m3ta-chiron
98dc2917e8
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
113 lines
3.5 KiB
Nix
113 lines
3.5 KiB
Nix
# roles/thin-client/network/wifi.nix
|
|
#
|
|
# 802.1X EAP-TLS WiFi via NetworkManager + wpa_supplicant backend.
|
|
# Q8 decisions: EAP-TLS, per-machine client cert, AD CS 3-5y lifetime,
|
|
# single Corp SSID.
|
|
#
|
|
# Per-host secrets (via agenix):
|
|
# secrets/<hostname>-wifi-client.pem.age
|
|
# → decrypted to /etc/wifi/client.pem
|
|
# Contains the full PKCS#12 export OR combined PEM (cert + key).
|
|
# Mode 0600, owner root.
|
|
#
|
|
# CA cert is NOT secret — checked into the repo as a public file under
|
|
# roles/thin-client/network/assets/corp-wifi-ca.pem. Replace placeholder
|
|
# with real AD CS root cert.
|
|
{config, lib, pkgs, ...}: let
|
|
inherit (lib) mkIf mkOption types;
|
|
cfg = config.az.tc;
|
|
hostname = config.networking.hostName;
|
|
in {
|
|
options.az.tc.wifi = {
|
|
ssid = mkOption {
|
|
type = types.str;
|
|
default = "AZ-CORP"; # TODO: real SSID
|
|
description = "Corporate SSID for thin clients.";
|
|
};
|
|
|
|
caCert = mkOption {
|
|
type = types.path;
|
|
default = ./assets/corp-wifi-ca.pem;
|
|
description = ''
|
|
Corporate WiFi CA certificate (PEM format, not secret — checked
|
|
into the repo). Replace the placeholder with the real AD CS root
|
|
cert.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
# Disable iwd explicitly — wpa_supplicant is the backend we use.
|
|
# Note: NetworkManager with `wifi.backend = "wpa_supplicant"` automatically
|
|
# sets networking.wireless.enable = true (it owns wpa_supplicant).
|
|
networking.wireless.iwd.enable = false;
|
|
|
|
networking.networkmanager = {
|
|
enable = true;
|
|
wifi.backend = "wpa_supplicant";
|
|
};
|
|
|
|
# Declarative NetworkManager profile for corp WiFi (EAP-TLS).
|
|
# NixOS has no built-in `ensureProfiles` option in the
|
|
# `networking.networkmanager` namespace, so we write the
|
|
# `.nmconnection` file directly to the system-connections dir.
|
|
# NetworkManager picks it up on restart.
|
|
environment.etc."NetworkManager/system-connections/${config.az.tc.wifi.ssid}.nmconnection".source =
|
|
pkgs.writeText "${config.az.tc.wifi.ssid}.nmconnection" ''
|
|
[connection]
|
|
id=${config.az.tc.wifi.ssid}
|
|
type=wifi
|
|
autoconnect=true
|
|
permissions=
|
|
|
|
[wifi]
|
|
mode=infrastructure
|
|
ssid=${config.az.tc.wifi.ssid}
|
|
|
|
[wifi-security]
|
|
key-mgmt=wpa-eap
|
|
|
|
[802-1x]
|
|
eap=tls
|
|
identity=${hostname}$
|
|
ca-cert=${config.az.tc.wifi.caCert}
|
|
client-cert=/etc/wifi/client.pem
|
|
private-key=/etc/wifi/client.pem
|
|
private-key-password=
|
|
phase2-auth=
|
|
|
|
[ipv4]
|
|
method=auto
|
|
|
|
[ipv6]
|
|
method=auto
|
|
'';
|
|
|
|
# `environment.etc` files are owned by root but world-readable by
|
|
# default — make this profile root-only since it references the cert
|
|
# path (the cert itself is root-only via agenix).
|
|
systemd.tmpfiles.rules = [
|
|
"d /etc/wifi 0700 root root -"
|
|
];
|
|
|
|
# CA cert installed system-wide as trust anchor (defensive)
|
|
security.pki.certificateFiles = [config.az.tc.wifi.caCert];
|
|
|
|
# Per-host client cert (via agenix)
|
|
age.secrets."${hostname}-wifi-client-cert" = {
|
|
file = ../../secrets/${hostname}-wifi-client-cert.age;
|
|
path = "/etc/wifi/client.pem";
|
|
mode = "0600";
|
|
owner = "root";
|
|
group = "root";
|
|
};
|
|
|
|
# Directory for the cert — NetworkManager reads it as root.
|
|
# Ensure wpa_supplicant doesn't try to use the cert before agenix decrypted it.
|
|
systemd.services.NetworkManager-wait-online = {
|
|
after = ["age-identity.service"];
|
|
wants = ["age-identity.service"];
|
|
};
|
|
};
|
|
}
|