beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ipa/docker): grant docker access via IPA group membership #90

Merged
beatzaplenty merged 1 commits from worktree-docker-ipa-group into main 2026-07-28 05:48:46 +00:00
Conversation 0 Commits 1 Files Changed 4
+112 -97
beatzaplenty commented 2026-07-28 05:48:41 +00:00
Owner
Copy Link
Copy Source

Create an IPA group "docker-access" (GID 50010) and pin the local
"docker" group to that GID on all Docker hosts. Any IPA user in the
docker-access group automatically gains docker socket access through
SSSD supplementary-group resolution — no per-host docker.members
entry needed.

Specific changes:

  • variables.nix: add dockerAccessGid = 50010
  • modules/docker/enable-service.nix: lib.mkForce docker GID to
    dockerAccessGid, removing the need to name individual IPA users
  • modules/build-types/docker.nix: remove direct wayne docker.members
    entry (access now comes from IPA group)
  • modules/ipa/client.nix: refactor repeated security.* / systemd.*
    top-level keys into merged attribute sets (fixes statix W20); add
    security.pam.services.lightdm.makeHomeDir so the GUI login path
    also creates the home dir on first login

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Create an IPA group "docker-access" (GID 50010) and pin the local "docker" group to that GID on all Docker hosts. Any IPA user in the docker-access group automatically gains docker socket access through SSSD supplementary-group resolution — no per-host docker.members entry needed. Specific changes: - variables.nix: add dockerAccessGid = 50010 - modules/docker/enable-service.nix: lib.mkForce docker GID to dockerAccessGid, removing the need to name individual IPA users - modules/build-types/docker.nix: remove direct wayne docker.members entry (access now comes from IPA group) - modules/ipa/client.nix: refactor repeated security.* / systemd.* top-level keys into merged attribute sets (fixes statix W20); add security.pam.services.lightdm.makeHomeDir so the GUI login path also creates the home dir on first login Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-28 05:48:41 +00:00
feat(ipa/docker): grant docker access via IPA group membership
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m39s
Details
5beed2d75c 
Create an IPA group "docker-access" (GID 50010) and pin the local
"docker" group to that GID on all Docker hosts.  Any IPA user in the
docker-access group automatically gains docker socket access through
SSSD supplementary-group resolution — no per-host docker.members
entry needed.

Specific changes:
- variables.nix: add dockerAccessGid = 50010
- modules/docker/enable-service.nix: lib.mkForce docker GID to
  dockerAccessGid, removing the need to name individual IPA users
- modules/build-types/docker.nix: remove direct wayne docker.members
  entry (access now comes from IPA group)
- modules/ipa/client.nix: refactor repeated security.* / systemd.*
  top-level keys into merged attribute sets (fixes statix W20); add
  security.pam.services.lightdm.makeHomeDir so the GUI login path
  also creates the home dir on first login

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty merged commit a960c662f0 into main 2026-07-28 05:48:46 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#90