mrcharles
30ddb37b34
Commit 33b5c76 claimed to harden Pi-hole on both DNS nodes but only
modified markdown — the working docker-compose.yml, gravity-validate.sh,
healthcheck, and autoheal config were never written to the repo, leaving
the DNS hardening unreproducible from version control.
This commits the live, verified-working config from the boxes into
netinfra/pihole/:
- docker-compose.yml (shm_size 1024M root-cause fix, healthcheck, autoheal)
- gravity-validate.sh (pre-start SQLite header check, auto-quarantine corrupt DB)
- .env.example (web UI password templated; real .env gitignored)
Defends against the gravity.db / /dev/shm corruption production outage.
The live password is templated as ${PIHOLE_WEB_PASSWORD} so no secret
enters git.
[#376]
43 lines
799 B
Plaintext
43 lines
799 B
Plaintext
# Crush internal state
|
|
.crush/
|
|
|
|
# OS/editor
|
|
.DS_Store
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
\#*\#
|
|
.\#*
|
|
|
|
# Python bytecode
|
|
__pycache__/
|
|
*.pyc
|
|
|
|
# Temporary files
|
|
*.tmp
|
|
*.bak
|
|
*.log.tmp
|
|
|
|
# LOGFILENAME artifacts: the framework (Logging.sh + PrettyPrint.sh) appends
|
|
# every print_info/print_error line to LOGFILENAME, defined as
|
|
# "$0.<Weekday>-YYYY-MM-DD-HH:MM:SS.$$". Running any script that sources the
|
|
# framework therefore drops a timestamped log file next to it.
|
|
*.Monday-*
|
|
*.Tuesday-*
|
|
*.Wednesday-*
|
|
*.Thursday-*
|
|
*.Friday-*
|
|
*.Saturday-*
|
|
*.Sunday-*
|
|
|
|
# Sensitive exports / runtime data
|
|
dns-cluster-setup/.export/
|
|
returned-logs/
|
|
|
|
# Kubernetes secrets (kubeconfig contains embedded client certs)
|
|
k8s/kubeconfig.yaml
|
|
k8s/*.token
|
|
|
|
# Pi-hole web UI password (real value only in on-box .env, never committed)
|
|
netinfra/pihole/.env
|