Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 afabcbbeff

Secret Scan / Scan for secrets and sensitive config (push) Failing after 5s

Details

feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 15:47:30 +10:00

2.8 KiB

Raw Permalink Blame History

CLAUDE.md

Guidance for Claude Code working in this repo. These instructions OVERRIDE any default behaviour and must be followed exactly.

Repo purpose

Configuration toolsets and docs for Wayne's Debian-based LAN machines. Four sections currently exist: proxmox/ (Proxmox VE hosts), pihole/ (Pi-hole DNS/DHCP), freeipa/ (FreeIPA identity management), and raspberrypi/ (Raspberry Pi 4). Each has its own README.

Safety rules (apply everywhere in this repo)

Never commit secrets. SSH private keys, passwords, hashes, TOTP seeds, API tokens, or wifi passphrases must not appear in committed files. The CI pipeline (scripts/check-secrets.sh) enforces this on every push; the pre-commit hook (scripts/install-hooks.sh) catches it locally before it reaches the remote.
pihole/pull-config.sh auto-sanitises sensitive fields from pihole.toml on every pull. If you write config to pihole/config/ by any other means, run pihole/sanitize-config.sh on the result before committing.
Scripts that SSH into live machines make real changes. Don't run pihole/apply-config.sh against a production Pi-hole, or any script in proxmox/scripts/ against pve1, without an explicit same-session go-ahead from the operator. The section-specific CLAUDE.md files spell out the per-host guardrails in detail.

Section-specific guidance

Proxmox: see proxmox/CLAUDE.md — covers pve1 (production, off-limits by default) vs. pve-test (sandbox, Claude's default target), per-host authorisation scope, and network-surgery hazards.
Pi-hole: pihole/ has no live-host guardrails beyond the secret rules above. apply-config.sh is the only script that touches a live host; treat its <dest-host> argument as production unless you're explicitly testing on a throwaway instance.
FreeIPA: freeipa/ documents and scripts for the FreeIPA identity management server (domain-controller.sweet.home, VMID 108 on pve1). All scripts that SSH into the server are production operations — treat them as off-limits without an explicit same-session go-ahead.
Raspberry Pi: see raspberrypi/CLAUDE.md — production host running live services; same write-authorisation rules as pve1. Bootstrap access via local raspi user (NOPASSWD sudo). IPA-enrolled; docker GID pinned to 50010 to match IPA docker-access group.

Adding a new machine type

Create a new top-level directory (e.g. nginx/, wireguard/) with:

README.md — purpose, quick-start, and current status
CLAUDE.md — host-specific guardrails (which hosts are production, what requires explicit authorisation, what must never be committed)
scripts/ and/or config/ as needed

Update the root README.md layout table and this file's "Section-specific guidance" list when you do.