feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
2026-07-29 08:34:01 +02:00
parent ea0c4ccf22
commit 98dc2917e8
42 changed files with 2281 additions and 1 deletions
@@ -0,0 +1,119 @@
+# roles/thin-client/apps/chromium.nix
+#
+# Chromium enterprise policy.
+# Q12 decisions: ManagedBookmarks, SyncDisabled, uBlock Origin + Allowlist,
+# PasswordManagerEnabled=false, Bitwarden Extension force-install.
+#
+# Policy file path on NixOS: /etc/chromium/policies/managed/*.json
+{config, lib, pkgs, ...}: let
+  inherit (lib) mkIf mkOption types;
+  cfg = config.az.tc;
+in {
+  options.az.tc.chromium = {
+    homepage = mkOption {
+      type = types.str;
+      default = "https://www.office.com"; # TODO: real homepage
+      description = "Chromium startup URL.";
+    };
+
+    bookmarks = mkOption {
+      type = types.listOf (types.submodule {
+        options = {
+          name = mkOption {type = types.str;};
+          url = mkOption {type = types.str;};
+        };
+      });
+      default = [
+        {name = "Outlook Web"; url = "https://outlook.office.com";}
+        {name = "Teams Web"; url = "https://teams.microsoft.com";}
+        {name = "SharePoint"; url = "https://azgroup.sharepoint.com";}
+        {name = "Office Home"; url = "https://www.office.com";}
+        # TODO: Intranet, Helpdesk, ERP, HR — fill real URLs
+      ];
+      description = "Managed bookmarks (cannot be deleted by user).";
+    };
+
+    bitwardenServerUrl = mkOption {
+      type = types.str;
+      default = "https://vault.bitwarden.com"; # cloud default; override for self-hosted
+      description = ''
+        Bitwarden server URL (cloud or self-hosted). Pushed via Chromium
+        extension settings.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    programs.chromium = {
+      enable = true;
+      extraOpts = {
+        # Bookmarks
+        ManagedBookmarks = [
+          {cn = "AZ Corporate Bookmarks"; children = config.az.tc.chromium.bookmarks;}
+        ];
+
+        # Homepage
+        HomepageLocation = config.az.tc.chromium.homepage;
+        RestoreOnStartup = 4; # always restore homepage
+        StartupUrls = [config.az.tc.chromium.homepage];
+
+        # Sync disabled (Q12)
+        SyncDisabled = true;
+        BrowserSignin = 0; # no Google account sign-in
+        RestrictSigninToPattern = ".*@az-group\\.local";
+
+        # Password manager disabled (Q12)
+        PasswordManagerEnabled = false;
+
+        # Autofill
+        AutofillAddressEnabled = true;
+        AutofillCreditCardEnabled = false;
+
+        # Background mode (Chromium keeps running in background)
+        BackgroundModeEnabled = false;
+
+        # Extensions: force-install uBlock Origin + Bitwarden
+        ExtensionInstallForcelist = [
+          # uBlock Origin
+          "cjpalhdlnbpafiamejdnhcphjbkeiagm"
+          # Bitwarden Password Manager
+          "nngceckbapebfimnlniiiahkandclblb"
+        ];
+        ExtensionInstallAllowlist = [
+          "cjpalhdlnbpafiamejdnhcphjbkeiagm" # uBlock Origin
+          "nngceckbapebfimnlniiiahkandclblb" # Bitwarden
+        ];
+        ExtensionInstallBlocklist = ["*"]; # block everything not in allowlist
+
+        # Bitwarden configuration via extension policy
+        "3rdparty" = {
+          "extensions" = {
+            "nngceckbapebfimnlniiiahkandclblb" = {
+              environment = {
+                base = config.az.tc.chromium.bitwardenServerUrl;
+              };
+            };
+          };
+        };
+
+        # Disable telemetry
+        UrlKeyedAnonymizedDataCollectionEnabled = false;
+        SafeBrowsingEnabled = true;
+
+        # Default browser check
+        DefaultBrowserSettingEnabled = true;
+
+        # PDF / plugins / popups
+        AlwaysOpenPdfExternally = false;
+        BlockThirdPartyCookies = true;
+
+        # Pinch-to-zoom, etc.
+        TouchEnabled = false;
+      };
+    };
+
+    environment.systemPackages = with pkgs; [
+      chromium
+    ];
+  };
+}