m3ta-chiron
98dc2917e8
Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts. Architektur: - roles/thin-client/ als geschlossene Rolle (default.nix compose + 7 Subdirectories: hardware, session, identity, network, peripherals, apps, monitoring, deployment) - hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host - flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper - secrets.nix mit per-host agenix-Secret-Stubs Submodule: - hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback - identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy - session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer), PipeWire Audio - network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened firewall, OpenSSH - peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares - apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS, Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart - monitoring: node_exporter → Pushgateway, Alloy (stub für Loki), Snipe-IT Asset-Checkin (stub) - deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window, snapper snapshots Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03. Siehe roles/thin-client/README.md für den Provisionierungs-Workflow und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare in den jeweiligen Modulen).
86 lines
2.6 KiB
Nix
86 lines
2.6 KiB
Nix
# roles/thin-client/session/branding.nix
|
|
#
|
|
# Light branding: corporate wallpaper, SDDM logo overlay, Breeze Light,
|
|
# Property-of-footer (hostname + IT hotline) on the lock screen.
|
|
# Q17 decisions: Light Branding, no login banner, user may adjust KDE.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
inherit (lib) mkIf;
|
|
cfg = config.az.tc;
|
|
in {
|
|
options.az.tc.branding = {
|
|
hotline = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "+49 30 1234567"; # TODO: real hotline
|
|
description = "IT-Hotline phone number for the property-of footer.";
|
|
};
|
|
wallpaper = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = ./assets/wallpaper.svg;
|
|
description = ''
|
|
Path to a corporate wallpaper image (JPEG or SVG). Replace
|
|
`roles/thin-client/session/assets/wallpaper.svg` with the real
|
|
asset, or override this option.
|
|
'';
|
|
};
|
|
logo = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = ./assets/logo.svg;
|
|
description = ''
|
|
Path to the corporate logo (SVG or PNG). Used in SDDM and lock
|
|
screen footer.
|
|
'';
|
|
};
|
|
company = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "AzIntec GmbH";
|
|
description = "Company name shown in the property-of footer.";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment = {
|
|
etc = {
|
|
# Wallpaper — install to /etc/az-wallpaper so KDE's wallpaper plugin
|
|
# can find it via the standard search path.
|
|
"az-wallpaper".source = config.az.tc.branding.wallpaper;
|
|
|
|
# Default Plasma configuration as /etc/xdg — KDE reads these as
|
|
# the system-wide defaults. User-specific changes are layered on top.
|
|
"xdg/kdeglobals".text = ''
|
|
[General]
|
|
ColorScheme=Breeze Light
|
|
|
|
[KDE]
|
|
widgetStyle=Breeze
|
|
|
|
[Icons]
|
|
Theme=breeze
|
|
|
|
[Wallpaper]
|
|
Image=file:///etc/az-wallpaper
|
|
'';
|
|
|
|
# Lock-screen footer (rendered by kscreenlocker_greet).
|
|
"xdg/kscreenlockerrc".text = ''
|
|
[Greeter]
|
|
Logo=${config.az.tc.branding.logo}
|
|
Footer=${config.az.tc.branding.company} · ${config.networking.hostName} · IT-Hotline: ${config.az.tc.branding.hotline}
|
|
'';
|
|
};
|
|
};
|
|
|
|
# Property-of-footer via SDDM theme config. Lightweight: we don't
|
|
# ship a full custom SDDM theme — we just set the footer string that
|
|
# the default Breeze SDDM theme shows.
|
|
services.displayManager.sddm.settings.Theme = {
|
|
Wallpaper = config.az.tc.branding.wallpaper;
|
|
Logo = config.az.tc.branding.logo;
|
|
};
|
|
};
|
|
}
|