feat(k8s/pihole): fully stateless setup with ConfigMap-driven config and adlists
This commit is contained in:
15
kubernetes/app/pihole/configmap-adlists.yaml
Normal file
15
kubernetes/app/pihole/configmap-adlists.yaml
Normal file
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: pihole-adlists
|
||||
namespace: pihole
|
||||
data:
|
||||
adlists.txt: |
|
||||
# Hagezi Multi Pro — ads, tracking, malware, scam, crypto
|
||||
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/pro.txt
|
||||
# Hagezi Threat Intelligence Feeds — malware, C2, phishing
|
||||
https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/hosts/tif.txt
|
||||
# Ukrainian Security Filter — phishing/fraud targeting Ukrainian citizens
|
||||
https://raw.githubusercontent.com/braveinnovators/ukrainian-security-filter/main/lists/domains.txt
|
||||
# Phishing Army Extended
|
||||
https://phishing.army/download/phishing_army_blocklist_extended.txt
|
||||
17
kubernetes/app/pihole/configmap-pihole.yaml
Normal file
17
kubernetes/app/pihole/configmap-pihole.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: pihole-config
|
||||
namespace: pihole
|
||||
data:
|
||||
TZ: Europe/Kyiv
|
||||
FTLCONF_dns_listeningMode: all
|
||||
FTLCONF_dns_upstreams: "127.0.0.1#5353"
|
||||
FTLCONF_misc_etc_dnsmasq_d: "true"
|
||||
FTLCONF_dns_revServers: "true,10.127.0.0/16,10.127.1.1,lviv"
|
||||
FTLCONF_files_database: /data/pihole-FTL.db
|
||||
# Local DNS records (one per line: "IP HOSTNAME")
|
||||
# Uncomment and add entries as needed:
|
||||
# FTLCONF_dns_hosts: |
|
||||
# 192.168.1.1 router.lan
|
||||
# 192.168.1.2 nas.lan
|
||||
@@ -8,7 +8,7 @@ metadata:
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: pihole
|
||||
@@ -17,23 +17,25 @@ spec:
|
||||
labels:
|
||||
app: pihole
|
||||
spec:
|
||||
initContainers:
|
||||
- name: fix-permissions
|
||||
image: busybox:latest
|
||||
command: ["sh", "-c", "chown 1000:1000 /data"]
|
||||
volumeMounts:
|
||||
- name: pihole-ftl-db
|
||||
mountPath: /data
|
||||
containers:
|
||||
- name: pihole
|
||||
image: pihole/pihole:2025.08.0
|
||||
image: pihole/pihole:2026.02.0
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: pihole-config
|
||||
env:
|
||||
- name: TZ
|
||||
value: Europe/Kyiv
|
||||
- name: FTLCONF_webserver_api_password
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: pihole-credentials
|
||||
key: WEBPASSWORD
|
||||
- name: FTLCONF_dns_listeningMode
|
||||
value: all
|
||||
- name: FTLCONF_dns_upstreams
|
||||
value: "127.0.0.1#5353"
|
||||
- name: FTLCONF_misc_etc_dnsmasq_d
|
||||
value: "true"
|
||||
ports:
|
||||
- containerPort: 53
|
||||
protocol: TCP
|
||||
@@ -44,11 +46,47 @@ spec:
|
||||
- containerPort: 80
|
||||
protocol: TCP
|
||||
name: http
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- dig
|
||||
- +norecurse
|
||||
- +retry=0
|
||||
- +time=2
|
||||
- healthcheck.pi.hole
|
||||
- "@127.0.0.1"
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
(
|
||||
SID=""
|
||||
until curl -sf "http://localhost/api/lists?sid=$SID" | grep -q '"lists"'; do
|
||||
SID=$(curl -s -X POST http://localhost/api/auth \
|
||||
-d "{\"password\":\"$FTLCONF_webserver_api_password\"}" | \
|
||||
grep -o '"sid":"[^"]*"' | cut -d'"' -f4)
|
||||
sleep 5
|
||||
done
|
||||
grep -v '^#\|^$' /etc/pihole-adlists/adlists.txt | while read -r url; do
|
||||
curl -s -X POST "http://localhost/api/lists?type=block&sid=$SID" \
|
||||
-d "{\"address\":\"$url\"}" > /dev/null
|
||||
done
|
||||
curl -s -X POST "http://localhost/api/action/gravity?sid=$SID" > /dev/null
|
||||
) &
|
||||
volumeMounts:
|
||||
- name: pihole-config
|
||||
mountPath: /etc/pihole
|
||||
- name: pihole-dnsmasq
|
||||
mountPath: /etc/dnsmasq.d
|
||||
- name: pihole-adlists
|
||||
mountPath: /etc/pihole-adlists
|
||||
- name: pihole-ftl-db
|
||||
mountPath: /data
|
||||
|
||||
- name: dnscrypt-proxy
|
||||
image: klutchell/dnscrypt-proxy:latest
|
||||
@@ -62,11 +100,16 @@ spec:
|
||||
|
||||
volumes:
|
||||
- name: pihole-config
|
||||
persistentVolumeClaim:
|
||||
claimName: pihole-config
|
||||
emptyDir: {}
|
||||
- name: pihole-dnsmasq
|
||||
persistentVolumeClaim:
|
||||
claimName: pihole-dnsmasq
|
||||
emptyDir: {}
|
||||
- name: pihole-ftl-db
|
||||
hostPath:
|
||||
path: /var/hostPath/pihole
|
||||
type: DirectoryOrCreate
|
||||
- name: pihole-adlists
|
||||
configMap:
|
||||
name: pihole-adlists
|
||||
- name: dnscrypt-config
|
||||
configMap:
|
||||
name: dnscrypt-config
|
||||
|
||||
@@ -2,3 +2,5 @@ apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: pihole
|
||||
labels:
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: pihole-config
|
||||
spec:
|
||||
capacity:
|
||||
storage: 2Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: ""
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
mountOptions:
|
||||
- hard
|
||||
- nointr
|
||||
nfs:
|
||||
server: synology.storage.lviv
|
||||
path: /volume3/k8s-storage/pihole-config
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: pihole-dnsmasq
|
||||
spec:
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: ""
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
mountOptions:
|
||||
- hard
|
||||
- nointr
|
||||
nfs:
|
||||
server: synology.storage.lviv
|
||||
path: /volume3/k8s-storage/pihole-dnsmasq
|
||||
@@ -1,27 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: pihole-config
|
||||
namespace: pihole
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: ""
|
||||
volumeName: pihole-config
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: pihole-dnsmasq
|
||||
namespace: pihole
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: ""
|
||||
volumeName: pihole-dnsmasq
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -7,6 +7,7 @@ metadata:
|
||||
metallb.io/loadBalancerIPs: 10.127.1.200
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
externalTrafficPolicy: Local
|
||||
selector:
|
||||
app: pihole
|
||||
ports:
|
||||
|
||||
Reference in New Issue
Block a user