Commit f2d600770455

@@ -203,7 +203,49 @@ install_native_apps() {
 	fi
 }
 
-# --- Phase 5: Home-manager ---
+# --- Phase 5: unscd for nix NSS resolution ---
+
+setup_unscd() {
+	# Nix glibc can't load system NSS modules (libnss_sss.so) so nix programs
+	# can't resolve LDAP/SSSD users. unscd creates /var/run/nscd/socket which
+	# nix glibc queries automatically. Must be built with system gcc/glibc
+	# so it can load system NSS modules.
+	if systemctl is-active --quiet unscd 2>/dev/null; then
+		log_info "unscd already running"
+		return 0
+	fi
+
+	log_info "Building and installing unscd for nix NSS resolution..."
+	sudo dnf install -y gcc make
+
+	local tmpdir
+	tmpdir=$(mktemp -d)
+	curl -sSL https://busybox.net/~vda/unscd/nscd-0.54.c -o "${tmpdir}/nscd.c"
+	gcc -O2 -o "${tmpdir}/unscd" "${tmpdir}/nscd.c"
+	sudo install -m 755 "${tmpdir}/unscd" /usr/local/sbin/unscd
+	rm -rf "${tmpdir}"
+
+	# Create systemd service
+	sudo tee /etc/systemd/system/unscd.service > /dev/null <<-'EOF'
+	[Unit]
+	Description=Name Service Cache Daemon (unscd for nix)
+	After=sssd.service network.target
+
+	[Service]
+	Type=forking
+	ExecStart=/usr/local/sbin/unscd
+	Restart=on-failure
+
+	[Install]
+	WantedBy=multi-user.target
+	EOF
+
+	sudo systemctl daemon-reload
+	sudo systemctl enable --now unscd
+	log_info "unscd installed and running"
+}
+
+# --- Phase 6: Home-manager ---
 
 setup_home_manager() {
 	log_info "Setting up home-manager..."
@@ -309,6 +351,7 @@ main() {
 	build_and_activate
 	setup_wireguard
 	install_native_apps
+	setup_unscd
 	setup_home_manager
 	setup_shell
 	print_summary

@@ -59,23 +59,6 @@ in
       mode = "0644";
     };
 
-    # nscd for nix NSS resolution
-    # Nix glibc can't load system NSS modules (libnss_sss.so) but queries
-    # nscd's socket at /var/run/nscd/socket automatically.
-    # We run unscd from nix with LD_LIBRARY_PATH pointing to system NSS
-    # libs so it can load libnss_sss.so and serve nix programs.
-    systemd.services.unscd = {
-      description = "Name Service Cache Daemon (unscd for nix)";
-      wantedBy = [ "system-manager.target" ];
-      after = [ "network.target" ];
-      serviceConfig = {
-        Type = "forking";
-        Environment = "LD_LIBRARY_PATH=/usr/lib64";
-        ExecStart = "${pkgs.unscd}/bin/nscd";
-        Restart = "on-failure";
-      };
-    };
-
     # Syncthing is managed by home-manager (user service with full folder config)
   };
 }