From ade91cc9ab1bb822013f38cd7c4b909587095e62 Mon Sep 17 00:00:00 2001
From: Fizzlepoof <admin@paccoco.com>
Date: Fri, 15 May 2026 16:09:03 +0000
Subject: [PATCH] Harden NOMAD Pi-hole DNS binding

---
 docs/planning/DEPLOY_PIHOLE.md   | 17 ++++++++++++++++-
 pihole/nomad/README.md           | 16 ++++++++++++++++
 pihole/nomad/docker-compose.yaml |  3 ++-
 3 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/docs/planning/DEPLOY_PIHOLE.md b/docs/planning/DEPLOY_PIHOLE.md
index ca62c21..b22172f 100644
--- a/docs/planning/DEPLOY_PIHOLE.md
+++ b/docs/planning/DEPLOY_PIHOLE.md
@@ -263,7 +263,8 @@ services:
     environment:
       TZ: ${TZ}
       FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD}
-      FTLCONF_dns_listeningMode: "LOCAL"
+      FTLCONF_dns_interface: "enp5s0"
+      FTLCONF_dns_listeningMode: "SINGLE"
       FTLCONF_dns_upstreams: "127.0.0.1#5335"
       FTLCONF_webserver_port: "8954"
       FTLCONF_ntp_ipv4_active: "false"
@@ -287,6 +288,20 @@ services:
       - ./keepalived.conf:/container/environment/01-custom/keepalived.conf
 ```
 
+### NOMAD host prerequisite
+
+If `systemd-resolved` is holding a local DNS stub on port 53, disable it before relying on NOMAD Pi-hole for LAN DNS:
+
+```bash
+sudo mkdir -p /etc/systemd/resolved.conf.d
+cat <<'EOF' | sudo tee /etc/systemd/resolved.conf.d/99-pihole.conf
+[Resolve]
+DNSStubListener=no
+EOF
+sudo systemctl restart systemd-resolved
+sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
+```
+
 ### keepalived.conf (N.O.M.A.D. — BACKUP1)
 
 ```
diff --git a/pihole/nomad/README.md b/pihole/nomad/README.md
index d4ea5c8..40072fc 100644
--- a/pihole/nomad/README.md
+++ b/pihole/nomad/README.md
@@ -14,3 +14,19 @@ cd /opt/pihole-nomad
 cp .env.example .env
 bash bin/prepare_nomad.sh --up
 ```
+
+Host note:
+
+- If `systemd-resolved` is using the local DNS stub on port 53, disable the stub listener on NOMAD before trusting Pi-hole for live DNS:
+
+```bash
+sudo mkdir -p /etc/systemd/resolved.conf.d
+cat <<'EOF' | sudo tee /etc/systemd/resolved.conf.d/99-pihole.conf
+[Resolve]
+DNSStubListener=no
+EOF
+sudo systemctl restart systemd-resolved
+sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
+```
+
+Pi-hole on NOMAD is pinned to `enp5s0` with `FTLCONF_dns_interface=enp5s0` and `FTLCONF_dns_listeningMode=SINGLE` so it answers cleanly on the LAN IP without fighting Docker bridge noise.
diff --git a/pihole/nomad/docker-compose.yaml b/pihole/nomad/docker-compose.yaml
index 69a80fe..f6b5fa0 100644
--- a/pihole/nomad/docker-compose.yaml
+++ b/pihole/nomad/docker-compose.yaml
@@ -28,7 +28,8 @@ services:
       TZ: ${TZ}
       PIHOLE_WEB_PORT: ${NOMAD_PIHOLE_WEB_PORT}
       FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD}
-      FTLCONF_dns_listeningMode: "LOCAL"
+      FTLCONF_dns_interface: "enp5s0"
+      FTLCONF_dns_listeningMode: "SINGLE"
       FTLCONF_dns_upstreams: "127.0.0.1#5335"
       FTLCONF_webserver_port: ${NOMAD_PIHOLE_WEB_PORT}
       FTLCONF_ntp_ipv4_active: "false"