feat(reference): add deployment profiles for environment-specific con…

[vadika]

…figuration

Introduce a deployment profile system that separates deployment-specific
settings (logging endpoints, security policies, networking) from use-case
profiles.

This allows the same Ghaf build to be customized for different deployment
environments without modifying core profile definitions.

New files:

• modules/reference/deployments/default.nix: Core options for logging,
  business-vm, networking, security, features, and branding
• modules/reference/deployments/tii-internal.nix: TII internal deployment
• modules/reference/deployments/demo.nix: Demo/conference deployment
• modules/reference/deployments/flake-module.nix: Flake integration

Usage:
ghaf.reference.deployments.profiles.tii-internal.enable = true;

The mvp-user-trial profile now reads from deployment settings when available,
falling back to current defaults for backward compatibility.

WireGuard VPN:

• wireguard.enable: Toggle WireGuard GUI (default: true for backward compat)
• wireguard.enabledVms: List of VMs where WireGuard GUI is enabled
• wireguard.preConfiguredPeers: Pre-configured WireGuard peers

Identity Provider (AD/LDAP):

• identity.provider: Select auth backend (none/azure-ad/ldap/local)
• identity.azure.*: Azure AD configuration (tenantId, clientId, domain)
• identity.ldap.*: LDAP configuration (serverUri, baseDn, bindDn, etc.)

Update mvp-user-trial.nix to read wireguard-gui setting from deployment
profile, allowing per-deployment control over VPN availability.

Example usage:
ghaf.reference.deployments.profiles.tii-internal.enable = true;
# WireGuard enabled by default for tii-internal

ghaf.reference.deployments.profiles.demo.enable = true;
# WireGuard disabled for demo deployments"

Description of Changes

Type of Change

• New Feature
• Bug Fix
• Improvement / Refactor

Related Issues / Tickets

Checklist

• Clear summary in PR description
• Detailed and meaningful commit message(s)
• Commits are logically organized and squashed if appropriate
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• Author has run make-checks and it passes
• All automatic GitHub Action checks pass - see actions
• Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

• Orin AGX aarch64
• Orin NX aarch64
• Lenovo X1 x86_64
• Dell Latitude x86_64
• System 76 x86_64

Installation Method

• Requires full re-installation
• Can be updated with nixos-rebuild ... switch
• Other:

Test Steps To Verify:

Nothing should change.

[milva-unikie]

Orin-AGX is failing in jenkins-pre-merge pipeline because net-vm is not sending any logs even though it is running. Orin-NX has the same issue, but on NX that case is skipped due to unrelated reasons.

[ghaf@ghaf-host:~]$ systemctl show microvm@net-vm.service
...
ActiveState=active
SubState=running
...

[ghaf@ghaf-host:~]$ journalctl -b -u microvm@net-vm.service
-- No entries --