dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

pihole: also neutralize the /etc/sysctl.conf sysctl override

Browse Source 
systemd-sysctl applies /etc/sysctl.conf AFTER all of sysctl.d/, so the
stale ip_unprivileged_port_start=80 line there beat every drop-in and kept
the runtime value at 80 after the first deploy pass. deploy_pihole now
comments out an active line in /etc/sysctl.conf (idempotent) and generalizes
the sysctl.d conflict scan to any file setting a value above 53.
This commit is contained in:
Frank
2026-08-26 20:08:30 -07:00
parent 8660209c35
commit f3c1ac1823
4 changed files with 30 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/deploy-remote.sh
+20 -8
View File
@@ -449,16 +449,28 @@ deploy_open_webui() {
deploy_pihole() {
# Rootless port 53 needs net.ipv4.ip_unprivileged_port_start <= 53, and it
# must hold at boot (systemd-sysctl applies /etc/sysctl.d). The repo
# drop-in is the single source of truth; a later-sorted file that resets
# the value to 80 took LAN DNS down after the 2026-08-26 reboot, so stage
# any such conflict in the home trash instead of deleting it.
# must hold at boot. The repo drop-in is the single source of truth.
# systemd-sysctl applies /etc/sysctl.d/*.conf (lexicographic), then
# /run/sysctl.d, /usr/lib/sysctl.d, and finally /etc/sysctl.conf — later
# files override earlier ones. On 2026-08-26 a later-sorted drop-in (=80)
# AND a stale line in /etc/sysctl.conf (=80) both reset the value after a
# reboot and took LAN DNS down. Neutralize every conflicting source:
# stage sysctl.d files that set a value above 53 in the home trash, and
# comment out an active line in /etc/sysctl.conf (idempotent).
run_privileged install -m 0644 dankclaw/pihole/sysctl/99-dnsmasq.conf \
/etc/sysctl.d/99-dnsmasq.conf
if grep -qs 'ip_unprivileged_port_start' /etc/sysctl.d/99-rootless-ports.conf; then
local sysctl_trash="$HOME/.AGENTTRASH/$(date +%Y%m%d)-sysctl-rootless-ports"
mkdir -p "$sysctl_trash"
run_privileged mv /etc/sysctl.d/99-rootless-ports.conf "$sysctl_trash/"
local sysctl_file sysctl_val sysctl_trash
while IFS= read -r sysctl_file; do
[[ "$sysctl_file" == */99-dnsmasq.conf ]] && continue
sysctl_val="$(sed -nE 's/^[[:space:]]*net\.ipv4\.ip_unprivileged_port_start[[:space:]]*=[[:space:]]*([0-9]+).*/\1/p' "$sysctl_file" | head -1)"
if [[ "$sysctl_val" =~ ^[0-9]+$ ]] && (( sysctl_val > 53 )); then
sysctl_trash="$HOME/.AGENTTRASH/$(date +%Y%m%d)-sysctl-unprivileged-port"
mkdir -p "$sysctl_trash"
run_privileged mv "$sysctl_file" "$sysctl_trash/"
fi
done < <(grep -lE '^[[:space:]]*net\.ipv4\.ip_unprivileged_port_start[[:space:]]*=' /etc/sysctl.d/*.conf 2>/dev/null || true)
if [[ -f /etc/sysctl.conf ]] && grep -qE '^[[:space:]]*net\.ipv4\.ip_unprivileged_port_start[[:space:]]*=' /etc/sysctl.conf; then
run_privileged sed -i -E 's/^[[:space:]]*(net\.ipv4\.ip_unprivileged_port_start[[:space:]]*=)/# \1 managed by dankclaw\/pihole\/sysctl\/99-dnsmasq.conf/' /etc/sysctl.conf
fi
run_privileged sysctl --system >/dev/null
mkdir -p /home/dank/Containers/pihole/etc-pihole /home/dank/Containers/pihole/etc-dockers