feat(mercury): pihole via container (native FTL segfaults on aarch64)

- services/pihole.nix: official pihole/pihole:2026.07.2 via podman, host net,
  caps NET_ADMIN/NET_RAW/SYS_NICE/CHOWN; FTLCONF_* env config (upstream unbound,
  DHCP 50-200, static lease jupiter, .sol domain, local records)
- unbound: resolveLocalQueries=false (was hijacking resolv.conf to :53 -> boot
  DNS deadlock; the real root cause of the earlier failures too)
- password via sops FTLCONF env file; /var/lib/pihole created via tmpfiles
- VM-verified: mercury.sol/jupiter.sol/external all resolve, 0 restarts

services/pihole.nix

@@ -1,53 +1,49 @@
-{ ... }:
+{ pkgs, lib, ... }:
 
-# Pi-hole (pihole-FTL v6) — network DNS (adblock) + DHCP, with the embedded
-# web UI. Forwards to the local unbound recursive resolver (services/unbound.nix).
-#
-# `settings` is the raw pihole.toml. Static DHCP leases ARE declarative here
-# (settings.dhcp.hosts, dnsmasq "MAC,IP,hostname" format) — the reason we chose
-# pihole over AdGuard.
-#
-# ⚠️ The pihole-ftl NixOS module + pihole.toml v6 schema are new; VALIDATE this
-# at runtime (VM or the Pi) before trusting it — eval only checks the module,
-# not the freeform TOML keys.
+# Pi-hole via the official container (the native nixpkgs pihole-ftl module
+# segfaults on aarch64 / Pi 3B+). Host networking so it can serve DHCP and reach
+# the host's unbound at 127.0.0.1:5335. Config via FTLCONF_* env vars (pihole v6)
+# — these override pihole.toml on every start, so it stays effectively
+# declarative. The web admin password is added from sops in the host config.
 {
-  services.pihole-ftl = {
+  virtualisation.podman = {
     enable = true;
-    openFirewallDNS = true;
-    openFirewallDHCP = true;
-    openFirewallWebserver = true;
+    dockerCompat = true;
+  };
 
-    lists = [
-      { url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; type = "block"; }
-    ];
-
-    settings = {
-      dns = {
-        upstreams = [ "127.0.0.1#5335" ];   # local unbound (recursive)
-        domain = "sol";                       # local domain -> jupiter.sol etc.
-        # Local A records (/etc/hosts style). mercury is the DHCP server (no
-        # lease of its own), so its name must be declared here. jupiter is also
-        # pinned explicitly so it resolves regardless of lease state.
-        hosts = [
-          "10.0.0.10 mercury.sol mercury"
-          "10.0.0.20 jupiter.sol jupiter"
-        ];
+  virtualisation.oci-containers = {
+    backend = "podman";
+    containers.pihole = {
+      image = "pihole/pihole:latest";   # TODO: pin to the tested version after VM check
+      autoStart = true;
+      extraOptions = [
+        "--network=host"                    # DHCP broadcast + host unbound on 127.0.0.1
+        "--cap-add=NET_ADMIN"               # DHCP
+        "--cap-add=NET_RAW"                 # DNS engine (dnsmasq) — REQUIRED
+        "--cap-add=SYS_NICE"
+        "--cap-add=CHOWN"                   # entrypoint chowns /etc/pihole
+      ];
+      volumes = [ "/var/lib/pihole:/etc/pihole" ];   # persist config/state
+      environment = {
+        TZ = "Europe/Berlin";
+        FTLCONF_dns_upstreams = "127.0.0.1#5335";     # host unbound (recursive)
+        FTLCONF_dns_listeningMode = "all";            # serve the LAN
+        FTLCONF_dns_domain = "sol";
+        FTLCONF_dhcp_active = "true";
+        FTLCONF_dhcp_start = "10.0.0.50";
+        FTLCONF_dhcp_end = "10.0.0.200";
+        FTLCONF_dhcp_router = "10.0.0.1";
+        FTLCONF_dhcp_leaseTime = "1h";
+        # Arrays (format validated in the VM): static lease + local DNS records.
+        FTLCONF_dhcp_hosts = "00:e0:4c:3c:a3:1f,10.0.0.20,jupiter";
+        FTLCONF_dns_hosts = "10.0.0.10 mercury.sol;10.0.0.20 jupiter.sol";
       };
-
-      dhcp = {
-        active = true;
-        start = "10.0.0.50";
-        end = "10.0.0.200";
-        router = "10.0.0.1";
-        leaseTime = "1h";
-        # Static leases (declarative). Format: "MAC,IP,hostname".
-        hosts = [ "00:e0:4c:3c:a3:1f,10.0.0.20,jupiter" ];
-      };
-
-      # Embedded web UI on :80. Set the admin password once after first boot:
-      #   sudo pihole setpassword    (kept out of the repo)
-      # (plain "80" so the module's openFirewall port parser is happy.)
-      webserver.port = "80";
     };
   };
+
+  # Bind-mount source must exist (podman won't create it).
+  systemd.tmpfiles.rules = [ "d /var/lib/pihole 0755 root root -" ];
+
+  networking.firewall.allowedTCPPorts = [ 53 80 ];
+  networking.firewall.allowedUDPPorts = [ 53 67 ];
 }

services/unbound.nix

@@ -8,6 +8,12 @@
 {
   services.unbound = {
     enable = true;
+    # Do NOT point the host's resolv.conf at unbound: it listens on :5335, not
+    # :53, so that would leave the host with no working resolver until pihole
+    # binds :53 (a boot-time deadlock — can't pull images / build lists). The
+    # host resolves via networking.nameservers (upstream) instead; pihole
+    # forwards to unbound explicitly at 127.0.0.1#5335.
+    resolveLocalQueries = false;
     # NixOS manages the DNSSEC root trust anchor (unbound-anchor).
     settings.server = {
       interface = [ "127.0.0.1" ];