realmd: init

[SohamG]

Description of changes

Fix #180043

Status Update 24 Nov 2023: See this comment

Things done

• Add realmd package.
• Add necessary nixos module.

Pending changes:

• Enable polkit and sssd as a part of our enable option.
• Fix config file paths (perhaps use /run/current-system)
• More testing

---

• Built on platform(s)
  • x86_64-linux

[brakenium]

I'm thinking about installing NixOS on my new laptop that is on order and would like to join it to my MS Active Directory domain. Is there anything I can do to help test this? Do you have a Nix config I could use to test this in a VM (QEMU/KVM)? Do I need to download your complete fork? It takes really long to do that. I'm new to Nix so I might not be the best person to help test, but I'm willing to learn

[SohamG]

brakenium ***@***.***> writes:

I'm thinking about installing NixOS on my new laptop that is on order and would like to join it to my MS Active Directory domain. Is there anything I can do to help test this? Do you have a Nix config I could use to test this in a VM (QEMU/KVM)? Do I need to download your complete fork? It takes really long to do that. I'm new to Nix so I might not be the best person to help test, but I'm willing to learn

Well, you dont need to download the *entire* fork, something like ``` git clone https://github.com/sohamg/nixpkgs --branch pkg/realmd --depth 2 ``` Should finish much faster and only download the necessary bits. For testing, however, the process isnt quite straightforward: You need to tell nixos-rebuild to use the previously cloned nixpkgs as the nixpkgs for the system. I believe this is done with the -A option (dont quote me on that, flake user here). That being said, I wont recommend testing on a production/in-use machine. I am testing in a VM right now, will have more to share soon. If you want, you can help by testing in a **VM** on your new laptop! Edit: Done with the -I option to nixos-rebuild (nixos-rebuild switch -I nixpkgs=/path/to/nixpkgs)

[SohamG]

Testing notes (Thanksgiving edition):

• I could swear the realmd package would build properly, but I guess not? (its the same hashes!) Added one line fix to preConfigure to get it to build.

• Discovery: Realmd throws a fit if you dont have polkit installed which means anything that doesnt have a GUI. No ones fixed this yet.. Need to make the nixos module enable polkit as well.

• The realmd config has broken paths (apparently?) due to double substitution of some kind (from normal linux paths to nix store paths). Will need to fix this.

Hopefully I can work more on this tomorrow. (I will gladly accept help!)

[brakenium]

Currently I'm doing some testing on my desktop in a VM. My laptop won't be here until January. I am trying to get a suitable NixOS config setup before it arrives and would like it to be domain joined. Later I remembered I can just curl the repo's zip file. I should be able to test it out if you can get me an example config (assuming you're testing with AD as well)

[SohamG]

brakenium ***@***.***> writes:

Later I remembered I can just curl the repo's zip file. I should be able to test it out if you can get me an example config (assuming you're testing with AD as well)

You only need a couple lines in the config: services.realmd.enable = true; services.polkit.enable = true; services.sssd.enable = true; And then after rebuilding you can join the domain with the usual realm commands realm join domain.tld -U adminuser Currently the join fails cause I need to fix the config file being generated. Thanks for the willingness to help. I should have it fixed soon and ready for actual testing.

[brakenium]

Sounds good. Please let me know when this is ready to test

[anthonyroussel]

Unfortunately the realm join command fails with /usr/bin/authselect tool not found (which is a Redhat-only tool).

machine # [   13.565952] realmd[769]:  * /nix/store/lf0wpjrj8yx4gsmw2s3xfl58ixmqk8qa-bash-5.2-p15/bin/bash -c /usr/bin/authselect select sssd with-mkhomedir --force && /nix/store/vapnrxrw3b21c7ji61bmnbzl2cj1vl96-systemd-254.3/bin/systemctl enable oddjobd.service && /nix/store/vapnrxrw3b21c7ji61bmnbzl2cj1vl96-systemd-254.3/bin/systemctl start oddjobd.service
machine # [   13.573824] realmd[769]: process started: 934
machine # [   13.580805] realmd[769]: /nix/store/lf0wpjrj8yx4gsmw2s3xfl58ixmqk8qa-bash-5.2-p15/bin/bash: line 1: /usr/bin/authselect: No such file or directory

I think we need to adapt the realmd-distro.conf configuration file for NixOS.

[SohamG]

Unfortunately the realm join command fails with /usr/bin/authselect tool not found (which is a Redhat-only tool).

machine # [   13.565952] realmd[769]:  * /nix/store/lf0wpjrj8yx4gsmw2s3xfl58ixmqk8qa-bash-5.2-p15/bin/bash -c /usr/bin/authselect select sssd with-mkhomedir --force && /nix/store/vapnrxrw3b21c7ji61bmnbzl2cj1vl96-systemd-254.3/bin/systemctl enable oddjobd.service && /nix/store/vapnrxrw3b21c7ji61bmnbzl2cj1vl96-systemd-254.3/bin/systemctl start oddjobd.service
machine # [   13.573824] realmd[769]: process started: 934
machine # [   13.580805] realmd[769]: /nix/store/lf0wpjrj8yx4gsmw2s3xfl58ixmqk8qa-bash-5.2-p15/bin/bash: line 1: /usr/bin/authselect: No such file or directory

I think we need to adapt the realmd-distro.conf configuration file for NixOS.

Yes, working on this exactly right now. Will onboard the other suggestions too (including the INI config one)

[kd2flz]

Unfortunately the realm join command fails with /usr/bin/authselect tool not found (which is a Redhat-only tool).

machine # [   13.565952] realmd[769]:  * /nix/store/lf0wpjrj8yx4gsmw2s3xfl58ixmqk8qa-bash-5.2-p15/bin/bash -c /usr/bin/authselect select sssd with-mkhomedir --force && /nix/store/vapnrxrw3b21c7ji61bmnbzl2cj1vl96-systemd-254.3/bin/systemctl enable oddjobd.service && /nix/store/vapnrxrw3b21c7ji61bmnbzl2cj1vl96-systemd-254.3/bin/systemctl start oddjobd.service
machine # [   13.573824] realmd[769]: process started: 934
machine # [   13.580805] realmd[769]: /nix/store/lf0wpjrj8yx4gsmw2s3xfl58ixmqk8qa-bash-5.2-p15/bin/bash: line 1: /usr/bin/authselect: No such file or directory

I think we need to adapt the realmd-distro.conf configuration file for NixOS.

Yes, working on this exactly right now. Will onboard the other suggestions too (including the INI config one)

Just curious what your thoughts were for going forward with this. I think I prefer the INI config method, as it would be more reproducible.