m3ta-chiron
98dc2917e8
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
97 lines
2.6 KiB
Nix
97 lines
2.6 KiB
Nix
# roles/thin-client/apps/remmina.nix
|
|
#
|
|
# Remmina RDP client with system-wide connection profiles.
|
|
# Q10 decisions: System-wide /etc/remmina/, Kerberos SSO, several TS,
|
|
# Fullscreen+Multi-Monitor, only Audio local redirection.
|
|
#
|
|
# Note on "Several TS": we ship a small placeholder list with one example.
|
|
# Add real TS endpoints in az.tc.rdp.servers below.
|
|
{config, lib, pkgs, ...}: let
|
|
inherit (lib) mkIf mkOption types;
|
|
cfg = config.az.tc;
|
|
|
|
# Helper: builds a .remmina profile for one TS
|
|
mkRemminaProfile = server: let
|
|
name = server.name;
|
|
fqdn = server.fqdn;
|
|
in
|
|
pkgs.writeTextFile {
|
|
name = "${lib.toLower name}.remmina";
|
|
destination = "/etc/remmina/${lib.toLower name}.remmina";
|
|
text = ''
|
|
[remmina]
|
|
name=${name}
|
|
protocol=RDP
|
|
server=${fqdn}
|
|
username=
|
|
domain=AZ-GROUP
|
|
security=
|
|
colordepth=32
|
|
resolution=multimonitor
|
|
viewmode=2
|
|
fullscreen=1
|
|
multimon=1
|
|
audio-mode=1
|
|
audiocapture=0
|
|
clipboard=both
|
|
quality=2
|
|
kerberos=1
|
|
enable-authecol=kerberos
|
|
disableclipboard=0
|
|
redirectsound=1
|
|
redirectprinter=0
|
|
redirectdrive=0
|
|
redirectusb=0
|
|
keyboard-grab=1
|
|
showcursor=1
|
|
'';
|
|
};
|
|
in {
|
|
options.az.tc.rdp = {
|
|
servers = mkOption {
|
|
type = types.listOf (types.submodule {
|
|
options = {
|
|
name = mkOption {
|
|
type = types.str;
|
|
description = "Display name (e.g. 'TS Berlin', 'TS ERP').";
|
|
};
|
|
fqdn = mkOption {
|
|
type = types.str;
|
|
description = "FQDN of the TS endpoint (e.g. 'ts-berlin.az-group.local').";
|
|
};
|
|
};
|
|
});
|
|
default = [
|
|
# TODO: fill real TS endpoints
|
|
{
|
|
name = "TS Berlin";
|
|
fqdn = "ts-berlin.az-group.local";
|
|
}
|
|
];
|
|
description = ''
|
|
List of Terminal Server endpoints. One Remmina profile per entry
|
|
is generated system-wide.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = with pkgs; [
|
|
remmina
|
|
freerdp3
|
|
];
|
|
|
|
# System-wide Remmina profiles
|
|
environment.etc = builtins.listToAttrs (builtins.map (server: {
|
|
name = "remmina/${lib.toLower server.name}.remmina";
|
|
value.source = (mkRemminaProfile server) + "/etc/remmina/${lib.toLower server.name}.remmina";
|
|
})
|
|
config.az.tc.rdp.servers);
|
|
|
|
# Allow Domain Users to read the system-wide profiles
|
|
systemd.tmpfiles.rules = [
|
|
"d /etc/remmina 0755 root root -"
|
|
];
|
|
};
|
|
}
|