{ lib, pkgs, vars, ... }:

{
  virtualisation.docker = {
    enable = true;
    package = pkgs.docker;
  };
  # Pin the docker group GID to match the IPA "docker-access" group so that
  # IPA group membership alone grants access to the Docker socket. Any user
  # whose supplementary groups (resolved by SSSD from IPA) include GID
  # vars.dockerAccessGid will pass the socket group-permission check without
  # any per-host users.groups.docker.members entry.
  users.groups.docker.gid = lib.mkForce vars.dockerAccessGid;
  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
  environment.systemPackages = with pkgs; [
    docker-compose
    docker-buildx
  ];
}