feat(pxe-boot): enroll in FreeIPA domain

- Add IPA client module with pre-provisioned keytab
- Set networking.domain for correct Kerberos FQDN
- Encrypted keytab covers lxc-pxe-boot and proxmox-pxe-boot age keys

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.sops.yaml

@@ -146,12 +146,11 @@ creation_rules:
           - *linode-gui
           - *proxmox-gui
 
-  # Host keytab for tailscale-router FreeIPA enrollment (binary sops file).
+  # Host keytab for pxe-boot FreeIPA enrollment (binary sops file).
   # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
-  - path_regex: secrets/tailscale-router\.keytab$
+  - path_regex: secrets/pxe-boot\.keytab$
     key_groups:
       - age:
           - *admin
-          - *lxc-tailscale-router
+          - *lxc-pxe-boot
-          - *proxmox-tailscale-router
+          - *proxmox-pxe-boot
-          - *linode-tailscale-router

flake.lock

@@ -173,11 +173,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785119570,
+        "lastModified": 1784350909,
-        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
+        "narHash": "sha256-ZWyzLbS1yKUTeFJLmdVuWNnHttL333/ldJbEE+KzCrM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
+        "rev": "4ce190229c73d44536caa7072f6308fb2d8feeb3",
         "type": "github"
       },
       "original": {
@@ -259,11 +259,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1785104993,
+        "lastModified": 1784432872,
-        "narHash": "sha256-eKbrvPoAOFutbYMdbB3r5EQVmFxKv24iKqHPPUXA0gM=",
+        "narHash": "sha256-n3gKTBIV4ZA5VQpUakffBe3KGu4+mhPoA34rrqS0GkA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8623c4c20aa4ca2f5fb81510d2944066c3fb0d96",
+        "rev": "fd1462031fdee08f65fd0b4c6b64e22239a77870",
         "type": "github"
       },
       "original": {

hosts/pxe-boot/host.nix

@@ -1,8 +1,16 @@
 { vars, ... }:
 
 {
+  imports = [
+    (import ../../modules/ipa/client.nix {
+      keytabSopsFile = ../../secrets/pxe-boot.keytab;
+      caCertFile     = ../../certs/ipa-ca.crt;
+    })
+  ];
+
   networking = {
     hostName = "pxe-boot";
+    domain   = vars.homeDomain;
     useDHCP = false;
     interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
       address = vars.pxeServerIp;

modules/build-types/gui.nix

@@ -1,17 +1,6 @@
 { config, pkgs, lib, inputs, vars, ... }:
 
 {
-  imports = [
-    ../docker/enable-service.nix
-  ];
-
-  nixpkgs.overlays = [
-    (final: prev: {
-      docker = prev.docker_29;
-      docker_cli = prev.docker_29;
-    })
-  ];
-
   environment.systemPackages = with pkgs; [
     inputs.nixos-conf-editor.packages.${pkgs.stdenv.hostPlatform.system}.nixos-conf-editor
     nodejs
@@ -29,7 +18,7 @@
   ];
 
   boot.loader.grub.useOSProber = true;
-  programs.direnv.enable = true;
+programs.direnv.enable = true;
   services = {
     xserver = {
       enable = true;

modules/docker/enable-service.nix

@@ -1,4 +1,4 @@
-{ pkgs, vars, ... }:
+{ pkgs, ... }:
 
 {
   #  virtualisation.docker.enable = true;
@@ -15,7 +15,7 @@
     #    experimental = true;
     #  };
   };
-  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
+
   environment.systemPackages = with pkgs; [
     docker-compose
     docker-buildx

modules/tailscale/ts-dns-forwarder.nix

@@ -19,14 +19,6 @@
   # tailnet-specific subdomain (vars.tailnetDomain) instead.
   services.dnsmasq = {
     enable = true;
-    # NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds
-    # 127.0.0.1 to networking.nameservers and makes dnsmasq bind to
-    # listen-address=127.0.0.1. This instance is not the host's local
-    # resolver — it only serves IPA's conditional forwarder for tailnet names.
-    # The host uses domainControllerIp directly (networking.nameservers in
-    # host.nix). Without this, all host DNS goes through dnsmasq, which has
-    # no upstream for general queries (no-resolv=true), breaking resolution.
-    resolveLocalQueries = false;
     settings = {
       # Listen only on the LAN interface — not tailscale0 or loopback.
       # bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and

secrets/pxe-boot.keytab

@@ -0,0 +1,22 @@
+{
+	"data": "ENC[AES256_GCM,data:Q++XWxg9tvY7ugT8+8FWCC5jgOfQ1+LYLsnqN0/WGxTf5XT2VmoXvszcE/ow2BUOBG3qBTXS3OHYFPwmj1GgaBHB8rpdXX6+LveSBE2gmx1VR+NUDTxy+0/DBq411MK9n/J9eIYcybdFIE11biFSAob9EgfxBF5roCDXIPDPyVCSe6LyhNvqYPnGQsfHCbejSewLTcRQEiguP9BX96CpMPIpmaB9fHN25t5RWCgMI7MtacrRxRsyKg44+2FZstXdZrp2Wv9u86BxqdAFqtZE8qpPeGdrdzluZx9jhnw0wZPzHdKg5wS7/UrLCb0UxIQiDxDMDuuBuLGkKXfAhb6SGZU41wWAWYk548iGRUaG+79BO4HhRZNObOFvfsjpMXEfcH/Vbv/wHVY4OpJUPe/ZWK4wpL9YrY4nT0t62HH7MirOy1uhwLE50h2+6dHKj6ur5G7thkSqgzVWXQ==,iv:zaRBwS+gfXLhH30havn6Q2+oPWuLV3qBfbOj00kewlQ=,tag:Vr5iEQ2u+9YNahryhgzwSw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArTGJnaVhleUtsWnlITE1s\nNmRCaW1QWTFNSG5LRFdmb1lzRlV5NWl3YTBNCmF6eUN6RkJBZzc0MmJJa0dKTW01\ncVh4K1VLR2lURUpKQXpxNGpQNnpSUlUKLS0tIFJONnJFWkNCR3pqalRsUW9POVBj\nQ0pFQ3ltKzBETTVXTW5sV1ppWTFJc1kKzxUboNZO+Nwn2eTWy11VP9w1pRswCHaJ\nE2dYU0oUOClVzc0oSuIJxraG6TPj1N4WGC24gS+UmpkmSuCiOeZBsw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDSmxNR1I3dUFKT0xUVG9h\nWkRIakNVeWRQOEN3blNRVjZlWHF4K2NRa0hBClRiOXlmTTJ4T2JTUEw2c1l0R2N2\nMnRwdDA5bEZlQWJRTm9vUmNKclBSU1EKLS0tIFcyeDFjbTZyVEVDUjN1VzU1VHly\nNWNDMW9rTXY2bHNWYVR0SmtMckovUzQKhTWr6yFVW9am3okCiIswwqR5+/p9OLmB\nWCgPtwoFaBt1RjUXPK4/eS4LlucR2K6V/mNMn4xVsnkIl193U9632g==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age16j42pdc5dr6wnj7xayhkqdj2rny9u68fcqejs50hqq42scssh4gsnrrnlt"
+			},
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2ME9CbmVGcENRWksyL0pW\nOEJyUGhpbGMwWlBhVXBSeXQ2MW1EWnFuR0E4CnMwU0pjdk1YMzF5ZEhTVFlBaHZq\nam94UWVGbjhZSEx6VHBmem9JRWgwYzAKLS0tIHFJZWRyRjRHNzhXdDJSYWN3bDlR\nYVp3eGJWWkh3Y09ZWElyclZQN1ZSVFkKjR32//EcFAdMjVlNgky5zvVkwXwEN68D\nrkTuHKjiO5aV7yAQGPkdNw0UM0oRGF0u4YF3oOUcZfSvnKgDeoi2Zw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1ug787sgt6st6k82fgkrug2lzltw4qsukrrqqs3w27ewwqj8rg4hsxcmylz"
+			}
+		],
+		"lastmodified": "2026-07-28T00:27:46Z",
+		"mac": "ENC[AES256_GCM,data:AbJIHYcFpeanQsJ3x7RPL9Yjlg5BJgkepKax0fL9L/PpA03Antab93iUNG95Mp6k/duovp8Jm445lbuppDZq1dh9ij/deBa8GbzJ50wwEe9zMc3EwRKScpqZEhRPF7KlJsIjsHJyd8NkcI5ji49XkHb4Ae1//8zG5HpVgy+3b04=,iv:uxQCbMwMIfP5S1dbsvIx3F79YWEguxwox8T0YZvUBdc=,tag:3utjmBGDmPc8q4JjaXvCkA==,type:str]",
+		"version": "3.13.2"
+	}
+}