scratch: verify direct-push access (will be deleted)

noctalia 5.3.0 is in the Fedora 44 updates repo (confirmed on
packages.fedoraproject.org and by a fresh-install dnf install noctalia).
The niri module no longer calls add_terra_repo; Terra stays in the base
section and in the mango module, which is the only consumer left
(mangowc). README + comments updated.

.token-verify.txt

@@ -0,0 +1 @@
+pathfinder token verification 2026-10-27T10:53:17Z

README.md

@@ -1,3 +1,157 @@
 # Fedora Unified Config
 
-The goal for this repo is to create a unified configuration for Fedora 44 and newer.
+Unified configuration for **bare/minimal Fedora 44 and newer**. Pick a desktop
+environment and optionally a tiling window manager; the script wires up repos,
+packages, the greeter and the session entry.
+
+This repo is the Fedora-only successor to `starburst`. Everything multi-distro
+(Arch, Debian, Ubuntu branches, OS guessing, per-distro package helpers) is gone
+on purpose.
+
+## Usage
+
+```bash
+git clone https://git.ku-it.org/yuri/fedora.git
+cd fedora
+./setup.sh                      # interactive: choose DE, then TWM
+./setup.sh --debug              # same, but pause after each section
+```
+
+Non-interactive:
+
+```bash
+./setup.sh --yes --de=none --twm=niri
+./setup.sh --yes --de=gnome --twm=none
+```
+
+Run as your **normal user**, not root. `sudo` is used where needed.
+
+## Layout
+
+```
+setup.sh                  entrypoint: args, preconditions, base setup, menus, dispatch
+lib/common.sh             colours, logging, dnf helpers, rpmfusion/terra, nerd fonts
+lib/session.sh            display-manager detection/switching, session entries
+modules/de/{gnome,plasma,xfce}.sh
+modules/twm/{niri,hyprland,mango,chadwm}.sh
+```
+
+Modules are **separate processes**, not sourced into `setup.sh`. That means a
+module's own `set -e` cannot leak into the caller, and every module can be run
+on its own for testing:
+
+```bash
+DE=none TWM=niri DEBUG_MODE=false bash modules/twm/niri.sh
+```
+
+Each module pulls in `lib/` by relative path, so it works both ways.
+
+## Selection matrix
+
+| DE | TWM | Result |
+|---|---|---|
+| any | any | DE provides the session; TWM is added alongside it |
+| `none` | any | TWM-only machine, SDDM installed as the greeter |
+| any | `none` | plain desktop, no tiling WM |
+| `none` | `none` | **refused** — that is not a graphical system |
+
+### Desktop environments
+
+| DE | dnf group (tried in order) | native greeter |
+|---|---|---|
+| `gnome` | `gnome-desktop`, `gnome-desktop-environment`, `workstation-product-environment` | gdm |
+| `plasma` | `kde-desktop`, `kde-desktop-environment` | sddm |
+| `xfce` | `xfce-desktop`, `xfce-desktop-environment` | sddm |
+
+### Tiling window managers
+
+| TWM | Source | Session type | Notes |
+|---|---|---|---|
+| `niri` | Fedora repos | Wayland | noctalia is packaged since F44; ships its own session entry |
+| `hyprland` | **COPR** (lionheartp, then hermitfeather, then solopasha) | Wayland | Retired from Fedora repos after F42; first COPR with a chroot for your release wins |
+| `mango` | **Terra repo only** | Wayland | Session entry written if the package lacks one |
+| `chadwm` | **built from source** | **X11** | dwm fork; not packaged anywhere for Fedora |
+
+`chadwm` is the only X11 entry in the menu. The other three are Wayland
+compositors — do not expect the same config story from it.
+
+## Display manager policy
+
+* A **DE module** leaves the DE's own greeter alone (GNOME→gdm, Plasma→sddm,
+  XFCE→sddm). It never fights a desktop over its own login screen.
+* A **TWM module** enforces **SDDM**, because it is the only greeter that lists
+  Wayland compositors *and* X11 sessions in one menu.
+* Either way `graphical.target` becomes the default.
+
+
+## System settings
+
+Between base setup and the DE menu, the script asks two questions:
+
+1. **Disable SELinux permanently?** — default **no**. Writes `SELINUX=disabled`
+   to `/etc/selinux/config` (backup kept); a reboot applies it. Recommended
+   answer is no.
+2. **Snapper + grub-btrfs + zstd compression** — only asked when `/` is btrfs,
+   default **yes**. Runs, in order:
+   - `btrfs subvolume list /` and the fstab btrfs entries are shown
+   - every fstab btrfs entry with a `subvol=` but no `compress=` gets
+     `,compress=zstd:1` appended (fstab backed up first; re-runs cannot stack
+     duplicate options)
+   - the [SysGuides installer](https://github.com/SysGuides/sysguides-snapper-fedora)
+     sets up snapper (root + home), grub-btrfs, and DNF5 pre/post snapshot hooks,
+     so every `dnf` transaction is snapshotted and `snapper undochange` works.
+
+Unattended equivalents: `--selinux=keep|disabled` and `--snapper=yes|no`.
+
+## Design rules
+
+1. **Fail loudly, early.** `set -e` is on unless `--debug`. Unsupported distro,
+   release below 44, `DE=none` + `TWM=none`, and a missing module all abort with
+   an explanation instead of half-installing.
+2. **Be idempotent.** Re-running must be safe. Repos are checked with `rpm -q`
+   before being added, the Nerd Font is skipped if already present, and session
+   entries are not overwritten.
+3. **Prefer official repos, then Terra, then a source build.** That order is why
+   only `mango` and `chadwm` need special handling.
+4. **No silent optional failures.** `install_optional` warns and continues for
+   nice-to-haves; everything load-bearing uses `install_packages` and aborts.
+5. **Guard anything environment-dependent.** `clear` needs `|| true` (no `TERM`
+   under cron/pipes), `os-release` fields are defaulted, and
+   `/usr/share/xsessions` is created before writing into it.
+
+## Testing
+
+The script was verified on a non-Fedora host with a stateful stub harness
+(fake `sudo`/`dnf`/`rpm`/`systemctl`/`git`/`make`/`curl`, a fake `os-release`,
+and sandboxed `/usr` + `$HOME`). Covered: every DE×(TWM|none) combination, the
+refusal paths, `--help`/bad args, interactive menus, `--debug` abort, and
+re-running for idempotency.
+
+`OS_RELEASE_FILE` is overridable purely so the preconditions can be tested:
+
+```bash
+OS_RELEASE_FILE=/tmp/fake-os-release ./setup.sh --yes --de=xfce --twm=chadwm
+```
+
+## Known limitations
+
+* `mangowc` comes from **Terra** (added in the base section) and `hyprland`
+  from a **COPR** — third-party sources whose layout is not guaranteed across
+  Fedora releases; `mango` aborts with build-from-source instructions if the
+  package is missing. `noctalia` has been in the Fedora repos since F44, so
+  the niri module needs no third-party repo.
+* Package *names* are not verified by installation in this repo's test harness —
+  only control flow is. First real run on a fresh F44 box is the actual proof.
+* `gnome-tweaks`/`gnome-extensions-app`, `wofi`, `waybar`, `hyprlock` and friends
+  are installed with `install_optional`, so a rename will warn rather than fail.
+
+## Roadmap
+
+- [ ] Profile files (`--profile=laptop`) instead of individual flags
+- [ ] Optional dotfiles layer (noctalia/hyprland/niri configs)
+- [ ] `--dry-run` that prints the dnf transaction without applying it
+- [ ] Pre-flight report: what is already installed, what would change
+
+## License
+
+See `LICENSE`.

lib/common.sh

@@ -0,0 +1,285 @@
+# shellcheck shell=bash
+#------------------------------------------
+# lib/common.sh — shared helpers
+#
+# Sourced by setup.sh and by every module. Modules source it directly, so a
+# module can be run standalone for testing:
+#     DE=none TWM=niri bash modules/twm/niri.sh
+#------------------------------------------
+
+# Guard against double-sourcing (setup.sh and a module can both pull it in)
+if [[ -n "${_SB_COMMON_LOADED:-}" ]]; then
+    return 0
+fi
+_SB_COMMON_LOADED=1
+
+#------------------------------------------
+# Colors (printf-safe, no tput)
+#------------------------------------------
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+CYAN='\033[0;36m'
+PURPLE='\033[0;35m'
+BLUE='\033[0;34m'
+GRAY='\033[0;37m'
+BOLD='\033[1m'
+RESET='\033[0m'
+
+# Disable colors if output is not a terminal
+# (PURPLE/BLUE/BOLD defined for future use; shellcheck has no way to know that)
+# shellcheck disable=SC2034
+if [ ! -t 1 ]; then
+    RED='' GREEN='' YELLOW='' CYAN='' PURPLE='' BLUE='' GRAY='' BOLD='' RESET=''
+fi
+
+color_yellow() { printf "%b%s%b\n" "$YELLOW" "$*" "$RESET"; }
+color_cyan()   { printf "%b%s%b\n" "$CYAN"   "$*" "$RESET"; }
+color_red()    { printf "%b%s%b\n" "$RED"    "$*" "$RESET"; }
+color_green()  { printf "%b%s%b\n" "$GREEN"  "$*" "$RESET"; }
+color_gray()   { printf "%b%s%b\n" "$GRAY"   "$*" "$RESET"; }
+
+#------------------------------------------
+# Log levels
+#------------------------------------------
+info()  { color_cyan   "  $*"; }
+ok()    { color_green  "  $*"; }
+warn()  { color_yellow "  $*"; }
+err()   { color_red    "  $*" >&2; }
+step()  { printf "\n"; color_yellow "$*"; }
+rule()  { printf "%s\n" "----------------------------------------------------------------"; }
+
+#------------------------------------------
+# Debug pausing
+#------------------------------------------
+is_debug() { [[ "${DEBUG_MODE:-false}" == "true" ]]; }
+
+pause_if_debug() {
+    if is_debug; then
+        printf "\n"
+        color_yellow "----------------------------------------------------------------"
+        read -rp "Section complete. Press [Enter] to continue, or [q] to abort: " debug_choice
+        if [[ "${debug_choice,,}" == "q" ]]; then
+            color_red "Script aborted by user."
+            exit 1
+        fi
+        color_yellow "----------------------------------------------------------------"
+        printf "\n"
+    fi
+}
+
+#------------------------------------------
+# Package helpers (dnf5)
+#------------------------------------------
+install_packages() {
+    # -y           : no prompts
+    # weak deps on : keep default behaviour, stated explicitly so it is greppable
+    sudo dnf install -y --setopt=install_weak_deps=True "$@"
+}
+
+# Same, but a missing/renamed package warns instead of aborting the whole run.
+# Use for anything that is a nice-to-have rather than load-bearing.
+install_optional() {
+    sudo dnf install -y --setopt=install_weak_deps=True "$@" \
+        || warn "Optional packages not installed: $*"
+}
+
+pkg_installed() {
+    local p
+    for p in "$@"; do
+        rpm -q "$p" &>/dev/null || return 1
+    done
+    return 0
+}
+
+remove_packages() {
+    local packages_to_remove=()
+    for pkg in "$@"; do
+        if pkg_installed "$pkg"; then
+            packages_to_remove+=("$pkg")
+        else
+            color_gray "  Package '$pkg' not installed. Skipping removal."
+        fi
+    done
+
+    if [ ${#packages_to_remove[@]} -gt 0 ]; then
+        info "Removing packages: ${packages_to_remove[*]}"
+        sudo dnf remove -y "${packages_to_remove[@]}"
+    fi
+}
+
+# dnf comps group. Fail loudly with the real group list rather than letting
+# dnf's generic "no match" scroll past.
+install_group() {
+    local group="$1"
+    if ! dnf group info "$group" >/dev/null 2>&1; then
+        err "No such dnf group: @$group"
+        err "Available groups on this system:"
+        dnf group list --hidden 2>/dev/null | sed 's/^/    /' >&2 || true
+        return 1
+    fi
+    sudo dnf group install -y "$group"
+}
+
+# Try each candidate group/environment in turn; first one that exists wins.
+install_group_any() {
+    local g
+    for g in "$@"; do
+        if dnf group info "$g" >/dev/null 2>&1; then
+            info "Using dnf group: @$g"
+            sudo dnf group install -y "$g"
+            return 0
+        fi
+    done
+    err "None of these dnf groups exist: $*"
+    dnf group list --hidden 2>/dev/null | sed 's/^/    /' >&2 || true
+    return 1
+}
+
+#------------------------------------------
+# Third-party repos
+#------------------------------------------
+add_terra_repo() {
+    if pkg_installed terra-release; then
+        ok "Terra repository already installed."
+        return 0
+    fi
+    info "Adding Terra repository (Fyra Labs)..."
+    # Terra's own instructions use --nogpgcheck for the bootstrap package;
+    # once terra-release is in place the repo itself is signature-checked.
+    sudo dnf install -y --nogpgcheck \
+        --repofrompath 'terra,https://repos.fyralabs.com/terra$releasever' \
+        terra-release
+}
+
+add_rpmfusion_repo() {
+    local rel
+    rel=$(rpm -E %fedora)
+    if pkg_installed rpmfusion-free-release rpmfusion-nonfree-release; then
+        ok "RPM Fusion already installed."
+        return 0
+    fi
+    info "Enabling RPM Fusion (free + nonfree) for Fedora ${rel}..."
+    sudo dnf install -y \
+        "https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-${rel}.noarch.rpm" \
+        "https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-${rel}.noarch.rpm"
+}
+
+#------------------------------------------
+# Fonts
+#------------------------------------------
+# Nerd Fonts are not in the Fedora repos, so pull the release zip from GitHub
+# into the user's font dir. Idempotent: skipped if the family is already there.
+install_nerd_font() {
+    local family="${1:-JetBrainsMono}"
+    local dest="${HOME}/.local/share/fonts/NerdFonts-${family}"
+    local url="https://github.com/ryanoasis/nerd-fonts/releases/latest/download/${family}.zip"
+
+    if [[ -d "$dest" ]] && compgen -G "$dest/*.ttf" >/dev/null; then
+        ok "Nerd Font ${family} already installed."
+        return 0
+    fi
+
+    info "Installing Nerd Font ${family}..."
+    local tmp
+    tmp=$(mktemp -d)
+
+    if ! curl -fsSL -o "$tmp/${family}.zip" "$url"; then
+        warn "Could not download ${family} Nerd Font. Skipping."
+        rm -rf "$tmp"
+        return 0
+    fi
+
+    if ! command -v unzip >/dev/null 2>&1; then
+        install_packages unzip
+    fi
+
+    mkdir -p "$dest"
+    unzip -qo "$tmp/${family}.zip" -d "$dest"
+    rm -rf "$tmp"
+
+    fc-cache -f "$dest" >/dev/null 2>&1 || true
+    ok "Nerd Font ${family} installed to $dest"
+}
+
+
+#------------------------------------------
+# System: SELinux, Btrfs, snapper
+#------------------------------------------
+# Permanently disable SELinux. Destructive-ish: warn loudly, and remind the
+# user a reboot is needed for the change to take effect.
+disable_selinux() {
+    # FSTAB/SELINUX file overridable for testing on non-Fedora hosts
+    local cfg="${SELINUX_CONFIG:-/etc/selinux/config}"
+    if [[ -f "$cfg" ]] && grep -q '^SELINUX=disabled' "$cfg"; then
+        ok "SELinux already disabled in $cfg."
+        return 0
+    fi
+    warn "Disabling SELinux permanently. This removes a significant layer of"
+    warn "system protection. Only do this if you specifically need it."
+    if [[ -f "$cfg" ]]; then
+        sudo cp "$cfg" "${cfg}.bkp.$(date +%F)"
+        sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/' "$cfg"
+    else
+        printf 'SELINUX=disabled\nSELINUXTYPE=targeted\n' | sudo tee "$cfg" >/dev/null
+    fi
+    ok "SELINUX=disabled written to $cfg (backup saved). Reboot to apply."
+}
+
+# Show the btrfs layout, then make sure every btrfs fstab entry compresses
+# with zstd. The sed variant from the SysGuides guide appends ,compress=zstd:1
+# after the subvol= option; we guard it so re-runs cannot stack duplicates.
+ensure_btrfs_compression() {
+    local fstab="${FSTAB_FILE:-/etc/fstab}"
+    info "Current btrfs subvolumes on /:"
+    sudo btrfs subvolume list / 2>/dev/null | sed 's/^/    /' || warn "btrfs subvolume list failed (not btrfs?)"
+
+    info "fstab btrfs entries:"
+    grep ' btrfs ' "$fstab" | sed 's/^/    /' || true
+
+    local fixed=0 line
+    # Only touch btrfs lines that have a subvol= option and no compress= yet.
+    while IFS= read -r line; do
+        if grep -q ' btrfs ' <<<"$line" && grep -q 'subvol=' <<<"$line" && ! grep -q 'compress=' <<<"$line"; then
+            fixed=$((fixed+1))
+        fi
+    done < "$fstab"
+
+    if (( fixed == 0 )); then
+        ok "All btrfs fstab entries already carry a compress= option (or none exist)."
+        return 0
+    fi
+
+    info "Adding compress=zstd:1 to ${fixed} btrfs fstab entrie(s)..."
+    # Backup once per run, then apply the SysGuides sed to every qualifying line.
+    sudo cp "$fstab" "$fstab.bkp.$(date +%F-%H%M)"
+    sudo sed -i '/ btrfs / s/subvol=[^ ,]*/&,compress=zstd:1/' "$fstab"
+    ok "fstab updated. Remount or reboot for compression to take effect:"
+    info "    sudo mount -o remount /  &&  sudo mount -o remount /home"
+}
+
+# Full snapshot setup via the SysGuides installer (snapper + grub-btrfs +
+# DNF5 pre/post snapshot actions). The installer re-validates btrfs itself.
+setup_snapper() {
+    if pkg_installed snapper && [[ -d /.snapshots ]]; then
+        ok "Snapper already configured (config for / exists)."
+        return 0
+    fi
+    if ! findmnt -n -o FSTYPE / 2>/dev/null | grep -q btrfs; then
+        warn "Root filesystem is not btrfs; skipping snapshot setup."
+        return 0
+    fi
+    info "Setting up snapper + grub-btrfs (SysGuides installer)..."
+    local tmp
+    tmp=$(mktemp -d)
+    git clone --depth 1 https://github.com/SysGuides/sysguides-snapper-fedora "$tmp/sysguides" \
+        || { err "Could not clone the SysGuides installer."; rm -rf "$tmp"; return 1; }
+    ( cd "$tmp/sysguides" && ./install.sh )
+    local rc=$?
+    rm -rf "$tmp"
+    if (( rc == 0 )); then
+        ok "Snapper + grub-btrfs installed. Every dnf transaction now gets a pre/post snapshot."
+        info "Try it:  snapper ls   |   snapper status 1..2   |   sudo snapper undochange 1..2"
+    fi
+    return $rc
+}

lib/session.sh

@@ -0,0 +1,91 @@
+# shellcheck shell=bash
+#------------------------------------------
+# lib/session.sh — display manager and graphical session wiring
+#
+# DM policy:
+#   * A DE module leaves its native DM alone (GNOME→gdm, Plasma→sddm, XFCE→sddm).
+#   * A TWM module enforces SDDM, because SDDM is the only DM that presents both
+#     Wayland compositors and X11 sessions in one menu. One greeter, no surprises.
+#------------------------------------------
+
+if [[ -n "${_SB_SESSION_LOADED:-}" ]]; then
+    return 0
+fi
+_SB_SESSION_LOADED=1
+
+# Name of the active display manager ("sddm", "gdm", "lightdm"), or "" if none.
+detect_display_manager() {
+    local link=/etc/systemd/system/display-manager.service
+    if [[ -L "$link" ]]; then
+        basename "$(readlink "$link")" | sed 's/\.service$//'
+    else
+        echo ""
+    fi
+}
+
+enable_graphical_target() {
+    sudo systemctl set-default graphical.target
+}
+
+# Make $1 the display manager, disabling whatever is active now.
+switch_display_manager() {
+    local target="$1"
+    local current
+    current=$(detect_display_manager)
+
+    if [[ "$current" == "$target" ]]; then
+        ok "Display manager already $target."
+    else
+        if [[ -n "$current" ]]; then
+            info "Disabling current display manager: $current"
+            # disable may fail if the unit vanished; that is not fatal
+            sudo systemctl disable "$current" 2>/dev/null || true
+        fi
+        info "Enabling display manager: $target"
+        sudo systemctl enable "$target"
+    fi
+
+    enable_graphical_target
+}
+
+# Register a Wayland session so the DM can list it.
+# $1 = identifier, $2 = display name, $3 = command
+write_wayland_session() {
+    local id="$1" name="$2" exec_cmd="$3"
+    local file="/usr/share/wayland-sessions/${id}.desktop"
+    if [[ -f "$file" ]]; then
+        ok "Wayland session already registered: $id"
+        return 0
+    fi
+    info "Registering Wayland session: $id"
+    sudo mkdir -p "$(dirname "$file")"
+    printf '[Desktop Entry]\nName=%s\nComment=%s\nExec=%s\nType=Application\nDesktopNames=%s\n' \
+        "$name" "$name session" "$exec_cmd" "$id" | sudo tee "$file" >/dev/null
+    sudo chmod 644 "$file"
+}
+
+# Register an X11 session so the DM can list it.
+write_x11_session() {
+    local id="$1" name="$2" exec_cmd="$3"
+    local file="/usr/share/xsessions/${id}.desktop"
+    if [[ -f "$file" ]]; then
+        ok "X11 session already registered: $id"
+        return 0
+    fi
+    info "Registering X11 session: $id"
+    # A bare Fedora has no X session yet, so the directory may not exist.
+    sudo mkdir -p "$(dirname "$file")"
+    printf '[Desktop Entry]\nName=%s\nComment=%s\nExec=%s\nType=Application\n' \
+        "$name" "$name session" "$exec_cmd" | sudo tee "$file" >/dev/null
+    sudo chmod 644 "$file"
+}
+
+# Common login-time plumbing every Wayland compositor wants on a bare install.
+install_session_prereqs() {
+    install_packages \
+        xdg-desktop-portal \
+        polkit \
+        pipewire \
+        pipewire-pulseaudio \
+        wireplumber
+}

modules/de/gnome.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/common.sh
+source "$HERE/../../lib/common.sh"
+# shellcheck source=../../lib/session.sh
+source "$HERE/../../lib/session.sh"
+
+if is_debug; then set +e; else set -e; fi
+
+step "Desktop environment: GNOME"
+rule
+
+if pkg_installed gnome-shell; then
+    ok "GNOME already installed."
+else
+    info "Installing the GNOME desktop..."
+    # Group names have shifted across releases; take whichever exists.
+    install_group_any gnome-desktop gnome-desktop-environment workstation-product-environment
+    install_optional gnome-tweaks gnome-extensions-app
+fi
+
+# GNOME ships and enables gdm itself. We deliberately leave it alone: a DE module
+# never fights the DE over its own greeter. A TWM module switched on top will
+# move the system to SDDM instead.
+info "Current display manager: $(detect_display_manager)"
+
+ok "GNOME setup complete."

modules/de/plasma.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/common.sh
+source "$HERE/../../lib/common.sh"
+# shellcheck source=../../lib/session.sh
+source "$HERE/../../lib/session.sh"
+
+if is_debug; then set +e; else set -e; fi
+
+step "Desktop environment: KDE Plasma"
+rule
+
+if pkg_installed plasma-workspace; then
+    ok "Plasma already installed."
+else
+    info "Installing the KDE Plasma desktop..."
+    install_group_any kde-desktop kde-desktop-environment
+fi
+
+# Plasma's native greeter is SDDM; make sure it is actually the active one.
+install_packages sddm
+switch_display_manager sddm
+
+ok "Plasma setup complete."

modules/de/xfce.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/common.sh
+source "$HERE/../../lib/common.sh"
+# shellcheck source=../../lib/session.sh
+source "$HERE/../../lib/session.sh"
+
+if is_debug; then set +e; else set -e; fi
+
+step "Desktop environment: XFCE"
+rule
+
+if pkg_installed xfce4-session; then
+    ok "XFCE already installed."
+else
+    info "Installing the XFCE desktop..."
+    install_group_any xfce-desktop xfce-desktop-environment
+    install_optional "@xfce-extra-plugins"
+fi
+
+# XFCE is X11. It needs an X server present even when it is only the session
+# provider for chadwm.
+install_packages xorg-x11-server-Xorg xorg-x11-xinit
+
+# XFCE runs fine under SDDM too — unify on SDDM so every session has one greeter
+if ! pkg_installed sddm; then
+    install_packages sddm
+fi
+switch_display_manager sddm
+
+install_nerd_font JetBrainsMono
+install_packages alacritty dconf
+
+# Point XFCE's terminal preference at alacritty, seeding the config directly so
+# it applies on first login rather than needing a session restart.
+XFCONF_DIR="$HOME/.config/xfce4/xfconf/xfce-perchannel-xml"
+mkdir -p "$XFCONF_DIR"
+info "Seeding XFCE session defaults..."
+cat > "$XFCONF_DIR/xfce4-session.xml" <<'EOF'
+<?xml version="1.0" encoding="UTF-8"?>
+<channel name="xfce4-session" version="1.0">
+  <property name="general" type="empty">
+    <property name="TerminalEmulator" type="string" value="alacritty"/>
+  </property>
+</channel>
+EOF
+
+ok "XFCE setup complete."

modules/twm/chadwm.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/common.sh
+source "$HERE/../../lib/common.sh"
+# shellcheck source=../../lib/session.sh
+source "$HERE/../../lib/session.sh"
+
+if is_debug; then set +e; else set -e; fi
+
+step "Tiling window manager: chadwm"
+rule
+
+# chadwm is an X11 dwm fork and is not packaged for Fedora anywhere. It is
+# built from source. Note this is the only non-Wayland option in the menu.
+info "Installing chadwm build dependencies..."
+install_packages \
+    gcc make git \
+    libX11-devel libXft-devel libXinerama-devel imlib2-devel \
+    dash xsetroot feh picom rofi alacritty \
+    xorg-x11-server-Xorg xorg-x11-xinit
+
+CHAD_DIR="$HOME/.config/chadwm"
+
+if [[ ! -d "$CHAD_DIR/.git" ]]; then
+    info "Cloning chadwm into $CHAD_DIR..."
+    git clone --depth 1 https://github.com/siduck/chadwm "$CHAD_DIR"
+else
+    ok "chadwm source already present at $CHAD_DIR"
+fi
+
+if [[ ! -x /usr/local/bin/chadwm ]]; then
+    info "Building and installing chadwm..."
+    # make install needs root to write /usr/local/bin
+    sudo make -C "$CHAD_DIR/chadwm" install
+else
+    ok "chadwm binary already installed."
+fi
+
+# Session wrapper: dwm forks do not do autostart themselves, so set up the
+# wallpaper/compositor here instead of leaving the user with an empty desktop.
+info "Installing session wrapper /usr/local/bin/chadwm-session..."
+sudo tee /usr/local/bin/chadwm-session >/dev/null <<'EOF'
+#!/bin/bash
+# chadwm session: compositor + wallpaper + status, then hand over to chadwm.
+pgrep -x picom >/dev/null || picom --daemon &
+if [ -d "$HOME/Pictures" ]; then
+    feh --bg-fill "$(find "$HOME/Pictures" -maxdepth 1 -type f \
+        \( -iname '*.jpg' -o -iname '*.png' \) | head -n1)" 2>/dev/null || true
+fi
+xsetroot -cursor_name left_ptr 2>/dev/null || true
+exec chadwm
+EOF
+sudo chmod 755 /usr/local/bin/chadwm-session
+
+write_x11_session chadwm "chadwm" "/usr/local/bin/chadwm-session"
+
+install_nerd_font JetBrainsMono
+
+install_packages sddm
+switch_display_manager sddm
+
+ok "chadwm setup complete. Log out and pick chadwm in SDDM."

modules/twm/hyprland.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/common.sh
+source "$HERE/../../lib/common.sh"
+# shellcheck source=../../lib/session.sh
+source "$HERE/../../lib/session.sh"
+
+if is_debug; then set +e; else set -e; fi
+
+step "Tiling window manager: Hyprland"
+rule
+
+# hyprland was retired from the Fedora repos after F42 (dependency churn), so it
+# comes from a COPR. Which COPR has a fedora-44 chroot changes over time —
+# solopasha (the usual recommendation) was rawhide-only when this was written.
+# Try candidates in order; first one that enables wins. If none works, abort
+# with an actionable message instead of a cryptic "chroot not found".
+if ! pkg_installed hyprland; then
+    enabled=""
+    for copr in lionheartp/Hyprland hermitfeather/hyprland solopasha/hyprland; do
+        info "Enabling copr: $copr..."
+        if sudo dnf copr enable -y "$copr" >/dev/null 2>&1; then
+            enabled="$copr"
+            ok "Copr enabled: $copr"
+            break
+        fi
+        warn "Copr $copr has no chroot for this Fedora release; trying next..."
+    done
+    if [[ -z "$enabled" ]]; then
+        err "None of the Hyprland COPRs have a chroot for Fedora $(rpm -E %fedora)."
+        err "Check https://copr.fedorainfracloud.org/coprs/ for an up-to-date one, or:"
+        err "    sudo dnf copr enable -y <owner>/<project> fedora-rawhide-x86_64   # last resort"
+        exit 1
+    fi
+fi
+
+info "Installing Hyprland and its ecosystem..."
+# COPR package sets differ; treat everything beyond the core compositor as
+# optional so a name drift warns instead of killing the transaction.
+install_packages hyprland xdg-desktop-portal-hyprland alacritty
+install_optional hyprpaper hypridle hyprlock waybar mako wofi xwayland-satellite
+
+install_session_prereqs
+install_nerd_font JetBrainsMono
+
+# The Fedora hyprland package ships hyprland.desktop in wayland-sessions.
+install_packages sddm
+switch_display_manager sddm
+
+ok "Hyprland setup complete. Log out and pick Hyprland in SDDM."

modules/twm/mango.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/common.sh
+source "$HERE/../../lib/common.sh"
+# shellcheck source=../../lib/session.sh
+source "$HERE/../../lib/session.sh"
+
+if is_debug; then set +e; else set -e; fi
+
+step "Tiling window manager: MangoWC"
+rule
+
+# MangoWC is not in the Fedora repos; it is packaged in Terra.
+add_terra_repo
+
+info "Installing MangoWC..."
+if ! sudo dnf install -y mangowc; then
+    err "mangowc is not available from Terra on this release."
+    err "Alternatives: copr dennemann/MangoWC, or build from source:"
+    err "    https://github.com/GravityShark/mangowc"
+    exit 1
+fi
+
+install_packages fuzzel alacritty
+install_optional xdg-desktop-portal-wlr
+install_optional xwayland-satellite
+
+install_session_prereqs
+install_nerd_font JetBrainsMono
+
+# MangoWC's session entry is not guaranteed by the package; write one if absent.
+write_wayland_session mangowc "MangoWC" "mangowc"
+
+install_packages sddm
+switch_display_manager sddm
+
+ok "MangoWC setup complete. Log out and pick MangoWC in SDDM."

modules/twm/niri.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/common.sh
+source "$HERE/../../lib/common.sh"
+# shellcheck source=../../lib/session.sh
+source "$HERE/../../lib/session.sh"
+
+if is_debug; then set +e; else set -e; fi
+
+step "Tiling window manager: Niri"
+rule
+
+# Noctalia is in the Fedora repos since F44 (noctalia 5.3.0 in updates) —
+# no third-party repo needed for this module. (Terra stays in the base
+# section; mangowc still requires it.)
+info "Installing Niri + Noctalia..."
+install_packages niri noctalia fuzzel alacritty
+# niri is Wayland-only; this lets X11 apps run inside it
+install_optional xwayland-satellite
+install_optional xdg-desktop-portal-wlr
+
+install_session_prereqs
+install_nerd_font JetBrainsMono
+
+# niri ships /usr/share/wayland-sessions/niri.desktop itself, so no entry needed.
+install_packages sddm
+switch_display_manager sddm
+
+ok "Niri setup complete. Log out and pick Niri in SDDM."

setup.sh

@@ -1,263 +1,400 @@
 #!/bin/bash
+#
+# setup.sh — unified Fedora configuration
+# Target: bare/minimal Fedora 44 and newer
+#
 set -uo pipefail
 
-#------------------------------------------
-# Color helpers (printf-safe, no tput)
-#------------------------------------------
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[0;33m'
-CYAN='\033[0;36m'
-PURPLE='\033[0;35m'
-BLUE='\033[0;34m'
-GRAY='\033[0;37m'
-BOLD='\033[1m'
-RESET='\033[0m'
-
-# Disable colors if output is not a terminal
-if [ ! -t 1 ]; then
-    RED='' GREEN='' YELLOW='' CYAN='' PURPLE='' BLUE='' GRAY='' BOLD='' RESET=''
-fi
-
-color_yellow() { printf "%b%s%b\n" "$YELLOW" "$*" "$RESET"; }
-color_cyan()   { printf "%b%s%b\n" "$CYAN"   "$*" "$RESET"; }
-color_red()    { printf "%b%s%b\n" "$RED"    "$*" "$RESET"; }
-color_green()  { printf "%b%s%b\n" "$GREEN"  "$*" "$RESET"; }
-color_gray()   { printf "%b%s%b\n" "$GRAY"   "$*" "$RESET"; }
-
-#------------------------------------------
-# Helper functions
-#------------------------------------------
-pause_if_debug() {
-    if [[ "${DEBUG_MODE:-false}" == "true" ]]; then
-        echo
-        color_yellow "----------------------------------------------------------------"
-        read -rp "Section complete. Press [Enter] to continue, or [q] to abort: " debug_choice
-        if [[ "${debug_choice,,}" == "q" ]]; then
-            color_red "Script aborted by user."
-            exit 1
-        fi
-        color_yellow "----------------------------------------------------------------"
-        echo
-    fi
-}
-
-install_packages() { sudo dnf install -y "$@"; }
-is_package_installed() { rpm -q "$@" &>/dev/null; }
-
-remove_packages() {
-    local packages_to_remove=()
-    for pkg in "$@"; do
-        if is_package_installed "$pkg"; then
-            packages_to_remove+=("$pkg")
-        fi
-    done
-
-    if [ ${#packages_to_remove[@]} -gt 0 ]; then
-        color_cyan "Removing packages: ${packages_to_remove[*]}"
-        sudo dnf remove -y "${packages_to_remove[@]}"
-    fi
-}
-
-
-#------------------------------------------
-# 0 STARTING the script
-#------------------------------------------
-
-#------------------------------------------
-# Script Version 1.0
-#------------------------------------------
-clear # Wipe the terminal history view cleanly for the main menu execution
-
-if [[ "$DEBUG_MODE" == "true" ]]; then
-    color_red "!!! DEBUG MODE ENABLED !!!"
-    color_red "The script will pause after each major section."
-    echo
-fi
-
-echo
-color_yellow "----------------------------------------------------------------"
-color_yellow "Script version 1.0"
-color_yellow "----------------------------------------------------------------"
-echo
-
-#------------------------------------------
-# OS Detection
-#------------------------------------------
-echo
-color_yellow "----------------------------------------------------------------"
-color_yellow "Start OS Detection"
-color_yellow "----------------------------------------------------------------"
-echo
-
-source /etc/os-release
-
-OS_ID="${ID,,}"
-OS_LIKE="${ID_LIKE:-}"
-OS_LIKE="${OS_LIKE,,}"
-OS_VERSION="${VERSION_ID:-unknown}"
-OS_PRETTY="$PRETTY_NAME"
-OS=""
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "$SCRIPT_DIR/lib/common.sh"
+# shellcheck source=lib/session.sh
+source "$SCRIPT_DIR/lib/session.sh"
 
-case "$OS_ID" in
+#------------------------------------------
-    fedora) OS="fedora" ;;
+# Defaults + argument parsing
+#   DEBUG_MODE must be initialised before anything reads it under set -u.
+#------------------------------------------
+DEBUG_MODE=false
+ASSUME_YES=false
+DE=""
+TWM=""
+SELINUX_OPT=""
+SNAPPER_OPT=""
+
+usage() {
+    cat <<'EOF'
+setup.sh — unified Fedora configuration (Fedora 44+)
+
+Usage:
+  ./setup.sh                              interactive: pick a DE and a TWM
+  ./setup.sh --de=none --twm=niri         non-interactive, explicit choices
+  ./setup.sh --debug                      pause after each section
+
+Options:
+  --de=NAME     gnome | plasma | xfce | none
+  --twm=NAME    chadwm | hyprland | mango | niri | none
+  --selinux=X   keep | disabled   (asked, default keep)
+  --snapper=X   yes | no          (asked when / is btrfs, default yes)
+  -y, --yes     never prompt (requires --de and --twm)
+  -d, --debug   pause after each section instead of aborting on error
+  -h, --help    show this help
+
+Valid DE/TWM combinations:
+  any DE + any TWM   DE provides the session, TWM is added alongside it
+  none    + any TWM  TWM-only machine, SDDM is installed as the greeter
+  any DE  + none     plain desktop, no tiling window manager
+  none    + none     refused: that is not a graphical system
+
+Notes:
+  * chadwm is an X11 window manager; the other three are Wayland compositors.
+  * Run as your normal user, not root. sudo is used where needed.
+EOF
+}
+
+for arg in "$@"; do
+    case "$arg" in
+        -d|--debug) DEBUG_MODE=true ;;
+        -y|--yes)   ASSUME_YES=true ;;
+        --de=*)     DE="${arg#*=}" ;;
+        --selinux=*) SELINUX_OPT="${arg#*=}" ;;
+        --snapper=*) SNAPPER_OPT="${arg#*=}" ;;
+        --twm=*)    TWM="${arg#*=}" ;;
+        -h|--help)  usage; exit 0 ;;
         *)
-        if [[ "$OS_LIKE" == *"fedora"* || "$OS_LIKE" == *"rhel"* ]]; then
+            err "Unknown argument: $arg"
-            OS="fedora"
+            printf "\n"
-        fi
+            usage
+            exit 2
             ;;
     esac
+done
+export DEBUG_MODE ASSUME_YES
 
-if [[ -n "$OS" ]]; then
+if is_debug; then
-    color_cyan "----------------------------------------------------------------"
+    set +e   # walk through failures instead of dying on the first one
-    color_cyan "Detected OS: $OS_PRETTY"
-    color_cyan "Version: $OS_VERSION"
-    color_cyan "----------------------------------------------------------------"
 else
-    color_red "----------------------------------------------------------------"
+    set -e
-    color_red "ERROR: Unsupported or unknown Linux distribution."
+fi
-    color_red "Detected: ID=$OS_ID ID_LIKE=${OS_LIKE:-empty}"
+
-    color_red "----------------------------------------------------------------"
+#------------------------------------------
+# Preconditions
+#------------------------------------------
+# clear can fail without TERM (cron, piped install, ssh without a tty) and would
+# abort the whole run under set -e.
+clear 2>/dev/null || true
+
+printf "\n"
+color_yellow "----------------------------------------------------------------"
+color_yellow "Fedora unified configuration"
+color_yellow "----------------------------------------------------------------"
+
+if [[ ${EUID} -eq 0 ]]; then
+    err "Do not run this as root. Run it as your user; it calls sudo itself."
     exit 1
 fi
 
+if [[ "$ASSUME_YES" == "true" && ( -z "$DE" || -z "$TWM" ) ]]; then
+    err "--yes requires explicit --de and --twm, so nothing is guessed on an"
+    err "unattended run. Example:"
+    err "    ./setup.sh --yes --de=none --twm=niri"
+    exit 2
+fi
+
+if is_debug; then
+    color_red "!!! DEBUG MODE ENABLED !!!"
+    color_red "The script will pause after each section."
+fi
+
+#------------------------------------------
+# OS gate — Fedora only, 44+
+#------------------------------------------
+step "OS detection"
+rule
+
+# Overridable so the script can be tested on a non-Fedora host.
+OS_RELEASE_FILE="${OS_RELEASE_FILE:-/etc/os-release}"
+# shellcheck source=/dev/null
+source "$OS_RELEASE_FILE"
+
+OS_ID="${ID:-unknown}"; OS_ID="${OS_ID,,}"
+OS_PRETTY="${PRETTY_NAME:-unknown}"
+
+if [[ "$OS_ID" != "fedora" ]]; then
+    err "Unsupported distribution: $OS_PRETTY (ID=${OS_ID})"
+    err "This repo targets Fedora only. RHEL clones are refused on purpose:"
+    err "they ship no dnf5 config-manager and no RPM Fusion, so both the base"
+    err "setup and every module would fail half-way."
+    exit 1
+fi
+
+FEDORA_REL=$(rpm -E %fedora)
+if [[ "$FEDORA_REL" =~ ^[0-9]+$ ]] && (( FEDORA_REL < 44 )); then
+    err "$OS_PRETTY reports release ${FEDORA_REL}, but this setup targets Fedora 44+."
+    exit 1
+fi
+
+ok "Detected: $OS_PRETTY (release ${FEDORA_REL})"
 pause_if_debug
 
 #------------------------------------------
-# 1 Basic Settings
+# 1 Base settings
 #------------------------------------------
-echo
+step "1 Base settings"
-color_yellow "----------------------------------------------------------------"
+rule
-color_yellow "1 Basic Settings"
-color_yellow "----------------------------------------------------------------"
-echo
 
-#------------------------------------------
-# 1.1 Ensure base is ready for installation
-#------------------------------------------
 if ! command -v curl >/dev/null 2>&1; then
-    color_yellow "curl is not installed. Installing..."
+    info "curl missing. Installing..."
     install_packages curl
 fi
 
-pause_if_debug
+# config-manager lives in dnf5-plugins; every repo step below depends on it.
+if ! dnf config-manager --help >/dev/null 2>&1; then
+    info "dnf config-manager missing. Installing dnf5-plugins..."
+    install_packages dnf5-plugins
+fi
 
-#------------------------------------------
+info "Tuning DNF..."
-# 1.2 Update and Enable Repos + Flatpak
-#------------------------------------------
-color_cyan "Optimizing DNF for speed..."
-
-# 1. Increase parallel downloads (allows downloading multiple packages at once)
-# 2. Set dnf to set YES as default instead of NO
 sudo dnf config-manager setopt max_parallel_downloads=20
 sudo dnf config-manager setopt defaultyes=True
 
-color_green "DNF optimized. Refreshing metadata..."
+info "Refreshing metadata..."
 sudo dnf makecache --refresh
 
-color_cyan "Enabling RPM Fusion repositories for Fedora $(rpm -E %fedora)..."
+add_rpmfusion_repo
+# Terra up front: it carries mangowc (noctalia moved into Fedora proper in
+# F44). Idempotent; also kept for the standalone-mango-module case.
+add_terra_repo
+pause_if_debug
 
-# Define the version variable for readability
+if ! command -v flatpak >/dev/null 2>&1; then
-FEDORA_VER=$(rpm -E %fedora)
+    info "Flatpak missing. Installing..."
-
+    install_packages flatpak
-color_yellow "Checking for updates and sources..."
-sudo dnf check-update || true
-
-# Check if flatpak is installed, if not, install it
-if ! command -v flatpak &> /dev/null; then
-    color_yellow "Flatpak not found. Installing..."
-    sudo dnf install -y flatpak
 fi
+info "Ensuring Flathub is available (system-wide)..."
+sudo flatpak remote-add --if-not-exists --system flathub https://dl.flathub.org/repo/flathub.flatpakrepo
 
-color_cyan "Enabling Flathub..."
+info "Updating the system..."
-# Using --if-not-exists is good practice to prevent errors on re-runs
-sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
-
-sudo dnf install -y \
-    "https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-${FEDORA_VER}.noarch.rpm" \
-    "https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-${FEDORA_VER}.noarch.rpm"
-
-color_cyan "Enabling full Flathub support..."
-flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
-
-# Update the system
-color_gray "Updating the system"
-echohttps://git.ku-it.org/terrabeam/starburst.git
 sudo dnf update -y
-
 pause_if_debug
 
 #------------------------------------------
-# Tiling Window Manager Selection
+# 2 Menu helpers
 #------------------------------------------
-echo
+# $1 = prompt, $2 = default answer, rest = valid answers
-color_yellow "----------------------------------------------------------------"
+ask_choice() {
-color_yellow "Tiling WM Selection"
+    local prompt="$1" default="$2"; shift 2
-color_yellow "----------------------------------------------------------------"
+    local answer
-echo
+    if [[ "$ASSUME_YES" == "true" ]]; then
-
+        echo "$default"
+        return 0
+    fi
     while true; do
-    echo
+        if ! read -t 60 -rp "$prompt (default: $default): " answer; then
-    color_gray "Select a tiling window manager:"
+            printf "\n"
-    echo
+            answer=""
-    echo "  1) CHADWM"
+        fi
-    echo "  2) Hyprland"
+        answer="${answer:-$default}"
-    echo "  3) MangoWC"
+        answer="${answer,,}"
-    echo "  4) Niri"
+        local v
-    echo "  x) None (default)"
+        for v in "$@"; do
-    if ! read -t 15 -rp "Enter choice [1/2/3/4/x] (default: x): " choice; then
+            if [[ "$answer" == "$v" ]]; then
-        choice="x"
+                echo "$answer"
+                return 0
             fi
-
-    case "${choice,,}" in
-        1) TWM="chadwm"; break ;;
-        2) TWM="hyprland"; break ;;
-        3) TWM="mango"; break ;;
-        4) TWM="niri"; break ;;
-        x|"") TWM="none"; break ;;
-        *) echo "Invalid option. Please enter 1, 2, 3, 4 or x." ;;
-    esac
         done
+        err "Invalid option: '$answer'. Choose from: $*"
+    done
+}
 
-echo
+# Ask a yes/no question; $2 is the default (yes|no). Honours --yes.
-color_cyan "----------------------------------------------------------------"
+ask_yes_no() {
-color_cyan "Selected Tiling WM: $TWM"
+    local prompt="$1" default="$2" answer
-color_cyan "----------------------------------------------------------------"
+    if [[ "$ASSUME_YES" == "true" ]]; then
+        echo "$default"
+        return 0
+    fi
+    while true; do
+        read -t 60 -rp "$prompt [y/n] (default: $default): " answer || printf "\n"
+        answer="${answer,,}"
+        [[ -z "$answer" ]] && answer="$default"
+        case "$answer" in
+            y|yes) echo "yes"; return 0 ;;
+            n|no)  echo "no";  return 0 ;;
+        esac
+        err "Please answer y or n."
+    done
+}
 
+#------------------------------------------
+# 3 System settings
+#------------------------------------------
+SELINUX_DISABLED=false
+BTRFS_SNAPPER=false
+
+if [[ -z "$SELINUX_OPT" ]]; then
+    step "3 System settings"
+    rule
+    printf "\n"
+    printf "\n"
+    choice=$(ask_yes_no "Disable SELinux permanently? (not recommended)" "no")
+    [[ "$choice" == "yes" ]] && SELINUX_DISABLED=true
+    printf "\n"
+    if findmnt -n -o FSTYPE / 2>/dev/null | grep -q btrfs; then
+        ok "Root filesystem is btrfs — snapshot support is available."
+        choice=$(ask_yes_no "Set up snapper + grub-btrfs snapshots and zstd compression?" "yes")
+        [[ "$choice" == "yes" ]] && BTRFS_SNAPPER=true
+    else
+        info "Root filesystem is not btrfs; skipping snapshot setup."
+    fi
+fi
+
+case "${SELINUX_OPT:-}" in
+    disabled) SELINUX_DISABLED=true ;;
+    keep|"")  : ;;
+    *) err "Unknown --selinux value: '$SELINUX_OPT' (keep|disabled)"; exit 2 ;;
+esac
+case "${SNAPPER_OPT:-}" in
+    yes)   BTRFS_SNAPPER=true ;;
+    no|"") : ;;
+    *) err "Unknown --snapper value: '$SNAPPER_OPT' (yes|no)"; exit 2 ;;
+esac
 pause_if_debug
 
 #------------------------------------------
-# 5. Tiling Window Manager installation
+# 4 Desktop environment selection
 #------------------------------------------
-case "$TWM" in
+if [[ -z "$DE" ]]; then
-    chadwm|hyprland|mango|niri)
+    step "3 Desktop environment"
-        color_yellow "Installing $TWM"
+    rule
-        SCRIPT_NAME="$SCRIPT_DIR/${TWM}.sh"
+    printf "\n"
-        if [[ -f "$SCRIPT_NAME" ]]; then
+    color_gray "  This system is treated as a bare Fedora install — picking a DE"
-            color_cyan "Running $SCRIPT_NAME"
+    color_gray "  here is what gives you a graphical login."
-            source "$SCRIPT_NAME"
+    printf "\n"
-        else
+    echo "  1) GNOME     (gdm)"
-            color_red "Error: $SCRIPT_NAME not found!"
+    echo "  2) Plasma    (sddm)"
-            exit 1
+    echo "  3) XFCE      (sddm)"
+    echo "  4) None      (TWM only — SDDM will be installed by the TWM module)"
+    printf "\n"
+    choice=$(ask_choice "Select desktop environment [1/2/3/4]" "4" 1 2 3 4)
+    case "$choice" in
+        1) DE="gnome" ;;
+        2) DE="plasma" ;;
+        3) DE="xfce" ;;
+        4) DE="none" ;;
+    esac
 fi
-        ;;
+
-    none)
+case "$DE" in
-        color_gray "No tiling window manager selected, skipping TWM installation."
+    gnome|plasma|xfce|none) ;;
-        ;;
+    *) err "Unknown --de value: '$DE' (gnome|plasma|xfce|none)"; exit 2 ;;
+esac
+pause_if_debug
+
+#------------------------------------------
+# 5 Tiling window manager selection
+#------------------------------------------
+if [[ -z "$TWM" ]]; then
+    step "5 Tiling window manager"
+    rule
+    printf "\n"
+    echo "  1) Niri       (Wayland, scrollable)"
+    echo "  2) Hyprland   (Wayland, dynamic)"
+    echo "  3) MangoWC    (Wayland, dwl-based, Terra repo)"
+    echo "  4) chadwm     (X11, dwm fork, built from source)"
+    echo "  5) None"
+    printf "\n"
+    choice=$(ask_choice "Select tiling window manager [1/2/3/4/5]" "5" 1 2 3 4 5)
+    case "$choice" in
+        1) TWM="niri" ;;
+        2) TWM="hyprland" ;;
+        3) TWM="mango" ;;
+        4) TWM="chadwm" ;;
+        5) TWM="none" ;;
+    esac
+fi
+
+case "$TWM" in
+    niri|hyprland|mango|chadwm|none) ;;
+    *) err "Unknown --twm value: '$TWM' (niri|hyprland|mango|chadwm|none)"; exit 2 ;;
 esac
 
+ok "Selection: DE=${DE} TWM=${TWM}"
+
+# A bare install with neither is not a graphical system. Refuse rather than
+# leave the user with a machine that boots to a black screen.
+if [[ "$DE" == "none" && "$TWM" == "none" ]]; then
+    err "DE=none with TWM=none would leave no graphical session at all."
+    err "Pick a desktop environment, a tiling window manager, or both."
+    exit 2
+fi
 pause_if_debug
 
-echo
+#------------------------------------------
-color_yellow "----------------------------------------------------------------"
+# 5 Dispatch
-color_yellow "End Detection"
+#------------------------------------------
-color_yellow "----------------------------------------------------------------"
+export DE TWM
 
-color_green "Fedora setup complete."
+run_module() {
-color_red "The installation has finished. A reboot is recommended."
+    local path="$1"
-# Reboots are dangerous to automate; we use a shorter timeout and default to No
+    if [[ ! -f "$path" ]]; then
-if read -t 10 -rp "Reboot now? [y/N]: " reboot_choice; then
+        err "Module not found: $path"
+        return 1
+    fi
+    info "Running $(basename "$path")"
+    printf "\n"
+    # Separate process: a module's own shell options and exit codes stay its own.
+    bash "$path"
+}
+
+step "5 Installation"
+rule
+
+if [[ "$SELINUX_DISABLED" == "true" ]]; then
+    disable_selinux
+    pause_if_debug
+fi
+
+if [[ "$BTRFS_SNAPPER" == "true" ]]; then
+    ensure_btrfs_compression
+    setup_snapper
+    pause_if_debug
+fi
+
+if [[ "$DE" != "none" ]]; then
+    run_module "$SCRIPT_DIR/modules/de/${DE}.sh"
+    pause_if_debug
+fi
+
+if [[ "$TWM" != "none" ]]; then
+    run_module "$SCRIPT_DIR/modules/twm/${TWM}.sh"
+    pause_if_debug
+fi
+
+#------------------------------------------
+# 6 Done
+#------------------------------------------
+step "7 Summary"
+rule
+ok "DE:  $DE"
+ok "TWM: $TWM"
+ok "SELinux: $([[ "$SELINUX_DISABLED" == "true" ]] && echo disabled || echo keeping)"; ok "Btrfs snapshots: $([[ "$BTRFS_SNAPPER" == "true" ]] && echo yes || echo skipped)"
+DM=$(detect_display_manager)
+ok "Display manager: ${DM:-none}"
+
+if [[ -z "$DM" ]]; then
+    warn "No display manager is active. You will boot to a text console."
+    warn "Install one, or run a TWM module which sets up SDDM."
+fi
+
+printf "\n"
+color_green "Fedora setup complete. A reboot is recommended."
+if [[ "$ASSUME_YES" == "true" ]]; then
+    info "Unattended run: not rebooting."
+    exit 0
+fi
+
+if read -t 15 -rp "Reboot now? [y/N]: " reboot_choice; then
     case "${reboot_choice,,}" in
         y|yes)
             color_red "Rebooting now."