Archived
beatzaplentyandClaude Sonnet 4.6
4aadef8e97
- Root README.md: new, describes overall repo layout (proxmox/, pihole/, scripts/) and secret-scanning workflow - Root CLAUDE.md: new, cross-section guardrails and instructions for adding new machine types; references proxmox/CLAUDE.md and pihole/ section-specific rules - pihole/README.md: new, covers scripts usage, notable DHCP/PXE config, EFI VM requirements (VirtIO RNG, Secure Boot), and secrets handling - proxmox/README.md: add repo-context note pointing back to root README Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
68 lines
2.1 KiB
Markdown
68 lines
2.1 KiB
Markdown
# pihole
|
|
|
|
Pi-hole v6 configuration management for `pihole.sweet.home`.
|
|
|
|
## What's here
|
|
|
|
```
|
|
config/
|
|
pihole.toml Pi-hole v6 main config (sanitised snapshot)
|
|
dnsmasq.d/
|
|
99-ipxe-chainload.conf Custom DHCP rules for EFI/BIOS iPXE PXE boot
|
|
pull-config.sh Pull live config from a Pi-hole to a local dir
|
|
apply-config.sh Apply a local config dir to a Pi-hole instance
|
|
sanitize-config.sh Redact sensitive fields from pihole.toml in-place
|
|
```
|
|
|
|
## Usage
|
|
|
|
### Snapshot the live config
|
|
|
|
```bash
|
|
# Pulls pihole.toml + custom dnsmasq.d/ drop-ins, auto-redacts sensitive fields
|
|
./pull-config.sh root@pihole ./config
|
|
```
|
|
|
|
### Apply config to a new Pi-hole
|
|
|
|
```bash
|
|
# Destination must have Pi-hole v6 already installed
|
|
./apply-config.sh ./config root@pihole-new
|
|
```
|
|
|
|
Both scripts take `<source> <destination>` as positional arguments.
|
|
Source/destination is an SSH target (e.g. `root@pihole`, `root@192.168.2.253`)
|
|
for the live side and a local directory path for the config side.
|
|
|
|
### Restore blocklists after applying
|
|
|
|
`apply-config.sh` transfers config only — not the gravity database.
|
|
Run this on the destination after applying to rebuild blocklists:
|
|
|
|
```bash
|
|
ssh root@pihole-new "pihole updateGravity"
|
|
```
|
|
|
|
## Notable config
|
|
|
|
### `dnsmasq.d/99-ipxe-chainload.conf`
|
|
|
|
Enables architecture-aware PXE boot via DHCP:
|
|
|
|
| Client | Vendor class | Boot file served |
|
|
|---|---|---|
|
|
| EFI iPXE already running | arch 7 + option 175 | `http://.../boot.ipxe` |
|
|
| BIOS iPXE already running | arch 0 + option 175 | `http://.../boot.ipxe` |
|
|
| EFI, no iPXE yet | `PXEClient:Arch:00007` | `ipxe.efi` via TFTP |
|
|
| BIOS/legacy, no iPXE yet | `PXEClient:Arch:00000` | `undionly.kpxe` via TFTP |
|
|
|
|
Proxmox EFI VMs also require a **VirtIO RNG device** (gives OVMF
|
|
enough entropy to complete PXE negotiation) and **Secure Boot disabled**
|
|
(`pre-enrolled-keys=0` on the EFI disk, or disabled in UEFI setup).
|
|
|
|
## Secrets
|
|
|
|
`pihole.toml` is stored with `pwhash`, `totp_secret`, and `app_pwhash`
|
|
redacted to empty strings. `pull-config.sh` does this automatically.
|
|
To redact manually: `./sanitize-config.sh config/pihole.toml`.
|