fix(netinfra): commit Pi-hole hardening config previously missing from repo

Commit 33b5c76 claimed to harden Pi-hole on both DNS nodes but only
modified markdown — the working docker-compose.yml, gravity-validate.sh,
healthcheck, and autoheal config were never written to the repo, leaving
the DNS hardening unreproducible from version control.

This commits the live, verified-working config from the boxes into
netinfra/pihole/:
- docker-compose.yml (shm_size 1024M root-cause fix, healthcheck, autoheal)
- gravity-validate.sh (pre-start SQLite header check, auto-quarantine corrupt DB)
- .env.example (web UI password templated; real .env gitignored)

Defends against the gravity.db / /dev/shm corruption production outage.
The live password is templated as ${PIHOLE_WEB_PASSWORD} so no secret
enters git.

[#376]

This commit is contained in:

mrcharles

2026-08-06 12:37:46 -05:00

parent 6c58671d15

commit 30ddb37b34

7 changed files with 130 additions and 2 deletions

									
										netinfra/pihole/.env.example
									
		+3
		
												View File
												
				@@ -0,0 +1,3 @@

				# Pi-hole web UI password. NEVER commit the real .env — only this template.

				# Copy to .env and set the value before `docker compose up -d`.

				PIHOLE_WEB_PASSWORD=changeme