mrcharles
cb327bcfed
pi-hole on netinfra-01/02 now conditionally forwards 192.168.0.0/16
reverse lookups to this node's Technitium over dnsnet, alongside the
existing knel.net + 100.64/10 pair. Technitium stays the single source
of truth; pollers (NetDisco, phpIPAM, UNPoller, Wazuh soon) resolving
via either node's :53 now get LAN PTRs. Both live revServer arrays and
this compose file are in sync; validated with forward, PTR (192.168 +
100.x), and external lookups against both nodes.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
61 lines
2.1 KiB
YAML
61 lines
2.1 KiB
YAML
services:
|
|
pihole:
|
|
container_name: pihole
|
|
# Root cause of the 2026-08 gravity.db corruption: default /dev/shm (64M)
|
|
# was too small for FTL's shared-memory metrics. 1024M has been stable.
|
|
shm_size: '1024M'
|
|
image: pihole/pihole:2026.07.0
|
|
hostname: pihole
|
|
entrypoint: ["/usr/local/bin/gravity-validate.sh"]
|
|
ports:
|
|
- "53:53/tcp"
|
|
- "53:53/udp"
|
|
- "10002:80/tcp"
|
|
- "10003:443/tcp"
|
|
environment:
|
|
TZ: 'America/Chicago'
|
|
FTLCONF_webserver_api_password: '${PIHOLE_WEB_PASSWORD}'
|
|
FTLCONF_dns_listeningMode: 'all'
|
|
# Rate-limiting disabled (count=0). Uptime Kuma on Cloudron VPS sends
|
|
# high-volume DNS queries for monitoring; default 1000/60s limit was
|
|
# causing intermittent REFUSED responses → Uptime Kuma flapping.
|
|
FTLCONF_dns_rateLimit_count: '0'
|
|
FTLCONF_dns_rateLimit_interval: '0'
|
|
FTLCONF_dns_upstreams: '["8.8.8.8"]'
|
|
# Conditional forwarding: knel.net + 100.64/10 + 192.168/16 all go to
|
|
# this node's Technitium (tsys-dns) over the shared dnsnet bridge —
|
|
# Technitium is the single source of truth for knel.net zones. Set
|
|
# live 2026-08-26 [#449]; mirrored here so recreation keeps it.
|
|
FTLCONF_dns_revServers: '["true,100.64.0.0/10,10.53.0.53,knel.net","true,192.168.0.0/16,10.53.0.53"]'
|
|
volumes:
|
|
- './etc-pihole:/etc/pihole'
|
|
- './etc-dnsmasq.d:/etc/dnsmasq.d'
|
|
- './gravity-validate.sh:/usr/local/bin/gravity-validate.sh:ro'
|
|
cap_add:
|
|
- SYS_NICE
|
|
restart: always
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "dig +short +norecurse @127.0.0.1 pi.hole >/dev/null 2>&1 && test -s /etc/pihole/gravity.db || exit 1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
labels:
|
|
autoheal: "true"
|
|
networks:
|
|
- default
|
|
- dnsnet
|
|
autoheal:
|
|
container_name: autoheal
|
|
image: willfarrell/autoheal:1.2.0
|
|
environment:
|
|
AUTOHEAL_CONTAINER_LABEL: autoheal
|
|
AUTOHEAL_INTERVAL: 30
|
|
AUTOHEAL_START_PERIOD: 60
|
|
volumes:
|
|
- '/var/run/docker.sock:/var/run/docker.sock:ro'
|
|
restart: always
|
|
networks:
|
|
dnsnet:
|
|
external: true
|