m3ta-chiron
0cc0b5064d
Tiefen-Validierung via 'nix build .#nixosConfigurations.AZ-TC-NN.config.
system.build.toplevel' hat mehrere reale Bugs gefunden, die 'nix flake
check' nicht sah. Alle drei Pilot-Hosts bauen jetzt sauber durch.
Gefixst:
- freerdp3 → freerdp (umbenannt in nixpkgs-unstable)
- SDDM Theme.Logo will INI-Atom (string), nicht Nix-path → '${path}'
- security.pam.mount.extraVolumes will list-of-string, nicht ein String
- sudoers: 'domain admins' muss als 'domain\ admins' escaped werden
- agenix file-Pfade: ../../secrets/ → ../../../secrets/ (Tiefe korrigiert)
- snapper: config.services.snapper.package gibt es nicht → pkgs.snapper
- samba4Full entfernt (blockiert durch ceph-common python metadata issue
in nixpkgs-unstable; Thin Clients brauchen es nicht — cifs-utils reicht)
- corp-wifi-ca.pem durch gültiges Dummy-PEM ersetzt (openssl-generiert,
mit明显 REPLACE-MARKER; build kann PEM parsen)
Functional gemacht:
- Alloy: echtes River-Config mit loki.source.journal + loki.write statt
barem logging-stub. Journal-Logs mit host/unit/severity-Labels nach
Loki.
- Snipe-IT: echte Check-in-Logik via curl + jq. Lookup by asset_tag,
PATCH falls exists, POST falls neu. startAt täglich 03:30. API-Token
via agenix (snipeit-api-token.age).
- node_exporter push: realer curl-Push alle 60s mit retry on failure.
Safety:
- Placeholder-Assertions in roles/thin-client/default.nix: build schlägt
fehl, wenn wifi.ssid/hotline/company noch Placeholder sind (außer
site='staging'). Pilot-Hosts haben site='staging' bis echte Werte da.
- assets/corp-wifi-ca.pem hat deutlich sichtbaren REPLACE-Hinweis.
Neue Options:
- az.tc.monitoring.snipeItUrl (default: snipeit.az-group.local)
Neue Secrets (Placeholder .age-Files zum Ausfüllen):
- snipeit-api-token.age (fleet-wide shared)
83 lines
2.7 KiB
Nix
83 lines
2.7 KiB
Nix
# roles/thin-client/apps/rustdesk.nix
|
|
#
|
|
# RustDesk client (Hilfe annehmen) + daemon (unattended support).
|
|
# Q13 decisions: Beides (Client+Daemon), Self-hosted Server, Pre-Shared Key
|
|
# via agenix, Wayland portal pre-authorized, Permanent password via agenix.
|
|
{config, lib, pkgs, ...}: let
|
|
inherit (lib) mkIf mkOption types;
|
|
cfg = config.az.tc;
|
|
hostname = config.networking.hostName;
|
|
in {
|
|
options.az.tc.rustdesk = {
|
|
serverHost = mkOption {
|
|
type = types.str;
|
|
default = "rustdesk.az-group.local"; # TODO: real host
|
|
description = "Self-hosted RustDesk hbbs/hbbr endpoint (via NetBird).";
|
|
};
|
|
|
|
serverPort = mkOption {
|
|
type = types.int;
|
|
default = 21116;
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment = {
|
|
systemPackages = with pkgs; [rustdesk];
|
|
|
|
etc = {
|
|
# /etc/rustdesk/RustDesk.toml — daemon config. Pre-shared key and
|
|
# server endpoints go here. Permanent password is in a separate
|
|
# agenix secret and written to a path RustDesk reads.
|
|
"rustdesk/RustDesk.toml".text = ''
|
|
[options]
|
|
custom-rendezvous-server = ${config.az.tc.rustdesk.serverHost}
|
|
relay-server = ${config.az.tc.rustdesk.serverHost}
|
|
api-server = https://${config.az.tc.rustdesk.serverHost}
|
|
key = file:/run/agenix/rustdesk-psk
|
|
verification-method = fixed-password
|
|
permanent-password-file = /run/agenix/${hostname}-rustdesk-password
|
|
enable-wayland-screen-share = true
|
|
allow-auto-disconnect = false
|
|
'';
|
|
|
|
# Wayland portal pre-authorization for RustDesk — KDE-specific
|
|
# xdg portal config so the "screen capture" prompt is pre-approved.
|
|
"xdg-desktop-portal/kde-screen-share.conf".text = ''
|
|
[allowed]
|
|
rustdesk=true
|
|
'';
|
|
};
|
|
};
|
|
|
|
# Systemd service: RustDesk daemon (runs as root for unattended).
|
|
systemd.services.rustdesk = {
|
|
description = "RustDesk unattended support daemon";
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network-online.target" "age-identity.service"];
|
|
wants = ["network-online.target" "age-identity.service"];
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = "${pkgs.rustdesk}/bin/rustdesk --service";
|
|
Restart = "always";
|
|
RestartSec = "5s";
|
|
User = "root";
|
|
};
|
|
};
|
|
|
|
# Shared pre-shared key (one for all thin clients)
|
|
age.secrets."rustdesk-psk" = {
|
|
file = ../../../secrets/rustdesk-psk.age;
|
|
mode = "0400";
|
|
owner = "root";
|
|
};
|
|
|
|
# Per-host permanent password
|
|
age.secrets."${hostname}-rustdesk-password" = {
|
|
file = ../../../secrets/${hostname}-rustdesk-password.age;
|
|
mode = "0400";
|
|
owner = "root";
|
|
};
|
|
};
|
|
}
|