gitops/homelab-v
1
0
Fork 0
mirror of https://github.com/outbackdingo/homelab-v.git synced 2026-08-25 14:53:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(pi-hole): Configured Pi-Hole to proxy public domain to local Traefik svc in order for Cloudflared tunnel to work

Browse Source
This commit is contained in:
Vegard Hagen
2023-07-24 19:11:54 +02:00
parent 17c79002dc
commit 93fde779be
11 changed files with 148 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/cloudflared/deployment.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ spec:
selector:
matchLabels:
app: cloudflared
replicas: 1
replicas: 2
template:
metadata:
labels:
infra/cloudflared/kustomization.yaml
+1 -1
View File
@@ -6,4 +6,4 @@ resources:
- namespace.yaml
- config-map.yaml
- tunnel-token.yaml
# - deployment.yaml
- deployment.yaml
infra/pi-hole/auth-secret.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: traefik-forward-auth-secrets
namespace: pi-hole
spec:
encryptedData:
google-client-id: AgAB1h2c7w9lgsugRpdHg0aGM9ragcQDJPebFMttuBnYg4bbRvnATh/d3l0tFX1GEgMESiAqpRN92AvXENNiaHkqI+Geru3I5EvKHOUyp84k3rXsFomqaLYlYhDtIEzplzd1bChMyv0Eo6p5dxOaXW00K4I1OE9qXE9DAkAtIzf93ye0y+cjB40RVYDgS5cKowaGEKTrtJ+H86rB9rtivzc1/rpFA7L7DrHHsr/KZ6Bf1DNWt//ZxcpzRhgwVIGby+Q+QjhSuqMt4ELlgRgkel3RM99LrK6IVh1lEJJ/lLA0KlUBMZZgLqU+5akX++f3C7xpWYYCW7/5wRTRySXivhtxiJ60EVfYVUdHPBHPrK5qienpd2KRGCrmrNebTxMOfW/zj1G6oM/jXFtYl2OsXo5X615uyTqPHS8fArp2DRTg5cCW5SqBlGxPGuXskZb8HQcJKf5mN92vLYic1UVVy5wmMR1glm1mg/xlzDe1hjR1wtwTYi4kEMYYpvkJnIid8Cnut99PALAEZiutaWLZXH0o3OVETDP939yrgzTmVKIpACGSxeL7mzEeB6hmFa1DqaqB7G8hDGZ5Q+KEhnz6W/NCnYxLYNEpm7LNOWJVh+CMR83ofotS8BbGbn5rNHzsLT2sRlCDBp16uWcydConcClQcuYSkiVRzG5yd1a0DEdZxn3cJDILgYmYwbhQF80ntEASFKRvtfD+q6VgjwpPhiOtQQJvbV0iPoPzqZ5Vh+IMwNRTI5epaVQmBJNOu9P+2V0IkaEhOMtejrxtIE2lBDgvjfLge+U86YM=
google-client-secret: AgA1pIbv9hSBYWAPZlJ8oMkaVradAXJvPP9X6WGOLqMahn5KL324yi6lBzym4vJQWzwVPbucmUZMGqJqEmfWMOHzjL88nRkRXI85wMSgyIA6i+WLmRr3QTuYiMs2UuHFZyIXveyjxgD0XEE/BJdzr7GMfUKAmTDnQur8Wb+DC2pMI8azjnAXrNI2evZ71TnLhfA1QFUR5ecZ5OLPqkiMXik+vQsscKFJlz4cmkVIOESk2RUtPkj06ChzRvokdojzZ1hprwnuQyQWS6BCXFV9LvbUL3ZZfj27xlx3BubulZPqVQ4fy/5oBFxRSfLONTpSqQ46ni7R28G9JnLHKjefu5LMP4hOcNdoQdklMy0QIKc10WCuqXRAzRDCSdtSgUJ6A1TBXd5ubneHhhUg4iSapqNIEia6HDkSWGtmtUrn02Vk1Uklpi8yIeAgbBjqANfLMclOhDgEygZbb8RPCLTxCksdaqsaUj6GE58PbYf3XzDpDMqomdMlp4fHzUrBNcUSCwRbfE4wqPxhVmF4/ST3upHuqnKH+og7HfB9YkYEF/mLBxf2HQeYnIBs/iVv+rWV9EW/73iRnzwjmS1uSvZPv/lbFjPYKaUgtV6as9WGSHhH+PC8LH+l/iOBm3FI89KWJEwq+fW0YIHeRoQ1YTLL0EXeW2nTYHIGbQuB1zw8mvtmHqbgn8bdZulOLS2Ftb0LdJRVPhhMqHAkzD1bsuL6FuT5v7IBYk11QkxYhb/+XG8Pe2Fs9g==
secret: AgA0PHE8APviTYiAWRQ18emplMCbxkWb6y+G8BcMt0SIjRaH/WXp1gDyr3NEuirjB3p+Foteh8NMC6zvTOoyXOHFwMozQYOl8ndi9v501AlVuaYSkUCJRJwwnpajsBkCeFk+PX1zn49Z82DamsfTj30Yt0AWigZbk5bEWPvCNnIc8ddj43rAI0ahkzb3GpLY1Y9YJ97Mk/fvrrBzeFlrbufyaNhRHlwLkvKrKd6qxYCuTBME6COx3gnKH8dN9eSgoJJFjVdfIvfBDHSl4O9nuGGFcZzm6Dd4UBcRfoOU+pDqOKt4yc5TG4XlGr1oc9Qs41n7/lqV8ZaCJe/B4jUBeHvPsc76wR6TTQ983WW2QEj6SqymIPwqFWYObsVlJgISVMORGTIwCG5UTYu9OFhXDi05/npdbZa3hyP0yn59JSjWvFBULrEqm6rGHm7BnGxpKfT71pE3nTPCGUENnMYKjtwuIko2G2hAIvZ8F7RgmgNufFGH6i20cHAMBwUZ//RCnqxnwal8CX2iUV1T8Ifn2V+LUJqmcnGzveJNtFaji/l60Ap7mqcxE9F5rhqkf2BJHLA2WFfrefN290AiXbh4PaMXU4pjvOmwY+yBjoUh2oADan6Jk+fEF6SMG20XwGh33DhbtPzBsxrmMlx9f5AqW0diPscwZC+XKlPnz1Pvk2YeO8ljhsn40DK6FzZBnPDKhpba3aFrBaew74CKqA==
template:
metadata:
name: traefik-forward-auth-secrets
namespace: pi-hole
infra/pi-hole/auth-values.yaml
+7
View File
@@ -0,0 +1,7 @@
name: auth
namespace: pi-hole
authOnly: true
auth:
cookieDomain: stonegarden.dev
whitelist:
- [email protected]
infra/pi-hole/cm-dnsmasq.yaml
+8
View File
@@ -0,0 +1,8 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: pi-hole-custom-dnsmasq
data:
02-custom.conf: |
address=/stonegarden.dev/192.168.1.128
address=/stonegarden.lan/192.168.1.128
infra/pi-hole/config/02-custom.conf
+2
View File
@@ -0,0 +1,2 @@
address=/stonegarden.dev/192.168.1.128
address=/stonegarden.lan/192.168.1.128
infra/pi-hole/config/pi-hole-env
+7
View File
@@ -0,0 +1,7 @@
TZ=Europe/Oslo
DNSMASQ_LISTENING=all
WEBPASSWORD=password
DNS1=1.1.1.1
DNS2=8.8.8.8
VIRTUAL_HOST=pi.hole
WEB_PORT=80
infra/pi-hole/deployment.yaml
+40 -36
View File
@@ -10,37 +10,28 @@ spec:
selector:
matchLabels:
app: pi-hole
#strategy:
# rollingUpdate:
# maxSurge: 1
# maxUnavailable: 0
# type: RollingUpdate
strategy:
rollingUpdate:
maxSurge: 1
maxUnavailable: 1
type: RollingUpdate
template:
metadata:
labels:
app: pi-hole
spec:
dnsPolicy: None
dnsConfig:
nameservers:
- 127.0.0.1
- 8.8.8.8
containers:
- env:
- name: TZ
value: Europe/Oslo
- name: WEBPASSWORD
value: password
#- name: DNS1
# value: 1.1.1.1
# #value: 185.228.168.168
#- name: DNS2
# value: 8.8.8.8
# #value: 185.228.169.168
- name: CONDITIONAL_FORWARDING
value: 'true'
- name: CONDITIONAL_FORWARDING_DOMAIN
value: stonegarden.dev
- name: CONDITIONAL_FORWARDING_IP
value: 192.168.1.128
image: pihole/pihole:latest
imagePullPolicy: Always
name: pi-hole
- name: pi-hole
image: pihole/pihole:2023.05.2
imagePullPolicy: IfNotPresent
envFrom:
- configMapRef:
name: pi-hole-env
ports:
- name: dns-tcp
containerPort: 53
@@ -51,7 +42,7 @@ spec:
- name: dchp
containerPort: 67
protocol: UDP
- name: web
- name: http
containerPort: 80
protocol: TCP
- name: https
@@ -75,11 +66,26 @@ spec:
# port: dns-tcp
# initialDelaySeconds: 15
# periodSeconds: 30
livenessProbe:
httpGet:
path: /admin/index.php
port: http
scheme: HTTP
initialDelaySeconds: 60
failureThreshold: 10
timeoutSeconds: 5
readinessProbe:
httpGet:
path: /admin/index.php
port: http
scheme: HTTP
initialDelaySeconds: 60
failureThreshold: 3
timeoutSeconds: 5
volumeMounts:
- name: etc-pihole
mountPath: /etc/pihole
- name: etc-dnsmasq
mountPath: /etc/dnsmasq.d
- name: custom-dnsmasq
mountPath: /etc/dnsmasq.d/02-custom.conf
subPath: 02-custom.conf
# - name: var-log
# mountPath: /var/log
# - name: var-log-lighttpd
@@ -98,12 +104,10 @@ spec:
# subPath: adlists.list
restartPolicy: Always
volumes:
- name: etc-pihole
emptyDir:
medium: Memory
- name: etc-dnsmasq
emptyDir:
medium: Memory
- name: custom-dnsmasq
configMap:
name: custom-dnsmasq
defaultMode: 420
#- name: var-log
# emptyDir:
# medium: Memory
infra/pi-hole/ingress-route.yaml
+18
View File
@@ -0,0 +1,18 @@
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: pi-hole
spec:
entryPoints:
- websecure
routes:
- match: Host(`pi-hole.stonegarden.dev`)
kind: Rule
services:
- name: pi-hole-web
port: http
middlewares:
- name: traefik-forward-auth
tls:
store:
name: cloudflare-tls
infra/pi-hole/kustomization.yaml
+20
View File
@@ -4,11 +4,31 @@ namespace: pi-hole
commonLabels:
app: pi-hole
configMapGenerator:
- name: pi-hole-env
envs:
- config/pi-hole-env
- name: custom-dnsmasq
files:
- config/02-custom.conf
resources:
- namespace.yaml
- auth-secret.yaml
- ingress-route.yaml
- service.yaml
#- cm-dnsmasq.yaml
#- cm-adlists.yaml
#- cm-ftl.yaml
#- cm-regex.yaml
#- cm-whitelist.yaml
- deployment.yaml
helmGlobals:
chartHome: ../../charts
helmCharts:
- name: application
releaseName: auth
valuesFile: auth-values.yaml
infra/pi-hole/service.yaml
+29 -14
View File
@@ -2,37 +2,52 @@
kind: Service
apiVersion: v1
metadata:
name: pi-hole-udp
name: pi-hole-dns-udp
namespace: pi-hole
annotations:
metallb.universe.tf/allow-shared-ip: dns
metallb.universe.tf/allow-shared-ip: pi-hole
spec:
selector:
app: pi-hole
ports:
- protocol: UDP
- name: dns-udp
port: 53
name: dnsudp
targetPort: 53
protocol: UDP
targetPort: dns-udp
type: LoadBalancer
---
kind: Service
apiVersion: v1
metadata:
name: pi-hole-tcp
name: pi-hole-dns-tcp
namespace: pi-hole
annotations:
metallb.universe.tf/allow-shared-ip: dns
metallb.universe.tf/allow-shared-ip: pi-hole
spec:
selector:
app: pi-hole
ports:
- protocol: TCP
- name: dns-tcp
port: 53
name: dnstcp
targetPort: 53
- protocol: TCP
protocol: TCP
targetPort: dns-tcp
type: LoadBalancer
---
kind: Service
apiVersion: v1
metadata:
name: pi-hole-web
namespace: pi-hole
annotations:
metallb.universe.tf/allow-shared-ip: pi-hole
spec:
selector:
app: pi-hole
ports:
- name: http
port: 80
name: web
targetPort: 80
type: LoadBalancer
targetPort: http
- name: https
port: 443
targetPort: https
type: LoadBalancer