feat: wire Pi-hole to forward knel.net to local Technitium + document setup
Add a shared Docker network (dnsnet, 10.53.0.0/24) connecting Pi-hole and
Technitium containers so Pi-hole can conditionally forward knel.net and
Tailscale-reverse queries to the local authoritative Technitium instance
(10.53.0.53) instead of netboot's upstream 192.168.3.16. Also adds
end-to-end documentation for both the reference node (pfv-netboot) and
the replicated nodes (pfv-netinfra-01/02).
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
This commit is contained in:
+57
-17
@@ -60,6 +60,10 @@ sudo docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}' 2>&1
|
||||
echo
|
||||
echo "### Pi-hole DNS (dig @127.0.0.1:53 pi.hole) ###"
|
||||
dig +time=3 +tries=1 +short @127.0.0.1 -p 53 pi.hole 2>&1
|
||||
echo "### Pi-hole -> Technitium (dig @53 knel.net SOA) ###"
|
||||
dig +time=3 +tries=1 +short @127.0.0.1 -p 53 knel.net SOA 2>&1
|
||||
echo "### Pi-hole -> Technitium (dig @53 pfv-netboot.knel.net A) ###"
|
||||
dig +time=3 +tries=1 +short @127.0.0.1 -p 53 pfv-netboot.knel.net A 2>&1
|
||||
echo "### Pi-hole web (curl :10002) ###"
|
||||
curl -sk -o /dev/null -w 'http=%{http_code}\n' http://127.0.0.1:10002/admin/ 2>&1
|
||||
echo
|
||||
@@ -68,10 +72,18 @@ dig +time=3 +tries=1 @127.0.0.1 -p 5300 knel.net SOA +short 2>&1
|
||||
echo "### Technitium web (curl :5380) ###"
|
||||
curl -sk -o /dev/null -w 'http=%{http_code}\n' http://127.0.0.1:5380/ 2>&1
|
||||
echo
|
||||
echo "### NTP on tailscale IP (ntpdig -p 1) ###"
|
||||
timeout 5 ntpdig -t1 -c1 -p1 $tsip 2>&1 || echo "(ntpdig not available or no response)"
|
||||
echo "### chrony container sources ###"
|
||||
sudo docker exec tsys-ntp chronyc -n sources 2>&1 | head -8
|
||||
echo "### NTP service ###"
|
||||
HOST_NTP=""
|
||||
for u in ntpsec ntp chrony openntpd; do
|
||||
systemctl is-active --quiet "\$u" 2>/dev/null && { HOST_NTP="\$u"; break; }
|
||||
done
|
||||
echo "host daemon: \${HOST_NTP:-none}"
|
||||
if [ -n "\$HOST_NTP" ]; then
|
||||
ntpq -c "rv 0 leap,stratum,offset" 2>&1 | head -3
|
||||
else
|
||||
echo "(no host NTP; chrony container:)"
|
||||
sudo docker exec tsys-ntp chronyc -n tracking 2>&1 | head -6
|
||||
fi
|
||||
EOF
|
||||
}
|
||||
|
||||
@@ -112,6 +124,12 @@ services:
|
||||
cap_add:
|
||||
- SYS_NICE
|
||||
restart: always
|
||||
networks:
|
||||
- default
|
||||
- dnsnet
|
||||
networks:
|
||||
dnsnet:
|
||||
external: true
|
||||
YAML
|
||||
|
||||
on_node "$node" "cat > $SVC_ROOT/ntp/docker-compose.yml" <<YAML
|
||||
@@ -139,6 +157,13 @@ services:
|
||||
volumes:
|
||||
- './config:/etc/dns'
|
||||
restart: always
|
||||
networks:
|
||||
default:
|
||||
dnsnet:
|
||||
ipv4_address: 10.53.0.53
|
||||
networks:
|
||||
dnsnet:
|
||||
external: true
|
||||
YAML
|
||||
|
||||
# ---- 3. Relay Pi-hole config from netboot -> target ---------------------
|
||||
@@ -167,8 +192,8 @@ YAML
|
||||
| on_node "$node" "sudo tar -xf - -C $SVC_ROOT/technitium && sudo mv $SVC_ROOT/technitium/_data $SVC_ROOT/technitium/config"
|
||||
fi
|
||||
|
||||
# ---- 5. Adapt copied config: Pi-hole interface name ---------------------
|
||||
log "$node: adapt Pi-hole pihole.toml interface name to actual iface"
|
||||
# ---- 5. Adapt copied config: interface + repoint knel.net to local Technitium
|
||||
log "$node: adapt Pi-hole pihole.toml (interface + revServer -> local Technitium)"
|
||||
on_node "$node" "bash -s" <<'EOF'
|
||||
set -e
|
||||
IFACE=$(ip -o -4 route show to default 2>/dev/null | awk '{print $5; exit}')
|
||||
@@ -177,12 +202,24 @@ TOML=/home/localuser/services/pihole/etc-pihole/pihole.toml
|
||||
if sudo test -f "$TOML"; then
|
||||
sudo sed -i "s|^ interface = .*| interface = \"$IFACE\" ### ADAPTED from eth0 on clone|" "$TOML"
|
||||
echo "set interface=$IFACE"
|
||||
# Repoint knel.net conditional forward from netboot's upstream (192.168.3.16)
|
||||
# to the LOCAL Technitium container at its fixed dnsnet IP 10.53.0.53.
|
||||
# Subnet 100.64.0.0/10 = Tailscale CGNAT range (covers all Tailscale reverse zones).
|
||||
if sudo grep -q 'revServers' "$TOML"; then
|
||||
sudo sed -i 's|"true,[0-9./]*,192\.168\.3\.16,knel\.net"|"true,100.64.0.0/10,10.53.0.53,knel.net"|' "$TOML"
|
||||
echo "revServer repointed to 10.53.0.53 (local Technitium)"
|
||||
else
|
||||
echo "(revServers not found; FTL will use defaults)"
|
||||
fi
|
||||
else
|
||||
echo "(pihole.toml not present; FTL will create it on first run)"
|
||||
fi
|
||||
# Strip netboot-specific primary upstream 192.168.3.16? -> keep, it is reachable on LAN.
|
||||
EOF
|
||||
|
||||
# ---- 5b. Create shared Docker network for Pi-hole <-> Technitium ----------
|
||||
log "$node: create dnsnet shared Docker network (10.53.0.0/24)"
|
||||
on_node "$node" "sudo docker network create --subnet 10.53.0.0/24 dnsnet 2>/dev/null || true"
|
||||
|
||||
# ---- 6. Pull images -----------------------------------------------------
|
||||
log "$node: docker compose pull (pihole, ntp, technitium)"
|
||||
on_node "$node" "bash -s" <<EOF
|
||||
@@ -203,20 +240,23 @@ EOF
|
||||
# there does not pre-bind the specific tailscale-IP socket. On these targets
|
||||
# ntpsec DOES bind the tailscale IP, so the container cannot claim it and is
|
||||
# redundant anyway. We therefore keep the host ntpsec as the NTP service.
|
||||
log "$node: NTP -- check whether host already serves UDP/123"
|
||||
log "$node: NTP -- detect host NTP service"
|
||||
on_node "$node" "bash -s" <<'EOF'
|
||||
set +e
|
||||
HOST_NTP=$(sudo ss -lun 2>/dev/null | awk '$5 ~ /:123$/ {print}' | head -1)
|
||||
HOST_NTP=""
|
||||
for u in ntpsec ntp chrony openntpd; do
|
||||
if systemctl is-active --quiet "$u" 2>/dev/null; then HOST_NTP="$u"; break; fi
|
||||
done
|
||||
if [ -n "$HOST_NTP" ]; then
|
||||
echo "Host already serves UDP/123 ($HOST_NTP); host daemon:"
|
||||
for u in ntpsec ntp chrony openntpd systemd-timesyncd; do
|
||||
systemctl is-active "$u" 2>/dev/null | grep -q active && echo " -> $u active"
|
||||
done
|
||||
echo "Skipping chrony container (host NTP provides the service)."
|
||||
echo "Removing any stale tsys-ntp container..."
|
||||
sudo docker rm -f tsys-ntp 2>/dev/null || true
|
||||
echo "Host NTP daemon '$HOST_NTP' is active -- it serves NTP on all local"
|
||||
echo "addresses (incl. the Tailscale IP). This is the same daemon family as"
|
||||
echo "netboot's bare-metal ntpsec; the netboot chrony container is redundant"
|
||||
echo "here and CANNOT bind the Tailscale IP (the host daemon already owns it)."
|
||||
echo "-> Keeping host NTP. Removing any stale chrony container (tsys-ntp)."
|
||||
sudo docker rm -f tsys-ntp 2>/dev/null && echo " (removed tsys-ntp)" || echo " (no tsys-ntp to remove)"
|
||||
echo " host peers:"; ntpq -pn 2>/dev/null | head -12 || true
|
||||
else
|
||||
echo "Nothing serving UDP/123; starting chrony container."
|
||||
echo "No host NTP daemon active; starting chrony container."
|
||||
sudo docker compose -f /home/localuser/services/ntp/docker-compose.yml up -d
|
||||
fi
|
||||
EOF
|
||||
|
||||
Reference in New Issue
Block a user