Archived
beatzaplentyandClaude Sonnet 4.6
afabcbbeff
Secret Scan / Scan for secrets and sensitive config (push) Failing after 5s
Documents and scripts to reproduce the IPA integration on the Pi (raspberrypi.tail13f623.ts.net, Debian 12 bookworm): - setup-ipa-sudo.sh: writes /etc/sudoers.d/ipa-admins granting %admins NOPASSWD:ALL (same IPA admins group as pbs/pdm/pve1) - setup-docker-ipa-gid.sh: pins local docker group GID to 50010 via groupmod --non-unique so IPA docker-access group membership alone grants docker socket access (mirrors NixOS lib.mkForce approach) - README.md + CLAUDE.md: quick-start, current status, guardrails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
28 lines
880 B
Bash
28 lines
880 B
Bash
#!/bin/bash
|
|
# Grant the IPA 'admins' group passwordless sudo on this Raspberry Pi.
|
|
#
|
|
# Writes /etc/sudoers.d/ipa-admins with NOPASSWD: ALL for the admins group.
|
|
# Idempotent — safe to re-run.
|
|
#
|
|
# Run as root (or via the local 'raspi' user's NOPASSWD sudo) after
|
|
# ipa-client-install has been completed and SSSD is active.
|
|
#
|
|
# Usage: sudo ./setup-ipa-sudo.sh
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
if [ ! -f /etc/ipa/default.conf ]; then
|
|
echo "ERROR: /etc/ipa/default.conf not found -- is this host enrolled in FreeIPA?" >&2
|
|
exit 1
|
|
fi
|
|
|
|
write_if_changed /etc/sudoers.d/ipa-admins '%admins ALL=(ALL) NOPASSWD:ALL'
|
|
chmod 0440 /etc/sudoers.d/ipa-admins
|
|
|
|
visudo -c >/dev/null
|
|
echo "Sudoers file valid. IPA admins group has NOPASSWD sudo on this host."
|