beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ipa): suppress Kerberos NFS services in LXC containers #84

Merged
beatzaplenty merged 1 commits from worktree-ipa-lxc-kerberos-fix into main 2026-07-28 02:13:48 +00:00
Conversation 0 Commits 1 Files Changed 1
+36 -2
beatzaplenty commented 2026-07-28 02:13:44 +00:00
Owner
Copy Link
Copy Source

The NixOS IPA module adds ConditionPathExists=/etc/krb5.keytab drop-ins
for auth-rpcgss-module.service and rpc-gssd.service via systemd.units.
In LXC containers with keytabs those conditions pass, the services start,
and then fail because auth_rpcgss can't be loaded and rpc_pipefs doesn't
exist in the container namespace.

Use lib.mkForce on our systemd.units text to win the conflict with NixOS's
existing definitions, and include ConditionVirtualization=!container
alongside the ConditionPathExists conditions so the services are skipped
(inactive, not failed) in containers that have a keytab.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

The NixOS IPA module adds ConditionPathExists=/etc/krb5.keytab drop-ins for auth-rpcgss-module.service and rpc-gssd.service via systemd.units. In LXC containers with keytabs those conditions pass, the services start, and then fail because auth_rpcgss can't be loaded and rpc_pipefs doesn't exist in the container namespace. Use lib.mkForce on our systemd.units text to win the conflict with NixOS's existing definitions, and include ConditionVirtualization=!container alongside the ConditionPathExists conditions so the services are skipped (inactive, not failed) in containers that have a keytab. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-28 02:13:45 +00:00
fix(ipa): suppress Kerberos NFS services in LXC containers
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s
Details
0b60d3ff2d 
The NixOS IPA module adds ConditionPathExists=/etc/krb5.keytab drop-ins
for auth-rpcgss-module.service and rpc-gssd.service via systemd.units.
In LXC containers with keytabs those conditions pass, the services start,
and then fail because auth_rpcgss can't be loaded and rpc_pipefs doesn't
exist in the container namespace.

Use lib.mkForce on our systemd.units text to win the conflict with NixOS's
existing definitions, and include ConditionVirtualization=!container
alongside the ConditionPathExists conditions so the services are skipped
(inactive, not failed) in containers that have a keytab.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty merged commit 232d0e7c40 into main 2026-07-28 02:13:48 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#84