Archived
beatzaplentyandClaude Sonnet 4.6
b269a5d616
- .gitleaks.toml — extends gitleaks defaults with Pi-hole-specific rules for pwhash/totp_secret/app_pwhash; allowlists known-safe patterns - .github/workflows/secret-scan.yml — GitHub Actions (full history scan) - .gitea/workflows/secret-scan.yml — Gitea Actions (identical workflow) - scripts/check-secrets.sh — shared runner used by both CI and local; supports --staged-only for pre-commit hook use; falls back to Docker if gitleaks isn't on PATH - scripts/install-hooks.sh — installs pre-commit hook pointing at above - pihole/sanitize-config.sh — redacts pwhash/totp_secret/app_pwhash in pihole.toml in-place before the file is committed - pihole/pull-config.sh — updated to call sanitize-config.sh automatically after every pull so the repo stays clean by default Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
52 lines
2.1 KiB
Bash
Executable File
52 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Pull Pi-hole configuration from a running instance to a local directory.
|
|
# Sensitive fields (password hashes, TOTP secrets) are redacted automatically.
|
|
#
|
|
# Usage: pull-config.sh <source-host> <dest-dir>
|
|
# source-host SSH-reachable hostname or IP of the source Pi-hole
|
|
# dest-dir Local directory to write config into (created if absent)
|
|
#
|
|
# Example:
|
|
# ./pull-config.sh root@pihole ./config
|
|
# ./pull-config.sh root@192.168.2.253 /backup/pihole-$(date +%Y%m%d)
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
usage() {
|
|
echo "Usage: $(basename "$0") <source-host> <dest-dir>" >&2
|
|
echo " source-host SSH target for the source Pi-hole (e.g. root@pihole)" >&2
|
|
echo " dest-dir Local directory to write config files into" >&2
|
|
exit 1
|
|
}
|
|
|
|
[[ $# -eq 2 ]] || usage
|
|
|
|
SOURCE="$1"
|
|
DEST="$2"
|
|
|
|
echo "Pulling Pi-hole config from ${SOURCE} → ${DEST}"
|
|
|
|
mkdir -p "${DEST}/dnsmasq.d"
|
|
|
|
# ── pihole.toml ────────────────────────────────────────────────────────────────
|
|
echo " pihole.toml"
|
|
ssh "${SOURCE}" "cat /etc/pihole/pihole.toml" > "${DEST}/pihole.toml"
|
|
"${SCRIPT_DIR}/sanitize-config.sh" "${DEST}/pihole.toml"
|
|
|
|
# ── custom dnsmasq drop-ins ────────────────────────────────────────────────────
|
|
# Pi-hole manages its own generated config; we only capture user-added files.
|
|
echo " dnsmasq.d/ (custom drop-ins)"
|
|
ssh "${SOURCE}" "ls /etc/dnsmasq.d/*.conf 2>/dev/null || true" | while read -r f; do
|
|
name="$(basename "$f")"
|
|
echo " ${name}"
|
|
ssh "${SOURCE}" "cat '${f}'" > "${DEST}/dnsmasq.d/${name}"
|
|
done
|
|
|
|
# ── DHCP static leases ─────────────────────────────────────────────────────────
|
|
echo " dhcp.leases"
|
|
ssh "${SOURCE}" "cat /etc/pihole/dhcp.leases 2>/dev/null || true" > "${DEST}/dhcp.leases"
|
|
|
|
echo "Done. Config written to ${DEST}/"
|