blob: 3a95f8a29eba3ab7348cc65f76252b121a12c81d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
{
inputs,
config,
...
}:
let
ip = "10.0.0.203";
interface = "eno1";
directory = "/opt/pihole";
in
{
systemd.tmpfiles.rules = builtins.map (x: "d ${x} 0755 share share - -") [ directory ];
virtualisation.oci-containers.containers.pihole = {
image = "pihole/pihole:latest";
autoStart = true;
ports = [
"53:53/udp"
"53:53/tcp"
"80:80/tcp"
];
volumes = [
"${directory}/etc:/etc/pihole"
"${directory}/etc-dnsmasq.d:/etc/dnsmasq.d"
];
environment = {
TZ = "America/Detroit";
FTLCONF_LOCAL_IPV4 = ip;
INTERFACE = interface;
};
extraOptions = [ "--network=host" ];
};
age.secrets.piholeAdminPass = {
file = "${inputs.self}/secrets/piholeAdminPass.age";
mode = "770";
owner = "share";
group = "share";
};
systemd.services.podman-pihole.postStart =
let
password = config.age.secrets.piholeAdminPass.path;
in
''
podman exec -it pihole pihole -a -p "$(tr -d '\n' < ${password})"
'';
networking.firewall = {
allowedTCPPorts = [
53
80
];
allowedUDPPorts = [ 53 ];
};
}
|
