# Gitleaks configuration for debian-configuration repo.
# Extends the default ruleset with Pi-hole-specific secret patterns.
# https://github.com/gitleaks/gitleaks

title = "debian-configuration secret scan"

[extend]
  useDefault = true

# ── Custom rules ───────────────────────────────────────────────────────────────

[[rules]]
  id          = "pihole-pwhash"
  description = "Pi-hole password hash (pihole.toml webserver.api.pwhash)"
  regex       = '''pwhash\s*=\s*"[^"]{10,}"'''
  tags        = ["pihole", "password"]

[[rules]]
  id          = "pihole-totp-secret"
  description = "Pi-hole 2FA TOTP secret"
  regex       = '''totp_secret\s*=\s*"[^"]{10,}"'''
  tags        = ["pihole", "2fa"]

[[rules]]
  id          = "pihole-app-pwhash"
  description = "Pi-hole app password hash"
  regex       = '''app_pwhash\s*=\s*"[^"]{10,}"'''
  tags        = ["pihole", "password"]

# ── Allowlist ──────────────────────────────────────────────────────────────────

[allowlist]
  description = "Known-safe patterns in this repo"
  regexes     = [
    # TLS cert path reference — not the key itself
    '''cert\s*=\s*"/etc/pihole/tls\.pem"''',
  ]
  paths       = [
    # Example/template files are intentionally non-live
    '''\.example$''',
  ]