Remove sssd blocker for docker and shadow charlie group

docs/onboarding.md

@@ -803,15 +803,22 @@ sudo tee /etc/systemd/system/docker.socket.d/group.conf >/dev/null <<'INI'
 SocketGroup=charlie-deploy
 INI
 
-# 3. Make sure dockerd starts after SSSD is up, so the charlie-deploy group
-#    is resolvable when docker.service starts. Without this, dockerd may
-#    fall back to the default group on first boot.
-sudo install -d -m 0755 /etc/systemd/system/docker.service.d
-sudo tee /etc/systemd/system/docker.service.d/wait-for-sssd.conf >/dev/null <<'INI'
-[Unit]
-After=sssd.service
-Wants=sssd.service
-INI
+# 3. Shadow the LDAP `charlie-deploy` group with a local /etc/group entry
+#    using the same GID. At boot, docker.socket's sd-chown helper resolves
+#    SocketGroup= via NSS *before* sssd is ready, and on morgott sssd can
+#    never be a hard prereq for docker anyway (sssd → ldap container →
+#    docker → circular). nss_files is consulted before sss, so a local
+#    entry with the matching GID lets the socket come up instantly. SSSD
+#    still provides LDAP users' supplementary group membership once it's
+#    up, which is what actually grants access — the local entry's member
+#    list stays empty on purpose.
+#
+#    Get the LDAP-assigned GID first; `groupadd` will refuse because NSS
+#    reports the group already exists, so append directly to /etc/group.
+GID=$(getent group charlie-deploy | cut -d: -f3)
+test -n "$GID" || { echo "charlie-deploy not in LDAP yet"; exit 1; }
+getent -s files group charlie-deploy >/dev/null \
+  || echo "charlie-deploy:x:${GID}:" | sudo tee -a /etc/group
 
 sudo systemctl daemon-reload
 sudo systemctl restart docker.socket docker.service

docs/roadmap.md

@@ -6,6 +6,7 @@ Open work, grouped by theme. Done items are dropped — git history has them.
 
 - [ ] **Mohg reonboarding.** Wipe + reinstall mohg, run a `charlie-host-bootstrap` (see [Centralization](#centralization)) end-to-end. Folds mohg into auto-deploy for [`portainer-agent`](https://gitea.alexandru.macocian.me/Charlie/portainer-agent) and [`otelcollector`](https://gitea.alexandru.macocian.me/Charlie/otelcollector).
 - [ ] **Malenia (mac) re-onboard.** NFS mount unreliable from malenia → otelcollector mac install deferred. Investigate NFS/SMB/AFP options or switch sync mechanism. Once reonboarded, refactor `otelcol.mac.yaml` to read `${env:VM_INGEST_AUTH}` and drop the credential from git (collapses rotation from 3 places to 1).
+- [ ] **Break the LDAP-on-morgott boot cycle.** `ldap` runs as a docker stack on morgott, so sssd can't be a hard prereq for docker (sssd → ldap container → docker → circular). We currently work around it with a local `/etc/group` shadow entry for `charlie-deploy` (see [onboarding.md → Charlie deploy group](onboarding.md#charlie-deploy-group), step 3). Architecturally cleaner: move `Charlie/ldap` onto a host whose docker socket doesn't depend on an LDAP-resolved group, or run slapd natively somewhere. Removes the GID-duplication and the "if LDAP renumbers the group, update each host's /etc/group" footgun.
 - [ ] **Miquella into the LDAP/SSH fold.** DSM is currently outside SSSD-backed identity. Configure DSM's LDAP client to point at `Charlie/ldap`, trust the SSH signing CA, accept ephemeral certs from gssh. Goal: malenia + miquella both onboarded into the gssh terminal flow with LDAP-driven access.
 
 ## Automation / observability