Archived
42 lines
1.5 KiB
TOML
42 lines
1.5 KiB
TOML
# Gitleaks configuration for debian-configuration repo.
|
|
# Extends the default ruleset with Pi-hole-specific secret patterns.
|
|
# https://github.com/gitleaks/gitleaks
|
|
|
|
title = "debian-configuration secret scan"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# ── Custom rules ───────────────────────────────────────────────────────────────
|
|
|
|
[[rules]]
|
|
id = "pihole-pwhash"
|
|
description = "Pi-hole password hash (pihole.toml webserver.api.pwhash)"
|
|
regex = '''pwhash\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "password"]
|
|
|
|
[[rules]]
|
|
id = "pihole-totp-secret"
|
|
description = "Pi-hole 2FA TOTP secret"
|
|
regex = '''totp_secret\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "2fa"]
|
|
|
|
[[rules]]
|
|
id = "pihole-app-pwhash"
|
|
description = "Pi-hole app password hash"
|
|
regex = '''app_pwhash\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "password"]
|
|
|
|
# ── Allowlist ──────────────────────────────────────────────────────────────────
|
|
|
|
[allowlist]
|
|
description = "Known-safe patterns in this repo"
|
|
regexes = [
|
|
# TLS cert path reference — not the key itself
|
|
'''cert\s*=\s*"/etc/pihole/tls\.pem"''',
|
|
]
|
|
paths = [
|
|
# Example/template files are intentionally non-live
|
|
'''\.example$''',
|
|
]
|