single playbook for mediapis

roles/pi_modern_shell_env/defaults/main.yml

@@ -12,9 +12,14 @@ pi_modern_shell_env_packages:
   - tmux
   - curl
 
-# oh-my-posh isn't packaged in apt; installed via the official script
-# instead, matching the prompt used in ~/nixconfig's home-manager setup.
-pi_modern_shell_env_ohmyposh_install_url: https://ohmyposh.dev/install.sh
+# oh-my-posh isn't packaged in apt; the binary is fetched directly from its
+# CDN instead (see tasks/main.yml for why we don't use the official install
+# script), matching the prompt used in ~/nixconfig's home-manager setup.
+pi_modern_shell_env_ohmyposh_arch_map:
+  x86_64: amd64
+  aarch64: arm64
+  armv6l: arm
+  armv7l: arm
 
 pi_modern_shell_env_target_user: "{{ main_user | default('root') }}"
 

roles/pi_modern_shell_env/tasks/main.yml

@@ -17,17 +17,17 @@
     dest: /usr/local/bin/bat
     state: link
 
-- name: Download oh-my-posh install script
+- name: Download oh-my-posh binary
   ansible.builtin.get_url:
-    url: "{{ pi_modern_shell_env_ohmyposh_install_url }}"
-    dest: /tmp/ohmyposh-install.sh
+    # The official install script's own curl-based downloads are blocked by
+    # oh-my-posh's CDN on some devices (observed on Raspberry Pi OS's curl
+    # build: TLS handshake fails with SSL_ERROR_SYSCALL), while Ansible's
+    # get_url (Python urllib) succeeds against the same CDN. Download the
+    # binary directly instead of shelling out to the install script.
+    url: "https://cdn.ohmyposh.dev/releases/latest/posh-linux-{{ pi_modern_shell_env_ohmyposh_arch_map[ansible_architecture] }}"
+    dest: /usr/local/bin/oh-my-posh
     mode: "0755"
 
-- name: Run oh-my-posh install script
-  ansible.builtin.command:
-    cmd: /tmp/ohmyposh-install.sh -d /usr/local/bin
-    creates: /usr/local/bin/oh-my-posh
-
 - name: Determine target user's home directory
   ansible.builtin.set_fact:
     pi_modern_shell_env_target_home: "{{ '/root' if pi_modern_shell_env_target_user == 'root' else '/home/' + pi_modern_shell_env_target_user }}"