Frank
bb96fc55f7
- dankclaw/pihole/: pihole.container (quadlet, slirp4netns, 53+8083), env.example (ServerIP/TZ/DNS1/DNS2/WEBPASSWORD placeholders), addn-hosts (moved from dankclaw/dnsmasq/, + pihole.franksdank.cloud record) - Caddyfile: pihole.franksdank.cloud vhost (family basicauth -> 8083) - scripts/deploy-pihole-quadlet.sh: idempotent quadlet installer - tests/pihole.bats replaces tests/dnsmasq.bats (same record validation + cross-checks, new quadlet/env seams); retired files in .AGENTTRASH/
119 lines
4.0 KiB
Bash
Executable File
119 lines
4.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# deploy-pihole-quadlet.sh — Install and (re)start the Pi-hole LAN DNS on
|
|
# dankclaw. Pi-hole retired the dnsmasq quadlet (2026-08-24).
|
|
#
|
|
# Pi-hole is boot-persistent via Quadlet (see AGENTS.md). This script:
|
|
# 1. Pushes main to origin
|
|
# 2. Pulls the repo on the target
|
|
# 3. Creates the data dirs and copies the quadlet unit + env + addn-hosts
|
|
# 4. daemon-reloads and starts pihole (first run pulls the image)
|
|
#
|
|
# It is idempotent: it stops any running unit and removes any container with
|
|
# the name (a prior run or a bare-container leftover) before reinstalling and
|
|
# starting. The data dirs (etc-pihole, etc-dockers) are preserved across
|
|
# reruns, so the blocklist and web settings survive. The env file is created
|
|
# from env.example only if absent; fill the real WEBPASSWORD before the web
|
|
# UI is usable.
|
|
#
|
|
# Usage:
|
|
# ./scripts/deploy-pihole-quadlet.sh <target> [--dry-run]
|
|
# ./scripts/deploy-pihole-quadlet.sh dankclaw
|
|
set -euo pipefail
|
|
|
|
REMOTE_USER="dank"
|
|
REMOTE_HOST="dankclaw"
|
|
REMOTE_DIR="/home/dank/serverAppConfigs"
|
|
QDIR="dankclaw/pihole"
|
|
UNIT="pihole.service"
|
|
DATA_DIR="/home/dank/Containers/pihole"
|
|
|
|
TARGET="${1:-}"
|
|
DRY_RUN=0
|
|
if [ "${2:-}" = "--dry-run" ]; then
|
|
DRY_RUN=1
|
|
fi
|
|
|
|
if [ -z "${TARGET:-}" ]; then
|
|
echo "Usage: $0 <target> [--dry-run]"
|
|
exit 1
|
|
fi
|
|
if [ "${TARGET}" != "dankclaw" ]; then
|
|
echo "This stack runs only on dankclaw (got: ${TARGET})"
|
|
exit 1
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Local pre-flight
|
|
# ---------------------------------------------------------------------------
|
|
cd "$(dirname "$0")/.."
|
|
if ! git diff --quiet HEAD; then
|
|
echo "FAIL: Local working tree has uncommitted changes. Commit first."
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$DRY_RUN" = "1" ]; then
|
|
echo "[dry-run] Would push main, pull on ${REMOTE_HOST}, install ${UNIT}, and start it (data at ${DATA_DIR})."
|
|
exit 0
|
|
fi
|
|
|
|
echo "=== Deploying pihole quadlet to ${REMOTE_HOST} ==="
|
|
echo "[1/3] Pushing local main to origin..."
|
|
git push origin main
|
|
|
|
REMOTE="${REMOTE_USER}@${REMOTE_HOST}"
|
|
|
|
echo "[2/3] Installing and starting ${UNIT} on ${REMOTE_HOST}..."
|
|
ssh "$REMOTE" bash -s <<REMOTE_EOF
|
|
set -euo pipefail
|
|
cd '${REMOTE_DIR}'
|
|
|
|
echo ' Pulling repo...'
|
|
git pull origin main
|
|
|
|
echo ' Stopping any running unit (idempotent)...'
|
|
systemctl --user stop '${UNIT}' 2>/dev/null || true
|
|
|
|
echo ' Removing any container with the name (prior run or bare-container leftover)...'
|
|
podman rm -f pihole 2>/dev/null || true
|
|
|
|
echo ' Creating the data dirs (preserved across reruns)...'
|
|
mkdir -p '${DATA_DIR}/etc-pihole' '${DATA_DIR}/etc-dockers'
|
|
|
|
echo ' Creating the env file from env.example if absent...'
|
|
if [ ! -f '${DATA_DIR}/env' ]; then
|
|
cp ${QDIR}/env.example '${DATA_DIR}/env'
|
|
echo ' env created: set the real WEBPASSWORD before the web UI is usable'
|
|
else
|
|
echo ' env present, keeping it'
|
|
fi
|
|
|
|
echo ' Copying the record file (addn-hosts)...'
|
|
cp ${QDIR}/addn-hosts '${DATA_DIR}/addn-hosts'
|
|
|
|
echo ' Copying the quadlet unit into ~/.config/containers/systemd/ ...'
|
|
mkdir -p ~/.config/containers/systemd
|
|
cp ${QDIR}/quadlet/pihole.container ~/.config/containers/systemd/
|
|
|
|
echo ' daemon-reload (generates the unit)...'
|
|
# Quadlet units are generator-managed: systemctl enable fails on them. The
|
|
# [Install] WantedBy=default.target in the .container file is itself the
|
|
# enablement (is-enabled reports "generated"); with user linger on it starts
|
|
# at boot. So: daemon-reload, then start.
|
|
systemctl --user daemon-reload
|
|
|
|
echo ' Starting (first run pulls the image; this can take a while)...'
|
|
systemctl --user start '${UNIT}'
|
|
|
|
echo ' Unit state:'
|
|
systemctl --user --no-pager status '${UNIT}' 2>&1 | grep -E "●|Active:" || true
|
|
REMOTE_EOF
|
|
|
|
echo "[3/3] Verifying pihole is up..."
|
|
ssh "$REMOTE" '
|
|
echo " is-enabled: $(systemctl --user is-enabled pihole.service 2>&1) (boot-persistent)"
|
|
echo " port 53:"; (ss -ulpn 2>/dev/null) | grep -E ":53\b" || echo " (not listening yet)"
|
|
echo " resolution:"; dig @127.0.0.1 romm.franksdank.cloud +short 2>/dev/null || echo " (no answer yet)"
|
|
' || true
|
|
|
|
echo "=== pihole quadlet deployed to ${REMOTE_HOST} ==="
|