Managed mode

One place for the accounts of a household or a small business. Machines enrol with a code and stay in sync — online or off.

A local-only machine keeps its accounts in one file and nothing outside it has an opinion. That is the right shape for a personal computer and the wrong shape for the household with four people and three computers, or the shop with six seats and no server room: it means creating the same accounts by hand on every machine and keeping every password in sync forever.

Managed mode is the third way, alongside local accounts and Active Directory: a hosted control plane owns users, groups, device assignments and policy for one household or organisation. Each machine enrols once with a code; from then on it periodically pulls a signed bundle of its accounts and applies it locally.

The property that shapes the design: the network is not available at the moment that matters. Login happens at the lock screen of a closed laptop on a train. So every authentication decision is made from state cached on the machine, and the network only ever refreshes that state. An offline managed machine authenticates its users, enforces its policy and keeps its group membership exactly as it does at home.

What it costs the machine: nothing extra

Managed users are systemd JSON user records in /etc/userdb/, resolved by the system’s own name-service layer and authenticated by the same PAM path local accounts use. The mechanism ships in every Immos image and is inert until a machine enrols — managed mode adds zero packages to the system, which on a distribution with no package manager is the only way a feature like this can ship at all.

Bundles are signed with OpenPGP; the verifying key is baked into the image, the same trust path the update system uses. A bundle the machine cannot verify is not applied, full stop.

Enrolling

On a machine that is already running:

$ sudo immos-managed enroll --code FAMILY-2026-XXXX

From the installer, “Managed system” is one of the three account choices — pick it instead of a local administrator and paste the enrolment code. The enrolment happens before anything is written to disk, and the install will not proceed until it has succeeded, so a managed machine never carries a local account nobody was told about.

The command line

A System Settings page covers the same ground without a terminal, including enrolling and checking status.

What the controlling side can do

• Users and groups — who exists on which machine, with real names and home directories.
• Administrators — a named group gets sudo and polkit rights.
• Access policy — which machines a user may sign in on.

Two deliberate absences: there is no remote wipe — the machine keeps working, offline, with its cached accounts — and parental controls (screen time, per-user app limits) are a reserved field in the bundle with the UI still to come; the plumbing rides along with every sync already.

Passwords, offline, honestly

An offline user logs in normally — the hash lives on the machine, protected the same way the local administrator’s is. But a password change needs the control plane: passwd cannot write a managed record, so immos-managed passwd does it online, and offline the honest answer is “not now”. The change lands on the machine at the next sync.

Leaving

immos-managed leave converts the managed accounts into ordinary local ones and removes the sync machinery. Nothing is deleted: the people who were managed users keep their passwords, their homes and their files — the machine simply stops taking orders. The local administrator that enrolled the machine is untouched throughout.

The full design — the record format, the sync failure model, the API contract — is written up in the repository, plan/19-managed-mode.md.