Pi-hole swap: quadlet + env + records + Caddy vhost (retires dnsmasq)

- dankclaw/pihole/: pihole.container (quadlet, slirp4netns, 53+8083),
  env.example (ServerIP/TZ/DNS1/DNS2/WEBPASSWORD placeholders), addn-hosts
  (moved from dankclaw/dnsmasq/, + pihole.franksdank.cloud record)
- Caddyfile: pihole.franksdank.cloud vhost (family basicauth -> 8083)
- scripts/deploy-pihole-quadlet.sh: idempotent quadlet installer
- tests/pihole.bats replaces tests/dnsmasq.bats (same record validation
  + cross-checks, new quadlet/env seams); retired files in .AGENTTRASH/

scripts/deploy-pihole-quadlet.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# deploy-pihole-quadlet.sh — Install and (re)start the Pi-hole LAN DNS on
+# dankclaw. Pi-hole retired the dnsmasq quadlet (2026-08-24).
+#
+# Pi-hole is boot-persistent via Quadlet (see AGENTS.md). This script:
+#   1. Pushes main to origin
+#   2. Pulls the repo on the target
+#   3. Creates the data dirs and copies the quadlet unit + env + addn-hosts
+#   4. daemon-reloads and starts pihole (first run pulls the image)
+#
+# It is idempotent: it stops any running unit and removes any container with
+# the name (a prior run or a bare-container leftover) before reinstalling and
+# starting. The data dirs (etc-pihole, etc-dockers) are preserved across
+# reruns, so the blocklist and web settings survive. The env file is created
+# from env.example only if absent; fill the real WEBPASSWORD before the web
+# UI is usable.
+#
+# Usage:
+#   ./scripts/deploy-pihole-quadlet.sh <target> [--dry-run]
+#   ./scripts/deploy-pihole-quadlet.sh dankclaw
+set -euo pipefail
+
+REMOTE_USER="dank"
+REMOTE_HOST="dankclaw"
+REMOTE_DIR="/home/dank/serverAppConfigs"
+QDIR="dankclaw/pihole"
+UNIT="pihole.service"
+DATA_DIR="/home/dank/Containers/pihole"
+
+TARGET="${1:-}"
+DRY_RUN=0
+if [ "${2:-}" = "--dry-run" ]; then
+    DRY_RUN=1
+fi
+
+if [ -z "${TARGET:-}" ]; then
+    echo "Usage: $0 <target> [--dry-run]"
+    exit 1
+fi
+if [ "${TARGET}" != "dankclaw" ]; then
+    echo "This stack runs only on dankclaw (got: ${TARGET})"
+    exit 1
+fi
+
+# ---------------------------------------------------------------------------
+# Local pre-flight
+# ---------------------------------------------------------------------------
+cd "$(dirname "$0")/.."
+if ! git diff --quiet HEAD; then
+    echo "FAIL: Local working tree has uncommitted changes. Commit first."
+    exit 1
+fi
+
+if [ "$DRY_RUN" = "1" ]; then
+    echo "[dry-run] Would push main, pull on ${REMOTE_HOST}, install ${UNIT}, and start it (data at ${DATA_DIR})."
+    exit 0
+fi
+
+echo "=== Deploying pihole quadlet to ${REMOTE_HOST} ==="
+echo "[1/3] Pushing local main to origin..."
+git push origin main
+
+REMOTE="${REMOTE_USER}@${REMOTE_HOST}"
+
+echo "[2/3] Installing and starting ${UNIT} on ${REMOTE_HOST}..."
+ssh "$REMOTE" bash -s <<REMOTE_EOF
+set -euo pipefail
+cd '${REMOTE_DIR}'
+
+echo '  Pulling repo...'
+git pull origin main
+
+echo '  Stopping any running unit (idempotent)...'
+systemctl --user stop '${UNIT}' 2>/dev/null || true
+
+echo '  Removing any container with the name (prior run or bare-container leftover)...'
+podman rm -f pihole 2>/dev/null || true
+
+echo '  Creating the data dirs (preserved across reruns)...'
+mkdir -p '${DATA_DIR}/etc-pihole' '${DATA_DIR}/etc-dockers'
+
+echo '  Creating the env file from env.example if absent...'
+if [ ! -f '${DATA_DIR}/env' ]; then
+    cp ${QDIR}/env.example '${DATA_DIR}/env'
+    echo '  env created: set the real WEBPASSWORD before the web UI is usable'
+else
+    echo '  env present, keeping it'
+fi
+
+echo '  Copying the record file (addn-hosts)...'
+cp ${QDIR}/addn-hosts '${DATA_DIR}/addn-hosts'
+
+echo '  Copying the quadlet unit into ~/.config/containers/systemd/ ...'
+mkdir -p ~/.config/containers/systemd
+cp ${QDIR}/quadlet/pihole.container ~/.config/containers/systemd/
+
+echo '  daemon-reload (generates the unit)...'
+# Quadlet units are generator-managed: systemctl enable fails on them. The
+# [Install] WantedBy=default.target in the .container file is itself the
+# enablement (is-enabled reports "generated"); with user linger on it starts
+# at boot. So: daemon-reload, then start.
+systemctl --user daemon-reload
+
+echo '  Starting (first run pulls the image; this can take a while)...'
+systemctl --user start '${UNIT}'
+
+echo '  Unit state:'
+systemctl --user --no-pager status '${UNIT}' 2>&1 | grep -E "●|Active:" || true
+REMOTE_EOF
+
+echo "[3/3] Verifying pihole is up..."
+ssh "$REMOTE" '
+  echo "  is-enabled: $(systemctl --user is-enabled pihole.service 2>&1) (boot-persistent)"
+  echo "  port 53:"; (ss -ulpn 2>/dev/null) | grep -E ":53\b" || echo "  (not listening yet)"
+  echo "  resolution:"; dig @127.0.0.1 romm.franksdank.cloud +short 2>/dev/null || echo "  (no answer yet)"
+' || true
+
+echo "=== pihole quadlet deployed to ${REMOTE_HOST} ==="