Merge pull request 'feat(ipa/docker): grant docker access via IPA group membership' (#90) from worktree-docker-ipa-group into main

Reviewed-on: #90

modules/docker/enable-service.nix

@@ -1,10 +1,16 @@
-{ pkgs, vars, ... }:
+{ lib, pkgs, vars, ... }:
 
 {
   virtualisation.docker = {
     enable = true;
     package = pkgs.docker;
   };
+  # Pin the docker group GID to match the IPA "docker-access" group so that
+  # IPA group membership alone grants access to the Docker socket. Any user
+  # whose supplementary groups (resolved by SSSD from IPA) include GID
+  # vars.dockerAccessGid will pass the socket group-permission check without
+  # any per-host users.groups.docker.members entry.
+  users.groups.docker.gid = lib.mkForce vars.dockerAccessGid;
   users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
   environment.systemPackages = with pkgs; [
     docker-compose