From 24c6a292738bcee6005a55c6a391df963f7f0b32 Mon Sep 17 00:00:00 2001 From: Fizzlepoof Date: Wed, 27 May 2026 21:14:15 +0000 Subject: [PATCH] docs: record full Pi-hole retirement --- docs/architecture/SERVICES_DIRECTORY.md | 2 +- docs/planning/DEPLOY_PIHOLE.md | 4 ++-- docs/planning/TODO.md | 4 ++-- .../doris-dashboard/bin/generate_dashboard.py | 3 --- pihole/README.md | 15 ++++++++----- pihole/nomad/README.md | 22 ++++++++++--------- pihole/rpi4/README.md | 5 +++-- pihole/serenity/README.md | 4 +++- technitium-pilot/README.md | 4 ++-- 9 files changed, 34 insertions(+), 29 deletions(-) diff --git a/docs/architecture/SERVICES_DIRECTORY.md b/docs/architecture/SERVICES_DIRECTORY.md index 2f5326d..4e73d23 100644 --- a/docs/architecture/SERVICES_DIRECTORY.md +++ b/docs/architecture/SERVICES_DIRECTORY.md @@ -51,7 +51,7 @@ OpenClaw is no longer treated as an active PD service in the operator inventory. | Service | Host | Port | Status | |---------|------|------|--------| | Technitium primary source node | PD (`10.5.30.8` via `technitium-pilot` macvlan stack) | 53 / 5380 | ✅ Active source of truth; PD root cron runs `technitium-pilot/bin/sync_backup_nodes.sh` every 15 minutes, and recent logs show successful sync + verification of Nomad (`10.5.30.9`) and Serenity (`10.5.30.10`) | -| Legacy Pi-hole runtime | PD + N.O.M.A.D. | legacy resolver path (`10.5.30.53`, Pi-hole/Unbound/Keepalived) | ⚠️ Not part of the active Technitium design. PD's old Pi-hole stack (`nebula-sync`, `pihole-primary`, `unbound-pihole-primary`, `keepalived-pihole-primary`) was retired on 2026-05-27 and PD was repointed to Technitium. The legacy VIP `10.5.30.53` still answers from the surviving NOMAD Pi-hole stack (`pihole-nomad` + `unbound-pihole-nomad` + `keepalived-pihole-nomad`), so treat it as leftover legacy DNS, not source-of-truth. | +| Legacy Pi-hole runtime | PD + N.O.M.A.D. | former legacy resolver path (`10.5.30.53`, Pi-hole/Unbound/Keepalived) | Historical only. PD's old Pi-hole stack (`nebula-sync`, `pihole-primary`, `unbound-pihole-primary`, `keepalived-pihole-primary`) and NOMAD's leftover stack (`pihole-nomad` + `unbound-pihole-nomad` + `keepalived-pihole-nomad`) were both retired on 2026-05-27. The old VIP `10.5.30.53` no longer answers; Technitium (`10.5.30.8/.9/.10`) is the live DNS path. | ## Media (PD) diff --git a/docs/planning/DEPLOY_PIHOLE.md b/docs/planning/DEPLOY_PIHOLE.md index c919ac8..447164f 100644 --- a/docs/planning/DEPLOY_PIHOLE.md +++ b/docs/planning/DEPLOY_PIHOLE.md @@ -1,9 +1,9 @@ # Pi-hole Deployment Plan -**Status:** Historical Pi-hole design. It is no longer the active DNS source of truth. PD's old primary runtime was retired on 2026-05-27 after local resolver cutover to the Technitium trio, but the legacy VIP `10.5.30.53` still survives from NOMAD's leftover Pi-hole stack. Treat this document as history/reference, not the current intended DNS architecture. +**Status:** Historical Pi-hole design. It is no longer the active DNS source of truth. Both the PD and NOMAD Pi-hole runtimes were retired on 2026-05-27 after cutover to the Technitium trio, and the old VIP `10.5.30.53` no longer answers. Treat this document as history/reference, not the current intended DNS architecture. **Architecture:** 3-node HA cluster with Keepalived VIP, Unbound recursive DNS, Nebula Sync -> **Warning:** The examples below describe the original HA Pi-hole plan. Current live reality is split: PD's old Pi-hole runtime is gone, but NOMAD still has legacy Pi-hole containers and currently carries the old VIP `10.5.30.53`. Do not treat anything below as the desired current-state DNS design. +> **Warning:** The examples below describe the original HA Pi-hole plan. The entire Pi-hole path has now been retired. Current live DNS is Technitium on `10.5.30.8`, `10.5.30.9`, and `10.5.30.10`; the old Pi-hole VIP `10.5.30.53` is dead. Do not treat anything below as the desired current-state DNS design. --- diff --git a/docs/planning/TODO.md b/docs/planning/TODO.md index c653179..17022d3 100644 --- a/docs/planning/TODO.md +++ b/docs/planning/TODO.md @@ -5,9 +5,9 @@ - [x] Regenerate N.O.M.A.D. Newt secret (was exposed in chat) — completed 2026-05-15 ## Infrastructure -- [x] Deploy Pi-hole HA on PD + N.O.M.A.D. with VIP `10.5.30.53` — completed 2026-05-15; historical design later superseded by the Technitium trio. As of 2026-05-27 the PD primary runtime at `/mnt/docker-ssd/docker/compose/pihole` has been retired, while the legacy VIP still survives from NOMAD's leftover stack at `/opt/pihole-nomad`; see docs/planning/DEPLOY_PIHOLE.md +- [x] Deploy Pi-hole HA on PD + N.O.M.A.D. with VIP `10.5.30.53` — completed 2026-05-15; historical design later superseded by the Technitium trio. Both the PD runtime at `/mnt/docker-ssd/docker/compose/pihole` and the NOMAD runtime at `/opt/pihole-nomad` were retired on 2026-05-27; see docs/planning/DEPLOY_PIHOLE.md - PD primary retired 2026-05-27 after local resolver cutover to Technitium (`10.5.30.8/.9/.10` + `9.9.9.9`) - - NOMAD legacy survivor still live at `/opt/pihole-nomad` + - NOMAD legacy survivor retired 2026-05-27; old VIP `10.5.30.53` no longer answers - RPi4 remains optional future BACKUP2 work if you want a third node later - [x] Deploy Kima-Hub — completed 2026-05-06; docs/planning/DEPLOY_KIMA_HUB.md now serves as deployment/repair reference - [ ] Set up off-site backup for vital data (appdata, databases, config repo, photos) diff --git a/home/doris-dashboard/bin/generate_dashboard.py b/home/doris-dashboard/bin/generate_dashboard.py index 327f242..60ffd03 100755 --- a/home/doris-dashboard/bin/generate_dashboard.py +++ b/home/doris-dashboard/bin/generate_dashboard.py @@ -112,9 +112,6 @@ SERVICE_DIRECTORY = [ 'items': [ {'name': 'Home Assistant', 'url': '', 'purpose': 'Smart-home control hub documented on PD, but Doris does not yet have a stable operator-safe route.', 'exposure': 'PRIVATE', 'state': 'attention', 'host': 'PD', 'port': '8123', 'probe': False, 'badge': 'Manual', 'detail': 'documented active on PD; local port currently refuses from NOMAD, so keep this manual until routed cleanly'}, {'name': 'Kima Hub', 'url': 'http://10.5.30.6:3333', 'health_url': 'http://10.5.30.6:3333', 'purpose': 'Custom IoT gateway and smart-home integration surface.', 'exposure': 'LAN', 'state': 'ok', 'host': 'PD', 'port': '3333'}, - {'name': 'Pi-hole VIP', 'url': 'http://10.5.30.53/ui/', 'health_url': 'http://10.5.30.53/admin/', 'purpose': 'Floating DNS/admin surface for the HA Pi-hole pair your clients should target.', 'exposure': 'LAN', 'state': 'ok', 'host': 'VIP', 'port': '53 / 80'}, - {'name': 'Pi-hole PD', 'url': 'http://10.5.30.6/ui/', 'health_url': 'http://10.5.30.6/admin/', 'purpose': 'Primary PD Pi-hole node behind the floating DNS VIP.', 'exposure': 'LAN', 'state': 'ok', 'host': 'PD', 'port': '53 / 80'}, - {'name': 'Pi-hole NOMAD', 'url': 'https://10.5.30.7/login', 'purpose': 'NOMAD backup Pi-hole replica for the HA DNS pair.', 'exposure': 'LAN', 'state': 'attention', 'host': 'NOMAD', 'port': '53 / 80/443', 'probe': False, 'badge': 'Manual', 'detail': 'documented active; local admin currently presents a self-signed TLS flow from NOMAD so Doris leaves this manual'}, {'name': 'Authelia', 'url': 'http://10.5.30.6:9091', 'health_url': 'http://10.5.30.6:9091', 'purpose': 'Identity and auth gate backing protected public routes.', 'exposure': 'LAN', 'state': 'ok', 'host': 'PD', 'port': '9091'}, ], }, diff --git a/pihole/README.md b/pihole/README.md index 02ee60e..19721aa 100644 --- a/pihole/README.md +++ b/pihole/README.md @@ -1,11 +1,13 @@ # PD Pi-hole / Unbound / Keepalived Stack -Primary-node stack for the Pi-hole HA plan. +Historical primary-node stack for the retired Pi-hole HA plan. - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole` -- **Live PD stack path:** `/mnt/docker-ssd/docker/compose/pihole` -- **Node role:** PD primary / MASTER -- **VIP target:** `10.5.30.53/24` +- **Former live PD stack path:** `/mnt/docker-ssd/docker/compose/pihole` +- **Former node role:** PD primary / MASTER +- **Former VIP target:** `10.5.30.53/24` + +Status: retired on 2026-05-27 after cutover to the Technitium trio (`10.5.30.8`, `10.5.30.9`, `10.5.30.10`). This stack intentionally covers the **PD primary** plus PD-hosted sync: - Pi-hole @@ -13,7 +15,7 @@ This stack intentionally covers the **PD primary** plus PD-hosted sync: - Keepalived - Nebula Sync -NOMAD replica deployment is now documented and live; only the RPi4 replica remains future work. +NOMAD replica deployment is documented here for historical reference; only the RPi4 replica remains optional future work if you ever revive a separate backup-DNS design. ## Files @@ -39,7 +41,7 @@ If that validates cleanly, bring it up: /usr/bin/bash bin/prepare_pd.sh --up ``` -## Current live topology +## Retired topology snapshot - **PD primary** - service root: `/mnt/docker-ssd/docker/compose/pihole` @@ -59,6 +61,7 @@ If that validates cleanly, bring it up: ## Important notes +- This stack is no longer live. Keep it only as a historical build/repair reference. - `KEEPALIVED_PASSWORD` must be **8 chars or fewer** because VRRP PASS auth is annoying and old. - Verify `LAN_INTERFACE` on PD before deployment (`ip link show`). - `FTLCONF_dns_listeningMode=LOCAL` is set because TrueNAS binds loopback on port 53. diff --git a/pihole/nomad/README.md b/pihole/nomad/README.md index 24fb309..4dd750a 100644 --- a/pihole/nomad/README.md +++ b/pihole/nomad/README.md @@ -1,17 +1,19 @@ # NOMAD Pi-hole / Unbound / staged Keepalived Replica - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole/nomad` -- **Suggested live stack path:** `/opt/pihole-nomad` -- **Node role:** NOMAD Pi-hole replica on Servers VLAN -- **Staged future VIP target:** `10.5.30.53/24` +- **Former live stack path:** `/opt/pihole-nomad` +- **Former node role:** NOMAD Pi-hole replica on Servers VLAN +- **Former staged VIP target:** `10.5.30.53/24` - **LAN interface:** `enp5s0` - **NOMAD LAN IP:** `10.5.30.7` -Current state: +Status: retired on 2026-05-27 after network-wide DNS cutover to the Technitium trio. -- `pihole-nomad` and `unbound-pihole-nomad` stay up normally on NOMAD. -- `keepalived-pihole-nomad` is intentionally disabled by default after NOMAD moved from Trusted to Servers VLAN. -- Enable HA later with `COMPOSE_PROFILES=ha` only after a same-subnet peer and VIP design are ready. +Retired state summary: + +- `pihole-nomad`, `unbound-pihole-nomad`, and `keepalived-pihole-nomad` were retired on 2026-05-27. +- The old VIP `10.5.30.53` no longer answers. +- Treat the files here as historical/reference material unless you intentionally revive this design. Bring-up: @@ -37,12 +39,12 @@ sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf Pi-hole on NOMAD is pinned to `enp5s0` with `FTLCONF_dns_interface=enp5s0` and `FTLCONF_dns_listeningMode=SINGLE` so it answers cleanly on the LAN IP without fighting Docker bridge noise. -Current live containers: +Former live containers: - `pihole-nomad` - `unbound-pihole-nomad` -Staged but disabled-by-default HA container: +Former HA container: - `keepalived-pihole-nomad` -Current LAN admin URL: +Former LAN admin URL: - `http://10.5.30.7:8954/admin/` diff --git a/pihole/rpi4/README.md b/pihole/rpi4/README.md index 53a8548..40e3f42 100644 --- a/pihole/rpi4/README.md +++ b/pihole/rpi4/README.md @@ -3,7 +3,8 @@ - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole/rpi4` - **Suggested live stack path:** `~/pihole/stack` - **Node role:** BACKUP2 -- **VIP target:** `10.5.30.53/24` +- **Historical VIP target:** `10.5.30.53/24` -This node still needs its actual LAN IP confirmed before live deployment. +This node still needs its actual LAN IP confirmed before any future deployment. +The original Pi-hole HA design using `10.5.30.53` is retired; keep this only as historical/future-idea reference unless you intentionally build a new backup-DNS path. Native keepalived config example is in `keepalived.conf.example`. diff --git a/pihole/serenity/README.md b/pihole/serenity/README.md index a801c6c..26b970b 100644 --- a/pihole/serenity/README.md +++ b/pihole/serenity/README.md @@ -3,9 +3,11 @@ - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole/serenity` - **Suggested live stack path:** `/boot/config/plugins/compose.manager/projects/pihole-ha` - **Node role:** Serenity backup / BACKUP1 -- **VIP target:** `10.5.30.53/24` +- **Historical VIP target:** `10.5.30.53/24` - **LAN interface:** `br0` +Status: historical reference only. Serenity's Pi-hole replica was previously cleaned up, and the overall Pi-hole HA path is now retired in favor of Technitium. + Bring-up: ```bash diff --git a/technitium-pilot/README.md b/technitium-pilot/README.md index 91dcf54..4a5156b 100644 --- a/technitium-pilot/README.md +++ b/technitium-pilot/README.md @@ -9,7 +9,7 @@ Non-disruptive Technitium DNS Server pilot for PlausibleDeniability. - Web console: `http://10.5.30.8/` - Friendly hostname inside Technitium: `http://dns.home.paccoco.com/` -This pilot intentionally does not touch the live Pi-hole service on `10.5.30.6` or the client VIP on `10.5.30.53`. +This stack is no longer just a side-by-side pilot. It is the active DNS source of truth, and the old Pi-hole service/VIP path has been retired. Current mirrored baseline from Pi-hole: - blocklists: @@ -33,7 +33,7 @@ Notes: - Authentik native OIDC callback for Technitium is `https://dns.paccoco.com/sso/callback`. - For Authentik native OIDC, the Technitium OAuth2 provider must have the default OpenID scope mappings attached: `openid`, `email`, and `profile`. Without them, Authentik will mint a token with no OpenID scopes and Technitium fails the `/application/o/userinfo/` call with `Scope mismatch` / `SSO authentication failed`. - The authoritative zone `home.paccoco.com` is now hosted in Technitium with `dns.home.paccoco.com -> 10.5.30.8`. -- Clients will resolve `dns.home.paccoco.com` only when they query Technitium directly, or after DHCP/cutover points them at Technitium. +- Clients now resolve `dns.home.paccoco.com` through the Technitium trio because the Pi-hole VIP path has been retired. - `bin/sync_backup_nodes.sh` is the PD-side replication runner that pushes the live Technitium config to the Nomad (`10.5.30.9`) and Serenity (`10.5.30.10`) backup nodes, then recycles those backup stacks and verifies both a private authoritative answer and a public recursive answer. - Active automation model: root cron on PD runs the sync every 15 minutes from `/mnt/docker-ssd/docker/compose/technitium-pilot`, logging to `/mnt/tank/docker/appdata/technitium-pilot/logs/sync-backup-nodes.log`. - External fallback `9.9.9.9` keeps general internet DNS available if the Technitium trio is down, but it is not a substitute for the private `home.paccoco.com` zone.