Archived
beatzaplentyandClaude Sonnet 4.6
afabcbbeff
Secret Scan / Scan for secrets and sensitive config (push) Failing after 5s
Documents and scripts to reproduce the IPA integration on the Pi (raspberrypi.tail13f623.ts.net, Debian 12 bookworm): - setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1) - setup-docker-ipa-gid.sh: pins local docker group GID to 50010 via groupmod --non-unique so IPA docker-access group membership alone grants docker socket access (mirrors NixOS lib.mkForce approach) - README.md + CLAUDE.md: quick-start, current status, guardrails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
54 lines
2.0 KiB
Bash
54 lines
2.0 KiB
Bash
#!/bin/bash
|
|
# Pin the local 'docker' group GID to match the IPA 'docker-access' group
|
|
# (GID 50010) so that IPA group membership alone grants docker socket access.
|
|
#
|
|
# On Debian, GID 50010 is already present via SSSD (the IPA group), so
|
|
# groupmod requires --non-unique to allow the local docker group to share
|
|
# it. The docker.socket + docker.service pair must be fully stopped before
|
|
# removing the stale socket so systemd recreates it with the new GID.
|
|
#
|
|
# Idempotent — exits 0 without touching anything if the GID is already 50010.
|
|
#
|
|
# Run as root after setup-ipa-sudo.sh has been applied and docker is running.
|
|
#
|
|
# Usage: sudo ./setup-docker-ipa-gid.sh
|
|
set -euo pipefail
|
|
|
|
DOCKER_ACCESS_GID=50010
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
if ! command -v docker &>/dev/null; then
|
|
echo "ERROR: docker not found -- install Docker before running this script." >&2
|
|
exit 1
|
|
fi
|
|
|
|
current_gid=$(getent group docker | cut -d: -f3)
|
|
if [ "$current_gid" = "$DOCKER_ACCESS_GID" ]; then
|
|
echo "docker group is already GID ${DOCKER_ACCESS_GID} -- nothing to do."
|
|
exit 0
|
|
fi
|
|
|
|
echo "Changing docker group GID: ${current_gid} -> ${DOCKER_ACCESS_GID}"
|
|
|
|
# SSSD exposes GID 50010 via the IPA docker-access group, so groupmod sees
|
|
# it as already in use. --non-unique lets the local docker group share it.
|
|
groupmod --non-unique -g "${DOCKER_ACCESS_GID}" docker
|
|
|
|
echo "Restarting docker to recreate socket with new GID..."
|
|
systemctl stop docker.service docker.socket
|
|
rm -f /var/run/docker.sock
|
|
systemctl start docker.socket docker.service
|
|
|
|
actual_gid=$(stat -c '%g' /var/run/docker.sock)
|
|
if [ "$actual_gid" != "$DOCKER_ACCESS_GID" ]; then
|
|
echo "ERROR: socket GID is ${actual_gid}, expected ${DOCKER_ACCESS_GID}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Done. Docker socket is now GID ${DOCKER_ACCESS_GID} (docker / docker-access)."
|
|
echo "IPA members of the 'docker-access' group can now run docker without explicit local group membership."
|