Archived
beatzaplentyandClaude Sonnet 4.6
f4bbd6331d
Check NixOS configurations / eval-hosts (pull_request) Failing after 10m0s
Adds modules/ipa/client.nix — a parameterized module that joins a NixOS host to the sweet.home FreeIPA domain without ipa-client-install. It configures security.ipa (SSSD, Kerberos, PAM, NSSwitch) and places a pre-provisioned host keytab via sops-nix binary secret so enrollment is fully reproducible from the flake. - variables.nix: adds ipaServer (FQDN of the FreeIPA KDC; security.ipa.server requires a hostname, not an IP, for Kerberos/TLS) - certs/ipa-ca.crt: placeholder for the IPA CA public certificate (operator replaces with: curl http://<ipa-server>/ipa/config/ca.crt) - secrets/nix-cache.keytab: placeholder binary sops file (operator replaces with the encrypted keytab after ipa host-add + ipa-getkeytab) - .sops.yaml: adds creation rule for secrets/nix-cache.keytab (same recipients as secrets/nix-cache.yaml) - hosts/nix-cache/host.nix: imports the IPA client module; adds networking.domain so the host's FQDN resolves correctly Module header documents the three operator steps needed per host before deploy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
36 lines
1.0 KiB
Nix
36 lines
1.0 KiB
Nix
{ vars, ... }:
|
|
|
|
{
|
|
imports = [
|
|
(import ../../modules/beszel/host-token.nix {
|
|
name = "nix-cache";
|
|
sopsFile = ../../secrets/nix-cache.yaml;
|
|
})
|
|
(import ../../modules/ipa/client.nix {
|
|
keytabSopsFile = ../../secrets/nix-cache.keytab;
|
|
caCertFile = ../../certs/ipa-ca.crt;
|
|
})
|
|
];
|
|
|
|
networking = {
|
|
hostName = vars.nixCacheHost;
|
|
domain = vars.homeDomain;
|
|
useDHCP = false;
|
|
interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
|
|
address = vars.nixCacheIp;
|
|
prefixLength = vars.lanPrefixLength;
|
|
}];
|
|
defaultGateway = { address = vars.lanGateway; interface = vars.lxcLanInterface; };
|
|
nameservers = [ vars.domainControllerIp ];
|
|
};
|
|
|
|
services.beszel.agent.environment = {
|
|
#DOCKER_HOST = "tcp://docker-socket-proxy:2375";
|
|
KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
|
|
};
|
|
|
|
# Preserved from the pre-refactor `nix-cache` target — stateVersion must
|
|
# never be bumped on an already-installed machine.
|
|
system.stateVersion = "25.05";
|
|
}
|