From dbbcda1434720a8d70d269b55173704202319fe9 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Wed, 19 Jul 2023 23:11:29 +0200 Subject: [PATCH] feat(pi-hole): Adding Pi-Hole --- infra/pi-hole/cm-adlists.yaml | 32 ++++++++ infra/pi-hole/cm-ftl.yaml | 9 ++ infra/pi-hole/cm-regex.yaml | 16 ++++ infra/pi-hole/cm-whitelist.yaml | 9 ++ infra/pi-hole/deployment.yaml | 136 +++++++++++++++++++++++++++++++ infra/pi-hole/kustomization.yaml | 14 ++++ infra/pi-hole/namespace.yaml | 4 + infra/pi-hole/service.yaml | 38 +++++++++ infra/project.yaml | 2 + 9 files changed, 260 insertions(+) create mode 100644 infra/pi-hole/cm-adlists.yaml create mode 100644 infra/pi-hole/cm-ftl.yaml create mode 100644 infra/pi-hole/cm-regex.yaml create mode 100644 infra/pi-hole/cm-whitelist.yaml create mode 100644 infra/pi-hole/deployment.yaml create mode 100644 infra/pi-hole/kustomization.yaml create mode 100644 infra/pi-hole/namespace.yaml create mode 100644 infra/pi-hole/service.yaml diff --git a/infra/pi-hole/cm-adlists.yaml b/infra/pi-hole/cm-adlists.yaml new file mode 100644 index 0000000..440144e --- /dev/null +++ b/infra/pi-hole/cm-adlists.yaml @@ -0,0 +1,32 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: adlists.list + namespace: pi-hole +data: + adlists.list: | + https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts + https://mirror1.malwaredomains.com/files/justdomains + http://sysctl.org/cameleon/hosts + https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt + https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt + https://hosts-file.net/ad_servers.txt + https://blocklist.site/app/dl/porn + https://blocklist.site/app/dl/fakenews + https://blocklist.site/app/dl/tracking + https://blocklist.site/app/dl/drugs + https://blocklist.site/app/dl/phishing + https://blocklist.site/app/dl/gambling + https://blocklist.site/app/dl/malware + https://blocklist.site/app/dl/spam + https://blocklist.site/app/dl/ads + https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt + https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/android-tracking.txt + https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt + https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.2o7Net/hosts + https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-blocklist.txt + https://v.firebog.net/hosts/Easyprivacy.txt + https://v.firebog.net/hosts/Prigent-Ads.txt + https://blocklist.site/app/dl/scam + https://blocklist.site/app/dl/proxy + https://blocklist.site/app/dl/redirect diff --git a/infra/pi-hole/cm-ftl.yaml b/infra/pi-hole/cm-ftl.yaml new file mode 100644 index 0000000..e2d329a --- /dev/null +++ b/infra/pi-hole/cm-ftl.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: pihole-ftl.conf + namespace: pi-hole +data: + pihole-FTL.conf: | + MAXDBDAYS=7 + LOGFILE=/var/log/pihole/pihole-FTL.log diff --git a/infra/pi-hole/cm-regex.yaml b/infra/pi-hole/cm-regex.yaml new file mode 100644 index 0000000..a35601f --- /dev/null +++ b/infra/pi-hole/cm-regex.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: regex.list + namespace: pi-hole +data: + regex.list: | + (^|\.)googlevideo\.com$ + (^|\.)twitch\.tv$ + (^|\.)wuaki\.tv$ + (^|\.)youtube\.be$ + (^|\.)youtube\.com$ + (^|\.)xvpn\.com$ + (^|\.)xvpn\.io$ + (^|\.)tiktok\.com$ + (^|\.)musical\.ly$ diff --git a/infra/pi-hole/cm-whitelist.yaml b/infra/pi-hole/cm-whitelist.yaml new file mode 100644 index 0000000..ceea752 --- /dev/null +++ b/infra/pi-hole/cm-whitelist.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: whitelist.txt + namespace: pi-hole +data: + whitelist.txt: | + ichnaea.netflix.com + nrdp.nccp.netflix.com diff --git a/infra/pi-hole/deployment.yaml b/infra/pi-hole/deployment.yaml new file mode 100644 index 0000000..541beba --- /dev/null +++ b/infra/pi-hole/deployment.yaml @@ -0,0 +1,136 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: pi-hole + name: pi-hole + namespace: pi-hole +spec: + replicas: 1 + selector: + matchLabels: + app: pi-hole + #strategy: + # rollingUpdate: + # maxSurge: 1 + # maxUnavailable: 0 + # type: RollingUpdate + template: + metadata: + labels: + app: pi-hole + spec: + containers: + - env: + - name: TZ + value: Europe/Oslo + - name: WEBPASSWORD + value: password + #- name: DNS1 + # value: 1.1.1.1 + # #value: 185.228.168.168 + #- name: DNS2 + # value: 8.8.8.8 + # #value: 185.228.169.168 + - name: CONDITIONAL_FORWARDING + value: 'true' + - name: CONDITIONAL_FORWARDING_DOMAIN + value: stonegarden.dev + - name: CONDITIONAL_FORWARDING_IP + value: 192.168.1.128 + image: pihole/pihole:latest + imagePullPolicy: Always + name: pi-hole + ports: + - name: dns-tcp + containerPort: 53 + protocol: TCP + - name: dns-udp + containerPort: 53 + protocol: UDP + - name: dchp + containerPort: 67 + protocol: UDP + - name: web + containerPort: 80 + protocol: TCP + - name: https + containerPort: 443 + protocol: TCP + resources: + requests: + cpu: "20m" + memory: "512Mi" + limits: + cpu: "250m" + memory: "896Mi" + #readinessProbe: + # exec: + # command: ['dig', '@127.0.0.1', 'cnn.com'] + # timeoutSeconds: 20 + # initialDelaySeconds: 5 + # periodSeconds: 60 + #livenessProbe: + # tcpSocket: + # port: dns-tcp + # initialDelaySeconds: 15 + # periodSeconds: 30 + volumeMounts: + - name: etc-pihole + mountPath: /etc/pihole + - name: etc-dnsmasq + mountPath: /etc/dnsmasq.d + # - name: var-log + # mountPath: /var/log + # - name: var-log-lighttpd + # mountPath: /var/log/lighttpd + # - name: ftlconf + # mountPath: /etc/pihole/pihole-FTL.conf + # subPath: pihole-FTL.conf + # - name: regex + # mountPath: /etc/pihole/regex.list + # subPath: regex.list + # - name: whitelist + # mountPath: /etc/pihole/whitelist.txt + # subPath: whitelist.txt + # - name: adlists + # mountPath: /etc/pihole/adlists.list + # subPath: adlists.list + restartPolicy: Always + volumes: + - name: etc-pihole + emptyDir: + medium: Memory + - name: etc-dnsmasq + emptyDir: + medium: Memory + #- name: var-log + # emptyDir: + # medium: Memory + #- name: var-log-lighttpd + # emptyDir: + # medium: Memory + #- name: ftlconf + # configMap: + # name: pihole-ftl.conf + # items: + # - key: pihole-FTL.conf + # path: pihole-FTL.conf + #- name: regex + # configMap: + # name: regex.list + # items: + # - key: regex.list + # path: regex.list + #- name: whitelist + # configMap: + # name: whitelist.txt + # items: + # - key: whitelist.txt + # path: whitelist.txt + #- name: adlists + # configMap: + # name: adlists.list + # items: + # - key: adlists.list + # path: adlists.list \ No newline at end of file diff --git a/infra/pi-hole/kustomization.yaml b/infra/pi-hole/kustomization.yaml new file mode 100644 index 0000000..d010fa7 --- /dev/null +++ b/infra/pi-hole/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: pi-hole +commonLabels: + app: pi-hole + +resources: + - namespace.yaml + - service.yaml + #- cm-adlists.yaml + #- cm-ftl.yaml + #- cm-regex.yaml + #- cm-whitelist.yaml + - deployment.yaml diff --git a/infra/pi-hole/namespace.yaml b/infra/pi-hole/namespace.yaml new file mode 100644 index 0000000..67b859d --- /dev/null +++ b/infra/pi-hole/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: pi-hole diff --git a/infra/pi-hole/service.yaml b/infra/pi-hole/service.yaml new file mode 100644 index 0000000..9438c6f --- /dev/null +++ b/infra/pi-hole/service.yaml @@ -0,0 +1,38 @@ +--- +kind: Service +apiVersion: v1 +metadata: + name: pi-hole-udp + namespace: pi-hole + annotations: + metallb.universe.tf/allow-shared-ip: dns +spec: + selector: + app: pi-hole + ports: + - protocol: UDP + port: 53 + name: dnsudp + targetPort: 53 + type: LoadBalancer +--- +kind: Service +apiVersion: v1 +metadata: + name: pi-hole-tcp + namespace: pi-hole + annotations: + metallb.universe.tf/allow-shared-ip: dns +spec: + selector: + app: pi-hole + ports: + - protocol: TCP + port: 53 + name: dnstcp + targetPort: 53 + - protocol: TCP + port: 80 + name: web + targetPort: 80 + type: LoadBalancer \ No newline at end of file diff --git a/infra/project.yaml b/infra/project.yaml index 47c6cc3..242c600 100644 --- a/infra/project.yaml +++ b/infra/project.yaml @@ -22,6 +22,8 @@ spec: server: '*' - namespace: 'monitoring' server: '*' + - namespace: 'pi-hole' + server: '*' - namespace: 'traefik-system' server: '*' - namespace: 'kube-system'