A bunch of changes...

config/hosts/clunk.nix

@@ -88,9 +88,12 @@ in {
 
     auth.kdc = {
       enable = true;
-      realm = "SELBY.CA";
-      acl-file = "/var/heimdal/access.acl";
+      realm = "RUS.SELBY.CA";
       bind-addresses = [ "10.0.0.1" "127.0.0.1" "::1" ];
+      acl = {
+        "niten" = { perms = [ "all" ]; };
+        "*/root" = { perms = [ "password" "list" ]; };
+      };
     };
 
     secure-dns-proxy = {

config/profiles/common.nix

@@ -22,6 +22,18 @@ in {
 
   system.autoUpgrade.enable = true;
 
+  krb5 = {
+    libdefaults = {
+      allow_weak_crypto = false;
+      dns_lookup_kdc = true;
+      forwardable = true;
+      ignore_acceptor_hostname = true;
+      noaddresses = true;
+      rdns = false;
+      proxiable = true;
+    };
+  };
+
   services = {
     openssh = {
       enable = true;