m3ta-chiron
98dc2917e8
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
71 lines
2.3 KiB
Nix
71 lines
2.3 KiB
Nix
# roles/thin-client/network/netbird.nix
|
|
#
|
|
# NetBird client for Thin Clients. Per-host setup-key via agenix.
|
|
# Q15 decisions: Per-Host Setup-Key, Corp DNS + NetBird DNS parallel,
|
|
# Client-only + accept-routes.
|
|
#
|
|
# SSH via NetBird: enabled (Q7).
|
|
{config, lib, pkgs, ...}: let
|
|
inherit (lib) mkIf mkOption types;
|
|
cfg = config.az.tc;
|
|
hostname = config.networking.hostName;
|
|
in {
|
|
options.az.tc.netbird = {
|
|
setupKeyFile = mkOption {
|
|
type = types.path;
|
|
default = ../../secrets/${hostname}-netbird-setupkey.age;
|
|
readOnly = true;
|
|
description = ''
|
|
agenix-encrypted NetBird setup key for this host. Provisioned in
|
|
the NetBird UI before first boot. Decrypted to
|
|
/run/agenix/netbird-setupkey (referenced by the systemd service).
|
|
'';
|
|
};
|
|
|
|
managementUrl = mkOption {
|
|
type = types.str;
|
|
default = "https://netbird.az-group.local:443"; # TODO: real URL
|
|
description = "NetBird management URL (self-hosted).";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
services.netbird.enable = true;
|
|
|
|
systemd.services.netbird = {
|
|
environment = {
|
|
NB_DISABLE_SSH_CONFIG = "false"; # we want SSH-via-NetBird
|
|
NB_MGMT_URL = config.az.tc.netbird.managementUrl;
|
|
NB_SETUP_KEY = "file:/run/agenix/${hostname}-netbird-setupkey";
|
|
};
|
|
path = with pkgs; [shadow util-linux];
|
|
|
|
after = ["age-identity.service" "network-online.target"];
|
|
wants = ["age-identity.service" "network-online.target"];
|
|
};
|
|
|
|
# Per-host setup key (agenix)
|
|
age.secrets."${hostname}-netbird-setupkey" = {
|
|
file = config.az.tc.netbird.setupKeyFile;
|
|
mode = "0400";
|
|
owner = "root";
|
|
group = "root";
|
|
};
|
|
|
|
# SSH config: allow SSH via NetBird hosts (the netbird binary acts as
|
|
# a ProxyCommand when the target is a NetBird peer).
|
|
programs.ssh.extraConfig = ''
|
|
Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
|
|
PreferredAuthentications publickey
|
|
PubkeyAuthentication yes
|
|
PasswordAuthentication no
|
|
ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
|
|
StrictHostKeyChecking accept-new
|
|
LogLevel ERROR
|
|
'';
|
|
|
|
# Loose reverse-path filter — required for overlay networks.
|
|
networking.firewall.checkReversePath = "loose";
|
|
};
|
|
}
|