fix(ipa): suppress Kerberos NFS services in LXC containers #84

Merged

beatzaplenty merged 1 commits from worktree-ipa-lxc-kerberos-fix into main

2026-07-28 02:13:48 +00:00

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	0b60d3ff2d	fix(ipa): suppress Kerberos NFS services in LXC containers Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s Details The NixOS IPA module adds ConditionPathExists=/etc/krb5.keytab drop-ins for auth-rpcgss-module.service and rpc-gssd.service via systemd.units. In LXC containers with keytabs those conditions pass, the services start, and then fail because auth_rpcgss can't be loaded and rpc_pipefs doesn't exist in the container namespace. Use lib.mkForce on our systemd.units text to win the conflict with NixOS's existing definitions, and include ConditionVirtualization=!container alongside the ConditionPathExists conditions so the services are skipped (inactive, not failed) in containers that have a keytab. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 12:07:58 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

0b60d3ff2d

fix(ipa): suppress Kerberos NFS services in LXC containers

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s

Details

The NixOS IPA module adds ConditionPathExists=/etc/krb5.keytab drop-ins
for auth-rpcgss-module.service and rpc-gssd.service via systemd.units.
In LXC containers with keytabs those conditions pass, the services start,
and then fail because auth_rpcgss can't be loaded and rpc_pipefs doesn't
exist in the container namespace.

Use lib.mkForce on our systemd.units text to win the conflict with NixOS's
existing definitions, and include ConditionVirtualization=!container
alongside the ConditionPathExists conditions so the services are skipped
(inactive, not failed) in containers that have a keytab.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 12:07:58 +10:00