ci: add secret scanning for GitHub, Gitea, and local use

- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules
  for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns
- .github/workflows/secret-scan.yml — GitHub Actions (full history scan)
- .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow)
- scripts/check-secrets.sh — shared runner used by both CI and local;
  supports --staged-only for pre-commit hook use; falls back to Docker
  if gitleaks isn't on PATH
- scripts/install-hooks.sh — installs pre-commit hook pointing at above
- pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash
  in pihole.toml in-place before the file is committed
- pihole/pull-config.sh — updated to call sanitize-config.sh
  automatically after every pull so the repo stays clean by default

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

pihole/pull-config.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Pull Pi-hole configuration from a running instance to a local directory.
+# Sensitive fields (password hashes, TOTP secrets) are redacted automatically.
 #
 # Usage: pull-config.sh <source-host> <dest-dir>
 #   source-host  SSH-reachable hostname or IP of the source Pi-hole
@@ -7,10 +8,12 @@
 #
 # Example:
 #   ./pull-config.sh root@pihole ./config
-#   ./pull-config.sh root@192.168.2.100 /backup/pihole-$(date +%Y%m%d)
+#   ./pull-config.sh root@192.168.2.253 /backup/pihole-$(date +%Y%m%d)
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
 usage() {
   echo "Usage: $(basename "$0") <source-host> <dest-dir>" >&2
   echo "  source-host  SSH target for the source Pi-hole (e.g. root@pihole)" >&2
@@ -30,6 +33,7 @@ mkdir -p "${DEST}/dnsmasq.d"
 # ── pihole.toml ────────────────────────────────────────────────────────────────
 echo "  pihole.toml"
 ssh "${SOURCE}" "cat /etc/pihole/pihole.toml" > "${DEST}/pihole.toml"
+"${SCRIPT_DIR}/sanitize-config.sh" "${DEST}/pihole.toml"
 
 # ── custom dnsmasq drop-ins ────────────────────────────────────────────────────
 # Pi-hole manages its own generated config; we only capture user-added files.

pihole/sanitize-config.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Redact sensitive fields from a Pi-hole pihole.toml before committing.
+# Called automatically by pull-config.sh; can also be run manually.
+#
+# Usage: sanitize-config.sh <pihole.toml>
+#   Edits the file in-place, replacing sensitive field values with "".
+
+set -euo pipefail
+
+usage() {
+  echo "Usage: $(basename "$0") <pihole.toml>" >&2
+  exit 1
+}
+
+[[ $# -eq 1 ]] || usage
+FILE="$1"
+[[ -f "$FILE" ]] || { echo "Error: file not found: $FILE" >&2; exit 1; }
+
+REDACTED=0
+
+redact_field() {
+  local field="$1"
+  # Match lines like:  pwhash = "some-value"  and blank the value
+  if grep -qE "^\s+${field}\s*=\s*\"[^\"]{1,}\"" "$FILE"; then
+    sed -i -E "s|^(\s+${field}\s*=\s*)\"[^\"]*\"|\1\"\"|" "$FILE"
+    echo "  redacted: ${field}"
+    REDACTED=$((REDACTED + 1))
+  fi
+}
+
+echo "Sanitizing $(basename "$FILE")..."
+redact_field "pwhash"
+redact_field "app_pwhash"
+redact_field "totp_secret"
+
+if [[ $REDACTED -eq 0 ]]; then
+  echo "  (nothing to redact)"
+else
+  echo "  ${REDACTED} field(s) redacted."
+fi