homelab/.gitleaks.toml at main · josevictorferreira/homelab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
title = "Homelab Gitleaks Configuration"

[extend]
useDefault = true

[allowlist]
# Description of the allowlist
paths = [
  # Generated Kubernetes manifests - these are regenerated by make manifests
  # and use SOPS/vals for secret injection
  '''\.k8s\/.*\.yaml$''',
  '''\.k8s-manifests\/.*\.yaml$''',
  '''kubernetes\/manifests\/.*\.yaml$''',
  # SOPS encrypted files - these are safe
  '''\.enc\.yaml$''',
  '''\.enc\.nix$''',
  # Gitleaks results file
  '''results\.json$''',
  '''gitleaks-report\.json$''',
]

# Regex patterns for allowed secrets (false positives)
regexes = [
  # Placeholder/test secret that appears in multiple generated files
  # This is the sha256 hash of an empty string, used as a placeholder
  '''44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a''',
  # SOPS reference pattern - these are not actual secrets
  '''ref\+sops://''',
  # Base64 encoded SOPS references
  '''cG9zdGdyZXNxbDovL3Bvc3RncmVzOnJlZitzb3BzOi8v''',
]

# Stopwords - these indicate a likely false positive
stopwords = [
  # SOPS related
  "sops",
  "SOPS",
  "ref+sops",
  # Placeholder indicators
  "placeholder",
  "CHANGEME",
  "REPLACE_ME",
  # Test data indicators
  "test",
  "example",
  "sample",
  "checksum"
]