# pihole

Pi-hole v6 configuration management for `pihole.sweet.home`.

## What's here

```
config/
  pihole.toml                  Pi-hole v6 main config (sanitised snapshot)
  dnsmasq.d/
    99-ipxe-chainload.conf     Custom DHCP rules for EFI/BIOS iPXE PXE boot
pull-config.sh                 Pull live config from a Pi-hole to a local dir
apply-config.sh                Apply a local config dir to a Pi-hole instance
sanitize-config.sh             Redact sensitive fields from pihole.toml in-place
```

## Usage

### Snapshot the live config

```bash
# Pulls pihole.toml + custom dnsmasq.d/ drop-ins, auto-redacts sensitive fields
./pull-config.sh root@pihole ./config
```

### Apply config to a new Pi-hole

```bash
# Destination must have Pi-hole v6 already installed
./apply-config.sh ./config root@pihole-new
```

Both scripts take `<source> <destination>` as positional arguments.
Source/destination is an SSH target (e.g. `root@pihole`, `root@192.168.2.253`)
for the live side and a local directory path for the config side.

### Restore blocklists after applying

`apply-config.sh` transfers config only — not the gravity database.
Run this on the destination after applying to rebuild blocklists:

```bash
ssh root@pihole-new "pihole updateGravity"
```

## Notable config

### `dnsmasq.d/99-ipxe-chainload.conf`

Enables architecture-aware PXE boot via DHCP:

| Client | Vendor class | Boot file served |
|---|---|---|
| EFI iPXE already running | arch 7 + option 175 | `http://.../boot.ipxe` |
| BIOS iPXE already running | arch 0 + option 175 | `http://.../boot.ipxe` |
| EFI, no iPXE yet | `PXEClient:Arch:00007` | `ipxe.efi` via TFTP |
| BIOS/legacy, no iPXE yet | `PXEClient:Arch:00000` | `undionly.kpxe` via TFTP |

Proxmox EFI VMs also require a **VirtIO RNG device** (gives OVMF
enough entropy to complete PXE negotiation) and **Secure Boot disabled**
(`pre-enrolled-keys=0` on the EFI disk, or disabled in UEFI setup).

## Secrets

`pihole.toml` is stored with `pwhash`, `totp_secret`, and `app_pwhash`
redacted to empty strings. `pull-config.sh` does this automatically.
To redact manually: `./sanitize-config.sh config/pihole.toml`.