KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: lock in storage philosophy and PDM migration capability

Browse Source 
Storage philosophy (user directive):
- NVMe/SSD: k8s worker scratch + ultix-streaming (dev workstation
  running "cluster of 1" pre-prod jobs before full k8s deployment)
- Spinning rust: all infrastructure VMs (UCS, netinfra, LibreNMS, SIEM)

Clarified that hosts are standalone but managed via Proxmox Datacenter
Manager (PDM), which supports VM migration between nodes through the
UI -- eliminating the need for manual disk copies in the migration plan.

Updated all migration steps to reference PDM storage migrate instead
of manual cp commands.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-07-27 21:46:48 -05:00
parent 6814374bac
commit 53954d8494
8 changed files with 2028 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+7 -3
View File
@@ -112,9 +112,13 @@ use `deploy-check.sh` / `deploy-tuning.sh` wrapper patterns instead.
`/etc/network/interfaces` with awk (sed fails on tab-indented stanza).
4. Always shellcheck before shipping: `docker run --rm -v "$PWD:/mnt"
koalaman/shellcheck:stable --severity=style scripts/*.sh`
5. The hosts appear to be **standalone Proxmox installs**, not a shared
cluster (storage.cfg differs per host). VMs are pinned to their host.
Moving VMs requires manual disk migration, not live migration.
5. The hosts are **standalone Proxmox installs** (not a pvecm cluster), but
managed collectively via **Proxmox Datacenter Manager (PDM)**. PDM supports
VM migration between nodes via the UI. NFS exports are visible to all nodes;
local storage migration is done through PDM's "Storage Migrate" function.
6. **Storage philosophy:** NVMe/SSD is for k8s worker scratch + ultix-streaming
(developer workstation for "cluster of 1" pre-prod jobs). Spinning rust
hosts all infrastructure VMs (UCS, netinfra, LibreNMS, SIEM).
## Friday walkthrough (user action)
K8S.md
+22 -11
View File
@@ -328,16 +328,20 @@ spec:
### 6.3 NFS-SSD tier (D3 and T5-SSD -- both on tsys5 after Friday)
The SSD NFS exports are a middle tier. **Both consolidated on tsys5** after
the Friday D3 relocation:
- **D3 (tsys5 SAS, 445 GB free):** CI/CD artifacts, container image cache,
UCS/LDAP. Currently 99% empty. Fastest NFS tier after the move off USB.
- **T5-SSD (tsys5 SAS, 140 GB free):** SIEM databases, monitoring data.
Currently 35% used by ultix-streaming.
**Storage philosophy (user directive): NVMe/SSD is EXCLUSIVELY for k8s worker
scratch space, with the exception of ultix-streaming which stays on T5-SSD.
Spinning rust hosts all other infrastructure VMs** (UCS, netinfra, LibreNMS,
SIEM, etc.).
The SSD NFS exports:
- **D3 (tsys5 SAS, 445 GB free):** k8s scratch exclusively (etcd, container
cache, ephemeral volumes). Currently 99% empty.
- **T5-SSD (tsys5 SAS, 140 GB free after ultix-streaming):** ultix-streaming
occupies 83 GB. Remaining 140 GB available for k8s use.
**tsys5 is the fast-tier hub:** NVMe (local) + D3 SSD + T5-SSD all on one host.
This simplifies the StorageClass design -- latency-sensitive PVCs target
tsys5 exports, bulk PVCs target either server.
This simplifies the StorageClass design -- latency-sensitive k8s PVCs target
tsys5 SSD exports, bulk PVCs target either server.
### 6.4 NFS data distribution across storage servers
@@ -413,6 +417,13 @@ if the data is already cached in the page cache.
## 8. Migration Plan
**Key enabler:** The hosts are standalone Proxmox installs, but **Proxmox
Datacenter Manager (PDM)** manages them collectively and supports VM migration
between nodes. Storage migration can be done via the PDM/Proxmox UI rather
than manual disk copies -- the destination node just needs access to the target
storage (which all nodes have for NFS exports, and local storage can be
migrated through the UI's "Storage Migrate" function).
### 8.1 Phase 1: Friday (after hardware work)
After tsys5 cable + NVMe and tsys4 NIC + RAM:
@@ -451,9 +462,9 @@ Plan for a maintenance window with the k8s cluster briefly down.
### 8.5 Phase 5: Critical VM relocation
1. Move netinfra-02 (VM 904) from D2 to S3.
2. Move ucs-01 (VM 108) from D2 to D3 (SSD).
3. Move ucs-02 (VM 902) from D5 to tsys9 local-lvm (SSD).
1. Move netinfra-02 (VM 904) from D2 to S3 (tsys5 HDD).
2. Move ucs-02 (VM 902) from D5 to S2 (tsys5 HDD).
3. (No change to T5-SSD -- ultix-streaming stays.)
---
PROJECT.md
+14 -11
View File
@@ -187,7 +187,7 @@ NFS-over-HDD and unsuitable for wnode boot disks.
|------|-------|------------|----------|
| **NVMe** | tsys3 (Samsung PM961), tsys5 (Friday addition), **tsys2 (Samsung 960 PRO 512GB)** | 2000-3500 MB/s | HPC scratch, ETL staging, container runtime, wnode boot, etcd |
| **Local SSD** | tsys9 (PNY CS900, 136 GB), **tsys2 (Samsung 850 EVO 1TB)** | 500 MB/s | wnode boot disk, etcd |
| **NFS-SSD** | tsys5 D3 (SK hynix, **SAS post-Friday**), tsys5 T5-SSD (Samsung) | 200-400 MB/s over NFS | UCS/LDAP, latency-sensitive VMs |
| **NFS-SSD** | tsys5 D3 (SK hynix, **SAS post-Friday**), tsys5 T5-SSD (Samsung) | 200-400 MB/s over NFS | **k8s worker scratch only** (etcd, container cache, ephemeral volumes) |
| **NFS-HDD** | tsys4 D2/D5, tsys5 S1-S4 | 80-120 MB/s over NFS | Bulk data, large disks, non-critical VMs, **wnode boot on tsys6/7** |
| **Local SATA HDD** | tsys1 local-lvm | 100-150 MB/s | Host OS only |
| **USB 2.0 HDD** | tsys6/7 local-lvm (WD My Passport) | **~30-35 MB/s** | **NOTHING -- slower than NFS, do not use for VMs** |
@@ -679,19 +679,22 @@ This maps to two k8s StorageClasses:
- `local-storage`: bound to the wnode's boot/local disk (fast, ephemeral)
- `nfs-bulk`: bound to NFS exports (slow, persistent, large capacity)
### 10.4 HIGH: Use D3 SSD and T5-SSD for latency-sensitive VMs
### 10.4 HIGH: Dedicate D3 SSD exclusively to k8s scratch
Currently wasted:
- **D3 (tsys4 SK hynix SSD, 445 GB free, 0% used)** -- nobody using it
- **T5-SSD (tsys5 Samsung 860 PRO, 140 GB free)** -- only ultix-streaming
**Storage philosophy (user directive): NVMe/SSD is for k8s worker scratch
space and ultix-streaming (developer workstation running "cluster of 1"
pre-production jobs). Spinning rust hosts all other infrastructure VMs**
(UCS, netinfra, LibreNMS, SIEM, etc.).
Recommended uses for D3 (after moving ucs-01 there, 32 GB):
- Remaining D3 space (413 GB): sectestbed-k8s-cnode, sectestbed-k8s-wnode
(move from local-nonprod HDD to NFS-SSD for faster test runs)
SSD allocation after Friday:
- **D3 (tsys5 SAS, 445 GB free, 0% used)** -- dedicated to k8s scratch via
the `nfs-ssd` StorageClass (etcd, container cache, ephemeral volumes).
- **T5-SSD (tsys5 SAS, 140 GB free)** -- ultix-streaming (VM 5111) stays here
(developer workstation, runs single-node test jobs before k8s). Remaining
140 GB available for k8s.
Recommended uses for T5-SSD (after moving nothing new, ultix-streaming uses 83 GB):
- Remaining T5-SSD space (140 GB): tsys-siem (VM 901, 132 GB disk currently
on D2 HDD) would benefit from SSD for SIEM database writes.
**Deep-dive on exact k8s scratch allocation is deferred to the next session**
(K8S.md) once we know the k8s distribution, job scheduler, and workload mix.
### 10.5 MEDIUM: Restart wnode-tsys6
TODO.md
+5 -6
View File
@@ -217,12 +217,11 @@ servers for redundancy.
| ucs-01 (108) | D2 (tsys4 HDD) | **D2 (tsys4 HDD) -- no change** | Already correct |
| ucs-02 (902) | D5 (tsys4 HDD) | **S2 (tsys5 HDD)** | Move for cross-server redundancy |
**To migrate ucs-02 to S2:**
1. Shut down VM 902 on tsys9
2. Copy disk: `cp /mnt/pve/D5/902/vm-902-disk-0.qcow2 /mnt/pve/S2/902/`
3. Update VM 902 config: change `scsi0` from `D5:902/...` to `S2:902/...`
4. Start VM 902, verify it boots and LDAP/AD services are healthy
5. Remove old disk from D5
**To migrate ucs-02 to S2 (use PDM/Proxmox UI):**
1. In Proxmox Datacenter or the node UI, select VM 902 on tsys9
2. Use "Migrate" or "Storage Migrate" to move the disk from D5 to S2
(both are NFS exports visible to tsys9, so this is a storage-only migration)
3. Verify VM 902 boots and LDAP/AD services are healthy after migration
Note: both VMs are currently on tsys4 HDD, which is fine for UCS. Only
ucs-02 needs to move -- it should be on a different storage server than
netinfra/audit-netboot.sh
Executable
+297
View File
@@ -0,0 +1,297 @@
#!/usr/bin/env bash
# =============================================================================
# audit-netboot.sh
# -----------------------------------------------------------------------------
# READ-ONLY audit of the reference node "pfv-netboot".
#
# Purpose: gather enough information to replicate its Pi-hole, Technitium DNS,
# and NTP services onto pfv-netinfra-01 and pfv-netinfra-02.
#
# Guarantees:
# * NO writes, NO installs, NO service restarts, NO network changes.
# * Every command below is read-only (status, cat, ls, ss, ps, sqlite3 SELECT).
#
# Intended to be run as the "localuser" account on pfv-netboot:
#
# ssh localuser@pfv-netboot 'bash -s' < audit-netboot.sh > netboot-audit.txt
#
# or, if sudo is needed for a few reads, the script will try `sudo -n` for
# specific files that are normally root-readable only. It will NEVER use sudo
# to write or modify anything.
# =============================================================================
set -u
AUDIT_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
# Helper: print a clearly delimited section header.
section() {
printf '\n========================================================================\n'
printf 'SECTION: %s\n' "$1"
printf '========================================================================\n'
}
# Helper: read a file with sudo if needed, silently skip if missing.
read_file() {
local path="$1"
if [ -r "$path" ]; then
printf '--- %s (uid-readable) ---\n' "$path"
cat "$path" 2>/dev/null
elif sudo -n true 2>/dev/null; then
if sudo -n test -e "$path"; then
printf '--- %s (via sudo -n) ---\n' "$path"
sudo -n cat "$path" 2>/dev/null
else
printf '--- %s : NOT FOUND ---\n' "$path"
fi
else
printf '--- %s : NOT READABLE (no passwordless sudo) ---\n' "$path"
fi
printf '\n'
}
list_dir() {
local path="$1"
printf '--- ls -la %s ---\n' "$path"
ls -la "$path" 2>/dev/null || sudo -n ls -la "$path" 2>/dev/null || printf '(cannot list %s)\n' "$path"
printf '\n'
}
printf '##### AUDIT START %s #####\n' "$AUDIT_DATE"
printf 'Audit host: %s\n' "$(hostname -f 2>/dev/null || hostname)"
printf 'Audit user: %s\n' "$(id -un 2>/dev/null)"
printf 'Script: audit-netboot.sh (READ-ONLY)\n'
# -----------------------------------------------------------------------------
# 1. System basics
# -----------------------------------------------------------------------------
section "1. SYSTEM BASICS"
echo "-- uname --"; uname -a
echo "-- /etc/os-release --"; cat /etc/os-release 2>/dev/null
echo "-- uptime --"; uptime
echo "-- timezone --"; timedatectl 2>/dev/null || cat /etc/timezone 2>/dev/null || date
echo "-- arch --"; dpkg --print-architecture 2>/dev/null || uname -m
echo "-- memory --"; free -h 2>/dev/null
echo "-- disk --"; df -h / 2>/dev/null
echo "-- cpu count --"; nproc 2>/dev/null
# -----------------------------------------------------------------------------
# 2. Network configuration
# -----------------------------------------------------------------------------
section "2. NETWORK"
echo "-- hostname --"; hostname; hostname -f 2>/dev/null; hostname -I 2>/dev/null
echo "-- ip addr --"; ip -br addr 2>/dev/null; echo; ip addr 2>/dev/null
echo "-- default route --"; ip route 2>/dev/null
echo "-- /etc/resolv.conf --"; cat /etc/resolv.conf 2>/dev/null
echo "-- /etc/hosts --"; cat /etc/hosts 2>/dev/null
echo "-- listening TCP/UDP sockets --"
ss -tlnup 2>/dev/null || sudo -n ss -tlnup 2>/dev/null
echo "-- /etc/network/interfaces --"; cat /etc/network/interfaces 2>/dev/null
echo "-- netplan --"; ls -la /etc/netplan/ 2>/dev/null; for f in /etc/netplan/*.yaml; do [ -e "$f" ] && { echo "--- $f ---"; cat "$f"; }; done 2>/dev/null
echo "-- systemd-networkd --"; ls -la /etc/systemd/network/ 2>/dev/null; networkctl status 2>/dev/null | head -40
# -----------------------------------------------------------------------------
# 3. DNS / DHCP / NTP related systemd units
# -----------------------------------------------------------------------------
section "3. RELEVANT SYSTEMD UNITS"
echo "-- all units matching dns|pihole|dnsmasq|technitium|ftl|ntp|chrony|timesync --"
systemctl list-units --type=service --all --no-pager 2>/dev/null \
| grep -Ei 'pihole|dnsmasq|ftl|technitium|dns|ntp|chrony|timesync|resolv|resolved' || true
echo "-- unit files (enabled state) --"
systemctl list-unit-files --no-pager 2>/dev/null \
| grep -Ei 'pihole|dnsmasq|ftl|technitium|dns|ntp|chrony|timesync|resolv|resolved' || true
echo "-- installed packages of interest --"
dpkg -l 2>/dev/null | grep -Ei 'pihole|dnsmasq|ftl|technitium|ntp|chrony|timesync|unbound|resolved|resolvconf' || true
# -----------------------------------------------------------------------------
# 4. NTP service details
# -----------------------------------------------------------------------------
section "4. NTP"
echo "-- chrony --"
systemctl status chrony --no-pager 2>/dev/null | head -15 || echo "(no chrony unit)"
read_file /etc/chrony/chrony.conf
echo "-- chronyc sources/stats (if available) --"
chronyc -n sources 2>/dev/null || sudo -n chronyc -n sources 2>/dev/null || true
chronyc -n tracking 2>/dev/null || sudo -n chronyc -n tracking 2>/dev/null || true
echo "-- ntpsec / ntp classic --"
systemctl status ntp --no-pager 2>/dev/null | head -15 || echo "(no ntp unit)"
systemctl status ntpsec --no-pager 2>/dev/null | head -15 || true
read_file /etc/ntp.conf
read_file /etc/ntpsec/ntp.conf
echo "-- systemd-timesyncd --"
systemctl status systemd-timesyncd --no-pager 2>/dev/null | head -15 || echo "(no timesyncd)"
read_file /etc/systemd/timesyncd.conf
echo "-- openntpd --"
systemctl status openntpd --no-pager 2>/dev/null | head -15 || true
read_file /etc/openntpd/ntpd.conf
# -----------------------------------------------------------------------------
# 5. Docker (Pi-hole and/or Technitium may be containerized)
# -----------------------------------------------------------------------------
section "5. DOCKER"
if command -v docker >/dev/null 2>&1; then
echo "-- docker version --"; docker version 2>/dev/null || sudo -n docker version 2>/dev/null || true
echo "-- containers (running) --"; docker ps 2>/dev/null || sudo -n docker ps 2>/dev/null || true
echo "-- containers (all) --"; docker ps -a 2>/dev/null || sudo -n docker ps -a 2>/dev/null || true
echo "-- images --"; docker images 2>/dev/null || sudo -n docker images 2>/dev/null || true
echo "-- volumes --"; docker volume ls 2>/dev/null || sudo -n docker volume ls 2>/dev/null || true
echo "-- networks --"; docker network ls 2>/dev/null || sudo -n docker network ls 2>/dev/null || true
else
echo "(docker not installed / not on PATH)"
fi
echo "-- compose files in common locations --"
for d in /etc/docker-compose /opt/docker-compose /root/docker-compose /home/localuser/docker-compose /srv/docker-compose /opt/pihole /opt/technitium /opt; do
if sudo -n test -d "$d" 2>/dev/null || [ -d "$d" ]; then
echo "### $d ###"
sudo -n ls -la "$d" 2>/dev/null || ls -la "$d" 2>/dev/null || true
for f in docker-compose.yml docker-compose.yaml compose.yml compose.yaml; do
if sudo -n test -f "$d/$f" 2>/dev/null; then
read_file "$d/$f"
elif [ -f "$d/$f" ]; then
read_file "$d/$f"
fi
done
fi
done
# -----------------------------------------------------------------------------
# 6. Pi-hole
# -----------------------------------------------------------------------------
section "6. PI-HOLE"
if command -v pihole >/dev/null 2>&1; then
echo "-- pihole version --"; pihole -v 2>/dev/null || sudo -n pihole -v 2>/dev/null || true
echo "-- pihole status --"; pihole status 2>/dev/null || sudo -n pihole status 2>/dev/null || true
else
echo "(pihole command not on PATH)"
fi
echo "-- /etc/pihole listing --"
list_dir /etc/pihole
# Key Pi-hole config files
for f in \
/etc/pihole/setupVars.conf \
/etc/pihole/pihole-FTL.conf \
/etc/pihole/adlists.list \
/etc/pihole/whitelist.txt \
/etc/pihole/blacklist.txt \
/etc/pihole/regex.list \
/etc/pihole/custom.list \
/etc/pihole/local.list \
/etc/pihole/hostnameMappings.txt \
/etc/pihole/dhcp.leases \
/etc/pihole/static_ip.conf \
/etc/pihole/GitHubVersions \
/etc/pihole/macvendor.db ; do
read_file "$f"
done
echo "-- /etc/pihole/*.conf (all) --"
for f in /etc/pihole/*.conf; do [ -e "$f" ] && read_file "$f"; done 2>/dev/null
echo "-- /etc/dnsmasq.d listing --"
list_dir /etc/dnsmasq.d
for f in /etc/dnsmasq.d/*; do [ -e "$f" ] && read_file "$f"; done 2>/dev/null
echo "-- /etc/dnsmasq.conf (if present) --"
read_file /etc/dnsmasq.conf
echo "-- gravity.db schema + row counts (Pi-hole v5+) --"
GRAVITY=""
for g in /etc/pihole/gravity.db /etc/pihole/gravity.db.*; do
if [ -e "$g" ]; then GRAVITY="$g"; break; fi
done
if [ -n "${GRAVITY:-}" ]; then
echo "gravity.db = $GRAVITY"
if command -v sqlite3 >/dev/null 2>&1; then
sqlite3 -readonly "$GRAVITY" ".tables" 2>/dev/null || sudo -n sqlite3 -readonly "$GRAVITY" ".tables" 2>/dev/null || true
for tbl in adlist adlist_by_group domainlist domainlist_by_group client client_by_group group info; do
cnt=$(sqlite3 -readonly "$GRAVITY" "SELECT COUNT(*) FROM $tbl;" 2>/dev/null || sudo -n sqlite3 -readonly "$GRAVITY" "SELECT COUNT(*) FROM $tbl;" 2>/dev/null || echo "n/a")
printf 'gravity.%s count = %s\n' "$tbl" "$cnt"
done
echo "-- adlist entries (url, enabled, comment) --"
sqlite3 -readonly "$GRAVITY" "SELECT id,address,enabled,comment FROM adlist;" 2>/dev/null \
|| sudo -n sqlite3 -readonly "$GRAVITY" "SELECT id,address,enabled,comment FROM adlist;" 2>/dev/null || true
echo "-- domainlist sample (first 50) --"
sqlite3 -readonly "$GRAVITY" "SELECT id,type,domain,enabled,comment FROM domainlist LIMIT 50;" 2>/dev/null \
|| sudo -n sqlite3 -readonly "$GRAVITY" "SELECT id,type,domain,enabled,comment FROM domainlist LIMIT 50;" 2>/dev/null || true
echo "-- client list --"
sqlite3 -readonly "$GRAVITY" "SELECT id,ip,comment FROM client;" 2>/dev/null \
|| sudo -n sqlite3 -readonly "$GRAVITY" "SELECT id,ip,comment FROM client;" 2>/dev/null || true
echo "-- group list --"
sqlite3 -readonly "$GRAVITY" "SELECT id,name,enabled,comment FROM 'group';" 2>/dev/null \
|| sudo -n sqlite3 -readonly "$GRAVITY" "SELECT id,name,enabled,comment FROM 'group';" 2>/dev/null || true
echo "-- info table --"
sqlite3 -readonly "$GRAVITY" "SELECT * FROM info;" 2>/dev/null \
|| sudo -n sqlite3 -readonly "$GRAVITY" "SELECT * FROM info;" 2>/dev/null || true
else
echo "(sqlite3 not installed; gravity.db present at $GRAVITY)"
fi
else
echo "(no gravity.db found)"
fi
echo "-- lighttpd / pihole web admin --"
systemctl status lighttpd --no-pager 2>/dev/null | head -15 || true
read_file /etc/lighttpd/lighttpd.conf
for f in /etc/lighttpd/conf-enabled/*; do [ -e "$f" ] && read_file "$f"; done 2>/dev/null
echo "-- pihole-FTL service --"
systemctl status pihole-FTL --no-pager 2>/dev/null | head -20 || true
# -----------------------------------------------------------------------------
# 7. Technitium DNS
# -----------------------------------------------------------------------------
section "7. TECHNITIUM DNS"
echo "-- technitium systemd unit --"
systemctl status technitium-dns --no-pager 2>/dev/null | head -20 || echo "(no technitium-dns unit)"
echo "-- any unit containing technitium --"
systemctl list-units --all --no-pager 2>/dev/null | grep -i technitium || true
echo "-- unit file path --"
sudo -n systemctl cat technitium-dns 2>/dev/null || systemctl cat technitium-dns 2>/dev/null || true
# Technitium common install locations
for d in /etc/technitium /etc/technitium/dns /opt/technitium /opt/technitium/dns /var/lib/technitium /usr/local/technitium; do
echo "### checking $d ###"
if sudo -n test -d "$d" 2>/dev/null || [ -d "$d" ]; then
list_dir "$d"
# recurse one level for config files
for sub in "$d" "$d"/*; do
[ -e "$sub" ] || continue
if [ -f "$sub" ] && echo "$sub" | grep -Eq '\.(xml|json|conf|config|txt)$'; then
read_file "$sub"
fi
done
fi
done
echo "-- technitium config.xml / dnsServer.conf (search) --"
sudo -n find /etc/technitium /opt/technitium /var/lib/technitium -maxdepth 4 \
\( -name 'config.xml' -o -name '*.config' -o -name 'dnsServer.conf' -o -name 'blockList.txt' \) \
-print 2>/dev/null || true
# -----------------------------------------------------------------------------
# 8. Firewall / SELinux / misc
# -----------------------------------------------------------------------------
section "8. FIREWALL & MISC"
echo "-- nftables --"; sudo -n nft list ruleset 2>/dev/null | head -80 || true
echo "-- iptables --"; sudo -n iptables -S 2>/dev/null | head -40 || true
echo "-- ufw --"; sudo -n ufw status verbose 2>/dev/null || true
echo "-- firewalld --"; systemctl status firewalld --no-pager 2>/dev/null | head -8 || true
echo "-- selinux/apparmor --"; getenforce 2>/dev/null || echo "(SELinux not present)"; aa-status 2>/dev/null | head -5 || true
# -----------------------------------------------------------------------------
# 9. Cron / timers that maintain these services
# -----------------------------------------------------------------------------
section "9. CRON & TIMERS"
echo "-- root crontab --"; sudo -n crontab -l 2>/dev/null || echo "(n/a)"
echo "-- localuser crontab --"; crontab -l 2>/dev/null || echo "(none)"
echo "-- /etc/cron.d --"; ls -la /etc/cron.d 2>/dev/null
for f in /etc/cron.d/*pihole* /etc/cron.d/*technitium* /etc/cron.d/*gravity*; do
[ -e "$f" ] && read_file "$f"
done 2>/dev/null
echo "-- pihole timer --"; systemctl list-timers --all --no-pager 2>/dev/null | grep -Ei 'pihole|gravity|technitium' || true
printf '\n##### AUDIT END %s #####\n' "$AUDIT_DATE"
netinfra/deep-audit-netboot.sh
Executable
+67
View File
@@ -0,0 +1,67 @@
#!/usr/bin/env bash
# deep-audit-netboot.sh — READ-ONLY deep inspection. Uses `sudo` for docker/root files.
set -u
DG="sudo docker"
hdr() { printf '\n=== %s ===\n' "$1"; }
hdr "COMPOSE FILES: /root/pihole and /root/NTP"
for f in /root/pihole/docker-compose.yml /root/NTP/docker-compose.yml; do
printf '\n--- %s ---\n' "$f"
sudo cat "$f" 2>&1
done
hdr "DIR LAYOUT of compose project dirs"
sudo ls -la /root/pihole 2>&1
sudo ls -la /root/NTP 2>&1
sudo ls -la /root 2>&1
hdr "SEARCH entire FS for any technitium / dns compose files"
sudo find / -xdev -maxdepth 6 \( -iname 'docker-compose.y*ml' -o -iname 'compose.y*ml' \) -print 2>/dev/null \
| grep -Ei 'dns|technitium|tsys' || true
hdr "ALL CONTAINERS with compose labels"
$DG ps -a --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}\tWDIR={{.Label "com.docker.compose.project.working_dir"}}\tCFG={{.Label "com.docker.compose.project.config_files"}}\tSVC={{.Label "com.docker.compose.service"}}' 2>&1
hdr "DOCKER INSPECT pihole + tsys-ntp (and any dns/technitium container)"
for c in $($DG ps -aq 2>/dev/null); do
nm=$($DG inspect --format '{{.Name}} | image={{.Config.Image}} | proj={{index .Config.Labels "com.docker.compose.project"}}' "$c" 2>/dev/null)
printf '\n###### %s ######\n' "$nm"
$DG inspect "$c" 2>&1
done
hdr "PI-HOLE internal config (sudo docker exec, READ-ONLY)"
echo "-- ls /etc/pihole --"; $DG exec pihole ls -la /etc/pihole 2>&1 || true
echo "-- ls /etc/dnsmasq.d --"; $DG exec pihole ls -la /etc/dnsmasq.d 2>&1 || true
for f in setupVars.conf pihole-FTL.conf adlists.list custom.list local.list regex.list dhcp.leases static_ip.conf; do
echo "--- /etc/pihole/$f ---"; $DG exec pihole cat "/etc/pihole/$f" 2>&1 || true
done
echo "-- /etc/dnsmasq.d/* --"
$DG exec pihole sh -c 'for f in /etc/dnsmasq.d/*; do echo "--- $f ---"; cat "$f"; done' 2>&1 || true
echo "-- pihole version --"; $DG exec pihole pihole -v 2>&1 || true
echo "-- gravity row counts --"
$DG exec pihole sh -c 'for t in adlist domainlist client "group" info; do printf "%s=" "$t"; sqlite3 /etc/pihole/gravity.db "SELECT COUNT(*) FROM $t;" 2>/dev/null; done' 2>&1 || true
echo "-- adlist addresses --"
$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT address,enabled,comment FROM adlist;" 2>&1 || true
echo "-- domainlist (allow+deny, first 60) --"
$DG exec pihole sqlite3 /etc/pihole/gravity.db "SELECT type,domain,enabled,comment FROM domainlist LIMIT 60;" 2>&1 || true
hdr "CHRONY/NTP container config (tsys-ntp)"
$DG exec tsys-ntp sh -c 'echo "--- chrony.conf ---"; cat /etc/chrony/chrony.conf 2>/dev/null || cat /etc/chrony.conf 2>/dev/null || echo none; echo "--- ls /etc ---"; ls -la /etc 2>/dev/null | head -30' 2>&1 || true
$DG exec tsys-ntp chronyc -n sources 2>&1 || true
$DG exec tsys-ntp chronyc -n tracking 2>&1 || true
echo "-- bare metal ntpsec.conf --"; sudo cat /etc/ntpsec/ntp.conf 2>&1
hdr "TECHNITIUM volumes"
for v in dns_tsys-dns-config dns_tyss-dns-config; do
mnt=$($DG volume inspect --format '{{.Mountpoint}}' "$v" 2>/dev/null)
printf '\n--- volume %s -> %s ---\n' "$v" "$mnt"
[ -n "$mnt" ] || continue
sudo find "$mnt" -maxdepth 4 -type f 2>/dev/null | head -80
echo "-- config dir listing --"
sudo ls -laR "$mnt"/config 2>/dev/null | head -60 || sudo ls -laR "$mnt" 2>/dev/null | head -60 || true
echo "-- config.xml --"
sudo cat "$mnt"/config/config.xml 2>/dev/null | head -250 || true
done
hdr "DONE"
netinfra/netboot-audit.txt
+720
View File
@@ -0,0 +1,720 @@
This system is the property of Known Element Enterprises LLC.
Authorized uses only. All activity may be monitored and reported.
All activities subject to monitoring/recording/review in real time and/or at a later time.##### AUDIT START 2026-07-28T02:41:34Z #####
Audit host: pfv-netboot.knel.net
Audit user: localuser
Script: audit-netboot.sh (READ-ONLY)
========================================================================
SECTION: 1. SYSTEM BASICS
========================================================================
-- uname --
Linux pfv-netboot 6.1.0-44-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.164-1 (2026-03-09) x86_64 GNU/Linux
-- /etc/os-release --
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
-- uptime --
21:41:34 up 113 days, 15:32, 2 users, load average: 0.07, 0.07, 0.06
-- timezone --
Local time: Mon 2026-07-27 21:41:34 CDT
Universal time: Tue 2026-07-28 02:41:34 UTC
RTC time: Tue 2026-07-28 02:41:34
Time zone: US/Central (CDT, -0500)
System clock synchronized: yes
NTP service: n/a
RTC in local TZ: no
-- arch --
amd64
-- memory --
total used free shared buff/cache available
Mem: 1.9Gi 940Mi 66Mi 65Mi 1.1Gi 961Mi
Swap: 974Mi 315Mi 659Mi
-- disk --
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 491G 18G 448G 4% /
-- cpu count --
2
========================================================================
SECTION: 2. NETWORK
========================================================================
-- hostname --
pfv-netboot
pfv-netboot.knel.net
192.168.3.250 172.24.0.1 172.18.0.1 172.19.0.1 172.23.0.1 172.17.0.1 172.20.0.1 172.22.0.1 100.103.64.82 2600:1700:1d1:eb00:215:5dff:fe64:e81e fd7a:115c:a1e0::2901:4052
-- ip addr --
lo UNKNOWN 127.0.0.1/8 ::1/128
eth0 UP 192.168.3.250/22 2600:1700:1d1:eb00:215:5dff:fe64:e81e/64 fe80::215:5dff:fe64:e81e/64
eth1 UP
br-3d55385c5e7d UP 172.24.0.1/16 fe80::d883:2ff:fef8:79cd/64
br-50e2988e78eb DOWN 172.18.0.1/16
br-748fea589ab8 DOWN 172.19.0.1/16
br-b52d11330b20 DOWN 172.23.0.1/16
docker0 DOWN 172.17.0.1/16
br-f91c61cdba28 DOWN 172.20.0.1/16
br-25187260f675 DOWN 172.22.0.1/16
tailscale0 UNKNOWN 100.103.64.82/32 fd7a:115c:a1e0::2901:4052/128 fe80::42db:e6ff:fe57:431c/64
veth9ecb986@if2 UP fe80::c45b:62ff:fe19:6258/64
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:15:5d:64:e8:1e brd ff:ff:ff:ff:ff:ff
inet 192.168.3.250/22 brd 192.168.3.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 2600:1700:1d1:eb00:215:5dff:fe64:e81e/64 scope global dynamic mngtmpaddr
valid_lft 3391sec preferred_lft 3391sec
inet6 fe80::215:5dff:fe64:e81e/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:15:5d:64:e8:2a brd ff:ff:ff:ff:ff:ff
5: br-3d55385c5e7d: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether da:83:02:f8:79:cd brd ff:ff:ff:ff:ff:ff
inet 172.24.0.1/16 brd 172.24.255.255 scope global br-3d55385c5e7d
valid_lft forever preferred_lft forever
inet6 fe80::d883:2ff:fef8:79cd/64 scope link
valid_lft forever preferred_lft forever
6: br-50e2988e78eb: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether ca:f9:33:b2:b6:bb brd ff:ff:ff:ff:ff:ff
inet 172.18.0.1/16 brd 172.18.255.255 scope global br-50e2988e78eb
valid_lft forever preferred_lft forever
7: br-748fea589ab8: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 82:e8:2b:47:1e:91 brd ff:ff:ff:ff:ff:ff
inet 172.19.0.1/16 brd 172.19.255.255 scope global br-748fea589ab8
valid_lft forever preferred_lft forever
8: br-b52d11330b20: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether de:6e:f1:ec:24:64 brd ff:ff:ff:ff:ff:ff
inet 172.23.0.1/16 brd 172.23.255.255 scope global br-b52d11330b20
valid_lft forever preferred_lft forever
9: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 56:f9:55:99:fa:af brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
10: br-f91c61cdba28: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 8e:ed:24:fa:4b:4a brd ff:ff:ff:ff:ff:ff
inet 172.20.0.1/16 brd 172.20.255.255 scope global br-f91c61cdba28
valid_lft forever preferred_lft forever
11: br-25187260f675: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 82:af:8a:0a:64:01 brd ff:ff:ff:ff:ff:ff
inet 172.22.0.1/16 brd 172.22.255.255 scope global br-25187260f675
valid_lft forever preferred_lft forever
18: tailscale0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1280 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 100.103.64.82/32 scope global tailscale0
valid_lft forever preferred_lft forever
inet6 fd7a:115c:a1e0::2901:4052/128 scope global
valid_lft forever preferred_lft forever
inet6 fe80::42db:e6ff:fe57:431c/64 scope link stable-privacy
valid_lft forever preferred_lft forever
24: veth9ecb986@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-3d55385c5e7d state UP group default
link/ether c6:5b:62:19:62:58 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::c45b:62ff:fe19:6258/64 scope link
valid_lft forever preferred_lft forever
-- default route --
default via 192.168.3.254 dev eth0 onlink
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
172.18.0.0/16 dev br-50e2988e78eb proto kernel scope link src 172.18.0.1 linkdown
172.19.0.0/16 dev br-748fea589ab8 proto kernel scope link src 172.19.0.1 linkdown
172.20.0.0/16 dev br-f91c61cdba28 proto kernel scope link src 172.20.0.1 linkdown
172.22.0.0/16 dev br-25187260f675 proto kernel scope link src 172.22.0.1 linkdown
172.23.0.0/16 dev br-b52d11330b20 proto kernel scope link src 172.23.0.1 linkdown
172.24.0.0/16 dev br-3d55385c5e7d proto kernel scope link src 172.24.0.1
192.168.0.0/22 dev eth0 proto kernel scope link src 192.168.3.250
-- /etc/resolv.conf --
# resolv.conf(5) file generated by tailscale
# For more info, see https://tailscale.com/s/resolvconf-overwrite
# DO NOT EDIT THIS FILE BY HAND -- CHANGES WILL BE OVERWRITTEN
nameserver 100.100.100.100
nameserver fd7a:115c:a1e0::53
search knel.net
-- /etc/hosts --
127.0.0.1 localhost
127.0.1.1 pfv-netboot.knel.net pfv-netboot
# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
-- listening TCP/UDP sockets --
Netid State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
udp UNCONN 0 0 0.0.0.0:38908 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:53 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:67 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:46164 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:111 0.0.0.0:*
udp UNCONN 0 0 100.103.64.82:123 0.0.0.0:*
udp UNCONN 0 0 172.24.0.1:123 0.0.0.0:*
udp UNCONN 0 0 192.168.3.250:123 0.0.0.0:*
udp UNCONN 0 0 127.0.0.1:123 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:123 0.0.0.0:*
udp UNCONN 0 0 172.17.255.255:137 0.0.0.0:*
udp UNCONN 0 0 172.17.0.1:137 0.0.0.0:*
udp UNCONN 0 0 172.18.255.255:137 0.0.0.0:*
udp UNCONN 0 0 172.18.0.1:137 0.0.0.0:*
udp UNCONN 0 0 172.19.255.255:137 0.0.0.0:*
udp UNCONN 0 0 172.19.0.1:137 0.0.0.0:*
udp UNCONN 0 0 172.20.255.255:137 0.0.0.0:*
udp UNCONN 0 0 172.20.0.1:137 0.0.0.0:*
udp UNCONN 0 0 172.22.255.255:137 0.0.0.0:*
udp UNCONN 0 0 172.22.0.1:137 0.0.0.0:*
udp UNCONN 0 0 172.23.255.255:137 0.0.0.0:*
udp UNCONN 0 0 172.23.0.1:137 0.0.0.0:*
udp UNCONN 0 0 172.24.255.255:137 0.0.0.0:*
udp UNCONN 0 0 172.24.0.1:137 0.0.0.0:*
udp UNCONN 0 0 192.168.3.255:137 0.0.0.0:*
udp UNCONN 0 0 192.168.3.250:137 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:137 0.0.0.0:*
udp UNCONN 0 0 172.17.255.255:138 0.0.0.0:*
udp UNCONN 0 0 172.17.0.1:138 0.0.0.0:*
udp UNCONN 0 0 172.18.255.255:138 0.0.0.0:*
udp UNCONN 0 0 172.18.0.1:138 0.0.0.0:*
udp UNCONN 0 0 172.19.255.255:138 0.0.0.0:*
udp UNCONN 0 0 172.19.0.1:138 0.0.0.0:*
udp UNCONN 0 0 172.20.255.255:138 0.0.0.0:*
udp UNCONN 0 0 172.20.0.1:138 0.0.0.0:*
udp UNCONN 0 0 172.22.255.255:138 0.0.0.0:*
udp UNCONN 0 0 172.22.0.1:138 0.0.0.0:*
udp UNCONN 0 0 172.23.255.255:138 0.0.0.0:*
udp UNCONN 0 0 172.23.0.1:138 0.0.0.0:*
udp UNCONN 0 0 172.24.255.255:138 0.0.0.0:*
udp UNCONN 0 0 172.24.0.1:138 0.0.0.0:*
udp UNCONN 0 0 192.168.3.255:138 0.0.0.0:*
udp UNCONN 0 0 192.168.3.250:138 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:138 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:161 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:41257 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:20000 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:41641 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:59092 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:10000 0.0.0.0:*
udp UNCONN 0 0 127.0.0.1:786 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:40725 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:37749 0.0.0.0:*
udp UNCONN 0 0 [::]:53 [::]:*
udp UNCONN 0 0 [::]:34901 [::]:*
udp UNCONN 0 0 [::]:111 [::]:*
udp UNCONN 0 0 [fe80::c45b:62ff:fe19:6258]%veth9ecb986:123 [::]:*
udp UNCONN 0 0 [fe80::42db:e6ff:fe57:431c]%tailscale0:123 [::]:*
udp UNCONN 0 0 [fd7a:115c:a1e0::2901:4052]:123 [::]:*
udp UNCONN 0 0 [fe80::d883:2ff:fef8:79cd]%br-3d55385c5e7d:123 [::]:*
udp UNCONN 0 0 [fe80::215:5dff:fe64:e81e]%eth0:123 [::]:*
udp UNCONN 0 0 [2600:1700:1d1:eb00:215:5dff:fe64:e81e]:123 [::]:*
udp UNCONN 0 0 [::1]:123 [::]:*
udp UNCONN 0 0 [::]:123 [::]:*
udp UNCONN 0 0 [::]:43257 [::]:*
udp UNCONN 0 0 [::]:44469 [::]:*
udp UNCONN 0 0 [::]:41641 [::]:*
udp UNCONN 0 0 [::]:55132 [::]:*
udp UNCONN 0 0 [::]:34667 [::]:*
tcp LISTEN 0 4096 0.0.0.0:38435 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:20000 0.0.0.0:*
tcp LISTEN 0 5 127.0.0.1:555 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:10002 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:10003 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:10000 0.0.0.0:*
tcp LISTEN 0 4096 100.103.64.82:64362 0.0.0.0:*
tcp LISTEN 0 5 127.0.0.1:61209 0.0.0.0:*
tcp LISTEN 0 50 0.0.0.0:139 0.0.0.0:*
tcp LISTEN 0 64 0.0.0.0:36079 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:45295 0.0.0.0:*
tcp LISTEN 0 5 0.0.0.0:4330 0.0.0.0:*
tcp LISTEN 0 100 0.0.0.0:25 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 64 0.0.0.0:2049 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:53 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:40029 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:111 0.0.0.0:*
tcp LISTEN 0 50 0.0.0.0:445 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:58853 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:44322 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:44323 0.0.0.0:*
tcp LISTEN 0 5 0.0.0.0:44321 0.0.0.0:*
tcp LISTEN 0 4096 [fd7a:115c:a1e0::2901:4052]:52472 [::]:*
tcp LISTEN 0 4096 [::]:45755 [::]:*
tcp LISTEN 0 4096 [::]:60951 [::]:*
tcp LISTEN 0 4096 *:9090 *:*
tcp LISTEN 0 64 [::]:37813 [::]:*
tcp LISTEN 0 4096 [::]:10002 [::]:*
tcp LISTEN 0 4096 [::]:10003 [::]:*
tcp LISTEN 0 4096 [::]:10000 [::]:*
tcp LISTEN 0 4096 *:45876 *:*
tcp LISTEN 0 50 [::]:139 [::]:*
tcp LISTEN 0 4096 [::]:44271 [::]:*
tcp LISTEN 0 5 [::]:4330 [::]:*
tcp LISTEN 0 128 [::]:22 [::]:*
tcp LISTEN 0 64 [::]:2049 [::]:*
tcp LISTEN 0 4096 [::]:53 [::]:*
tcp LISTEN 0 4096 [::]:111 [::]:*
tcp LISTEN 0 4096 *:6556 *:*
tcp LISTEN 0 50 [::]:445 [::]:*
tcp LISTEN 0 4096 [::]:60725 [::]:*
tcp LISTEN 0 128 [::]:44322 [::]:*
tcp LISTEN 0 128 [::]:44323 [::]:*
tcp LISTEN 0 5 [::]:44321 [::]:*
-- /etc/network/interfaces --
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug eth0
iface eth0 inet static
address 192.168.3.250
netmask 255.255.252.0
gateway 192.168.3.254
#allow-hotplug eth1
#iface eth1 inet static
# address 10.100.100.4
# netmask 255.255.255.0
-- netplan --
-- systemd-networkd --
total 8
drwxr-xr-x 2 root root 4096 Mar 6 2025 .
drwxr-xr-x 5 root root 4096 Jul 20 17:55 ..
● State: n/a
Online state: unknown
Address: 192.168.3.250 on eth0
172.24.0.1 on br-3d55385c5e7d
172.18.0.1 on br-50e2988e78eb
172.19.0.1 on br-748fea589ab8
172.23.0.1 on br-b52d11330b20
172.17.0.1 on docker0
172.20.0.1 on br-f91c61cdba28
172.22.0.1 on br-25187260f675
100.103.64.82 on tailscale0
2600:1700:1d1:eb00:215:5dff:fe64:e81e on eth0
fd7a:115c:a1e0::2901:4052 on tailscale0
fe80::215:5dff:fe64:e81e on eth0
fe80::d883:2ff:fef8:79cd on br-3d55385c5e7d
fe80::42db:e6ff:fe57:431c on tailscale0
fe80::c45b:62ff:fe19:6258 on veth9ecb986
Gateway: 192.168.3.254 on eth0
fe80::6e4b:b4ff:fe10:4061 on eth0
========================================================================
SECTION: 3. RELEVANT SYSTEMD UNITS
========================================================================
-- all units matching dns|pihole|dnsmasq|technitium|ftl|ntp|chrony|timesync --
initrd-parse-etc.service loaded inactive dead Mountpoints Configured in the Real Root
ntpsec-rotate-stats.service loaded inactive dead Rotate ntpd stats
ntpsec-systemd-netif.service loaded inactive dead ntpsec-systemd-netif.service
ntpsec.service loaded active running Network Time Service
● systemd-resolved.service not-found inactive dead systemd-resolved.service
● systemd-timesyncd.service not-found inactive dead systemd-timesyncd.service
-- unit files (enabled state) --
ntpsec-systemd-netif.path enabled enabled
postfix-resolvconf.path disabled enabled
ntp.service alias -
ntpd.service alias -
ntpsec-rotate-stats.service static -
ntpsec-systemd-netif.service static -
ntpsec-wait.service disabled enabled
ntpsec.service enabled enabled
postfix-resolvconf.service disabled enabled
ntpsec-rotate-stats.timer enabled enabled
ntpsec.timer masked enabled
-- installed packages of interest --
ii dnsmasq-base 2.90-4~deb12u2 amd64 Small caching DNS proxy and DHCP/TFTP server - executable
ii ntpsec 1.2.2+dfsg1-1+deb12u1 amd64 Network Time Protocol daemon and utility programs
ii ntpsec-ntpdate 1.2.2+dfsg1-1+deb12u1 amd64 client for setting system time from NTP servers
ii ntpsec-ntpdig 1.2.2+dfsg1-1+deb12u1 amd64 ntpdig SNTP client
ii python3-ntp 1.2.2+dfsg1-1+deb12u1 amd64 Python 3 NTP Helper Classes
========================================================================
SECTION: 4. NTP
========================================================================
-- chrony --
-- chronyc sources/stats (if available) --
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
-- ntpsec / ntp classic --
● ntpsec.service - Network Time Service
Loaded: loaded (/lib/systemd/system/ntpsec.service; enabled; preset: enabled)
Active: active (running) since Mon 2026-07-20 17:56:32 CDT; 1 week 0 days ago
Docs: man:ntpd(8)
Process: 2124687 ExecStart=/usr/libexec/ntpsec/ntp-systemd-wrapper (code=exited, status=0/SUCCESS)
Main PID: 2124690 (ntpd)
Tasks: 1 (limit: 2219)
Memory: 10.7M
CPU: 34.324s
CGroup: /system.slice/ntpsec.service
└─2124690 /usr/sbin/ntpd -p /run/ntpd.pid -c /etc/ntpsec/ntp.conf -g -N -u ntpsec:ntpsec
● ntpsec.service - Network Time Service
Loaded: loaded (/lib/systemd/system/ntpsec.service; enabled; preset: enabled)
Active: active (running) since Mon 2026-07-20 17:56:32 CDT; 1 week 0 days ago
Docs: man:ntpd(8)
Process: 2124687 ExecStart=/usr/libexec/ntpsec/ntp-systemd-wrapper (code=exited, status=0/SUCCESS)
Main PID: 2124690 (ntpd)
Tasks: 1 (limit: 2219)
Memory: 10.7M
CPU: 34.324s
CGroup: /system.slice/ntpsec.service
└─2124690 /usr/sbin/ntpd -p /run/ntpd.pid -c /etc/ntpsec/ntp.conf -g -N -u ntpsec:ntpsec
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 37: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
driftfile /var/lib/ntp/ntp.drift
leapfile /usr/share/zoneinfo/leap-seconds.list
server pfvsvrpi.knel.net
restrict 127.0.0.1
restrict ::1
-- systemd-timesyncd --
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
-- openntpd --
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
========================================================================
SECTION: 5. DOCKER
========================================================================
-- docker version --
Client: Docker Engine - Community
Version: 29.6.2
API version: 1.55
Go version: go1.26.5
Git commit: dfc4efb
Built: Thu Jul 16 16:12:20 2026
OS/Arch: linux/amd64
Context: default
Client: Docker Engine - Community
Version: 29.6.2
API version: 1.55
Go version: go1.26.5
Git commit: dfc4efb
Built: Thu Jul 16 16:12:20 2026
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 29.6.2
API version: 1.55 (minimum version 1.40)
Go version: go1.26.5
Git commit: 3d80467
Built: Thu Jul 16 16:12:20 2026
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v2.2.6
GitCommit: 11ce9d5f3c68c941867e82890e93e815c1304f1b
runc:
Version: 1.3.6
GitCommit: v1.3.6-0-g491b69ba
docker-init:
Version: 0.19.0
GitCommit: de40ad0
-- containers (running) --
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1d09249f01b0 pihole/pihole:latest "start.sh" 5 months ago Up 44 minutes (healthy) 67/udp, 0.0.0.0:53->53/tcp, 0.0.0.0:53->53/udp, [::]:53->53/tcp, [::]:53->53/udp, 123/udp, 0.0.0.0:10002->80/tcp, [::]:10002->80/tcp, 0.0.0.0:10003->443/tcp, [::]:10003->443/tcp pihole
c33ced53142e dockurr/chrony "/bin/startup" 13 months ago Up 7 days (healthy) tsys-ntp
-- containers (all) --
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
1d09249f01b0 pihole/pihole:latest "start.sh" 5 months ago Up 44 minutes (healthy) 67/udp, 0.0.0.0:53->53/tcp, 0.0.0.0:53->53/udp, [::]:53->53/tcp, [::]:53->53/udp, 123/udp, 0.0.0.0:10002->80/tcp, [::]:10002->80/tcp, 0.0.0.0:10003->443/tcp, [::]:10003->443/tcp pihole
c33ced53142e dockurr/chrony "/bin/startup" 13 months ago Up 7 days (healthy) tsys-ntp
-- images --
IMAGE ID DISK USAGE CONTENT SIZE EXTRA
busybox:latest 6d3e4188a38a 4.28MB 0B
dockurr/chrony:latest 3b656f2feb55 15.4MB 0B U
pihole/pihole:latest 81365952d1f8 92.7MB 0B U
-- volumes --
DRIVER VOLUME NAME
local 0cb24520936997d233409ea07681920fdb03d92967856e849474cf90446dc426
local 0ccc1140e4b86442167f65d7caf43d8a3bc04fff2bef461f112d8b7c8e4bd4c8
local 1d7f70d65f5d739f737c3bc0d1b0b2b5cf4f192477dcbbdb95bca344310bff84
local 2a1726279d1d382ab0a2bcb2079f60e65fc0fd0d40880074038e0c678b2a7f56
local 3d207dff87da7dc7d11b70f1e595cc5cce001392cb663ac4d664f5710b9879b8
local 4f8894b9f0206c743be26e6b644e3bf017c5b6e190ac7da31e7ffb7132a1ca2f
local 7c210964fd48cd91c8e37543d562569ec523208b5ea421f8fb47dc73a6d724ee
local 8ccc4c07bf45d05bc922d4f619780f60cac0149b4dd7de5be7720f72f47e6c10
local 71c98aa3d5fb266ef291ac4fc95b11fc83475b9bb0f70999e77095249ad18bf5
local 83f977471ac2f4ad6521ad50f0311ee36547701d00d9a869903f0ba667c2000d
local 87eced0295c12870220fc746ef685530cb5b8e20c4afafbfd573ff773459cd9f
local 95eb8a7b389b9a04bd90f4cee485bd015b7c3fd311c1750c7596a2b2fde1605d
local 562da84ce678f8d8b9cc45665099f2562beb4a41c860b5951ef8b88a8f682e41
local 8974fb973f2be9c05c1ec6548ffaad0b1caa302972f7567c3fb3a97d59b9076b
local 201278554f24a7af6284b9564c45656e6d2dc7b9daea24fe52707d7825cb5385
local b24c0bd3e25987537a92078d6f521f5f155e7379295d21e43c500cbabc8a02e0
local bb353f885d620d98dbb147f0ff51f38a87725669b1a14390fb825509878a7e0b
local bc96d56b965f1e238afd47e483b93f1ec9ed59e8458e8e851ffc9710582a5475
local c329a5b999999c074bf767bc1f7b3647cf5d4d0624b7d45d63658cbb723e5d46
local cf03c8ea64823ac8db5c6df1093b2d9f5146838dd8dc2986bdc485e8b59d0d24
local d9500add842368a6d637090569e5c13cb9f068cbfeb14e02c597ae82f2807e47
local da3164486ea59aaa9fd14113faa9104411c61ad36a9487e3ce780e86a96dac1f
local dae4bbdcbb634b817b47558df3908906fe7635ad57377389616189bd0f2d7b64
local dddeee12833ed02185e00732ddb8c12ef6a6b88c49e7df4e48f7a27b71182bf5
local dns_tsys-dns-config
local dns_tyss-dns-config
local e054c42f042095e22be91432ca87e524fc0ebbc447a800c263c389577e190629
local eda6668262ccd43f0e3c0b9e3c42711cc516f372b46ef174bca34d96d17740b8
local f53cb9833442fd9499260fa8073a04a15f5c96a5576aa96d781bc24441906942
local f142ec0c6150618365447908d5753ff5ff7defcbf27c210702a17ad205dc4aba
local f350de2e220f4983bca2e7ca96374a597a075779224b036ccd76deb280ba8922
-- networks --
NETWORK ID NAME DRIVER SCOPE
0f56376f4515 bridge bridge local
f91c61cdba28 dns_default bridge local
b24303598fa1 host host local
25187260f675 msmtpd_default bridge local
748fea589ab8 netdisco_default bridge local
bd40993bc47f none null local
b52d11330b20 ntp_default bridge local
3d55385c5e7d pihole_default bridge local
50e2988e78eb root_default bridge local
-- compose files in common locations --
### /opt ###
total 16
drwxr-xr-x 4 root root 4096 Dec 29 2025 .
drwxr-xr-x 20 root root 4096 Jul 20 17:55 ..
drwxr-xr-x 2 beszel beszel 4096 Apr 6 01:08 beszel-agent
drwx--x--x 4 root root 4096 Jun 10 2025 containerd
========================================================================
SECTION: 6. PI-HOLE
========================================================================
(pihole command not on PATH)
-- /etc/pihole listing --
main: line 54: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
(cannot list /etc/pihole)
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
-- /etc/pihole/*.conf (all) --
-- /etc/dnsmasq.d listing --
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
main: line 54: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
(cannot list /etc/dnsmasq.d)
-- /etc/dnsmasq.conf (if present) --
-- gravity.db schema + row counts (Pi-hole v5+) --
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
(no gravity.db found)
-- lighttpd / pihole web admin --
main: line 44: printf: --: invalid option
printf: usage: printf [-v var] format [arguments]
alias.url += ("/javascript" => "/usr/share/javascript")
-- pihole-FTL service --
========================================================================
SECTION: 7. TECHNITIUM DNS
========================================================================
-- technitium systemd unit --
-- any unit containing technitium --
-- unit file path --
### checking /etc/technitium ###
### checking /etc/technitium/dns ###
### checking /opt/technitium ###
### checking /opt/technitium/dns ###
### checking /var/lib/technitium ###
### checking /usr/local/technitium ###
-- technitium config.xml / dnsServer.conf (search) --
========================================================================
SECTION: 8. FIREWALL & MISC
========================================================================
-- nftables --
table ip raw {
chain PREROUTING {
type filter hook prerouting priority raw; policy accept;
iifname != "br-b52d11330b20" ip daddr 172.23.0.2 counter packets 0 bytes 0 drop
iifname != "br-3d55385c5e7d" ip daddr 172.24.0.2 counter packets 0 bytes 0 drop
}
chain OUTPUT {
type filter hook output priority raw; policy accept;
}
}
table ip filter {
chain INPUT {
type filter hook input priority filter; policy accept;
counter packets 8461563 bytes 1841523123 jump ts-input
}
chain FORWARD {
type filter hook forward priority filter; policy drop;
counter packets 20387709 bytes 3821595842 jump DOCKER-USER
counter packets 20387709 bytes 3821595842 jump DOCKER-FORWARD
counter packets 1064 bytes 88643 jump ts-forward
}
chain OUTPUT {
type filter hook output priority filter; policy accept;
}
chain DOCKER-FORWARD {
counter packets 20387709 bytes 3821595842 jump DOCKER-CT
counter packets 14776132 bytes 2075147539 jump DOCKER-INTERNAL
counter packets 14776132 bytes 2075147539 jump DOCKER-BRIDGE
iifname "br-748fea589ab8" counter packets 0 bytes 0 accept
iifname "br-b52d11330b20" counter packets 0 bytes 0 accept
iifname "br-f91c61cdba28" counter packets 0 bytes 0 accept
iifname "br-25187260f675" counter packets 0 bytes 0 accept
iifname "br-3d55385c5e7d" counter packets 10132822 bytes 1741327665 accept
iifname "br-50e2988e78eb" counter packets 0 bytes 0 accept
iifname "docker0" counter packets 0 bytes 0 accept
}
chain DOCKER-USER {
}
chain ts-input {
iifname "lo" ip saddr 100.103.64.82 counter packets 0 bytes 0 accept
iifname "tailscale0" counter packets 512217 bytes 46924098 accept
udp dport 41641 counter packets 3360373 bytes 516737750 accept
iifname != "tailscale0" ip saddr 100.115.92.0/23 counter packets 0 bytes 0 return
iifname != "tailscale0" ip saddr 100.64.0.0/10 counter packets 0 bytes 0 drop
}
chain ts-forward {
iifname "tailscale0" counter packets 28 bytes 2578 meta mark set mark and 0xff00ffff xor 0x40000
meta mark & 0x00ff0000 == 0x00040000 counter packets 28 bytes 2578 accept
oifname "tailscale0" ip saddr 100.64.0.0/10 counter packets 0 bytes 0 drop
oifname "tailscale0" counter packets 15 bytes 1554 accept
}
chain DOCKER {
iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" ip daddr 172.24.0.2 tcp dport 443 counter packets 0 bytes 0 accept
iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" ip daddr 172.24.0.2 tcp dport 80 counter packets 0 bytes 0 accept
iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" ip daddr 172.24.0.2 udp dport 53 counter packets 32283 bytes 2368019 accept
iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" ip daddr 172.24.0.2 tcp dport 53 counter packets 638 bytes 34248 accept
iifname != "br-748fea589ab8" oifname "br-748fea589ab8" counter packets 0 bytes 0 drop
iifname != "br-b52d11330b20" oifname "br-b52d11330b20" counter packets 0 bytes 0 drop
iifname != "br-f91c61cdba28" oifname "br-f91c61cdba28" counter packets 0 bytes 0 drop
iifname != "br-25187260f675" oifname "br-25187260f675" counter packets 0 bytes 0 drop
iifname != "br-3d55385c5e7d" oifname "br-3d55385c5e7d" counter packets 0 bytes 0 drop
iifname != "br-50e2988e78eb" oifname "br-50e2988e78eb" counter packets 0 bytes 0 drop
iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop
}
chain DOCKER-BRIDGE {
oifname "br-748fea589ab8" counter packets 0 bytes 0 jump DOCKER
oifname "br-b52d11330b20" counter packets 0 bytes 0 jump DOCKER
oifname "br-f91c61cdba28" counter packets 0 bytes 0 jump DOCKER
oifname "br-25187260f675" counter packets 0 bytes 0 jump DOCKER
oifname "br-3d55385c5e7d" counter packets 4643310 bytes 333819874 jump DOCKER
oifname "br-50e2988e78eb" counter packets 0 bytes 0 jump DOCKER
-- iptables --
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-BRIDGE
-N DOCKER-CT
-N DOCKER-FORWARD
-N DOCKER-INTERNAL
-N DOCKER-USER
-N ts-forward
-N ts-input
-A INPUT -j ts-input
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-FORWARD
-A FORWARD -j ts-forward
-A DOCKER -d 172.24.0.2/32 ! -i br-3d55385c5e7d -o br-3d55385c5e7d -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.24.0.2/32 ! -i br-3d55385c5e7d -o br-3d55385c5e7d -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.24.0.2/32 ! -i br-3d55385c5e7d -o br-3d55385c5e7d -p udp -m udp --dport 53 -j ACCEPT
-A DOCKER -d 172.24.0.2/32 ! -i br-3d55385c5e7d -o br-3d55385c5e7d -p tcp -m tcp --dport 53 -j ACCEPT
-A DOCKER ! -i br-748fea589ab8 -o br-748fea589ab8 -j DROP
-A DOCKER ! -i br-b52d11330b20 -o br-b52d11330b20 -j DROP
-A DOCKER ! -i br-f91c61cdba28 -o br-f91c61cdba28 -j DROP
-A DOCKER ! -i br-25187260f675 -o br-25187260f675 -j DROP
-A DOCKER ! -i br-3d55385c5e7d -o br-3d55385c5e7d -j DROP
-A DOCKER ! -i br-50e2988e78eb -o br-50e2988e78eb -j DROP
-A DOCKER ! -i docker0 -o docker0 -j DROP
-A DOCKER-BRIDGE -o br-748fea589ab8 -j DOCKER
-A DOCKER-BRIDGE -o br-b52d11330b20 -j DOCKER
-A DOCKER-BRIDGE -o br-f91c61cdba28 -j DOCKER
-A DOCKER-BRIDGE -o br-25187260f675 -j DOCKER
-A DOCKER-BRIDGE -o br-3d55385c5e7d -j DOCKER
-A DOCKER-BRIDGE -o br-50e2988e78eb -j DOCKER
-A DOCKER-BRIDGE -o docker0 -j DOCKER
-A DOCKER-CT -o br-748fea589ab8 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-b52d11330b20 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-f91c61cdba28 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-25187260f675 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-3d55385c5e7d -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-50e2988e78eb -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-- ufw --
-- firewalld --
-- selinux/apparmor --
(SELinux not present)
========================================================================
SECTION: 9. CRON & TIMERS
========================================================================
-- root crontab --
(n/a)
-- localuser crontab --
(none)
-- /etc/cron.d --
-- pihole timer --
##### AUDIT END 2026-07-28T02:41:34Z #####
netinfra/netboot-deep-audit.txt
+896
View File
@@ -0,0 +1,896 @@
This system is the property of Known Element Enterprises LLC.
Authorized uses only. All activity may be monitored and reported.
All activities subject to monitoring/recording/review in real time and/or at a later time.
=== COMPOSE FILES: /root/pihole and /root/NTP ===
--- /root/pihole/docker-compose.yml ---
# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
pihole:
container_name: pihole
image: pihole/pihole:latest
ports:
# DNS Ports
- "53:53/tcp"
- "53:53/udp"
# Default HTTP Port
- "10002:80/tcp"
# Default HTTPs Port. FTL will generate a self-signed certificate
- "10003:443/tcp"
# Uncomment the below if using Pi-hole as your DHCP Server
#- "67:67/udp"
# Uncomment the line below if you are using Pi-hole as your NTP server
#- "123:123/udp"
environment:
# Set the appropriate timezone for your location from
# https://en.wikipedia.org/wiki/List_of_tz_database_time_zones, e.g:
TZ: 'America/Chicago'
# Set a password to access the web interface. Not setting one will result in a random password being assigned
FTLCONF_webserver_api_password: 'REDACTED_PASSWORD'
# If using Docker's default `bridge` network setting the dns listening mode should be set to 'all'
FTLCONF_dns_listeningMode: 'all'
# Volumes store your data between container upgrades
volumes:
# For persisting Pi-hole's databases and common configuration file
- './etc-pihole:/etc/pihole'
# Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
#- './etc-dnsmasq.d:/etc/dnsmasq.d'
cap_add:
# See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
# Required if you are using Pi-hole as your DHCP server, else not needed
#- NET_ADMIN
# Required if you are using Pi-hole as your NTP client to be able to set the host's system time
#- SYS_TIME
# Optional, if Pi-hole should get some more processing time
- SYS_NICE
restart: always
--- /root/NTP/docker-compose.yml ---
services:
ntp:
image: dockurr/chrony
container_name: tsys-ntp
environment:
NTP_SERVERS: "pool.ntp.org"
ports:
- 100.103.64.82:123:123/udp
restart: always
=== DIR LAYOUT of compose project dirs ===
total 16
drwxr-xr-x 3 root root 4096 Feb 6 18:32 .
drwx------ 10 root root 4096 Apr 5 06:16 ..
-rw-r--r-- 1 root root 2089 Feb 6 18:30 docker-compose.yml
drwxr-xr-x 7 localuser localuser 4096 Jul 27 20:57 etc-pihole
total 12
drwxr-xr-x 2 root root 4096 Jul 2 2025 .
drwx------ 10 root root 4096 Apr 5 06:16 ..
-rw-r--r-- 1 root root 188 Jun 23 2025 docker-compose.yml
total 84
drwx------ 10 root root 4096 Apr 5 06:16 .
drwxr-xr-x 20 root root 4096 Jul 20 17:55 ..
-rw------- 1 root root 4113 Jun 18 2025 .bash_history
-rw-r--r-- 1 root root 571 Apr 10 2021 .bashrc
drwx------ 3 root root 4096 Jun 10 2025 .config
drwxr-xr-x 2 root root 4096 Apr 5 06:16 dhcp
-rw------- 1 root root 2960 Feb 16 19:26 dhcpmigrate
drwxr-xr-x 10 root root 4096 Jul 2 2025 FetchApply
drwx------ 3 root root 4096 Jul 10 2025 .gnupg
-rw------- 1 root root 40 Apr 5 06:15 .lesshst
drwxr-xr-x 2 root root 4096 Jul 2 2025 NTP
drwxr-xr-x 3 root root 4096 Feb 6 18:32 pihole
-rw-r--r-- 1 root root 161 Jul 9 2019 .profile
drwx------ 2 root root 4096 Jun 13 2025 .ssh
drwxr-xr-x 2 root root 4096 Jul 27 09:08 .tmp
-rw------- 1 root root 15370 Apr 5 06:15 .viminfo
-rw-r--r-- 1 root root 180 Jun 17 2025 .wget-hsts
=== SEARCH entire FS for any technitium / dns compose files ===
=== ALL CONTAINERS with compose labels ===
NAMES IMAGE STATUS WDIR=working dir CFG=config files SVC=service
pihole pihole/pihole:latest Up 48 minutes (healthy) WDIR=/root/pihole CFG=/root/pihole/docker-compose.yml SVC=pihole
tsys-ntp dockurr/chrony Up 7 days (healthy) WDIR=/root/NTP CFG=/root/NTP/docker-compose.yml SVC=ntp
=== DOCKER INSPECT pihole + tsys-ntp (and any dns/technitium container) ===
###### /pihole | image=pihole/pihole:latest | proj=pihole ######
[
{
"Id": "1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82",
"Created": "2026-02-07T00:32:57.4029722Z",
"Path": "start.sh",
"Args": [],
"State": {
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"Dead": false,
"Pid": 1222239,
"ExitCode": 0,
"Error": "",
"StartedAt": "2026-07-28T01:57:27.732608642Z",
"FinishedAt": "2026-07-28T01:57:27.095917957Z",
"Health": {
"Status": "healthy",
"FailingStreak": 0,
"Log": [
{
"Start": "2026-07-27T21:43:50.682295418-05:00",
"End": "2026-07-27T21:43:50.921778022-05:00",
"ExitCode": 0,
"Output": "127.0.0.1\n"
},
{
"Start": "2026-07-27T21:44:20.925872245-05:00",
"End": "2026-07-27T21:44:21.170837655-05:00",
"ExitCode": 0,
"Output": "127.0.0.1\n"
},
{
"Start": "2026-07-27T21:44:51.175444367-05:00",
"End": "2026-07-27T21:44:51.416140073-05:00",
"ExitCode": 0,
"Output": "127.0.0.1\n"
},
{
"Start": "2026-07-27T21:45:21.417102671-05:00",
"End": "2026-07-27T21:45:21.689964304-05:00",
"ExitCode": 0,
"Output": "127.0.0.1\n"
},
{
"Start": "2026-07-27T21:45:51.691119192-05:00",
"End": "2026-07-27T21:45:51.945416009-05:00",
"ExitCode": 0,
"Output": "127.0.0.1\n"
}
]
}
},
"Image": "sha256:81365952d1f82f114cea23ef5a2961c73da61ec5dc0e066ee2f625b1eb98854b",
"ResolvConfPath": "/var/lib/docker/containers/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82/resolv.conf",
"HostnamePath": "/var/lib/docker/containers/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82/hostname",
"HostsPath": "/var/lib/docker/containers/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82/hosts",
"LogPath": "/var/lib/docker/containers/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82/1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82-json.log",
"Name": "/pihole",
"RestartCount": 2,
"Driver": "overlay2",
"Platform": "linux",
"MountLabel": "",
"ProcessLabel": "",
"AppArmorProfile": "docker-default",
"ExecIDs": null,
"HostConfig": {
"Binds": [
"/root/pihole/etc-pihole:/etc/pihole:rw"
],
"ContainerIDFile": "",
"LogConfig": {
"Type": "json-file",
"Config": {}
},
"NetworkMode": "pihole_default",
"PortBindings": {
"443/tcp": [
{
"HostIp": "",
"HostPort": "10003"
}
],
"53/tcp": [
{
"HostIp": "",
"HostPort": "53"
}
],
"53/udp": [
{
"HostIp": "",
"HostPort": "53"
}
],
"80/tcp": [
{
"HostIp": "",
"HostPort": "10002"
}
]
},
"RestartPolicy": {
"Name": "always",
"MaximumRetryCount": 0
},
"AutoRemove": false,
"VolumeDriver": "",
"VolumesFrom": null,
"ConsoleSize": [
0,
0
],
"CapAdd": [
"CAP_SYS_NICE"
],
"CapDrop": null,
"CgroupnsMode": "private",
"Dns": [],
"DnsOptions": [],
"DnsSearch": [],
"ExtraHosts": [],
"GroupAdd": null,
"IpcMode": "private",
"Cgroup": "",
"Links": null,
"OomScoreAdj": 0,
"PidMode": "",
"Privileged": false,
"PublishAllPorts": false,
"ReadonlyRootfs": false,
"SecurityOpt": null,
"UTSMode": "",
"UsernsMode": "",
"ShmSize": 67108864,
"Runtime": "runc",
"Isolation": "",
"CpuShares": 0,
"Memory": 0,
"NanoCpus": 0,
"CgroupParent": "",
"BlkioWeight": 0,
"BlkioWeightDevice": null,
"BlkioDeviceReadBps": null,
"BlkioDeviceWriteBps": null,
"BlkioDeviceReadIOps": null,
"BlkioDeviceWriteIOps": null,
"CpuPeriod": 0,
"CpuQuota": 0,
"CpuRealtimePeriod": 0,
"CpuRealtimeRuntime": 0,
"CpusetCpus": "",
"CpusetMems": "",
"Devices": null,
"DeviceCgroupRules": null,
"DeviceRequests": null,
"MemoryReservation": 0,
"MemorySwap": 0,
"MemorySwappiness": null,
"OomKillDisable": null,
"PidsLimit": null,
"Ulimits": null,
"CpuCount": 0,
"CpuPercent": 0,
"IOMaximumIOps": 0,
"IOMaximumBandwidth": 0,
"MaskedPaths": [
"/proc/acpi",
"/proc/asound",
"/proc/interrupts",
"/proc/kcore",
"/proc/keys",
"/proc/latency_stats",
"/proc/sched_debug",
"/proc/scsi",
"/proc/timer_list",
"/proc/timer_stats",
"/sys/devices/virtual/powercap",
"/sys/firmware"
],
"ReadonlyPaths": [
"/proc/bus",
"/proc/fs",
"/proc/irq",
"/proc/sys",
"/proc/sysrq-trigger"
]
},
"GraphDriver": {
"Data": {
"ID": "1d09249f01b08b0ffea241791a11cb8f4b1f06e0a9e258f23d6a483e0b6cfa82",
"LowerDir": "/var/lib/docker/overlay2/69d0a802515624c1ced9a0ae9e09ed76f94b3077d3d5628914ccee60941a51ac-init/diff:/var/lib/docker/overlay2/c026d6eb78252f15477a6ed84b76e7855b525a582aafa11ae38d89d932433d9c/diff:/var/lib/docker/overlay2/38b4e9cd3ba8e5a10ee7dffbf21e4e552bc30ca96df4b3fc46532d8c2f4828d0/diff:/var/lib/docker/overlay2/10c7b2bc8ab474a29274b66e94e43e31db3dd248dbe0c8e8f7069e305efc7a41/diff:/var/lib/docker/overlay2/de5840a2fb5aed78f79984d980d59f9e50839ddb792146cc7a33d185b8b3eee2/diff:/var/lib/docker/overlay2/5f0504c14572ef5e745e8b06b8f1b3ce74027bce323b7bd1153c828e0dd97d52/diff:/var/lib/docker/overlay2/7a3eefaaac250fbb5430c567e9d12320c35c5da67ad3f8b7b8a7accccc435f18/diff:/var/lib/docker/overlay2/a6c7374834f19eabf6bd3e36f8ad8f2e20e3cf32c4bfea3133ef432b163dac8b/diff:/var/lib/docker/overlay2/28ffada6ac95ffb6c493b1908d00f9cfa096069fd715fa101b910b628835bed5/diff:/var/lib/docker/overlay2/0e79a525158aef2253d47f7f429c50e48c49fec81329f2be7fc580d906528087/diff:/var/lib/docker/overlay2/7365834c77d4c08772f03b8fc0fa6d21b593d3ac70a9ec66fe77ed403d0ef064/diff:/var/lib/docker/overlay2/4bd0de3b67968b6681a962ee9fb89b6bb09b07e5d2ba0d0f85f0561cd9442d32/diff",
"MergedDir": "/var/lib/docker/overlay2/69d0a802515624c1ced9a0ae9e09ed76f94b3077d3d5628914ccee60941a51ac/merged",
"UpperDir": "/var/lib/docker/overlay2/69d0a802515624c1ced9a0ae9e09ed76f94b3077d3d5628914ccee60941a51ac/diff",
"WorkDir": "/var/lib/docker/overlay2/69d0a802515624c1ced9a0ae9e09ed76f94b3077d3d5628914ccee60941a51ac/work"
},
"Name": "overlay2"
},
"Mounts": [
{
"Type": "bind",
"Source": "/root/pihole/etc-pihole",
"Destination": "/etc/pihole",
"Mode": "rw",
"RW": true,
"Propagation": "rprivate"
}
],
"Config": {
"Hostname": "1d09249f01b0",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": true,
"AttachStderr": true,
"ExposedPorts": {
"123/udp": {},
"443/tcp": {},
"53/tcp": {},
"53/udp": {},
"67/udp": {},
"80/tcp": {}
},
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"FTLCONF_webserver_api_password=REDACTED_PASSWORD",
"FTLCONF_dns_listeningMode=all",
"TZ=America/Chicago",
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"DNSMASQ_USER=pihole",
"FTL_CMD=no-daemon"
],
"Cmd": null,
"Healthcheck": {
"Test": [
"CMD-SHELL",
"dig -p $(pihole-FTL --config dns.port) +short +norecurse +retry=0 @127.0.0.1 pi.hole || exit 1"
]
},
"Image": "pihole/pihole:latest",
"Volumes": null,
"WorkingDir": "/",
"Entrypoint": [
"start.sh"
],
"Labels": {
"com.docker.compose.config-hash": "60a181f601a1959cb6dda5f5889ff706d9986f7db015664ab40608253b83348e",
"com.docker.compose.container-number": "1",
"com.docker.compose.depends_on": "",
"com.docker.compose.image": "sha256:81365952d1f82f114cea23ef5a2961c73da61ec5dc0e066ee2f625b1eb98854b",
"com.docker.compose.oneoff": "False",
"com.docker.compose.project": "pihole",
"com.docker.compose.project.config_files": "/root/pihole/docker-compose.yml",
"com.docker.compose.project.working_dir": "/root/pihole",
"com.docker.compose.service": "pihole",
"com.docker.compose.version": "5.0.2",
"org.opencontainers.image.created": "2025-06-06T19:35:20.360Z",
"org.opencontainers.image.description": "Pi-hole in a docker container",
"org.opencontainers.image.licenses": "NOASSERTION",
"org.opencontainers.image.revision": "b56e67ef6808de2854d30481ebcd40bcd2b43445",
"org.opencontainers.image.source": "https://github.com/pi-hole/docker-pi-hole",
"org.opencontainers.image.title": "docker-pi-hole",
"org.opencontainers.image.url": "https://github.com/pi-hole/docker-pi-hole",
"org.opencontainers.image.version": "2025.06.1"
}
},
"NetworkSettings": {
"SandboxID": "4c83df12c0f6aa377cdd17640639b35e737eb7530c6798d7b80eb3135dbfbd20",
"SandboxKey": "/var/run/docker/netns/4c83df12c0f6",
"Ports": {
"123/udp": null,
"443/tcp": [
{
"HostIp": "0.0.0.0",
"HostPort": "10003"
},
{
"HostIp": "::",
"HostPort": "10003"
}
],
"53/tcp": [
{
"HostIp": "0.0.0.0",
"HostPort": "53"
},
{
"HostIp": "::",
"HostPort": "53"
}
],
"53/udp": [
{
"HostIp": "0.0.0.0",
"HostPort": "53"
},
{
"HostIp": "::",
"HostPort": "53"
}
],
"67/udp": null,
"80/tcp": [
{
"HostIp": "0.0.0.0",
"HostPort": "10002"
},
{
"HostIp": "::",
"HostPort": "10002"
}
]
},
"Networks": {
"pihole_default": {
"IPAMConfig": null,
"Links": null,
"Aliases": [
"pihole",
"pihole"
],
"DriverOpts": null,
"GwPriority": 0,
"NetworkID": "3d55385c5e7d7d4ca5ddec3f98533d43452cdc2fda68831ac4a16aeb0d42867c",
"EndpointID": "aadb163f607f9247c8ad41f8cadac2282272501c60e3ea7fa31fd2d584271447",
"Gateway": "172.24.0.1",
"IPAddress": "172.24.0.2",
"MacAddress": "7e:48:e2:84:c5:15",
"IPPrefixLen": 16,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"DNSNames": [
"pihole",
"1d09249f01b0"
]
}
}
}
}
]
###### /tsys-ntp | image=dockurr/chrony | proj=ntp ######
[
{
"Id": "c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908",
"Created": "2025-06-23T16:51:39.454106229Z",
"Path": "/bin/startup",
"Args": [],
"State": {
"Status": "running",
"Running": true,
"Paused": false,
"Restarting": false,
"OOMKilled": false,
"Dead": false,
"Pid": 2109237,
"ExitCode": 0,
"Error": "",
"StartedAt": "2026-07-20T22:55:49.597671587Z",
"FinishedAt": "2026-07-20T22:55:37.650310687Z",
"Health": {
"Status": "healthy",
"FailingStreak": 0,
"Log": [
{
"Start": "2026-07-27T21:44:16.437981113-05:00",
"End": "2026-07-27T21:44:16.501904568-05:00",
"ExitCode": 0,
"Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525388062 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n"
},
{
"Start": "2026-07-27T21:44:46.50366458-05:00",
"End": "2026-07-27T21:44:46.566905934-05:00",
"ExitCode": 0,
"Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525413632 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n"
},
{
"Start": "2026-07-27T21:45:16.568367435-05:00",
"End": "2026-07-27T21:45:16.632376789-05:00",
"ExitCode": 0,
"Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525439143 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n"
},
{
"Start": "2026-07-27T21:45:46.63406538-05:00",
"End": "2026-07-27T21:45:46.695064332-05:00",
"ExitCode": 0,
"Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525464714 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n"
},
{
"Start": "2026-07-27T21:46:16.697074212-05:00",
"End": "2026-07-27T21:46:16.763778169-05:00",
"ExitCode": 0,
"Output": "Reference ID : 00000000 ()\nStratum : 0\nRef time (UTC) : Thu Jan 01 00:00:00 1970\nSystem time : 0.525490224 seconds slow of NTP time\nLast offset : +0.000000000 seconds\nRMS offset : 0.000000000 seconds\nFrequency : 0.849 ppm slow\nResidual freq : +0.000 ppm\nSkew : 0.000 ppm\nRoot delay : 1.000000000 seconds\nRoot dispersion : 1.000000000 seconds\nUpdate interval : 0.0 seconds\nLeap status : Not synchronised\n"
}
]
}
},
"Image": "sha256:3b656f2feb55b967a6773337da2f982bc489a463066e2a4d3e82d04e53f13fbc",
"ResolvConfPath": "/var/lib/docker/containers/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908/resolv.conf",
"HostnamePath": "/var/lib/docker/containers/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908/hostname",
"HostsPath": "/var/lib/docker/containers/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908/hosts",
"LogPath": "/var/lib/docker/containers/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908/c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908-json.log",
"Name": "/tsys-ntp",
"RestartCount": 0,
"Driver": "overlay2",
"Platform": "linux",
"MountLabel": "",
"ProcessLabel": "",
"AppArmorProfile": "docker-default",
"ExecIDs": null,
"HostConfig": {
"Binds": null,
"ContainerIDFile": "",
"LogConfig": {
"Type": "json-file",
"Config": {}
},
"NetworkMode": "ntp_default",
"PortBindings": {
"123/udp": [
{
"HostIp": "100.103.64.82",
"HostPort": "123"
}
]
},
"RestartPolicy": {
"Name": "always",
"MaximumRetryCount": 0
},
"AutoRemove": false,
"VolumeDriver": "",
"VolumesFrom": null,
"ConsoleSize": [
0,
0
],
"CapAdd": null,
"CapDrop": null,
"CgroupnsMode": "private",
"Dns": [],
"DnsOptions": [],
"DnsSearch": [],
"ExtraHosts": [],
"GroupAdd": null,
"IpcMode": "private",
"Cgroup": "",
"Links": null,
"OomScoreAdj": 0,
"PidMode": "",
"Privileged": false,
"PublishAllPorts": false,
"ReadonlyRootfs": false,
"SecurityOpt": null,
"UTSMode": "",
"UsernsMode": "",
"ShmSize": 67108864,
"Runtime": "runc",
"Isolation": "",
"CpuShares": 0,
"Memory": 0,
"NanoCpus": 0,
"CgroupParent": "",
"BlkioWeight": 0,
"BlkioWeightDevice": null,
"BlkioDeviceReadBps": null,
"BlkioDeviceWriteBps": null,
"BlkioDeviceReadIOps": null,
"BlkioDeviceWriteIOps": null,
"CpuPeriod": 0,
"CpuQuota": 0,
"CpuRealtimePeriod": 0,
"CpuRealtimeRuntime": 0,
"CpusetCpus": "",
"CpusetMems": "",
"Devices": null,
"DeviceCgroupRules": null,
"DeviceRequests": null,
"MemoryReservation": 0,
"MemorySwap": 0,
"MemorySwappiness": null,
"OomKillDisable": null,
"PidsLimit": null,
"Ulimits": null,
"CpuCount": 0,
"CpuPercent": 0,
"IOMaximumIOps": 0,
"IOMaximumBandwidth": 0,
"Mounts": [
{
"Type": "volume",
"Source": "e054c42f042095e22be91432ca87e524fc0ebbc447a800c263c389577e190629",
"Target": "/run/chrony"
},
{
"Type": "volume",
"Source": "8974fb973f2be9c05c1ec6548ffaad0b1caa302972f7567c3fb3a97d59b9076b",
"Target": "/var/lib/chrony"
},
{
"Type": "volume",
"Source": "562da84ce678f8d8b9cc45665099f2562beb4a41c860b5951ef8b88a8f682e41",
"Target": "/etc/chrony"
}
],
"MaskedPaths": [
"/proc/asound",
"/proc/acpi",
"/proc/interrupts",
"/proc/kcore",
"/proc/keys",
"/proc/latency_stats",
"/proc/timer_list",
"/proc/timer_stats",
"/proc/sched_debug",
"/proc/scsi",
"/sys/firmware",
"/sys/devices/virtual/powercap"
],
"ReadonlyPaths": [
"/proc/bus",
"/proc/fs",
"/proc/irq",
"/proc/sys",
"/proc/sysrq-trigger"
]
},
"GraphDriver": {
"Data": {
"ID": "c33ced53142e99743b52fb71e834543017f4312360cfef1fe7fd6857b0676908",
"LowerDir": "/var/lib/docker/overlay2/40b6c14e2ca0bdc9b2624ca63e7e7b4ad588098c00e53ebf18b4aac5a132c6db-init/diff:/var/lib/docker/overlay2/6de110c8e8511a542a0541ecba7006ff7fe26ee0e91b738d87fec292a76a5cb1/diff:/var/lib/docker/overlay2/5dc67368f8acabea18fc0be0b07d52e5a82362b5d57119871e3471c509927a73/diff:/var/lib/docker/overlay2/ce6cab3e3329a7148ae6c5e55af761b4b533eac36dcd08cb34d3de88e958d92f/diff",
"MergedDir": "/var/lib/docker/overlay2/40b6c14e2ca0bdc9b2624ca63e7e7b4ad588098c00e53ebf18b4aac5a132c6db/merged",
"UpperDir": "/var/lib/docker/overlay2/40b6c14e2ca0bdc9b2624ca63e7e7b4ad588098c00e53ebf18b4aac5a132c6db/diff",
"WorkDir": "/var/lib/docker/overlay2/40b6c14e2ca0bdc9b2624ca63e7e7b4ad588098c00e53ebf18b4aac5a132c6db/work"
},
"Name": "overlay2"
},
"Mounts": [
{
"Type": "volume",
"Name": "8974fb973f2be9c05c1ec6548ffaad0b1caa302972f7567c3fb3a97d59b9076b",
"Source": "/var/lib/docker/volumes/8974fb973f2be9c05c1ec6548ffaad0b1caa302972f7567c3fb3a97d59b9076b/_data",
"Destination": "/var/lib/chrony",
"Driver": "local",
"Mode": "z",
"RW": true,
"Propagation": ""
},
{
"Type": "volume",
"Name": "562da84ce678f8d8b9cc45665099f2562beb4a41c860b5951ef8b88a8f682e41",
"Source": "/var/lib/docker/volumes/562da84ce678f8d8b9cc45665099f2562beb4a41c860b5951ef8b88a8f682e41/_data",
"Destination": "/etc/chrony",
"Driver": "local",
"Mode": "z",
"RW": true,
"Propagation": ""
},
{
"Type": "volume",
"Name": "e054c42f042095e22be91432ca87e524fc0ebbc447a800c263c389577e190629",
"Source": "/var/lib/docker/volumes/e054c42f042095e22be91432ca87e524fc0ebbc447a800c263c389577e190629/_data",
"Destination": "/run/chrony",
"Driver": "local",
"Mode": "z",
"RW": true,
"Propagation": ""
}
],
"Config": {
"Hostname": "c33ced53142e",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": true,
"AttachStderr": true,
"ExposedPorts": {
"123/udp": {}
},
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"NTP_SERVERS=pool.ntp.org",
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"NTP_DIRECTIVES=ratelimit\\nrtcsync"
],
"Cmd": null,
"Healthcheck": {
"Test": [
"CMD-SHELL",
"chronyc -n tracking || exit 1"
]
},
"Image": "dockurr/chrony",
"Volumes": {
"/etc/chrony": {},
"/run/chrony": {},
"/var/lib/chrony": {}
},
"WorkingDir": "/",
"Entrypoint": [
"/bin/startup"
],
"Labels": {
"com.docker.compose.config-hash": "b9a2451b9ec10e82b113b417df6060f18aab234f117063b84ac7a29455f2feb0",
"com.docker.compose.container-number": "1",
"com.docker.compose.depends_on": "",
"com.docker.compose.image": "sha256:3b656f2feb55b967a6773337da2f982bc489a463066e2a4d3e82d04e53f13fbc",
"com.docker.compose.oneoff": "False",
"com.docker.compose.project": "ntp",
"com.docker.compose.project.config_files": "/root/NTP/docker-compose.yml",
"com.docker.compose.project.working_dir": "/root/NTP",
"com.docker.compose.replace": "61f92d4c43f32567409816af5e3c1c9622aedcb5e35b27b25980282fa3c3e1b3",
"com.docker.compose.service": "ntp",
"com.docker.compose.version": "2.36.2",
"org.opencontainers.image.created": "2025-06-12T01:51:48.447Z",
"org.opencontainers.image.description": "🕒 chronyd NTP server in a Docker container.",
"org.opencontainers.image.licenses": "MIT",
"org.opencontainers.image.revision": "43fb0f2b381bccfef5123971a51baf450ab24464",
"org.opencontainers.image.source": "https://github.com/dockur/chrony",
"org.opencontainers.image.title": "Chrony",
"org.opencontainers.image.url": "https://github.com/dockur/chrony",
"org.opencontainers.image.version": "4.7"
}
},
"NetworkSettings": {
"SandboxID": "ccaa71c75942abc56df6ae1c89a8c2ae91e769ed52eab64635a63f8ee996f782",
"SandboxKey": "/var/run/docker/netns/ccaa71c75942",
"Ports": {},
"Networks": {}
}
}
]
=== PI-HOLE internal config (sudo docker exec, READ-ONLY) ===
-- ls /etc/pihole --
total 2545492
drwxr-xr-x 7 pihole pihole 4096 Jul 27 20:57 .
drwxr-xr-x 1 root root 4096 Feb 6 18:32 ..
-rw-r----- 1 pihole pihole 65 Jun 23 2025 adlists.list
-rw-r----- 1 pihole pihole 44 Jul 27 20:57 cli_pw
drwxr-xr-x 2 pihole pihole 4096 Apr 6 10:07 config_backups
-rw-r----- 1 pihole pihole 0 Jun 18 2025 dhcp.leases
-rw-r----- 1 pihole pihole 5753 Apr 6 10:07 dnsmasq.conf
-rw-r----- 1 pihole pihole 5500928 Jul 26 04:51 gravity.db
drwxr-xr-x 2 pihole pihole 4096 Jul 26 04:51 gravity_backups
-rw-r----- 1 pihole pihole 4751360 Jul 19 04:51 gravity_old.db
drwxr-xr-x 2 pihole pihole 4096 Jun 18 2025 hosts
drwxr-xr-x 2 pihole pihole 4096 Jul 26 04:51 listsCache
-rw-r----- 1 root root 421 Jul 27 20:57 logrotate
drwxr-xr-x 2 pihole pihole 4096 Jun 18 2025 migration_backup
-rw-r----- 1 pihole pihole 2591891456 Jul 27 21:40 pihole-FTL.db
-rw-r----- 1 pihole pihole 32768 Jul 27 21:46 pihole-FTL.db-shm
-rw-r----- 1 pihole pihole 4272472 Jul 27 21:46 pihole-FTL.db-wal
-rw-r----- 1 pihole pihole 55996 Apr 6 10:07 pihole.toml
-rw------- 1 pihole pihole 713 Jun 18 2025 tls.crt
-rw------- 1 pihole pihole 1734 Jun 18 2025 tls.pem
-rw------- 1 pihole pihole 733 Jun 18 2025 tls_ca.crt
-rw-r--r-- 1 pihole pihole 376 Jul 27 20:57 versions
-- ls /etc/dnsmasq.d --
ls: cannot access '/etc/dnsmasq.d': No such file or directory
--- /etc/pihole/setupVars.conf ---
cat: /etc/pihole/setupVars.conf: No such file or directory
--- /etc/pihole/pihole-FTL.conf ---
cat: /etc/pihole/pihole-FTL.conf: No such file or directory
--- /etc/pihole/adlists.list ---
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
--- /etc/pihole/custom.list ---
cat: /etc/pihole/custom.list: No such file or directory
--- /etc/pihole/local.list ---
cat: /etc/pihole/local.list: No such file or directory
--- /etc/pihole/regex.list ---
cat: /etc/pihole/regex.list: No such file or directory
--- /etc/pihole/dhcp.leases ---
--- /etc/pihole/static_ip.conf ---
cat: /etc/pihole/static_ip.conf: No such file or directory
-- /etc/dnsmasq.d/* --
--- /etc/dnsmasq.d/* ---
cat: '/etc/dnsmasq.d/*': No such file or directory
-- pihole version --
Core version is v6.1.2 (Latest: v6.4.3)
Web version is v6.2.1 (Latest: v6.6)
FTL version is v6.2.2 (Latest: v6.7)
-- gravity row counts --
adlist=domainlist=client=group=info=-- adlist addresses --
OCI runtime exec failed: exec failed: unable to start container process: exec: "sqlite3": executable file not found in $PATH
-- domainlist (allow+deny, first 60) --
OCI runtime exec failed: exec failed: unable to start container process: exec: "sqlite3": executable file not found in $PATH
=== CHRONY/NTP container config (tsys-ntp) ===
--- chrony.conf ---
# https://github.com/dockur/chrony
# chrony.conf file generated by startup script
# located at /bin/startup
# time servers provided by NTP_SERVER environment variables.
server pool.ntp.org iburst
driftfile /var/lib/chrony/chrony.drift
makestep 0.1 3
ratelimit
rtcsync
allow all
--- ls /etc ---
total 176
drwxr-xr-x 1 root root 4096 Jun 23 2025 .
drwxr-xr-x 1 root root 4096 Jun 23 2025 ..
-rw-r--r-- 1 root root 21 Jan 8 2025 alpine-release
drwxr-xr-x 1 root root 4096 Jun 12 2025 apk
drwxr-xr-x 2 root root 4096 Jan 8 2025 busybox-paths.d
drwxr-xr-x 2 chrony chrony 4096 Jun 23 2025 chrony
drwxr-xr-x 2 root root 4096 Jan 8 2025 crontabs
-rw-r--r-- 1 root root 89 Jan 4 2025 fstab
-rw-r--r-- 1 root root 530 Jun 12 2025 group
-rw-r--r-- 1 root root 524 Jun 12 2025 group-
-rw-r--r-- 1 root root 13 Jul 20 22:55 hostname
-rw-r--r-- 1 root root 148 Jul 20 22:55 hosts
-rw-r--r-- 1 root root 570 Jan 4 2025 inittab
-rw-r--r-- 1 root root 77 Jan 8 2025 issue
drwxr-xr-x 1 root root 4096 Jun 12 2025 logrotate.d
drwxr-xr-x 2 root root 4096 Jan 8 2025 modprobe.d
-rw-r--r-- 1 root root 15 Jan 4 2025 modules
drwxr-xr-x 2 root root 4096 Jan 8 2025 modules-load.d
-rw-r--r-- 1 root root 284 Jan 4 2025 motd
lrwxrwxrwx 1 root root 12 Jun 23 2025 mtab -> /proc/mounts
drwxr-xr-x 8 root root 4096 Jan 8 2025 network
-rw-r--r-- 1 root root 205 Jan 4 2025 nsswitch.conf
drwxr-xr-x 2 root root 4096 Jan 8 2025 opt
lrwxrwxrwx 1 root root 21 Jan 8 2025 os-release -> ../usr/lib/os-release
-rw-r--r-- 1 root root 756 Jun 12 2025 passwd
-rw-r--r-- 1 root root 702 Jan 4 2025 passwd-
drwxr-xr-x 7 root root 4096 Jan 8 2025 periodic
drwxr-xr-x 2 root root 4096 Jun 12 2025 pkcs11
-rw-r--r-- 1 root root 547 Jan 4 2025 profile
MS Name/IP address Stratum Poll Reach LastRx Last sample
===============================================================================
Reference ID : 00000000 ()
Stratum : 0
Ref time (UTC) : Thu Jan 01 00:00:00 1970
System time : 0.525492370 seconds slow of NTP time
Last offset : +0.000000000 seconds
RMS offset : 0.000000000 seconds
Frequency : 0.849 ppm slow
Residual freq : +0.000 ppm
Skew : 0.000 ppm
Root delay : 1.000000000 seconds
Root dispersion : 1.000000000 seconds
Update interval : 0.0 seconds
Leap status : Not synchronised
-- bare metal ntpsec.conf --
driftfile /var/lib/ntp/ntp.drift
leapfile /usr/share/zoneinfo/leap-seconds.list
server pfvsvrpi.knel.net
restrict 127.0.0.1
restrict ::1
=== TECHNITIUM volumes ===
--- volume dns_tsys-dns-config -> /var/lib/docker/volumes/dns_tsys-dns-config/_data ---
/var/lib/docker/volumes/dns_tsys-dns-config/_data/stats/2025062320.stat
/var/lib/docker/volumes/dns_tsys-dns-config/_data/stats/2025062321.stat
/var/lib/docker/volumes/dns_tsys-dns-config/_data/dns.config
/var/lib/docker/volumes/dns_tsys-dns-config/_data/auth.config
/var/lib/docker/volumes/dns_tsys-dns-config/_data/logs/2025-06-23.log
/var/lib/docker/volumes/dns_tsys-dns-config/_data/scopes/Default.scope
/var/lib/docker/volumes/dns_tsys-dns-config/_data/log.config
/var/lib/docker/volumes/dns_tsys-dns-config/_data/self-signed-cert.pfx
/var/lib/docker/volumes/dns_tsys-dns-config/_data/cache.bin
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/199.86.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/knel.net.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/119.127.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/46.96.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/181.103.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/184.108.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/211.114.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/145.105.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/97.82.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/194.67.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/2.108.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/75.110.100.in-addr.arpa.zone
/var/lib/docker/volumes/dns_tsys-dns-config/_data/zones/64.103.100.in-addr.arpa.zone
-- config dir listing --
-- config.xml --
--- volume dns_tyss-dns-config -> /var/lib/docker/volumes/dns_tyss-dns-config/_data ---
-- config dir listing --
-- config.xml --
=== DONE ===