beatzaplenty/debian-configuration
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12 Commits 4 Branches 0 Tags
4aadef8e97a684c837b6fd8f70f6b9d75f97a21f
Commit Graph
6 Commits
Author SHA1 Message Date
beatzaplentyandClaude Sonnet 4.6 4aadef8e97 docs: update documentation for debian-configuration repo rename
Secret Scan / Scan for secrets and sensitive config (push) Failing after 3s
Details
Secret Scan / Scan for secrets and sensitive config (pull_request) Failing after 3s
Details 
- Root README.md: new, describes overall repo layout (proxmox/, pihole/,
  scripts/) and secret-scanning workflow
- Root CLAUDE.md: new, cross-section guardrails and instructions for
  adding new machine types; references proxmox/CLAUDE.md and pihole/
  section-specific rules
- pihole/README.md: new, covers scripts usage, notable DHCP/PXE config,
  EFI VM requirements (VirtIO RNG, Secure Boot), and secrets handling
- proxmox/README.md: add repo-context note pointing back to root README

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
 2026-07-23 12:35:30 +10:00
beatzaplentyandClaude Sonnet 4.6 2909db5d04 restructure: move proxmox/ into subfolder, add pihole/ section 
All existing content moved from repo root into proxmox/ to make room
for other Debian machine configs. Adds pihole/ with:

- config/pihole.toml — snapshot of current Pi-hole v6 config
- config/dnsmasq.d/99-ipxe-chainload.conf — custom PXE DHCP rules
  (EFI/BIOS iPXE chainload, fixed tag-specificity bug for UEFI boot)
- pull-config.sh <source-host> <dest-dir> — pull live config to disk
- apply-config.sh <source-dir> <dest-host> — push config to a Pi-hole

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
 2026-07-23 12:16:35 +10:00
beatzaplenty 04d1e63f0a Updated environment 2026-07-21 23:14:20 +00:00
beatzaplenty 2cca6a7dc0 Stage 1 base config/hardening toolset, applied and verified on pve1 
Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).

Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.

Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.
 2026-07-21 05:44:50 +00:00
beatzaplenty 24a0047fa8 Drop ZFS-replication as an interim HA step; jump straight to Ceph 
Simplifies the storage model to one long-term tier (Ceph) instead of
two. Node 1 runs local ZFS only until nodes 2/3 join, at which point
Ceph goes live and VMs migrate onto it directly.
 2026-07-20 11:54:17 +10:00
beatzaplenty a854412117 Initial planning docs and hardening scripts for HA rebuild 
Covers node 1 hardware/network layout, LVM-thin -> ZFS migration path,
Ceph as the future HA storage upgrade, and baseline SSH/firewall
hardening.
 2026-07-20 11:45:54 +10:00