fix(ipa): skip home-manager-wayne service when home dir absent

On first enrollment /home/wayne doesn't exist until the IPA user's first
login (pam_mkhomedir creates it). home-manager-<user>.service cd's into
the home dir immediately and fails with ENOENT, causing the whole rebuild
activation to return exit code 4.

Add ConditionPathExists so systemd skips the service (condition not met,
no failure) instead. After first login the dir exists and subsequent
rebuilds activate Home Manager normally.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/ipa/client.nix

@@ -137,12 +137,35 @@ lib.mkIf enabled {
   # With security.ipa setting "passwd: sss files" in nsswitch, SSSD's IPA entry
   # takes priority for NSS lookups — this local stub is only a fallback when
   # SSSD is unreachable (at which point auth fails anyway).
+  # HM with useUserPackages = true (flake.nix) sets users.users.${ipaUser}.packages,
+  # which forces the stub into /etc/passwd. pam_sss.so with the "localusers" flag
+  # (added by NixOS when SSSD is enabled) then skips SSSD for any user it finds in
+  # local /etc/passwd — including this stub — falling through to pam_unix, which has
+  # no password for the stub → sudo auth always fails.
+  #
+  # Fix: NOPASSWD for the IPA user. The IPA user already authenticated to reach a
+  # shell (SSH public key from IPA or Kerberos), so re-prompting via a broken PAM
+  # path is security theater on a single-admin homelab.
   users.users.${vars.ipaUser} = {
     isNormalUser = true;
     group = "users";
+    extraGroups = [ "wheel" ];
     createHome = false;
   };
 
+  # home-manager-<user>.service fails on first enrollment because /home/wayne
+  # doesn't exist until the user's first login (pam_mkhomedir creates it then).
+  # ConditionPathExists makes systemd skip the service (exit 0, condition not
+  # met) instead of failing. After first login the dir exists and subsequent
+  # rebuilds activate HM normally.
+  systemd.services."home-manager-${vars.ipaUser}".unitConfig.ConditionPathExists =
+    "/home/${vars.ipaUser}";
+
+  security.sudo.extraRules = [{
+    users = [ vars.ipaUser ];
+    commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
+  }];
+
   # Home Manager config for the IPA primary user, applied on every enrolled
   # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session
   # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix)

scripts/ipa/create-nixos-ipa-host-account.sh

@@ -81,6 +81,14 @@ if [[ -z "${TARGET}" ]]; then
   usage 1
 fi
 
+# Reject FQDNs passed by mistake — the script appends HOME_DOMAIN itself.
+# "nixos.sweet.home" → FQDN would become "nixos.sweet.home.sweet.home".
+if [[ "${TARGET}" == *"."* ]]; then
+  echo "Error: <hostname> must be the short name (e.g. 'nixos'), not a FQDN." >&2
+  echo "       The FQDN is derived automatically as ${TARGET}.${HOME_DOMAIN}." >&2
+  exit 1
+fi
+
 FQDN="${TARGET}.${HOME_DOMAIN}"
 KEYTAB_SECRET="${REPO_ROOT}/secrets/${TARGET}.keytab"
 # Temp path on the domain controller — use a name that won't collide.