Update Pi-hole docs for live HA rollout

pihole/README.md

@@ -13,7 +13,7 @@ This stack intentionally covers the **PD primary** plus PD-hosted sync:
 - Keepalived
 - Nebula Sync
 
-NOMAD and RPi4 replicas still need their own deployment steps.
+NOMAD replica deployment is now documented and live; only the RPi4 replica remains future work.
 
 ## Files
 
@@ -39,6 +39,24 @@ If that validates cleanly, bring it up:
 /usr/bin/bash bin/prepare_pd.sh --up
 ```
 
+## Current live topology
+
+- **PD primary**
+  - service root: `/mnt/docker-ssd/docker/compose/pihole`
+  - Pi-hole container: `pihole-primary`
+  - Unbound container: `unbound-pihole-primary`
+  - Keepalived container: `keepalived-pihole-primary`
+  - Nebula Sync container: `nebula-sync`
+  - LAN admin URL: `http://10.5.1.6:8953/admin/`
+- **NOMAD backup**
+  - service root: `/opt/pihole-nomad`
+  - Pi-hole container: `pihole-nomad`
+  - Unbound container: `unbound-pihole-nomad`
+  - Keepalived container: `keepalived-pihole-nomad`
+  - LAN admin URL: `http://10.5.1.16:8954/admin/`
+- **VIP for client DNS:** `10.5.1.53`
+- **Shared Pi-hole admin password:** stored in the local `.env` files; Nebula and both nodes use the same current value.
+
 ## Important notes
 
 - `KEEPALIVED_PASSWORD` must be **8 chars or fewer** because VRRP PASS auth is annoying and old.
@@ -46,5 +64,6 @@ If that validates cleanly, bring it up:
 - `FTLCONF_dns_listeningMode=LOCAL` is set because TrueNAS binds loopback on port 53.
 - Pi-hole NTP is explicitly disabled here because PD host `chronyd` already owns UDP 123.
 - Nebula Sync runs on PD and uses `NEBULA_SYNC_PRIMARY` / `NEBULA_SYNC_REPLICAS` from `.env`.
+- Current replica target is NOMAD at `http://10.5.1.16:8954`.
 - Nebula Sync is intentionally set to selective mode with gravity sync toggles enabled for groups, adlists, and domain lists so replica-specific runtime/network settings are not clobbered.
 - `keepalived.conf` is generated and should stay local/untracked.

pihole/nomad/README.md

@@ -30,3 +30,11 @@ sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
 ```
 
 Pi-hole on NOMAD is pinned to `enp5s0` with `FTLCONF_dns_interface=enp5s0` and `FTLCONF_dns_listeningMode=SINGLE` so it answers cleanly on the LAN IP without fighting Docker bridge noise.
+
+Current live containers:
+- `pihole-nomad`
+- `unbound-pihole-nomad`
+- `keepalived-pihole-nomad`
+
+Current LAN admin URL:
+- `http://10.5.1.16:8954/admin/`