6 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	f5d29be041	fix(ipa): harden script and update module docs ... Script fixes: - Rename HOSTNAME variable to TARGET (shadowed the bash builtin) - Fix ipa-getkeytab -s to always use IPA_SERVER, not DC_HOST (diverge if --dc is overridden to a jump host) - Remove dead REALM variable - Add EXIT trap to delete the plaintext keytab if the script aborts before sops encryption completes; cleared after successful encrypt - Distinguish real ipa host-add failures from "already exists" instead of swallowing all errors with || true - Warn explicitly when no platform age keys exist for the target (keytab would be admin-only and the host couldn't decrypt it at boot) - Fix sops fallback from pinned nixos-25.11 channel to nixpkgs (uses the repo's own flake.lock) - Expand "next steps" output to include networking.domain and nameservers lines that host.nix requires for IPA membership Module docs: - Point to the script as the primary setup path; move manual steps to a fallback section - Note that certs/ipa-ca.crt is already committed (no need to re-fetch) - Document the networking.domain and nameservers requirements in the header - Add sync-host-keys.sh as explicit step 0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 10:24:23 +10:00
beatzaplentyandClaude Sonnet 4.6	f46ae18672	fix(ipa): work around OpenSSH 10 AuthorizedKeysCommand path check ... OpenSSH 10.0 tightened AuthorizedKeysCommand security by checking every path component of the command binary for group/world-write permission. /nix/store is 1775 (group-writable by nixbld), so sshd silently skips the command for any binary in the Nix store — causing IPA pubkey auth to silently fail with no diagnostic. Fix: copy sss_ssh_authorizedkeys to /usr/local/bin via systemd tmpfiles (C+ copies the file rather than symlinking, so the path at runtime is root-owned/755 throughout), and point AuthorizedKeysCommand at the copy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 10:08:57 +10:00
beatzaplentyandClaude Sonnet 4.6	97019205da	fix(ipa): create home dir on first login + AuthorizedKeysCommand ... - security.pam.services.sshd.makeHomeDir: IPA users have no pre-created home directory on the host; without this, sshd opens a session to a missing directory and resets the connection immediately after auth - AuthorizedKeysCommand was already added in previous commit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 09:47:11 +10:00
beatzaplentyandClaude Sonnet 4.6	5487490b8e	feat(ipa): add AuthorizedKeysCommand + enroll tailscale-router ... - modules/ipa/client.nix: add AuthorizedKeysCommand so sshd fetches SSH public keys from IPA via sss_ssh_authorizedkeys, enabling pubkey login without per-host authorized_keys files - hosts/tailscale-router/host.nix: add IPA client module + networking.domain so SSSD runs and wayne can authenticate on this host - secrets/tailscale-router.keytab: sops-encrypted keytab for tailscale-router.sweet.home (generated by create-nixos-ipa-host-account.sh) - .sops.yaml: creation rule for secrets/tailscale-router.keytab Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 09:42:38 +10:00
beatzaplentyandClaude Sonnet 4.6	8955840f0a	fix(ipa): use in-place sops encryption in module docs ... sops matches creation rules against the input file path, so encrypting /tmp/<host>.keytab directly with stdout redirect fails to find the rule. Copy to secrets/ first, then use -i to encrypt in-place. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 07:19:53 +10:00
beatzaplentyandClaude Sonnet 4.6	f4bbd6331d	feat(ipa): add reusable declarative FreeIPA client module ... Adds modules/ipa/client.nix — a parameterized module that joins a NixOS host to the sweet.home FreeIPA domain without ipa-client-install. It configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a pre-provisioned host keytab via sops-nix binary secret so enrollment is fully reproducible from the flake. - variables.nix: adds ipaServer (FQDN of the FreeIPA KDC; security.ipa.server requires a hostname, not an IP, for Kerberos/TLS) - certs/ipa-ca.crt: placeholder for the IPA CA public certificate (operator replaces with: curl http://<ipa-server>/ipa/config/ca.crt) - secrets/nix-cache.keytab: placeholder binary sops file (operator replaces with the encrypted keytab after ipa host-add + ipa-getkeytab) - .sops.yaml: adds creation rule for secrets/nix-cache.keytab (same recipients as secrets/nix-cache.yaml) - hosts/nix-cache/host.nix: imports the IPA client module; adds networking.domain so the host's FQDN resolves correctly Module header documents the three operator steps needed per host before deploy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-27 23:31:21 +10:00