m3ta-chiron
0cc0b5064d
Tiefen-Validierung via 'nix build .#nixosConfigurations.AZ-TC-NN.config.
system.build.toplevel' hat mehrere reale Bugs gefunden, die 'nix flake
check' nicht sah. Alle drei Pilot-Hosts bauen jetzt sauber durch.
Gefixst:
- freerdp3 → freerdp (umbenannt in nixpkgs-unstable)
- SDDM Theme.Logo will INI-Atom (string), nicht Nix-path → '${path}'
- security.pam.mount.extraVolumes will list-of-string, nicht ein String
- sudoers: 'domain admins' muss als 'domain\ admins' escaped werden
- agenix file-Pfade: ../../secrets/ → ../../../secrets/ (Tiefe korrigiert)
- snapper: config.services.snapper.package gibt es nicht → pkgs.snapper
- samba4Full entfernt (blockiert durch ceph-common python metadata issue
in nixpkgs-unstable; Thin Clients brauchen es nicht — cifs-utils reicht)
- corp-wifi-ca.pem durch gültiges Dummy-PEM ersetzt (openssl-generiert,
mit明显 REPLACE-MARKER; build kann PEM parsen)
Functional gemacht:
- Alloy: echtes River-Config mit loki.source.journal + loki.write statt
barem logging-stub. Journal-Logs mit host/unit/severity-Labels nach
Loki.
- Snipe-IT: echte Check-in-Logik via curl + jq. Lookup by asset_tag,
PATCH falls exists, POST falls neu. startAt täglich 03:30. API-Token
via agenix (snipeit-api-token.age).
- node_exporter push: realer curl-Push alle 60s mit retry on failure.
Safety:
- Placeholder-Assertions in roles/thin-client/default.nix: build schlägt
fehl, wenn wifi.ssid/hotline/company noch Placeholder sind (außer
site='staging'). Pilot-Hosts haben site='staging' bis echte Werte da.
- assets/corp-wifi-ca.pem hat deutlich sichtbaren REPLACE-Hinweis.
Neue Options:
- az.tc.monitoring.snipeItUrl (default: snipeit.az-group.local)
Neue Secrets (Placeholder .age-Files zum Ausfüllen):
- snipeit-api-token.age (fleet-wide shared)
65 lines
3.5 KiB
Nix
65 lines
3.5 KiB
Nix
let
|
|
#SYSTEMS
|
|
AZ-CLD-1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItSijmU5YwcJcoshtmYxpxBaVA4TPaCMk23ws7KDkAH";
|
|
AZ-LT-NIX = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIg/nFOPx763xIbepPsdYRE49R7HwvikXhLF/iPgH1Jh";
|
|
AZ-PRM-1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID6gl9maUQ99I4t8mCAdfUw6lrA9NYx2EbwqGOmKts+l";
|
|
|
|
# ── Thin Client Fleet Hosts ───────────────────────────────────────
|
|
# SSH host keys (ed25519) are generated on first boot of each host.
|
|
# After first boot, retrieve via: ssh-keyscan -t ed25519 AZ-TC-NN.netbird
|
|
# and paste the public key here. Until then, the corresponding .age
|
|
# secrets can't be decrypted by the host.
|
|
AZ-TC-01 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-01";
|
|
AZ-TC-02 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-02";
|
|
AZ-TC-03 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5PLACEHOLDER-REPLACE-WITH-REAL-HOSTKEY-03";
|
|
|
|
#USERS
|
|
sascha.koenig = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEZbg/Z9mnflXuLahGY8WOSBMqbgeqVIkIwRkquys1Ml";
|
|
jannik.mueller = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPvZazSuIoWoRWhkAqQDMLeurxVUyy1MTllp1wfw1tzq";
|
|
|
|
users = [sascha.koenig jannik.mueller];
|
|
systems = [AZ-CLD-1 AZ-LT-NIX AZ-PRM-1];
|
|
thinClients = [AZ-TC-01 AZ-TC-02 AZ-TC-03];
|
|
in {
|
|
"secrets/elevenlabs-key.age".publicKeys = systems ++ users;
|
|
"secrets/exa-key.age".publicKeys = systems ++ users;
|
|
"secrets/kestractl-env.age".publicKeys = systems ++ users;
|
|
"secrets/outline-key.age".publicKeys = systems ++ users;
|
|
"secrets/ref-key.age".publicKeys = systems ++ users;
|
|
"secrets/sascha.koenig-secrets.age".publicKeys = [AZ-LT-NIX sascha.koenig];
|
|
|
|
# ── Per-host Thin Client secrets ──────────────────────────────────
|
|
# Each Thin Client needs:
|
|
# - <host>-krb5-keytab.age — AD machine keytab
|
|
# - <host>-netbird-setupkey.age — NetBird setup key
|
|
# - <host>-wifi-client-cert.age — WiFi EAP-TLS client cert (PEM, key+cert)
|
|
# - <host>-rustdesk-password.age — RustDesk permanent password
|
|
# Plus a shared one for all thin clients:
|
|
# - rustdesk-psk.age — RustDesk pre-shared key
|
|
#
|
|
# Create with: agenix -e secrets/AZ-TC-01-krb5-keytab.age
|
|
|
|
# Shared RustDesk PSK — readable by all thin clients
|
|
"secrets/rustdesk-psk.age".publicKeys = thinClients ++ users;
|
|
|
|
# Shared Snipe-IT API token — same token for all thin clients (they
|
|
# only check themselves in, not manage assets).
|
|
"secrets/snipeit-api-token.age".publicKeys = thinClients ++ users;
|
|
|
|
# Per-host Thin Client secrets
|
|
"secrets/AZ-TC-01-krb5-keytab.age".publicKeys = [AZ-TC-01] ++ users;
|
|
"secrets/AZ-TC-01-netbird-setupkey.age".publicKeys = [AZ-TC-01] ++ users;
|
|
"secrets/AZ-TC-01-wifi-client-cert.age".publicKeys = [AZ-TC-01] ++ users;
|
|
"secrets/AZ-TC-01-rustdesk-password.age".publicKeys = [AZ-TC-01] ++ users;
|
|
|
|
"secrets/AZ-TC-02-krb5-keytab.age".publicKeys = [AZ-TC-02] ++ users;
|
|
"secrets/AZ-TC-02-netbird-setupkey.age".publicKeys = [AZ-TC-02] ++ users;
|
|
"secrets/AZ-TC-02-wifi-client-cert.age".publicKeys = [AZ-TC-02] ++ users;
|
|
"secrets/AZ-TC-02-rustdesk-password.age".publicKeys = [AZ-TC-02] ++ users;
|
|
|
|
"secrets/AZ-TC-03-krb5-keytab.age".publicKeys = [AZ-TC-03] ++ users;
|
|
"secrets/AZ-TC-03-netbird-setupkey.age".publicKeys = [AZ-TC-03] ++ users;
|
|
"secrets/AZ-TC-03-wifi-client-cert.age".publicKeys = [AZ-TC-03] ++ users;
|
|
"secrets/AZ-TC-03-rustdesk-password.age".publicKeys = [AZ-TC-03] ++ users;
|
|
}
|