diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..32c550e --- /dev/null +++ b/Dockerfile @@ -0,0 +1,19 @@ +#ARG PIHOLE_VERSION +FROM pihole/pihole:development +RUN apk update +RUN apk add --no-cache unbound curl ca-certificates \ + && curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache +RUN apk add --no-cache iputils-ping + +COPY config/unbound/unbound.conf /etc/unbound/unbound.conf +COPY config/unbound/unbound.conf.d /etc/unbound/unbound.conf.d +COPY config/unbound/unbound.log /etc/unbound/unbound.log + +COPY config/entrypoint.sh /usr/bin/entrypoint.sh +COPY config/unbound/unbound.sh /usr/bin/unbound.sh + +RUN chmod +x /usr/bin/entrypoint.sh +RUN chmod +x /usr/bin/unbound.sh + +WORKDIR /usr/bin +ENTRYPOINT ["entrypoint.sh"] diff --git a/config/99-edns.conf b/config/99-edns.conf new file mode 100644 index 0000000..379513b --- /dev/null +++ b/config/99-edns.conf @@ -0,0 +1 @@ +edns-packet-max=1232 \ No newline at end of file diff --git a/config/entrypoint.sh b/config/entrypoint.sh new file mode 100644 index 0000000..67e0108 --- /dev/null +++ b/config/entrypoint.sh @@ -0,0 +1,4 @@ +#!/bin/sh +/bin/bash /usr/bin/start.sh & +/bin/bash /usr/bin/unbound.sh & +wait diff --git a/config/lighttpd-external.conf b/config/lighttpd-external.conf new file mode 100644 index 0000000..8685d5e --- /dev/null +++ b/config/lighttpd-external.conf @@ -0,0 +1,6 @@ +$HTTP["url"] =~ "^/admin/" { + # Allow using Pi-Hole admin in iframes (eg, for Home Assistant) + setenv.set-response-header += ( + "X-Frame-Options" => "Allow" + ) +} \ No newline at end of file diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf new file mode 100644 index 0000000..a688821 --- /dev/null +++ b/config/unbound/unbound.conf @@ -0,0 +1,62 @@ +# Config pulled from https://docs.pi-hole.net/guides/unbound/ + +server: + # Working Directory + directory: "/etc/unbound" + + # Include other configs + include: "/etc/unbound/unbound.conf.d/*.conf" + + # If no logfile is specified, syslog is used + logfile: "/etc/unbound/unbound.log" + verbosity: 2 + + interface: 127.0.0.1 + port: 5335 + do-ip4: yes + do-udp: yes + do-tcp: yes + + # May be set to yes if you have IPv6 connectivity + do-ip6: no + + # You want to leave this to no unless you have *native* IPv6. With 6to4 and + # Terredo tunnels your web browser should favor IPv4 for the same reasons + prefer-ip6: no + + # Use this only when you downloaded the list of primary root servers! + # If you use the default dns-root-data package, unbound will find it automatically + root-hints: "/etc/unbound/root.hints" + + # Trust glue only if it is within the server's authority + harden-glue: yes + + # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS + harden-dnssec-stripped: yes + + # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes + # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details + use-caps-for-id: no + + # Reduce EDNS reassembly buffer size. + # Suggested by the unbound man page to reduce fragmentation reassembly problems + edns-buffer-size: 1232 + + # Perform prefetching of close to expired message cache entries + # This only applies to domains that have been frequently queried + prefetch: yes + + # One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1. + num-threads: 2 + + # Ensure kernel buffer is large enough to not lose messages in traffic spikes + # Be aware that if enabled (requires CAP_NET_ADMIN or privileged), the kernel buffer must have the defined amount of memory, if not, a warning will be raised. + #so-rcvbuf: 1m + + # Ensure privacy of local IP ranges + private-address: 192.168.0.0/16 + private-address: 169.254.0.0/16 + private-address: 172.16.0.0/12 + private-address: 10.0.0.0/8 + private-address: fd00::/8 + private-address: fe80::/10 diff --git a/config/unbound/unbound.conf.d/.placeholder b/config/unbound/unbound.conf.d/.placeholder new file mode 100644 index 0000000..e69de29 diff --git a/config/unbound/unbound.log b/config/unbound/unbound.log new file mode 100644 index 0000000..e69de29 diff --git a/config/unbound/unbound.sh b/config/unbound/unbound.sh new file mode 100644 index 0000000..83c3028 --- /dev/null +++ b/config/unbound/unbound.sh @@ -0,0 +1,3 @@ +#!/bin/bash + +/usr/sbin/unbound -d -c /etc/unbound/unbound.conf diff --git a/docker-compose.yml_docker b/docker-compose.yml_docker new file mode 100644 index 0000000..20b4532 --- /dev/null +++ b/docker-compose.yml_docker @@ -0,0 +1,37 @@ +version: '3.9' + +# This is using local volumes. If you would like an example of nfs volumes look in docker-compose.yml_swarm. +volumes: + pihole-data: + pihole-unbound: + +services: + app: + image: + hostname: Pihole + volumes: + - type: volume + source: pihole-data + target: /etc/pihole + # volume: + # nocopy: true + - type: volume + source: pihole-unbound + target: /etc/unbound + # volume: + # nocopy: true + - /etc/localtime:/etc/localtime:ro + - type: tmpfs + target: /dev/shm + tmpfs: + size: 2048000000 + ports: + - "443:443/tcp" + - "53:53/tcp" + - "53:53/udp" + - "80:80/tcp" #Allows use of different port to access pihole web interface when other docker containers use port 80 + # - 5335:5335/tcp # Uncomment to enable unbound access on local server + # - 22/tcp # Uncomment to enable SSH + environment: + TZ: + FTLCONF_webserver_api_password: '' diff --git a/docker-compose.yml_swarm b/docker-compose.yml_swarm new file mode 100644 index 0000000..d84f7c1 --- /dev/null +++ b/docker-compose.yml_swarm @@ -0,0 +1,68 @@ +version: '3.9' + +# I use nfs in my swarm so this is the config for nfs volumes. +# If you would rather use local volumes just remove the lines under pihole-data: and pihole-unbound: in the volumes section. +volumes: + pihole-data: + driver: local + driver_opts: + type: "nfs" + o: "addr=,soft,rw" + device: ":/mnt//PiHole/pihole-data/_data/" + pihole-unbound: + driver: local + driver_opts: + type: "nfs" + o: "addr=,soft,rw" + device: ":/mnt//PiHole/pihole-unbound/_data/" + +services: + app: + image: + hostname: Pihole + volumes: + - type: volume + source: pihole-data + target: /etc/pihole + # volume: + # nocopy: true + - type: volume + source: pihole-unbound + target: /etc/unbound + # volume: + # nocopy: true + - /etc/localtime:/etc/localtime:ro + - type: tmpfs + target: /dev/shm + tmpfs: + size: 2048000000 + ports: + # I use host for the dns port to ensure my router can get to it directly without any docker bridge. + # This allows my known host file on my router to forward domain names for local machines to Pihole. + - target: 53 + published: 53 + protocol: tcp + mode: host + - target: 53 + published: 53 + protocol: udp + mode: host + - "443:443/tcp" + # - 53:53/tcp + # - 53:53/udp + - "80:80/tcp" #Allows use of different port to access pihole web interface when other docker containers use port 80 + # - 5335:5335/tcp # Uncomment to enable unbound access on local server + # - 22/tcp # Uncomment to enable SSH + environment: + TZ: + FTLCONF_webserver_api_password: '' + deploy: + mode: replicated + replicas: 1 + restart_policy: + condition: any + placement: + constraints: + # Whatever constraints you need. (I have 2 vms that use high availability on proxmox so i assign this service to them to + # ensure pihole is always up. + - node.labels.HA == true