erik
fd3ccf5f07
- services/pihole.nix: official pihole/pihole:2026.07.2 via podman, host net, caps NET_ADMIN/NET_RAW/SYS_NICE/CHOWN; FTLCONF_* env config (upstream unbound, DHCP 50-200, static lease jupiter, .sol domain, local records) - unbound: resolveLocalQueries=false (was hijacking resolv.conf to :53 -> boot DNS deadlock; the real root cause of the earlier failures too) - password via sops FTLCONF env file; /var/lib/pihole created via tmpfiles - VM-verified: mercury.sol/jupiter.sol/external all resolve, 0 restarts
50 lines
2.0 KiB
Nix
50 lines
2.0 KiB
Nix
{ pkgs, lib, ... }:
|
|
|
|
# Pi-hole via the official container (the native nixpkgs pihole-ftl module
|
|
# segfaults on aarch64 / Pi 3B+). Host networking so it can serve DHCP and reach
|
|
# the host's unbound at 127.0.0.1:5335. Config via FTLCONF_* env vars (pihole v6)
|
|
# — these override pihole.toml on every start, so it stays effectively
|
|
# declarative. The web admin password is added from sops in the host config.
|
|
{
|
|
virtualisation.podman = {
|
|
enable = true;
|
|
dockerCompat = true;
|
|
};
|
|
|
|
virtualisation.oci-containers = {
|
|
backend = "podman";
|
|
containers.pihole = {
|
|
image = "pihole/pihole:latest"; # TODO: pin to the tested version after VM check
|
|
autoStart = true;
|
|
extraOptions = [
|
|
"--network=host" # DHCP broadcast + host unbound on 127.0.0.1
|
|
"--cap-add=NET_ADMIN" # DHCP
|
|
"--cap-add=NET_RAW" # DNS engine (dnsmasq) — REQUIRED
|
|
"--cap-add=SYS_NICE"
|
|
"--cap-add=CHOWN" # entrypoint chowns /etc/pihole
|
|
];
|
|
volumes = [ "/var/lib/pihole:/etc/pihole" ]; # persist config/state
|
|
environment = {
|
|
TZ = "Europe/Berlin";
|
|
FTLCONF_dns_upstreams = "127.0.0.1#5335"; # host unbound (recursive)
|
|
FTLCONF_dns_listeningMode = "all"; # serve the LAN
|
|
FTLCONF_dns_domain = "sol";
|
|
FTLCONF_dhcp_active = "true";
|
|
FTLCONF_dhcp_start = "10.0.0.50";
|
|
FTLCONF_dhcp_end = "10.0.0.200";
|
|
FTLCONF_dhcp_router = "10.0.0.1";
|
|
FTLCONF_dhcp_leaseTime = "1h";
|
|
# Arrays (format validated in the VM): static lease + local DNS records.
|
|
FTLCONF_dhcp_hosts = "00:e0:4c:3c:a3:1f,10.0.0.20,jupiter";
|
|
FTLCONF_dns_hosts = "10.0.0.10 mercury.sol;10.0.0.20 jupiter.sol";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Bind-mount source must exist (podman won't create it).
|
|
systemd.tmpfiles.rules = [ "d /var/lib/pihole 0755 root root -" ];
|
|
|
|
networking.firewall.allowedTCPPorts = [ 53 80 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 67 ];
|
|
}
|