diff --git a/AGENTS.md b/AGENTS.md index 8cc97dd..f6f5ea4 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -112,9 +112,13 @@ use `deploy-check.sh` / `deploy-tuning.sh` wrapper patterns instead. `/etc/network/interfaces` with awk (sed fails on tab-indented stanza). 4. Always shellcheck before shipping: `docker run --rm -v "$PWD:/mnt" koalaman/shellcheck:stable --severity=style scripts/*.sh` -5. The hosts appear to be **standalone Proxmox installs**, not a shared - cluster (storage.cfg differs per host). VMs are pinned to their host. - Moving VMs requires manual disk migration, not live migration. +5. The hosts are **standalone Proxmox installs** (not a pvecm cluster), but + managed collectively via **Proxmox Datacenter Manager (PDM)**. PDM supports + VM migration between nodes via the UI. NFS exports are visible to all nodes; + local storage migration is done through PDM's "Storage Migrate" function. +6. **Storage philosophy:** NVMe/SSD is for k8s worker scratch + ultix-streaming + (developer workstation for "cluster of 1" pre-prod jobs). Spinning rust + hosts all infrastructure VMs (UCS, netinfra, LibreNMS, SIEM). ## Friday walkthrough (user action) diff --git a/K8S.md b/K8S.md index 2a8033e..6dc15e3 100644 --- a/K8S.md +++ b/K8S.md @@ -328,16 +328,20 @@ spec: ### 6.3 NFS-SSD tier (D3 and T5-SSD -- both on tsys5 after Friday) -The SSD NFS exports are a middle tier. **Both consolidated on tsys5** after -the Friday D3 relocation: -- **D3 (tsys5 SAS, 445 GB free):** CI/CD artifacts, container image cache, - UCS/LDAP. Currently 99% empty. Fastest NFS tier after the move off USB. -- **T5-SSD (tsys5 SAS, 140 GB free):** SIEM databases, monitoring data. - Currently 35% used by ultix-streaming. +**Storage philosophy (user directive): NVMe/SSD is EXCLUSIVELY for k8s worker +scratch space, with the exception of ultix-streaming which stays on T5-SSD. +Spinning rust hosts all other infrastructure VMs** (UCS, netinfra, LibreNMS, +SIEM, etc.). + +The SSD NFS exports: +- **D3 (tsys5 SAS, 445 GB free):** k8s scratch exclusively (etcd, container + cache, ephemeral volumes). Currently 99% empty. +- **T5-SSD (tsys5 SAS, 140 GB free after ultix-streaming):** ultix-streaming + occupies 83 GB. Remaining 140 GB available for k8s use. **tsys5 is the fast-tier hub:** NVMe (local) + D3 SSD + T5-SSD all on one host. -This simplifies the StorageClass design -- latency-sensitive PVCs target -tsys5 exports, bulk PVCs target either server. +This simplifies the StorageClass design -- latency-sensitive k8s PVCs target +tsys5 SSD exports, bulk PVCs target either server. ### 6.4 NFS data distribution across storage servers @@ -413,6 +417,13 @@ if the data is already cached in the page cache. ## 8. Migration Plan +**Key enabler:** The hosts are standalone Proxmox installs, but **Proxmox +Datacenter Manager (PDM)** manages them collectively and supports VM migration +between nodes. Storage migration can be done via the PDM/Proxmox UI rather +than manual disk copies -- the destination node just needs access to the target +storage (which all nodes have for NFS exports, and local storage can be +migrated through the UI's "Storage Migrate" function). + ### 8.1 Phase 1: Friday (after hardware work) After tsys5 cable + NVMe and tsys4 NIC + RAM: @@ -451,9 +462,9 @@ Plan for a maintenance window with the k8s cluster briefly down. ### 8.5 Phase 5: Critical VM relocation -1. Move netinfra-02 (VM 904) from D2 to S3. -2. Move ucs-01 (VM 108) from D2 to D3 (SSD). -3. Move ucs-02 (VM 902) from D5 to tsys9 local-lvm (SSD). +1. Move netinfra-02 (VM 904) from D2 to S3 (tsys5 HDD). +2. Move ucs-02 (VM 902) from D5 to S2 (tsys5 HDD). +3. (No change to T5-SSD -- ultix-streaming stays.) --- diff --git a/PROJECT.md b/PROJECT.md index f5cc888..a972981 100644 --- a/PROJECT.md +++ b/PROJECT.md @@ -187,7 +187,7 @@ NFS-over-HDD and unsuitable for wnode boot disks. |------|-------|------------|----------| | **NVMe** | tsys3 (Samsung PM961), tsys5 (Friday addition), **tsys2 (Samsung 960 PRO 512GB)** | 2000-3500 MB/s | HPC scratch, ETL staging, container runtime, wnode boot, etcd | | **Local SSD** | tsys9 (PNY CS900, 136 GB), **tsys2 (Samsung 850 EVO 1TB)** | 500 MB/s | wnode boot disk, etcd | -| **NFS-SSD** | tsys5 D3 (SK hynix, **SAS post-Friday**), tsys5 T5-SSD (Samsung) | 200-400 MB/s over NFS | UCS/LDAP, latency-sensitive VMs | +| **NFS-SSD** | tsys5 D3 (SK hynix, **SAS post-Friday**), tsys5 T5-SSD (Samsung) | 200-400 MB/s over NFS | **k8s worker scratch only** (etcd, container cache, ephemeral volumes) | | **NFS-HDD** | tsys4 D2/D5, tsys5 S1-S4 | 80-120 MB/s over NFS | Bulk data, large disks, non-critical VMs, **wnode boot on tsys6/7** | | **Local SATA HDD** | tsys1 local-lvm | 100-150 MB/s | Host OS only | | **USB 2.0 HDD** | tsys6/7 local-lvm (WD My Passport) | **~30-35 MB/s** | **NOTHING -- slower than NFS, do not use for VMs** | @@ -679,19 +679,22 @@ This maps to two k8s StorageClasses: - `local-storage`: bound to the wnode's boot/local disk (fast, ephemeral) - `nfs-bulk`: bound to NFS exports (slow, persistent, large capacity) -### 10.4 HIGH: Use D3 SSD and T5-SSD for latency-sensitive VMs +### 10.4 HIGH: Dedicate D3 SSD exclusively to k8s scratch -Currently wasted: -- **D3 (tsys4 SK hynix SSD, 445 GB free, 0% used)** -- nobody using it -- **T5-SSD (tsys5 Samsung 860 PRO, 140 GB free)** -- only ultix-streaming +**Storage philosophy (user directive): NVMe/SSD is for k8s worker scratch +space and ultix-streaming (developer workstation running "cluster of 1" +pre-production jobs). Spinning rust hosts all other infrastructure VMs** +(UCS, netinfra, LibreNMS, SIEM, etc.). -Recommended uses for D3 (after moving ucs-01 there, 32 GB): -- Remaining D3 space (413 GB): sectestbed-k8s-cnode, sectestbed-k8s-wnode - (move from local-nonprod HDD to NFS-SSD for faster test runs) +SSD allocation after Friday: +- **D3 (tsys5 SAS, 445 GB free, 0% used)** -- dedicated to k8s scratch via + the `nfs-ssd` StorageClass (etcd, container cache, ephemeral volumes). +- **T5-SSD (tsys5 SAS, 140 GB free)** -- ultix-streaming (VM 5111) stays here + (developer workstation, runs single-node test jobs before k8s). Remaining + 140 GB available for k8s. -Recommended uses for T5-SSD (after moving nothing new, ultix-streaming uses 83 GB): -- Remaining T5-SSD space (140 GB): tsys-siem (VM 901, 132 GB disk currently - on D2 HDD) would benefit from SSD for SIEM database writes. +**Deep-dive on exact k8s scratch allocation is deferred to the next session** +(K8S.md) once we know the k8s distribution, job scheduler, and workload mix. ### 10.5 MEDIUM: Restart wnode-tsys6 diff --git a/TODO.md b/TODO.md index 2ad1ca0..2a5eba3 100644 --- a/TODO.md +++ b/TODO.md @@ -217,12 +217,11 @@ servers for redundancy. | ucs-01 (108) | D2 (tsys4 HDD) | **D2 (tsys4 HDD) -- no change** | Already correct | | ucs-02 (902) | D5 (tsys4 HDD) | **S2 (tsys5 HDD)** | Move for cross-server redundancy | -**To migrate ucs-02 to S2:** -1. Shut down VM 902 on tsys9 -2. Copy disk: `cp /mnt/pve/D5/902/vm-902-disk-0.qcow2 /mnt/pve/S2/902/` -3. Update VM 902 config: change `scsi0` from `D5:902/...` to `S2:902/...` -4. Start VM 902, verify it boots and LDAP/AD services are healthy -5. Remove old disk from D5 +**To migrate ucs-02 to S2 (use PDM/Proxmox UI):** +1. In Proxmox Datacenter or the node UI, select VM 902 on tsys9 +2. Use "Migrate" or "Storage Migrate" to move the disk from D5 to S2 + (both are NFS exports visible to tsys9, so this is a storage-only migration) +3. Verify VM 902 boots and LDAP/AD services are healthy after migration Note: both VMs are currently on tsys4 HDD, which is fine for UCS. Only ucs-02 needs to move -- it should be on a different storage server than diff --git a/netinfra/audit-netboot.sh b/netinfra/audit-netboot.sh new file mode 100755 index 0000000..0640e01 --- /dev/null +++ b/netinfra/audit-netboot.sh @@ -0,0 +1,297 @@ +#!/usr/bin/env bash +# ============================================================================= +# audit-netboot.sh +# ----------------------------------------------------------------------------- +# READ-ONLY audit of the reference node "pfv-netboot". +# +# Purpose: gather enough information to replicate its Pi-hole, Technitium DNS, +# and NTP services onto pfv-netinfra-01 and pfv-netinfra-02. +# +# Guarantees: +# * NO writes, NO installs, NO service restarts, NO network changes. +# * Every command below is read-only (status, cat, ls, ss, ps, sqlite3 SELECT). +# +# Intended to be run as the "localuser" account on pfv-netboot: +# +# ssh localuser@pfv-netboot 'bash -s' < audit-netboot.sh > netboot-audit.txt +# +# or, if sudo is needed for a few reads, the script will try `sudo -n` for +# specific files that are normally root-readable only. It will NEVER use sudo +# to write or modify anything. +# ============================================================================= + +set -u +AUDIT_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" + +# Helper: print a clearly delimited section header. +section() { + printf '\n========================================================================\n' + printf 'SECTION: %s\n' "$1" + printf '========================================================================\n' +} + +# Helper: read a file with sudo if needed, silently skip if missing. +read_file() { + local path="$1" + if [ -r "$path" ]; then + printf '--- %s (uid-readable) ---\n' "$path" + cat "$path" 2>/dev/null + elif sudo -n true 2>/dev/null; then + if sudo -n test -e "$path"; then + printf '--- %s (via sudo -n) ---\n' "$path" + sudo -n cat "$path" 2>/dev/null + else + printf '--- %s : NOT FOUND ---\n' "$path" + fi + else + printf '--- %s : NOT READABLE (no passwordless sudo) ---\n' "$path" + fi + printf '\n' +} + +list_dir() { + local path="$1" + printf '--- ls -la %s ---\n' "$path" + ls -la "$path" 2>/dev/null || sudo -n ls -la "$path" 2>/dev/null || printf '(cannot list %s)\n' "$path" + printf '\n' +} + +printf '##### AUDIT START %s #####\n' "$AUDIT_DATE" +printf 'Audit host: %s\n' "$(hostname -f 2>/dev/null || hostname)" +printf 'Audit user: %s\n' "$(id -un 2>/dev/null)" +printf 'Script: audit-netboot.sh (READ-ONLY)\n' + +# ----------------------------------------------------------------------------- +# 1. System basics +# ----------------------------------------------------------------------------- +section "1. SYSTEM BASICS" +echo "-- uname --"; uname -a +echo "-- /etc/os-release --"; cat /etc/os-release 2>/dev/null +echo "-- uptime --"; uptime +echo "-- timezone --"; timedatectl 2>/dev/null || cat /etc/timezone 2>/dev/null || date +echo "-- arch --"; dpkg --print-architecture 2>/dev/null || uname -m +echo "-- memory --"; free -h 2>/dev/null +echo "-- disk --"; df -h / 2>/dev/null +echo "-- cpu count --"; nproc 2>/dev/null + +# ----------------------------------------------------------------------------- +# 2. Network configuration +# ----------------------------------------------------------------------------- +section "2. NETWORK" +echo "-- hostname --"; hostname; hostname -f 2>/dev/null; hostname -I 2>/dev/null +echo "-- ip addr --"; ip -br addr 2>/dev/null; echo; ip addr 2>/dev/null +echo "-- default route --"; ip route 2>/dev/null +echo "-- /etc/resolv.conf --"; cat /etc/resolv.conf 2>/dev/null +echo "-- /etc/hosts --"; cat /etc/hosts 2>/dev/null +echo "-- listening TCP/UDP sockets --" +ss -tlnup 2>/dev/null || sudo -n ss -tlnup 2>/dev/null +echo "-- /etc/network/interfaces --"; cat /etc/network/interfaces 2>/dev/null +echo "-- netplan --"; ls -la /etc/netplan/ 2>/dev/null; for f in /etc/netplan/*.yaml; do [ -e "$f" ] && { echo "--- $f ---"; cat "$f"; }; done 2>/dev/null +echo "-- systemd-networkd --"; ls -la /etc/systemd/network/ 2>/dev/null; networkctl status 2>/dev/null | head -40 + +# ----------------------------------------------------------------------------- +# 3. DNS / DHCP / NTP related systemd units +# ----------------------------------------------------------------------------- +section "3. RELEVANT SYSTEMD UNITS" +echo "-- all units matching dns|pihole|dnsmasq|technitium|ftl|ntp|chrony|timesync --" +systemctl list-units --type=service --all --no-pager 2>/dev/null \ + | grep -Ei 'pihole|dnsmasq|ftl|technitium|dns|ntp|chrony|timesync|resolv|resolved' || true +echo "-- unit files (enabled state) --" +systemctl list-unit-files --no-pager 2>/dev/null \ + | grep -Ei 'pihole|dnsmasq|ftl|technitium|dns|ntp|chrony|timesync|resolv|resolved' || true +echo "-- installed packages of interest --" +dpkg -l 2>/dev/null | grep -Ei 'pihole|dnsmasq|ftl|technitium|ntp|chrony|timesync|unbound|resolved|resolvconf' || true + +# ----------------------------------------------------------------------------- +# 4. NTP service details +# ----------------------------------------------------------------------------- +section "4. NTP" +echo "-- chrony --" +systemctl status chrony --no-pager 2>/dev/null | head -15 || echo "(no chrony unit)" +read_file /etc/chrony/chrony.conf +echo "-- chronyc sources/stats (if available) --" +chronyc -n sources 2>/dev/null || sudo -n chronyc -n sources 2>/dev/null || true +chronyc -n tracking 2>/dev/null || sudo -n chronyc -n tracking 2>/dev/null || true + +echo "-- ntpsec / ntp classic --" +systemctl status ntp --no-pager 2>/dev/null | head -15 || echo "(no ntp unit)" +systemctl status ntpsec --no-pager 2>/dev/null | head -15 || true +read_file /etc/ntp.conf +read_file /etc/ntpsec/ntp.conf + +echo "-- systemd-timesyncd --" +systemctl status systemd-timesyncd --no-pager 2>/dev/null | head -15 || echo "(no timesyncd)" +read_file /etc/systemd/timesyncd.conf + +echo "-- openntpd --" +systemctl status openntpd --no-pager 2>/dev/null | head -15 || true +read_file /etc/openntpd/ntpd.conf + +# ----------------------------------------------------------------------------- +# 5. Docker (Pi-hole and/or Technitium may be containerized) +# ----------------------------------------------------------------------------- +section "5. DOCKER" +if command -v docker >/dev/null 2>&1; then + echo "-- docker version --"; docker version 2>/dev/null || sudo -n docker version 2>/dev/null || true + echo "-- containers (running) --"; docker ps 2>/dev/null || sudo -n docker ps 2>/dev/null || true + echo "-- containers (all) --"; docker ps -a 2>/dev/null || sudo -n docker ps -a 2>/dev/null || true + echo "-- images --"; docker images 2>/dev/null || sudo -n docker images 2>/dev/null || true + echo "-- volumes --"; docker volume ls 2>/dev/null || sudo -n docker volume ls 2>/dev/null || true + echo "-- networks --"; docker network ls 2>/dev/null || sudo -n docker network ls 2>/dev/null || true +else + echo "(docker not installed / not on PATH)" +fi +echo "-- compose files in common locations --" +for d in /etc/docker-compose /opt/docker-compose /root/docker-compose /home/localuser/docker-compose /srv/docker-compose /opt/pihole /opt/technitium /opt; do + if sudo -n test -d "$d" 2>/dev/null || [ -d "$d" ]; then + echo "### $d ###" + sudo -n ls -la "$d" 2>/dev/null || ls -la "$d" 2>/dev/null || true + for f in docker-compose.yml docker-compose.yaml compose.yml compose.yaml; do + if sudo -n test -f "$d/$f" 2>/dev/null; then + read_file "$d/$f" + elif [ -f "$d/$f" ]; then + read_file "$d/$f" + fi + done + fi +done + +# ----------------------------------------------------------------------------- +# 6. Pi-hole +# ----------------------------------------------------------------------------- +section "6. PI-HOLE" +if command -v pihole >/dev/null 2>&1; then + echo "-- pihole version --"; pihole -v 2>/dev/null || sudo -n pihole -v 2>/dev/null || true + echo "-- pihole status --"; pihole status 2>/dev/null || sudo -n pihole status 2>/dev/null || true +else + echo "(pihole command not on PATH)" +fi + +echo "-- /etc/pihole listing --" +list_dir /etc/pihole + +# Key Pi-hole config files +for f in \ + /etc/pihole/setupVars.conf \ + /etc/pihole/pihole-FTL.conf \ + /etc/pihole/adlists.list \ + /etc/pihole/whitelist.txt \ + /etc/pihole/blacklist.txt \ + /etc/pihole/regex.list \ + /etc/pihole/custom.list \ + /etc/pihole/local.list \ + /etc/pihole/hostnameMappings.txt \ + /etc/pihole/dhcp.leases \ + /etc/pihole/static_ip.conf \ + /etc/pihole/GitHubVersions \ + /etc/pihole/macvendor.db ; do + read_file "$f" +done + +echo "-- /etc/pihole/*.conf (all) --" +for f in /etc/pihole/*.conf; do [ -e "$f" ] && read_file "$f"; done 2>/dev/null + +echo "-- /etc/dnsmasq.d listing --" +list_dir /etc/dnsmasq.d +for f in /etc/dnsmasq.d/*; do [ -e "$f" ] && read_file "$f"; done 2>/dev/null + +echo "-- /etc/dnsmasq.conf (if present) --" +read_file /etc/dnsmasq.conf + +echo "-- gravity.db schema + row counts (Pi-hole v5+) --" +GRAVITY="" +for g in /etc/pihole/gravity.db /etc/pihole/gravity.db.*; do + if [ -e "$g" ]; then GRAVITY="$g"; break; fi +done +if [ -n "${GRAVITY:-}" ]; then + echo "gravity.db = $GRAVITY" + if command -v sqlite3 >/dev/null 2>&1; then + sqlite3 -readonly "$GRAVITY" ".tables" 2>/dev/null || sudo -n sqlite3 -readonly "$GRAVITY" ".tables" 2>/dev/null || true + for tbl in adlist adlist_by_group domainlist domainlist_by_group client client_by_group group info; do + cnt=$(sqlite3 -readonly "$GRAVITY" "SELECT COUNT(*) FROM $tbl;" 2>/dev/null || sudo -n sqlite3 -readonly "$GRAVITY" "SELECT COUNT(*) FROM $tbl;" 2>/dev/null || echo "n/a") + printf 'gravity.%s count = %s\n' "$tbl" "$cnt" + done + echo "-- adlist entries (url, enabled, comment) --" + sqlite3 -readonly "$GRAVITY" "SELECT id,address,enabled,comment FROM adlist;" 2>/dev/null \ + || sudo -n sqlite3 -readonly "$GRAVITY" "SELECT id,address,enabled,comment FROM adlist;" 2>/dev/null || true + echo "-- domainlist sample (first 50) --" + sqlite3 -readonly "$GRAVITY" "SELECT id,type,domain,enabled,comment FROM domainlist LIMIT 50;" 2>/dev/null \ + || sudo -n sqlite3 -readonly "$GRAVITY" "SELECT id,type,domain,enabled,comment FROM domainlist LIMIT 50;" 2>/dev/null || true + echo "-- client list --" + sqlite3 -readonly "$GRAVITY" "SELECT id,ip,comment FROM client;" 2>/dev/null \ + || sudo -n sqlite3 -readonly "$GRAVITY" "SELECT id,ip,comment FROM client;" 2>/dev/null || true + echo "-- group list --" + sqlite3 -readonly "$GRAVITY" "SELECT id,name,enabled,comment FROM 'group';" 2>/dev/null \ + || sudo -n sqlite3 -readonly "$GRAVITY" "SELECT id,name,enabled,comment FROM 'group';" 2>/dev/null || true + echo "-- info table --" + sqlite3 -readonly "$GRAVITY" "SELECT * FROM info;" 2>/dev/null \ + || sudo -n sqlite3 -readonly "$GRAVITY" "SELECT * FROM info;" 2>/dev/null || true + else + echo "(sqlite3 not installed; gravity.db present at $GRAVITY)" + fi +else + echo "(no gravity.db found)" +fi + +echo "-- lighttpd / pihole web admin --" +systemctl status lighttpd --no-pager 2>/dev/null | head -15 || true +read_file /etc/lighttpd/lighttpd.conf +for f in /etc/lighttpd/conf-enabled/*; do [ -e "$f" ] && read_file "$f"; done 2>/dev/null + +echo "-- pihole-FTL service --" +systemctl status pihole-FTL --no-pager 2>/dev/null | head -20 || true + +# ----------------------------------------------------------------------------- +# 7. Technitium DNS +# ----------------------------------------------------------------------------- +section "7. TECHNITIUM DNS" +echo "-- technitium systemd unit --" +systemctl status technitium-dns --no-pager 2>/dev/null | head -20 || echo "(no technitium-dns unit)" +echo "-- any unit containing technitium --" +systemctl list-units --all --no-pager 2>/dev/null | grep -i technitium || true +echo "-- unit file path --" +sudo -n systemctl cat technitium-dns 2>/dev/null || systemctl cat technitium-dns 2>/dev/null || true + +# Technitium common install locations +for d in /etc/technitium /etc/technitium/dns /opt/technitium /opt/technitium/dns /var/lib/technitium /usr/local/technitium; do + echo "### checking $d ###" + if sudo -n test -d "$d" 2>/dev/null || [ -d "$d" ]; then + list_dir "$d" + # recurse one level for config files + for sub in "$d" "$d"/*; do + [ -e "$sub" ] || continue + if [ -f "$sub" ] && echo "$sub" | grep -Eq '\.(xml|json|conf|config|txt)$'; then + read_file "$sub" + fi + done + fi +done + +echo "-- technitium config.xml / dnsServer.conf (search) --" +sudo -n find /etc/technitium /opt/technitium /var/lib/technitium -maxdepth 4 \ + \( -name 'config.xml' -o -name '*.config' -o -name 'dnsServer.conf' -o -name 'blockList.txt' \) \ + -print 2>/dev/null || true + +# ----------------------------------------------------------------------------- +# 8. Firewall / SELinux / misc +# ----------------------------------------------------------------------------- +section "8. FIREWALL & MISC" +echo "-- nftables --"; sudo -n nft list ruleset 2>/dev/null | head -80 || true +echo "-- iptables --"; sudo -n iptables -S 2>/dev/null | head -40 || true +echo "-- ufw --"; sudo -n ufw status verbose 2>/dev/null || true +echo "-- firewalld --"; systemctl status firewalld --no-pager 2>/dev/null | head -8 || true +echo "-- selinux/apparmor --"; getenforce 2>/dev/null || echo "(SELinux not present)"; aa-status 2>/dev/null | head -5 || true + +# ----------------------------------------------------------------------------- +# 9. Cron / timers that maintain these services +# ----------------------------------------------------------------------------- +section "9. CRON & TIMERS" +echo "-- root crontab --"; sudo -n crontab -l 2>/dev/null || echo "(n/a)" +echo "-- localuser crontab --"; crontab -l 2>/dev/null || echo "(none)" +echo "-- /etc/cron.d --"; ls -la /etc/cron.d 2>/dev/null +for f in /etc/cron.d/*pihole* /etc/cron.d/*technitium* /etc/cron.d/*gravity*; do + [ -e "$f" ] && read_file "$f" +done 2>/dev/null +echo "-- pihole timer --"; systemctl list-timers --all --no-pager 2>/dev/null | grep -Ei 'pihole|gravity|technitium' || true + +printf '\n##### AUDIT END %s #####\n' "$AUDIT_DATE" diff --git a/netinfra/deep-audit-netboot.sh b/netinfra/deep-audit-netboot.sh new file mode 100755 index 0000000..44a2728 --- /dev/null +++ b/netinfra/deep-audit-netboot.sh @@ -0,0 +1,67 @@ +#!/usr/bin/env bash +# deep-audit-netboot.sh — READ-ONLY deep inspection. Uses `sudo` for docker/root files. +set -u +DG="sudo docker" + +hdr() { printf '\n=== %s ===\n' "$1"; } + +hdr "COMPOSE FILES: /root/pihole and /root/NTP" +for f in /root/pihole/docker-compose.yml /root/NTP/docker-compose.yml; do + printf '\n--- %s ---\n' "$f" + sudo cat "$f" 2>&1 +done + +hdr "DIR LAYOUT of compose project dirs" +sudo ls -la /root/pihole 2>&1 +sudo ls -la /root/NTP 2>&1 +sudo ls -la /root 2>&1 + +hdr "SEARCH entire FS for any technitium / dns compose files" +sudo find / -xdev -maxdepth 6 \( -iname 'docker-compose.y*ml' -o -iname 'compose.y*ml' \) -print 2>/dev/null \ + | grep -Ei 'dns|technitium|tsys' || true + +hdr "ALL CONTAINERS with compose labels" +$DG ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\tWDIR={{.Label "com.docker.compose.project.working_dir"}}\tCFG={{.Label "com.docker.compose.project.config_files"}}\tSVC={{.Label "com.docker.compose.service"}}' 2>&1 + +hdr "DOCKER INSPECT pihole + tsys-ntp (and any dns/technitium container)" +for c in $($DG ps -aq 2>/dev/null); do + nm=$($DG inspect --format '{{.Name}} | image={{.Config.Image}} | proj={{index .Config.Labels "com.docker.compose.project"}}' "$c" 2>/dev/null) + printf '\n###### %s ######\n' "$nm" + $DG inspect "$c" 2>&1 +done + +hdr "PI-HOLE internal config (sudo docker exec, READ-ONLY)" +echo "-- ls /etc/pihole --"; $DG exec pihole ls -la /etc/pihole 2>&1 || true +echo "-- ls /etc/dnsmasq.d --"; $DG exec pihole ls -la /etc/dnsmasq.d 2>&1 || true +for f in setupVars.conf pihole-FTL.conf adlists.list custom.list local.list regex.list dhcp.leases static_ip.conf; do + echo "--- /etc/pihole/$f ---"; $DG exec pihole cat "/etc/pihole/$f" 2>&1 || true +done +echo "-- /etc/dnsmasq.d/* --" +$DG exec pihole sh -c 'for f in /etc/dnsmasq.d/*; do echo "--- $f ---"; cat "$f"; done' 2>&1 || true +echo "-- pihole version --"; $DG exec pihole pihole -v 2>&1 || true +echo "-- gravity row counts --" +$DG exec pihole sh -c 'for t in adlist domainlist client "group" info; do printf "%s=" "$t"; sqlite3 /etc/pihole/gravity.db "SELECT COUNT(*) FROM $t;" 2>/dev/null; done' 2>&1 || true +echo "-- adlist addresses --" +$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT address,enabled,comment FROM adlist;" 2>&1 || true +echo "-- domainlist (allow+deny, first 60) --" +$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT type,domain,enabled,comment FROM domainlist LIMIT 60;" 2>&1 || true + +hdr "CHRONY/NTP container config (tsys-ntp)" +$DG exec tsys-ntp sh -c 'echo "--- chrony.conf ---"; cat /etc/chrony/chrony.conf 2>/dev/null || cat /etc/chrony.conf 2>/dev/null || echo none; echo "--- ls /etc ---"; ls -la /etc 2>/dev/null | head -30' 2>&1 || true +$DG exec tsys-ntp chronyc -n sources 2>&1 || true +$DG exec tsys-ntp chronyc -n tracking 2>&1 || true +echo "-- bare metal ntpsec.conf --"; sudo cat /etc/ntpsec/ntp.conf 2>&1 + +hdr "TECHNITIUM volumes" +for v in dns_tsys-dns-config dns_tyss-dns-config; do + mnt=$($DG volume inspect --format '{{.Mountpoint}}' "$v" 2>/dev/null) + printf '\n--- volume %s -> %s ---\n' "$v" "$mnt" + [ -n "$mnt" ] || continue + sudo find "$mnt" -maxdepth 4 -type f 2>/dev/null | head -80 + echo "-- config dir listing --" + sudo ls -laR "$mnt"/config 2>/dev/null | head -60 || sudo ls -laR "$mnt" 2>/dev/null | head -60 || true + echo "-- config.xml --" + sudo cat "$mnt"/config/config.xml 2>/dev/null | head -250 || true +done + +hdr "DONE" diff --git a/netinfra/netboot-audit.txt b/netinfra/netboot-audit.txt new file mode 100644 index 0000000..35c5126 --- /dev/null +++ b/netinfra/netboot-audit.txt @@ -0,0 +1,720 @@ +This system is the property of Known Element Enterprises LLC. + +Authorized uses only. All activity may be monitored and reported. + +All activities subject to monitoring/recording/review in real time and/or at a later time.##### AUDIT START 2026-07-28T02:41:34Z ##### +Audit host: pfv-netboot.knel.net +Audit user: localuser +Script: audit-netboot.sh (READ-ONLY) + +======================================================================== +SECTION: 1. SYSTEM BASICS +======================================================================== +-- uname -- +Linux pfv-netboot 6.1.0-44-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.164-1 (2026-03-09) x86_64 GNU/Linux +-- /etc/os-release -- +PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" +NAME="Debian GNU/Linux" +VERSION_ID="12" +VERSION="12 (bookworm)" +VERSION_CODENAME=bookworm +ID=debian +HOME_URL="https://www.debian.org/" +SUPPORT_URL="https://www.debian.org/support" +BUG_REPORT_URL="https://bugs.debian.org/" +-- uptime -- + 21:41:34 up 113 days, 15:32, 2 users, load average: 0.07, 0.07, 0.06 +-- timezone -- + Local time: Mon 2026-07-27 21:41:34 CDT + Universal time: Tue 2026-07-28 02:41:34 UTC + RTC time: Tue 2026-07-28 02:41:34 + Time zone: US/Central (CDT, -0500) +System clock synchronized: yes + NTP service: n/a + RTC in local TZ: no +-- arch -- +amd64 +-- memory -- + total used free shared buff/cache available +Mem: 1.9Gi 940Mi 66Mi 65Mi 1.1Gi 961Mi +Swap: 974Mi 315Mi 659Mi +-- disk -- +Filesystem Size Used Avail Use% Mounted on +/dev/sda1 491G 18G 448G 4% / +-- cpu count -- +2 + +======================================================================== +SECTION: 2. NETWORK +======================================================================== +-- hostname -- +pfv-netboot +pfv-netboot.knel.net +192.168.3.250 172.24.0.1 172.18.0.1 172.19.0.1 172.23.0.1 172.17.0.1 172.20.0.1 172.22.0.1 100.103.64.82 2600:1700:1d1:eb00:215:5dff:fe64:e81e fd7a:115c:a1e0::2901:4052 +-- ip addr -- +lo UNKNOWN 127.0.0.1/8 ::1/128 +eth0 UP 192.168.3.250/22 2600:1700:1d1:eb00:215:5dff:fe64:e81e/64 fe80::215:5dff:fe64:e81e/64 +eth1 UP +br-3d55385c5e7d UP 172.24.0.1/16 fe80::d883:2ff:fef8:79cd/64 +br-50e2988e78eb DOWN 172.18.0.1/16 +br-748fea589ab8 DOWN 172.19.0.1/16 +br-b52d11330b20 DOWN 172.23.0.1/16 +docker0 DOWN 172.17.0.1/16 +br-f91c61cdba28 DOWN 172.20.0.1/16 +br-25187260f675 DOWN 172.22.0.1/16 +tailscale0 UNKNOWN 100.103.64.82/32 fd7a:115c:a1e0::2901:4052/128 fe80::42db:e6ff:fe57:431c/64 +veth9ecb986@if2 UP fe80::c45b:62ff:fe19:6258/64 + +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host noprefixroute + valid_lft forever preferred_lft forever +2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000 + link/ether 00:15:5d:64:e8:1e brd ff:ff:ff:ff:ff:ff + inet 192.168.3.250/22 brd 192.168.3.255 scope global eth0 + valid_lft forever preferred_lft forever + inet6 2600:1700:1d1:eb00:215:5dff:fe64:e81e/64 scope global dynamic mngtmpaddr + valid_lft 3391sec preferred_lft 3391sec + inet6 fe80::215:5dff:fe64:e81e/64 scope link + valid_lft forever preferred_lft forever +3: eth1: mtu 1500 qdisc mq state UP group default qlen 1000 + link/ether 00:15:5d:64:e8:2a brd ff:ff:ff:ff:ff:ff +5: br-3d55385c5e7d: mtu 1500 qdisc noqueue state UP group default + link/ether da:83:02:f8:79:cd brd ff:ff:ff:ff:ff:ff + inet 172.24.0.1/16 brd 172.24.255.255 scope global br-3d55385c5e7d + valid_lft forever preferred_lft forever + inet6 fe80::d883:2ff:fef8:79cd/64 scope link + valid_lft forever preferred_lft forever +6: br-50e2988e78eb: mtu 1500 qdisc noqueue state DOWN group default + link/ether ca:f9:33:b2:b6:bb brd ff:ff:ff:ff:ff:ff + inet 172.18.0.1/16 brd 172.18.255.255 scope global br-50e2988e78eb + valid_lft forever preferred_lft forever +7: br-748fea589ab8: mtu 1500 qdisc noqueue state DOWN group default + link/ether 82:e8:2b:47:1e:91 brd ff:ff:ff:ff:ff:ff + inet 172.19.0.1/16 brd 172.19.255.255 scope global br-748fea589ab8 + valid_lft forever preferred_lft forever +8: br-b52d11330b20: mtu 1500 qdisc noqueue state DOWN group default + link/ether de:6e:f1:ec:24:64 brd ff:ff:ff:ff:ff:ff + inet 172.23.0.1/16 brd 172.23.255.255 scope global br-b52d11330b20 + valid_lft forever preferred_lft forever +9: docker0: mtu 1500 qdisc noqueue state DOWN group default + link/ether 56:f9:55:99:fa:af brd ff:ff:ff:ff:ff:ff + inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0 + valid_lft forever preferred_lft forever +10: br-f91c61cdba28: mtu 1500 qdisc noqueue state DOWN group default + link/ether 8e:ed:24:fa:4b:4a brd ff:ff:ff:ff:ff:ff + inet 172.20.0.1/16 brd 172.20.255.255 scope global br-f91c61cdba28 + valid_lft forever preferred_lft forever +11: br-25187260f675: mtu 1500 qdisc noqueue state DOWN group default + link/ether 82:af:8a:0a:64:01 brd ff:ff:ff:ff:ff:ff + inet 172.22.0.1/16 brd 172.22.255.255 scope global br-25187260f675 + valid_lft forever preferred_lft forever +18: tailscale0: mtu 1280 qdisc fq_codel state UNKNOWN group default qlen 500 + link/none + inet 100.103.64.82/32 scope global tailscale0 + valid_lft forever preferred_lft forever + inet6 fd7a:115c:a1e0::2901:4052/128 scope global + valid_lft forever preferred_lft forever + inet6 fe80::42db:e6ff:fe57:431c/64 scope link stable-privacy + valid_lft forever preferred_lft forever +24: veth9ecb986@if2: mtu 1500 qdisc noqueue master br-3d55385c5e7d state UP group default + link/ether c6:5b:62:19:62:58 brd ff:ff:ff:ff:ff:ff link-netnsid 0 + inet6 fe80::c45b:62ff:fe19:6258/64 scope link + valid_lft forever preferred_lft forever +-- default route -- +default via 192.168.3.254 dev eth0 onlink +172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown +172.18.0.0/16 dev br-50e2988e78eb proto kernel scope link src 172.18.0.1 linkdown +172.19.0.0/16 dev br-748fea589ab8 proto kernel scope link src 172.19.0.1 linkdown +172.20.0.0/16 dev br-f91c61cdba28 proto kernel scope link src 172.20.0.1 linkdown +172.22.0.0/16 dev br-25187260f675 proto kernel scope link src 172.22.0.1 linkdown +172.23.0.0/16 dev br-b52d11330b20 proto kernel scope link src 172.23.0.1 linkdown +172.24.0.0/16 dev br-3d55385c5e7d proto kernel scope link src 172.24.0.1 +192.168.0.0/22 dev eth0 proto kernel scope link src 192.168.3.250 +-- /etc/resolv.conf -- +# resolv.conf(5) file generated by tailscale +# For more info, see https://tailscale.com/s/resolvconf-overwrite +# DO NOT EDIT THIS FILE BY HAND -- CHANGES WILL BE OVERWRITTEN + +nameserver 100.100.100.100 +nameserver fd7a:115c:a1e0::53 +search knel.net +-- /etc/hosts -- +127.0.0.1 localhost +127.0.1.1 pfv-netboot.knel.net pfv-netboot + +# The following lines are desirable for IPv6 capable hosts +::1 localhost ip6-localhost ip6-loopback +ff02::1 ip6-allnodes +ff02::2 ip6-allrouters +-- listening TCP/UDP sockets -- +Netid State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess +udp UNCONN 0 0 0.0.0.0:38908 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:53 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:67 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:46164 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:111 0.0.0.0:* +udp UNCONN 0 0 100.103.64.82:123 0.0.0.0:* +udp UNCONN 0 0 172.24.0.1:123 0.0.0.0:* +udp UNCONN 0 0 192.168.3.250:123 0.0.0.0:* +udp UNCONN 0 0 127.0.0.1:123 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:123 0.0.0.0:* +udp UNCONN 0 0 172.17.255.255:137 0.0.0.0:* +udp UNCONN 0 0 172.17.0.1:137 0.0.0.0:* +udp UNCONN 0 0 172.18.255.255:137 0.0.0.0:* +udp UNCONN 0 0 172.18.0.1:137 0.0.0.0:* +udp UNCONN 0 0 172.19.255.255:137 0.0.0.0:* +udp UNCONN 0 0 172.19.0.1:137 0.0.0.0:* +udp UNCONN 0 0 172.20.255.255:137 0.0.0.0:* +udp UNCONN 0 0 172.20.0.1:137 0.0.0.0:* +udp UNCONN 0 0 172.22.255.255:137 0.0.0.0:* +udp UNCONN 0 0 172.22.0.1:137 0.0.0.0:* +udp UNCONN 0 0 172.23.255.255:137 0.0.0.0:* +udp UNCONN 0 0 172.23.0.1:137 0.0.0.0:* +udp UNCONN 0 0 172.24.255.255:137 0.0.0.0:* +udp UNCONN 0 0 172.24.0.1:137 0.0.0.0:* +udp UNCONN 0 0 192.168.3.255:137 0.0.0.0:* +udp UNCONN 0 0 192.168.3.250:137 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:137 0.0.0.0:* +udp UNCONN 0 0 172.17.255.255:138 0.0.0.0:* +udp UNCONN 0 0 172.17.0.1:138 0.0.0.0:* +udp UNCONN 0 0 172.18.255.255:138 0.0.0.0:* +udp UNCONN 0 0 172.18.0.1:138 0.0.0.0:* +udp UNCONN 0 0 172.19.255.255:138 0.0.0.0:* +udp UNCONN 0 0 172.19.0.1:138 0.0.0.0:* +udp UNCONN 0 0 172.20.255.255:138 0.0.0.0:* +udp UNCONN 0 0 172.20.0.1:138 0.0.0.0:* +udp UNCONN 0 0 172.22.255.255:138 0.0.0.0:* +udp UNCONN 0 0 172.22.0.1:138 0.0.0.0:* +udp UNCONN 0 0 172.23.255.255:138 0.0.0.0:* +udp UNCONN 0 0 172.23.0.1:138 0.0.0.0:* +udp UNCONN 0 0 172.24.255.255:138 0.0.0.0:* +udp UNCONN 0 0 172.24.0.1:138 0.0.0.0:* +udp UNCONN 0 0 192.168.3.255:138 0.0.0.0:* +udp UNCONN 0 0 192.168.3.250:138 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:138 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:161 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:41257 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:20000 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:41641 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:59092 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:10000 0.0.0.0:* +udp UNCONN 0 0 127.0.0.1:786 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:40725 0.0.0.0:* +udp UNCONN 0 0 0.0.0.0:37749 0.0.0.0:* +udp UNCONN 0 0 [::]:53 [::]:* +udp UNCONN 0 0 [::]:34901 [::]:* +udp UNCONN 0 0 [::]:111 [::]:* +udp UNCONN 0 0 [fe80::c45b:62ff:fe19:6258]%veth9ecb986:123 [::]:* +udp UNCONN 0 0 [fe80::42db:e6ff:fe57:431c]%tailscale0:123 [::]:* +udp UNCONN 0 0 [fd7a:115c:a1e0::2901:4052]:123 [::]:* +udp UNCONN 0 0 [fe80::d883:2ff:fef8:79cd]%br-3d55385c5e7d:123 [::]:* +udp UNCONN 0 0 [fe80::215:5dff:fe64:e81e]%eth0:123 [::]:* +udp UNCONN 0 0 [2600:1700:1d1:eb00:215:5dff:fe64:e81e]:123 [::]:* +udp UNCONN 0 0 [::1]:123 [::]:* +udp UNCONN 0 0 [::]:123 [::]:* +udp UNCONN 0 0 [::]:43257 [::]:* +udp UNCONN 0 0 [::]:44469 [::]:* +udp UNCONN 0 0 [::]:41641 [::]:* +udp UNCONN 0 0 [::]:55132 [::]:* +udp UNCONN 0 0 [::]:34667 [::]:* +tcp LISTEN 0 4096 0.0.0.0:38435 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:20000 0.0.0.0:* +tcp LISTEN 0 5 127.0.0.1:555 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:10002 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:10003 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:10000 0.0.0.0:* +tcp LISTEN 0 4096 100.103.64.82:64362 0.0.0.0:* +tcp LISTEN 0 5 127.0.0.1:61209 0.0.0.0:* +tcp LISTEN 0 50 0.0.0.0:139 0.0.0.0:* +tcp LISTEN 0 64 0.0.0.0:36079 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:45295 0.0.0.0:* +tcp LISTEN 0 5 0.0.0.0:4330 0.0.0.0:* +tcp LISTEN 0 100 0.0.0.0:25 0.0.0.0:* +tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* +tcp LISTEN 0 64 0.0.0.0:2049 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:53 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:40029 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:111 0.0.0.0:* +tcp LISTEN 0 50 0.0.0.0:445 0.0.0.0:* +tcp LISTEN 0 4096 0.0.0.0:58853 0.0.0.0:* +tcp LISTEN 0 128 0.0.0.0:44322 0.0.0.0:* +tcp LISTEN 0 128 0.0.0.0:44323 0.0.0.0:* +tcp LISTEN 0 5 0.0.0.0:44321 0.0.0.0:* +tcp LISTEN 0 4096 [fd7a:115c:a1e0::2901:4052]:52472 [::]:* +tcp LISTEN 0 4096 [::]:45755 [::]:* +tcp LISTEN 0 4096 [::]:60951 [::]:* +tcp LISTEN 0 4096 *:9090 *:* +tcp LISTEN 0 64 [::]:37813 [::]:* +tcp LISTEN 0 4096 [::]:10002 [::]:* +tcp LISTEN 0 4096 [::]:10003 [::]:* +tcp LISTEN 0 4096 [::]:10000 [::]:* +tcp LISTEN 0 4096 *:45876 *:* +tcp LISTEN 0 50 [::]:139 [::]:* +tcp LISTEN 0 4096 [::]:44271 [::]:* +tcp LISTEN 0 5 [::]:4330 [::]:* +tcp LISTEN 0 128 [::]:22 [::]:* +tcp LISTEN 0 64 [::]:2049 [::]:* +tcp LISTEN 0 4096 [::]:53 [::]:* +tcp LISTEN 0 4096 [::]:111 [::]:* +tcp LISTEN 0 4096 *:6556 *:* +tcp LISTEN 0 50 [::]:445 [::]:* +tcp LISTEN 0 4096 [::]:60725 [::]:* +tcp LISTEN 0 128 [::]:44322 [::]:* +tcp LISTEN 0 128 [::]:44323 [::]:* +tcp LISTEN 0 5 [::]:44321 [::]:* +-- /etc/network/interfaces -- +# This file describes the network interfaces available on your system +# and how to activate them. For more information, see interfaces(5). + +source /etc/network/interfaces.d/* + +# The loopback network interface +auto lo +iface lo inet loopback + +# The primary network interface +allow-hotplug eth0 +iface eth0 inet static + address 192.168.3.250 + netmask 255.255.252.0 + gateway 192.168.3.254 + +#allow-hotplug eth1 +#iface eth1 inet static +# address 10.100.100.4 +# netmask 255.255.255.0 +-- netplan -- +-- systemd-networkd -- +total 8 +drwxr-xr-x 2 root root 4096 Mar 6 2025 . +drwxr-xr-x 5 root root 4096 Jul 20 17:55 .. +● State: n/a + Online state: unknown + Address: 192.168.3.250 on eth0 + 172.24.0.1 on br-3d55385c5e7d + 172.18.0.1 on br-50e2988e78eb + 172.19.0.1 on br-748fea589ab8 + 172.23.0.1 on br-b52d11330b20 + 172.17.0.1 on docker0 + 172.20.0.1 on br-f91c61cdba28 + 172.22.0.1 on br-25187260f675 + 100.103.64.82 on tailscale0 + 2600:1700:1d1:eb00:215:5dff:fe64:e81e on eth0 + fd7a:115c:a1e0::2901:4052 on tailscale0 + fe80::215:5dff:fe64:e81e on eth0 + fe80::d883:2ff:fef8:79cd on br-3d55385c5e7d + fe80::42db:e6ff:fe57:431c on tailscale0 + fe80::c45b:62ff:fe19:6258 on veth9ecb986 + Gateway: 192.168.3.254 on eth0 + fe80::6e4b:b4ff:fe10:4061 on eth0 + +======================================================================== +SECTION: 3. RELEVANT SYSTEMD UNITS +======================================================================== +-- all units matching dns|pihole|dnsmasq|technitium|ftl|ntp|chrony|timesync -- + initrd-parse-etc.service loaded inactive dead Mountpoints Configured in the Real Root + ntpsec-rotate-stats.service loaded inactive dead Rotate ntpd stats + ntpsec-systemd-netif.service loaded inactive dead ntpsec-systemd-netif.service + ntpsec.service loaded active running Network Time Service +● systemd-resolved.service not-found inactive dead systemd-resolved.service +● systemd-timesyncd.service not-found inactive dead systemd-timesyncd.service +-- unit files (enabled state) -- +ntpsec-systemd-netif.path enabled enabled +postfix-resolvconf.path disabled enabled +ntp.service alias - +ntpd.service alias - +ntpsec-rotate-stats.service static - +ntpsec-systemd-netif.service static - +ntpsec-wait.service disabled enabled +ntpsec.service enabled enabled +postfix-resolvconf.service disabled enabled +ntpsec-rotate-stats.timer enabled enabled +ntpsec.timer masked enabled +-- installed packages of interest -- +ii dnsmasq-base 2.90-4~deb12u2 amd64 Small caching DNS proxy and DHCP/TFTP server - executable +ii ntpsec 1.2.2+dfsg1-1+deb12u1 amd64 Network Time Protocol daemon and utility programs +ii ntpsec-ntpdate 1.2.2+dfsg1-1+deb12u1 amd64 client for setting system time from NTP servers +ii ntpsec-ntpdig 1.2.2+dfsg1-1+deb12u1 amd64 ntpdig SNTP client +ii python3-ntp 1.2.2+dfsg1-1+deb12u1 amd64 Python 3 NTP Helper Classes + +======================================================================== +SECTION: 4. NTP +======================================================================== +-- chrony -- + +-- chronyc sources/stats (if available) -- +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +-- ntpsec / ntp classic -- +● ntpsec.service - Network Time Service + Loaded: loaded (/lib/systemd/system/ntpsec.service; enabled; preset: enabled) + Active: active (running) since Mon 2026-07-20 17:56:32 CDT; 1 week 0 days ago + Docs: man:ntpd(8) + Process: 2124687 ExecStart=/usr/libexec/ntpsec/ntp-systemd-wrapper (code=exited, status=0/SUCCESS) + Main PID: 2124690 (ntpd) + Tasks: 1 (limit: 2219) + Memory: 10.7M + CPU: 34.324s + CGroup: /system.slice/ntpsec.service + └─2124690 /usr/sbin/ntpd -p /run/ntpd.pid -c /etc/ntpsec/ntp.conf -g -N -u ntpsec:ntpsec +● ntpsec.service - Network Time Service + Loaded: loaded (/lib/systemd/system/ntpsec.service; enabled; preset: enabled) + Active: active (running) since Mon 2026-07-20 17:56:32 CDT; 1 week 0 days ago + Docs: man:ntpd(8) + Process: 2124687 ExecStart=/usr/libexec/ntpsec/ntp-systemd-wrapper (code=exited, status=0/SUCCESS) + Main PID: 2124690 (ntpd) + Tasks: 1 (limit: 2219) + Memory: 10.7M + CPU: 34.324s + CGroup: /system.slice/ntpsec.service + └─2124690 /usr/sbin/ntpd -p /run/ntpd.pid -c /etc/ntpsec/ntp.conf -g -N -u ntpsec:ntpsec + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +main: line 37: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +driftfile /var/lib/ntp/ntp.drift +leapfile /usr/share/zoneinfo/leap-seconds.list +server pfvsvrpi.knel.net +restrict 127.0.0.1 +restrict ::1 + +-- systemd-timesyncd -- + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +-- openntpd -- + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +======================================================================== +SECTION: 5. DOCKER +======================================================================== +-- docker version -- +Client: Docker Engine - Community + Version: 29.6.2 + API version: 1.55 + Go version: go1.26.5 + Git commit: dfc4efb + Built: Thu Jul 16 16:12:20 2026 + OS/Arch: linux/amd64 + Context: default +Client: Docker Engine - Community + Version: 29.6.2 + API version: 1.55 + Go version: go1.26.5 + Git commit: dfc4efb + Built: Thu Jul 16 16:12:20 2026 + OS/Arch: linux/amd64 + Context: default + +Server: Docker Engine - Community + Engine: + Version: 29.6.2 + API version: 1.55 (minimum version 1.40) + Go version: go1.26.5 + Git commit: 3d80467 + Built: Thu Jul 16 16:12:20 2026 + OS/Arch: linux/amd64 + Experimental: false + containerd: + Version: v2.2.6 + GitCommit: 11ce9d5f3c68c941867e82890e93e815c1304f1b + runc: + Version: 1.3.6 + GitCommit: v1.3.6-0-g491b69ba + docker-init: + Version: 0.19.0 + GitCommit: de40ad0 +-- containers (running) -- +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +1d09249f01b0 pihole/pihole:latest "start.sh" 5 months ago Up 44 minutes (healthy) 67/udp, 0.0.0.0:53->53/tcp, 0.0.0.0:53->53/udp, [::]:53->53/tcp, [::]:53->53/udp, 123/udp, 0.0.0.0:10002->80/tcp, [::]:10002->80/tcp, 0.0.0.0:10003->443/tcp, [::]:10003->443/tcp pihole +c33ced53142e dockurr/chrony "/bin/startup" 13 months ago Up 7 days (healthy) tsys-ntp +-- containers (all) -- +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +1d09249f01b0 pihole/pihole:latest "start.sh" 5 months ago Up 44 minutes (healthy) 67/udp, 0.0.0.0:53->53/tcp, 0.0.0.0:53->53/udp, [::]:53->53/tcp, [::]:53->53/udp, 123/udp, 0.0.0.0:10002->80/tcp, [::]:10002->80/tcp, 0.0.0.0:10003->443/tcp, [::]:10003->443/tcp pihole +c33ced53142e dockurr/chrony "/bin/startup" 13 months ago Up 7 days (healthy) tsys-ntp +-- images -- +IMAGE ID DISK USAGE CONTENT SIZE EXTRA +busybox:latest 6d3e4188a38a 4.28MB 0B +dockurr/chrony:latest 3b656f2feb55 15.4MB 0B U +pihole/pihole:latest 81365952d1f8 92.7MB 0B U +-- volumes -- +DRIVER VOLUME NAME +local 0cb24520936997d233409ea07681920fdb03d92967856e849474cf90446dc426 +local 0ccc1140e4b86442167f65d7caf43d8a3bc04fff2bef461f112d8b7c8e4bd4c8 +local 1d7f70d65f5d739f737c3bc0d1b0b2b5cf4f192477dcbbdb95bca344310bff84 +local 2a1726279d1d382ab0a2bcb2079f60e65fc0fd0d40880074038e0c678b2a7f56 +local 3d207dff87da7dc7d11b70f1e595cc5cce001392cb663ac4d664f5710b9879b8 +local 4f8894b9f0206c743be26e6b644e3bf017c5b6e190ac7da31e7ffb7132a1ca2f +local 7c210964fd48cd91c8e37543d562569ec523208b5ea421f8fb47dc73a6d724ee +local 8ccc4c07bf45d05bc922d4f619780f60cac0149b4dd7de5be7720f72f47e6c10 +local 71c98aa3d5fb266ef291ac4fc95b11fc83475b9bb0f70999e77095249ad18bf5 +local 83f977471ac2f4ad6521ad50f0311ee36547701d00d9a869903f0ba667c2000d +local 87eced0295c12870220fc746ef685530cb5b8e20c4afafbfd573ff773459cd9f +local 95eb8a7b389b9a04bd90f4cee485bd015b7c3fd311c1750c7596a2b2fde1605d +local 562da84ce678f8d8b9cc45665099f2562beb4a41c860b5951ef8b88a8f682e41 +local 8974fb973f2be9c05c1ec6548ffaad0b1caa302972f7567c3fb3a97d59b9076b +local 201278554f24a7af6284b9564c45656e6d2dc7b9daea24fe52707d7825cb5385 +local b24c0bd3e25987537a92078d6f521f5f155e7379295d21e43c500cbabc8a02e0 +local bb353f885d620d98dbb147f0ff51f38a87725669b1a14390fb825509878a7e0b +local bc96d56b965f1e238afd47e483b93f1ec9ed59e8458e8e851ffc9710582a5475 +local c329a5b999999c074bf767bc1f7b3647cf5d4d0624b7d45d63658cbb723e5d46 +local cf03c8ea64823ac8db5c6df1093b2d9f5146838dd8dc2986bdc485e8b59d0d24 +local d9500add842368a6d637090569e5c13cb9f068cbfeb14e02c597ae82f2807e47 +local da3164486ea59aaa9fd14113faa9104411c61ad36a9487e3ce780e86a96dac1f +local dae4bbdcbb634b817b47558df3908906fe7635ad57377389616189bd0f2d7b64 +local dddeee12833ed02185e00732ddb8c12ef6a6b88c49e7df4e48f7a27b71182bf5 +local dns_tsys-dns-config +local dns_tyss-dns-config +local e054c42f042095e22be91432ca87e524fc0ebbc447a800c263c389577e190629 +local eda6668262ccd43f0e3c0b9e3c42711cc516f372b46ef174bca34d96d17740b8 +local f53cb9833442fd9499260fa8073a04a15f5c96a5576aa96d781bc24441906942 +local f142ec0c6150618365447908d5753ff5ff7defcbf27c210702a17ad205dc4aba +local f350de2e220f4983bca2e7ca96374a597a075779224b036ccd76deb280ba8922 +-- networks -- +NETWORK ID NAME DRIVER SCOPE +0f56376f4515 bridge bridge local +f91c61cdba28 dns_default bridge local +b24303598fa1 host host local +25187260f675 msmtpd_default bridge local +748fea589ab8 netdisco_default bridge local +bd40993bc47f none null local +b52d11330b20 ntp_default bridge local +3d55385c5e7d pihole_default bridge local +50e2988e78eb root_default bridge local +-- compose files in common locations -- +### /opt ### +total 16 +drwxr-xr-x 4 root root 4096 Dec 29 2025 . +drwxr-xr-x 20 root root 4096 Jul 20 17:55 .. +drwxr-xr-x 2 beszel beszel 4096 Apr 6 01:08 beszel-agent +drwx--x--x 4 root root 4096 Jun 10 2025 containerd + +======================================================================== +SECTION: 6. PI-HOLE +======================================================================== +(pihole command not on PATH) +-- /etc/pihole listing -- +main: line 54: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +(cannot list /etc/pihole) + + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] + +-- /etc/pihole/*.conf (all) -- +-- /etc/dnsmasq.d listing -- +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +main: line 54: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +(cannot list /etc/dnsmasq.d) + +-- /etc/dnsmasq.conf (if present) -- + +-- gravity.db schema + row counts (Pi-hole v5+) -- +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +(no gravity.db found) +-- lighttpd / pihole web admin -- + +main: line 44: printf: --: invalid option +printf: usage: printf [-v var] format [arguments] +alias.url += ("/javascript" => "/usr/share/javascript") + +-- pihole-FTL service -- + +======================================================================== +SECTION: 7. TECHNITIUM DNS +======================================================================== +-- technitium systemd unit -- +-- any unit containing technitium -- +-- unit file path -- +### checking /etc/technitium ### +### checking /etc/technitium/dns ### +### checking /opt/technitium ### +### checking /opt/technitium/dns ### +### checking /var/lib/technitium ### +### checking /usr/local/technitium ### +-- technitium config.xml / dnsServer.conf (search) -- + +======================================================================== +SECTION: 8. FIREWALL & MISC +======================================================================== +-- nftables -- +table ip raw { + chain PREROUTING { + type filter hook prerouting priority raw; policy accept; + iifname != "br-b52d11330b20" ip daddr 172.23.0.2 counter packets 0 bytes 0 drop + iifname != "br-3d55385c5e7d" ip daddr 172.24.0.2 counter packets 0 bytes 0 drop + } + + chain OUTPUT { + type filter hook output priority raw; policy accept; + } +} +table ip filter { + chain INPUT { + type filter hook input priority filter; policy accept; + counter packets 8461563 bytes 1841523123 jump ts-input + } + + chain FORWARD { + type filter hook forward priority filter; policy drop; + counter packets 20387709 bytes 3821595842 jump DOCKER-USER + counter packets 20387709 bytes 3821595842 jump DOCKER-FORWARD + counter packets 1064 bytes 88643 jump ts-forward + } + + chain OUTPUT { + type filter hook output priority filter; policy accept; + } + + chain DOCKER-FORWARD { + counter packets 20387709 bytes 3821595842 jump DOCKER-CT + counter packets 14776132 bytes 2075147539 jump DOCKER-INTERNAL + counter packets 14776132 bytes 2075147539 jump DOCKER-BRIDGE + iifname "br-748fea589ab8" counter packets 0 bytes 0 accept + iifname "br-b52d11330b20" counter packets 0 bytes 0 accept + iifname "br-f91c61cdba28" counter packets 0 bytes 0 accept + iifname "br-25187260f675" counter packets 0 bytes 0 accept + iifname "br-3d55385c5e7d" counter packets 10132822 bytes 1741327665 accept + iifname "br-50e2988e78eb" counter packets 0 bytes 0 accept + iifname "docker0" counter packets 0 bytes 0 accept + } + + chain DOCKER-USER { + } + + chain ts-input { + iifname "lo" ip saddr 100.103.64.82 counter packets 0 bytes 0 accept + iifname "tailscale0" counter packets 512217 bytes 46924098 accept + udp dport 41641 counter packets 3360373 bytes 516737750 accept + iifname != "tailscale0" ip saddr 100.115.92.0/23 counter packets 0 bytes 0 return + iifname != "tailscale0" ip saddr 100.64.0.0/10 counter packets 0 bytes 0 drop + } + + chain ts-forward { + iifname "tailscale0" counter packets 28 bytes 2578 meta mark set mark and 0xff00ffff xor 0x40000 + meta mark & 0x00ff0000 == 0x00040000 counter packets 28 bytes 2578 accept + oifname "tailscale0" ip saddr 100.64.0.0/10 counter packets 0 bytes 0 drop + oifname "tailscale0" counter packets 15 bytes 1554 accept + } + + chain DOCKER { + iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" ip daddr 172.24.0.2 tcp dport 443 counter packets 0 bytes 0 accept + iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" ip daddr 172.24.0.2 tcp dport 80 counter packets 0 bytes 0 accept + iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" ip daddr 172.24.0.2 udp dport 53 counter packets 32283 bytes 2368019 accept + iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" ip daddr 172.24.0.2 tcp dport 53 counter packets 638 bytes 34248 accept + iifname != "br-748fea589ab8" oifname "br-748fea589ab8" counter packets 0 bytes 0 drop + iifname != "br-b52d11330b20" oifname "br-b52d11330b20" counter packets 0 bytes 0 drop + iifname != "br-f91c61cdba28" oifname "br-f91c61cdba28" counter packets 0 bytes 0 drop + iifname != "br-25187260f675" oifname "br-25187260f675" counter packets 0 bytes 0 drop + iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" counter packets 0 bytes 0 drop + iifname != "br-50e2988e78eb" oifname "br-50e2988e78eb" counter packets 0 bytes 0 drop + iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop + } + + chain DOCKER-BRIDGE { + oifname "br-748fea589ab8" counter packets 0 bytes 0 jump DOCKER + oifname "br-b52d11330b20" counter packets 0 bytes 0 jump DOCKER + oifname "br-f91c61cdba28" counter packets 0 bytes 0 jump DOCKER + oifname "br-25187260f675" counter packets 0 bytes 0 jump DOCKER + oifname "br-3d55385c5e7d" counter packets 4643310 bytes 333819874 jump DOCKER + oifname "br-50e2988e78eb" counter packets 0 bytes 0 jump DOCKER +-- iptables -- +-P INPUT ACCEPT +-P FORWARD DROP +-P OUTPUT ACCEPT +-N DOCKER +-N DOCKER-BRIDGE +-N DOCKER-CT +-N DOCKER-FORWARD +-N DOCKER-INTERNAL +-N DOCKER-USER +-N ts-forward +-N ts-input +-A INPUT -j ts-input +-A FORWARD -j DOCKER-USER +-A FORWARD -j DOCKER-FORWARD +-A FORWARD -j ts-forward +-A DOCKER -d 172.24.0.2/32 ! -i br-3d55385c5e7d -o br-3d55385c5e7d -p tcp -m tcp --dport 443 -j ACCEPT +-A DOCKER -d 172.24.0.2/32 ! -i br-3d55385c5e7d -o br-3d55385c5e7d -p tcp -m tcp --dport 80 -j ACCEPT +-A DOCKER -d 172.24.0.2/32 ! -i br-3d55385c5e7d -o br-3d55385c5e7d -p udp -m udp --dport 53 -j ACCEPT +-A DOCKER -d 172.24.0.2/32 ! -i br-3d55385c5e7d -o br-3d55385c5e7d -p tcp -m tcp --dport 53 -j ACCEPT +-A DOCKER ! -i br-748fea589ab8 -o br-748fea589ab8 -j DROP +-A DOCKER ! -i br-b52d11330b20 -o br-b52d11330b20 -j DROP +-A DOCKER ! -i br-f91c61cdba28 -o br-f91c61cdba28 -j DROP +-A DOCKER ! -i br-25187260f675 -o br-25187260f675 -j DROP +-A DOCKER ! -i br-3d55385c5e7d -o br-3d55385c5e7d -j DROP +-A DOCKER ! -i br-50e2988e78eb -o br-50e2988e78eb -j DROP +-A DOCKER ! -i docker0 -o docker0 -j DROP +-A DOCKER-BRIDGE -o br-748fea589ab8 -j DOCKER +-A DOCKER-BRIDGE -o br-b52d11330b20 -j DOCKER +-A DOCKER-BRIDGE -o br-f91c61cdba28 -j DOCKER +-A DOCKER-BRIDGE -o br-25187260f675 -j DOCKER +-A DOCKER-BRIDGE -o br-3d55385c5e7d -j DOCKER +-A DOCKER-BRIDGE -o br-50e2988e78eb -j DOCKER +-A DOCKER-BRIDGE -o docker0 -j DOCKER +-A DOCKER-CT -o br-748fea589ab8 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-CT -o br-b52d11330b20 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-CT -o br-f91c61cdba28 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-CT -o br-25187260f675 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-CT -o br-3d55385c5e7d -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-CT -o br-50e2988e78eb -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-- ufw -- +-- firewalld -- +-- selinux/apparmor -- +(SELinux not present) + +======================================================================== +SECTION: 9. CRON & TIMERS +======================================================================== +-- root crontab -- +(n/a) +-- localuser crontab -- +(none) +-- /etc/cron.d -- +-- pihole timer -- + +##### AUDIT END 2026-07-28T02:41:34Z ##### diff --git a/netinfra/netboot-deep-audit.txt b/netinfra/netboot-deep-audit.txt new file mode 100644 index 0000000..224a59e --- /dev/null +++ b/netinfra/netboot-deep-audit.txt @@ -0,0 +1,896 @@ +This system is the property of Known Element Enterprises LLC. + +Authorized uses only. All activity may be monitored and reported. + +All activities subject to monitoring/recording/review in real time and/or at a later time. +=== COMPOSE FILES: /root/pihole and /root/NTP === + +--- /root/pihole/docker-compose.yml --- +# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/ +services: + pihole: + container_name: pihole + image: pihole/pihole:latest + ports: + # DNS Ports + - "53:53/tcp" + - "53:53/udp" + # Default HTTP Port + - "10002:80/tcp" + # Default HTTPs Port. FTL will generate a self-signed certificate + - "10003:443/tcp" + # Uncomment the below if using Pi-hole as your DHCP Server + #- "67:67/udp" + # Uncomment the line below if you are using Pi-hole as your NTP server + #- "123:123/udp" + environment: + # Set the appropriate timezone for your location from + # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones, e.g: + TZ: 'America/Chicago' + # Set a password to access the web interface. Not setting one will result in a random password being assigned + FTLCONF_webserver_api_password: 'Gransyan1!' + # If using Docker's default `bridge` network setting the dns listening mode should be set to 'all' + FTLCONF_dns_listeningMode: 'all' + # Volumes store your data between container upgrades + volumes: + # For persisting Pi-hole's databases and common configuration file + - './etc-pihole:/etc/pihole' + # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true' + #- './etc-dnsmasq.d:/etc/dnsmasq.d' + cap_add: + # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities + # Required if you are using Pi-hole as your DHCP server, else not needed + #- NET_ADMIN + # Required if you are using Pi-hole as your NTP client to be able to set the host's system time + #- SYS_TIME + # Optional, if Pi-hole should get some more processing time + - SYS_NICE + restart: always + +--- /root/NTP/docker-compose.yml --- +services: + ntp: + image: dockurr/chrony + container_name: tsys-ntp + environment: + NTP_SERVERS: "pool.ntp.org" + ports: + - 100.103.64.82:123:123/udp + restart: always + +=== DIR LAYOUT of compose project dirs === +total 16 +drwxr-xr-x 3 root root 4096 Feb 6 18:32 . +drwx------ 10 root root 4096 Apr 5 06:16 .. +-rw-r--r-- 1 root root 2089 Feb 6 18:30 docker-compose.yml +drwxr-xr-x 7 localuser localuser 4096 Jul 27 20:57 etc-pihole +total 12 +drwxr-xr-x 2 root root 4096 Jul 2 2025 . +drwx------ 10 root root 4096 Apr 5 06:16 .. +-rw-r--r-- 1 root root 188 Jun 23 2025 docker-compose.yml +total 84 +drwx------ 10 root root 4096 Apr 5 06:16 . +drwxr-xr-x 20 root root 4096 Jul 20 17:55 .. +-rw------- 1 root root 4113 Jun 18 2025 .bash_history +-rw-r--r-- 1 root root 571 Apr 10 2021 .bashrc +drwx------ 3 root root 4096 Jun 10 2025 .config +drwxr-xr-x 2 root root 4096 Apr 5 06:16 dhcp +-rw------- 1 root root 2960 Feb 16 19:26 dhcpmigrate +drwxr-xr-x 10 root root 4096 Jul 2 2025 FetchApply +drwx------ 3 root root 4096 Jul 10 2025 .gnupg +-rw------- 1 root root 40 Apr 5 06:15 .lesshst +drwxr-xr-x 2 root root 4096 Jul 2 2025 NTP +drwxr-xr-x 3 root root 4096 Feb 6 18:32 pihole +-rw-r--r-- 1 root root 161 Jul 9 2019 .profile +drwx------ 2 root root 4096 Jun 13 2025 .ssh +drwxr-xr-x 2 root root 4096 Jul 27 09:08 .tmp +-rw------- 1 root root 15370 Apr 5 06:15 .viminfo +-rw-r--r-- 1 root root 180 Jun 17 2025 .wget-hsts + +=== SEARCH entire FS for any technitium / dns compose files === + +=== ALL CONTAINERS with compose labels === +NAMES IMAGE STATUS WDIR=working dir CFG=config files SVC=service +pihole pihole/pihole:latest Up 48 minutes (healthy) WDIR=/root/pihole CFG=/root/pihole/docker-compose.yml SVC=pihole +tsys-ntp dockurr/chrony Up 7 days (healthy) WDIR=/root/NTP CFG=/root/NTP/docker-compose.yml SVC=ntp + +=== DOCKER INSPECT pihole + tsys-ntp (and any dns/technitium container) === + +###### /pihole | image=pihole/pihole:latest | proj=pihole ###### +[ + { + "Id": "1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82", + "Created": "2026-02-07T00:32:57.4029722Z", + "Path": "start.sh", + "Args": [], + "State": { + "Status": "running", + "Running": true, + "Paused": false, + "Restarting": false, + "OOMKilled": false, + "Dead": false, + "Pid": 1222239, + "ExitCode": 0, + "Error": "", + "StartedAt": "2026-07-28T01:57:27.732608642Z", + "FinishedAt": "2026-07-28T01:57:27.095917957Z", + "Health": { + "Status": "healthy", + "FailingStreak": 0, + "Log": [ + { + "Start": "2026-07-27T21:43:50.682295418-05:00", + "End": "2026-07-27T21:43:50.921778022-05:00", + "ExitCode": 0, + "Output": "127.0.0.1\n" + }, + { + "Start": "2026-07-27T21:44:20.925872245-05:00", + "End": "2026-07-27T21:44:21.170837655-05:00", + "ExitCode": 0, + "Output": "127.0.0.1\n" + }, + { + "Start": "2026-07-27T21:44:51.175444367-05:00", + "End": "2026-07-27T21:44:51.416140073-05:00", + "ExitCode": 0, + "Output": "127.0.0.1\n" + }, + { + "Start": "2026-07-27T21:45:21.417102671-05:00", + "End": "2026-07-27T21:45:21.689964304-05:00", + "ExitCode": 0, + "Output": "127.0.0.1\n" + }, + { + "Start": "2026-07-27T21:45:51.691119192-05:00", + "End": "2026-07-27T21:45:51.945416009-05:00", + "ExitCode": 0, + "Output": "127.0.0.1\n" + } + ] + } + }, + "Image": "sha256:81365952d1f82f114cea23ef5a2961c73da61ec5dc0e066ee2f625b1eb98854b", + "ResolvConfPath": "/var/lib/docker/containers/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82/resolv.conf", + "HostnamePath": "/var/lib/docker/containers/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82/hostname", + "HostsPath": "/var/lib/docker/containers/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82/hosts", + "LogPath": "/var/lib/docker/containers/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82-json.log", + "Name": "/pihole", + "RestartCount": 2, + "Driver": "overlay2", + "Platform": "linux", + "MountLabel": "", + "ProcessLabel": "", + "AppArmorProfile": "docker-default", + "ExecIDs": null, + "HostConfig": { + "Binds": [ + "/root/pihole/etc-pihole:/etc/pihole:rw" + ], + "ContainerIDFile": "", + "LogConfig": { + "Type": "json-file", + "Config": {} + }, + "NetworkMode": "pihole_default", + "PortBindings": { + "443/tcp": [ + { + "HostIp": "", + "HostPort": "10003" + } + ], + "53/tcp": [ + { + "HostIp": "", + "HostPort": "53" + } + ], + "53/udp": [ + { + "HostIp": "", + "HostPort": "53" + } + ], + "80/tcp": [ + { + "HostIp": "", + "HostPort": "10002" + } + ] + }, + "RestartPolicy": { + "Name": "always", + "MaximumRetryCount": 0 + }, + "AutoRemove": false, + "VolumeDriver": "", + "VolumesFrom": null, + "ConsoleSize": [ + 0, + 0 + ], + "CapAdd": [ + "CAP_SYS_NICE" + ], + "CapDrop": null, + "CgroupnsMode": "private", + "Dns": [], + "DnsOptions": [], + "DnsSearch": [], + "ExtraHosts": [], + "GroupAdd": null, + "IpcMode": "private", + "Cgroup": "", + "Links": null, + "OomScoreAdj": 0, + "PidMode": "", + "Privileged": false, + "PublishAllPorts": false, + "ReadonlyRootfs": false, + "SecurityOpt": null, + "UTSMode": "", + "UsernsMode": "", + "ShmSize": 67108864, + "Runtime": "runc", + "Isolation": "", + "CpuShares": 0, + "Memory": 0, + "NanoCpus": 0, + "CgroupParent": "", + "BlkioWeight": 0, + "BlkioWeightDevice": null, + "BlkioDeviceReadBps": null, + "BlkioDeviceWriteBps": null, + "BlkioDeviceReadIOps": null, + "BlkioDeviceWriteIOps": null, + "CpuPeriod": 0, + "CpuQuota": 0, + "CpuRealtimePeriod": 0, + "CpuRealtimeRuntime": 0, + "CpusetCpus": "", + "CpusetMems": "", + "Devices": null, + "DeviceCgroupRules": null, + "DeviceRequests": null, + "MemoryReservation": 0, + "MemorySwap": 0, + "MemorySwappiness": null, + "OomKillDisable": null, + "PidsLimit": null, + "Ulimits": null, + "CpuCount": 0, + "CpuPercent": 0, + "IOMaximumIOps": 0, + "IOMaximumBandwidth": 0, + "MaskedPaths": [ + "/proc/acpi", + "/proc/asound", + "/proc/interrupts", + "/proc/kcore", + "/proc/keys", + "/proc/latency_stats", + "/proc/sched_debug", + "/proc/scsi", + "/proc/timer_list", + "/proc/timer_stats", + "/sys/devices/virtual/powercap", + "/sys/firmware" + ], + "ReadonlyPaths": [ + "/proc/bus", + "/proc/fs", + "/proc/irq", + "/proc/sys", + "/proc/sysrq-trigger" + ] + }, + "GraphDriver": { + "Data": { + "ID": "1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82", + "LowerDir": "/var/lib/docker/overlay2/69d0a802515624c1ced9a0ae9e09ed76f94b3077d3d5628914ccee60941a51ac-init/diff:/var/lib/docker/overlay2/c026d6eb78252f15477a6ed84b76e7855b525a582aafa11ae38d89d932433d9c/diff:/var/lib/docker/overlay2/38b4e9cd3ba8e5a10ee7dffbf21e4e552bc30ca96df4b3fc46532d8c2f4828d0/diff:/var/lib/docker/overlay2/10c7b2bc8ab474a29274b66e94e43e31db3dd248dbe0c8e8f7069e305efc7a41/diff:/var/lib/docker/overlay2/de5840a2fb5aed78f79984d980d59f9e50839ddb792146cc7a33d185b8b3eee2/diff:/var/lib/docker/overlay2/5f0504c14572ef5e745e8b06b8f1b3ce74027bce323b7bd1153c828e0dd97d52/diff:/var/lib/docker/overlay2/7a3eefaaac250fbb5430c567e9d12320c35c5da67ad3f8b7b8a7accccc435f18/diff:/var/lib/docker/overlay2/a6c7374834f19eabf6bd3e36f8ad8f2e20e3cf32c4bfea3133ef432b163dac8b/diff:/var/lib/docker/overlay2/28ffada6ac95ffb6c493b1908d00f9cfa096069fd715fa101b910b628835bed5/diff:/var/lib/docker/overlay2/0e79a525158aef2253d47f7f429c50e48c49fec81329f2be7fc580d906528087/diff:/var/lib/docker/overlay2/7365834c77d4c08772f03b8fc0fa6d21b593d3ac70a9ec66fe77ed403d0ef064/diff:/var/lib/docker/overlay2/4bd0de3b67968b6681a962ee9fb89b6bb09b07e5d2ba0d0f85f0561cd9442d32/diff", + "MergedDir": "/var/lib/docker/overlay2/69d0a802515624c1ced9a0ae9e09ed76f94b3077d3d5628914ccee60941a51ac/merged", + "UpperDir": "/var/lib/docker/overlay2/69d0a802515624c1ced9a0ae9e09ed76f94b3077d3d5628914ccee60941a51ac/diff", + "WorkDir": "/var/lib/docker/overlay2/69d0a802515624c1ced9a0ae9e09ed76f94b3077d3d5628914ccee60941a51ac/work" + }, + "Name": "overlay2" + }, + "Mounts": [ + { + "Type": "bind", + "Source": "/root/pihole/etc-pihole", + "Destination": "/etc/pihole", + "Mode": "rw", + "RW": true, + "Propagation": "rprivate" + } + ], + "Config": { + "Hostname": "1d09249f01b0", + "Domainname": "", + "User": "", + "AttachStdin": false, + "AttachStdout": true, + "AttachStderr": true, + "ExposedPorts": { + "123/udp": {}, + "443/tcp": {}, + "53/tcp": {}, + "53/udp": {}, + "67/udp": {}, + "80/tcp": {} + }, + "Tty": false, + "OpenStdin": false, + "StdinOnce": false, + "Env": [ + "FTLCONF_webserver_api_password=Gransyan1!", + "FTLCONF_dns_listeningMode=all", + "TZ=America/Chicago", + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "DNSMASQ_USER=pihole", + "FTL_CMD=no-daemon" + ], + "Cmd": null, + "Healthcheck": { + "Test": [ + "CMD-SHELL", + "dig -p $(pihole-FTL --config dns.port) +short +norecurse +retry=0 @127.0.0.1 pi.hole || exit 1" + ] + }, + "Image": "pihole/pihole:latest", + "Volumes": null, + "WorkingDir": "/", + "Entrypoint": [ + "start.sh" + ], + "Labels": { + "com.docker.compose.config-hash": "60a181f601a1959cb6dda5f5889ff706d9986f7db015664ab40608253b83348e", + "com.docker.compose.container-number": "1", + "com.docker.compose.depends_on": "", + "com.docker.compose.image": "sha256:81365952d1f82f114cea23ef5a2961c73da61ec5dc0e066ee2f625b1eb98854b", + "com.docker.compose.oneoff": "False", + "com.docker.compose.project": "pihole", + "com.docker.compose.project.config_files": "/root/pihole/docker-compose.yml", + "com.docker.compose.project.working_dir": "/root/pihole", + "com.docker.compose.service": "pihole", + "com.docker.compose.version": "5.0.2", + "org.opencontainers.image.created": "2025-06-06T19:35:20.360Z", + "org.opencontainers.image.description": "Pi-hole in a docker container", + "org.opencontainers.image.licenses": "NOASSERTION", + "org.opencontainers.image.revision": "b56e67ef6808de2854d30481ebcd40bcd2b43445", + "org.opencontainers.image.source": "https://github.com/pi-hole/docker-pi-hole", + "org.opencontainers.image.title": "docker-pi-hole", + "org.opencontainers.image.url": "https://github.com/pi-hole/docker-pi-hole", + "org.opencontainers.image.version": "2025.06.1" + } + }, + "NetworkSettings": { + "SandboxID": "4c83df12c0f6aa377cdd17640639b35e737eb7530c6798d7b80eb3135dbfbd20", + "SandboxKey": "/var/run/docker/netns/4c83df12c0f6", + "Ports": { + "123/udp": null, + "443/tcp": [ + { + "HostIp": "0.0.0.0", + "HostPort": "10003" + }, + { + "HostIp": "::", + "HostPort": "10003" + } + ], + "53/tcp": [ + { + "HostIp": "0.0.0.0", + "HostPort": "53" + }, + { + "HostIp": "::", + "HostPort": "53" + } + ], + "53/udp": [ + { + "HostIp": "0.0.0.0", + "HostPort": "53" + }, + { + "HostIp": "::", + "HostPort": "53" + } + ], + "67/udp": null, + "80/tcp": [ + { + "HostIp": "0.0.0.0", + "HostPort": "10002" + }, + { + "HostIp": "::", + "HostPort": "10002" + } + ] + }, + "Networks": { + "pihole_default": { + "IPAMConfig": null, + "Links": null, + "Aliases": [ + "pihole", + "pihole" + ], + "DriverOpts": null, + "GwPriority": 0, + "NetworkID": "3d55385c5e7d7d4ca5ddec3f98533d43452cdc2fda68831ac4a16aeb0d42867c", + "EndpointID": "aadb163f607f9247c8ad41f8cadac2282272501c60e3ea7fa31fd2d584271447", + "Gateway": "172.24.0.1", + "IPAddress": "172.24.0.2", + "MacAddress": "7e:48:e2:84:c5:15", + "IPPrefixLen": 16, + "IPv6Gateway": "", + "GlobalIPv6Address": "", + "GlobalIPv6PrefixLen": 0, + "DNSNames": [ + "pihole", + "1d09249f01b0" + ] + } + } + } + } +] + +###### /tsys-ntp | image=dockurr/chrony | proj=ntp ###### +[ + { + "Id": "c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908", + "Created": "2025-06-23T16:51:39.454106229Z", + "Path": "/bin/startup", + "Args": [], + "State": { + "Status": "running", + "Running": true, + "Paused": false, + "Restarting": false, + "OOMKilled": false, + "Dead": false, + "Pid": 2109237, + "ExitCode": 0, + "Error": "", + "StartedAt": "2026-07-20T22:55:49.597671587Z", + "FinishedAt": "2026-07-20T22:55:37.650310687Z", + "Health": { + "Status": "healthy", + "FailingStreak": 0, + "Log": [ + { + "Start": "2026-07-27T21:44:16.437981113-05:00", + "End": "2026-07-27T21:44:16.501904568-05:00", + "ExitCode": 0, + "Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525388062 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n" + }, + { + "Start": "2026-07-27T21:44:46.50366458-05:00", + "End": "2026-07-27T21:44:46.566905934-05:00", + "ExitCode": 0, + "Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525413632 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n" + }, + { + "Start": "2026-07-27T21:45:16.568367435-05:00", + "End": "2026-07-27T21:45:16.632376789-05:00", + "ExitCode": 0, + "Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525439143 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n" + }, + { + "Start": "2026-07-27T21:45:46.63406538-05:00", + "End": "2026-07-27T21:45:46.695064332-05:00", + "ExitCode": 0, + "Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525464714 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n" + }, + { + "Start": "2026-07-27T21:46:16.697074212-05:00", + "End": "2026-07-27T21:46:16.763778169-05:00", + "ExitCode": 0, + "Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525490224 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n" + } + ] + } + }, + "Image": "sha256:3b656f2feb55b967a6773337da2f982bc489a463066e2a4d3e82d04e53f13fbc", + "ResolvConfPath": "/var/lib/docker/containers/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908/resolv.conf", + "HostnamePath": "/var/lib/docker/containers/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908/hostname", + "HostsPath": "/var/lib/docker/containers/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908/hosts", + "LogPath": "/var/lib/docker/containers/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908-json.log", + "Name": "/tsys-ntp", + "RestartCount": 0, + "Driver": "overlay2", + "Platform": "linux", + "MountLabel": "", + "ProcessLabel": "", + "AppArmorProfile": "docker-default", + "ExecIDs": null, + "HostConfig": { + "Binds": null, + "ContainerIDFile": "", + "LogConfig": { + "Type": "json-file", + "Config": {} + }, + "NetworkMode": "ntp_default", + "PortBindings": { + "123/udp": [ + { + "HostIp": "100.103.64.82", + "HostPort": "123" + } + ] + }, + "RestartPolicy": { + "Name": "always", + "MaximumRetryCount": 0 + }, + "AutoRemove": false, + "VolumeDriver": "", + "VolumesFrom": null, + "ConsoleSize": [ + 0, + 0 + ], + "CapAdd": null, + "CapDrop": null, + "CgroupnsMode": "private", + "Dns": [], + "DnsOptions": [], + "DnsSearch": [], + "ExtraHosts": [], + "GroupAdd": null, + "IpcMode": "private", + "Cgroup": "", + "Links": null, + "OomScoreAdj": 0, + "PidMode": "", + "Privileged": false, + "PublishAllPorts": false, + "ReadonlyRootfs": false, + "SecurityOpt": null, + "UTSMode": "", + "UsernsMode": "", + "ShmSize": 67108864, + "Runtime": "runc", + "Isolation": "", + "CpuShares": 0, + "Memory": 0, + "NanoCpus": 0, + "CgroupParent": "", + "BlkioWeight": 0, + "BlkioWeightDevice": null, + "BlkioDeviceReadBps": null, + "BlkioDeviceWriteBps": null, + "BlkioDeviceReadIOps": null, + "BlkioDeviceWriteIOps": null, + "CpuPeriod": 0, + "CpuQuota": 0, + "CpuRealtimePeriod": 0, + "CpuRealtimeRuntime": 0, + "CpusetCpus": "", + "CpusetMems": "", + "Devices": null, + "DeviceCgroupRules": null, + "DeviceRequests": null, + "MemoryReservation": 0, + "MemorySwap": 0, + "MemorySwappiness": null, + "OomKillDisable": null, + "PidsLimit": null, + "Ulimits": null, + "CpuCount": 0, + "CpuPercent": 0, + "IOMaximumIOps": 0, + "IOMaximumBandwidth": 0, + "Mounts": [ + { + "Type": "volume", + "Source": "e054c42f042095e22be91432ca87e524fc0ebbc447a800c263c389577e190629", + "Target": "/run/chrony" + }, + { + "Type": "volume", + "Source": "8974fb973f2be9c05c1ec6548ffaad0b1caa302972f7567c3fb3a97d59b9076b", + "Target": "/var/lib/chrony" + }, + { + "Type": "volume", + "Source": "562da84ce678f8d8b9cc45665099f2562beb4a41c860b5951ef8b88a8f682e41", + "Target": "/etc/chrony" + } + ], + "MaskedPaths": [ + "/proc/asound", + "/proc/acpi", + "/proc/interrupts", + "/proc/kcore", + "/proc/keys", + "/proc/latency_stats", + "/proc/timer_list", + "/proc/timer_stats", + "/proc/sched_debug", + "/proc/scsi", + "/sys/firmware", + "/sys/devices/virtual/powercap" + ], + "ReadonlyPaths": [ + "/proc/bus", + "/proc/fs", + "/proc/irq", + "/proc/sys", + "/proc/sysrq-trigger" + ] + }, + "GraphDriver": { + "Data": { + "ID": "c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908", + "LowerDir": "/var/lib/docker/overlay2/40b6c14e2ca0bdc9b2624ca63e7e7b4ad588098c00e53ebf18b4aac5a132c6db-init/diff:/var/lib/docker/overlay2/6de110c8e8511a542a0541ecba7006ff7fe26ee0e91b738d87fec292a76a5cb1/diff:/var/lib/docker/overlay2/5dc67368f8acabea18fc0be0b07d52e5a82362b5d57119871e3471c509927a73/diff:/var/lib/docker/overlay2/ce6cab3e3329a7148ae6c5e55af761b4b533eac36dcd08cb34d3de88e958d92f/diff", + "MergedDir": "/var/lib/docker/overlay2/40b6c14e2ca0bdc9b2624ca63e7e7b4ad588098c00e53ebf18b4aac5a132c6db/merged", + "UpperDir": "/var/lib/docker/overlay2/40b6c14e2ca0bdc9b2624ca63e7e7b4ad588098c00e53ebf18b4aac5a132c6db/diff", + "WorkDir": "/var/lib/docker/overlay2/40b6c14e2ca0bdc9b2624ca63e7e7b4ad588098c00e53ebf18b4aac5a132c6db/work" + }, + "Name": "overlay2" + }, + "Mounts": [ + { + "Type": "volume", + "Name": "8974fb973f2be9c05c1ec6548ffaad0b1caa302972f7567c3fb3a97d59b9076b", + "Source": "/var/lib/docker/volumes/8974fb973f2be9c05c1ec6548ffaad0b1caa302972f7567c3fb3a97d59b9076b/_data", + "Destination": "/var/lib/chrony", + "Driver": "local", + "Mode": "z", + "RW": true, + "Propagation": "" + }, + { + "Type": "volume", + "Name": "562da84ce678f8d8b9cc45665099f2562beb4a41c860b5951ef8b88a8f682e41", + "Source": "/var/lib/docker/volumes/562da84ce678f8d8b9cc45665099f2562beb4a41c860b5951ef8b88a8f682e41/_data", + "Destination": "/etc/chrony", + "Driver": "local", + "Mode": "z", + "RW": true, + "Propagation": "" + }, + { + "Type": "volume", + "Name": "e054c42f042095e22be91432ca87e524fc0ebbc447a800c263c389577e190629", + "Source": "/var/lib/docker/volumes/e054c42f042095e22be91432ca87e524fc0ebbc447a800c263c389577e190629/_data", + "Destination": "/run/chrony", + "Driver": "local", + "Mode": "z", + "RW": true, + "Propagation": "" + } + ], + "Config": { + "Hostname": "c33ced53142e", + "Domainname": "", + "User": "", + "AttachStdin": false, + "AttachStdout": true, + "AttachStderr": true, + "ExposedPorts": { + "123/udp": {} + }, + "Tty": false, + "OpenStdin": false, + "StdinOnce": false, + "Env": [ + "NTP_SERVERS=pool.ntp.org", + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "NTP_DIRECTIVES=ratelimit\\nrtcsync" + ], + "Cmd": null, + "Healthcheck": { + "Test": [ + "CMD-SHELL", + "chronyc -n tracking || exit 1" + ] + }, + "Image": "dockurr/chrony", + "Volumes": { + "/etc/chrony": {}, + "/run/chrony": {}, + "/var/lib/chrony": {} + }, + "WorkingDir": "/", + "Entrypoint": [ + "/bin/startup" + ], + "Labels": { + "com.docker.compose.config-hash": "b9a2451b9ec10e82b113b417df6060f18aab234f117063b84ac7a29455f2feb0", + "com.docker.compose.container-number": "1", + "com.docker.compose.depends_on": "", + "com.docker.compose.image": "sha256:3b656f2feb55b967a6773337da2f982bc489a463066e2a4d3e82d04e53f13fbc", + "com.docker.compose.oneoff": "False", + "com.docker.compose.project": "ntp", + "com.docker.compose.project.config_files": "/root/NTP/docker-compose.yml", + "com.docker.compose.project.working_dir": "/root/NTP", + "com.docker.compose.replace": "61f92d4c43f32567409816af5e3c1c9622aedcb5e35b27b25980282fa3c3e1b3", + "com.docker.compose.service": "ntp", + "com.docker.compose.version": "2.36.2", + "org.opencontainers.image.created": "2025-06-12T01:51:48.447Z", + "org.opencontainers.image.description": "🕒 chronyd NTP server in a Docker container.", + "org.opencontainers.image.licenses": "MIT", + "org.opencontainers.image.revision": "43fb0f2b381bccfef5123971a51baf450ab24464", + "org.opencontainers.image.source": "https://github.com/dockur/chrony", + "org.opencontainers.image.title": "Chrony", + "org.opencontainers.image.url": "https://github.com/dockur/chrony", + "org.opencontainers.image.version": "4.7" + } + }, + "NetworkSettings": { + "SandboxID": "ccaa71c75942abc56df6ae1c89a8c2ae91e769ed52eab64635a63f8ee996f782", + "SandboxKey": "/var/run/docker/netns/ccaa71c75942", + "Ports": {}, + "Networks": {} + } + } +] + +=== PI-HOLE internal config (sudo docker exec, READ-ONLY) === +-- ls /etc/pihole -- +total 2545492 +drwxr-xr-x 7 pihole pihole 4096 Jul 27 20:57 . +drwxr-xr-x 1 root root 4096 Feb 6 18:32 .. +-rw-r----- 1 pihole pihole 65 Jun 23 2025 adlists.list +-rw-r----- 1 pihole pihole 44 Jul 27 20:57 cli_pw +drwxr-xr-x 2 pihole pihole 4096 Apr 6 10:07 config_backups +-rw-r----- 1 pihole pihole 0 Jun 18 2025 dhcp.leases +-rw-r----- 1 pihole pihole 5753 Apr 6 10:07 dnsmasq.conf +-rw-r----- 1 pihole pihole 5500928 Jul 26 04:51 gravity.db +drwxr-xr-x 2 pihole pihole 4096 Jul 26 04:51 gravity_backups +-rw-r----- 1 pihole pihole 4751360 Jul 19 04:51 gravity_old.db +drwxr-xr-x 2 pihole pihole 4096 Jun 18 2025 hosts +drwxr-xr-x 2 pihole pihole 4096 Jul 26 04:51 listsCache +-rw-r----- 1 root root 421 Jul 27 20:57 logrotate +drwxr-xr-x 2 pihole pihole 4096 Jun 18 2025 migration_backup +-rw-r----- 1 pihole pihole 2591891456 Jul 27 21:40 pihole-FTL.db +-rw-r----- 1 pihole pihole 32768 Jul 27 21:46 pihole-FTL.db-shm +-rw-r----- 1 pihole pihole 4272472 Jul 27 21:46 pihole-FTL.db-wal +-rw-r----- 1 pihole pihole 55996 Apr 6 10:07 pihole.toml +-rw------- 1 pihole pihole 713 Jun 18 2025 tls.crt +-rw------- 1 pihole pihole 1734 Jun 18 2025 tls.pem +-rw------- 1 pihole pihole 733 Jun 18 2025 tls_ca.crt +-rw-r--r-- 1 pihole pihole 376 Jul 27 20:57 versions +-- ls /etc/dnsmasq.d -- +ls: cannot access '/etc/dnsmasq.d': No such file or directory +--- /etc/pihole/setupVars.conf --- +cat: /etc/pihole/setupVars.conf: No such file or directory +--- /etc/pihole/pihole-FTL.conf --- +cat: /etc/pihole/pihole-FTL.conf: No such file or directory +--- /etc/pihole/adlists.list --- +https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts +--- /etc/pihole/custom.list --- +cat: /etc/pihole/custom.list: No such file or directory +--- /etc/pihole/local.list --- +cat: /etc/pihole/local.list: No such file or directory +--- /etc/pihole/regex.list --- +cat: /etc/pihole/regex.list: No such file or directory +--- /etc/pihole/dhcp.leases --- +--- /etc/pihole/static_ip.conf --- +cat: /etc/pihole/static_ip.conf: No such file or directory +-- /etc/dnsmasq.d/* -- +--- /etc/dnsmasq.d/* --- +cat: '/etc/dnsmasq.d/*': No such file or directory +-- pihole version -- +Core version is v6.1.2 (Latest: v6.4.3) +Web version is v6.2.1 (Latest: v6.6) +FTL version is v6.2.2 (Latest: v6.7) +-- gravity row counts -- +adlist=domainlist=client=group=info=-- adlist addresses -- +OCI runtime exec failed: exec failed: unable to start container process: exec: "sqlite3": executable file not found in $PATH +-- domainlist (allow+deny, first 60) -- +OCI runtime exec failed: exec failed: unable to start container process: exec: "sqlite3": executable file not found in $PATH + +=== CHRONY/NTP container config (tsys-ntp) === +--- chrony.conf --- +# https://github.com/dockur/chrony + +# chrony.conf file generated by startup script +# located at /bin/startup + +# time servers provided by NTP_SERVER environment variables. +server pool.ntp.org iburst + +driftfile /var/lib/chrony/chrony.drift +makestep 0.1 3 +ratelimit +rtcsync + +allow all +--- ls /etc --- +total 176 +drwxr-xr-x 1 root root 4096 Jun 23 2025 . +drwxr-xr-x 1 root root 4096 Jun 23 2025 .. +-rw-r--r-- 1 root root 21 Jan 8 2025 alpine-release +drwxr-xr-x 1 root root 4096 Jun 12 2025 apk +drwxr-xr-x 2 root root 4096 Jan 8 2025 busybox-paths.d +drwxr-xr-x 2 chrony chrony 4096 Jun 23 2025 chrony +drwxr-xr-x 2 root root 4096 Jan 8 2025 crontabs +-rw-r--r-- 1 root root 89 Jan 4 2025 fstab +-rw-r--r-- 1 root root 530 Jun 12 2025 group +-rw-r--r-- 1 root root 524 Jun 12 2025 group- +-rw-r--r-- 1 root root 13 Jul 20 22:55 hostname +-rw-r--r-- 1 root root 148 Jul 20 22:55 hosts +-rw-r--r-- 1 root root 570 Jan 4 2025 inittab +-rw-r--r-- 1 root root 77 Jan 8 2025 issue +drwxr-xr-x 1 root root 4096 Jun 12 2025 logrotate.d +drwxr-xr-x 2 root root 4096 Jan 8 2025 modprobe.d +-rw-r--r-- 1 root root 15 Jan 4 2025 modules +drwxr-xr-x 2 root root 4096 Jan 8 2025 modules-load.d +-rw-r--r-- 1 root root 284 Jan 4 2025 motd +lrwxrwxrwx 1 root root 12 Jun 23 2025 mtab -> /proc/mounts +drwxr-xr-x 8 root root 4096 Jan 8 2025 network +-rw-r--r-- 1 root root 205 Jan 4 2025 nsswitch.conf +drwxr-xr-x 2 root root 4096 Jan 8 2025 opt +lrwxrwxrwx 1 root root 21 Jan 8 2025 os-release -> ../usr/lib/os-release +-rw-r--r-- 1 root root 756 Jun 12 2025 passwd +-rw-r--r-- 1 root root 702 Jan 4 2025 passwd- +drwxr-xr-x 7 root root 4096 Jan 8 2025 periodic +drwxr-xr-x 2 root root 4096 Jun 12 2025 pkcs11 +-rw-r--r-- 1 root root 547 Jan 4 2025 profile +MS Name/IP address Stratum Poll Reach LastRx Last sample +=============================================================================== +Reference ID : 00000000 () +Stratum : 0 +Ref time (UTC) : Thu Jan 01 00:00:00 1970 +System time : 0.525492370 seconds slow of NTP time +Last offset : +0.000000000 seconds +RMS offset : 0.000000000 seconds +Frequency : 0.849 ppm slow +Residual freq : +0.000 ppm +Skew : 0.000 ppm +Root delay : 1.000000000 seconds +Root dispersion : 1.000000000 seconds +Update interval : 0.0 seconds +Leap status : Not synchronised +-- bare metal ntpsec.conf -- +driftfile /var/lib/ntp/ntp.drift +leapfile /usr/share/zoneinfo/leap-seconds.list +server pfvsvrpi.knel.net +restrict 127.0.0.1 +restrict ::1 + +=== TECHNITIUM volumes === + +--- volume dns_tsys-dns-config -> /var/lib/docker/volumes/dns_tsys-dns-config/_data --- +/var/lib/docker/volumes/dns_tsys-dns-config/_data/stats/2025062320.stat +/var/lib/docker/volumes/dns_tsys-dns-config/_data/stats/2025062321.stat +/var/lib/docker/volumes/dns_tsys-dns-config/_data/dns.config +/var/lib/docker/volumes/dns_tsys-dns-config/_data/auth.config +/var/lib/docker/volumes/dns_tsys-dns-config/_data/logs/2025-06-23.log +/var/lib/docker/volumes/dns_tsys-dns-config/_data/scopes/Default.scope +/var/lib/docker/volumes/dns_tsys-dns-config/_data/log.config +/var/lib/docker/volumes/dns_tsys-dns-config/_data/self-signed-cert.pfx +/var/lib/docker/volumes/dns_tsys-dns-config/_data/cache.bin +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/199.86.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/knel.net.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/119.127.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/46.96.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/181.103.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/184.108.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/211.114.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/145.105.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/97.82.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/194.67.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/2.108.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/75.110.100.in-addr.arpa.zone +/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/64.103.100.in-addr.arpa.zone +-- config dir listing -- +-- config.xml -- + +--- volume dns_tyss-dns-config -> /var/lib/docker/volumes/dns_tyss-dns-config/_data --- +-- config dir listing -- +-- config.xml -- + +=== DONE ===