ansible-desktop

automated installation of Archlinux with a gnome/Xfce desktop configuration,
	along with common packages.

Initially we use archinstall ( https://wiki.archlinux.org/title/archinstall )
	to provision with NetworkManager, Xfce, and to start sshd. Could also
	download the ssh pubkey for ansible, and turn off password logins/disable
	root login

	archinstall steps:
	- make/save a new gnome profile
	- copy archinstall configs
	- reconfigure disk layout
	- NOTE: must select seatd when installing sway WM
	- set root/user passwds
	- Install
	- (only for qemu) enable sshd in chroot
	- enable wheel group in /etc/sudoers
	- enable/start seatd systemd service

	ansible steps:
	- (only for qemu) ssh setup, pubkey install
	- dotfile repo, vim plugin install
	- dev-tools (optional):
	- 	make, gcc, cmake, binutils

	- gnome: (only usable to me wayland DE until xfce finishes)
	- 	dconf dump/load to export/import settings
	- 	dash-to-panel extension mostly enables settings I prefer
	- 	gnome-tweaks for extra settings

	- desktop applications:
	- 	firefox (including user.js and addons),
	- 		https://github.com/arkenfox/user.js
	- 	mail-client, audacious, xarchiver, okular, mpv

	=== sandboxing: (aka, stop using firejail's setuid) ===

	ideally would be lightweight lxc containers only running Wayland, with
		no fallback to X11
		- https://wiki.archlinux.org/title/LXD#Use_Wayland_and_Xorg_applications
		- https://discuss.linuxcontainers.org/t/overview-gui-inside-containers/8767
		- https://blog.simos.info/running-x11-software-in-lxd-containers/
		- for issues mounting the X socket:
			https://github.com/lxc/lxd/issues/6584#issuecomment-564367714

	for seccomp filtering, maybe try bwrap, or flatpak
		however: https://hanako.codeberg.page/

	will always leak via the X11 socket unless using Wayland, or xpra