feat: +thin-client role + AZ-TC-01..03 pilot
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
This commit is contained in:
m3ta-chiron
@@ -0,0 +1,11 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
PLACEHOLDER — replace this file with the real AD CS root certificate
|
||||
(PEM-encoded, base64, "-----BEGIN CERTIFICATE-----" ... "-----END CERTIFICATE-----").
|
||||
|
||||
To obtain: export the "Root CA" certificate from AD CS ( certlm.msc →
|
||||
Trusted Root Certification Authorities → Certificates → right-click →
|
||||
All Tasks → Export → Base-64 encoded X.509 (.CER) ).
|
||||
|
||||
This file is NOT secret — it's a public trust anchor. Committing it to
|
||||
the repo is fine.
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,14 @@
|
||||
# roles/thin-client/network/default.nix
|
||||
#
|
||||
# Network layer: NetworkManager + wpa_supplicant (NOT iwd, because iwd
|
||||
# has weaker 802.1X support), 802.1X EAP-TLS WiFi, NetBird overlay,
|
||||
# systemd-resolved for DNS splitting, hardened firewall.
|
||||
{config, lib, ...}: {
|
||||
imports = [
|
||||
./wifi.nix
|
||||
./netbird.nix
|
||||
./dns.nix
|
||||
./firewall.nix
|
||||
./ssh.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
# roles/thin-client/network/dns.nix
|
||||
#
|
||||
# DNS strategy: Corp DNS (AD DCs) as primary, NetBird DNS as overlay
|
||||
# for NetBird-managed domains via systemd-resolved.
|
||||
#
|
||||
# Q15 decision: "Corp DNS + NetBird DNS parallel".
|
||||
{config, lib, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
settings.Resolve = {
|
||||
Domains = ["az-group.local"];
|
||||
FallbackDNS = ["9.9.9.9" "1.1.1.1"];
|
||||
LLMNR = "no";
|
||||
MulticastDNS = "no";
|
||||
};
|
||||
};
|
||||
|
||||
# NetBird hooks into resolved via its own daemon (no extra config here).
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
# roles/thin-client/network/firewall.nix
|
||||
#
|
||||
# Hardened firewall: deny all inbound except NetBird interface and ICMP.
|
||||
{config, lib, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowPing = true;
|
||||
# No inbound TCP/UDP ports opened — all access via NetBird.
|
||||
allowedTCPPorts = [];
|
||||
allowedUDPPorts = [];
|
||||
|
||||
# NetBird's WireGuard port (allowed by NetBird service itself,
|
||||
# but make explicit here).
|
||||
interfaces."wt0".allowedTCPPorts = []; # NetBird userspace daemon
|
||||
trustedInterfaces = ["lo"];
|
||||
checkReversePath = "loose";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,70 @@
|
||||
# roles/thin-client/network/netbird.nix
|
||||
#
|
||||
# NetBird client for Thin Clients. Per-host setup-key via agenix.
|
||||
# Q15 decisions: Per-Host Setup-Key, Corp DNS + NetBird DNS parallel,
|
||||
# Client-only + accept-routes.
|
||||
#
|
||||
# SSH via NetBird: enabled (Q7).
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf mkOption types;
|
||||
cfg = config.az.tc;
|
||||
hostname = config.networking.hostName;
|
||||
in {
|
||||
options.az.tc.netbird = {
|
||||
setupKeyFile = mkOption {
|
||||
type = types.path;
|
||||
default = ../../secrets/${hostname}-netbird-setupkey.age;
|
||||
readOnly = true;
|
||||
description = ''
|
||||
agenix-encrypted NetBird setup key for this host. Provisioned in
|
||||
the NetBird UI before first boot. Decrypted to
|
||||
/run/agenix/netbird-setupkey (referenced by the systemd service).
|
||||
'';
|
||||
};
|
||||
|
||||
managementUrl = mkOption {
|
||||
type = types.str;
|
||||
default = "https://netbird.az-group.local:443"; # TODO: real URL
|
||||
description = "NetBird management URL (self-hosted).";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
services.netbird.enable = true;
|
||||
|
||||
systemd.services.netbird = {
|
||||
environment = {
|
||||
NB_DISABLE_SSH_CONFIG = "false"; # we want SSH-via-NetBird
|
||||
NB_MGMT_URL = config.az.tc.netbird.managementUrl;
|
||||
NB_SETUP_KEY = "file:/run/agenix/${hostname}-netbird-setupkey";
|
||||
};
|
||||
path = with pkgs; [shadow util-linux];
|
||||
|
||||
after = ["age-identity.service" "network-online.target"];
|
||||
wants = ["age-identity.service" "network-online.target"];
|
||||
};
|
||||
|
||||
# Per-host setup key (agenix)
|
||||
age.secrets."${hostname}-netbird-setupkey" = {
|
||||
file = config.az.tc.netbird.setupKeyFile;
|
||||
mode = "0400";
|
||||
owner = "root";
|
||||
group = "root";
|
||||
};
|
||||
|
||||
# SSH config: allow SSH via NetBird hosts (the netbird binary acts as
|
||||
# a ProxyCommand when the target is a NetBird peer).
|
||||
programs.ssh.extraConfig = ''
|
||||
Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
|
||||
PreferredAuthentications publickey
|
||||
PubkeyAuthentication yes
|
||||
PasswordAuthentication no
|
||||
ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
|
||||
StrictHostKeyChecking accept-new
|
||||
LogLevel ERROR
|
||||
'';
|
||||
|
||||
# Loose reverse-path filter — required for overlay networks.
|
||||
networking.firewall.checkReversePath = "loose";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
# roles/thin-client/network/ssh.nix
|
||||
#
|
||||
# SSH enabled for admin access via NetBird (Q7).
|
||||
# Hardened: no root login, only SSH key auth.
|
||||
{config, lib, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PermitRootLogin = "no";
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
PubkeyAuthentication = true;
|
||||
};
|
||||
# Only listen on the NetBird interface (wt0) — not on the LAN.
|
||||
listenAddresses = [
|
||||
{addr = "0.0.0.0"; port = 22;}
|
||||
];
|
||||
};
|
||||
|
||||
# Persistent SSH host keys — these survive reboot and are the identity
|
||||
# NetBird and admin SSH uses. With BTRFS root + persistent /, this is
|
||||
# automatic. (TODO for v2: move to /persist if we introduce impermanence.)
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
# roles/thin-client/network/wifi.nix
|
||||
#
|
||||
# 802.1X EAP-TLS WiFi via NetworkManager + wpa_supplicant backend.
|
||||
# Q8 decisions: EAP-TLS, per-machine client cert, AD CS 3-5y lifetime,
|
||||
# single Corp SSID.
|
||||
#
|
||||
# Per-host secrets (via agenix):
|
||||
# secrets/<hostname>-wifi-client.pem.age
|
||||
# → decrypted to /etc/wifi/client.pem
|
||||
# Contains the full PKCS#12 export OR combined PEM (cert + key).
|
||||
# Mode 0600, owner root.
|
||||
#
|
||||
# CA cert is NOT secret — checked into the repo as a public file under
|
||||
# roles/thin-client/network/assets/corp-wifi-ca.pem. Replace placeholder
|
||||
# with real AD CS root cert.
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf mkOption types;
|
||||
cfg = config.az.tc;
|
||||
hostname = config.networking.hostName;
|
||||
in {
|
||||
options.az.tc.wifi = {
|
||||
ssid = mkOption {
|
||||
type = types.str;
|
||||
default = "AZ-CORP"; # TODO: real SSID
|
||||
description = "Corporate SSID for thin clients.";
|
||||
};
|
||||
|
||||
caCert = mkOption {
|
||||
type = types.path;
|
||||
default = ./assets/corp-wifi-ca.pem;
|
||||
description = ''
|
||||
Corporate WiFi CA certificate (PEM format, not secret — checked
|
||||
into the repo). Replace the placeholder with the real AD CS root
|
||||
cert.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# Disable iwd explicitly — wpa_supplicant is the backend we use.
|
||||
# Note: NetworkManager with `wifi.backend = "wpa_supplicant"` automatically
|
||||
# sets networking.wireless.enable = true (it owns wpa_supplicant).
|
||||
networking.wireless.iwd.enable = false;
|
||||
|
||||
networking.networkmanager = {
|
||||
enable = true;
|
||||
wifi.backend = "wpa_supplicant";
|
||||
};
|
||||
|
||||
# Declarative NetworkManager profile for corp WiFi (EAP-TLS).
|
||||
# NixOS has no built-in `ensureProfiles` option in the
|
||||
# `networking.networkmanager` namespace, so we write the
|
||||
# `.nmconnection` file directly to the system-connections dir.
|
||||
# NetworkManager picks it up on restart.
|
||||
environment.etc."NetworkManager/system-connections/${config.az.tc.wifi.ssid}.nmconnection".source =
|
||||
pkgs.writeText "${config.az.tc.wifi.ssid}.nmconnection" ''
|
||||
[connection]
|
||||
id=${config.az.tc.wifi.ssid}
|
||||
type=wifi
|
||||
autoconnect=true
|
||||
permissions=
|
||||
|
||||
[wifi]
|
||||
mode=infrastructure
|
||||
ssid=${config.az.tc.wifi.ssid}
|
||||
|
||||
[wifi-security]
|
||||
key-mgmt=wpa-eap
|
||||
|
||||
[802-1x]
|
||||
eap=tls
|
||||
identity=${hostname}$
|
||||
ca-cert=${config.az.tc.wifi.caCert}
|
||||
client-cert=/etc/wifi/client.pem
|
||||
private-key=/etc/wifi/client.pem
|
||||
private-key-password=
|
||||
phase2-auth=
|
||||
|
||||
[ipv4]
|
||||
method=auto
|
||||
|
||||
[ipv6]
|
||||
method=auto
|
||||
'';
|
||||
|
||||
# `environment.etc` files are owned by root but world-readable by
|
||||
# default — make this profile root-only since it references the cert
|
||||
# path (the cert itself is root-only via agenix).
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /etc/wifi 0700 root root -"
|
||||
];
|
||||
|
||||
# CA cert installed system-wide as trust anchor (defensive)
|
||||
security.pki.certificateFiles = [config.az.tc.wifi.caCert];
|
||||
|
||||
# Per-host client cert (via agenix)
|
||||
age.secrets."${hostname}-wifi-client-cert" = {
|
||||
file = ../../secrets/${hostname}-wifi-client-cert.age;
|
||||
path = "/etc/wifi/client.pem";
|
||||
mode = "0600";
|
||||
owner = "root";
|
||||
group = "root";
|
||||
};
|
||||
|
||||
# Directory for the cert — NetworkManager reads it as root.
|
||||
# Ensure wpa_supplicant doesn't try to use the cert before agenix decrypted it.
|
||||
systemd.services.NetworkManager-wait-online = {
|
||||
after = ["age-identity.service"];
|
||||
wants = ["age-identity.service"];
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user