beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ipa): add reusable declarative FreeIPA client module #74

Merged
beatzaplenty merged 1 commits from worktree-ipa-client-module into main 2026-07-27 21:06:28 +00:00
Conversation 0 Commits 1 Files Changed 6
+98
beatzaplenty commented 2026-07-27 21:06:25 +00:00
Owner
Copy Link
Copy Source

Adds modules/ipa/client.nix — a parameterized module that joins a NixOS host
to the sweet.home FreeIPA domain without ipa-client-install. It configures
security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a pre-provisioned host
keytab via sops-nix binary secret so enrollment is fully reproducible from the
flake.

  • variables.nix: adds ipaServer (FQDN of the FreeIPA KDC; security.ipa.server
    requires a hostname, not an IP, for Kerberos/TLS)
  • certs/ipa-ca.crt: placeholder for the IPA CA public certificate (operator
    replaces with: curl http:///ipa/config/ca.crt)
  • secrets/nix-cache.keytab: placeholder binary sops file (operator replaces
    with the encrypted keytab after ipa host-add + ipa-getkeytab)
  • .sops.yaml: adds creation rule for secrets/nix-cache.keytab (same recipients
    as secrets/nix-cache.yaml)
  • hosts/nix-cache/host.nix: imports the IPA client module; adds
    networking.domain so the host's FQDN resolves correctly

Module header documents the three operator steps needed per host before deploy.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Adds modules/ipa/client.nix — a parameterized module that joins a NixOS host to the sweet.home FreeIPA domain without ipa-client-install. It configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a pre-provisioned host keytab via sops-nix binary secret so enrollment is fully reproducible from the flake. - variables.nix: adds ipaServer (FQDN of the FreeIPA KDC; security.ipa.server requires a hostname, not an IP, for Kerberos/TLS) - certs/ipa-ca.crt: placeholder for the IPA CA public certificate (operator replaces with: curl http://<ipa-server>/ipa/config/ca.crt) - secrets/nix-cache.keytab: placeholder binary sops file (operator replaces with the encrypted keytab after ipa host-add + ipa-getkeytab) - .sops.yaml: adds creation rule for secrets/nix-cache.keytab (same recipients as secrets/nix-cache.yaml) - hosts/nix-cache/host.nix: imports the IPA client module; adds networking.domain so the host's FQDN resolves correctly Module header documents the three operator steps needed per host before deploy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-27 21:06:25 +00:00
feat(ipa): add reusable declarative FreeIPA client module
Check NixOS configurations / eval-hosts (pull_request) Failing after 10m0s
Details
f4bbd6331d 
Adds modules/ipa/client.nix — a parameterized module that joins a NixOS host
to the sweet.home FreeIPA domain without ipa-client-install. It configures
security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a pre-provisioned host
keytab via sops-nix binary secret so enrollment is fully reproducible from the
flake.

- variables.nix: adds ipaServer (FQDN of the FreeIPA KDC; security.ipa.server
  requires a hostname, not an IP, for Kerberos/TLS)
- certs/ipa-ca.crt: placeholder for the IPA CA public certificate (operator
  replaces with: curl http://<ipa-server>/ipa/config/ca.crt)
- secrets/nix-cache.keytab: placeholder binary sops file (operator replaces
  with the encrypted keytab after ipa host-add + ipa-getkeytab)
- .sops.yaml: adds creation rule for secrets/nix-cache.keytab (same recipients
  as secrets/nix-cache.yaml)
- hosts/nix-cache/host.nix: imports the IPA client module; adds
  networking.domain so the host's FQDN resolves correctly

Module header documents the three operator steps needed per host before deploy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty merged commit c0936a10e7 into main 2026-07-27 21:06:28 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#74