beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ipa): add create-nixos-ipa-host-account script #76

Merged
beatzaplenty merged 1 commits from worktree-ipa-client-module into main 2026-07-27 22:58:46 +00:00
Conversation 0 Commits 1 Files Changed 2
+267
beatzaplenty commented 2026-07-27 22:58:43 +00:00
Owner
Copy Link
Copy Source

Single command to enroll a NixOS host in FreeIPA and produce a
sops-encrypted keytab at secrets/.keytab:

  • Adds the .sops.yaml creation rule automatically (with all registered
    platform-variant age keys as recipients)
  • SSHes to the domain controller to run ipa host-add + ipa-getkeytab
  • Refreshes the admin Kerberos ticket via ssh -t ... kinit admin if
    missing or expired, so no manual kinit step is needed
  • SCPs the keytab and encrypts it in-place with sops (file must be at
    secrets/.keytab before encryption so the path-based creation
    rule matches — the common failure point when doing this manually)

Also adds HOME_DOMAIN and IPA_SERVER to scripts/env.sh, matching
variables.nix's homeDomain/ipaServer (same manual-sync pattern as
NIX_CACHE_HOST/LAN_DOMAIN).

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Single command to enroll a NixOS host in FreeIPA and produce a sops-encrypted keytab at secrets/<hostname>.keytab: - Adds the .sops.yaml creation rule automatically (with all registered platform-variant age keys as recipients) - SSHes to the domain controller to run ipa host-add + ipa-getkeytab - Refreshes the admin Kerberos ticket via `ssh -t ... kinit admin` if missing or expired, so no manual kinit step is needed - SCPs the keytab and encrypts it in-place with sops (file must be at secrets/<hostname>.keytab before encryption so the path-based creation rule matches — the common failure point when doing this manually) Also adds HOME_DOMAIN and IPA_SERVER to scripts/env.sh, matching variables.nix's homeDomain/ipaServer (same manual-sync pattern as NIX_CACHE_HOST/LAN_DOMAIN). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-27 22:58:43 +00:00
feat(ipa): add create-nixos-ipa-host-account script
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m24s
Details
6c1891812e 
Single command to enroll a NixOS host in FreeIPA and produce a
sops-encrypted keytab at secrets/<hostname>.keytab:
  - Adds the .sops.yaml creation rule automatically (with all registered
    platform-variant age keys as recipients)
  - SSHes to the domain controller to run ipa host-add + ipa-getkeytab
  - Refreshes the admin Kerberos ticket via `ssh -t ... kinit admin` if
    missing or expired, so no manual kinit step is needed
  - SCPs the keytab and encrypts it in-place with sops (file must be at
    secrets/<hostname>.keytab before encryption so the path-based creation
    rule matches — the common failure point when doing this manually)

Also adds HOME_DOMAIN and IPA_SERVER to scripts/env.sh, matching
variables.nix's homeDomain/ipaServer (same manual-sync pattern as
NIX_CACHE_HOST/LAN_DOMAIN).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty merged commit d9cee0a674 into main 2026-07-27 22:58:46 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#76