Archived
beatzaplentyandClaude Sonnet 4.6
afabcbbeff
Secret Scan / Scan for secrets and sensitive config (push) Failing after 5s
Documents and scripts to reproduce the IPA integration on the Pi (raspberrypi.tail13f623.ts.net, Debian 12 bookworm): - setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1) - setup-docker-ipa-gid.sh: pins local docker group GID to 50010 via groupmod --non-unique so IPA docker-access group membership alone grants docker socket access (mirrors NixOS lib.mkForce approach) - README.md + CLAUDE.md: quick-start, current status, guardrails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
53 lines
1.5 KiB
Markdown
53 lines
1.5 KiB
Markdown
# raspberrypi
|
|
|
|
Configuration scripts for `raspberrypi.tail13f623.ts.net` — Raspberry Pi 4
|
|
running Debian 12 bookworm (aarch64). Reachable from LAN via Tailscale
|
|
MagicDNS (`tail13f623.ts.net`).
|
|
|
|
## Services
|
|
|
|
- **Traefik** — reverse proxy (ports 80, 443, 8080)
|
|
- **Uptime Kuma** — uptime monitoring
|
|
- **CrowdSec** — intrusion detection
|
|
- **Beszel agent** — metrics collection
|
|
|
|
## IPA enrollment
|
|
|
|
The Pi is enrolled in the `sweet.home` FreeIPA domain. SSSD resolves:
|
|
- `admins (GID 50000)` — sudo access
|
|
- `docker-access (GID 50010)` — docker socket access
|
|
|
|
## Setup scripts
|
|
|
|
Run these **as root** (or via `sudo`) after `ipa-client-install` completes.
|
|
|
|
### 1. IPA sudo
|
|
|
|
```bash
|
|
sudo ./scripts/setup-ipa-sudo.sh
|
|
```
|
|
|
|
Writes `/etc/sudoers.d/ipa-admins` granting `%admins NOPASSWD:ALL`. After
|
|
this, IPA users in the `admins` group can `sudo` without a password.
|
|
|
|
### 2. Docker GID
|
|
|
|
```bash
|
|
sudo ./scripts/setup-docker-ipa-gid.sh
|
|
```
|
|
|
|
Pins the local `docker` group GID to 50010 to match the IPA `docker-access`
|
|
group. Restarts `docker.socket` + `docker.service` to recreate the socket
|
|
with the new GID. After this, IPA members of `docker-access` can run docker
|
|
without any per-host group membership entry.
|
|
|
|
## Current status
|
|
|
|
| Item | Status |
|
|
|---|---|
|
|
| IPA enrollment | ✅ |
|
|
| SSH (wayne) | ✅ via `raspberrypi.tail13f623.ts.net` |
|
|
| Sudo (wayne, NOPASSWD) | ✅ `/etc/sudoers.d/ipa-admins` |
|
|
| Docker (wayne, via IPA group) | ✅ docker group GID = 50010 |
|
|
| Bootstrap sudo | ✅ local `raspi` user, NOPASSWD |
|