Installs and documents the FreeIPA identity management server at
domain-controller.sweet.home (VMID 108, pve1). Provides Kerberos,
LDAP, and integrated DNS for the SWEET.HOME realm.
New section: freeipa/
- docs/install.md: full step-by-step reproduction procedure including
Proxmox VM prep (Rocky Linux 9 GenericCloud, SeaBIOS, cloud-init),
swap setup, static IP, /etc/hosts fix, ipa-server-install flags
- docs/pihole-dns.md: how to configure Pi-hole to forward sweet.home
queries to the FreeIPA BIND instance
- scripts/install.sh: idempotent install script with pre-flight checks;
reads passwords from env or interactive prompt (never commits them)
- scripts/configure-pihole-dns.sh: idempotent Pi-hole forwarder setup
- scripts/verify.sh: read-only health check (13 checks, 0 side effects)
- CLAUDE.md: host guardrails for domain-controller
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Jbvxx4xbHVcx1NkK3vtmK
Adds an inbound ACCEPT rule for TCP 45876 so the beszel hub
can poll the agent running on pve1. Scoped to +mgmt (192.168.2.0/24)
to stay consistent with the existing default-deny policy.
Rule applied live on pve1 via pve-firewall restart (2026-07-24).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules
for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns
- .github/workflows/secret-scan.yml — GitHub Actions (full history scan)
- .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow)
- scripts/check-secrets.sh — shared runner used by both CI and local;
supports --staged-only for pre-commit hook use; falls back to Docker
if gitleaks isn't on PATH
- scripts/install-hooks.sh — installs pre-commit hook pointing at above
- pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash
in pihole.toml in-place before the file is committed
- pihole/pull-config.sh — updated to call sanitize-config.sh
automatically after every pull so the repo stays clean by default
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
All existing content moved from repo root into proxmox/ to make room
for other Debian machine configs. Adds pihole/ with:
- config/pihole.toml — snapshot of current Pi-hole v6 config
- config/dnsmasq.d/99-ipxe-chainload.conf — custom PXE DHCP rules
(EFI/BIOS iPXE chainload, fixed tag-specificity bug for UEFI boot)
- pull-config.sh <source-host> <dest-dir> — pull live config to disk
- apply-config.sh <source-dir> <dest-host> — push config to a Pi-hole
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
New script setup-linux-admin-user.sh creates the Linux system user,
installs an SSH authorized key, and adds the user to the sudo group.
Integrated into bootstrap.sh before harden-ssh.sh so key-based access
is in place before password authentication is disabled.
bootstrap.sh now accepts ADMIN_USER and ADMIN_SSH_KEY env vars to run
user setup and setup-admin-sudo.sh automatically at the right point.
audit.sh checks that at least one non-root user has an authorized key.
docs/04-security-hardening.md updated with the new steps and ordering.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Single-user Nix on PVE nodes is owned by root. Add the fixed Nix binary
path (/nix/var/nix/profiles/default/bin/nix) to the NOPASSWD sudoers
rule so non-root SSH users can run nix build from create-proxmox-resource.sh.
Gracefully skips with a warning if Nix isn't installed yet (run after
codex-setup.sh bootstraps the node).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The nixos flake's create-proxmox-resource.sh runs pvesh/qm/pct over
non-interactive SSH, which requires NOPASSWD sudo for those binaries.
pvesh moved from /usr/sbin to /usr/bin in PVE 8.x, so the script
resolves paths at runtime rather than hardcoding them, preventing the
silent NOPASSWD-miss that caused ipcc_send_rec errors.
- scripts/setup-admin-sudo.sh: new script, takes username, writes
/etc/sudoers.d/<user>-proxmox with correct resolved paths and
validates it with visudo -c before leaving it in place
- scripts/bootstrap.sh: add setup-admin-sudo.sh to post-steps list
- scripts/audit.sh: check that a *-proxmox sudoers file exists with
NOPASSWD for all three tools
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).
Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.
Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.
Simplifies the storage model to one long-term tier (Ceph) instead of
two. Node 1 runs local ZFS only until nodes 2/3 join, at which point
Ceph goes live and VMs migrate onto it directly.
beatzaplentyandClaude Sonnet 4.6