initial commit

2026-08-31 08:41:45 -05:00
commit 76fa38e34c
54 changed files with 6747 additions and 0 deletions
@@ -0,0 +1,64 @@
+{
+  name,
+  hostInfo,
+  dsl,
+  ...
+}:
+let
+  inherit (dsl) mkContainer;
+  inherit (hostInfo.paths) data;
+in
+mkContainer {
+  inherit name;
+  net.access = [ { to = "@internet"; } ];
+  svc.autoStart = false;
+  net.expose.tcp = [ 53 ];
+  # TODO: figure out how to have this be the external dns resolver only
+  resources.fs."/var/lib/pihole" = {
+    hostPath = "${data}/misc/pihole";
+    isReadOnly = false;
+  };
+  containerConfig = _: {
+    services.pihole-ftl = {
+      enable = true;
+      stateDirectory = "/var/lib/pihole";
+      openFirewallDNS = true;
+      settings.dns.upstreams = [
+        "1.1.1.1"
+        "8.8.8.8"
+      ];
+      lists = [
+        {
+          url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
+          type = "block";
+          description = "StevenBlack unified hosts";
+          enabled = true;
+        }
+        {
+          url = "https://big.oisd.nl/domainswild";
+          type = "block";
+          description = "OISD Big";
+          enabled = true;
+        }
+        {
+          url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/pro.txt";
+          type = "block";
+          description = "HaGeZi Multi Pro";
+          enabled = true;
+        }
+        {
+          url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/tif.txt";
+          type = "block";
+          description = "HaGeZi Threat Intelligence Feeds";
+          enabled = true;
+        }
+      ];
+    };
+    services.pihole-web = {
+      enable = true;
+      ports = [ "443s" ];
+    };
+    systemd.services.pihole-ftl.serviceConfig.FailureAction = "exit-force";
+  };
+  resources.mem = "512M";
+}