erik
c2ac7e3af4
mercury is the DHCP server (no lease of its own) so its name wasn't resolvable. Add explicit dns.hosts A records. VM-verified: both resolve, external unaffected.
54 lines
1.8 KiB
Nix
54 lines
1.8 KiB
Nix
{ ... }:
|
|
|
|
# Pi-hole (pihole-FTL v6) — network DNS (adblock) + DHCP, with the embedded
|
|
# web UI. Forwards to the local unbound recursive resolver (services/unbound.nix).
|
|
#
|
|
# `settings` is the raw pihole.toml. Static DHCP leases ARE declarative here
|
|
# (settings.dhcp.hosts, dnsmasq "MAC,IP,hostname" format) — the reason we chose
|
|
# pihole over AdGuard.
|
|
#
|
|
# ⚠️ The pihole-ftl NixOS module + pihole.toml v6 schema are new; VALIDATE this
|
|
# at runtime (VM or the Pi) before trusting it — eval only checks the module,
|
|
# not the freeform TOML keys.
|
|
{
|
|
services.pihole-ftl = {
|
|
enable = true;
|
|
openFirewallDNS = true;
|
|
openFirewallDHCP = true;
|
|
openFirewallWebserver = true;
|
|
|
|
lists = [
|
|
{ url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"; type = "block"; }
|
|
];
|
|
|
|
settings = {
|
|
dns = {
|
|
upstreams = [ "127.0.0.1#5335" ]; # local unbound (recursive)
|
|
domain = "sol"; # local domain -> jupiter.sol etc.
|
|
# Local A records (/etc/hosts style). mercury is the DHCP server (no
|
|
# lease of its own), so its name must be declared here. jupiter is also
|
|
# pinned explicitly so it resolves regardless of lease state.
|
|
hosts = [
|
|
"10.0.0.10 mercury.sol mercury"
|
|
"10.0.0.20 jupiter.sol jupiter"
|
|
];
|
|
};
|
|
|
|
dhcp = {
|
|
active = true;
|
|
start = "10.0.0.50";
|
|
end = "10.0.0.200";
|
|
router = "10.0.0.1";
|
|
leaseTime = "1h";
|
|
# Static leases (declarative). Format: "MAC,IP,hostname".
|
|
hosts = [ "00:e0:4c:3c:a3:1f,10.0.0.20,jupiter" ];
|
|
};
|
|
|
|
# Embedded web UI on :80. Set the admin password once after first boot:
|
|
# sudo pihole setpassword (kept out of the repo)
|
|
# (plain "80" so the module's openFirewall port parser is happy.)
|
|
webserver.port = "80";
|
|
};
|
|
};
|
|
}
|