91 lines
2.7 KiB
Nix
91 lines
2.7 KiB
Nix
{ config, lib, ... }:
|
|
let
|
|
name = "pihole";
|
|
podman = config.profile.podman;
|
|
pihole = podman.pihole;
|
|
inherit (lib) mkIf attrsets;
|
|
ip = "10.88.1.1";
|
|
image = "docker.io/pihole/pihole:latest";
|
|
piholeDNSIPBind = "192.168.100.3";
|
|
in
|
|
{
|
|
config = mkIf (podman.enable && pihole.enable) {
|
|
services.caddy.virtualHosts."pihole.tigor.web.id".extraConfig = ''
|
|
@root path /
|
|
redir @root /admin
|
|
reverse_proxy ${ip}:80
|
|
'';
|
|
|
|
sops.secrets."pihole/env" = {
|
|
sopsFile = ../../secrets/pihole.yaml;
|
|
};
|
|
|
|
networking.nameservers = [ piholeDNSIPBind ];
|
|
|
|
# We have refresh the custom.list dns list when caddy virtual hosts changes,
|
|
# the easiest way to do so is to restart the pihole container.
|
|
#
|
|
# This works by collecting all the virtual hosts defined in caddy
|
|
# and check if the length of the list changes, if it does, we restart the pihole container.
|
|
systemd.services."podman-${name}".restartTriggers = attrsets.mapAttrsToList (name: _: name) config.services.caddy.virtualHosts;
|
|
environment.etc."pihole/custom.list" = {
|
|
# Copy file instead of symlink
|
|
mode = "0444";
|
|
|
|
# Creates a pihole custom.list file with the following pattern:
|
|
#
|
|
# custom.list:
|
|
# 192.168.100.5 {domain_name_1}
|
|
# 192.168.100.5 {domain_name_2}
|
|
#
|
|
# For each domain defined in services.caddy.virtualHosts
|
|
text =
|
|
let
|
|
inherit (lib) strings attrsets;
|
|
in
|
|
''${strings.concatStringsSep "\n" (
|
|
attrsets.mapAttrsToList (name: _: "192.168.100.5 ${strings.removePrefix "https://" name}") config.services.caddy.virtualHosts
|
|
)}
|
|
'';
|
|
};
|
|
virtualisation.oci-containers.containers.${name} = {
|
|
inherit image;
|
|
hostname = name;
|
|
environment = {
|
|
TZ = "Asia/Jakarta";
|
|
PIHOLE_DNS_ = "192.168.100.5";
|
|
DHCP_ACTIVE = "true";
|
|
DHCP_START = "192.168.100.20";
|
|
DHCP_END = "192.168.100.254";
|
|
DHCP_ROUTER = "192.168.100.1";
|
|
DNS_BOGUS_PRIV = "false";
|
|
DNS_FQDN_REQUIRED = "false";
|
|
};
|
|
ports = [
|
|
"${piholeDNSIPBind}:53:53/udp"
|
|
"67:67/udp"
|
|
];
|
|
volumes = [
|
|
"pihole-etc:/etc/pihole"
|
|
"pihole-dnsmasq:/etc/dnsmasq.d"
|
|
"/etc/pihole/custom.list:/etc/pihole/custom.list"
|
|
];
|
|
environmentFiles = [
|
|
config.sops.secrets."pihole/env".path
|
|
];
|
|
extraOptions = [
|
|
"--ip=${ip}"
|
|
"--network=podman"
|
|
"--cap-add=NET_ADMIN"
|
|
"--cap-add=NET_BIND_SERVICE"
|
|
"--cap-add=NET_RAW"
|
|
"--cap-add=SYS_NICE"
|
|
"--cap-add=CHOWN"
|
|
];
|
|
labels = {
|
|
"io.containers.autoupdate" = "registry";
|
|
};
|
|
};
|
|
};
|
|
}
|