source "$ZSH/oh-my-zsh.sh"
+    marker: "# {mark} ansible: linux_dev_station oh-my-zsh"
+    create: true
+    mode: "0644"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_oh_my_zsh_enabled | bool
+
+- name: Ensure .zshrc has extra environment variables
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ linux_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: linux_dev_station extra env vars
+      {% for env_key, env_value in linux_dev_station_zshrc_extra_env.items() %}
+      export {{ env_key }}="{{ env_value }}"
+      {% endfor %}
+    marker: "# {mark} ansible: linux_dev_station extra env vars"
+    create: true
+    mode: "0644"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_zshrc_extra_env | length > 0
+
 - name: Ensure .zshrc has ssh-agent startup for devstation
   become: true
   ansible.builtin.blockinfile:

ansible/roles/linux_dev_station/tasks/tool_packages.yml

@@ -142,6 +142,8 @@
   become_user: "{{ linux_dev_station_service_user }}"
   ansible.builtin.command: >-
     {{ linux_dev_station_service_home }}/.fnm/fnm default {{ node_version }}
+  register: linux_dev_station_fnm_default_result
+  changed_when: "'default' in linux_dev_station_fnm_default_result.stderr or 'default' in linux_dev_station_fnm_default_result.stdout"
   environment:
     HOME: "{{ linux_dev_station_service_home }}"
     USER: "{{ linux_dev_station_service_user }}"
@@ -266,3 +268,72 @@
   when:
     - linux_dev_station_service_user_enabled | bool
     - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'opencode') | list | length > 0
+
+- name: Download sectool zip
+  become: true
+  ansible.builtin.get_url:
+    url: "https://github.com/a13labs/sectool/releases/download/v{{ tool.version }}/sectool-v{{ tool.version }}-linux-x64.zip"
+    dest: "{{ linux_dev_station_service_home }}/.cache/sectool-{{ tool.version }}.zip"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+    mode: "0644"
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0
+
+- name: Create sectool installation directories
+  become: true
+  become_user: "{{ linux_dev_station_service_user }}"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - "{{ linux_dev_station_service_home }}/.local/lib/sectool-{{ tool.version }}"
+    - "{{ linux_dev_station_service_home }}/.local/bin"
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0
+
+- name: Extract sectool zip to versioned directory
+  become: true
+  become_user: "{{ linux_dev_station_service_user }}"
+  ansible.builtin.unarchive:
+    src: "{{ linux_dev_station_service_home }}/.cache/sectool-{{ tool.version }}.zip"
+    dest: "{{ linux_dev_station_service_home }}/.local/lib/sectool-{{ tool.version }}"
+    remote_src: true
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0
+
+- name: Ensure sectool binary is executable
+  become: true
+  ansible.builtin.file:
+    path: "{{ linux_dev_station_service_home }}/.local/lib/sectool-{{ tool.version }}/sectool"
+    mode: "0755"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0
+
+- name: Create symlink for sectool binary
+  become: true
+  become_user: "{{ linux_dev_station_service_user }}"
+  ansible.builtin.file:
+    src: "{{ linux_dev_station_service_home }}/.local/lib/sectool-{{ tool.version }}/sectool"
+    dest: "{{ linux_dev_station_service_home }}/.local/bin/sectool"
+    state: link
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0

ansible/roles/linux_dev_station/templates/code-server.service.j2

@@ -7,7 +7,7 @@ Type=simple
 User={{ linux_dev_station_service_user }}
 Group={{ linux_dev_station_service_user }}
 WorkingDirectory={{ linux_dev_station_workspace_dir }}
-ExecStart=/bin/bash {{ linux_dev_station_scripts_dir }}/start-ide.sh
+ExecStart=/bin/zsh -i {{ linux_dev_station_scripts_dir }}/start-ide.sh
 Restart=always
 RestartSec=5
 StandardOutput=append:{{ linux_dev_station_logs_dir }}/code-server.log
@@ -15,6 +15,7 @@ StandardError=append:{{ linux_dev_station_logs_dir }}/code-server.err.log
 
 Environment="HOME={{ linux_dev_station_service_home }}"
 Environment="PATH={{ linux_dev_station_path }}"
+Environment="TMPDIR={{ linux_dev_station_service_home }}/.cache/tmp"
 Environment="PASSWORD={{ linux_dev_station_code_server_password }}"
 {% if linux_dev_station_ssh_agent_enabled | bool %}
 Environment="SSH_AUTH_SOCK={{ linux_dev_station_ssh_agent_socket }}"

ansible/roles/linux_dev_station/templates/opencode.service.j2

@@ -7,7 +7,7 @@ Type=simple
 User={{ linux_dev_station_service_user }}
 Group={{ linux_dev_station_service_user }}
 WorkingDirectory={{ linux_dev_station_workspace_dir }}
-ExecStart=/bin/bash {{ linux_dev_station_scripts_dir }}/start-opencode.sh
+ExecStart=/bin/zsh -i {{ linux_dev_station_scripts_dir }}/start-opencode.sh
 Restart=always
 RestartSec=5
 StandardOutput=append:{{ linux_dev_station_logs_dir }}/opencode.log
@@ -15,6 +15,7 @@ StandardError=append:{{ linux_dev_station_logs_dir }}/opencode.err.log
 
 Environment="HOME={{ linux_dev_station_service_home }}"
 Environment="PATH={{ linux_dev_station_path }}"
+Environment="TMPDIR={{ linux_dev_station_service_home }}/.cache/tmp"
 Environment="OPENCODE_SERVER_USERNAME={{ linux_dev_station_opencode_server_username }}"
 Environment="OPENCODE_SERVER_PASSWORD={{ linux_dev_station_opencode_server_password }}"
 {% for env_key, env_value in linux_dev_station_opencode_extra_environment.items() %}

ansible/roles/linux_dev_station/templates/start-ide.sh.j2

@@ -1,7 +1,16 @@
-#!/usr/bin/env bash
+#!/usr/bin/env zsh
 
 set -euo pipefail
 
+# Suppress ZLE warnings from Oh My Zsh (no TTY in systemd)
+setopt NOZLE 2>/dev/null || true
+
+# Override TMPDIR — /tmp is noexec on Fedora, Bun needs an executable temp
+export TMPDIR="{{ linux_dev_station_service_home }}/.cache/tmp"
+mkdir -p "$TMPDIR"
+# Clean stale files older than 7 days
+find "$TMPDIR" -mindepth 1 -atime +7 -delete 2>/dev/null || true
+
 {% if linux_dev_station_ssh_agent_enabled | bool %}
 source "{{ linux_dev_station_scripts_dir }}/ssh-agent-start.sh"
 {% endif %}

ansible/roles/linux_dev_station/templates/start-opencode.sh.j2

@@ -1,7 +1,16 @@
-#!/usr/bin/env bash
+#!/usr/bin/env zsh
 
 set -euo pipefail
 
+# Suppress ZLE warnings from Oh My Zsh (no TTY in systemd)
+setopt NOZLE 2>/dev/null || true
+
+# Override TMPDIR — /tmp is noexec on Fedora, Bun needs an executable temp
+export TMPDIR="{{ linux_dev_station_service_home }}/.cache/tmp"
+mkdir -p "$TMPDIR"
+# Clean stale files older than 7 days
+find "$TMPDIR" -mindepth 1 -atime +7 -delete 2>/dev/null || true
+
 {% if linux_dev_station_ssh_agent_enabled | bool %}
 source "{{ linux_dev_station_scripts_dir }}/ssh-agent-start.sh"
 {% endif %}