fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden NOMAD Pi-hole DNS binding

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-15 16:09:03 +00:00
parent 546507e71c
commit ade91cc9ab
3 changed files with 34 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
docs/planning/DEPLOY_PIHOLE.md
View File

@@ -263,7 +263,8 @@ services:
environment: environment:
TZ: ${TZ} TZ: ${TZ}
FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD} FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD}
FTLCONF_dns_listeningMode: "LOCAL" FTLCONF_dns_interface: "enp5s0"
FTLCONF_dns_listeningMode: "SINGLE"
FTLCONF_dns_upstreams: "127.0.0.1#5335" FTLCONF_dns_upstreams: "127.0.0.1#5335"
FTLCONF_webserver_port: "8954" FTLCONF_webserver_port: "8954"
FTLCONF_ntp_ipv4_active: "false" FTLCONF_ntp_ipv4_active: "false"
@@ -287,6 +288,20 @@ services:
- ./keepalived.conf:/container/environment/01-custom/keepalived.conf - ./keepalived.conf:/container/environment/01-custom/keepalived.conf
``` ```
### NOMAD host prerequisite
If `systemd-resolved` is holding a local DNS stub on port 53, disable it before relying on NOMAD Pi-hole for LAN DNS:
```bash
sudo mkdir -p /etc/systemd/resolved.conf.d
cat <<'EOF' | sudo tee /etc/systemd/resolved.conf.d/99-pihole.conf
[Resolve]
DNSStubListener=no
EOF
sudo systemctl restart systemd-resolved
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
```
### keepalived.conf (N.O.M.A.D. — BACKUP1) ### keepalived.conf (N.O.M.A.D. — BACKUP1)
``` ```

16
pihole/nomad/README.md
View File

@@ -14,3 +14,19 @@ cd /opt/pihole-nomad
cp .env.example .env cp .env.example .env
bash bin/prepare_nomad.sh --up bash bin/prepare_nomad.sh --up
``` ```
Host note:
- If `systemd-resolved` is using the local DNS stub on port 53, disable the stub listener on NOMAD before trusting Pi-hole for live DNS:
```bash
sudo mkdir -p /etc/systemd/resolved.conf.d
cat <<'EOF' | sudo tee /etc/systemd/resolved.conf.d/99-pihole.conf
[Resolve]
DNSStubListener=no
EOF
sudo systemctl restart systemd-resolved
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
```
Pi-hole on NOMAD is pinned to `enp5s0` with `FTLCONF_dns_interface=enp5s0` and `FTLCONF_dns_listeningMode=SINGLE` so it answers cleanly on the LAN IP without fighting Docker bridge noise.

3
pihole/nomad/docker-compose.yaml
View File

@@ -28,7 +28,8 @@ services:
TZ: ${TZ} TZ: ${TZ}
PIHOLE_WEB_PORT: ${NOMAD_PIHOLE_WEB_PORT} PIHOLE_WEB_PORT: ${NOMAD_PIHOLE_WEB_PORT}
FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD} FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD}
FTLCONF_dns_listeningMode: "LOCAL" FTLCONF_dns_interface: "enp5s0"
FTLCONF_dns_listeningMode: "SINGLE"
FTLCONF_dns_upstreams: "127.0.0.1#5335" FTLCONF_dns_upstreams: "127.0.0.1#5335"
FTLCONF_webserver_port: ${NOMAD_PIHOLE_WEB_PORT} FTLCONF_webserver_port: ${NOMAD_PIHOLE_WEB_PORT}
FTLCONF_ntp_ipv4_active: "false" FTLCONF_ntp_ipv4_active: "false"