{ lib, pkgs, vars, ... }:

{
  #  virtualisation.docker.enable = true;
  virtualisation.docker = {
    enable = true;
    package = pkgs.docker;
    #  listenOptions = [
    #  "unix:///var/run/docker.sock"
    #  "tcp://0.0.0.0:2375"
    #];

    #  daemon.settings = {
    #    metrics-addr = "0.0.0.0:9323";
    #    experimental = true;
    #  };
  };
  # Pin the docker group GID to match the IPA "docker-access" group so that
  # IPA group membership alone grants access to the Docker socket. Any user
  # whose supplementary groups (resolved by SSSD from IPA) include GID
  # vars.dockerAccessGid will pass the socket group-permission check without
  # any per-host users.groups.docker.members entry.
  users.groups.docker.gid = lib.mkForce vars.dockerAccessGid;
  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
  environment.systemPackages = with pkgs; [
    docker-compose
    docker-buildx
  ];
}