.gitleaks.toml

@@ -1,15 +1,6 @@
 # Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
-#
-# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
-# this file (title + allowlist) with ZERO detection rules, so it would never
-# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
-# re-pushing this template to a repo that already had the old version, that
-# repo's secret scanning was a no-op until this lands.
 title = "homelab gitea bootstrap"
 
-[extend]
-useDefault = true
-
 [allowlist]
 description = "Test fixtures and example configs are not production secrets"
 paths = [
@@ -20,7 +11,6 @@ paths = [
   '''(?i).*\.example\.(yml|yaml|env|json|toml)$''',
   '''(?i).*vault\.example\.(yml|yaml)$''',
   '''(?i).*\.env\.example$''',
-  '''(?i)demo_photos/.*''',
 ]
 regexes = [
   '''(?i)(invalid|fake|dummy|placeholder|example|changeme|change_me|not-a-real)''',

.notes/task_list.md

@@ -5,12 +5,11 @@
 
 ## Active (2026-07)
 
-Blocked on client only:
+See FIXES doc + Gitea:
 
-- **#44** JRCC watermark — need SVG/PNG + placement
-- **#43** Tag without account — need product rules
-
-Ops (no ticket): production Next.js viewer on LXC 9101 (`next start`); keep DB host `.179`
+- QA: #21 network/SharePoint scan, #26 thumbnails, #30/#31/#33 auto-match
+- Blocked on client: #44 JRCC watermark, #43 tag without account
+- Ops: production Next.js viewer on LXC 9101; DB host `.179`
 
 ## Historical / backlog ideas
 
@@ -25,8 +24,6 @@ Ops (no ticket): production Next.js viewer on LXC 9101 (`next start`); keep DB h
 
 ## Completed (selected)
 
-- [x] 2026-07-09 open-issue triage (#45/#46/#47 + #21/#26/#30/#31/#33) — PRs #51/#52
-- [x] Shared Postgres retarget `.181` → `.179` (ansible #81)
-- [x] Kuma + Beszel for PunimTag (ansible #82)
-- [x] Docs Postgres `.179` + next-steps (punimtag #53)
+- [x] 2026-07-09 open-issue triage (#45/#46/#47 + related) — PRs #51/#52
+- [x] Shared Postgres retarget `.181` → `.179`
 - [x] Grid thumbnail + disk cache

docs/FIXES_2026-07-09.md

@@ -1,7 +1,6 @@
 # PunimTag fixes — 2026-07-09
 
 Merged: PR #51 → `dev`, PR #52 → `master` (`eeb0033`).  
-Docs: PR #53. Ansible: #81 (Postgres `.179`), #82 (Kuma/Beszel).  
 Dev URLs: https://punimtagdev.levkin.ca · https://punimtagadmindev.levkin.ca
 
 ## Infra (homelab)
@@ -13,34 +12,38 @@ Dev URLs: https://punimtagdev.levkin.ca · https://punimtagadmindev.levkin.ca
 | Hosts | LXC **9101** `punimTagFE-dev` @ `10.0.10.121` |
 | Monitoring | Kuma: PunimTag viewer/admin; Beszel: `punimtag-9101` |
 
-## Ticket fixes (code) — closed
+Ansible: inventory/docs PRs for `.179` + monitoring (see ansible repo).
+
+## Ticket fixes (code)
 
 | Issue | Status | Change |
 |-------|--------|--------|
 | **#45** Recursive scan checkbox | Closed | Re-read local folder when recursive toggles (`Scan.tsx`) |
 | **#46** Person search wrong people | Closed | Selected people use exact `person_ids` (`Search.tsx`, `search_service.py`) |
 | **#47** Identify Next/Prev blank image | Closed | Clear loading when crop already cached (`Identify.tsx`) |
-| **#21** SharePoint/network scan hang | Closed (eng) | Non-blocking import enqueue; 2h job timeout (`photos.py`). Reopen with path + logs if still hangs. |
-| **#26** Slow main-page images | Closed (eng) | Grid `?thumbnail=true` + disk cache under `.cache/photo-thumbnails/` |
-| **#30/#31/#33** Auto-match false positives | Closed (eng) | Re-enable small-face filters (`face_service.py`). Re-Process after deploy to validate. |
+| **#21** SharePoint/network scan hang | Open (needs QA) | Non-blocking import enqueue; 2h job timeout (`photos.py`) |
+| **#26** Slow main-page images | Open (needs QA) | Grid `?thumbnail=true` + disk cache under `.cache/photo-thumbnails/` |
+| **#30/#31/#33** Auto-match false positives | Open (needs QA) | Re-enable small-face filters (`face_service.py`) |
 
-## Still open (blocked on client)
+## Still blocked on client
 
 | Issue | Need |
 |-------|------|
 | **#44** JRCC watermark | SVG/PNG + placement/opacity |
 | **#43** Tag without account | Product rules (approval, PII, ToS) |
+| **#21** path confirm | Exact SharePoint/network path Noam used |
 
 ## Performance notes (#26)
 
 Grid thumbs are ~**0.1%** of full image bytes (~13 KB vs ~11 MB). Warm cache ~15 ms server-side.
 
-**Optional later:** production `next start` (remove Next.js “N” badge); pre-generate thumbs at Process; lazy-load face metadata on home SSR.
+**Further options:** production `next start` (remove Next.js “N” badge); pre-generate thumbs at Process; lazy-load face metadata on home SSR.
 
-## Ops follow-ups (not tickets)
+## Ops follow-ups
 
 1. Run viewer as production (`next build` + `next start`), not `next dev`
 2. Keep `.env` on `.179` after every deploy (`DEPLOYMENT_CHECKLIST.md`)
+3. Client QA on open tickets above
 
 ## Cleanup
 

scripts/git-hooks/install.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# One-time installer for the local pre-commit gitleaks hook.
-# Run once per clone: bash scripts/git-hooks/install.sh
-#
-# Respects `core.hooksPath` if you've set one (local or global) — some setups
-# point git at a hooks dir outside `.git/hooks/` (e.g. a machine-wide
-# `~/.git-hooks/`), and installing to `.git/hooks/` in that case would be a
-# silent no-op. If an existing hook is already at that path, this chains to
-# it so nothing already relying on it breaks.
-set -euo pipefail
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT"
-
-HOOKS_DIR="$(git config --get core.hooksPath || true)"
-if [ -z "$HOOKS_DIR" ]; then
-  HOOKS_DIR=".git/hooks"
-elif [[ "$HOOKS_DIR" != /* ]]; then
-  HOOKS_DIR="$REPO_ROOT/$HOOKS_DIR"
-fi
-mkdir -p "$HOOKS_DIR"
-
-TARGET="$HOOKS_DIR/pre-commit"
-if [ -f "$TARGET" ] && ! grep -q "gitleaks" "$TARGET" 2>/dev/null; then
-  echo "⚠️  Existing pre-commit hook found at $TARGET that isn't ours — chaining instead of overwriting."
-  CHAINED="$HOOKS_DIR/pre-commit.d-gitleaks"
-  cp scripts/git-hooks/pre-commit "$CHAINED"
-  chmod +x "$CHAINED"
-  if ! grep -q "pre-commit.d-gitleaks" "$TARGET" 2>/dev/null; then
-    printf '\n# Added by levkinops ansible repo (scripts/git-hooks/install.sh)\n"%s"\n' "$CHAINED" >> "$TARGET"
-  fi
-else
-  cp scripts/git-hooks/pre-commit "$TARGET"
-  chmod +x "$TARGET"
-fi
-
-echo "✓ Installed pre-commit gitleaks hook → $TARGET"
-if [ "$HOOKS_DIR" != ".git/hooks" ] && [ "$HOOKS_DIR" != "$REPO_ROOT/.git/hooks" ]; then
-  echo "  (using core.hooksPath=$HOOKS_DIR — applies to every repo that shares this hooksPath)"
-fi
-if ! command -v gitleaks >/dev/null 2>&1; then
-  echo "  Note: gitleaks isn't installed locally yet. Install it for the hook to actually run:"
-  echo "    macOS:  brew install gitleaks"
-  echo "    Linux:  see https://github.com/gitleaks/gitleaks#installing"
-  echo "  Until then this hook is a no-op locally (CI still scans every push)."
-fi

scripts/git-hooks/pre-commit

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-# Local pre-commit secret scan — mirrors the `secret-scanning` CI job (gitleaks)
-# so leaked secrets are caught before they ever leave your machine, not just at
-# CI time. Installed via `make install-git-hooks`.
-#
-# Uses the same .gitleaks.toml allowlist as CI. Only scans staged content.
-set -euo pipefail
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT"
-
-if ! command -v gitleaks >/dev/null 2>&1; then
-  echo "⚠️  gitleaks not installed locally — skipping local secret scan."
-  echo "    Install: brew install gitleaks   (CI will still catch it either way)"
-  exit 0
-fi
-
-echo "🔐 Running gitleaks on staged changes..."
-if ! gitleaks protect --staged --config .gitleaks.toml --no-banner --redact; then
-  echo ""
-  echo "❌ gitleaks found a potential secret in your staged changes."
-  echo "   Fix it, or if it's a false positive, add an allowlist entry to .gitleaks.toml."
-  echo "   Bypass (not recommended): git commit --no-verify"
-  exit 1
-fi
-
-echo "✓ gitleaks: no secrets found in staged changes"