Archived
beatzaplentyandClaude Sonnet 4.6
afabcbbeff
Secret Scan / Scan for secrets and sensitive config (push) Failing after 5s
Documents and scripts to reproduce the IPA integration on the Pi (raspberrypi.tail13f623.ts.net, Debian 12 bookworm): - setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1) - setup-docker-ipa-gid.sh: pins local docker group GID to 50010 via groupmod --non-unique so IPA docker-access group membership alone grants docker socket access (mirrors NixOS lib.mkForce approach) - README.md + CLAUDE.md: quick-start, current status, guardrails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
58 lines
2.8 KiB
Markdown
58 lines
2.8 KiB
Markdown
# CLAUDE.md
|
|
|
|
Guidance for Claude Code working in this repo. These instructions
|
|
OVERRIDE any default behaviour and must be followed exactly.
|
|
|
|
## Repo purpose
|
|
|
|
Configuration toolsets and docs for Wayne's Debian-based LAN machines.
|
|
Four sections currently exist: `proxmox/` (Proxmox VE hosts),
|
|
`pihole/` (Pi-hole DNS/DHCP), `freeipa/` (FreeIPA identity management),
|
|
and `raspberrypi/` (Raspberry Pi 4). Each has its own README.
|
|
|
|
## Safety rules (apply everywhere in this repo)
|
|
|
|
- **Never commit secrets.** SSH private keys, passwords, hashes, TOTP
|
|
seeds, API tokens, or wifi passphrases must not appear in committed
|
|
files. The CI pipeline (`scripts/check-secrets.sh`) enforces this on
|
|
every push; the pre-commit hook (`scripts/install-hooks.sh`) catches
|
|
it locally before it reaches the remote.
|
|
- **`pihole/pull-config.sh` auto-sanitises** sensitive fields from
|
|
`pihole.toml` on every pull. If you write config to `pihole/config/`
|
|
by any other means, run `pihole/sanitize-config.sh` on the result
|
|
before committing.
|
|
- **Scripts that SSH into live machines make real changes.** Don't run
|
|
`pihole/apply-config.sh` against a production Pi-hole, or any script
|
|
in `proxmox/scripts/` against `pve1`, without an explicit same-session
|
|
go-ahead from the operator. The section-specific CLAUDE.md files
|
|
spell out the per-host guardrails in detail.
|
|
|
|
## Section-specific guidance
|
|
|
|
- **Proxmox:** see `proxmox/CLAUDE.md` — covers `pve1` (production,
|
|
off-limits by default) vs. `pve-test` (sandbox, Claude's default
|
|
target), per-host authorisation scope, and network-surgery hazards.
|
|
- **Pi-hole:** `pihole/` has no live-host guardrails beyond the secret
|
|
rules above. `apply-config.sh` is the only script that touches a live
|
|
host; treat its `<dest-host>` argument as production unless you're
|
|
explicitly testing on a throwaway instance.
|
|
- **FreeIPA:** `freeipa/` documents and scripts for the FreeIPA identity
|
|
management server (`domain-controller.sweet.home`, VMID 108 on `pve1`).
|
|
All scripts that SSH into the server are production operations — treat
|
|
them as off-limits without an explicit same-session go-ahead.
|
|
- **Raspberry Pi:** see `raspberrypi/CLAUDE.md` — production host running
|
|
live services; same write-authorisation rules as `pve1`. Bootstrap access
|
|
via local `raspi` user (NOPASSWD sudo). IPA-enrolled; docker GID pinned
|
|
to 50010 to match IPA `docker-access` group.
|
|
|
|
## Adding a new machine type
|
|
|
|
Create a new top-level directory (e.g. `nginx/`, `wireguard/`) with:
|
|
- `README.md` — purpose, quick-start, and current status
|
|
- `CLAUDE.md` — host-specific guardrails (which hosts are production,
|
|
what requires explicit authorisation, what must never be committed)
|
|
- `scripts/` and/or `config/` as needed
|
|
|
|
Update the root `README.md` layout table and this file's
|
|
"Section-specific guidance" list when you do.
|