fix(docker): declaratively apply groupmod --non-unique for IPA GID conflict

NixOS's group activation uses plain groupmod, which silently skips the
GID change when SSSD exposes the same GID (50010) via the IPA
docker-access group through NSS.  Add an activation script that runs
after the normal 'groups' step and applies groupmod --non-unique so the
local docker group can share GID 50010 with the SSSD-provided IPA group.
If the GID actually changes on a live system the script also restarts
docker.socket + docker.service so the socket is recreated with the new
GID.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/build-types/docker.nix

@@ -33,9 +33,6 @@
   ];
 
   users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
-  # Grant the IPA domain user docker access via the local group so that
-  # `wayne` can manage containers without sudo.
-  users.groups.docker.members = [ "wayne" ];
   services.openssh.settings.PermitRootLogin = "yes";
 
   networking.firewall.allowedTCPPorts = [

modules/docker/enable-service.nix

@@ -1,13 +1,45 @@
-{ pkgs, vars, ... }:
+{ lib, pkgs, vars, ... }:
 
+let
+  gid = toString vars.dockerAccessGid;
+in
 {
   virtualisation.docker = {
     enable = true;
     package = pkgs.docker;
   };
+  # Pin the docker group GID to match the IPA "docker-access" group so that
+  # IPA group membership alone grants access to the Docker socket. Any user
+  # whose supplementary groups (resolved by SSSD from IPA) include GID
+  # vars.dockerAccessGid will pass the socket group-permission check without
+  # any per-host users.groups.docker.members entry.
+  users.groups.docker.gid = lib.mkForce vars.dockerAccessGid;
   users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
   environment.systemPackages = with pkgs; [
     docker-compose
     docker-buildx
   ];
+
+  # NixOS's group activation uses plain `groupmod` without --non-unique.
+  # When SSSD is active it exposes the IPA "docker-access" group at
+  # vars.dockerAccessGid via NSS, so groupmod sees that GID as already in
+  # use and silently skips the change (warning: "not applying GID change").
+  # This script runs after the normal "groups" step and applies the change
+  # with --non-unique (which lets the local docker group share the GID with
+  # the SSSD-provided IPA group). If the GID actually changed it also
+  # restarts docker.socket so the socket is recreated with the new GID.
+  system.activationScripts.docker-group-gid = {
+    deps = [ "groups" ];
+    text = ''
+      current=$(grep "^docker:" /etc/group | cut -d: -f3)
+      if [ "$current" != "${gid}" ]; then
+        ${pkgs.shadow}/bin/groupmod --non-unique -g ${gid} docker
+        if ${pkgs.systemd}/bin/systemctl is-active --quiet docker.socket; then
+          ${pkgs.systemd}/bin/systemctl stop docker.service docker.socket
+          rm -f /var/run/docker.sock
+          ${pkgs.systemd}/bin/systemctl start docker.socket docker.service
+        fi
+      fi
+    '';
+  };
 }

modules/ipa/client.nix

@@ -38,47 +38,122 @@ lib.mkIf enabled {
   networking.domain = lib.mkDefault vars.homeDomain;
   networking.nameservers = lib.mkDefault [ vars.domainControllerIp ];
 
-  security.ipa = {
-    enable = true;
-    domain = vars.homeDomain;
-    inherit realm;
-    server = vars.ipaServer;
-    certificate = caCertPkg;
-    inherit basedn;
-    ipaHostname = fqdn;
-    offlinePasswords = true;
-    cacheCredentials = true;
+  security = {
+    ipa = {
+      enable = true;
+      domain = vars.homeDomain;
+      inherit realm;
+      server = vars.ipaServer;
+      certificate = caCertPkg;
+      inherit basedn;
+      ipaHostname = fqdn;
+      offlinePasswords = true;
+      cacheCredentials = true;
+    };
+
+    # Create the home directory on first login if it doesn't exist yet.
+    # IPA users have no pre-created home on the host; without this sshd
+    # opens a session to a non-existent directory and resets the connection.
+    # lightdm also needs this so the GUI login path can create the home dir
+    # if it was not pre-seeded by the tmpfiles rule above (e.g. on first boot
+    # before SSSD has resolved the user).
+    pam.services = {
+      sshd.makeHomeDir = true;
+      lightdm.makeHomeDir = true;
+
+      # pam_unix returns PAM_AUTHINFO_UNAVAIL without prompting when the local
+      # stub has "!" in shadow (account locked), so PAM_AUTHTOK is never set
+      # and pam_sss's use_first_pass fails with "No authentication token".
+      # Changing to try_first_pass makes pam_sss prompt independently when no
+      # prior module has set the token, restoring IPA password login via
+      # LightDM and su.
+      login.rules.auth.sss.settings = lib.mkForce { try_first_pass = true; };
+      su.rules.auth.sss.settings = lib.mkForce { try_first_pass = true; };
+    };
+
+    # HM with useUserPackages = true (flake.nix) sets users.users.${ipaUser}.packages,
+    # which forces the stub into /etc/passwd. pam_sss.so with the "localusers" flag
+    # (added by NixOS when SSSD is enabled) then skips SSSD for any user it finds in
+    # local /etc/passwd — including this stub — falling through to pam_unix, which has
+    # no password for the stub → sudo auth always fails.
+    #
+    # Fix: NOPASSWD for the IPA user. The IPA user already authenticated to reach a
+    # shell (SSH public key from IPA or Kerberos), so re-prompting via a broken PAM
+    # path is security theater on a single-admin homelab.
+    sudo.extraRules = [{
+      users = [ vars.ipaUser ];
+      commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
+    }];
   };
 
-  # Fetch SSH public keys from IPA so users can log in with the key stored
-  # in their IPA profile rather than needing ~/.ssh/authorized_keys on every
-  # host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP).
-  #
-  # /nix/store is 1775 (group-writable by nixbld). OpenSSH 10.0+ rejects
-  # AuthorizedKeysCommand binaries whose path contains any group-writable
-  # component, silently skipping the command. Copy to /usr/local/bin (all
-  # components root-owned, 755) so the path passes sshd's safety check.
-  systemd.tmpfiles.rules = [
-    "d /usr/local 0755 root root - -"
-    "d /usr/local/bin 0755 root root - -"
-    "C+ /usr/local/bin/sss_ssh_authorizedkeys 0555 root root - ${pkgs.sssd}/bin/sss_ssh_authorizedkeys"
-    # Pre-create the IPA user's home dir so Home Manager activation succeeds
-    # even before their first login. On a fresh system SSSD may not have
-    # resolved the user yet — tmpfiles warns and skips in that case (non-fatal),
-    # and pam_mkhomedir covers the first-login path as a fallback.
-    "d /home/${vars.ipaUser} 0700 ${vars.ipaUser} ${vars.ipaUser} - -"
-  ];
+  systemd = {
+    # Fetch SSH public keys from IPA so users can log in with the key stored
+    # in their IPA profile rather than needing ~/.ssh/authorized_keys on every
+    # host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP).
+    #
+    # /nix/store is 1775 (group-writable by nixbld). OpenSSH 10.0+ rejects
+    # AuthorizedKeysCommand binaries whose path contains any group-writable
+    # component, silently skipping the command. Copy to /usr/local/bin (all
+    # components root-owned, 755) so the path passes sshd's safety check.
+    tmpfiles.rules = [
+      "d /usr/local 0755 root root - -"
+      "d /usr/local/bin 0755 root root - -"
+      "C+ /usr/local/bin/sss_ssh_authorizedkeys 0555 root root - ${pkgs.sssd}/bin/sss_ssh_authorizedkeys"
+      # Pre-create the IPA user's home dir so Home Manager activation succeeds
+      # even before their first login. On a fresh system SSSD may not have
+      # resolved the user yet — tmpfiles warns and skips in that case (non-fatal),
+      # and pam_mkhomedir covers the first-login path as a fallback.
+      "d /home/${vars.ipaUser} 0700 ${vars.ipaUser} ${vars.ipaUser} - -"
+    ];
+
+    # security.ipa enables Kerberos (security.krb5) which causes systemd to
+    # start auth-rpcgss-module.service and rpc-gssd.service for Kerberos NFS
+    # authentication. LXC containers can't load the auth_rpcgss kernel module
+    # and don't have /var/lib/nfs/rpc_pipefs, so both services fail.
+    #
+    # The NixOS IPA module already adds a drop-in for auth-rpcgss-module.service
+    # with ConditionPathExists=/etc/krb5.keytab. We use lib.mkForce to win the
+    # text conflict and add ConditionVirtualization=!container alongside it so
+    # the service is skipped (not failed) in containers that do have a keytab.
+    # Same fix for rpc-gssd.service which also fails in containers.
+    units = lib.mkIf config.boot.isContainer {
+      "auth-rpcgss-module.service" = {
+        overrideStrategy = "asDropinIfExists";
+        text = lib.mkForce ''
+          [Unit]
+          ConditionPathExists=
+          ConditionPathExists=/etc/krb5.keytab
+          ConditionVirtualization=!container
+        '';
+      };
+      # rpc-gssd also has ConditionPathExists from the NixOS IPA module (and an
+      # X-Restart-Triggers store path from systemd.nix). Use mkForce to win;
+      # omit X-Restart-Triggers since this service is skipped in containers anyway.
+      "rpc-gssd.service" = {
+        overrideStrategy = "asDropinIfExists";
+        text = lib.mkForce ''
+          [Unit]
+          ConditionPathExists=
+          ConditionPathExists=/etc/krb5.keytab
+          ConditionVirtualization=!container
+        '';
+      };
+    };
+
+    # home-manager-<user>.service fails on first enrollment because /home/wayne
+    # doesn't exist until the user's first login (pam_mkhomedir creates it then).
+    # ConditionPathExists makes systemd skip the service (exit 0, condition not
+    # met) instead of failing. After first login the dir exists and subsequent
+    # rebuilds activate HM normally.
+    services."home-manager-${vars.ipaUser}".unitConfig.ConditionPathExists =
+      "/home/${vars.ipaUser}";
+  };
 
   services.openssh.extraConfig = ''
     AuthorizedKeysCommand /usr/local/bin/sss_ssh_authorizedkeys %u
     AuthorizedKeysCommandUser nobody
   '';
 
-  # Create the home directory on first login if it doesn't exist yet.
-  # IPA users have no pre-created home on the host; without this sshd
-  # opens a session to a non-existent directory and resets the connection.
-  security.pam.services.sshd.makeHomeDir = true;
-
   # Host keytab: pre-provisioned on the IPA server, sops-encrypted binary.
   # Placed at /etc/krb5.keytab before SSSD starts so the host authenticates
   # to IPA without running ipa-client-install.
@@ -92,44 +167,6 @@ lib.mkIf enabled {
     restartUnits = [ "sssd.service" ];
   };
 
-  # security.ipa enables Kerberos (security.krb5) which causes systemd to
-  # start auth-rpcgss-module.service and rpc-gssd.service for Kerberos NFS
-  # authentication. LXC containers can't load the auth_rpcgss kernel module
-  # and don't have /var/lib/nfs/rpc_pipefs, so both services fail.
-  #
-  # The NixOS IPA module already adds a drop-in for auth-rpcgss-module.service
-  # with ConditionPathExists=/etc/krb5.keytab. We use lib.mkForce to win the
-  # text conflict and add ConditionVirtualization=!container alongside it so
-  # the service is skipped (not failed) in containers that do have a keytab.
-  # Same fix for rpc-gssd.service which also fails in containers.
-  systemd.units = lib.mkIf config.boot.isContainer {
-    "auth-rpcgss-module.service" = {
-      overrideStrategy = "asDropinIfExists";
-      text = lib.mkForce ''
-        [Unit]
-        ConditionPathExists=
-        ConditionPathExists=/etc/krb5.keytab
-        ConditionVirtualization=!container
-      '';
-    };
-    # rpc-gssd also has ConditionPathExists from the NixOS IPA module (and an
-    # X-Restart-Triggers store path from systemd.nix). Use mkForce to win;
-    # omit X-Restart-Triggers since this service is skipped in containers anyway.
-    "rpc-gssd.service" = {
-      overrideStrategy = "asDropinIfExists";
-      text = lib.mkForce ''
-        [Unit]
-        ConditionPathExists=
-        ConditionPathExists=/etc/krb5.keytab
-        ConditionVirtualization=!container
-      '';
-    };
-  };
-
-  # Home Manager config for the IPA primary user, applied on every enrolled
-  # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session
-  # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix)
-  # so they don't need to be repeated here.
   # NixOS requires isNormalUser/isSystemUser + group on any entry in
   # users.users. HM with useUserPackages = true (set in flake.nix) adds a stub
   # entry for each HM user so it can install packages to
@@ -137,35 +174,20 @@ lib.mkIf enabled {
   # With security.ipa setting "passwd: sss files" in nsswitch, SSSD's IPA entry
   # takes priority for NSS lookups — this local stub is only a fallback when
   # SSSD is unreachable (at which point auth fails anyway).
-  # HM with useUserPackages = true (flake.nix) sets users.users.${ipaUser}.packages,
-  # which forces the stub into /etc/passwd. pam_sss.so with the "localusers" flag
-  # (added by NixOS when SSSD is enabled) then skips SSSD for any user it finds in
-  # local /etc/passwd — including this stub — falling through to pam_unix, which has
-  # no password for the stub → sudo auth always fails.
-  #
-  # Fix: NOPASSWD for the IPA user. The IPA user already authenticated to reach a
-  # shell (SSH public key from IPA or Kerberos), so re-prompting via a broken PAM
-  # path is security theater on a single-admin homelab.
   users.users.${vars.ipaUser} = {
     isNormalUser = true;
     group = "users";
     extraGroups = [ "wheel" ];
     createHome = false;
+    # "!" is not a password hash — it is the standard "account locked" marker.
+    # It cannot authenticate anyone locally. It exists solely so NixOS generates
+    # a shadow entry for this stub user; without one pam_unix returns
+    # PAM_AUTHINFO_UNAVAIL before prompting, which means PAM_AUTHTOK is never
+    # set and the subsequent pam_sss use_first_pass call has nothing to work
+    # with — blocking LightDM and su logins even when IPA/SSSD auth succeeds.
+    hashedPassword = "!";
   };
 
-  # home-manager-<user>.service fails on first enrollment because /home/wayne
-  # doesn't exist until the user's first login (pam_mkhomedir creates it then).
-  # ConditionPathExists makes systemd skip the service (exit 0, condition not
-  # met) instead of failing. After first login the dir exists and subsequent
-  # rebuilds activate HM normally.
-  systemd.services."home-manager-${vars.ipaUser}".unitConfig.ConditionPathExists =
-    "/home/${vars.ipaUser}";
-
-  security.sudo.extraRules = [{
-    users = [ vars.ipaUser ];
-    commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
-  }];
-
   # Home Manager config for the IPA primary user, applied on every enrolled
   # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session
   # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix)

variables.nix

@@ -85,6 +85,12 @@
   # that IPA itself doesn't cover: dotfiles, user packages, session variables.
   ipaUser = "wayne";
 
+  # GID of the IPA "docker-access" group (GID 50010 on the IPA server).
+  # The local "docker" group is pinned to this GID on every host that runs
+  # Docker so that IPA group membership alone grants docker socket access -
+  # no per-host users.groups.docker.members entry for the IPA user needed.
+  dockerAccessGid = 50010;
+
   # HA file server cluster
   # LAN IPs (vmbr0 / ens18) — client-facing: iSCSI initiators, NFS, management.
   # Storage IPs (vmbr1 / ens19) — isolated internal bridge, used for DRBD