From 0fe7ddf6e8e9f3b941a670cf1f0f33d67f0b3347 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 13:23:48 +1000 Subject: [PATCH 1/2] fix(ipa): reject FQDN input in create-nixos-ipa-host-account.sh Passing a FQDN like "nixos.sweet.home" instead of the short hostname "nixos" caused the script to create a double-FQDN IPA host account (nixos.sweet.home.sweet.home). Add an early check that rejects any TARGET containing a dot. Co-Authored-By: Claude Sonnet 4.6 --- scripts/ipa/create-nixos-ipa-host-account.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/scripts/ipa/create-nixos-ipa-host-account.sh b/scripts/ipa/create-nixos-ipa-host-account.sh index a93b507..635dba2 100755 --- a/scripts/ipa/create-nixos-ipa-host-account.sh +++ b/scripts/ipa/create-nixos-ipa-host-account.sh @@ -81,6 +81,14 @@ if [[ -z "${TARGET}" ]]; then usage 1 fi +# Reject FQDNs passed by mistake — the script appends HOME_DOMAIN itself. +# "nixos.sweet.home" → FQDN would become "nixos.sweet.home.sweet.home". +if [[ "${TARGET}" == *"."* ]]; then + echo "Error: must be the short name (e.g. 'nixos'), not a FQDN." >&2 + echo " The FQDN is derived automatically as ${TARGET}.${HOME_DOMAIN}." >&2 + exit 1 +fi + FQDN="${TARGET}.${HOME_DOMAIN}" KEYTAB_SECRET="${REPO_ROOT}/secrets/${TARGET}.keytab" # Temp path on the domain controller — use a name that won't collide. -- 2.54.0 From 9294d2fd25d429a5005664751d2b372841c4630d Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 13:38:49 +1000 Subject: [PATCH 2/2] fix(ipa): skip home-manager-wayne service when home dir absent On first enrollment /home/wayne doesn't exist until the IPA user's first login (pam_mkhomedir creates it). home-manager-.service cd's into the home dir immediately and fails with ENOENT, causing the whole rebuild activation to return exit code 4. Add ConditionPathExists so systemd skips the service (condition not met, no failure) instead. After first login the dir exists and subsequent rebuilds activate Home Manager normally. Co-Authored-By: Claude Sonnet 4.6 --- modules/ipa/client.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix index 88f7fea..16a10c9 100644 --- a/modules/ipa/client.nix +++ b/modules/ipa/client.nix @@ -153,6 +153,14 @@ lib.mkIf enabled { createHome = false; }; + # home-manager-.service fails on first enrollment because /home/wayne + # doesn't exist until the user's first login (pam_mkhomedir creates it then). + # ConditionPathExists makes systemd skip the service (exit 0, condition not + # met) instead of failing. After first login the dir exists and subsequent + # rebuilds activate HM normally. + systemd.services."home-manager-${vars.ipaUser}".unitConfig.ConditionPathExists = + "/home/${vars.ipaUser}"; + security.sudo.extraRules = [{ users = [ vars.ipaUser ]; commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }]; -- 2.54.0