fix(tailscale-router): stop dnsmasq from intercepting host DNS queries

NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds
127.0.0.1 to networking.nameservers and binds dnsmasq to listen-address=127.0.0.1.
This made the host route all its own DNS through dnsmasq, which had
no-resolv=true and no upstream for anything outside the tailnet domain —
so every non-tailscale DNS query from the host itself (including SSSD
resolving the IPA server FQDN after the IPA client module was added) failed.

Setting resolveLocalQueries=false limits dnsmasq to its intended role: a
forwarding proxy reachable on the LAN interface for IPA's conditional
forwarder. The host uses domainControllerIp directly (already set in
networking.nameservers in host.nix).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.sops.yaml

@@ -135,3 +135,13 @@ creation_rules:
           - *baremetal-gui
           - *linode-gui
           - *proxmox-gui
+
+  # Host keytab for tailscale-router FreeIPA enrollment (binary sops file).
+  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
+  - path_regex: secrets/tailscale-router\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *lxc-tailscale-router
+          - *proxmox-tailscale-router
+          - *linode-tailscale-router

hosts/tailscale-router/host.nix

@@ -6,6 +6,11 @@
       name = "tailscale-router";
       sopsFile = ../../secrets/tailscale-router.yaml;
     })
+    (import ../../modules/ipa/client.nix {
+      keytabSopsFile = ../../secrets/tailscale-router.keytab;
+      caCertFile     = ../../certs/ipa-ca.crt;
+    })
+
   ];
 
   networking = {

modules/tailscale/ts-dns-forwarder.nix

@@ -19,6 +19,14 @@
   # tailnet-specific subdomain (vars.tailnetDomain) instead.
   services.dnsmasq = {
     enable = true;
+    # NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds
+    # 127.0.0.1 to networking.nameservers and makes dnsmasq bind to
+    # listen-address=127.0.0.1. This instance is not the host's local
+    # resolver — it only serves IPA's conditional forwarder for tailnet names.
+    # The host uses domainControllerIp directly (networking.nameservers in
+    # host.nix). Without this, all host DNS goes through dnsmasq, which has
+    # no upstream for general queries (no-resolv=true), breaking resolution.
+    resolveLocalQueries = false;
     settings = {
       # Listen only on the LAN interface — not tailscale0 or loopback.
       # bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and

scripts/ipa/create-nixos-ipa-host-account.sh

@@ -17,17 +17,19 @@
 #
 # Options:
 #   --ip <addr>      Register this IP with the IPA host record (optional).
-#   --dc <host>      SSH as root to this host for ipa-getkeytab.
+#   --dc <host>      SSH to this host for ipa-getkeytab.
 #                    Default: $IPA_SERVER (from env.sh / environment).
-#   --dc-user <u>    SSH user on the domain controller. Default: root.
+#   --dc-user <u>    SSH user on the domain controller. Default: wayne.
 #   --dry-run        Print what would be done without making any changes.
 #   -h, --help       Show this message.
 #
 # Prereqs:
 #   1. Run from the repo root (so .sops.yaml and secrets/ are found).
-#   2. SSH access to the domain controller as --dc-user (default: root).
-#      If there's no valid Kerberos ticket on the DC, the script runs
-#      `kinit admin` there interactively — you'll be prompted for the IPA
+#   2. SSH access to the domain controller as --dc-user (default: wayne)
+#      with passwordless sudo (or sudo cached). IPA commands and kinit run
+#      as root via sudo so the Kerberos ticket is in root's cache where all
+#      ipa tools expect it. If there's no valid ticket, the script runs
+#      `sudo kinit admin` interactively — you'll be prompted for the IPA
 #      admin password once. The password never touches this script.
 #   3. The host's age key(s) must already be in .sops.yaml. Run
 #      scripts/secrets/sync-host-keys.sh <flake-target> first so the host
@@ -47,7 +49,7 @@ source "${SCRIPT_DIR}/../env.sh"
 # --- Argument parsing ---
 
 DC_HOST="${IPA_SERVER}"
-DC_USER="root"
+DC_USER="wayne"
 IP_ADDR=""
 DRY_RUN=false
 HOSTNAME=""
@@ -183,16 +185,15 @@ fi
 log "Adding FreeIPA host account: ${FQDN}"
 
 # Ensure there's a valid admin Kerberos ticket on the DC.
-# ipa host-add and ipa-getkeytab both need one. If the ticket is missing or
-# expired, run kinit admin interactively over SSH (ssh -t allocates a PTY so
-# kinit can prompt for the password normally — no password ever touches this
-# script or the shell history on either machine).
+# ipa host-add and ipa-getkeytab both need one. All IPA commands run via
+# sudo so the ticket must be in root's cache — check and refresh as root.
+# ssh -t allocates a PTY so kinit (and sudo if needed) can prompt normally;
+# no password ever touches this script or the shell history.
 if ! $DRY_RUN; then
-  if ! ssh "${DC_USER}@${DC_HOST}" "klist -s" &>/dev/null; then
-    log "No valid Kerberos ticket on ${DC_HOST} — running kinit admin"
-    ssh -t "${DC_USER}@${DC_HOST}" "kinit admin"
-    # Verify it actually worked before proceeding.
-    if ! ssh "${DC_USER}@${DC_HOST}" "klist -s" &>/dev/null; then
+  if ! ssh "${DC_USER}@${DC_HOST}" "sudo klist -s" &>/dev/null; then
+    log "No valid Kerberos ticket on ${DC_HOST} — running sudo kinit admin"
+    ssh -t "${DC_USER}@${DC_HOST}" "sudo kinit admin"
+    if ! ssh "${DC_USER}@${DC_HOST}" "sudo klist -s" &>/dev/null; then
       echo "Error: kinit admin failed or produced no valid ticket." >&2
       exit 1
     fi
@@ -207,7 +208,7 @@ IP_FLAG=""
 # --force: create the host record even if DNS doesn't resolve it yet.
 # Pipe through grep to suppress the "already exists" warning without
 # hiding real errors (ipa exits 1 for real errors, 0 for already-exists).
-HOST_ADD_CMD="ipa host-add '${FQDN}' ${IP_FLAG} --force 2>&1 | \
+HOST_ADD_CMD="sudo ipa host-add '${FQDN}' ${IP_FLAG} --force 2>&1 | \
   tee /dev/stderr | grep -q 'already exists' && echo '(host already registered)' || true"
 dc_run "bash -c \"${HOST_ADD_CMD}\""
 
@@ -215,16 +216,17 @@ dc_run "bash -c \"${HOST_ADD_CMD}\""
 
 log "Fetching keytab for host/${FQDN}"
 
-dc_run "ipa-getkeytab -s '${DC_HOST}' -p 'host/${FQDN}' -k '${DC_TMP}'"
+dc_run "sudo ipa-getkeytab -s '${DC_HOST}' -p 'host/${FQDN}' -k '${DC_TMP}'"
 
 if $DRY_RUN; then
-  echo "[dry-run] Would scp ${DC_USER}@${DC_HOST}:${DC_TMP} ${KEYTAB_SECRET}"
+  echo "[dry-run] Would stream ${DC_USER}@${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
 else
-  logn "Copying keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
-  scp "${DC_USER}@${DC_HOST}:${DC_TMP}" "${KEYTAB_SECRET}"
+  logn "Streaming keytab from ${DC_HOST}:${DC_TMP} → secrets/${HOSTNAME}.keytab"
+  # scp can't read a root-owned temp file as wayne; pipe through sudo cat instead.
+  ssh "${DC_USER}@${DC_HOST}" "sudo cat '${DC_TMP}'" > "${KEYTAB_SECRET}"
 
   logn "Removing temp file on ${DC_HOST}"
-  dc_run "rm -f '${DC_TMP}'"
+  dc_run "sudo rm -f '${DC_TMP}'"
 fi
 
 # --- Step 4: Encrypt in-place ---

secrets/tailscale-router.keytab

@@ -0,0 +1,26 @@
+{
+	"data": "ENC[AES256_GCM,data:+/1AAVha+86abQIX8tebqPJ6BIcCCiTJgPe0OfFOwA2Mcx0NJdiPtQgyeo3G8fAolIQOFkk5reL+GUhlOz4iEbPOCWwFCckdH0tXiCiVcD35qQNMRurY8HmpM5FWFnyzBkKuyNZ8okPuo2+fA3NQh3gs94rpm2kBsfS18xvrlv9b8u1JvAxlH6GRMN1uUgFGmOXlpGAVjDUFiKUHN8tRSZpsxG0aKKPBZ82JdKgYfCiCQifS1366gIFrsjGriUC+P8wkadRnD1JE2ZAGSL7wJLaRmzA4LAMGXFGbitOsFxKxX3q8VWEXaaL+9h4rTe0WCrvmgDM9NUeVHpfRiJrLvQgrFZMUxuZF66vQVsLybjIWpYYJcjC6nfR0U3lMa9gjzOTMPxm8HdGKC53FhLM1HiPoe1a2Nno283fV0uaByMPmo257O6l1CXqb6KoZOGFccm7fKR/VnFAS1AInF+szI7/r+UcaTW6LwYeV3OwLE4a8b4OiqTLgCu6v,iv:kUlVXF4Yl5HGvoLwu9loiuuDVtz0kARRiUU3K+BPL2A=,tag:pVaGzQAX9Etoqc5XMGmNeg==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6OUVUdkoxM1M5THlYZ1ky\nYWJ5RjhtRGoxTldwRkI2T1p6dHR4Y3gwR1ZrCjRDS1hTM01lZ0FSalBYQ1B0bENs\nUytXNmlrUkV4TmJkMUM1QW1ZaExIcGMKLS0tIHdHKzdEcUxvM0ZYUEp0a2d6SHp5\nYXQydy9uNG15V2FhUUd4NEFTMTNNMEUKkIzKEoYzoVs+nhnpkHFgDkQqrWykatND\ntsNxcr1SXSKeEW1m/QpXZnn/aW3zSQR09PqOHf7PYU47/AdkwrUaAg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByZENrck42dWJjR2hYUVBl\ncERtRjR6dTdING5nWXlBc3o3eXFhaSs5NkFRCk43QXFUeTBJR0U5dG9YTDRmQ0Yx\naEo2blUvUXNZY3dpbEZRTUx1elNzdkkKLS0tIHJwNjRNM3V6WktWZ1BlUUtLRTNI\nMTVEbCtYbllIbTdxTGozWUluS3pIRXMKZCruDIkD/JofdAHWgPuaaKTDsz408ZkY\n77mhO8J+kd03qwt6qhFC5KF1lyjhwEnqrOE195+R/8Yl7hA/DsL2ZQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1k7d2du5mejsmv5rzavm4xwgpthqvcfsehduquv28nzs53zppa3kqngfxq2"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxaC95RjYybzVlU2tYdHdU\naGJ4M2IvNkJwVlNIU0VCZEFUZk5VaksrVnpFCmJXS3luTG9WejR0Rk9DbHA3dngy\nRElFWjU1N2xuc3JaKzQ0L0U2Yktib1kKLS0tIFlrK3F0ZFh5Ync3ejVWMzRKTUx2\nZDhxdEMwa3B4TFZUcWdTdktDeGt1QUEKfgYnK2lW3cZuJGaw+bAKDipLuC4S5vK2\nxK2eJB5TP/xXrp0F3lx9sc2b1FOY9Vt9IQ7zVlBqJFkzJrcw8zYJJw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1zhfyuzlq40reuqlr34gf77852nhs3t6mqfzrqmas8z6sxk7tcfhsungrm0"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwOGFkSXNxTUIzLzR1Skk5\nMGZveHFDN3YwVmpwT3VTYkppWEU1aGVpdkhRCjZtRC92bVphd0ZFbzFxVzRUcGk4\nMUd1aWdEbFRaM01FT25JSVRoMTRsNUUKLS0tIDAybmcrYjFVWkFYaGY5TFZjcjFO\nYlZoQjJjN2lFNzd4RlJuSHFlRlNCOFEKgUIPnL2/OJgz9oMYt86/llHa7adTkhs6\n8yGYGV1wtU9aYtUMIR907SfYyZ6M4z8jH2wwzpQLbwQQMLgkejl1jg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1f7usptjx9rv4rxauasve200gxtdt9jkqhhdqstlf20wvlm7u75rsjfw50m"
+			}
+		],
+		"lastmodified": "2026-07-27T23:14:51Z",
+		"mac": "ENC[AES256_GCM,data:CYhzR0Y29GXvWUBbb13s16v9hDQ4k4Xmd4FUpcyNtHe0L/IrDGkx1WHzAohNGZjGMNB9W3BgiEH85OoOo8r1F82El4/8s2prEJi8AARvQU3+2cmRjjhNCCYQWmJkoF/cZNpw6nVyWzZdfUpPvHjbuf6utlI3rtR0qiCpSo/32S0=,iv:XLKTU2Ute4jMkfRAbXiVGxqP9+fjSs6HwRv1JfTTe7w=,tag:oIqS/1HWQZ7mLWaO7GwLFA==,type:str]",
+		"version": "3.13.2"
+	}
+}