Sync network redesign repo state and cutover artifacts

2026-05-22 20:16:21 +00:00
parent 4b1e3d4061
commit 9e6dde7695
59 changed files with 5389 additions and 244 deletions
--- a/pihole/.env.example
+++ b/pihole/.env.example
@@ -10,7 +10,7 @@ PIHOLE_PASSWORD=CHANGE_ME

 # Keepalived / VIP (VRRP PASS auth is max 8 chars)
 LAN_INTERFACE=eno1
-VIP_CIDR=10.5.1.53/24
+VIP_CIDR=10.5.30.53/24
 KEEPALIVED_ROUTER_ID=53
 KEEPALIVED_STATE=MASTER
 KEEPALIVED_PRIORITY=100
@@ -19,7 +19,7 @@ KEEPALIVED_NOPREEMPT=true

 # Nebula Sync (PD primary -> replicas)
 NEBULA_SYNC_PRIMARY=http://127.0.0.1:8953|CHANGE_ME
-NEBULA_SYNC_REPLICAS=http://10.5.1.16:8954|CHANGE_ME
+NEBULA_SYNC_REPLICAS=http://10.5.30.7:8954|CHANGE_ME
 NEBULA_SYNC_FULL_SYNC=false
 NEBULA_SYNC_RUN_GRAVITY=true
 NEBULA_SYNC_CRON=0 3 * * *
--- a/pihole/README.md
+++ b/pihole/README.md
@@ -5,7 +5,7 @@ Primary-node stack for the Pi-hole HA plan.
 - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole`
 - **Live PD stack path:** `/mnt/docker-ssd/docker/compose/pihole`
 - **Node role:** PD primary / MASTER
- **VIP target:** `10.5.1.53/24`
+- **VIP target:** `10.5.30.53/24`

 This stack intentionally covers the **PD primary** plus PD-hosted sync:
 - Pi-hole
@@ -47,14 +47,14 @@ If that validates cleanly, bring it up:
  - Unbound container: `unbound-pihole-primary`
  - Keepalived container: `keepalived-pihole-primary`
  - Nebula Sync container: `nebula-sync`
-  - LAN admin URL: `http://10.5.1.6:8953/admin/`
+  - LAN admin URL: `http://10.5.30.6:8953/admin/`
 - **NOMAD backup**
  - service root: `/opt/pihole-nomad`
  - Pi-hole container: `pihole-nomad`
  - Unbound container: `unbound-pihole-nomad`
-  - Keepalived container: `keepalived-pihole-nomad`
-  - LAN admin URL: `http://10.5.1.16:8954/admin/`
- **VIP for client DNS:** `10.5.1.53`
+  - Keepalived container: `keepalived-pihole-nomad` (staged, disabled by default)
+  - LAN admin URL: `http://10.5.30.7:8954/admin/`
+- **VIP for client DNS:** `10.5.30.53`
 - **Shared Pi-hole admin password:** stored in the local `.env` files; Nebula and both nodes use the same current value.

 ## Important notes
@@ -64,6 +64,7 @@ If that validates cleanly, bring it up:
 - `FTLCONF_dns_listeningMode=LOCAL` is set because TrueNAS binds loopback on port 53.
 - Pi-hole NTP is explicitly disabled here because PD host `chronyd` already owns UDP 123.
 - Nebula Sync runs on PD and uses `NEBULA_SYNC_PRIMARY` / `NEBULA_SYNC_REPLICAS` from `.env`.
- Current replica target is NOMAD at `http://10.5.1.16:8954`.
+- Current replica target is NOMAD at `http://10.5.30.7:8954`.
+- NOMAD no longer participates in the old Trusted-side `10.5.30.53/24` Keepalived VIP after moving to Servers VLAN. Re-enable Keepalived there only after a same-subnet HA design exists.
 - Nebula Sync is intentionally set to selective mode with gravity sync toggles enabled for groups, adlists, and domain lists so replica-specific runtime/network settings are not clobbered.
 - `keepalived.conf` is generated and should stay local/untracked.
--- a/pihole/bin/prepare_pd.sh
+++ b/pihole/bin/prepare_pd.sh
@@ -12,8 +12,21 @@ if [[ ! -f "$ENV_FILE" ]]; then
 fi

 set -a
-# shellcheck disable=SC1090
-source "$ENV_FILE"
+eval "$(python3 - "$ENV_FILE" <<'PY'
+from pathlib import Path
+import shlex
+import sys
+
+env_file = Path(sys.argv[1])
+for raw_line in env_file.read_text(encoding='utf-8').splitlines():
+    line = raw_line.strip()
+    if not line or line.startswith('#') or '=' not in line:
+        continue
+    key, value = line.split('=', 1)
+    value = value.strip().strip('"').strip("'")
+    print(f"{key.strip()}={shlex.quote(value)}")
+PY
+)"
 set +a

 required_vars=(
--- a/pihole/nomad/.env.example
+++ b/pihole/nomad/.env.example
@@ -5,7 +5,7 @@ PIHOLE_WEB_PORT=8954
 NOMAD_PIHOLE_WEB_PORT=8954
 PIHOLE_PASSWORD=CHANGE_ME
 LAN_INTERFACE=enp5s0
-VIP_CIDR=10.5.1.53/24
+VIP_CIDR=10.5.30.53/24
 KEEPALIVED_ROUTER_ID=53
 KEEPALIVED_STATE=BACKUP
 KEEPALIVED_PRIORITY=90
--- a/pihole/nomad/README.md
+++ b/pihole/nomad/README.md
@@ -1,11 +1,17 @@
-# NOMAD Pi-hole / Unbound / Keepalived Replica
+# NOMAD Pi-hole / Unbound / staged Keepalived Replica

 - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole/nomad`
 - **Suggested live stack path:** `/opt/pihole-nomad`
- **Node role:** NOMAD backup / BACKUP1
- **VIP target:** `10.5.1.53/24`
+- **Node role:** NOMAD Pi-hole replica on Servers VLAN
+- **Staged future VIP target:** `10.5.30.53/24`
 - **LAN interface:** `enp5s0`
- **NOMAD LAN IP:** `10.5.1.16`
+- **NOMAD LAN IP:** `10.5.30.7`
+
+Current state:
+
+- `pihole-nomad` and `unbound-pihole-nomad` stay up normally on NOMAD.
+- `keepalived-pihole-nomad` is intentionally disabled by default after NOMAD moved from Trusted to Servers VLAN.
+- Enable HA later with `COMPOSE_PROFILES=ha` only after a same-subnet peer and VIP design are ready.

 Bring-up:

@@ -34,7 +40,9 @@ Pi-hole on NOMAD is pinned to `enp5s0` with `FTLCONF_dns_interface=enp5s0` and `
 Current live containers:
 - `pihole-nomad`
 - `unbound-pihole-nomad`
+
+Staged but disabled-by-default HA container:
 - `keepalived-pihole-nomad`

 Current LAN admin URL:
- `http://10.5.1.16:8954/admin/`
+- `http://10.5.30.7:8954/admin/`
--- a/pihole/nomad/docker-compose.yaml
+++ b/pihole/nomad/docker-compose.yaml
@@ -51,6 +51,7 @@ services:
    image: osixia/keepalived:2.0.20
    container_name: keepalived-pihole-nomad
    network_mode: host
+    profiles: ["ha"]
    restart: unless-stopped
    depends_on:
      pihole:
--- a/pihole/nomad/keepalived.conf
+++ b/pihole/nomad/keepalived.conf
@@ -23,7 +23,7 @@ vrrp_instance VI_DNS {
    }

    virtual_ipaddress {
-        10.5.1.53/24
+        10.5.30.53/24
    }

    track_script {
--- a/pihole/rpi4/README.md
+++ b/pihole/rpi4/README.md
@@ -3,7 +3,7 @@
 - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole/rpi4`
 - **Suggested live stack path:** `~/pihole/stack`
 - **Node role:** BACKUP2
- **VIP target:** `10.5.1.53/24`
+- **VIP target:** `10.5.30.53/24`

 This node still needs its actual LAN IP confirmed before live deployment.
 Native keepalived config example is in `keepalived.conf.example`.
--- a/pihole/rpi4/keepalived.conf.example
+++ b/pihole/rpi4/keepalived.conf.example
@@ -16,6 +16,6 @@ vrrp_instance VI_DNS {
    }

    virtual_ipaddress {
-        10.5.1.53/24
+        10.5.30.53/24
    }
 }
--- a/pihole/serenity/.env.example
+++ b/pihole/serenity/.env.example
@@ -4,7 +4,7 @@ APPDATA_UNBOUND_ROOT=/mnt/user/appdata/unbound-secondary
 SERENITY_PIHOLE_WEB_PORT=8954
 PIHOLE_PASSWORD=CHANGE_ME
 LAN_INTERFACE=br0
-VIP_CIDR=10.5.1.53/24
+VIP_CIDR=10.5.30.53/24
 KEEPALIVED_ROUTER_ID=53
 KEEPALIVED_STATE=BACKUP
 KEEPALIVED_PRIORITY=90
--- a/pihole/serenity/README.md
+++ b/pihole/serenity/README.md
@@ -3,7 +3,7 @@
 - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole/serenity`
 - **Suggested live stack path:** `/boot/config/plugins/compose.manager/projects/pihole-ha`
 - **Node role:** Serenity backup / BACKUP1
- **VIP target:** `10.5.1.53/24`
+- **VIP target:** `10.5.30.53/24`
 - **LAN interface:** `br0`

 Bring-up:
--- a/pihole/serenity/keepalived.conf
+++ b/pihole/serenity/keepalived.conf
@@ -23,7 +23,7 @@ vrrp_instance VI_DNS {
    }

    virtual_ipaddress {
-        10.5.1.53/24
+        10.5.30.53/24
    }

    track_script {