Archived
beatzaplentyandClaude Sonnet 4.6
b269a5d616
- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns - .github/workflows/secret-scan.yml — GitHub Actions (full history scan) - .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow) - scripts/check-secrets.sh — shared runner used by both CI and local; supports --staged-only for pre-commit hook use; falls back to Docker if gitleaks isn't on PATH - scripts/install-hooks.sh — installs pre-commit hook pointing at above - pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash in pihole.toml in-place before the file is committed - pihole/pull-config.sh — updated to call sanitize-config.sh automatically after every pull so the repo stays clean by default Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
41 lines
1019 B
Bash
Executable File
41 lines
1019 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Redact sensitive fields from a Pi-hole pihole.toml before committing.
|
|
# Called automatically by pull-config.sh; can also be run manually.
|
|
#
|
|
# Usage: sanitize-config.sh <pihole.toml>
|
|
# Edits the file in-place, replacing sensitive field values with "".
|
|
|
|
set -euo pipefail
|
|
|
|
usage() {
|
|
echo "Usage: $(basename "$0") <pihole.toml>" >&2
|
|
exit 1
|
|
}
|
|
|
|
[[ $# -eq 1 ]] || usage
|
|
FILE="$1"
|
|
[[ -f "$FILE" ]] || { echo "Error: file not found: $FILE" >&2; exit 1; }
|
|
|
|
REDACTED=0
|
|
|
|
redact_field() {
|
|
local field="$1"
|
|
# Match lines like: pwhash = "some-value" and blank the value
|
|
if grep -qE "^\s+${field}\s*=\s*\"[^\"]{1,}\"" "$FILE"; then
|
|
sed -i -E "s|^(\s+${field}\s*=\s*)\"[^\"]*\"|\1\"\"|" "$FILE"
|
|
echo " redacted: ${field}"
|
|
REDACTED=$((REDACTED + 1))
|
|
fi
|
|
}
|
|
|
|
echo "Sanitizing $(basename "$FILE")..."
|
|
redact_field "pwhash"
|
|
redact_field "app_pwhash"
|
|
redact_field "totp_secret"
|
|
|
|
if [[ $REDACTED -eq 0 ]]; then
|
|
echo " (nothing to redact)"
|
|
else
|
|
echo " ${REDACTED} field(s) redacted."
|
|
fi
|