AZ-NIX-CLIENTS/roles/thin-client/default.nix

# roles/thin-client/default.nix
#
# Top-level NixOS role module for the AZ-NIX-CLIENTS Thin Client fleet
# (AZ-TC-01..NN). Replaces a Windows 10 workstation with a locked-down
# NixOS + KDE Plasma client that authenticates against Active Directory
# and provides pre-configured RDP, browser, and Office-Web access.
#
# A Fleet Host (hosts/AZ-TC-NN/default.nix) only needs to set:
#   az.tc.enable        = true;
#   az.tc.hardwareClass = "dell-optiplex-micro";
#   networking.hostName = "AZ-TC-01";
# Everything else is composed by this role.
#
# See roles/thin-client/README.md for the provisioning workflow.
{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.az.tc;
in {
  imports = [
    ./hardware
    ./session
    ./identity
    ./network
    ./peripherals
    ./apps
    ./monitoring
    ./deployment
  ];

  options.az.tc = {
    enable = lib.mkEnableOption "the AzIntec Thin Client role (KDE Plasma + AD + RDP fleet host)";

    hardwareClass = lib.mkOption {
      type = lib.types.enum ["dell-optiplex-micro" "generic-x86_64-uefi"];
      default = "generic-x86_64-uefi";
      description = ''
        Hardware class of the Thin Client. Selects the appropriate
        kernel modules, firmware, and video driver under
        `roles/thin-client/hardware/`.
      '';
    };

    site = lib.mkOption {
      type = lib.types.str;
      default = "default";
      description = ''
        Site identifier (e.g. "BER", "MUC"). Currently informational;
        reserved for per-site printer maps or branding variations.
      '';
    };
  };

  config = lib.mkIf cfg.enable {
    # ── Fleet-wide base configuration ────────────────────────────────
    # Everything that every Thin Client needs regardless of which
    # submodule pulls it in. Submodules opt-in via mkIf themselves.

    # We do NOT import hosts/common here — that pulls nushell as default
    # shell and m3ta-home profile system, neither of which belongs on a
    # Thin Client. The minimum system config is set explicitly below.

    nixpkgs.hostPlatform = "x86_64-linux";
    nixpkgs.config.allowUnfree = true;

    nix = {
      settings = {
        experimental-features = "nix-command flakes";
        trusted-users = ["root"];
      };
      gc = {
        automatic = true;
        dates = "weekly";
        options = "--delete-older-than 14d";
      };
      optimise.automatic = true;
    };

    # Thin Clients are managed centrally; users do not run nix commands.
    users.defaultUserShell = pkgs.bash;

    # Console / i18n / time — matches AZ-LT-NIX conventions.
    i18n.defaultLocale = "de_DE.UTF-8";
    time.timeZone = "Europe/Berlin";
    console.useXkbConfig = true;

    # Persistence-relevant state lives on the BTRFS root; nothing
    # tmpfs-related here. /home persists per-user (Q6: "alles persistieren").

    # Polkit for udisks/colord/etc. — needed so non-root users can mount
    # USB sticks, change brightness, etc.
    security.polkit.enable = true;

    # XDG portal wiring for Wayland screen-capture (RustDesk + OBS).
    environment.pathsToLink = [
      "/share/xdg-desktop-portal"
      "/share/applications"
    ];

    # SSH is enabled by the network module (via NetBird only).
    # Firewall is enabled by the network module.

    # ── assertions / warnings ────────────────────────────────────────
    # Catches un-overridden placeholders at build time so the operator
    # notices BEFORE deploying to a real Thin Client. Each assertion
    # checks a "placeholder" marker value; override the option in
    # hosts/AZ-TC-NN/default.nix to silence.
    assertions = [
      {
        assertion = cfg.enable -> (config.networking.hostName or "") != "";
        message = "az.tc.enable requires networking.hostName to be set (e.g. 'AZ-TC-01').";
      }
      {
        assertion = cfg.enable -> config.az.tc.wifi.ssid != "AZ-CORP" || config.az.tc.site == "staging";
        message = ''
          az.tc.wifi.ssid is still the placeholder 'AZ-CORP'. Set the
          real corp WiFi SSID in hosts/AZ-TC-NN/default.nix (or set
          az.tc.site = "staging" to silence for lab/test hosts).
        '';
      }
      {
        assertion = cfg.enable -> config.az.tc.branding.hotline != "+49 30 1234567" || config.az.tc.site == "staging";
        message = "az.tc.branding.hotline is still the placeholder — set the real IT-Hotline number.";
      }
      {
        assertion = cfg.enable -> config.az.tc.branding.company != "AzIntec GmbH" || config.az.tc.site == "staging";
        message = "az.tc.branding.company is still the placeholder 'AzIntec GmbH' — set the real company name.";
      }
    ];
  };
}