updated structure

.claude/worktrees/debian-restructure/.gitleaks.toml

@@ -0,0 +1,41 @@
+# Gitleaks configuration for debian-configuration repo.
+# Extends the default ruleset with Pi-hole-specific secret patterns.
+# https://github.com/gitleaks/gitleaks
+
+title = "debian-configuration secret scan"
+
+[extend]
+  useDefault = true
+
+# ── Custom rules ───────────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "pihole-pwhash"
+  description = "Pi-hole password hash (pihole.toml webserver.api.pwhash)"
+  regex       = '''pwhash\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "password"]
+
+[[rules]]
+  id          = "pihole-totp-secret"
+  description = "Pi-hole 2FA TOTP secret"
+  regex       = '''totp_secret\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "2fa"]
+
+[[rules]]
+  id          = "pihole-app-pwhash"
+  description = "Pi-hole app password hash"
+  regex       = '''app_pwhash\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "password"]
+
+# ── Allowlist ──────────────────────────────────────────────────────────────────
+
+[allowlist]
+  description = "Known-safe patterns in this repo"
+  regexes     = [
+    # TLS cert path reference — not the key itself
+    '''cert\s*=\s*"/etc/pihole/tls\.pem"''',
+  ]
+  paths       = [
+    # Example/template files are intentionally non-live
+    '''\.example$''',
+  ]