I have a Proxmox VM container server which currently consists of:
Freeipa installed on the podman0 bridge
Mariadb and Nextcloud installed on the podman1 bridge
I hope to eventually add quite a few more containers ranging from home assistant to Gitlab.
The Freeipa and Nextcloud are both working just fine and the Nextcloud server can use LDAP to authenticate users from the Freeipa.
The problem is that I also want to share out the Freeipa data so I can access it as a normal CIFS share. I was going to just create the NixOS samba config for this, but then I realized that the container server would have to be attached to the Freeipa for this to work correctly. I have assembled the appropriate nix config for this using security.ipa, but whenever I try to build it the Freeipa container will not run. I sort of expected this chicken and the egg problem and I have three potential solutions, but I having difficulty selecting one:
- install freeipa on another nix VM as a container and limit that server to only that container
- install freeipa on rocky/alma/etc, but then I have to administrate said rocky/alma/etc.
- create a container just for handling the sharing so that the container could be joined, but the container server would not have to be (I like that this fits within the current schema)
The first question is whether anyone has a reason that I should use Freeipa directly on Rocky/Alma/etc rather than on a container on Nix. (I wish I could just setup Freeipa on NixOS, but I do not believe there is any current support for that).
The second question is somewhat dependent on the first. If anyone else likes the idea of just having a container for sharing, then I would like to figure out the best way to do it. I could just do a NixOS container (nix-ception) and use the standard samba config, or I could go for something like a containerized version of open media vault.
I have my entire network in a Nix flake and I deploy it all from a single workstation. I really like the ability to keep a configuration managed approach to the network which is why I am so heavily into Nix for this.
Any thoughts, suggestions, even constructive opinions would be helpful.
(Edited for clarification and spelling)