3 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	f6f30c675f	fix(ipa): stream keytab via sudo cat instead of scp ... ipa-getkeytab runs as root via sudo so the temp file is root-owned; scp as wayne gets Permission denied. Pipe through `sudo cat` over SSH instead, which reads as root but writes locally as the invoking user. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 09:08:19 +10:00
beatzaplentyandClaude Sonnet 4.6	27a8c7fad9	fix(ipa): SSH as wayne with sudo instead of root on domain controller ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 09:02:32 +10:00
beatzaplentyandClaude Sonnet 4.6	6c1891812e	feat(ipa): add create-nixos-ipa-host-account script ... Single command to enroll a NixOS host in FreeIPA and produce a sops-encrypted keytab at secrets/<hostname>.keytab: - Adds the .sops.yaml creation rule automatically (with all registered platform-variant age keys as recipients) - SSHes to the domain controller to run ipa host-add + ipa-getkeytab - Refreshes the admin Kerberos ticket via `ssh -t ... kinit admin` if missing or expired, so no manual kinit step is needed - SCPs the keytab and encrypts it in-place with sops (file must be at secrets/<hostname>.keytab before encryption so the path-based creation rule matches — the common failure point when doing this manually) Also adds HOME_DOMAIN and IPA_SERVER to scripts/env.sh, matching variables.nix's homeDomain/ipaServer (same manual-sync pattern as NIX_CACHE_HOST/LAN_DOMAIN). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 08:57:55 +10:00