From 44a0acc18f9688d174a6914e5656c7d3d03ffbba Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Tue, 28 Jul 2026 12:59:46 +1000
Subject: [PATCH] fix(ipa): add wheel group to IPA user stub for sudo access

initgroups() uses NSS (groups: files sss) to build the supplemental
group list at login. Adding wheel to the local users.users stub means
the IPA user gets wheel membership from /etc/group, satisfying sudo's
group check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 modules/ipa/client.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix
index 7b6800e..af9612c 100644
--- a/modules/ipa/client.nix
+++ b/modules/ipa/client.nix
@@ -140,6 +140,7 @@ lib.mkIf enabled {
   users.users.${vars.ipaUser} = {
     isNormalUser = true;
     group = "users";
+    extraGroups = [ "wheel" ];
     createHome = false;
   };