m3ta-chiron
98dc2917e8
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
95 lines
2.9 KiB
Nix
95 lines
2.9 KiB
Nix
# roles/thin-client/deployment/disko.nix
|
|
#
|
|
# BTRFS disk layout via Disko. Used by `nixos-anywhere` during provisioning.
|
|
# Q4 decisions: Standard persistent BTRFS, subvolumes @root and @home,
|
|
# zstd compression, snapper for / (NOT /home — privacy for multi-user).
|
|
#
|
|
# Apply during provisioning:
|
|
# nixos-anywhere --flake .#AZ-TC-01 \
|
|
# --disko disko-config ./roles/thin-client/deployment/disko.nix \
|
|
# root@<target-ip>
|
|
#
|
|
# This module sets `disko.devices` so the config can be referenced both
|
|
# for partitioning (nixos-anywhere --disko) and for fstab generation.
|
|
{config, lib, ...}: let
|
|
inherit (lib) mkIf mkOption types;
|
|
cfg = config.az.tc;
|
|
in {
|
|
options.az.tc.deployment = {
|
|
diskDevice = mkOption {
|
|
type = types.str;
|
|
default = "/dev/sda";
|
|
description = ''
|
|
Target disk device for the BTRFS layout. Typically /dev/sda or
|
|
/dev/nvme0n1. Override per-host in hosts/AZ-TC-NN/default.nix.
|
|
'';
|
|
};
|
|
|
|
swapSizeGB = mkOption {
|
|
type = types.int;
|
|
default = 4;
|
|
description = "Swap partition size in GB. Set 0 to disable swap.";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
disko.devices = {
|
|
disk.main = {
|
|
type = "disk";
|
|
device = config.az.tc.deployment.diskDevice;
|
|
content = {
|
|
type = "gpt";
|
|
partitions = {
|
|
ESP = {
|
|
size = "512M";
|
|
type = "EF00";
|
|
content = {
|
|
type = "filesystem";
|
|
format = "vfat";
|
|
mountpoint = "/boot";
|
|
mountOptions = ["umask=0077"];
|
|
};
|
|
};
|
|
swap = mkIf (config.az.tc.deployment.swapSizeGB > 0) {
|
|
size = "${toString config.az.tc.deployment.swapSizeGB}G";
|
|
content = {
|
|
type = "swap";
|
|
randomEncryption = true;
|
|
};
|
|
};
|
|
root = {
|
|
size = "100%";
|
|
content = {
|
|
type = "btrfs";
|
|
extraArgs = ["-f"]; # force overwrite
|
|
subvolumes = {
|
|
"@root" = {
|
|
mountpoint = "/";
|
|
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
|
};
|
|
"@home" = {
|
|
mountpoint = "/home";
|
|
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
|
};
|
|
"@nix" = {
|
|
mountpoint = "/nix";
|
|
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
|
};
|
|
"@persist" = {
|
|
mountpoint = "/persist";
|
|
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
|
};
|
|
"@snapshots" = {
|
|
mountpoint = "/.snapshots";
|
|
mountOptions = ["compress=zstd" "noatime" "ssd"];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|