ci: add local pre-commit gitleaks hook

.gitleaks.toml

@@ -1,6 +1,15 @@
 # Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
+#
+# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
+# this file (title + allowlist) with ZERO detection rules, so it would never
+# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
+# re-pushing this template to a repo that already had the old version, that
+# repo's secret scanning was a no-op until this lands.
 title = "homelab gitea bootstrap"
 
+[extend]
+useDefault = true
+
 [allowlist]
 description = "Test fixtures and example configs are not production secrets"
 paths = [
@@ -11,6 +20,7 @@ paths = [
   '''(?i).*\.example\.(yml|yaml|env|json|toml)$''',
   '''(?i).*vault\.example\.(yml|yaml)$''',
   '''(?i).*\.env\.example$''',
+  '''(?i)demo_photos/.*''',
 ]
 regexes = [
   '''(?i)(invalid|fake|dummy|placeholder|example|changeme|change_me|not-a-real)''',

.notes/task_list.md

@@ -5,11 +5,12 @@
 
 ## Active (2026-07)
 
-See FIXES doc + Gitea:
+Blocked on client only:
 
-- QA: #21 network/SharePoint scan, #26 thumbnails, #30/#31/#33 auto-match
-- Blocked on client: #44 JRCC watermark, #43 tag without account
-- Ops: production Next.js viewer on LXC 9101; DB host `.179`
+- **#44** JRCC watermark — need SVG/PNG + placement
+- **#43** Tag without account — need product rules
+
+Ops (no ticket): production Next.js viewer on LXC 9101 (`next start`); keep DB host `.179`
 
 ## Historical / backlog ideas
 
@@ -24,6 +25,8 @@ See FIXES doc + Gitea:
 
 ## Completed (selected)
 
-- [x] 2026-07-09 open-issue triage (#45/#46/#47 + related) — PRs #51/#52
-- [x] Shared Postgres retarget `.181` → `.179`
+- [x] 2026-07-09 open-issue triage (#45/#46/#47 + #21/#26/#30/#31/#33) — PRs #51/#52
+- [x] Shared Postgres retarget `.181` → `.179` (ansible #81)
+- [x] Kuma + Beszel for PunimTag (ansible #82)
+- [x] Docs Postgres `.179` + next-steps (punimtag #53)
 - [x] Grid thumbnail + disk cache

docs/FIXES_2026-07-09.md

@@ -1,6 +1,7 @@
 # PunimTag fixes — 2026-07-09
 
 Merged: PR #51 → `dev`, PR #52 → `master` (`eeb0033`).  
+Docs: PR #53. Ansible: #81 (Postgres `.179`), #82 (Kuma/Beszel).  
 Dev URLs: https://punimtagdev.levkin.ca · https://punimtagadmindev.levkin.ca
 
 ## Infra (homelab)
@@ -12,38 +13,34 @@ Dev URLs: https://punimtagdev.levkin.ca · https://punimtagadmindev.levkin.ca
 | Hosts | LXC **9101** `punimTagFE-dev` @ `10.0.10.121` |
 | Monitoring | Kuma: PunimTag viewer/admin; Beszel: `punimtag-9101` |
 
-Ansible: inventory/docs PRs for `.179` + monitoring (see ansible repo).
-
-## Ticket fixes (code)
+## Ticket fixes (code) — closed
 
 | Issue | Status | Change |
 |-------|--------|--------|
 | **#45** Recursive scan checkbox | Closed | Re-read local folder when recursive toggles (`Scan.tsx`) |
 | **#46** Person search wrong people | Closed | Selected people use exact `person_ids` (`Search.tsx`, `search_service.py`) |
 | **#47** Identify Next/Prev blank image | Closed | Clear loading when crop already cached (`Identify.tsx`) |
-| **#21** SharePoint/network scan hang | Open (needs QA) | Non-blocking import enqueue; 2h job timeout (`photos.py`) |
-| **#26** Slow main-page images | Open (needs QA) | Grid `?thumbnail=true` + disk cache under `.cache/photo-thumbnails/` |
-| **#30/#31/#33** Auto-match false positives | Open (needs QA) | Re-enable small-face filters (`face_service.py`) |
+| **#21** SharePoint/network scan hang | Closed (eng) | Non-blocking import enqueue; 2h job timeout (`photos.py`). Reopen with path + logs if still hangs. |
+| **#26** Slow main-page images | Closed (eng) | Grid `?thumbnail=true` + disk cache under `.cache/photo-thumbnails/` |
+| **#30/#31/#33** Auto-match false positives | Closed (eng) | Re-enable small-face filters (`face_service.py`). Re-Process after deploy to validate. |
 
-## Still blocked on client
+## Still open (blocked on client)
 
 | Issue | Need |
 |-------|------|
 | **#44** JRCC watermark | SVG/PNG + placement/opacity |
 | **#43** Tag without account | Product rules (approval, PII, ToS) |
-| **#21** path confirm | Exact SharePoint/network path Noam used |
 
 ## Performance notes (#26)
 
 Grid thumbs are ~**0.1%** of full image bytes (~13 KB vs ~11 MB). Warm cache ~15 ms server-side.
 
-**Further options:** production `next start` (remove Next.js “N” badge); pre-generate thumbs at Process; lazy-load face metadata on home SSR.
+**Optional later:** production `next start` (remove Next.js “N” badge); pre-generate thumbs at Process; lazy-load face metadata on home SSR.
 
-## Ops follow-ups
+## Ops follow-ups (not tickets)
 
 1. Run viewer as production (`next build` + `next start`), not `next dev`
 2. Keep `.env` on `.179` after every deploy (`DEPLOYMENT_CHECKLIST.md`)
-3. Client QA on open tickets above
 
 ## Cleanup
 

scripts/git-hooks/install.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# One-time installer for the local pre-commit gitleaks hook.
+# Run once per clone: bash scripts/git-hooks/install.sh
+#
+# Respects `core.hooksPath` if you've set one (local or global) — some setups
+# point git at a hooks dir outside `.git/hooks/` (e.g. a machine-wide
+# `~/.git-hooks/`), and installing to `.git/hooks/` in that case would be a
+# silent no-op. If an existing hook is already at that path, this chains to
+# it so nothing already relying on it breaks.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+HOOKS_DIR="$(git config --get core.hooksPath || true)"
+if [ -z "$HOOKS_DIR" ]; then
+  HOOKS_DIR=".git/hooks"
+elif [[ "$HOOKS_DIR" != /* ]]; then
+  HOOKS_DIR="$REPO_ROOT/$HOOKS_DIR"
+fi
+mkdir -p "$HOOKS_DIR"
+
+TARGET="$HOOKS_DIR/pre-commit"
+if [ -f "$TARGET" ] && ! grep -q "gitleaks" "$TARGET" 2>/dev/null; then
+  echo "⚠️  Existing pre-commit hook found at $TARGET that isn't ours — chaining instead of overwriting."
+  CHAINED="$HOOKS_DIR/pre-commit.d-gitleaks"
+  cp scripts/git-hooks/pre-commit "$CHAINED"
+  chmod +x "$CHAINED"
+  if ! grep -q "pre-commit.d-gitleaks" "$TARGET" 2>/dev/null; then
+    printf '\n# Added by levkinops ansible repo (scripts/git-hooks/install.sh)\n"%s"\n' "$CHAINED" >> "$TARGET"
+  fi
+else
+  cp scripts/git-hooks/pre-commit "$TARGET"
+  chmod +x "$TARGET"
+fi
+
+echo "✓ Installed pre-commit gitleaks hook → $TARGET"
+if [ "$HOOKS_DIR" != ".git/hooks" ] && [ "$HOOKS_DIR" != "$REPO_ROOT/.git/hooks" ]; then
+  echo "  (using core.hooksPath=$HOOKS_DIR — applies to every repo that shares this hooksPath)"
+fi
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "  Note: gitleaks isn't installed locally yet. Install it for the hook to actually run:"
+  echo "    macOS:  brew install gitleaks"
+  echo "    Linux:  see https://github.com/gitleaks/gitleaks#installing"
+  echo "  Until then this hook is a no-op locally (CI still scans every push)."
+fi

scripts/git-hooks/pre-commit

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Local pre-commit secret scan — mirrors the `secret-scanning` CI job (gitleaks)
+# so leaked secrets are caught before they ever leave your machine, not just at
+# CI time. Installed via `make install-git-hooks`.
+#
+# Uses the same .gitleaks.toml allowlist as CI. Only scans staged content.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "⚠️  gitleaks not installed locally — skipping local secret scan."
+  echo "    Install: brew install gitleaks   (CI will still catch it either way)"
+  exit 0
+fi
+
+echo "🔐 Running gitleaks on staged changes..."
+if ! gitleaks protect --staged --config .gitleaks.toml --no-banner --redact; then
+  echo ""
+  echo "❌ gitleaks found a potential secret in your staged changes."
+  echo "   Fix it, or if it's a false positive, add an allowlist entry to .gitleaks.toml."
+  echo "   Bypass (not recommended): git commit --no-verify"
+  exit 1
+fi
+
+echo "✓ gitleaks: no secrets found in staged changes"