Archived
beatzaplentyandClaude Sonnet 4.6
f85c65870f
Consolidates nixos, docker, raspi, and debian-configuration into a single infrastructure-as-code repo. Includes: - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi roles (converted from debian-configuration bash scripts) - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub), Docker container catalog — migrated from docker/infrastructure/terraform/ - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending git subtree population (see implementation plan) - docs/: internal MkDocs site with architecture, network topology, runbooks, and drift-detection guide; external sanitized site - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change) - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router See docs/internal/implementation-plan.md for the phased rollout after pushing to Gitea. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
81 lines
3.3 KiB
TOML
81 lines
3.3 KiB
TOML
# Gitleaks configuration for the infrastructure mono-repo.
|
|
# Extends the default ruleset with patterns for all managed services.
|
|
# https://github.com/gitleaks/gitleaks
|
|
|
|
title = "infrastructure secret scan"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# ── Pi-hole ────────────────────────────────────────────────────────────────────
|
|
|
|
[[rules]]
|
|
id = "pihole-pwhash"
|
|
description = "Pi-hole password hash (pihole.toml webserver.api.pwhash)"
|
|
regex = '''pwhash\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "password"]
|
|
|
|
[[rules]]
|
|
id = "pihole-totp-secret"
|
|
description = "Pi-hole 2FA TOTP secret"
|
|
regex = '''totp_secret\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "2fa"]
|
|
|
|
[[rules]]
|
|
id = "pihole-app-pwhash"
|
|
description = "Pi-hole app password hash"
|
|
regex = '''app_pwhash\s*=\s*"[^"]{10,}"'''
|
|
tags = ["pihole", "password"]
|
|
|
|
# ── Ansible / Terraform ────────────────────────────────────────────────────────
|
|
|
|
[[rules]]
|
|
id = "ansible-vault-inline"
|
|
description = "Ansible vault encrypted value in a file that isn't a vault file"
|
|
regex = '''\$ANSIBLE_VAULT;[0-9]+\.[0-9]+'''
|
|
tags = ["ansible", "vault"]
|
|
|
|
[[rules]]
|
|
id = "terraform-tfvars-secret"
|
|
description = "Terraform tfvars token assignment"
|
|
regex = '''(api_token|token_secret|password|secret)\s*=\s*"[^"]{8,}"'''
|
|
tags = ["terraform", "credentials"]
|
|
|
|
# ── Authelia ───────────────────────────────────────────────────────────────────
|
|
|
|
[[rules]]
|
|
id = "authelia-user-hash"
|
|
description = "Authelia user database bcrypt/argon2 hash"
|
|
regex = '''\$argon2|\$2[aby]\$'''
|
|
tags = ["authelia", "password"]
|
|
|
|
# ── Docker secrets ─────────────────────────────────────────────────────────────
|
|
|
|
[[rules]]
|
|
id = "docker-secrets-env"
|
|
description = "Docker secrets env file password assignment"
|
|
regex = '''(PASSWORD|SECRET|TOKEN|KEY)\s*=\s*[^\s#]{12,}'''
|
|
tags = ["docker", "credentials"]
|
|
|
|
# ── ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
[allowlist]
|
|
description = "Known-safe patterns in this repo"
|
|
regexes = [
|
|
# TLS cert path reference — not the key itself
|
|
'''cert\s*=\s*"/etc/pihole/tls\.pem"''',
|
|
# Ansible example password placeholders
|
|
'''changeme|CHANGEME|example_password|your_password_here''',
|
|
# Terraform variable default empty strings
|
|
'''default\s*=\s*""''',
|
|
]
|
|
paths = [
|
|
# Template and example files are intentionally non-live
|
|
'''\.example$''',
|
|
'''\.example\..*$''',
|
|
# Test fixtures
|
|
'''test.*fixture''',
|
|
# This config file itself
|
|
'''\.gitleaks\.toml$''',
|
|
]
|