mrcharles
30ddb37b34
Commit 33b5c76 claimed to harden Pi-hole on both DNS nodes but only
modified markdown — the working docker-compose.yml, gravity-validate.sh,
healthcheck, and autoheal config were never written to the repo, leaving
the DNS hardening unreproducible from version control.
This commits the live, verified-working config from the boxes into
netinfra/pihole/:
- docker-compose.yml (shm_size 1024M root-cause fix, healthcheck, autoheal)
- gravity-validate.sh (pre-start SQLite header check, auto-quarantine corrupt DB)
- .env.example (web UI password templated; real .env gitignored)
Defends against the gravity.db / /dev/shm corruption production outage.
The live password is templated as ${PIHOLE_WEB_PASSWORD} so no secret
enters git.
[#376]
1.7 KiB
1.7 KiB
netinfra/pihole/ — Pi-hole recursive DNS (pfv-netinfra-01/02)
Redmine: #376 (up/down alerts + commit hardening) · #357 (cluster build, closed)
Pi-hole v6 runs as the recursive resolver on port 53 of both DNS nodes.
Technitium (tsys-dns) runs as the authoritative server on port 5300; the two
share the dnsnet Docker network so Pi-hole can conditional-forward knel.net
zones to Technitium.
Hardening (defense-in-depth against gravity.db corruption)
The operator hit a production outage when Pi-hole's /dev/shm was too small,
corrupting gravity.db. The live config on both nodes now includes:
shm_size: 1024M— fixes the root cause (default 64M was too small).gravity-validate.sh— entrypoint that checks the SQLite header ofgravity.dbbefore start; auto-moves a corrupt/empty DB aside so Pi-hole can regenerate it cleanly.- Healthcheck —
dig +norecurse @127.0.0.1 pi.hole+ gravity.db non-empty; fails the container if DNS or the DB is broken. autohealsidecar — restarts any container labeledautoheal=truethat goes unhealthy.
Deploy
The compose reads the web UI password from a gitignored .env:
cd netinfra/pihole/
cp .env.example .env # then edit .env and set PIHOLE_WEB_PASSWORD
docker compose up -d
Files are deployed to /home/localuser/services/pihole/ on each node. Volumes
(./etc-pihole, ./etc-dnsmasq.d) hold the persistent state.
Verify
dig @127.0.0.1 +short google.com # recursive
dig @127.0.0.1 +short git.knownelement.com # knel.net via Technitium forward
docker inspect pihole --format '{{.State.Health.Status}}'