From 0b60d3ff2d2f001948eb00730793294ea8e93d04 Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Tue, 28 Jul 2026 12:07:58 +1000
Subject: [PATCH] fix(ipa): suppress Kerberos NFS services in LXC containers

The NixOS IPA module adds ConditionPathExists=/etc/krb5.keytab drop-ins
for auth-rpcgss-module.service and rpc-gssd.service via systemd.units.
In LXC containers with keytabs those conditions pass, the services start,
and then fail because auth_rpcgss can't be loaded and rpc_pipefs doesn't
exist in the container namespace.

Use lib.mkForce on our systemd.units text to win the conflict with NixOS's
existing definitions, and include ConditionVirtualization=!container
alongside the ConditionPathExists conditions so the services are skipped
(inactive, not failed) in containers that have a keytab.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 modules/ipa/client.nix | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix
index a5703f9..9bfc498 100644
--- a/modules/ipa/client.nix
+++ b/modules/ipa/client.nix
@@ -41,10 +41,10 @@ lib.mkIf enabled {
   security.ipa = {
     enable = true;
     domain = vars.homeDomain;
-    realm = realm;
+    inherit realm;
     server = vars.ipaServer;
     certificate = caCertPkg;
-    basedn = basedn;
+    inherit basedn;
     ipaHostname = fqdn;
     offlinePasswords = true;
     cacheCredentials = true;
@@ -86,4 +86,38 @@ lib.mkIf enabled {
     mode = "0600";
     restartUnits = [ "sssd.service" ];
   };
+
+  # security.ipa enables Kerberos (security.krb5) which causes systemd to
+  # start auth-rpcgss-module.service and rpc-gssd.service for Kerberos NFS
+  # authentication. LXC containers can't load the auth_rpcgss kernel module
+  # and don't have /var/lib/nfs/rpc_pipefs, so both services fail.
+  #
+  # The NixOS IPA module already adds a drop-in for auth-rpcgss-module.service
+  # with ConditionPathExists=/etc/krb5.keytab. We use lib.mkForce to win the
+  # text conflict and add ConditionVirtualization=!container alongside it so
+  # the service is skipped (not failed) in containers that do have a keytab.
+  # Same fix for rpc-gssd.service which also fails in containers.
+  systemd.units = lib.mkIf config.boot.isContainer {
+    "auth-rpcgss-module.service" = {
+      overrideStrategy = "asDropinIfExists";
+      text = lib.mkForce ''
+        [Unit]
+        ConditionPathExists=
+        ConditionPathExists=/etc/krb5.keytab
+        ConditionVirtualization=!container
+      '';
+    };
+    # rpc-gssd also has ConditionPathExists from the NixOS IPA module (and an
+    # X-Restart-Triggers store path from systemd.nix). Use mkForce to win;
+    # omit X-Restart-Triggers since this service is skipped in containers anyway.
+    "rpc-gssd.service" = {
+      overrideStrategy = "asDropinIfExists";
+      text = lib.mkForce ''
+        [Unit]
+        ConditionPathExists=
+        ConditionPathExists=/etc/krb5.keytab
+        ConditionVirtualization=!container
+      '';
+    };
+  };
 }
-- 
2.54.0