Archived
beatzaplentyandClaude Sonnet 4.6
b269a5d616
- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns - .github/workflows/secret-scan.yml — GitHub Actions (full history scan) - .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow) - scripts/check-secrets.sh — shared runner used by both CI and local; supports --staged-only for pre-commit hook use; falls back to Docker if gitleaks isn't on PATH - scripts/install-hooks.sh — installs pre-commit hook pointing at above - pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash in pihole.toml in-place before the file is committed - pihole/pull-config.sh — updated to call sanitize-config.sh automatically after every pull so the repo stays clean by default Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
42 lines
1.5 KiB
TOML
42 lines
1.5 KiB
TOML
# Gitleaks configuration for debian-configuration repo.
|
|
# Extends the default ruleset with Pi-hole-specific secret patterns.
|
|
# https://github.com/gitleaks/gitleaks
|
|
|
|
title = "debian-configuration secret scan"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# ── Custom rules ───────────────────────────────────────────────────────────────
|
|
|
|
[[rules]]
|
|
id = "pihole-pwhash"
|
|
description = "Pi-hole password hash (pihole.toml webserver.api.pwhash)"
|
|
regex = '''pwhash\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "password"]
|
|
|
|
[[rules]]
|
|
id = "pihole-totp-secret"
|
|
description = "Pi-hole 2FA TOTP secret"
|
|
regex = '''totp_secret\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "2fa"]
|
|
|
|
[[rules]]
|
|
id = "pihole-app-pwhash"
|
|
description = "Pi-hole app password hash"
|
|
regex = '''app_pwhash\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "password"]
|
|
|
|
# ── Allowlist ──────────────────────────────────────────────────────────────────
|
|
|
|
[allowlist]
|
|
description = "Known-safe patterns in this repo"
|
|
regexes = [
|
|
# TLS cert path reference — not the key itself
|
|
'''cert\s*=\s*"/etc/pihole/tls\.pem"''',
|
|
]
|
|
paths = [
|
|
# Example/template files are intentionally non-live
|
|
'''\.example$''',
|
|
]
|