Archived
beatzaplentyandClaude Sonnet 4.6
5beed2d75c
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m39s
Create an IPA group "docker-access" (GID 50010) and pin the local "docker" group to that GID on all Docker hosts. Any IPA user in the docker-access group automatically gains docker socket access through SSSD supplementary-group resolution — no per-host docker.members entry needed. Specific changes: - variables.nix: add dockerAccessGid = 50010 - modules/docker/enable-service.nix: lib.mkForce docker GID to dockerAccessGid, removing the need to name individual IPA users - modules/build-types/docker.nix: remove direct wayne docker.members entry (access now comes from IPA group) - modules/ipa/client.nix: refactor repeated security.* / systemd.* top-level keys into merged attribute sets (fixes statix W20); add security.pam.services.lightdm.makeHomeDir so the GUI login path also creates the home dir on first login Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
45 lines
1.1 KiB
Nix
45 lines
1.1 KiB
Nix
{ pkgs, vars, ... }:
|
|
|
|
{
|
|
# Pins the Docker Engine version, carried forward from the pre-refactor
|
|
# `docker` target's inline pkgs overlay.
|
|
nixpkgs.overlays = [
|
|
(final: prev: {
|
|
docker = prev.docker_29;
|
|
docker_cli = prev.docker_29;
|
|
})
|
|
];
|
|
|
|
imports = [
|
|
../docker/mount-data.nix
|
|
../docker/enable-service.nix
|
|
../docker/nextcloud-cron-job.nix
|
|
../docker/docker-health-to-gotify.nix
|
|
../traefik/rotate-logs.nix
|
|
../raspi/mount-data.nix
|
|
../services/enable-rpcbind.nix
|
|
];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
nfs-utils
|
|
];
|
|
|
|
boot.supportedFilesystems = [ "nfs" ];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"L+ /home/${vars.primaryUser}/docker - - - - ${vars.nfsShares.dockerConfig.mountpoint}"
|
|
"d /mnt/docker 0755 ${vars.primaryUser} users -"
|
|
"d ${vars.nfsShares.raspiVolumes.mountpoint} 0755 ${vars.primaryUser} users -"
|
|
];
|
|
|
|
users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
|
|
services.openssh.settings.PermitRootLogin = "yes";
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
vars.ports.dockerHttp
|
|
vars.ports.dockerExtra
|
|
vars.ports.dockerHttps
|
|
vars.ports.beszelHub
|
|
];
|
|
}
|