Pi-hole swap: quadlet + env + records + Caddy vhost (retires dnsmasq)

- dankclaw/pihole/: pihole.container (quadlet, slirp4netns, 53+8083),
  env.example (ServerIP/TZ/DNS1/DNS2/WEBPASSWORD placeholders), addn-hosts
  (moved from dankclaw/dnsmasq/, + pihole.franksdank.cloud record)
- Caddyfile: pihole.franksdank.cloud vhost (family basicauth -> 8083)
- scripts/deploy-pihole-quadlet.sh: idempotent quadlet installer
- tests/pihole.bats replaces tests/dnsmasq.bats (same record validation
  + cross-checks, new quadlet/env seams); retired files in .AGENTTRASH/

dankclaw/pihole/addn-hosts

@@ -0,0 +1,40 @@
+# A records for the flat franksdank.name scheme (dnsmasq addn-hosts format:
+# <IP> <name> [<name> ...]). Served by the Pi-hole quadlet (FTL is a
+# dnsmasq fork): the quadlet mounts this file into /etc/dnsmasq.d/ read-only.
+#
+# Caddy is consolidated on dankclaw (192.168.0.143): it fronts every service
+# on both hosts, so every name resolves to that one IP. Keep in sync with the
+# Caddyfile (tests/pihole.bats cross-checks this).
+#
+#   192.168.0.143 = dankclaw (runs the Caddy container + the AI/dev stack)
+#   192.168.0.235 = dankserver (media stack; reached by Caddy via published
+#                    LAN ports — no DNS records point here)
+
+# --- Homepage + legacy name ---
+192.168.0.143 dankclaw.franksdank.cloud
+192.168.0.143 dankserver.franksdank.cloud
+
+# --- Media services (dankserver, proxied) ---
+192.168.0.143 plex.franksdank.cloud
+192.168.0.143 plex.franksdank.casa
+192.168.0.143 books.franksdank.cloud
+192.168.0.143 romm.franksdank.cloud
+192.168.0.143 files.franksdank.cloud
+192.168.0.143 jellyfin.franksdank.cloud
+192.168.0.143 radarr.franksdank.cloud
+192.168.0.143 sonarr.franksdank.cloud
+192.168.0.143 lidarr.franksdank.cloud
+192.168.0.143 readarr.franksdank.cloud
+192.168.0.143 prowlarr.franksdank.cloud
+192.168.0.143 qbittorrent.franksdank.cloud
+
+# --- AI / search / dev services (dankclaw, local) ---
+192.168.0.143 search.franksdank.cloud
+192.168.0.143 comfyui.franksdank.cloud
+192.168.0.143 chat.franksdank.cloud
+192.168.0.143 hermes.franksdank.cloud
+192.168.0.143 gitea.franksdank.cloud
+192.168.0.143 grafana.franksdank.cloud
+192.168.0.143 prometheus.franksdank.cloud
+192.168.0.143 loki.franksdank.cloud
+192.168.0.143 pihole.franksdank.cloud

dankclaw/pihole/env.example

@@ -0,0 +1,18 @@
+# Pi-hole container environment (dankclaw).
+# Copy to /home/dank/Containers/pihole/env and fill real values.
+# The real env file is never committed (it holds the web UI password).
+
+# The host IP the container answers for (also shown in the web UI).
+ServerIP=192.168.0.143
+
+# Timezone for the web UI and logs.
+TZ=America/Los_Angeles
+
+# Pinned upstream resolvers. The slirp netns has no useful resolv.conf, so
+# pin them (mirrors the retired dnsmasq.conf server= lines).
+DNS1=1.1.1.1
+DNS2=1.0.0.1
+
+# Web UI password (the shared family password; the same credential as
+# CADDY_BASICAUTH_HASH in the host .env).
+WEBPASSWORD=changeme

dankclaw/pihole/quadlet/pihole.container

@@ -0,0 +1,42 @@
+# Quadlet unit: Pi-hole LAN DNS (rootless, boot-persistent).
+#
+# Install path on dankclaw: ~/.config/containers/systemd/pihole.container
+# Unit name: pihole.service (container name: pihole)
+#
+# The LAN's authoritative DNS for the flat franksdank.cloud / franksdank.casa
+# name scheme. It retired the dnsmasq quadlet (2026-08-24): Pi-hole FTL is a
+# dnsmasq fork, so the addn-hosts record file carries over unchanged and is
+# mounted into /etc/dnsmasq.d/ (the FTL dnsmasq config dir). It serves one A
+# record per Caddy vhost and forwards everything else to the pinned upstream
+# resolvers (DNS1/DNS2 in the env file). The SURFboard G36 router hands this
+# server out to DHCP clients (DNS statically configured -> 192.168.0.143),
+# so no client needs per-device config.
+#
+# Runs on slirp4netns with port 53 (DNS) and 8083 (web UI) published to the
+# LAN (the same pattern as open-webui). Config + state mount from
+# /home/dank/Containers/pihole. The web UI password is WEBPASSWORD in the env
+# file. See docs/Infrastructure/LAN-DNS.md.
+
+[Unit]
+Description=Pi-hole LAN DNS container
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+ContainerName=pihole
+Image=docker.io/pihole/pihole:latest
+Network=slirp4netns
+PublishPort=0.0.0.0:53:53/udp
+PublishPort=0.0.0.0:53:53/tcp
+PublishPort=0.0.0.0:8083:80/tcp
+EnvironmentFile=/home/dank/Containers/pihole/env
+Volume=/home/dank/Containers/pihole/etc-pihole:/etc/pihole
+Volume=/home/dank/Containers/pihole/etc-dockers:/etc/dockers
+Volume=/home/dank/Containers/pihole/addn-hosts:/etc/dnsmasq.d/addn-hosts:ro
+
+[Service]
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target