{ lib, pkgs, vars, ... }:

let
  gid = toString vars.dockerAccessGid;
in
{
  virtualisation.docker = {
    enable = true;
    package = pkgs.docker;
  };
  # Pin the docker group GID to match the IPA "docker-access" group so that
  # IPA group membership alone grants access to the Docker socket. Any user
  # whose supplementary groups (resolved by SSSD from IPA) include GID
  # vars.dockerAccessGid will pass the socket group-permission check without
  # any per-host users.groups.docker.members entry.
  users.groups.docker.gid = lib.mkForce vars.dockerAccessGid;
  users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
  environment.systemPackages = with pkgs; [
    docker-compose
    docker-buildx
  ];

  # NixOS's group activation uses plain `groupmod` without --non-unique.
  # When SSSD is active it exposes the IPA "docker-access" group at
  # vars.dockerAccessGid via NSS, so groupmod sees that GID as already in
  # use and silently skips the change (warning: "not applying GID change").
  # This script runs after the normal "groups" step and applies the change
  # with --non-unique (which lets the local docker group share the GID with
  # the SSSD-provided IPA group). If the GID actually changed it also
  # restarts docker.socket so the socket is recreated with the new GID.
  system.activationScripts.docker-group-gid = {
    deps = [ "groups" ];
    text = ''
      current=$(grep "^docker:" /etc/group | cut -d: -f3)
      if [ "$current" != "${gid}" ]; then
        ${pkgs.shadow}/bin/groupmod --non-unique -g ${gid} docker
        if ${pkgs.systemd}/bin/systemctl is-active --quiet docker.socket; then
          ${pkgs.systemd}/bin/systemctl stop docker.service docker.socket
          rm -f /var/run/docker.sock
          ${pkgs.systemd}/bin/systemctl start docker.socket docker.service
        fi
      fi
    '';
  };
}