Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 761fe9e194

Secret Scan / Scan for secrets and sensitive config (push) Failing after 4s

Details

Secret Scan / Scan for secrets and sensitive config (pull_request) Failing after 3s

Details

docs(freeipa): update IPs and remove Pi-hole references

- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs)
- cloud-init nameserver and nmcli DNS during install use .254 (gateway)
  since IPA isn't running yet at that point
- --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone)
- Remove Step 7 (Pi-hole DNS forwarding config) from install.md
- Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh
- Update CLAUDE.md section count and freeipa/ guidance entry
- Update freeipa/README.md IP and DNS forwarding description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 15:25:22 +10:00

2.5 KiB

Raw Permalink Blame History

CLAUDE.md

Guidance for Claude Code working in this repo. These instructions OVERRIDE any default behaviour and must be followed exactly.

Repo purpose

Configuration toolsets and docs for Wayne's Debian-based LAN machines. Three sections currently exist: proxmox/ (Proxmox VE hosts), pihole/ (Pi-hole DNS/DHCP), and freeipa/ (FreeIPA identity management). Each has its own README.

Safety rules (apply everywhere in this repo)

Never commit secrets. SSH private keys, passwords, hashes, TOTP seeds, API tokens, or wifi passphrases must not appear in committed files. The CI pipeline (scripts/check-secrets.sh) enforces this on every push; the pre-commit hook (scripts/install-hooks.sh) catches it locally before it reaches the remote.
pihole/pull-config.sh auto-sanitises sensitive fields from pihole.toml on every pull. If you write config to pihole/config/ by any other means, run pihole/sanitize-config.sh on the result before committing.
Scripts that SSH into live machines make real changes. Don't run pihole/apply-config.sh against a production Pi-hole, or any script in proxmox/scripts/ against pve1, without an explicit same-session go-ahead from the operator. The section-specific CLAUDE.md files spell out the per-host guardrails in detail.

Section-specific guidance

Proxmox: see proxmox/CLAUDE.md — covers pve1 (production, off-limits by default) vs. pve-test (sandbox, Claude's default target), per-host authorisation scope, and network-surgery hazards.
Pi-hole: pihole/ has no live-host guardrails beyond the secret rules above. apply-config.sh is the only script that touches a live host; treat its <dest-host> argument as production unless you're explicitly testing on a throwaway instance.
FreeIPA: freeipa/ documents and scripts for the FreeIPA identity management server (domain-controller.sweet.home, VMID 108 on pve1). All scripts that SSH into the server are production operations — treat them as off-limits without an explicit same-session go-ahead.

Adding a new machine type

Create a new top-level directory (e.g. nginx/, wireguard/) with:

README.md — purpose, quick-start, and current status
CLAUDE.md — host-specific guardrails (which hosts are production, what requires explicit authorisation, what must never be committed)
scripts/ and/or config/ as needed

Update the root README.md layout table and this file's "Section-specific guidance" list when you do.