# NOMAD Pi-hole / Unbound / staged Keepalived Replica

- **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole/nomad`
- **Suggested live stack path:** `/opt/pihole-nomad`
- **Node role:** NOMAD Pi-hole replica on Servers VLAN
- **Staged future VIP target:** `10.5.30.53/24`
- **LAN interface:** `enp5s0`
- **NOMAD LAN IP:** `10.5.30.7`

Current state:

- `pihole-nomad` and `unbound-pihole-nomad` stay up normally on NOMAD.
- `keepalived-pihole-nomad` is intentionally disabled by default after NOMAD moved from Trusted to Servers VLAN.
- Enable HA later with `COMPOSE_PROFILES=ha` only after a same-subnet peer and VIP design are ready.

Bring-up:

```bash
cd /opt/pihole-nomad
cp .env.example .env
bash bin/prepare_nomad.sh --up
```

Host note:

- If `systemd-resolved` is using the local DNS stub on port 53, disable the stub listener on NOMAD before trusting Pi-hole for live DNS:

```bash
sudo mkdir -p /etc/systemd/resolved.conf.d
cat <<'EOF' | sudo tee /etc/systemd/resolved.conf.d/99-pihole.conf
[Resolve]
DNSStubListener=no
EOF
sudo systemctl restart systemd-resolved
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
```

Pi-hole on NOMAD is pinned to `enp5s0` with `FTLCONF_dns_interface=enp5s0` and `FTLCONF_dns_listeningMode=SINGLE` so it answers cleanly on the LAN IP without fighting Docker bridge noise.

Current live containers:
- `pihole-nomad`
- `unbound-pihole-nomad`

Staged but disabled-by-default HA container:
- `keepalived-pihole-nomad`

Current LAN admin URL:
- `http://10.5.30.7:8954/admin/`