Merge pull request 'fix(ipa): suppress Kerberos NFS services in LXC containers' (#84) from worktree-ipa-lxc-kerberos-fix into main

Reviewed-on: #84

modules/common/aliases.nix

@@ -1,7 +1,50 @@
-_:
+{ config, pkgs, lib, vars, ... }:
 
+let
+  # Flake attribute names are now <platform>-<buildtype> (e.g. proxmox-docker)
+  # and no longer match networking.hostName, since a host's hostname stays
+  # fixed while the platform backing it can change. Each nixosConfiguration
+  # stamps its own active target name into /etc/flake-target at build time.
+  mySwitchCmd = ''
+    sudo nixos-rebuild switch \
+      --no-write-lock-file \
+      --refresh \
+      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+  '';
+  myTestCmd = ''
+    sudo nixos-rebuild test \
+      --no-write-lock-file \
+      --refresh \
+      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+  '';
+
+  # lxc-* hosts pre-seed their SSH host key at build time (see
+  # modules/platforms/lxc.nix) so sops-nix's .sops.yaml recipient matches on
+  # first boot -- without it, secrets permanently fail to decrypt (see that
+  # file's comment for the confirmed failure). That requires --impure plus
+  # NIXOS_HOST_KEYS_DIR pointing at the repo's host-keys/ dir, same pattern
+  # docs/auto-installer.md uses for the installer ISO. A function, not a
+  # shellAlias, since the target name has to interpolate into the middle of
+  # the flake attribute path, not just append after it. Must be run from the
+  # repo root, same as every other host-keys/ command in this repo.
+  buildImageFn = ''
+    buildImage() {
+      if [ -z "$1" ]; then
+        echo "usage: buildImage <flake-target>  (e.g. lxc-docker)" >&2
+        return 1
+      fi
+      NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
+        ".#nixosConfigurations.$1.config.system.build.tarball"
+    }
+  '';
+in
 {
-  # Switch-nix, Test-nix, and buildImage are defined system-wide in
-  # modules/common/configuration.nix so all users (including IPA accounts)
-  # get them. Add any Home-Manager-only per-user shell config here.
+  programs.bash = {
+    enable = true;
+    shellAliases = {
+      "Switch-nix" = mySwitchCmd;
+      "Test-nix" = myTestCmd;
+    };
+    initExtra = buildImageFn;
+  };
 }

modules/common/configuration.nix

@@ -1,29 +1,5 @@
 { config, lib, pkgs, vars, ... }:
 
-let
-  switchCmd = ''
-    sudo nixos-rebuild switch \
-      --no-write-lock-file \
-      --refresh \
-      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
-  '';
-  testCmd = ''
-    sudo nixos-rebuild test \
-      --no-write-lock-file \
-      --refresh \
-      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
-  '';
-  buildImageFn = ''
-    buildImage() {
-      if [ -z "$1" ]; then
-        echo "usage: buildImage <flake-target>  (e.g. lxc-docker)" >&2
-        return 1
-      fi
-      NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
-        ".#nixosConfigurations.$1.config.system.build.tarball"
-    }
-  '';
-in
 {
   imports =
     [
@@ -32,16 +8,6 @@ in
       ./set-locale.nix
       ../ipa/client.nix
     ];
-
-  # System-wide shell config so all users (including IPA accounts) get the
-  # same management aliases as the local nixos user's Home Manager provides.
-  programs.bash = {
-    shellAliases = {
-      "Switch-nix" = switchCmd;
-      "Test-nix" = testCmd;
-    };
-    interactiveShellInit = buildImageFn;
-  };
   # Use the GRUB 2 boot loader.
   # boot.loader.grub.enable = true;
   #boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only

modules/ipa/client.nix

@@ -19,7 +19,7 @@
 #        sops -e --input-type binary -i secrets/<host>.keytab
 #   d. Commit secrets/<host>.keytab and the updated .sops.yaml, then deploy.
 #
-# vars dependencies: homeDomain, ipaServer, domainControllerIp, ipaUser
+# vars dependencies: homeDomain, ipaServer, domainControllerIp
 
 { config, lib, pkgs, vars, ... }:
 
@@ -62,11 +62,6 @@ lib.mkIf enabled {
     "d /usr/local 0755 root root - -"
     "d /usr/local/bin 0755 root root - -"
     "C+ /usr/local/bin/sss_ssh_authorizedkeys 0555 root root - ${pkgs.sssd}/bin/sss_ssh_authorizedkeys"
-    # Pre-create the IPA user's home dir so Home Manager activation succeeds
-    # even before their first login. On a fresh system SSSD may not have
-    # resolved the user yet — tmpfiles warns and skips in that case (non-fatal),
-    # and pam_mkhomedir covers the first-login path as a fallback.
-    "d /home/${vars.ipaUser} 0700 ${vars.ipaUser} ${vars.ipaUser} - -"
   ];
 
   services.openssh.extraConfig = ''
@@ -125,64 +120,4 @@ lib.mkIf enabled {
       '';
     };
   };
-
-  # Home Manager config for the IPA primary user, applied on every enrolled
-  # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session
-  # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix)
-  # so they don't need to be repeated here.
-  # NixOS requires isNormalUser/isSystemUser + group on any entry in
-  # users.users. HM with useUserPackages = true (set in flake.nix) adds a stub
-  # entry for each HM user so it can install packages to
-  # /etc/profiles/per-user/<name>/. This definition satisfies those assertions.
-  # With security.ipa setting "passwd: sss files" in nsswitch, SSSD's IPA entry
-  # takes priority for NSS lookups — this local stub is only a fallback when
-  # SSSD is unreachable (at which point auth fails anyway).
-  # HM with useUserPackages = true (flake.nix) sets users.users.${ipaUser}.packages,
-  # which forces the stub into /etc/passwd. pam_sss.so with the "localusers" flag
-  # (added by NixOS when SSSD is enabled) then skips SSSD for any user it finds in
-  # local /etc/passwd — including this stub — falling through to pam_unix, which has
-  # no password for the stub → sudo auth always fails.
-  #
-  # Fix: NOPASSWD for the IPA user. The IPA user already authenticated to reach a
-  # shell (SSH public key from IPA or Kerberos), so re-prompting via a broken PAM
-  # path is security theater on a single-admin homelab.
-  users.users.${vars.ipaUser} = {
-    isNormalUser = true;
-    group = "users";
-    extraGroups = [ "wheel" ];
-    createHome = false;
-  };
-
-  # home-manager-<user>.service fails on first enrollment because /home/wayne
-  # doesn't exist until the user's first login (pam_mkhomedir creates it then).
-  # ConditionPathExists makes systemd skip the service (exit 0, condition not
-  # met) instead of failing. After first login the dir exists and subsequent
-  # rebuilds activate HM normally.
-  systemd.services."home-manager-${vars.ipaUser}".unitConfig.ConditionPathExists =
-    "/home/${vars.ipaUser}";
-
-  security.sudo.extraRules = [{
-    users = [ vars.ipaUser ];
-    commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
-  }];
-
-  # Home Manager config for the IPA primary user, applied on every enrolled
-  # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session
-  # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix)
-  # so they don't need to be repeated here.
-  #
-  # homeDirectory uses mkForce because HM's NixOS integration module sets it to
-  # "/var/empty" for users not found in config.users.users at eval time (SSSD
-  # users aren't visible there).
-  home-manager.users.${vars.ipaUser} = { pkgs, ... }: {
-    home = {
-      username = vars.ipaUser;
-      homeDirectory = lib.mkForce "/home/${vars.ipaUser}";
-      stateVersion = "26.05";
-      packages = with pkgs; [ tmux sshfs ];
-      sessionVariables.EDITOR = "nano";
-    };
-    programs.home-manager.enable = true;
-    programs.bash.enable = true;
-  };
 }

scripts/ipa/create-nixos-ipa-host-account.sh

@@ -81,14 +81,6 @@ if [[ -z "${TARGET}" ]]; then
   usage 1
 fi
 
-# Reject FQDNs passed by mistake — the script appends HOME_DOMAIN itself.
-# "nixos.sweet.home" → FQDN would become "nixos.sweet.home.sweet.home".
-if [[ "${TARGET}" == *"."* ]]; then
-  echo "Error: <hostname> must be the short name (e.g. 'nixos'), not a FQDN." >&2
-  echo "       The FQDN is derived automatically as ${TARGET}.${HOME_DOMAIN}." >&2
-  exit 1
-fi
-
 FQDN="${TARGET}.${HOME_DOMAIN}"
 KEYTAB_SECRET="${REPO_ROOT}/secrets/${TARGET}.keytab"
 # Temp path on the domain controller — use a name that won't collide.

variables.nix

@@ -80,11 +80,6 @@
   # one-line change.
   primaryUser = "nixos";
 
-  # Primary IPA/domain user. Home Manager is configured for this user on every
-  # IPA-enrolled host (see modules/ipa/client.nix) to manage the environment
-  # that IPA itself doesn't cover: dotfiles, user packages, session variables.
-  ipaUser = "wayne";
-
   # HA file server cluster
   # LAN IPs (vmbr0 / ens18) — client-facing: iSCSI initiators, NFS, management.
   # Storage IPs (vmbr1 / ens19) — isolated internal bridge, used for DRBD