feat(pxe-boot): enroll in FreeIPA domain

- Add IPA client module with pre-provisioned keytab
- Set networking.domain for correct Kerberos FQDN
- Encrypted keytab covers lxc-pxe-boot and proxmox-pxe-boot age keys

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.sops.yaml

@@ -63,6 +63,16 @@ creation_rules:
           - *lxc-nix-cache
           - *proxmox-nix-cache
 
+  # Host keytab for nix-cache FreeIPA enrollment (binary sops file).
+  # Generate with: sops -e --input-type binary /tmp/nix-cache.keytab > secrets/nix-cache.keytab
+  - path_regex: secrets/nix-cache\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *linode-nix-cache
+          - *lxc-nix-cache
+          - *proxmox-nix-cache
+
   - path_regex: secrets/server\.yaml$
     key_groups:
       - age:
@@ -117,6 +127,16 @@ creation_rules:
   # scripts/secrets/sync-host-keys.sh yet, so whichever variant is actually
   # deployed next needs its recipient added here (and `sops updatekeys` rerun)
   # before it can decrypt this.
+  # Host keytab for tailscale-router FreeIPA enrollment (binary sops file).
+  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
+  - path_regex: secrets/tailscale-router\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *lxc-tailscale-router
+          - *proxmox-tailscale-router
+          - *linode-tailscale-router
+
   - path_regex: secrets/gui\.yaml$
     key_groups:
       - age:
@@ -126,72 +146,11 @@ creation_rules:
           - *linode-gui
           - *proxmox-gui
 
-  # IPA host keytabs (binary sops files).
-  # Each keytab is encrypted for all platform variants of that host so any
-  # deployed variant can decrypt it at boot. Run
-  # scripts/ipa/create-nixos-ipa-host-account.sh <hostname> to enroll a new
-  # host and produce the keytab; this section is updated by that script.
-
-  - path_regex: secrets/nix-cache\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *linode-nix-cache
-          - *lxc-nix-cache
-          - *proxmox-nix-cache
-
-  - path_regex: secrets/tailscale-router\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *linode-tailscale-router
-          - *lxc-tailscale-router
-          - *proxmox-tailscale-router
-
+  # Host keytab for pxe-boot FreeIPA enrollment (binary sops file).
+  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
   - path_regex: secrets/pxe-boot\.keytab$
     key_groups:
       - age:
           - *admin
           - *lxc-pxe-boot
           - *proxmox-pxe-boot
-
-  # nixos = the workstation (hosts/nixos/host.nix). All gui platform variants
-  # share the hostname "nixos" and must be able to decrypt at boot.
-  - path_regex: secrets/nixos\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *baremetal-gui
-          - *lxc-gui
-          - *proxmox-gui
-          - *linode-gui
-
-  - path_regex: secrets/server\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *linode-server
-          - *lxc-server
-          - *proxmox-server
-
-  - path_regex: secrets/docker\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *linode-docker
-          - *lxc-docker
-          - *proxmox-docker
-
-  - path_regex: secrets/tor-relay\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *lxc-tor-relay
-
-  - path_regex: secrets/nix-minimal\.keytab$
-    key_groups:
-      - age:
-          - *admin
-          - *lxc-minimal
-          - *proxmox-minimal
-          - *linode-minimal

flake.lock

@@ -173,11 +173,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785119570,
-        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
+        "lastModified": 1784350909,
+        "narHash": "sha256-ZWyzLbS1yKUTeFJLmdVuWNnHttL333/ldJbEE+KzCrM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
+        "rev": "4ce190229c73d44536caa7072f6308fb2d8feeb3",
         "type": "github"
       },
       "original": {
@@ -259,11 +259,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1785104993,
-        "narHash": "sha256-eKbrvPoAOFutbYMdbB3r5EQVmFxKv24iKqHPPUXA0gM=",
+        "lastModified": 1784432872,
+        "narHash": "sha256-n3gKTBIV4ZA5VQpUakffBe3KGu4+mhPoA34rrqS0GkA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8623c4c20aa4ca2f5fb81510d2944066c3fb0d96",
+        "rev": "fd1462031fdee08f65fd0b4c6b64e22239a77870",
         "type": "github"
       },
       "original": {

hosts/nix-cache/host.nix

@@ -6,10 +6,15 @@
       name = "nix-cache";
       sopsFile = ../../secrets/nix-cache.yaml;
     })
+    (import ../../modules/ipa/client.nix {
+      keytabSopsFile = ../../secrets/nix-cache.keytab;
+      caCertFile = ../../certs/ipa-ca.crt;
+    })
   ];
 
   networking = {
     hostName = vars.nixCacheHost;
+    domain = vars.homeDomain;
     useDHCP = false;
     interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
       address = vars.nixCacheIp;

hosts/pxe-boot/host.nix

@@ -1,8 +1,16 @@
 { vars, ... }:
 
 {
+  imports = [
+    (import ../../modules/ipa/client.nix {
+      keytabSopsFile = ../../secrets/pxe-boot.keytab;
+      caCertFile     = ../../certs/ipa-ca.crt;
+    })
+  ];
+
   networking = {
     hostName = "pxe-boot";
+    domain   = vars.homeDomain;
     useDHCP = false;
     interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
       address = vars.pxeServerIp;

hosts/tailscale-router/host.nix

@@ -6,10 +6,15 @@
       name = "tailscale-router";
       sopsFile = ../../secrets/tailscale-router.yaml;
     })
+    (import ../../modules/ipa/client.nix {
+      keytabSopsFile = ../../secrets/tailscale-router.keytab;
+      caCertFile = ../../certs/ipa-ca.crt;
+    })
   ];
 
   networking = {
     hostName = "tailscale-router";
+    domain = vars.homeDomain;
     useDHCP = false;
     interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
       address = vars.tailscaleRouterIp;

modules/build-types/gui.nix

@@ -1,17 +1,6 @@
 { config, pkgs, lib, inputs, vars, ... }:
 
 {
-  imports = [
-    ../docker/enable-service.nix
-  ];
-
-  nixpkgs.overlays = [
-    (final: prev: {
-      docker = prev.docker_29;
-      docker_cli = prev.docker_29;
-    })
-  ];
-
   environment.systemPackages = with pkgs; [
     inputs.nixos-conf-editor.packages.${pkgs.stdenv.hostPlatform.system}.nixos-conf-editor
     nodejs
@@ -29,7 +18,7 @@
   ];
 
   boot.loader.grub.useOSProber = true;
-  programs.direnv.enable = true;
+programs.direnv.enable = true;
   services = {
     xserver = {
       enable = true;

modules/common/configuration.nix

@@ -6,7 +6,6 @@
       # Include the results of the hardware scan.
       #      ./hardware-configuration.nix
       ./set-locale.nix
-      ../ipa/client.nix
     ];
   # Use the GRUB 2 boot loader.
   # boot.loader.grub.enable = true;

modules/docker/enable-service.nix

@@ -1,4 +1,4 @@
-{ pkgs, vars, ... }:
+{ pkgs, ... }:
 
 {
   #  virtualisation.docker.enable = true;
@@ -15,7 +15,7 @@
     #    experimental = true;
     #  };
   };
-  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
+
   environment.systemPackages = with pkgs; [
     docker-compose
     docker-buildx

modules/ipa/client.nix

@@ -1,15 +1,34 @@
 # Fully declarative FreeIPA domain membership.
 #
-# Imported by modules/common/configuration.nix — no per-host wiring needed.
-# Enables itself automatically on any host that has a sops-encrypted keytab
-# at secrets/<hostname>.keytab; is a no-op for all other hosts.
+# Configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a
+# pre-provisioned host keytab via sops-nix so no imperative ipa-client-install
+# step is needed after deployment.
 #
-# To enroll a new host:
-#   0. scripts/secrets/sync-host-keys.sh <flake-target>
-#   1. scripts/ipa/create-nixos-ipa-host-account.sh [--ip <addr>] <hostname>
-#      (adds .sops.yaml rule, runs ipa host-add, encrypts keytab in one step)
-#   2. git add secrets/<hostname>.keytab .sops.yaml && git commit
-#   3. Deploy — no further steps required.
+# Usage (in a host.nix imports list):
+#   (import ../../modules/ipa/client.nix {
+#     keytabSopsFile = ../../secrets/<hostname>.keytab;
+#     caCertFile     = ../../certs/ipa-ca.crt;  # already committed — do not re-fetch
+#   })
+#
+# The host.nix networking block must also set:
+#   networking.domain   = vars.homeDomain;         # needed for Kerberos FQDN
+#   networking.nameservers = [ vars.domainControllerIp ];  # IPA DNS
+#
+# One-time operator setup per host (do this BEFORE deploying):
+#
+#   0. Generate SSH host keys and the host's age key for sops:
+#        scripts/secrets/sync-host-keys.sh <flake-target>
+#      This must run before step 1 so the host age key is in .sops.yaml
+#      and the keytab can be encrypted for the host to read at boot.
+#
+#   1. Add the IPA host account and produce the sops-encrypted keytab:
+#        scripts/ipa/create-nixos-ipa-host-account.sh [--ip <addr>] <hostname>
+#      The script handles ipa host-add, ipa-getkeytab, .sops.yaml patching,
+#      and sops encryption in one step. See the script header for details.
+#
+#   2. Wire up the host (see "Usage" above), then deploy:
+#        nixos-rebuild switch  (or create-proxmox-resource.sh)
+#      No further manual enrollment steps are required after deployment.
 #
 # Manual fallback (if the script isn't usable):
 #   a. On the FreeIPA server: ipa host-add <fqdn> [--ip-address=<ip>] --force
@@ -21,23 +40,18 @@
 #
 # vars dependencies: homeDomain, ipaServer, domainControllerIp
 
+{ keytabSopsFile, caCertFile }:
 { config, lib, pkgs, vars, ... }:
 
 let
-  keytabPath = ../../secrets + "/${config.networking.hostName}.keytab";
-  enabled = builtins.pathExists keytabPath;
-
   realm = lib.strings.toUpper vars.homeDomain;
   fqdn = "${config.networking.hostName}.${vars.homeDomain}";
   # "sweet.home" -> "dc=sweet,dc=home"
   basedn = lib.strings.concatMapStringsSep "," (c: "dc=${c}") (lib.strings.splitString "." vars.homeDomain);
   # security.ipa.certificate expects a derivation (package), not a raw path.
-  caCertPkg = pkgs.writeText "ipa-ca.crt" (builtins.readFile ../../certs/ipa-ca.crt);
+  caCertPkg = pkgs.writeText "ipa-ca.crt" (builtins.readFile caCertFile);
 in
-lib.mkIf enabled {
-  networking.domain = lib.mkDefault vars.homeDomain;
-  networking.nameservers = lib.mkDefault [ vars.domainControllerIp ];
-
+{
   security.ipa = {
     enable = true;
     domain = vars.homeDomain;
@@ -78,7 +92,7 @@ lib.mkIf enabled {
   # Placed at /etc/krb5.keytab before SSSD starts so the host authenticates
   # to IPA without running ipa-client-install.
   sops.secrets."ipa-host-keytab" = {
-    sopsFile = keytabPath;
+    sopsFile = keytabSopsFile;
     format = "binary";
     path = "/etc/krb5.keytab";
     owner = "root";

modules/tailscale/ts-dns-forwarder.nix

@@ -19,14 +19,6 @@
   # tailnet-specific subdomain (vars.tailnetDomain) instead.
   services.dnsmasq = {
     enable = true;
-    # NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds
-    # 127.0.0.1 to networking.nameservers and makes dnsmasq bind to
-    # listen-address=127.0.0.1. This instance is not the host's local
-    # resolver — it only serves IPA's conditional forwarder for tailnet names.
-    # The host uses domainControllerIp directly (networking.nameservers in
-    # host.nix). Without this, all host DNS goes through dnsmasq, which has
-    # no upstream for general queries (no-resolv=true), breaking resolution.
-    resolveLocalQueries = false;
     settings = {
       # Listen only on the LAN interface — not tailscale0 or loopback.
       # bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and