Archived
Check NixOS configurations / eval-hosts (pull_request) Failing after 40m50s
Any enrolled host now automatically gets a Home Manager profile for the IPA primary user (vars.ipaUser = "wayne"), covering what IPA doesn't: dotfiles, user-scoped packages (tmux, sshfs), and EDITOR variable. The home directory is pre-created by systemd-tmpfiles so HM activation succeeds on steady-state systems before first login; pam_mkhomedir remains as a fallback for fresh deploys where SSSD hasn't cached the user yet. A minimal users.users stub satisfies NixOS's assertion requirements (isNormalUser + group) that arise because home-manager.useUserPackages creates a users.users entry to install packages to /etc/profiles/per-user/. The stub is shadowed by SSSD at runtime (security.ipa sets passwd: sss files). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>