Archived
beatzaplentyandClaude Sonnet 4.6
761fe9e194
- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs) - cloud-init nameserver and nmcli DNS during install use .254 (gateway) since IPA isn't running yet at that point - --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone) - Remove Step 7 (Pi-hole DNS forwarding config) from install.md - Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh - Update CLAUDE.md section count and freeipa/ guidance entry - Update freeipa/README.md IP and DNS forwarding description Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
54 lines
2.5 KiB
Markdown
54 lines
2.5 KiB
Markdown
# CLAUDE.md
|
|
|
|
Guidance for Claude Code working in this repo. These instructions
|
|
OVERRIDE any default behaviour and must be followed exactly.
|
|
|
|
## Repo purpose
|
|
|
|
Configuration toolsets and docs for Wayne's Debian-based LAN machines.
|
|
Three sections currently exist: `proxmox/` (Proxmox VE hosts),
|
|
`pihole/` (Pi-hole DNS/DHCP), and `freeipa/` (FreeIPA identity
|
|
management). Each has its own README.
|
|
|
|
## Safety rules (apply everywhere in this repo)
|
|
|
|
- **Never commit secrets.** SSH private keys, passwords, hashes, TOTP
|
|
seeds, API tokens, or wifi passphrases must not appear in committed
|
|
files. The CI pipeline (`scripts/check-secrets.sh`) enforces this on
|
|
every push; the pre-commit hook (`scripts/install-hooks.sh`) catches
|
|
it locally before it reaches the remote.
|
|
- **`pihole/pull-config.sh` auto-sanitises** sensitive fields from
|
|
`pihole.toml` on every pull. If you write config to `pihole/config/`
|
|
by any other means, run `pihole/sanitize-config.sh` on the result
|
|
before committing.
|
|
- **Scripts that SSH into live machines make real changes.** Don't run
|
|
`pihole/apply-config.sh` against a production Pi-hole, or any script
|
|
in `proxmox/scripts/` against `pve1`, without an explicit same-session
|
|
go-ahead from the operator. The section-specific CLAUDE.md files
|
|
spell out the per-host guardrails in detail.
|
|
|
|
## Section-specific guidance
|
|
|
|
- **Proxmox:** see `proxmox/CLAUDE.md` — covers `pve1` (production,
|
|
off-limits by default) vs. `pve-test` (sandbox, Claude's default
|
|
target), per-host authorisation scope, and network-surgery hazards.
|
|
- **Pi-hole:** `pihole/` has no live-host guardrails beyond the secret
|
|
rules above. `apply-config.sh` is the only script that touches a live
|
|
host; treat its `<dest-host>` argument as production unless you're
|
|
explicitly testing on a throwaway instance.
|
|
- **FreeIPA:** `freeipa/` documents and scripts for the FreeIPA identity
|
|
management server (`domain-controller.sweet.home`, VMID 108 on `pve1`).
|
|
All scripts that SSH into the server are production operations — treat
|
|
them as off-limits without an explicit same-session go-ahead.
|
|
|
|
## Adding a new machine type
|
|
|
|
Create a new top-level directory (e.g. `nginx/`, `wireguard/`) with:
|
|
- `README.md` — purpose, quick-start, and current status
|
|
- `CLAUDE.md` — host-specific guardrails (which hosts are production,
|
|
what requires explicit authorisation, what must never be committed)
|
|
- `scripts/` and/or `config/` as needed
|
|
|
|
Update the root `README.md` layout table and this file's
|
|
"Section-specific guidance" list when you do.
|