From 9d1b6f667452f30cdc11a617b758102750198c96 Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Sun, 5 Oct 2025 22:09:43 +0200
Subject: [PATCH] nixos/ipa: install shells into well-known paths

---
 nixos/modules/security/ipa.nix | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/nixos/modules/security/ipa.nix b/nixos/modules/security/ipa.nix
index 695de6e2d230..b9ed5ff36bf7 100644
--- a/nixos/modules/security/ipa.nix
+++ b/nixos/modules/security/ipa.nix
@@ -131,6 +131,22 @@ in
         default = true;
         description = "Whether to whitelist the FreeIPA domain in Chromium.";
       };
+
+      shells = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
+        default = with pkgs; [
+          bash
+          zsh
+        ];
+        defaultText = lib.literalExpression ''
+          with pkgs; [ bash zsh ];
+        '';
+        description = ''
+          List of shells which binaries should be installed to /bin/<name>.
+
+          FreeIPA typicly configures somesthing like /bin/bash into the users shell attribute.
+        '';
+      };
     };
   };
 
@@ -296,5 +312,15 @@ in
     networking.timeServers = lib.optional cfg.useAsTimeserver cfg.server;
 
     security.pki.certificateFiles = lib.singleton cfg.certificate;
+
+    systemd.tmpfiles.settings."10-ipa-shells" = lib.foldl' (
+      acc: pkg:
+      (
+        acc
+        // {
+          ${pkg.shellPath}."L+".argument = "${pkg}${pkg.shellPath}";
+        }
+      )
+    ) { } cfg.shells;
   };
 }