feat: +thin-client role + AZ-TC-01..03 pilot
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
This commit is contained in:
m3ta-chiron
@@ -0,0 +1,6 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!-- Placeholder AzIntec logo. Replace with real corporate logo. -->
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 80" width="200" height="80">
|
||||
<rect width="200" height="80" fill="#1e3a8a"/>
|
||||
<text x="100" y="50" font-family="Arial,sans-serif" font-size="24" font-weight="bold" fill="white" text-anchor="middle">AZ-INTEC</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 388 B |
@@ -0,0 +1,12 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!-- Placeholder wallpaper. Replace with real corporate wallpaper (JPEG preferred). -->
|
||||
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1920 1080" width="1920" height="1080">
|
||||
<defs>
|
||||
<linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
|
||||
<stop offset="0%" stop-color="#0f172a"/>
|
||||
<stop offset="100%" stop-color="#1e3a8a"/>
|
||||
</linearGradient>
|
||||
</defs>
|
||||
<rect width="1920" height="1080" fill="url(#bg)"/>
|
||||
<text x="960" y="540" font-family="Arial,sans-serif" font-size="72" font-weight="bold" fill="white" text-anchor="middle" opacity="0.3">AZ-INTEC</text>
|
||||
</svg>
|
||||
|
After Width: | Height: | Size: 626 B |
@@ -0,0 +1,25 @@
|
||||
# roles/thin-client/session/audio.nix
|
||||
#
|
||||
# PipeWire audio stack. Required by RustDesk (capture/playback), OBS,
|
||||
# Chromium (Office Web, Teams Web). Done here rather than in apps/ because
|
||||
# it's session infrastructure.
|
||||
{config, lib, pkgs, ...}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
jack.enable = true;
|
||||
wireplumber.enable = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
pulseaudioFull # pactl/pavucontrol for support cases
|
||||
pavucontrol
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
# roles/thin-client/session/branding.nix
|
||||
#
|
||||
# Light branding: corporate wallpaper, SDDM logo overlay, Breeze Light,
|
||||
# Property-of-footer (hostname + IT hotline) on the lock screen.
|
||||
# Q17 decisions: Light Branding, no login banner, user may adjust KDE.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
options.az.tc.branding = {
|
||||
hotline = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "+49 30 1234567"; # TODO: real hotline
|
||||
description = "IT-Hotline phone number for the property-of footer.";
|
||||
};
|
||||
wallpaper = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = ./assets/wallpaper.svg;
|
||||
description = ''
|
||||
Path to a corporate wallpaper image (JPEG or SVG). Replace
|
||||
`roles/thin-client/session/assets/wallpaper.svg` with the real
|
||||
asset, or override this option.
|
||||
'';
|
||||
};
|
||||
logo = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = ./assets/logo.svg;
|
||||
description = ''
|
||||
Path to the corporate logo (SVG or PNG). Used in SDDM and lock
|
||||
screen footer.
|
||||
'';
|
||||
};
|
||||
company = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "AzIntec GmbH";
|
||||
description = "Company name shown in the property-of footer.";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment = {
|
||||
etc = {
|
||||
# Wallpaper — install to /etc/az-wallpaper so KDE's wallpaper plugin
|
||||
# can find it via the standard search path.
|
||||
"az-wallpaper".source = config.az.tc.branding.wallpaper;
|
||||
|
||||
# Default Plasma configuration as /etc/xdg — KDE reads these as
|
||||
# the system-wide defaults. User-specific changes are layered on top.
|
||||
"xdg/kdeglobals".text = ''
|
||||
[General]
|
||||
ColorScheme=Breeze Light
|
||||
|
||||
[KDE]
|
||||
widgetStyle=Breeze
|
||||
|
||||
[Icons]
|
||||
Theme=breeze
|
||||
|
||||
[Wallpaper]
|
||||
Image=file:///etc/az-wallpaper
|
||||
'';
|
||||
|
||||
# Lock-screen footer (rendered by kscreenlocker_greet).
|
||||
"xdg/kscreenlockerrc".text = ''
|
||||
[Greeter]
|
||||
Logo=${config.az.tc.branding.logo}
|
||||
Footer=${config.az.tc.branding.company} · ${config.networking.hostName} · IT-Hotline: ${config.az.tc.branding.hotline}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# Property-of-footer via SDDM theme config. Lightweight: we don't
|
||||
# ship a full custom SDDM theme — we just set the footer string that
|
||||
# the default Breeze SDDM theme shows.
|
||||
services.displayManager.sddm.settings.Theme = {
|
||||
Wallpaper = config.az.tc.branding.wallpaper;
|
||||
Logo = config.az.tc.branding.logo;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
# roles/thin-client/session/default.nix
|
||||
#
|
||||
# KDE Plasma 6 session on Wayland, SDDM, locale/timezone already set in
|
||||
# the top-level role. Submodules pull in branding, audio, fonts.
|
||||
{config, lib, pkgs, ...}: {
|
||||
imports = [
|
||||
./desktop.nix
|
||||
./branding.nix
|
||||
./audio.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,80 @@
|
||||
# roles/thin-client/session/desktop.nix
|
||||
#
|
||||
# KDE Plasma 6 on Wayland, SDDM display manager.
|
||||
# Q6 decisions: Wayland, no autologin, Full-HD uniform monitors.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
inherit (lib) mkIf;
|
||||
cfg = config.az.tc;
|
||||
in {
|
||||
config = mkIf cfg.enable {
|
||||
# Xserver base — required for keyboard config even on Wayland.
|
||||
services.xserver.enable = true;
|
||||
|
||||
services.displayManager = {
|
||||
sddm = {
|
||||
enable = true;
|
||||
wayland.enable = true;
|
||||
autoNumlock = true;
|
||||
settings = {
|
||||
Theme = {
|
||||
# Branded theme set in branding.nix
|
||||
CursorTheme = "breeze_cursors";
|
||||
};
|
||||
Autologin = {
|
||||
# Explicitly disabled — multi-user machine.
|
||||
User = "";
|
||||
Session = "";
|
||||
};
|
||||
};
|
||||
};
|
||||
defaultSession = "plasma";
|
||||
};
|
||||
|
||||
services.desktopManager.plasma6 = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
# Wayland portal for screen capture (RustDesk + OBS).
|
||||
xdg.portal = {
|
||||
enable = true;
|
||||
extraPortals = [
|
||||
pkgs.kdePackages.xdg-desktop-portal-kde
|
||||
];
|
||||
config.common.default = ["kde"];
|
||||
};
|
||||
|
||||
# PipeWire for audio (RustDesk/OBS/Chrome all consume it).
|
||||
security.rtkit.enable = true;
|
||||
|
||||
# German keyboard layout
|
||||
services.xserver.xkb = {
|
||||
layout = "de";
|
||||
variant = "";
|
||||
options = "eurosign:e";
|
||||
};
|
||||
|
||||
# Essential KDE/PIM utilities users expect
|
||||
environment.plasma6.excludePackages = with pkgs.kdePackages; [
|
||||
konsole
|
||||
elisa
|
||||
khelpcenter
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Thin-client baseline utilities
|
||||
kitty
|
||||
ark
|
||||
kdePackages.kcalc
|
||||
kdePackages.spectacle
|
||||
kdePackages.filelight
|
||||
];
|
||||
|
||||
# Firewall UI helper (KDE) — optional but useful for support staff
|
||||
# networking.firewall is configured in network/firewall.nix
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user