Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 afabcbbeff

Secret Scan / Scan for secrets and sensitive config (push) Failing after 5s

Details

feat(raspberrypi): add Raspberry Pi configuration section

Documents and scripts to reproduce the IPA integration on the Pi
(raspberrypi.tail13f623.ts.net, Debian 12 bookworm):

- setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting
  %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1)
- setup-docker-ipa-gid.sh: pins local docker group GID to 50010
  via groupmod --non-unique so IPA docker-access group membership
  alone grants docker socket access (mirrors NixOS lib.mkForce approach)
- README.md + CLAUDE.md: quick-start, current status, guardrails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 15:47:30 +10:00

1.3 KiB

Raw Permalink Blame History

raspberrypi CLAUDE.md

Guardrails for Claude Code working on raspberrypi configuration.

Host

raspberrypi.tail13f623.ts.net (100.86.56.87) — Raspberry Pi 4, Debian 12 bookworm (aarch64). Reachable from LAN via Tailscale MagicDNS.

Production status

The Raspberry Pi is a production host running live services (Traefik, Uptime Kuma, CrowdSec, Beszel agent). Treat it the same as pve1: read-only inspection is always fine; any script that writes to the host requires explicit same-session operator go-ahead.

Bootstrap access

The local raspi account has NOPASSWD sudo and the nixos ED25519 key authorized. Use it to bootstrap IPA sudo rules or make root-level changes when wayne sudo is not yet working.

IPA integration

Enrolled in SWEET.HOME realm via ipa-client-install.
SSSD resolves IPA groups: admins (50000), docker-access (50010).
%admins NOPASSWD:ALL granted via /etc/sudoers.d/ipa-admins (written by scripts/setup-ipa-sudo.sh).

Docker GID

The local docker group GID is pinned to 50010 (groupmod --non-unique) so it matches the IPA docker-access group. Members of docker-access in IPA can run docker without any per-host group membership entry. Applied by scripts/setup-docker-ipa-gid.sh.

What must never be committed

SSH private keys, passwords, API tokens, Tailscale auth keys.

1.3 KiB Raw Permalink Blame History