Authentication methods are tried in order, so if another NixOS module defines a specific ident mapping like local hydra all ident map=hydra-users it should appear before the generic local all all ident