Enhance Linux and macOS development station configurations:

- Add user management and Oh My Zsh settings
- Update service scripts to use Zsh
- Include new packages and environment variables
- Modify Terraform configuration for upstream services

ansible/roles/linux_dev_station/tasks/main.yml

@@ -175,6 +175,80 @@
     - linux_dev_station_service_user_enabled | bool
     - linux_dev_station_oh_my_zsh_enabled | bool
 
+- name: Ensure .zshrc sets PATH for tool binaries
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ linux_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: linux_dev_station path
+      if ! [[ "$PATH" =~ "$HOME/.local/bin:" ]]; then
+        PATH="$HOME/.local/bin:$PATH"
+      fi
+      if ! [[ "$PATH" =~ "$HOME/bin:" ]]; then
+        PATH="$HOME/bin:$PATH"
+      fi
+      export PATH
+    marker: "# {mark} ansible: linux_dev_station path"
+    create: true
+    mode: "0644"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+
+- name: Ensure .zshrc unsets history vars before Oh My Zsh
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ linux_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: linux_dev_station unset history before oh-my-zsh
+      unset HISTFILE HISTSIZE SAVEHIST
+    marker: "# {mark} ansible: linux_dev_station unset history before oh-my-zsh"
+    create: true
+    mode: "0644"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_oh_my_zsh_enabled | bool
+
+- name: Ensure .zshrc sources Oh My Zsh
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ linux_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: linux_dev_station oh-my-zsh
+      export ZSH="$HOME/.oh-my-zsh"
+      ZSH_THEME="{{ linux_dev_station_oh_my_zsh_theme }}"
+      plugins=({{ linux_dev_station_oh_my_zsh_plugins | join(' ') }})
+      source "$ZSH/oh-my-zsh.sh"
+    marker: "# {mark} ansible: linux_dev_station oh-my-zsh"
+    create: true
+    mode: "0644"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_oh_my_zsh_enabled | bool
+
+- name: Ensure .zshrc has extra environment variables
+  become: true
+  ansible.builtin.blockinfile:
+    path: "{{ linux_dev_station_service_home }}/.zshrc"
+    block: |
+      # ansible: linux_dev_station extra env vars
+      {% for env_key, env_value in linux_dev_station_zshrc_extra_env.items() %}
+      export {{ env_key }}="{{ env_value }}"
+      {% endfor %}
+    marker: "# {mark} ansible: linux_dev_station extra env vars"
+    create: true
+    mode: "0644"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_zshrc_extra_env | length > 0
+
 - name: Ensure .zshrc has ssh-agent startup for devstation
   become: true
   ansible.builtin.blockinfile:

ansible/roles/linux_dev_station/tasks/tool_packages.yml

@@ -142,6 +142,8 @@
   become_user: "{{ linux_dev_station_service_user }}"
   ansible.builtin.command: >-
     {{ linux_dev_station_service_home }}/.fnm/fnm default {{ node_version }}
+  register: linux_dev_station_fnm_default_result
+  changed_when: "'default' in linux_dev_station_fnm_default_result.stderr or 'default' in linux_dev_station_fnm_default_result.stdout"
   environment:
     HOME: "{{ linux_dev_station_service_home }}"
     USER: "{{ linux_dev_station_service_user }}"
@@ -266,3 +268,72 @@
   when:
     - linux_dev_station_service_user_enabled | bool
     - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'opencode') | list | length > 0
+
+- name: Download sectool zip
+  become: true
+  ansible.builtin.get_url:
+    url: "https://github.com/a13labs/sectool/releases/download/v{{ tool.version }}/sectool-v{{ tool.version }}-linux-x64.zip"
+    dest: "{{ linux_dev_station_service_home }}/.cache/sectool-{{ tool.version }}.zip"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+    mode: "0644"
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0
+
+- name: Create sectool installation directories
+  become: true
+  become_user: "{{ linux_dev_station_service_user }}"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: "0755"
+  loop:
+    - "{{ linux_dev_station_service_home }}/.local/lib/sectool-{{ tool.version }}"
+    - "{{ linux_dev_station_service_home }}/.local/bin"
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0
+
+- name: Extract sectool zip to versioned directory
+  become: true
+  become_user: "{{ linux_dev_station_service_user }}"
+  ansible.builtin.unarchive:
+    src: "{{ linux_dev_station_service_home }}/.cache/sectool-{{ tool.version }}.zip"
+    dest: "{{ linux_dev_station_service_home }}/.local/lib/sectool-{{ tool.version }}"
+    remote_src: true
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0
+
+- name: Ensure sectool binary is executable
+  become: true
+  ansible.builtin.file:
+    path: "{{ linux_dev_station_service_home }}/.local/lib/sectool-{{ tool.version }}/sectool"
+    mode: "0755"
+    owner: "{{ linux_dev_station_service_user }}"
+    group: "{{ linux_dev_station_service_user }}"
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0
+
+- name: Create symlink for sectool binary
+  become: true
+  become_user: "{{ linux_dev_station_service_user }}"
+  ansible.builtin.file:
+    src: "{{ linux_dev_station_service_home }}/.local/lib/sectool-{{ tool.version }}/sectool"
+    dest: "{{ linux_dev_station_service_home }}/.local/bin/sectool"
+    state: link
+  vars:
+    tool: "{{ linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | first }}"
+  when:
+    - linux_dev_station_service_user_enabled | bool
+    - linux_dev_station_tool_packages | selectattr('name', 'equalto', 'sectool') | list | length > 0