From 89746718a94541b79861627a05d941fba061346f Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 12:32:33 +1000 Subject: [PATCH 1/2] feat(shell): make Switch-nix/Test-nix/buildImage system-wide IPA users (e.g. wayne@) don't get Home Manager so the aliases defined in aliases.nix were invisible to them. Move Switch-nix, Test-nix, and buildImage into programs.bash in configuration.nix so every user on every host gets them via /etc/bashrc. Stub out aliases.nix for future per-user HM-only additions. Co-Authored-By: Claude Sonnet 4.6 --- modules/common/aliases.nix | 51 +++----------------------------- modules/common/configuration.nix | 34 +++++++++++++++++++++ 2 files changed, 38 insertions(+), 47 deletions(-) diff --git a/modules/common/aliases.nix b/modules/common/aliases.nix index c04cf56..8b4a35c 100644 --- a/modules/common/aliases.nix +++ b/modules/common/aliases.nix @@ -1,50 +1,7 @@ -{ config, pkgs, lib, vars, ... }: +_: -let - # Flake attribute names are now - (e.g. proxmox-docker) - # and no longer match networking.hostName, since a host's hostname stays - # fixed while the platform backing it can change. Each nixosConfiguration - # stamps its own active target name into /etc/flake-target at build time. - mySwitchCmd = '' - sudo nixos-rebuild switch \ - --no-write-lock-file \ - --refresh \ - --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target) - ''; - myTestCmd = '' - sudo nixos-rebuild test \ - --no-write-lock-file \ - --refresh \ - --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target) - ''; - - # lxc-* hosts pre-seed their SSH host key at build time (see - # modules/platforms/lxc.nix) so sops-nix's .sops.yaml recipient matches on - # first boot -- without it, secrets permanently fail to decrypt (see that - # file's comment for the confirmed failure). That requires --impure plus - # NIXOS_HOST_KEYS_DIR pointing at the repo's host-keys/ dir, same pattern - # docs/auto-installer.md uses for the installer ISO. A function, not a - # shellAlias, since the target name has to interpolate into the middle of - # the flake attribute path, not just append after it. Must be run from the - # repo root, same as every other host-keys/ command in this repo. - buildImageFn = '' - buildImage() { - if [ -z "$1" ]; then - echo "usage: buildImage (e.g. lxc-docker)" >&2 - return 1 - fi - NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \ - ".#nixosConfigurations.$1.config.system.build.tarball" - } - ''; -in { - programs.bash = { - enable = true; - shellAliases = { - "Switch-nix" = mySwitchCmd; - "Test-nix" = myTestCmd; - }; - initExtra = buildImageFn; - }; + # Switch-nix, Test-nix, and buildImage are defined system-wide in + # modules/common/configuration.nix so all users (including IPA accounts) + # get them. Add any Home-Manager-only per-user shell config here. } diff --git a/modules/common/configuration.nix b/modules/common/configuration.nix index 68fa68e..0144331 100644 --- a/modules/common/configuration.nix +++ b/modules/common/configuration.nix @@ -1,5 +1,29 @@ { config, lib, pkgs, vars, ... }: +let + switchCmd = '' + sudo nixos-rebuild switch \ + --no-write-lock-file \ + --refresh \ + --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target) + ''; + testCmd = '' + sudo nixos-rebuild test \ + --no-write-lock-file \ + --refresh \ + --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target) + ''; + buildImageFn = '' + buildImage() { + if [ -z "$1" ]; then + echo "usage: buildImage (e.g. lxc-docker)" >&2 + return 1 + fi + NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \ + ".#nixosConfigurations.$1.config.system.build.tarball" + } + ''; +in { imports = [ @@ -8,6 +32,16 @@ ./set-locale.nix ../ipa/client.nix ]; + + # System-wide shell config so all users (including IPA accounts) get the + # same management aliases as the local nixos user's Home Manager provides. + programs.bash = { + shellAliases = { + "Switch-nix" = switchCmd; + "Test-nix" = testCmd; + }; + interactiveShellInit = buildImageFn; + }; # Use the GRUB 2 boot loader. # boot.loader.grub.enable = true; #boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only -- 2.54.0 From 3589fc31d7e20d0193a40bc352fd7d7459c7165e Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 12:53:10 +1000 Subject: [PATCH 2/2] feat(ipa): add Home Manager config for IPA primary user Any enrolled host now automatically gets a Home Manager profile for the IPA primary user (vars.ipaUser = "wayne"), covering what IPA doesn't: dotfiles, user-scoped packages (tmux, sshfs), and EDITOR variable. The home directory is pre-created by systemd-tmpfiles so HM activation succeeds on steady-state systems before first login; pam_mkhomedir remains as a fallback for fresh deploys where SSSD hasn't cached the user yet. A minimal users.users stub satisfies NixOS's assertion requirements (isNormalUser + group) that arise because home-manager.useUserPackages creates a users.users entry to install packages to /etc/profiles/per-user/. The stub is shadowed by SSSD at runtime (security.ipa sets passwd: sss files). Co-Authored-By: Claude Sonnet 4.6 --- modules/ipa/client.nix | 44 +++++++++++++++++++++++++++++++++++++++++- variables.nix | 5 +++++ 2 files changed, 48 insertions(+), 1 deletion(-) diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix index 9bfc498..7b6800e 100644 --- a/modules/ipa/client.nix +++ b/modules/ipa/client.nix @@ -19,7 +19,7 @@ # sops -e --input-type binary -i secrets/.keytab # d. Commit secrets/.keytab and the updated .sops.yaml, then deploy. # -# vars dependencies: homeDomain, ipaServer, domainControllerIp +# vars dependencies: homeDomain, ipaServer, domainControllerIp, ipaUser { config, lib, pkgs, vars, ... }: @@ -62,6 +62,11 @@ lib.mkIf enabled { "d /usr/local 0755 root root - -" "d /usr/local/bin 0755 root root - -" "C+ /usr/local/bin/sss_ssh_authorizedkeys 0555 root root - ${pkgs.sssd}/bin/sss_ssh_authorizedkeys" + # Pre-create the IPA user's home dir so Home Manager activation succeeds + # even before their first login. On a fresh system SSSD may not have + # resolved the user yet — tmpfiles warns and skips in that case (non-fatal), + # and pam_mkhomedir covers the first-login path as a fallback. + "d /home/${vars.ipaUser} 0700 ${vars.ipaUser} ${vars.ipaUser} - -" ]; services.openssh.extraConfig = '' @@ -120,4 +125,41 @@ lib.mkIf enabled { ''; }; }; + + # Home Manager config for the IPA primary user, applied on every enrolled + # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session + # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix) + # so they don't need to be repeated here. + # NixOS requires isNormalUser/isSystemUser + group on any entry in + # users.users. HM with useUserPackages = true (set in flake.nix) adds a stub + # entry for each HM user so it can install packages to + # /etc/profiles/per-user//. This definition satisfies those assertions. + # With security.ipa setting "passwd: sss files" in nsswitch, SSSD's IPA entry + # takes priority for NSS lookups — this local stub is only a fallback when + # SSSD is unreachable (at which point auth fails anyway). + users.users.${vars.ipaUser} = { + isNormalUser = true; + group = "users"; + createHome = false; + }; + + # Home Manager config for the IPA primary user, applied on every enrolled + # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session + # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix) + # so they don't need to be repeated here. + # + # homeDirectory uses mkForce because HM's NixOS integration module sets it to + # "/var/empty" for users not found in config.users.users at eval time (SSSD + # users aren't visible there). + home-manager.users.${vars.ipaUser} = { pkgs, ... }: { + home = { + username = vars.ipaUser; + homeDirectory = lib.mkForce "/home/${vars.ipaUser}"; + stateVersion = "26.05"; + packages = with pkgs; [ tmux sshfs ]; + sessionVariables.EDITOR = "nano"; + }; + programs.home-manager.enable = true; + programs.bash.enable = true; + }; } diff --git a/variables.nix b/variables.nix index e438178..45e64b6 100644 --- a/variables.nix +++ b/variables.nix @@ -80,6 +80,11 @@ # one-line change. primaryUser = "nixos"; + # Primary IPA/domain user. Home Manager is configured for this user on every + # IPA-enrolled host (see modules/ipa/client.nix) to manage the environment + # that IPA itself doesn't cover: dotfiles, user packages, session variables. + ipaUser = "wayne"; + # HA file server cluster # LAN IPs (vmbr0 / ens18) — client-facing: iSCSI initiators, NFS, management. # Storage IPs (vmbr1 / ens19) — isolated internal bridge, used for DRBD -- 2.54.0