fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move Pi-hole backup node from Serenity to NOMAD

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-15 15:37:35 +00:00
parent 66dda26f98
commit f3469e35fd
13 changed files with 321 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
docs/planning/DEPLOY_PIHOLE.md
View File

@@ -16,8 +16,8 @@
│ 10.5.1.53/24 │
└──────┬──────────────┬──────────────────┘
│ │ │
PD (MASTER) Serenity (BACKUP1) RPi4 (BACKUP2)
10.5.1.6 10.5.1.5 10.5.1.X
PD (MASTER) N.O.M.A.D. (BACKUP1) RPi4 (BACKUP2)
10.5.1.6 10.5.1.16 10.5.1.X
priority 100 priority 90 priority 80
Pi-hole :53 Pi-hole :53 Pi-hole :53
Unbound :5335 Unbound :5335 Unbound :5335
@@ -225,11 +225,11 @@ sudo docker logs unbound-pihole-primary --tail 20
---
## Node 2: Serenity (BACKUP1)
## Node 2: N.O.M.A.D. (BACKUP1)
Serenity runs Unraid. Deploy via Docker Compose in Unraid's **User Scripts** or the **Compose Manager** plugin.
N.O.M.A.D. runs Ubuntu bare metal. Deploy via Docker Compose on the host.
**Appdata:** `/mnt/user/appdata/`
**Appdata:** `/mnt/hdd-2/docker/appdata/`
**Web UI port:** `8954`
### docker-compose.yaml
@@ -244,7 +244,7 @@ services:
network_mode: host
restart: unless-stopped
volumes:
- /mnt/user/appdata/unbound-pihole:/opt/unbound/etc/unbound/
- /mnt/hdd-2/docker/appdata/unbound-nomad:/opt/unbound/etc/unbound/
healthcheck:
test: ["CMD-SHELL", "drill @127.0.0.1 -p 5335 cloudflare.com || exit 1"]
interval: 30s
@@ -253,7 +253,7 @@ services:
pihole:
image: pihole/pihole:latest
container_name: pihole-secondary
container_name: pihole-nomad
network_mode: host
restart: unless-stopped
depends_on:
@@ -265,8 +265,11 @@ services:
FTLCONF_dns_listeningMode: "LOCAL"
FTLCONF_dns_upstreams: "127.0.0.1#5335"
FTLCONF_webserver_port: "8954"
FTLCONF_ntp_ipv4_active: "false"
FTLCONF_ntp_ipv6_active: "false"
FTLCONF_ntp_sync_active: "false"
volumes:
- /mnt/user/appdata/pihole-secondary/etc-pihole:/etc/pihole
- /mnt/hdd-2/docker/appdata/pihole-nomad/etc-pihole:/etc/pihole
cap_add:
- SYS_NICE
@@ -283,16 +286,16 @@ services:
- ./keepalived.conf:/container/environment/01-custom/keepalived.conf
```
### keepalived.conf (Serenity — BACKUP1)
### keepalived.conf (N.O.M.A.D. — BACKUP1)
```
global_defs {
router_id pihole_serenity
router_id pihole_nomad
}
vrrp_instance VI_DNS {
state BACKUP
interface eth0
interface enp5s0
virtual_router_id 53
priority 90
advert_int 1
@@ -414,7 +417,7 @@ sudo systemctl start keepalived
restart: unless-stopped
environment:
PRIMARY: "http://127.0.0.1:8953|${PIHOLE_PASSWORD}"
REPLICAS: "http://10.5.1.5:8954|${PIHOLE_PASSWORD_SERENITY},http://10.5.1.X:8955|${PIHOLE_PASSWORD_RPI}"
REPLICAS: "http://10.5.1.16:8954|${PIHOLE_PASSWORD_NOMAD},http://10.5.1.X:8955|${PIHOLE_PASSWORD_RPI}"
RUN_GRAVITY: "true"
FULL_SYNC: "false"
CRON: "0 3 * * *"
@@ -426,7 +429,7 @@ sudo systemctl start keepalived
> - `REPLICAS` — comma-separated list of secondary instances
> - `CRON` — syncs daily at 3 AM; force a manual sync with `docker exec nebula-sync nebula-sync run`
> - Each Pi-hole instance can (and should) have a **different** password — nebula-sync handles auth per-instance
> - Add `PIHOLE_PASSWORD_SERENITY` and `PIHOLE_PASSWORD_RPI` to your `.env` file
> - Add `PIHOLE_PASSWORD_NOMAD` and `PIHOLE_PASSWORD_RPI` to your `.env` file
### What Nebula Sync copies
- Gravity database (blocklists, allowlists, group assignments)
@@ -469,7 +472,7 @@ nslookup doubleclick.net 10.5.1.53 # Should return 0.0.0.0 (blocked)
# On PD, bring down keepalived
sudo docker stop keepalived
# Wait ~3 seconds, then check from another machine:
nslookup google.com 10.5.1.53 # Should still work — Serenity took over VIP
nslookup google.com 10.5.1.53 # Should still work — N.O.M.A.D. took over VIP
# Restore
sudo docker start keepalived
```
@@ -491,7 +494,6 @@ Add in Pi-hole (primary) → Local DNS → DNS Records:
| Domain | IP |
|--------|----|
| pd.lan | 10.5.1.6 |
| serenity.lan | 10.5.1.5 |
| nomad.lan | 10.5.1.16 |
| rocinante.lan | 10.5.1.112 |
| rpi4.lan | 10.5.1.X |
@@ -503,7 +505,7 @@ Nebula Sync will propagate these to all replicas.
| Subdomain | Target |
|-----------|--------|
| `pihole.paccoco.com` | `http://10.5.1.6:8953` (primary) |
| `pihole2.paccoco.com` | `http://10.5.1.5:8954` (Serenity) |
| `pihole2.paccoco.com` | `http://10.5.1.16:8954` (N.O.M.A.D.) |
Enable Pangolin auth — Pi-hole admin should not be publicly accessible.
@@ -515,7 +517,7 @@ Enable Pangolin auth — Pi-hole admin should not be publicly accessible.
|------|------|------|--------|
| PD | `/mnt/tank/docker/appdata/pihole-primary` | tank | Low write frequency |
| PD | `/mnt/tank/docker/appdata/unbound-primary` | tank | Config + root hints only |
| Serenity | `/mnt/user/appdata/pihole-secondary` | Unraid array | Low write frequency |
| N.O.M.A.D. | `/mnt/hdd-2/docker/appdata/pihole-nomad` | Local HDD | Docker-managed local appdata |
| RPi4 | `~/pihole/` | SD card / SSD | Dedicated Pi, no other concerns |
---

2
docs/planning/TODO.md
View File

@@ -5,7 +5,7 @@
- [x] Regenerate N.O.M.A.D. Newt secret (was exposed in chat) — completed 2026-05-15
## Infrastructure
- [ ] Deploy Pi-hole 3-node HA cluster (PD + Serenity + RPi4) — see docs/planning/DEPLOY_PIHOLE.md
- [ ] Deploy Pi-hole 3-node HA cluster (PD + N.O.M.A.D. + RPi4) — see docs/planning/DEPLOY_PIHOLE.md
- PD primary stack scaffolded repo-side under `pihole/` on 2026-05-15
- RPi4 IP still TBD — fill in before deploying
- [x] Deploy Kima-Hub — completed 2026-05-06; docs/planning/DEPLOY_KIMA_HUB.md now serves as deployment/repair reference