From e70cbd3473cc7033f6e2e4f63e4c2a001c1b79e5 Mon Sep 17 00:00:00 2001 From: Alexandru Macocian Date: Wed, 13 May 2026 01:19:45 +0200 Subject: [PATCH] Remove sssd blocker for docker and shadow charlie group --- docs/onboarding.md | 25 ++++++++++++++++--------- docs/roadmap.md | 1 + 2 files changed, 17 insertions(+), 9 deletions(-) diff --git a/docs/onboarding.md b/docs/onboarding.md index 8a75163..8742d76 100644 --- a/docs/onboarding.md +++ b/docs/onboarding.md @@ -803,15 +803,22 @@ sudo tee /etc/systemd/system/docker.socket.d/group.conf >/dev/null <<'INI' SocketGroup=charlie-deploy INI -# 3. Make sure dockerd starts after SSSD is up, so the charlie-deploy group -# is resolvable when docker.service starts. Without this, dockerd may -# fall back to the default group on first boot. -sudo install -d -m 0755 /etc/systemd/system/docker.service.d -sudo tee /etc/systemd/system/docker.service.d/wait-for-sssd.conf >/dev/null <<'INI' -[Unit] -After=sssd.service -Wants=sssd.service -INI +# 3. Shadow the LDAP `charlie-deploy` group with a local /etc/group entry +# using the same GID. At boot, docker.socket's sd-chown helper resolves +# SocketGroup= via NSS *before* sssd is ready, and on morgott sssd can +# never be a hard prereq for docker anyway (sssd → ldap container → +# docker → circular). nss_files is consulted before sss, so a local +# entry with the matching GID lets the socket come up instantly. SSSD +# still provides LDAP users' supplementary group membership once it's +# up, which is what actually grants access — the local entry's member +# list stays empty on purpose. +# +# Get the LDAP-assigned GID first; `groupadd` will refuse because NSS +# reports the group already exists, so append directly to /etc/group. +GID=$(getent group charlie-deploy | cut -d: -f3) +test -n "$GID" || { echo "charlie-deploy not in LDAP yet"; exit 1; } +getent -s files group charlie-deploy >/dev/null \ + || echo "charlie-deploy:x:${GID}:" | sudo tee -a /etc/group sudo systemctl daemon-reload sudo systemctl restart docker.socket docker.service diff --git a/docs/roadmap.md b/docs/roadmap.md index 6641dab..67557f4 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -6,6 +6,7 @@ Open work, grouped by theme. Done items are dropped — git history has them. - [ ] **Mohg reonboarding.** Wipe + reinstall mohg, run a `charlie-host-bootstrap` (see [Centralization](#centralization)) end-to-end. Folds mohg into auto-deploy for [`portainer-agent`](https://gitea.alexandru.macocian.me/Charlie/portainer-agent) and [`otelcollector`](https://gitea.alexandru.macocian.me/Charlie/otelcollector). - [ ] **Malenia (mac) re-onboard.** NFS mount unreliable from malenia → otelcollector mac install deferred. Investigate NFS/SMB/AFP options or switch sync mechanism. Once reonboarded, refactor `otelcol.mac.yaml` to read `${env:VM_INGEST_AUTH}` and drop the credential from git (collapses rotation from 3 places to 1). +- [ ] **Break the LDAP-on-morgott boot cycle.** `ldap` runs as a docker stack on morgott, so sssd can't be a hard prereq for docker (sssd → ldap container → docker → circular). We currently work around it with a local `/etc/group` shadow entry for `charlie-deploy` (see [onboarding.md → Charlie deploy group](onboarding.md#charlie-deploy-group), step 3). Architecturally cleaner: move `Charlie/ldap` onto a host whose docker socket doesn't depend on an LDAP-resolved group, or run slapd natively somewhere. Removes the GID-duplication and the "if LDAP renumbers the group, update each host's /etc/group" footgun. - [ ] **Miquella into the LDAP/SSH fold.** DSM is currently outside SSSD-backed identity. Configure DSM's LDAP client to point at `Charlie/ldap`, trust the SSH signing CA, accept ephemeral certs from gssh. Goal: malenia + miquella both onboarded into the gssh terminal flow with LDAP-driven access. ## Automation / observability