single playbook for mediapis

roles/pi_modern_shell_env/tasks/main.yml

@@ -17,17 +17,17 @@
     dest: /usr/local/bin/bat
     state: link
 
-- name: Download oh-my-posh install script
+- name: Download oh-my-posh binary
   ansible.builtin.get_url:
-    url: "{{ pi_modern_shell_env_ohmyposh_install_url }}"
-    dest: /tmp/ohmyposh-install.sh
+    # The official install script's own curl-based downloads are blocked by
+    # oh-my-posh's CDN on some devices (observed on Raspberry Pi OS's curl
+    # build: TLS handshake fails with SSL_ERROR_SYSCALL), while Ansible's
+    # get_url (Python urllib) succeeds against the same CDN. Download the
+    # binary directly instead of shelling out to the install script.
+    url: "https://cdn.ohmyposh.dev/releases/latest/posh-linux-{{ pi_modern_shell_env_ohmyposh_arch_map[ansible_architecture] }}"
+    dest: /usr/local/bin/oh-my-posh
     mode: "0755"
 
-- name: Run oh-my-posh install script
-  ansible.builtin.command:
-    cmd: /tmp/ohmyposh-install.sh -d /usr/local/bin
-    creates: /usr/local/bin/oh-my-posh
-
 - name: Determine target user's home directory
   ansible.builtin.set_fact:
     pi_modern_shell_env_target_home: "{{ '/root' if pi_modern_shell_env_target_user == 'root' else '/home/' + pi_modern_shell_env_target_user }}"