Merge pull request 'feat(ipa/docker): grant docker access via IPA group membership' (#90) from worktree-docker-ipa-group into main

Reviewed-on: #90
2026-07-28 05:48:45 +00:00
parent 6f602b2245 5beed2d75c
commit a960c662f0
4 changed files with 112 additions and 97 deletions
@@ -85,6 +85,12 @@
  # that IPA itself doesn't cover: dotfiles, user packages, session variables.
  ipaUser = "wayne";

+  # GID of the IPA "docker-access" group (GID 50010 on the IPA server).
+  # The local "docker" group is pinned to this GID on every host that runs
+  # Docker so that IPA group membership alone grants docker socket access -
+  # no per-host users.groups.docker.members entry for the IPA user needed.
+  dockerAccessGid = 50010;
+
  # HA file server cluster
  # LAN IPs (vmbr0 / ens18) — client-facing: iSCSI initiators, NFS, management.
  # Storage IPs (vmbr1 / ens19) — isolated internal bridge, used for DRBD