70 lines
2.7 KiB
Markdown
70 lines
2.7 KiB
Markdown
# PD Pi-hole / Unbound / Keepalived Stack
|
|
|
|
Primary-node stack for the Pi-hole HA plan.
|
|
|
|
- **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole`
|
|
- **Live PD stack path:** `/mnt/docker-ssd/docker/compose/pihole`
|
|
- **Node role:** PD primary / MASTER
|
|
- **VIP target:** `10.5.1.53/24`
|
|
|
|
This stack intentionally covers the **PD primary** plus PD-hosted sync:
|
|
- Pi-hole
|
|
- Unbound
|
|
- Keepalived
|
|
- Nebula Sync
|
|
|
|
NOMAD replica deployment is now documented and live; only the RPi4 replica remains future work.
|
|
|
|
## Files
|
|
|
|
- `docker-compose.yaml` — primary-node stack
|
|
- `.env.example` — required variables
|
|
- `unbound.conf` — shared recursive resolver config
|
|
- `keepalived.conf.template` — rendered into `keepalived.conf`
|
|
- `bin/render_keepalived_conf.py` — generates `keepalived.conf` from `.env`
|
|
- `bin/prepare_pd.sh` — creates appdata dirs, downloads root hints, renders config, validates compose, optional `--up`
|
|
|
|
## First-time setup on PD
|
|
|
|
```bash
|
|
cd /mnt/docker-ssd/docker/compose/pihole
|
|
cp .env.example .env
|
|
nano .env # set real passwords + verify LAN_INTERFACE
|
|
/usr/bin/bash bin/prepare_pd.sh
|
|
```
|
|
|
|
If that validates cleanly, bring it up:
|
|
|
|
```bash
|
|
/usr/bin/bash bin/prepare_pd.sh --up
|
|
```
|
|
|
|
## Current live topology
|
|
|
|
- **PD primary**
|
|
- service root: `/mnt/docker-ssd/docker/compose/pihole`
|
|
- Pi-hole container: `pihole-primary`
|
|
- Unbound container: `unbound-pihole-primary`
|
|
- Keepalived container: `keepalived-pihole-primary`
|
|
- Nebula Sync container: `nebula-sync`
|
|
- LAN admin URL: `http://10.5.1.6:8953/admin/`
|
|
- **NOMAD backup**
|
|
- service root: `/opt/pihole-nomad`
|
|
- Pi-hole container: `pihole-nomad`
|
|
- Unbound container: `unbound-pihole-nomad`
|
|
- Keepalived container: `keepalived-pihole-nomad`
|
|
- LAN admin URL: `http://10.5.1.16:8954/admin/`
|
|
- **VIP for client DNS:** `10.5.1.53`
|
|
- **Shared Pi-hole admin password:** stored in the local `.env` files; Nebula and both nodes use the same current value.
|
|
|
|
## Important notes
|
|
|
|
- `KEEPALIVED_PASSWORD` must be **8 chars or fewer** because VRRP PASS auth is annoying and old.
|
|
- Verify `LAN_INTERFACE` on PD before deployment (`ip link show`).
|
|
- `FTLCONF_dns_listeningMode=LOCAL` is set because TrueNAS binds loopback on port 53.
|
|
- Pi-hole NTP is explicitly disabled here because PD host `chronyd` already owns UDP 123.
|
|
- Nebula Sync runs on PD and uses `NEBULA_SYNC_PRIMARY` / `NEBULA_SYNC_REPLICAS` from `.env`.
|
|
- Current replica target is NOMAD at `http://10.5.1.16:8954`.
|
|
- Nebula Sync is intentionally set to selective mode with gravity sync toggles enabled for groups, adlists, and domain lists so replica-specific runtime/network settings are not clobbered.
|
|
- `keepalived.conf` is generated and should stay local/untracked.
|