# Gitleaks configuration for the infrastructure mono-repo.
# Extends the default ruleset with patterns for all managed services.
# https://github.com/gitleaks/gitleaks

title = "infrastructure secret scan"

[extend]
  useDefault = true

# ── Pi-hole ────────────────────────────────────────────────────────────────────

[[rules]]
  id          = "pihole-pwhash"
  description = "Pi-hole password hash (pihole.toml webserver.api.pwhash)"
  regex       = '''pwhash\s*=\s*"[^"]{10,}"'''
  tags        = ["pihole", "password"]

[[rules]]
  id          = "pihole-totp-secret"
  description = "Pi-hole 2FA TOTP secret"
  regex       = '''totp_secret\s*=\s*"[^"]{10,}"'''
  tags        = ["pihole", "2fa"]

[[rules]]
  id          = "pihole-app-pwhash"
  description = "Pi-hole app password hash"
  regex       = '''app_pwhash\s*=\s*"[^"]{10,}"'''
  tags        = ["pihole", "password"]

# ── Ansible / Terraform ────────────────────────────────────────────────────────

[[rules]]
  id          = "ansible-vault-inline"
  description = "Ansible vault encrypted value in a file that isn't a vault file"
  regex       = '''\$ANSIBLE_VAULT;[0-9]+\.[0-9]+'''
  tags        = ["ansible", "vault"]

[[rules]]
  id          = "terraform-tfvars-secret"
  description = "Terraform tfvars token assignment"
  regex       = '''(api_token|token_secret|password|secret)\s*=\s*"[^"]{8,}"'''
  tags        = ["terraform", "credentials"]

# ── Authelia ───────────────────────────────────────────────────────────────────

[[rules]]
  id          = "authelia-user-hash"
  description = "Authelia user database bcrypt/argon2 hash"
  regex       = '''\$argon2|\$2[aby]\$'''
  tags        = ["authelia", "password"]

# ── Docker secrets ─────────────────────────────────────────────────────────────

[[rules]]
  id          = "docker-secrets-env"
  description = "Docker secrets env file password assignment"
  regex       = '''(PASSWORD|SECRET|TOKEN|KEY)\s*=\s*[^\s#]{12,}'''
  tags        = ["docker", "credentials"]

# ── ─────────────────────────────────────────────────────────────────────────────

[allowlist]
  description = "Known-safe patterns in this repo"
  regexes     = [
    # TLS cert path reference — not the key itself
    '''cert\s*=\s*"/etc/pihole/tls\.pem"''',
    # Ansible example password placeholders
    '''changeme|CHANGEME|example_password|your_password_here''',
    # Terraform variable default empty strings
    '''default\s*=\s*""''',
  ]
  paths       = [
    # Template and example files are intentionally non-live
    '''\.example$''',
    '''\.example\..*$''',
    # Test fixtures
    '''test.*fixture''',
    # This config file itself
    '''\.gitleaks\.toml$''',
  ]