m3ta-chiron
98dc2917e8
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
55 lines
1.5 KiB
Nix
55 lines
1.5 KiB
Nix
# roles/thin-client/peripherals/printing.nix
|
|
#
|
|
# CUPS with the single Pull-Print queue. Q16 decision: All users print
|
|
# to one queue, retrieve at any physical device via badge/PIN.
|
|
#
|
|
# Driverless IPPS — no vendor driver needed.
|
|
{config, lib, pkgs, ...}: let
|
|
inherit (lib) mkIf mkOption types;
|
|
cfg = config.az.tc;
|
|
in {
|
|
options.az.tc.printing = {
|
|
pullPrintEndpoint = mkOption {
|
|
type = types.str;
|
|
default = "ipps://pull-print.az-group.local:443/ipp/print"; # TODO: real endpoint
|
|
description = ''
|
|
IPPS URI of the Pull-Print queue. All thin clients print here.
|
|
'';
|
|
};
|
|
|
|
queueName = mkOption {
|
|
type = types.str;
|
|
default = "Pull-Print";
|
|
description = "Name of the local CUPS queue for the Pull-Print endpoint.";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
services.printing = {
|
|
enable = true;
|
|
drivers = with pkgs; [cups-filters];
|
|
browsing = false;
|
|
listenAddresses = ["localhost:631"];
|
|
allowFrom = ["localhost"];
|
|
};
|
|
|
|
# No Avahi — Q16 decision: "Avahi aus".
|
|
services.avahi.enable = false;
|
|
|
|
# Single Pull-Print queue
|
|
hardware.printers = {
|
|
ensurePrinters = [
|
|
{
|
|
name = config.az.tc.printing.queueName;
|
|
location = "Pull-Print";
|
|
description = "Central Pull-Print queue (follow-me print)";
|
|
deviceUri = config.az.tc.printing.pullPrintEndpoint;
|
|
model = "everywhere";
|
|
ppdOptions = {PageSize = "A4";};
|
|
}
|
|
];
|
|
ensureDefaultPrinter = config.az.tc.printing.queueName;
|
|
};
|
|
};
|
|
}
|