65 lines
1.6 KiB
Nix
65 lines
1.6 KiB
Nix
{
|
|
name,
|
|
hostInfo,
|
|
dsl,
|
|
...
|
|
}:
|
|
let
|
|
inherit (dsl) mkContainer;
|
|
inherit (hostInfo.paths) data;
|
|
in
|
|
mkContainer {
|
|
inherit name;
|
|
net.access = [ { to = "@internet"; } ];
|
|
svc.autoStart = false;
|
|
net.expose.tcp = [ 53 ];
|
|
# TODO: figure out how to have this be the external dns resolver only
|
|
resources.fs."/var/lib/pihole" = {
|
|
hostPath = "${data}/misc/pihole";
|
|
isReadOnly = false;
|
|
};
|
|
containerConfig = _: {
|
|
services.pihole-ftl = {
|
|
enable = true;
|
|
stateDirectory = "/var/lib/pihole";
|
|
openFirewallDNS = true;
|
|
settings.dns.upstreams = [
|
|
"1.1.1.1"
|
|
"8.8.8.8"
|
|
];
|
|
lists = [
|
|
{
|
|
url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
|
|
type = "block";
|
|
description = "StevenBlack unified hosts";
|
|
enabled = true;
|
|
}
|
|
{
|
|
url = "https://big.oisd.nl/domainswild";
|
|
type = "block";
|
|
description = "OISD Big";
|
|
enabled = true;
|
|
}
|
|
{
|
|
url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/pro.txt";
|
|
type = "block";
|
|
description = "HaGeZi Multi Pro";
|
|
enabled = true;
|
|
}
|
|
{
|
|
url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/domains/tif.txt";
|
|
type = "block";
|
|
description = "HaGeZi Threat Intelligence Feeds";
|
|
enabled = true;
|
|
}
|
|
];
|
|
};
|
|
services.pihole-web = {
|
|
enable = true;
|
|
ports = [ "443s" ];
|
|
};
|
|
systemd.services.pihole-ftl.serviceConfig.FailureAction = "exit-force";
|
|
};
|
|
resources.mem = "512M";
|
|
}
|