Frank
d2810ab610
Closing the command-center security queue #70/#71/#72/#73/#74: rolling tags let a rebuild move under a running service with nobody approving it, and make a CVE audit ungradeable. 36 quadlet units across dankclaw, dankserver and frankbook-pro now carry tag@sha256; localhost/* builds stay exempt (their build is the pin). The pihole and copyparty pins pull the fixed builds; valkey 9.1.2 (already running) and redis 7.4.11 are pinned in place, vendor fixes TBD. New gate tests/quadlet_image_pins.bats: no unpinned registry image, no generator-rejected key anywhere. Three seams that pinned the old exact-tag law (frankbook readarr, open_webui, seerr) now require tag AND digest - strictly stronger. Quadlet Lifecycle docs: batch-abort law, entrypoint flags-only law, pin law.
43 lines
1.7 KiB
INI
43 lines
1.7 KiB
INI
# Quadlet unit: Pi-hole LAN DNS (rootless, boot-persistent).
|
|
#
|
|
# Install path on dankclaw: ~/.config/containers/systemd/pihole.container
|
|
# Unit name: pihole.service (container name: pihole)
|
|
#
|
|
# The LAN's authoritative DNS for the flat franksdank.cloud / franksdank.casa
|
|
# name scheme. It retired the dnsmasq quadlet (2026-08-24): Pi-hole FTL is a
|
|
# dnsmasq fork, so the addn-hosts record file carries over unchanged and is
|
|
# mounted into /etc/pihole/hosts/ (the FTL hostsdir) read-only. It serves one A
|
|
# record per Caddy vhost and forwards everything else to the pinned upstream
|
|
# resolvers (DNS1/DNS2 in the env file). The SURFboard G36 router hands this
|
|
# server out to DHCP clients (DNS statically configured -> 192.168.0.143),
|
|
# so no client needs per-device config.
|
|
#
|
|
# Runs on slirp4netns with port 53 (DNS) and 8083 (web UI) published to the
|
|
# LAN (the same pattern as open-webui). Config + state mount from
|
|
# /home/dank/Containers/pihole. The web UI password is WEBPASSWORD in the env
|
|
# file. See serverAppConfigs-docs/Infrastructure/LAN-DNS.md.
|
|
|
|
[Unit]
|
|
Description=Pi-hole LAN DNS container
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Container]
|
|
ContainerName=pihole
|
|
Image=docker.io/pihole/pihole:latest@sha256:d34134716fc32038b052a8674c7c6879e0ff21f0e6d8af345166fffa2c27c113
|
|
Network=slirp4netns
|
|
PublishPort=0.0.0.0:53:53/udp
|
|
PublishPort=0.0.0.0:53:53/tcp
|
|
PublishPort=0.0.0.0:8083:80/tcp
|
|
EnvironmentFile=/home/dank/Containers/pihole/env
|
|
Volume=/home/dank/Containers/pihole/etc-pihole:/etc/pihole
|
|
Volume=/home/dank/Containers/pihole/etc-dockers:/etc/dockers
|
|
Volume=/home/dank/Containers/pihole/addn-hosts:/etc/pihole/hosts/addn-hosts:ro
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|