fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sync network redesign repo state and cutover artifacts

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-22 20:16:21 +00:00
parent 4b1e3d4061
commit 8c72a0c287
59 changed files with 5389 additions and 244 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pihole/README.md
View File

@@ -5,7 +5,7 @@ Primary-node stack for the Pi-hole HA plan.
- **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole`
- **Live PD stack path:** `/mnt/docker-ssd/docker/compose/pihole`
- **Node role:** PD primary / MASTER
- **VIP target:** `10.5.1.53/24`
- **VIP target:** `10.5.30.53/24`
This stack intentionally covers the **PD primary** plus PD-hosted sync:
- Pi-hole
@@ -47,14 +47,14 @@ If that validates cleanly, bring it up:
- Unbound container: `unbound-pihole-primary`
- Keepalived container: `keepalived-pihole-primary`
- Nebula Sync container: `nebula-sync`
- LAN admin URL: `http://10.5.1.6:8953/admin/`
- LAN admin URL: `http://10.5.30.6:8953/admin/`
- **NOMAD backup**
- service root: `/opt/pihole-nomad`
- Pi-hole container: `pihole-nomad`
- Unbound container: `unbound-pihole-nomad`
- Keepalived container: `keepalived-pihole-nomad`
- LAN admin URL: `http://10.5.1.16:8954/admin/`
- **VIP for client DNS:** `10.5.1.53`
- Keepalived container: `keepalived-pihole-nomad` (staged, disabled by default)
- LAN admin URL: `http://10.5.30.7:8954/admin/`
- **VIP for client DNS:** `10.5.30.53`
- **Shared Pi-hole admin password:** stored in the local `.env` files; Nebula and both nodes use the same current value.
## Important notes
@@ -64,6 +64,7 @@ If that validates cleanly, bring it up:
- `FTLCONF_dns_listeningMode=LOCAL` is set because TrueNAS binds loopback on port 53.
- Pi-hole NTP is explicitly disabled here because PD host `chronyd` already owns UDP 123.
- Nebula Sync runs on PD and uses `NEBULA_SYNC_PRIMARY` / `NEBULA_SYNC_REPLICAS` from `.env`.
- Current replica target is NOMAD at `http://10.5.1.16:8954`.
- Current replica target is NOMAD at `http://10.5.30.7:8954`.
- NOMAD no longer participates in the old Trusted-side `10.5.30.53/24` Keepalived VIP after moving to Servers VLAN. Re-enable Keepalived there only after a same-subnet HA design exists.
- Nebula Sync is intentionally set to selective mode with gravity sync toggles enabled for groups, adlists, and domain lists so replica-specific runtime/network settings are not clobbered.
- `keepalived.conf` is generated and should stay local/untracked.