Harden NOMAD Pi-hole DNS binding

pihole/nomad/README.md

@@ -14,3 +14,19 @@ cd /opt/pihole-nomad
 cp .env.example .env
 bash bin/prepare_nomad.sh --up
 ```
+
+Host note:
+
+- If `systemd-resolved` is using the local DNS stub on port 53, disable the stub listener on NOMAD before trusting Pi-hole for live DNS:
+
+```bash
+sudo mkdir -p /etc/systemd/resolved.conf.d
+cat <<'EOF' | sudo tee /etc/systemd/resolved.conf.d/99-pihole.conf
+[Resolve]
+DNSStubListener=no
+EOF
+sudo systemctl restart systemd-resolved
+sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
+```
+
+Pi-hole on NOMAD is pinned to `enp5s0` with `FTLCONF_dns_interface=enp5s0` and `FTLCONF_dns_listeningMode=SINGLE` so it answers cleanly on the LAN IP without fighting Docker bridge noise.

pihole/nomad/docker-compose.yaml

@@ -28,7 +28,8 @@ services:
       TZ: ${TZ}
       PIHOLE_WEB_PORT: ${NOMAD_PIHOLE_WEB_PORT}
       FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD}
-      FTLCONF_dns_listeningMode: "LOCAL"
+      FTLCONF_dns_interface: "enp5s0"
+      FTLCONF_dns_listeningMode: "SINGLE"
       FTLCONF_dns_upstreams: "127.0.0.1#5335"
       FTLCONF_webserver_port: ${NOMAD_PIHOLE_WEB_PORT}
       FTLCONF_ntp_ipv4_active: "false"