# raspberrypi

Configuration scripts for `raspberrypi.tail13f623.ts.net` — Raspberry Pi 4
running Debian 12 bookworm (aarch64). Reachable from LAN via Tailscale
MagicDNS (`tail13f623.ts.net`).

## Services

- **Traefik** — reverse proxy (ports 80, 443, 8080)
- **Uptime Kuma** — uptime monitoring
- **CrowdSec** — intrusion detection
- **Beszel agent** — metrics collection

## IPA enrollment

The Pi is enrolled in the `sweet.home` FreeIPA domain. SSSD resolves:
- `admins (GID 50000)` — sudo access
- `docker-access (GID 50010)` — docker socket access

## Setup scripts

Run these **as root** (or via `sudo`) after `ipa-client-install` completes.

### 1. IPA sudo

```bash
sudo ./scripts/setup-ipa-sudo.sh
```

Writes `/etc/sudoers.d/ipa-admins` granting `%admins NOPASSWD:ALL`. After
this, IPA users in the `admins` group can `sudo` without a password.

### 2. Docker GID

```bash
sudo ./scripts/setup-docker-ipa-gid.sh
```

Pins the local `docker` group GID to 50010 to match the IPA `docker-access`
group. Restarts `docker.socket` + `docker.service` to recreate the socket
with the new GID. After this, IPA members of `docker-access` can run docker
without any per-host group membership entry.

## Current status

| Item | Status |
|---|---|
| IPA enrollment | ✅ |
| SSH (wayne) | ✅ via `raspberrypi.tail13f623.ts.net` |
| Sudo (wayne, NOPASSWD) | ✅ `/etc/sudoers.d/ipa-admins` |
| Docker (wayne, via IPA group) | ✅ docker group GID = 50010 |
| Bootstrap sudo | ✅ local `raspi` user, NOPASSWD |