4 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	f5d29be041	fix(ipa): harden script and update module docs ... Script fixes: - Rename HOSTNAME variable to TARGET (shadowed the bash builtin) - Fix ipa-getkeytab -s to always use IPA_SERVER, not DC_HOST (diverge if --dc is overridden to a jump host) - Remove dead REALM variable - Add EXIT trap to delete the plaintext keytab if the script aborts before sops encryption completes; cleared after successful encrypt - Distinguish real ipa host-add failures from "already exists" instead of swallowing all errors with || true - Warn explicitly when no platform age keys exist for the target (keytab would be admin-only and the host couldn't decrypt it at boot) - Fix sops fallback from pinned nixos-25.11 channel to nixpkgs (uses the repo's own flake.lock) - Expand "next steps" output to include networking.domain and nameservers lines that host.nix requires for IPA membership Module docs: - Point to the script as the primary setup path; move manual steps to a fallback section - Note that certs/ipa-ca.crt is already committed (no need to re-fetch) - Document the networking.domain and nameservers requirements in the header - Add sync-host-keys.sh as explicit step 0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 10:24:23 +10:00
beatzaplentyandClaude Sonnet 4.6	f6f30c675f	fix(ipa): stream keytab via sudo cat instead of scp ... ipa-getkeytab runs as root via sudo so the temp file is root-owned; scp as wayne gets Permission denied. Pipe through `sudo cat` over SSH instead, which reads as root but writes locally as the invoking user. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 09:08:19 +10:00
beatzaplentyandClaude Sonnet 4.6	27a8c7fad9	fix(ipa): SSH as wayne with sudo instead of root on domain controller ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 09:02:32 +10:00
beatzaplentyandClaude Sonnet 4.6	6c1891812e	feat(ipa): add create-nixos-ipa-host-account script ... Single command to enroll a NixOS host in FreeIPA and produce a sops-encrypted keytab at secrets/<hostname>.keytab: - Adds the .sops.yaml creation rule automatically (with all registered platform-variant age keys as recipients) - SSHes to the domain controller to run ipa host-add + ipa-getkeytab - Refreshes the admin Kerberos ticket via `ssh -t ... kinit admin` if missing or expired, so no manual kinit step is needed - SCPs the keytab and encrypts it in-place with sops (file must be at secrets/<hostname>.keytab before encryption so the path-based creation rule matches — the common failure point when doing this manually) Also adds HOME_DOMAIN and IPA_SERVER to scripts/env.sh, matching variables.nix's homeDomain/ipaServer (same manual-sync pattern as NIX_CACHE_HOST/LAN_DOMAIN). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 08:57:55 +10:00