From 8411cc5e16807250c330cdc04a3aa2e7f3717c37 Mon Sep 17 00:00:00 2001
From: Joshua Holland <joshua@uptrusthq.com>
Date: Thu, 18 Sep 2025 17:30:56 +0000
Subject: [PATCH] nixos/users-groups: expand subuid/subgid ranges to fix UID
 allocation errors

Resolves "update-users-groups.pl: out of free UIDs or GIDs" error by
increasing the hardcoded UID ranges to match the limitations of UIDs
established by shadow.nix. Without this change, regular user creation is
limited to 100 total users across the lifetime of a NixOS system.

Refs: #437870
---
 nixos/modules/config/update-users-groups.pl | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/config/update-users-groups.pl b/nixos/modules/config/update-users-groups.pl
index 0d192ae04073..3dc5e96cdec8 100644
--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@@ -334,8 +334,13 @@ $subUidsPrevUsed{$_} = 1 foreach values %{$subUidMap};
 sub allocSubUid {
     my ($name, @rest) = @_;
 
-    # TODO: No upper bounds?
-    my ($min, $max, $delta) = (100000, 100000 + 100 * 65536, 65536);
+    # The upper bound of 29000 users is derived from limits in
+    # nixos/modules/programs/shadow.nix which allocates the UID ranges
+    # 1000-29999 for regular users. System users are not allocated
+    # subordinate user or group IDs, and so after removing those 999
+    # system users, we end up with 29000 users that are non-system users
+    # that need subUIDs and subGIDs.
+    my ($min, $max, $delta) = (100000, 100000 + 29000 * 65536 - 1, 65536);
     my $prevId = $subUidMap->{$name};
     if (defined $prevId && !defined $subUidsUsed{$prevId}) {
         $subUidsUsed{$prevId} = 1;