# raspberrypi CLAUDE.md

Guardrails for Claude Code working on raspberrypi configuration.

## Host

`raspberrypi.tail13f623.ts.net` (100.86.56.87) — Raspberry Pi 4, Debian 12
bookworm (aarch64). Reachable from LAN via Tailscale MagicDNS.

## Production status

The Raspberry Pi is a **production host** running live services (Traefik,
Uptime Kuma, CrowdSec, Beszel agent). Treat it the same as pve1: read-only
inspection is always fine; any script that writes to the host requires
explicit same-session operator go-ahead.

## Bootstrap access

The local `raspi` account has NOPASSWD sudo and the nixos ED25519 key
authorized. Use it to bootstrap IPA sudo rules or make root-level changes
when `wayne` sudo is not yet working.

## IPA integration

- Enrolled in `SWEET.HOME` realm via `ipa-client-install`.
- SSSD resolves IPA groups: `admins (50000)`, `docker-access (50010)`.
- `%admins NOPASSWD:ALL` granted via `/etc/sudoers.d/ipa-admins`
  (written by `scripts/setup-ipa-sudo.sh`).

## Docker GID

The local `docker` group GID is pinned to 50010 (`groupmod --non-unique`)
so it matches the IPA `docker-access` group. Members of `docker-access`
in IPA can run docker without any per-host group membership entry.
Applied by `scripts/setup-docker-ipa-gid.sh`.

## What must never be committed

SSH private keys, passwords, API tokens, Tailscale auth keys.