Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

History

beatzaplentyandClaude Sonnet 4.6 afabcbbeff

Secret Scan / Scan for secrets and sensitive config (push) Failing after 5s

Details

feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 15:47:30 +10:00

scripts

feat(raspberrypi): add Raspberry Pi configuration section

2026-07-28 15:47:30 +10:00

CLAUDE.md

feat(raspberrypi): add Raspberry Pi configuration section

2026-07-28 15:47:30 +10:00

README.md

feat(raspberrypi): add Raspberry Pi configuration section

2026-07-28 15:47:30 +10:00

README.md

raspberrypi

Configuration scripts for raspberrypi.tail13f623.ts.net — Raspberry Pi 4 running Debian 12 bookworm (aarch64). Reachable from LAN via Tailscale MagicDNS (tail13f623.ts.net).

Services

Traefik — reverse proxy (ports 80, 443, 8080)
Uptime Kuma — uptime monitoring
CrowdSec — intrusion detection
Beszel agent — metrics collection

IPA enrollment

The Pi is enrolled in the sweet.home FreeIPA domain. SSSD resolves:

admins (GID 50000) — sudo access
docker-access (GID 50010) — docker socket access

Setup scripts

Run these as root (or via sudo) after ipa-client-install completes.

1. IPA sudo

sudo ./scripts/setup-ipa-sudo.sh

Writes /etc/sudoers.d/ipa-admins granting %admins NOPASSWD:ALL. After this, IPA users in the admins group can sudo without a password.

2. Docker GID

sudo ./scripts/setup-docker-ipa-gid.sh

Pins the local docker group GID to 50010 to match the IPA docker-access group. Restarts docker.socket + docker.service to recreate the socket with the new GID. After this, IPA members of docker-access can run docker without any per-host group membership entry.

Current status

Item	Status
IPA enrollment	✅
SSH (wayne)	✅ via `raspberrypi.tail13f623.ts.net`
Sudo (wayne, NOPASSWD)	✅ `/etc/sudoers.d/ipa-admins`
Docker (wayne, via IPA group)	✅ docker group GID = 50010
Bootstrap sudo	✅ local `raspi` user, NOPASSWD