feat: +thin-client role + AZ-TC-01..03 pilot
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
This commit is contained in:
m3ta-chiron
@@ -0,0 +1,42 @@
|
||||
# roles/thin-client/apps/autostart.nix
|
||||
#
|
||||
# KDE autostart for Outlook + Teams at login.
|
||||
# Q11 decision: "Outlook + Teams beim Login".
|
||||
#
|
||||
# Implemented as system-wide .desktop files in
|
||||
# /etc/xdg/autostart/ — KDE's Plasma session picks them up automatically
|
||||
# for every user.
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
|
||||
mkAutostart = name: url: let
|
||||
filename = builtins.replaceStrings [" "] ["-"] (lib.toLower name);
|
||||
in
|
||||
pkgs.writeTextFile {
|
||||
name = "${filename}-autostart.desktop";
|
||||
destination = "/etc/xdg/autostart/${filename}-autostart.desktop";
|
||||
text = ''
|
||||
[Desktop Entry]
|
||||
Type=Application
|
||||
Name=${name} (Auto-Start)
|
||||
Exec=${pkgs.chromium}/bin/chromium --app=${url} --no-default-browser-check --no-first-run
|
||||
Icon=web-browser
|
||||
Terminal=false
|
||||
X-KDE-autostart-after=panel
|
||||
X-KDE-autostart-phase=2
|
||||
X-GNOME-Autostart-enabled=true
|
||||
'';
|
||||
};
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
environment.etc = {
|
||||
"xdg/autostart/outlook-autostart.desktop".source =
|
||||
(mkAutostart "Outlook" "https://outlook.office.com")
|
||||
+ "/etc/xdg/autostart/outlook-autostart.desktop";
|
||||
"xdg/autostart/teams-autostart.desktop".source =
|
||||
(mkAutostart "Teams" "https://teams.microsoft.com")
|
||||
+ "/etc/xdg/autostart/teams-autostart.desktop";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,119 @@
|
||||
# roles/thin-client/apps/chromium.nix
|
||||
#
|
||||
# Chromium enterprise policy.
|
||||
# Q12 decisions: ManagedBookmarks, SyncDisabled, uBlock Origin + Allowlist,
|
||||
# PasswordManagerEnabled=false, Bitwarden Extension force-install.
|
||||
#
|
||||
# Policy file path on NixOS: /etc/chromium/policies/managed/*.json
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf mkOption types;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
options.az.tc.chromium = {
|
||||
homepage = mkOption {
|
||||
type = types.str;
|
||||
default = "https://www.office.com"; # TODO: real homepage
|
||||
description = "Chromium startup URL.";
|
||||
};
|
||||
|
||||
bookmarks = mkOption {
|
||||
type = types.listOf (types.submodule {
|
||||
options = {
|
||||
name = mkOption {type = types.str;};
|
||||
url = mkOption {type = types.str;};
|
||||
};
|
||||
});
|
||||
default = [
|
||||
{name = "Outlook Web"; url = "https://outlook.office.com";}
|
||||
{name = "Teams Web"; url = "https://teams.microsoft.com";}
|
||||
{name = "SharePoint"; url = "https://azgroup.sharepoint.com";}
|
||||
{name = "Office Home"; url = "https://www.office.com";}
|
||||
# TODO: Intranet, Helpdesk, ERP, HR — fill real URLs
|
||||
];
|
||||
description = "Managed bookmarks (cannot be deleted by user).";
|
||||
};
|
||||
|
||||
bitwardenServerUrl = mkOption {
|
||||
type = types.str;
|
||||
default = "https://vault.bitwarden.com"; # cloud default; override for self-hosted
|
||||
description = ''
|
||||
Bitwarden server URL (cloud or self-hosted). Pushed via Chromium
|
||||
extension settings.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
programs.chromium = {
|
||||
enable = true;
|
||||
extraOpts = {
|
||||
# Bookmarks
|
||||
ManagedBookmarks = [
|
||||
{cn = "AZ Corporate Bookmarks"; children = config.az.tc.chromium.bookmarks;}
|
||||
];
|
||||
|
||||
# Homepage
|
||||
HomepageLocation = config.az.tc.chromium.homepage;
|
||||
RestoreOnStartup = 4; # always restore homepage
|
||||
StartupUrls = [config.az.tc.chromium.homepage];
|
||||
|
||||
# Sync disabled (Q12)
|
||||
SyncDisabled = true;
|
||||
BrowserSignin = 0; # no Google account sign-in
|
||||
RestrictSigninToPattern = ".*@az-group\\.local";
|
||||
|
||||
# Password manager disabled (Q12)
|
||||
PasswordManagerEnabled = false;
|
||||
|
||||
# Autofill
|
||||
AutofillAddressEnabled = true;
|
||||
AutofillCreditCardEnabled = false;
|
||||
|
||||
# Background mode (Chromium keeps running in background)
|
||||
BackgroundModeEnabled = false;
|
||||
|
||||
# Extensions: force-install uBlock Origin + Bitwarden
|
||||
ExtensionInstallForcelist = [
|
||||
# uBlock Origin
|
||||
"cjpalhdlnbpafiamejdnhcphjbkeiagm"
|
||||
# Bitwarden Password Manager
|
||||
"nngceckbapebfimnlniiiahkandclblb"
|
||||
];
|
||||
ExtensionInstallAllowlist = [
|
||||
"cjpalhdlnbpafiamejdnhcphjbkeiagm" # uBlock Origin
|
||||
"nngceckbapebfimnlniiiahkandclblb" # Bitwarden
|
||||
];
|
||||
ExtensionInstallBlocklist = ["*"]; # block everything not in allowlist
|
||||
|
||||
# Bitwarden configuration via extension policy
|
||||
"3rdparty" = {
|
||||
"extensions" = {
|
||||
"nngceckbapebfimnlniiiahkandclblb" = {
|
||||
environment = {
|
||||
base = config.az.tc.chromium.bitwardenServerUrl;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Disable telemetry
|
||||
UrlKeyedAnonymizedDataCollectionEnabled = false;
|
||||
SafeBrowsingEnabled = true;
|
||||
|
||||
# Default browser check
|
||||
DefaultBrowserSettingEnabled = true;
|
||||
|
||||
# PDF / plugins / popups
|
||||
AlwaysOpenPdfExternally = false;
|
||||
BlockThirdPartyCookies = true;
|
||||
|
||||
# Pinch-to-zoom, etc.
|
||||
TouchEnabled = false;
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
chromium
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
# roles/thin-client/apps/default.nix
|
||||
#
|
||||
# All user-facing applications: Chromium, Office-Web shortcuts, Remmina
|
||||
# (RDP), RustDesk, OBS, and login-autostart for Outlook + Teams.
|
||||
{config, lib, ...}: {
|
||||
imports = [
|
||||
./chromium.nix
|
||||
./office-web.nix
|
||||
./remmina.nix
|
||||
./rustdesk.nix
|
||||
./obs.nix
|
||||
./autostart.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
# roles/thin-client/apps/obs.nix
|
||||
#
|
||||
# OBS Studio for Schulungs-Recording. Pre-configured profile with
|
||||
# PipeWire screen capture + Mic + System-Audio, Output to ~/Videos/OBS/.
|
||||
# Q14 decisions: Use Case Schulungs-Recording, Pre-configuriertes Profil,
|
||||
# Output local, no streaming.
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
environment = {
|
||||
systemPackages = with pkgs; [
|
||||
obs-studio
|
||||
obs-studio-plugins.obs-pipewire-audio-capture
|
||||
obs-studio-plugins.wlrobs
|
||||
];
|
||||
|
||||
etc = {
|
||||
# System-wide OBS profile "AZ-Default".
|
||||
# Installed to /etc/obs/az-default/ and copied to user profile on
|
||||
# first run.
|
||||
"obs/az-default/basic.ini".text = ''
|
||||
[General]
|
||||
Name=AZ-Default
|
||||
|
||||
[Output]
|
||||
Mode=Simple
|
||||
FilenameFormatting=%CCYY-%MM-%DD %hh-%mm-%ss
|
||||
DelayEnable=false
|
||||
DelaySec=20
|
||||
DelayPreserve=false
|
||||
ReplayWhileRecording=false
|
||||
ReplayBufferEnable=false
|
||||
|
||||
[SimpleOutput]
|
||||
FilePath=/home/%/Videos/OBS/
|
||||
RecFormat=mp4
|
||||
VEncoder=x264
|
||||
VBitrate=6000
|
||||
AEncoder=aac
|
||||
ABitrate=192
|
||||
|
||||
[Audio]
|
||||
SampleRate=48000
|
||||
ChannelSetup=stereo
|
||||
|
||||
[Video]
|
||||
Base=1920x1080
|
||||
Output=1920x1080
|
||||
FPSType=0
|
||||
FPSCommon=30
|
||||
|
||||
[AdvOut]
|
||||
ApplyServiceSettings=true
|
||||
RescaleRes=1920x1080
|
||||
'';
|
||||
|
||||
# Pre-configured scene collection with PipeWire screen capture.
|
||||
"obs/az-default/scenes.json".text = ''
|
||||
{
|
||||
"sources": [
|
||||
{
|
||||
"name": "Bildschirm (PipeWire)",
|
||||
"id": "pipewire-screen-capture-source",
|
||||
"type": "input"
|
||||
},
|
||||
{
|
||||
"name": "Mikrofon",
|
||||
"id": "pulse_input_capture",
|
||||
"type": "input"
|
||||
},
|
||||
{
|
||||
"name": "System-Audio",
|
||||
"id": "pulse_output_capture",
|
||||
"type": "input"
|
||||
}
|
||||
],
|
||||
"scene": "AZ-Default"
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
# roles/thin-client/apps/office-web.nix
|
||||
#
|
||||
# Office 365 (cloud) web apps as Chromium app-mode .desktop files.
|
||||
# Q11 decisions: Word, Excel, PowerPoint, Outlook, Teams via
|
||||
# `chromium --app=<URL>`, system-wide, Outlook+Teams autostart at login.
|
||||
#
|
||||
# The .desktop files are installed system-wide via
|
||||
# environment.systemPackages, so every user sees them in the KDE menu
|
||||
# under "Office".
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
|
||||
# Helper: builds a Chromium app-mode .desktop file.
|
||||
mkOfficeWebDesktop = name: url: comment:
|
||||
pkgs.writeTextFile {
|
||||
name = builtins.replaceStrings [" "] ["-"] (lib.toLower name) + ".desktop";
|
||||
destination = "/share/applications/${builtins.replaceStrings [" "] ["-"] (lib.toLower name)}.desktop";
|
||||
text = ''
|
||||
[Desktop Entry]
|
||||
Version=1.0
|
||||
Type=Application
|
||||
Name=${name}
|
||||
GenericName=${name} (Web)
|
||||
Comment=${comment}
|
||||
Exec=${pkgs.chromium}/bin/chromium --app=${url} --no-default-browser-check --no-first-run
|
||||
Icon=web-browser
|
||||
Terminal=false
|
||||
Categories=Office;Network;WebApps;
|
||||
Keywords=office;${lib.toLower name};web;
|
||||
StartupNotify=true
|
||||
StartupWMClass=${url}
|
||||
'';
|
||||
};
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [
|
||||
(mkOfficeWebDesktop "Word" "https://www.office.com/launch/word" "Microsoft Word Online")
|
||||
(mkOfficeWebDesktop "Excel" "https://www.office.com/launch/excel" "Microsoft Excel Online")
|
||||
(mkOfficeWebDesktop "PowerPoint" "https://www.office.com/launch/powerpoint" "Microsoft PowerPoint Online")
|
||||
(mkOfficeWebDesktop "Outlook" "https://outlook.office.com" "Microsoft Outlook Web")
|
||||
(mkOfficeWebDesktop "Teams" "https://teams.microsoft.com" "Microsoft Teams Web")
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
# roles/thin-client/apps/remmina.nix
|
||||
#
|
||||
# Remmina RDP client with system-wide connection profiles.
|
||||
# Q10 decisions: System-wide /etc/remmina/, Kerberos SSO, several TS,
|
||||
# Fullscreen+Multi-Monitor, only Audio local redirection.
|
||||
#
|
||||
# Note on "Several TS": we ship a small placeholder list with one example.
|
||||
# Add real TS endpoints in az.tc.rdp.servers below.
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf mkOption types;
|
||||
cfg = config.az.tc;
|
||||
|
||||
# Helper: builds a .remmina profile for one TS
|
||||
mkRemminaProfile = server: let
|
||||
name = server.name;
|
||||
fqdn = server.fqdn;
|
||||
in
|
||||
pkgs.writeTextFile {
|
||||
name = "${lib.toLower name}.remmina";
|
||||
destination = "/etc/remmina/${lib.toLower name}.remmina";
|
||||
text = ''
|
||||
[remmina]
|
||||
name=${name}
|
||||
protocol=RDP
|
||||
server=${fqdn}
|
||||
username=
|
||||
domain=AZ-GROUP
|
||||
security=
|
||||
colordepth=32
|
||||
resolution=multimonitor
|
||||
viewmode=2
|
||||
fullscreen=1
|
||||
multimon=1
|
||||
audio-mode=1
|
||||
audiocapture=0
|
||||
clipboard=both
|
||||
quality=2
|
||||
kerberos=1
|
||||
enable-authecol=kerberos
|
||||
disableclipboard=0
|
||||
redirectsound=1
|
||||
redirectprinter=0
|
||||
redirectdrive=0
|
||||
redirectusb=0
|
||||
keyboard-grab=1
|
||||
showcursor=1
|
||||
'';
|
||||
};
|
||||
in {
|
||||
options.az.tc.rdp = {
|
||||
servers = mkOption {
|
||||
type = types.listOf (types.submodule {
|
||||
options = {
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
description = "Display name (e.g. 'TS Berlin', 'TS ERP').";
|
||||
};
|
||||
fqdn = mkOption {
|
||||
type = types.str;
|
||||
description = "FQDN of the TS endpoint (e.g. 'ts-berlin.az-group.local').";
|
||||
};
|
||||
};
|
||||
});
|
||||
default = [
|
||||
# TODO: fill real TS endpoints
|
||||
{
|
||||
name = "TS Berlin";
|
||||
fqdn = "ts-berlin.az-group.local";
|
||||
}
|
||||
];
|
||||
description = ''
|
||||
List of Terminal Server endpoints. One Remmina profile per entry
|
||||
is generated system-wide.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [
|
||||
remmina
|
||||
freerdp3
|
||||
];
|
||||
|
||||
# System-wide Remmina profiles
|
||||
environment.etc = builtins.listToAttrs (builtins.map (server: {
|
||||
name = "remmina/${lib.toLower server.name}.remmina";
|
||||
value.source = (mkRemminaProfile server) + "/etc/remmina/${lib.toLower server.name}.remmina";
|
||||
})
|
||||
config.az.tc.rdp.servers);
|
||||
|
||||
# Allow Domain Users to read the system-wide profiles
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /etc/remmina 0755 root root -"
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
# roles/thin-client/apps/rustdesk.nix
|
||||
#
|
||||
# RustDesk client (Hilfe annehmen) + daemon (unattended support).
|
||||
# Q13 decisions: Beides (Client+Daemon), Self-hosted Server, Pre-Shared Key
|
||||
# via agenix, Wayland portal pre-authorized, Permanent password via agenix.
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf mkOption types;
|
||||
cfg = config.az.tc;
|
||||
hostname = config.networking.hostName;
|
||||
in {
|
||||
options.az.tc.rustdesk = {
|
||||
serverHost = mkOption {
|
||||
type = types.str;
|
||||
default = "rustdesk.az-group.local"; # TODO: real host
|
||||
description = "Self-hosted RustDesk hbbs/hbbr endpoint (via NetBird).";
|
||||
};
|
||||
|
||||
serverPort = mkOption {
|
||||
type = types.int;
|
||||
default = 21116;
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment = {
|
||||
systemPackages = with pkgs; [rustdesk];
|
||||
|
||||
etc = {
|
||||
# /etc/rustdesk/RustDesk.toml — daemon config. Pre-shared key and
|
||||
# server endpoints go here. Permanent password is in a separate
|
||||
# agenix secret and written to a path RustDesk reads.
|
||||
"rustdesk/RustDesk.toml".text = ''
|
||||
[options]
|
||||
custom-rendezvous-server = ${config.az.tc.rustdesk.serverHost}
|
||||
relay-server = ${config.az.tc.rustdesk.serverHost}
|
||||
api-server = https://${config.az.tc.rustdesk.serverHost}
|
||||
key = file:/run/agenix/rustdesk-psk
|
||||
verification-method = fixed-password
|
||||
permanent-password-file = /run/agenix/${hostname}-rustdesk-password
|
||||
enable-wayland-screen-share = true
|
||||
allow-auto-disconnect = false
|
||||
'';
|
||||
|
||||
# Wayland portal pre-authorization for RustDesk — KDE-specific
|
||||
# xdg portal config so the "screen capture" prompt is pre-approved.
|
||||
"xdg-desktop-portal/kde-screen-share.conf".text = ''
|
||||
[allowed]
|
||||
rustdesk=true
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# Systemd service: RustDesk daemon (runs as root for unattended).
|
||||
systemd.services.rustdesk = {
|
||||
description = "RustDesk unattended support daemon";
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = ["network-online.target" "age-identity.service"];
|
||||
wants = ["network-online.target" "age-identity.service"];
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
ExecStart = "${pkgs.rustdesk}/bin/rustdesk --service";
|
||||
Restart = "always";
|
||||
RestartSec = "5s";
|
||||
User = "root";
|
||||
};
|
||||
};
|
||||
|
||||
# Shared pre-shared key (one for all thin clients)
|
||||
age.secrets."rustdesk-psk" = {
|
||||
file = ../../secrets/rustdesk-psk.age;
|
||||
mode = "0400";
|
||||
owner = "root";
|
||||
};
|
||||
|
||||
# Per-host permanent password
|
||||
age.secrets."${hostname}-rustdesk-password" = {
|
||||
file = ../../secrets/${hostname}-rustdesk-password.age;
|
||||
mode = "0400";
|
||||
owner = "root";
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user