m3ta-chiron
98dc2917e8
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
83 lines
2.7 KiB
Nix
83 lines
2.7 KiB
Nix
# roles/thin-client/apps/rustdesk.nix
|
|
#
|
|
# RustDesk client (Hilfe annehmen) + daemon (unattended support).
|
|
# Q13 decisions: Beides (Client+Daemon), Self-hosted Server, Pre-Shared Key
|
|
# via agenix, Wayland portal pre-authorized, Permanent password via agenix.
|
|
{config, lib, pkgs, ...}: let
|
|
inherit (lib) mkIf mkOption types;
|
|
cfg = config.az.tc;
|
|
hostname = config.networking.hostName;
|
|
in {
|
|
options.az.tc.rustdesk = {
|
|
serverHost = mkOption {
|
|
type = types.str;
|
|
default = "rustdesk.az-group.local"; # TODO: real host
|
|
description = "Self-hosted RustDesk hbbs/hbbr endpoint (via NetBird).";
|
|
};
|
|
|
|
serverPort = mkOption {
|
|
type = types.int;
|
|
default = 21116;
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment = {
|
|
systemPackages = with pkgs; [rustdesk];
|
|
|
|
etc = {
|
|
# /etc/rustdesk/RustDesk.toml — daemon config. Pre-shared key and
|
|
# server endpoints go here. Permanent password is in a separate
|
|
# agenix secret and written to a path RustDesk reads.
|
|
"rustdesk/RustDesk.toml".text = ''
|
|
[options]
|
|
custom-rendezvous-server = ${config.az.tc.rustdesk.serverHost}
|
|
relay-server = ${config.az.tc.rustdesk.serverHost}
|
|
api-server = https://${config.az.tc.rustdesk.serverHost}
|
|
key = file:/run/agenix/rustdesk-psk
|
|
verification-method = fixed-password
|
|
permanent-password-file = /run/agenix/${hostname}-rustdesk-password
|
|
enable-wayland-screen-share = true
|
|
allow-auto-disconnect = false
|
|
'';
|
|
|
|
# Wayland portal pre-authorization for RustDesk — KDE-specific
|
|
# xdg portal config so the "screen capture" prompt is pre-approved.
|
|
"xdg-desktop-portal/kde-screen-share.conf".text = ''
|
|
[allowed]
|
|
rustdesk=true
|
|
'';
|
|
};
|
|
};
|
|
|
|
# Systemd service: RustDesk daemon (runs as root for unattended).
|
|
systemd.services.rustdesk = {
|
|
description = "RustDesk unattended support daemon";
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network-online.target" "age-identity.service"];
|
|
wants = ["network-online.target" "age-identity.service"];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = "${pkgs.rustdesk}/bin/rustdesk --service";
|
|
Restart = "always";
|
|
RestartSec = "5s";
|
|
User = "root";
|
|
};
|
|
};
|
|
|
|
# Shared pre-shared key (one for all thin clients)
|
|
age.secrets."rustdesk-psk" = {
|
|
file = ../../secrets/rustdesk-psk.age;
|
|
mode = "0400";
|
|
owner = "root";
|
|
};
|
|
|
|
# Per-host permanent password
|
|
age.secrets."${hostname}-rustdesk-password" = {
|
|
file = ../../secrets/${hostname}-rustdesk-password.age;
|
|
mode = "0400";
|
|
owner = "root";
|
|
};
|
|
};
|
|
}
|