feat(users): migrate daniel to kanidm-only identity #498
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "kanidm-takeover-daniel"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Removes the local nix-declared
users.users.danielentirely. Daniel is now provided exclusively by kanidm via NSS/PAM; identity, auth, and most group membership flow from the kanidm server. Supersedes PR #495 — theuid_attr_map = "name"fix is folded in here.Layout changes
/home/daniel/.home/to/home/daniel/. Kanidm'shome_attr = "name"makes it reportpw_dir = /home/<name>, matching.lyte.userHomeandlyte.userSshKeysoptions on the shared user-env module replace the previousconfig.users.users.daniel.*indirection.Authorization
security.sudo.extraRulesgrants kanidm'sadministratorsgroup wheel-equivalent sudo.users.groups.<g>.members = [ "daniel" ]. String members don't need a local user declaration./etc/ssh/authorized_keys.d/danielso login survives kanidm-unixd being down.Migration unit
systemd.services.migrate-daniel-to-kanidm: idempotent one-shot, marker-gated. On each host:/home/daniel/.home/*up one level if still nested./home/danielto the kanidm uid/gid (resolved by name viagetent, no numeric hardcoding).userdel danielif a stale uid=1000 entry is still in/etc/passwd.Testing
Deployed to thinker via LAN. NixOS itself removed the local daniel on activation ("removing user 'daniel'"). Post-deploy:
id daniel→ uid/gid from kanidm, full group membership.getent passwd daniel→ single entry pointing at/home/daniel./home/daniel/.home/still needs the flatten, files still at 1000:1000; will be resolved when the active session clears.Follow-up
uid_attr_map/home_attrtake effect at the server level too.Remove the local `users.users.daniel` declaration and the nested `/home/daniel/.home` layout. Daniel is now provided exclusively by kanidm via NSS/PAM, with uid/gid derived from UUID by kanidm. Changes: - `lib/modules/shared/user-env.nix`: new `lyte.userHome` and `lyte.userSshKeys` options, replaces the indirect lookup through `config.users.users.<name>`. - `lib/modules/nixos/default-module.nix`: - Drop `users.users.daniel` / `users.groups.daniel`. - Flatten home: tmpfiles creates `/home/daniel` (not `/home/daniel/.home`). - Attach daniel to local service groups (wheel, video, dialout, uucp, power, kvm, input, users) via `users.groups.<g>.members` (string members don't require a local user declaration). - Grant kanidm `administrators` group wheel-equivalent sudo. - Write `/etc/ssh/authorized_keys.d/daniel` for offline/kanidm-down SSH access (the existing `AuthorizedKeysFile` stanza picks these up). - New `migrate-daniel-to-kanidm` one-shot: flattens `~/.home` if still nested, chowns `/home/daniel` to the kanidm-provided uid (by name, not number), userdels the pre-migration local entry if it's still at uid 1000. Idempotent via marker, bails if a session is active. - `lib/modules/nixos/kanidm.nix`: - Set `uid_attr_map` / `gid_attr_map` to "name" (shortname resolution, supersedes the pending #495). - Set `home_attr = "name"`, `home_alias = "none"` so kanidm reports pw_dir as `/home/daniel` and doesn't try to create a conflicting UUID-named dir. - Host files (`dragon,flab,foxtrot,rascal,pinephone`, `beefcake/{daniel,restic}`): swap `config.users.users.daniel.*` for `config.lyte.{userHome,userSshKeys,username}`. Group memberships moved to `users.groups.<g>.members` lists. - Modules (`syncthing, desktop, opencode, claude, niri, virtual-machines`): same pattern. Supersedes PR #495 (uid_attr_map fix, folded into this one).Three call sites that still created/depended-on users.users.daniel after the removal, causing CI to fail on dragon (music-production), and foxtrot/flab/dragon/syncthing (sops-nix secret owner lookup): - lib/modules/nixos/music-production.nix: convert `users.users.<u> .extraGroups = [ "audio" ]` to `users.groups.audio.members`. - All sops secrets with `owner = "daniel"`: add explicit `group = "users"`. sops-nix defaults the group to `users.${owner}.group` at eval time, which crashes when daniel isn't a declared user. - Add daniel to `networkmanager` group so NetworkManager's polkit rules let him edit connections (resolves the 'not authorized' prompt hit on thinker).