feat(docker): add IPA wayne user to docker group

Grants the domain wayne account docker socket access on docker.sweet.home
without needing sudo, alongside the existing nixos local user membership.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hosts/docker/host.nix

@@ -14,6 +14,11 @@
   };
   boot.zfs.forceImportRoot = false;
 
+  # Only advertise the LAN interface to IPA DNS. Without this, SSSD registers
+  # every Docker bridge (172.x.x.x) as an A record for docker.sweet.home —
+  # the default dyndns.interface = "*" catches them all.
+  security.ipa.dyndns.interface = vars.lxcLanInterface; # eth0
+
   # Preserved from the pre-refactor `docker` target — stateVersion must never
   # be bumped on an already-installed machine.
   system.stateVersion = "25.05";

modules/build-types/docker.nix

@@ -33,6 +33,9 @@
   ];
 
   users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
+  # Grant the IPA domain user docker access via the local group so that
+  # `wayne` can manage containers without sudo.
+  users.groups.docker.members = [ "wayne" ];
   services.openssh.settings.PermitRootLogin = "yes";
 
   networking.firewall.allowedTCPPorts = [