2 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	8955840f0a	fix(ipa): use in-place sops encryption in module docs ... sops matches creation rules against the input file path, so encrypting /tmp/<host>.keytab directly with stdout redirect fails to find the rule. Copy to secrets/ first, then use -i to encrypt in-place. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 07:19:53 +10:00
beatzaplentyandClaude Sonnet 4.6	f4bbd6331d	feat(ipa): add reusable declarative FreeIPA client module ... Adds modules/ipa/client.nix — a parameterized module that joins a NixOS host to the sweet.home FreeIPA domain without ipa-client-install. It configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a pre-provisioned host keytab via sops-nix binary secret so enrollment is fully reproducible from the flake. - variables.nix: adds ipaServer (FQDN of the FreeIPA KDC; security.ipa.server requires a hostname, not an IP, for Kerberos/TLS) - certs/ipa-ca.crt: placeholder for the IPA CA public certificate (operator replaces with: curl http://<ipa-server>/ipa/config/ca.crt) - secrets/nix-cache.keytab: placeholder binary sops file (operator replaces with the encrypted keytab after ipa host-add + ipa-getkeytab) - .sops.yaml: adds creation rule for secrets/nix-cache.keytab (same recipients as secrets/nix-cache.yaml) - hosts/nix-cache/host.nix: imports the IPA client module; adds networking.domain so the host's FQDN resolves correctly Module header documents the three operator steps needed per host before deploy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-27 23:31:21 +10:00