feat(docker): add IPA wayne user to docker group

Grants the domain wayne account docker socket access on docker.sweet.home without needing sudo, alongside the existing nixos local user membership. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix(docker): pin IPA dyndns to eth0 to prevent Docker bridge IP registration
2026-07-28 14:07:34 +10:00 · 2026-07-28 14:07:34 +10:00 · 2026-07-28 03:39:23 +00:00 · 2026-07-28 03:16:03 +00:00 · 2026-07-28 03:00:33 +00:00 · 2026-07-28 02:55:20 +00:00
2 changed files with 8 additions and 0 deletions
@@ -14,6 +14,11 @@
  };
  boot.zfs.forceImportRoot = false;

+  # Only advertise the LAN interface to IPA DNS. Without this, SSSD registers
+  # every Docker bridge (172.x.x.x) as an A record for docker.sweet.home —
+  # the default dyndns.interface = "*" catches them all.
+  security.ipa.dyndns.interface = vars.lxcLanInterface; # eth0
+
  # Preserved from the pre-refactor `docker` target — stateVersion must never
  # be bumped on an already-installed machine.
  system.stateVersion = "25.05";
@@ -33,6 +33,9 @@
  ];

  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
+  # Grant the IPA domain user docker access via the local group so that
+  # `wayne` can manage containers without sudo.
+  users.groups.docker.members = [ "wayne" ];
  services.openssh.settings.PermitRootLogin = "yes";

  networking.firewall.allowedTCPPorts = [
Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	fe7fc55c04	feat(docker): add IPA wayne user to docker group Check NixOS configurations / eval-hosts (push) Failing after 12m13s Details Grants the domain wayne account docker socket access on docker.sweet.home without needing sudo, alongside the existing nixos local user membership. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 14:07:34 +10:00
beatzaplentyandClaude Sonnet 4.6	6cdae391f4	fix(docker): pin IPA dyndns to eth0 to prevent Docker bridge IP registration SSSD's dyndns_iface defaults to "*" which registers every interface's IP in IPA DNS, including all Docker bridge networks (172.x.x.x). This caused docker.sweet.home to resolve to Docker bridge IPs instead of 192.168.2.225. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 14:07:34 +10:00
beatzaplenty	95eb494370	Merge pull request 'Worktree ipa lxc kerberos fix' (#88 ) from worktree-ipa-lxc-kerberos-fix into main Check NixOS configurations / eval-hosts (push) Failing after 9m47s Details Reviewed-on: #88	2026-07-28 03:39:23 +00:00
beatzaplenty	5c2d61d35a	Merge pull request 'fix(ipa): use NOPASSWD sudo for IPA user to bypass broken PAM path' (#87 ) from worktree-ipa-lxc-kerberos-fix into main Check NixOS configurations / eval-hosts (push) Failing after 9m45s Details Reviewed-on: #87	2026-07-28 03:16:03 +00:00
beatzaplenty	e6f15404f5	Merge pull request 'fix(ipa): add wheel group to IPA user stub for sudo access' (#86 ) from worktree-ipa-lxc-kerberos-fix into main Check NixOS configurations / eval-hosts (push) Successful in 10m54s Details Reviewed-on: #86	2026-07-28 03:00:33 +00:00
beatzaplenty	1fc6e63178	Merge pull request 'Worktree ipa lxc kerberos fix' (#85 ) from worktree-ipa-lxc-kerberos-fix into main Check NixOS configurations / eval-hosts (push) Failing after 33m33s Details Reviewed-on: #85	2026-07-28 02:55:20 +00:00
beatzaplenty	232d0e7c40	Merge pull request 'fix(ipa): suppress Kerberos NFS services in LXC containers' (#84 ) from worktree-ipa-lxc-kerberos-fix into main Check NixOS configurations / eval-hosts (push) Successful in 10m32s Details Reviewed-on: #84	2026-07-28 02:13:47 +00:00