# roles/thin-client/identity/default.nix
#
# Identity layer: Active Directory integration (realm/sssd/krb5 via keytab),
# local break-glass users (without m3ta-home), sudo policy.
#
# All AD-related secrets are provisioned via agenix:
#   secrets/<hostname>-krb5-keytab.age → /etc/krb5.keytab
#
# See README.md for the pre-create workflow.
{config, lib, ...}: {
  imports = [
    ./ad.nix
    ./local-users.nix
    ./sudo.nix
  ];
}