Archived
beatzaplentyandClaude Sonnet 4.6
afabcbbeff
Secret Scan / Scan for secrets and sensitive config (push) Failing after 5s
Documents and scripts to reproduce the IPA integration on the Pi (raspberrypi.tail13f623.ts.net, Debian 12 bookworm): - setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1) - setup-docker-ipa-gid.sh: pins local docker group GID to 50010 via groupmod --non-unique so IPA docker-access group membership alone grants docker socket access (mirrors NixOS lib.mkForce approach) - README.md + CLAUDE.md: quick-start, current status, guardrails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
40 lines
1.3 KiB
Markdown
40 lines
1.3 KiB
Markdown
# raspberrypi CLAUDE.md
|
|
|
|
Guardrails for Claude Code working on raspberrypi configuration.
|
|
|
|
## Host
|
|
|
|
`raspberrypi.tail13f623.ts.net` (100.86.56.87) — Raspberry Pi 4, Debian 12
|
|
bookworm (aarch64). Reachable from LAN via Tailscale MagicDNS.
|
|
|
|
## Production status
|
|
|
|
The Raspberry Pi is a **production host** running live services (Traefik,
|
|
Uptime Kuma, CrowdSec, Beszel agent). Treat it the same as pve1: read-only
|
|
inspection is always fine; any script that writes to the host requires
|
|
explicit same-session operator go-ahead.
|
|
|
|
## Bootstrap access
|
|
|
|
The local `raspi` account has NOPASSWD sudo and the nixos ED25519 key
|
|
authorized. Use it to bootstrap IPA sudo rules or make root-level changes
|
|
when `wayne` sudo is not yet working.
|
|
|
|
## IPA integration
|
|
|
|
- Enrolled in `SWEET.HOME` realm via `ipa-client-install`.
|
|
- SSSD resolves IPA groups: `admins (50000)`, `docker-access (50010)`.
|
|
- `%admins NOPASSWD:ALL` granted via `/etc/sudoers.d/ipa-admins`
|
|
(written by `scripts/setup-ipa-sudo.sh`).
|
|
|
|
## Docker GID
|
|
|
|
The local `docker` group GID is pinned to 50010 (`groupmod --non-unique`)
|
|
so it matches the IPA `docker-access` group. Members of `docker-access`
|
|
in IPA can run docker without any per-host group membership entry.
|
|
Applied by `scripts/setup-docker-ipa-gid.sh`.
|
|
|
|
## What must never be committed
|
|
|
|
SSH private keys, passwords, API tokens, Tailscale auth keys.
|