894e7241f1
- Add speckit workflow infrastructure (.claude, .specify) - Create NixOS configuration skeleton (flake.nix, configuration.nix, hosts/ops-jrz1.nix) - Add sanitization scripts with 22 rules for personal info removal - Add validation scripts with gitleaks integration - Configure git hooks (pre-commit, pre-push) for security validation - Add project documentation (README, LICENSE) - Add comprehensive .gitignore for Nix, secrets, staging Phase 1 and Phase 2 complete. Foundation ready for module extraction from ops-base.
121 lines
3.4 KiB
Bash
Executable file
121 lines
3.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
#
|
|
# Validation script for sanitized files
|
|
# Checks that all personal information has been removed
|
|
#
|
|
# Usage: ./scripts/validate-sanitization.sh <directory-to-check>
|
|
|
|
set -euo pipefail
|
|
|
|
# Colors for output
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# Check arguments
|
|
if [ $# -ne 1 ]; then
|
|
echo "Usage: $0 <directory-to-check>"
|
|
echo "Example: $0 modules/"
|
|
exit 1
|
|
fi
|
|
|
|
CHECK_DIR="$1"
|
|
|
|
if [ ! -d "$CHECK_DIR" ]; then
|
|
echo -e "${RED}✗ Error: Directory $CHECK_DIR does not exist${NC}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Validating sanitization in $CHECK_DIR"
|
|
echo ""
|
|
|
|
VALIDATION_FAILED=0
|
|
|
|
# Check for personal domains
|
|
echo "Checking for personal domains..."
|
|
if rg 'clarun\.xyz|talu\.uno' "$CHECK_DIR" --type nix --type md 2>/dev/null; then
|
|
echo -e "${RED}✗ FAIL: Found personal domains (clarun.xyz or talu.uno)${NC}"
|
|
VALIDATION_FAILED=1
|
|
else
|
|
echo -e "${GREEN}✓ PASS: No personal domains found${NC}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check for personal IPs
|
|
echo "Checking for personal IP addresses..."
|
|
if rg '192\.168\.1\.|45\.77\.205\.49' "$CHECK_DIR" --type nix 2>/dev/null; then
|
|
echo -e "${RED}✗ FAIL: Found personal IP addresses${NC}"
|
|
VALIDATION_FAILED=1
|
|
else
|
|
echo -e "${GREEN}✓ PASS: No personal IP addresses found${NC}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check for personal paths
|
|
echo "Checking for personal paths..."
|
|
if rg '/home/dan' "$CHECK_DIR" 2>/dev/null; then
|
|
echo -e "${RED}✗ FAIL: Found personal paths (/home/dan)${NC}"
|
|
VALIDATION_FAILED=1
|
|
else
|
|
echo -e "${GREEN}✓ PASS: No personal paths found${NC}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check for hostname jrz1
|
|
echo "Checking for personal hostname..."
|
|
if rg '\bjrz1\b' "$CHECK_DIR" --type nix --type md 2>/dev/null; then
|
|
echo -e "${RED}✗ FAIL: Found personal hostname (jrz1)${NC}"
|
|
VALIDATION_FAILED=1
|
|
else
|
|
echo -e "${GREEN}✓ PASS: No personal hostname found${NC}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check for personal email
|
|
echo "Checking for personal email..."
|
|
if rg 'dlei@duck\.com' "$CHECK_DIR" 2>/dev/null; then
|
|
echo -e "${RED}✗ FAIL: Found personal email (dlei@duck.com)${NC}"
|
|
VALIDATION_FAILED=1
|
|
else
|
|
echo -e "${GREEN}✓ PASS: No personal email found${NC}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check for Matrix access tokens (if gitleaks available)
|
|
if command -v gitleaks &> /dev/null; then
|
|
echo "Running gitleaks secret scan..."
|
|
if gitleaks detect --no-git --source "$CHECK_DIR" --quiet 2>/dev/null; then
|
|
echo -e "${GREEN}✓ PASS: No secrets detected by gitleaks${NC}"
|
|
else
|
|
echo -e "${RED}✗ FAIL: gitleaks detected secrets${NC}"
|
|
echo "Run: gitleaks detect --no-git --source $CHECK_DIR"
|
|
VALIDATION_FAILED=1
|
|
fi
|
|
echo ""
|
|
else
|
|
echo -e "${YELLOW}⚠ WARNING: gitleaks not installed, skipping secret scan${NC}"
|
|
echo "Install with: nix-env -iA nixpkgs.gitleaks"
|
|
echo ""
|
|
fi
|
|
|
|
# Summary
|
|
echo "==> Validation Summary"
|
|
if [ $VALIDATION_FAILED -eq 0 ]; then
|
|
echo -e "${GREEN}✓ All validation checks passed${NC}"
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo "1. Manual review: Check comments for personal context"
|
|
echo "2. Build validation: nix flake check"
|
|
echo "3. Commit changes: git add && git commit"
|
|
exit 0
|
|
else
|
|
echo -e "${RED}✗ Validation failed - personal information still present${NC}"
|
|
echo ""
|
|
echo "Actions required:"
|
|
echo "1. Review the failures above"
|
|
echo "2. Manually fix remaining personal references"
|
|
echo "3. Re-run this script"
|
|
exit 1
|
|
fi
|