erik
70a851c71d
- services/pihole.nix: DNS adblock + DHCP, upstream unbound, .sol domain, jupiter static lease 00:e0:4c:3c:a3:1f -> 10.0.0.20 (declarative!) - drop services/adguardhome.nix; mercury imports pihole - admin password set via 'pihole setpassword' post-boot (not in repo)
47 lines
1.5 KiB
Nix
47 lines
1.5 KiB
Nix
{ ... }:
|
|
|
|
# Pi-hole (pihole-FTL v6) — network DNS (adblock) + DHCP, with the embedded
|
|
# web UI. Forwards to the local unbound recursive resolver (services/unbound.nix).
|
|
#
|
|
# `settings` is the raw pihole.toml. Static DHCP leases ARE declarative here
|
|
# (settings.dhcp.hosts, dnsmasq "MAC,IP,hostname" format) — the reason we chose
|
|
# pihole over AdGuard.
|
|
#
|
|
# ⚠️ The pihole-ftl NixOS module + pihole.toml v6 schema are new; VALIDATE this
|
|
# at runtime (VM or the Pi) before trusting it — eval only checks the module,
|
|
# not the freeform TOML keys.
|
|
{
|
|
services.pihole-ftl = {
|
|
enable = true;
|
|
openFirewallDNS = true;
|
|
openFirewallDHCP = true;
|
|
openFirewallWebserver = true;
|
|
|
|
lists = [
|
|
{ url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; type = "block"; }
|
|
];
|
|
|
|
settings = {
|
|
dns = {
|
|
upstreams = [ "127.0.0.1#5335" ]; # local unbound (recursive)
|
|
domain = "sol"; # local domain -> jupiter.sol etc.
|
|
};
|
|
|
|
dhcp = {
|
|
active = true;
|
|
start = "10.0.0.50";
|
|
end = "10.0.0.200";
|
|
router = "10.0.0.1";
|
|
leaseTime = "1h";
|
|
# Static leases (declarative). Format: "MAC,IP,hostname".
|
|
hosts = [ "00:e0:4c:3c:a3:1f,10.0.0.20,jupiter" ];
|
|
};
|
|
|
|
# Embedded web UI on :80. Set the admin password once after first boot:
|
|
# sudo pihole setpassword (kept out of the repo)
|
|
# (plain "80" so the module's openFirewall port parser is happy.)
|
|
webserver.port = "80";
|
|
};
|
|
};
|
|
}
|