m3ta-chiron
98dc2917e8
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
81 lines
1.8 KiB
Nix
81 lines
1.8 KiB
Nix
# roles/thin-client/session/desktop.nix
|
|
#
|
|
# KDE Plasma 6 on Wayland, SDDM display manager.
|
|
# Q6 decisions: Wayland, no autologin, Full-HD uniform monitors.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
inherit (lib) mkIf;
|
|
cfg = config.az.tc;
|
|
in {
|
|
config = mkIf cfg.enable {
|
|
# Xserver base — required for keyboard config even on Wayland.
|
|
services.xserver.enable = true;
|
|
|
|
services.displayManager = {
|
|
sddm = {
|
|
enable = true;
|
|
wayland.enable = true;
|
|
autoNumlock = true;
|
|
settings = {
|
|
Theme = {
|
|
# Branded theme set in branding.nix
|
|
CursorTheme = "breeze_cursors";
|
|
};
|
|
Autologin = {
|
|
# Explicitly disabled — multi-user machine.
|
|
User = "";
|
|
Session = "";
|
|
};
|
|
};
|
|
};
|
|
defaultSession = "plasma";
|
|
};
|
|
|
|
services.desktopManager.plasma6 = {
|
|
enable = true;
|
|
};
|
|
|
|
# Wayland portal for screen capture (RustDesk + OBS).
|
|
xdg.portal = {
|
|
enable = true;
|
|
extraPortals = [
|
|
pkgs.kdePackages.xdg-desktop-portal-kde
|
|
];
|
|
config.common.default = ["kde"];
|
|
};
|
|
|
|
# PipeWire for audio (RustDesk/OBS/Chrome all consume it).
|
|
security.rtkit.enable = true;
|
|
|
|
# German keyboard layout
|
|
services.xserver.xkb = {
|
|
layout = "de";
|
|
variant = "";
|
|
options = "eurosign:e";
|
|
};
|
|
|
|
# Essential KDE/PIM utilities users expect
|
|
environment.plasma6.excludePackages = with pkgs.kdePackages; [
|
|
konsole
|
|
elisa
|
|
khelpcenter
|
|
];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
# Thin-client baseline utilities
|
|
kitty
|
|
ark
|
|
kdePackages.kcalc
|
|
kdePackages.spectacle
|
|
kdePackages.filelight
|
|
];
|
|
|
|
# Firewall UI helper (KDE) — optional but useful for support staff
|
|
# networking.firewall is configured in network/firewall.nix
|
|
};
|
|
}
|