misc

2026-01-22 12:24:11 +01:00
parent 5b59fa1039
commit eb17551aec
40 changed files with 92 additions and 240 deletions
@@ -0,0 +1,92 @@
+{ config, pkgs, ... }:
+
+let
+  container_name = "pi-hole";
+  compose_file = "podman/pi-hole/compose.yaml";
+  config_dir = "/mnt/config/pi-hole";
+in
+
+{
+  config = {
+    environment.etc."${compose_file}".text =
+      /*
+      yaml
+      */
+      ''
+        services:
+          pihole:
+            image: pihole/pihole:latest
+            container_name: pi-hole
+            networks:
+              pi-hole_frontend:
+            ports:
+              # DNS Ports
+              - "53:53/tcp"
+              - "53:53/udp"
+            environment:
+              TZ: $TZ
+              FTLCONF_webserver_api_password: $FTLCONF_webserver_api_password
+              FTLCONF_dns_listeningMode: "all"
+              FTLCONF_dns_revServers: true,$HOME_ROUTER_SUBNET,$HOME_ROUTER_IP,home
+              FTLCONF_dns_domain_name: "home"
+              FTLCONF_dns_domain_local: "true"
+              FTLCONF_dns_hosts: |
+                $HOME_SERVER_IP frigate.$DOMAIN_NAME
+                $HOME_SERVER_IP gitea.$DOMAIN_NAME
+                $HOME_SERVER_IP home-assistant.$DOMAIN_NAME
+                $HOME_SERVER_IP immich.$DOMAIN_NAME
+                $HOME_SERVER_IP it-tools.$DOMAIN_NAME
+                $HOME_SERVER_IP nextcloud.$DOMAIN_NAME
+                $HOME_SERVER_IP nextcloud-aio.$DOMAIN_NAME
+                $HOME_SERVER_IP passbolt.$DOMAIN_NAME
+                $HOME_SERVER_IP pi-hole.$DOMAIN_NAME
+                $HOME_SERVER_IP traefik.$DOMAIN_NAME
+              FTLCONF_dhcp_active: "false"
+              FTLCONF_dns_upstreams: 9.9.9.9;149.112.112.112
+              FTLCONF_ntp_ipv4_active: "false"
+              FTLCONF_ntp_ipv6_active: "false"
+              FTLCONF_ntp_sync_active: "false"
+            volumes:
+              - ${config_dir}:/etc/pihole
+            cap_add:
+              - SYS_NICE
+            labels:
+              - traefik.enable=true
+              - traefik.http.services.pihole.loadbalancer.server.port=80
+              - traefik.http.services.pihole.loadbalancer.server.scheme=http
+              - traefik.http.routers.pihole-https.entrypoints=websecure
+              - traefik.http.routers.pihole-https.rule=Host(`pi-hole.$DOMAIN_NAME`)
+              - traefik.http.routers.pihole-https.tls=true
+              - traefik.http.routers.pihole-https.tls.certresolver=cloudflare
+            restart: unless-stopped
+
+        networks:
+          pi-hole_frontend:
+            external: true
+      '';
+    systemd.services.${container_name} = {
+      description = "Podman container : ${container_name}";
+      after = [ "network.target" ];
+      requires = [ "traefik.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pkgs.podman ];
+
+      serviceConfig = {
+        User = "numbus-admin";
+        Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
+        AmbientCapabilities = "CAP_SYS_NICE";
+        LimitNICE = -20;
+        Type = "exec";
+        # Pull the latest image before running
+        ExecStartPre = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull";
+        # Bring the service up
+        ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
+        # Take it down gracefully
+        ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
+        Restart = "on-failure";
+        RestartSec = "5m";
+        StartLimitBurst = "3";
+      };
+    };
+  };
+}