feat: +thin-client role + AZ-TC-01..03 pilot
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
This commit is contained in:
m3ta-chiron
@@ -0,0 +1,33 @@
|
||||
# roles/thin-client/deployment/auto-upgrade.nix
|
||||
#
|
||||
# Q18 decision: Auto-Upgrade pro Host daily, Generation-Picker + BTRFS-
|
||||
# Snapshot für Rollback, Auto-Reboot nach Kernel-Update.
|
||||
{config, lib, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
system.autoUpgrade = {
|
||||
enable = true;
|
||||
dates = "03:00";
|
||||
randomizedDelaySec = "30min";
|
||||
flake = "git+https://code.m3ta.dev/m3tam3re/AZ-NIX-CLIENTS";
|
||||
flags = [
|
||||
"--no-write-lock-file"
|
||||
"--refresh"
|
||||
];
|
||||
allowReboot = true;
|
||||
rebootWindow = {
|
||||
lower = "03:00";
|
||||
upper = "05:00";
|
||||
};
|
||||
};
|
||||
|
||||
# Always keep at least 7 generations for rollback
|
||||
boot.loader.systemd-boot.configurationLimit = 10;
|
||||
|
||||
# gc — keep more generations than the autoUpgrade default to allow
|
||||
# rollback over a weekend.
|
||||
nix.gc.options = "--delete-older-than 14d";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
# roles/thin-client/deployment/default.nix
|
||||
#
|
||||
# Deployment layer: Disko BTRFS layout, auto-upgrade, snapper snapshots.
|
||||
# Q3 (nixos-anywhere), Q4 (BTRFS, @root/@home), Q18 (auto-upgrade daily,
|
||||
# generation-picker + BTRFS snapshot, auto-reboot).
|
||||
{config, lib, ...}: {
|
||||
imports = [
|
||||
./disko.nix
|
||||
./auto-upgrade.nix
|
||||
./snapper.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,94 @@
|
||||
# roles/thin-client/deployment/disko.nix
|
||||
#
|
||||
# BTRFS disk layout via Disko. Used by `nixos-anywhere` during provisioning.
|
||||
# Q4 decisions: Standard persistent BTRFS, subvolumes @root and @home,
|
||||
# zstd compression, snapper for / (NOT /home — privacy for multi-user).
|
||||
#
|
||||
# Apply during provisioning:
|
||||
# nixos-anywhere --flake .#AZ-TC-01 \
|
||||
# --disko disko-config ./roles/thin-client/deployment/disko.nix \
|
||||
# root@<target-ip>
|
||||
#
|
||||
# This module sets `disko.devices` so the config can be referenced both
|
||||
# for partitioning (nixos-anywhere --disko) and for fstab generation.
|
||||
{config, lib, ...}: let
|
||||
inherit (lib) mkIf mkOption types;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
options.az.tc.deployment = {
|
||||
diskDevice = mkOption {
|
||||
type = types.str;
|
||||
default = "/dev/sda";
|
||||
description = ''
|
||||
Target disk device for the BTRFS layout. Typically /dev/sda or
|
||||
/dev/nvme0n1. Override per-host in hosts/AZ-TC-NN/default.nix.
|
||||
'';
|
||||
};
|
||||
|
||||
swapSizeGB = mkOption {
|
||||
type = types.int;
|
||||
default = 4;
|
||||
description = "Swap partition size in GB. Set 0 to disable swap.";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
disko.devices = {
|
||||
disk.main = {
|
||||
type = "disk";
|
||||
device = config.az.tc.deployment.diskDevice;
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = ["umask=0077"];
|
||||
};
|
||||
};
|
||||
swap = mkIf (config.az.tc.deployment.swapSizeGB > 0) {
|
||||
size = "${toString config.az.tc.deployment.swapSizeGB}G";
|
||||
content = {
|
||||
type = "swap";
|
||||
randomEncryption = true;
|
||||
};
|
||||
};
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "btrfs";
|
||||
extraArgs = ["-f"]; # force overwrite
|
||||
subvolumes = {
|
||||
"@root" = {
|
||||
mountpoint = "/";
|
||||
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
||||
};
|
||||
"@home" = {
|
||||
mountpoint = "/home";
|
||||
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
||||
};
|
||||
"@nix" = {
|
||||
mountpoint = "/nix";
|
||||
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
||||
};
|
||||
"@persist" = {
|
||||
mountpoint = "/persist";
|
||||
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
||||
};
|
||||
"@snapshots" = {
|
||||
mountpoint = "/.snapshots";
|
||||
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
# roles/thin-client/deployment/snapper.nix
|
||||
#
|
||||
# BTRFS snapshots for the root subvolume via snapper. Snapshots taken
|
||||
# before and after each `nixos-rebuild switch`, plus hourly/daily.
|
||||
#
|
||||
# Q18 decision: Generation-Picker + BTRFS-Snapshot.
|
||||
{config, lib, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
services.snapper = {
|
||||
snapshotRootOnBoot = true;
|
||||
configs = {
|
||||
root = {
|
||||
SUBVOLUME = "/";
|
||||
ALLOW_USERS = ["root"];
|
||||
TIMELINE_CREATE = true;
|
||||
TIMELINE_CLEANUP = true;
|
||||
TIMELINE_LIMIT_HOURLY = "12";
|
||||
TIMELINE_LIMIT_DAILY = "7";
|
||||
TIMELINE_LIMIT_WEEKLY = "4";
|
||||
TIMELINE_LIMIT_MONTHLY = "0";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Take a snapshot before any nixos-rebuild switch — hooks into the
|
||||
# toplevel system path activation.
|
||||
system.activationScripts.snapperPreSwitch = {
|
||||
deps = [];
|
||||
text = ''
|
||||
if [ -d /.snapshots ]; then
|
||||
${config.services.snapper.package}/bin/snapper -c root create \
|
||||
-d "pre-switch $(date +%Y-%m-%d-%H%M)" || true
|
||||
fi
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user