Files

T

mrcharles 4f82520e0e fix(netinfra): kill IPv6 on DNS nodes to stop Pi-hole flapping

Root cause of Uptime Kuma DNS up/down alerts: Pi-hole's upstream config
included Google IPv6 DNS (2001:4860:4860::8888), but netinfra-01 has no
IPv6 internet route. Every forwarded query to the IPv6 upstream failed
with "Network unreachable", causing intermittent DNS resolution
failures every ~8 seconds.

Fix applied to both netinfra-01 and netinfra-02:
- Pi-hole upstream set to 8.8.8.8 only (IPv4); removed 192.168.3.16
  (retired netboot) and 2001:4860:4860::8888 (IPv6 Google DNS)
- IPv6 disabled at kernel level (/etc/sysctl.d/99-disable-ipv6.conf)
- knel.net authoritative resolution unchanged (Technitium via revServers)

Verified: zero IPv6 warnings, zero connection errors, DNS resolving
cleanly from all paths after fix.

[#376]

2026-08-06 13:11:38 -05:00

2.1 KiB

Raw Blame History

netinfra/pihole/ — Pi-hole recursive DNS (pfv-netinfra-01/02)

Redmine: #376 (up/down alerts + commit hardening) · #357 (cluster build, closed)

Pi-hole v6 runs as the recursive resolver on port 53 of both DNS nodes. Technitium (tsys-dns) runs as the authoritative server on port 5300; the two share the dnsnet Docker network so Pi-hole can conditional-forward knel.net zones to Technitium.

Hardening (defense-in-depth against gravity.db corruption)

The operator hit a production outage when Pi-hole's /dev/shm was too small, corrupting gravity.db. The live config on both nodes now includes:

shm_size: 1024M — fixes the root cause (default 64M was too small).
gravity-validate.sh — entrypoint that checks the SQLite header of gravity.db before start; auto-moves a corrupt/empty DB aside so Pi-hole can regenerate it cleanly.
Healthcheck — dig +norecurse @127.0.0.1 pi.hole + gravity.db non-empty; fails the container if DNS or the DB is broken.
autoheal sidecar — restarts any container labeled autoheal=true that goes unhealthy.

Deploy

The compose reads the web UI password from a gitignored .env:

cd netinfra/pihole/
cp .env.example .env          # then edit .env and set PIHOLE_WEB_PASSWORD
docker compose up -d

Files are deployed to /home/localuser/services/pihole/ on each node. Volumes (./etc-pihole, ./etc-dnsmasq.d) hold the persistent state.

IPv6 disabled

Both netinfra nodes run IPv4-only. IPv6 is disabled at the kernel level (/etc/sysctl.d/99-disable-ipv6.conf) because netinfra-01 has no IPv6 internet route, and Pi-hole's default IPv6 upstream (Google 2001:4860:4860::8888) was causing continuous "Network unreachable" errors + intermittent DNS failures detected by Uptime Kuma. The upstream is now 8.8.8.8 (IPv4 only).

Verify

dig @127.0.0.1 +short google.com        # recursive
dig @127.0.0.1 +short git.knownelement.com   # knel.net via Technitium forward
docker inspect pihole --format '{{.State.Health.Status}}'

2.1 KiB Raw Blame History