Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 4aadef8e97

Secret Scan / Scan for secrets and sensitive config (push) Failing after 3s

Details

Secret Scan / Scan for secrets and sensitive config (pull_request) Failing after 3s

Details

docs: update documentation for debian-configuration repo rename

- Root README.md: new, describes overall repo layout (proxmox/, pihole/,
  scripts/) and secret-scanning workflow
- Root CLAUDE.md: new, cross-section guardrails and instructions for
  adding new machine types; references proxmox/CLAUDE.md and pihole/
  section-specific rules
- pihole/README.md: new, covers scripts usage, notable DHCP/PXE config,
  EFI VM requirements (VirtIO RNG, Secure Boot), and secrets handling
- proxmox/README.md: add repo-context note pointing back to root README

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

2026-07-23 12:35:30 +10:00

1.4 KiB

Raw Blame History

debian-configuration

Configuration, hardening toolsets, and operational docs for Wayne's Debian-based LAN machines. Each subdirectory covers a different host or service type.

Layout

proxmox/   Proxmox VE hosts (pve1 production, pve-test sandbox)
pihole/    Pi-hole DNS/DHCP (config snapshots, pull/apply scripts)
scripts/   Repo-wide scripts (secret scanning, git hook installer)

Sections

`proxmox/`

Base configuration and hardening toolset for Proxmox VE hosts. See proxmox/README.md for goals, quick-start, and current status.

`pihole/`

Pi-hole v6 configuration management. Stores a sanitised snapshot of the live config and provides scripts to pull from or push to a running instance. See pihole/README.md for usage.

Secret scanning

All commits are scanned for secrets by a CI pipeline that runs on both GitHub Actions and Gitea Actions. The same scan can be run locally:

# One-time setup — installs a pre-commit git hook
bash scripts/install-hooks.sh

# Manual run against the full git history
bash scripts/check-secrets.sh

# Requires gitleaks on PATH; falls back to Docker if available
# https://github.com/gitleaks/gitleaks#installing

pihole/pull-config.sh automatically redacts sensitive fields (pwhash, totp_secret, app_pwhash) from pihole.toml before writing it to disk, so the repo stays clean by default.

1.4 KiB Raw Blame History