From d6988bb35f7237bf57c050e58ac42f5d1cf96abf Mon Sep 17 00:00:00 2001 From: reachableceo Date: Thu, 6 Aug 2026 13:59:45 -0500 Subject: [PATCH] fix(netinfra): disable Pi-hole rate-limiting causing Uptime Kuma flapping Root cause of intermittent DNS up/down alerts: Pi-hole's default rate-limit (1000 queries/60s per client) was throttling Uptime Kuma on the Cloudron VPS (tsys-cloudron, 100.107.35.78). Uptime Kuma sends high-volume DNS queries to monitor dozens of hosts; when it exceeded the limit, Pi-hole responded REFUSED, which Uptime Kuma detected as DNS being down. This happened every 1-2 minutes. Evidence: 40 rate-limiting events against 100.107.35.78 in recent netinfra-01 Pi-hole logs. Also 10.53.0.1 (Docker bridge gateway) hit 4852 queries in a single 60s window. Fix: Set dns.rateLimit.count=0 and dns.rateLimit.interval=0 on both nodes (private tailnet, no DNS amplification risk). Also persisted in docker-compose.yml via FTLCONF env vars. Combined with prior IPv6 fix (4f82520), this resolves all known causes of DNS flapping. [#376] --- netinfra/pihole/README.md | 12 +++++++++++- netinfra/pihole/docker-compose.yml | 5 +++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/netinfra/pihole/README.md b/netinfra/pihole/README.md index e49a749..f2ad36c 100644 --- a/netinfra/pihole/README.md +++ b/netinfra/pihole/README.md @@ -34,14 +34,24 @@ docker compose up -d Files are deployed to `/home/localuser/services/pihole/` on each node. Volumes (`./etc-pihole`, `./etc-dnsmasq.d`) hold the persistent state. -## IPv6 disabled +## IPv6 disabled + Rate-limiting disabled +### IPv6 Both netinfra nodes run **IPv4-only**. IPv6 is disabled at the kernel level (`/etc/sysctl.d/99-disable-ipv6.conf`) because netinfra-01 has no IPv6 internet route, and Pi-hole's default IPv6 upstream (Google `2001:4860:4860::8888`) was causing continuous "Network unreachable" errors + intermittent DNS failures detected by Uptime Kuma. The upstream is now `8.8.8.8` (IPv4 only). +### Rate-limiting +Pi-hole's default rate-limit (1000 queries / 60 seconds per client) was +**the root cause of Uptime Kuma DNS flapping**. Uptime Kuma runs on the +Cloudron VPS (`tsys-cloudron`, `100.107.35.78`) and sends high-volume DNS +queries to monitor dozens of hosts. When it exceeded 1000 queries/60s, +Pi-hole responded with REFUSED, which Uptime Kuma detected as DNS being +down. Rate-limiting is now disabled (`count=0, interval=0`) since this is a +private tailnet with no risk of DNS amplification attacks. + ## Verify ```bash diff --git a/netinfra/pihole/docker-compose.yml b/netinfra/pihole/docker-compose.yml index 6faf0a2..99effb8 100644 --- a/netinfra/pihole/docker-compose.yml +++ b/netinfra/pihole/docker-compose.yml @@ -16,6 +16,11 @@ services: TZ: 'America/Chicago' FTLCONF_webserver_api_password: '${PIHOLE_WEB_PASSWORD}' FTLCONF_dns_listeningMode: 'all' + # Rate-limiting disabled (count=0). Uptime Kuma on Cloudron VPS sends + # high-volume DNS queries for monitoring; default 1000/60s limit was + # causing intermittent REFUSED responses → Uptime Kuma flapping. + FTLCONF_dns_rateLimit_count: '0' + FTLCONF_dns_rateLimit_interval: '0' FTLCONF_dns_upstreams: '["8.8.8.8"]' volumes: - './etc-pihole:/etc/pihole'