Archived
beatzaplentyandClaude Sonnet 4.6
f4bbd6331d
Check NixOS configurations / eval-hosts (pull_request) Failing after 10m0s
Adds modules/ipa/client.nix — a parameterized module that joins a NixOS host to the sweet.home FreeIPA domain without ipa-client-install. It configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a pre-provisioned host keytab via sops-nix binary secret so enrollment is fully reproducible from the flake. - variables.nix: adds ipaServer (FQDN of the FreeIPA KDC; security.ipa.server requires a hostname, not an IP, for Kerberos/TLS) - certs/ipa-ca.crt: placeholder for the IPA CA public certificate (operator replaces with: curl http://<ipa-server>/ipa/config/ca.crt) - secrets/nix-cache.keytab: placeholder binary sops file (operator replaces with the encrypted keytab after ipa host-add + ipa-getkeytab) - .sops.yaml: adds creation rule for secrets/nix-cache.keytab (same recipients as secrets/nix-cache.yaml) - hosts/nix-cache/host.nix: imports the IPA client module; adds networking.domain so the host's FQDN resolves correctly Module header documents the three operator steps needed per host before deploy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
10 lines
499 B
Plaintext
10 lines
499 B
Plaintext
# Placeholder — replace with the actual FreeIPA CA certificate before deploying.
|
|
#
|
|
# Retrieve from the IPA server (it is a public certificate, safe to commit):
|
|
# curl -o certs/ipa-ca.crt http://<ipa-server>/ipa/config/ca.crt
|
|
#
|
|
# This file must contain a valid PEM certificate for SSSD to authenticate
|
|
# against FreeIPA over TLS. The Nix build succeeds with a placeholder, but
|
|
# the deployed host will not be able to join the domain until the real cert
|
|
# is committed and the system is rebuilt.
|