diff --git a/pi-hole/.editorconfig b/pi-hole/.editorconfig new file mode 100755 index 0000000..7a12570 --- /dev/null +++ b/pi-hole/.editorconfig @@ -0,0 +1,19 @@ +root = true + +[*] +charset = utf-8 +end_of_line = lf +indent_style = space +insert_final_newline = true +trim_trailing_whitespace = true +ident_size = 4 + +[*.md] +ident_size = 2 +trim_trailing_whitespace = false + +[*.json] +ident_size = 2 + +[{.gitignore,.gitkeep,.editorconfig}] +ident_size = 2 diff --git a/pi-hole/.github/CODEOWNERS b/pi-hole/.github/CODEOWNERS new file mode 100644 index 0000000..3fbad49 --- /dev/null +++ b/pi-hole/.github/CODEOWNERS @@ -0,0 +1,4 @@ +# Require maintainer's :+1: for changes to the .github/ repo-config files +# mainly due to https://github.com/probot/settings privilege escalation +.github/* @frenck +.gitlab-ci.yml @frenck diff --git a/pi-hole/.github/FUNDING.yml b/pi-hole/.github/FUNDING.yml new file mode 100644 index 0000000..7f95bd4 --- /dev/null +++ b/pi-hole/.github/FUNDING.yml @@ -0,0 +1,4 @@ +--- +github: frenck +patreon: frenck +custom: https://frenck.dev/donate/ diff --git a/pi-hole/.github/ISSUE_TEMPLATE.md b/pi-hole/.github/ISSUE_TEMPLATE.md new file mode 100755 index 0000000..544da8f --- /dev/null +++ b/pi-hole/.github/ISSUE_TEMPLATE.md @@ -0,0 +1,20 @@ +# Problem/Motivation + +> (Why the issue was filed) + +## Expected behavior + +> (What you expected to happen) + +## Actual behavior + +> (What actually happened) + +## Steps to reproduce + +> (How can someone else make/see it happen) + +## Proposed changes + +> (If you have a proposed change, workaround or fix, +> describe the rationale behind it) diff --git a/pi-hole/.github/PULL_REQUEST_TEMPLATE.md b/pi-hole/.github/PULL_REQUEST_TEMPLATE.md new file mode 100755 index 0000000..cbd529a --- /dev/null +++ b/pi-hole/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,9 @@ +# Proposed Changes + +> (Describe the changes and rationale behind them) + +## Related Issues + +> ([Github link][autolink-references] to related issues or pull requests) + +[autolink-references]: https://help.github.com/articles/autolinked-references-and-urls/ \ No newline at end of file diff --git a/pi-hole/.github/autolabeler.yml b/pi-hole/.github/autolabeler.yml new file mode 100644 index 0000000..3ce5703 --- /dev/null +++ b/pi-hole/.github/autolabeler.yml @@ -0,0 +1,2 @@ +--- +"Type: Documentation": ["*.md", "*.j2"] diff --git a/pi-hole/.github/config.yml b/pi-hole/.github/config.yml new file mode 100644 index 0000000..f5828bb --- /dev/null +++ b/pi-hole/.github/config.yml @@ -0,0 +1,50 @@ +--- +# Configuration for request-info - https://github.com/behaviorbot/request-info + +# *OPTIONAL* Comment to reply with +# Can be either a string : +requestInfoReplyComment: + - "We would appreciate it if you could provide us with more info about this issue/pr!" + - "Hmmm... That issue/PR is kinda low on text. Could you please provide some more content?" + +# *OPTIONAL* default titles to check against for lack of descriptiveness +# MUST BE ALL LOWERCASE +requestInfoDefaultTitles: [] + +# *OPTIONAL* Label to be added to Issues and Pull Requests with insufficient information given +requestInfoLabelToAdd: "Incomplete" + +# *OPTIONAL* Require Pull Requests to contain more information than what is provided in the PR template +# Will fail if the pull request's body is equal to the provided template +checkPullRequestTemplate: true + +# *OPTIONAL* Only warn about insufficient information on these events type +# Keys must be lowercase. Valid values are 'issue' and 'pullRequest' +requestInfoOn: + pullRequest: true + issue: true + +# *OPTIONAL* Add a list of people whose Issues/PRs will not be commented on +# keys must be GitHub usernames +requestInfoUserstoExclude: [] + +# Configuration for new-issue-welcome - https://github.com/behaviorbot/new-issue-welcome + +# Comment to be posted to on first time issues +newIssueWelcomeComment: > + :wave: Thanks for opening your first issue here! + If you're reporting a :bug: bug, please make sure you include steps to reproduce it. + Also, logs, error messages and information about your hardware might be useful. + +# Configuration for new-pr-welcome - https://github.com/behaviorbot/new-pr-welcome + +# Comment to be posted to on PRs from first time contributors in your repository +newPRWelcomeComment: > + :sparkling_heart: Thanks for opening this pull request! :sparkling_heart: + If your PR gets accepted and merged in, we will invite you to the project :tada: + +# Configuration for first-pr-merge - https://github.com/behaviorbot/first-pr-merge + +# Comment to be posted to on pull requests merged by a first time user +firstPRMergeComment: > + Congrats on merging your first pull request! :tada::tada::tada: diff --git a/pi-hole/.github/invite-contributors.yml b/pi-hole/.github/invite-contributors.yml new file mode 100644 index 0000000..25eb31a --- /dev/null +++ b/pi-hole/.github/invite-contributors.yml @@ -0,0 +1,10 @@ +--- +# If true, this will add new contributors as outside collaborators +# to the repo their PR was merged in. Team name is ignored if this +# flag is set to true. +isOutside: false + +# Specify team name to add new contributors to a specific team +# within your organization. +# Use team name or team-name-slug +team: Contributors diff --git a/pi-hole/.github/lock.yml b/pi-hole/.github/lock.yml new file mode 100644 index 0000000..4b1e816 --- /dev/null +++ b/pi-hole/.github/lock.yml @@ -0,0 +1,20 @@ +--- +# Configuration for lock-threads - https://github.com/dessant/lock-threads +# Number of days of inactivity before a closed issue or pull request is locked +daysUntilLock: 30 + +# Comment to post before locking. Set to `false` to disable +lockComment: > + This thread has been automatically locked because it has not had recent + activity. Please open a new issue for related bugs and link to relevant + comments in this thread. + +# Issues or pull requests with these labels will not be locked +# exemptLabels: +# - no-locking + +# Limit to only `issues` or `pulls` +# only: issues + +# Add a label when locking. Set to `false` to disable +lockLabel: false diff --git a/pi-hole/.github/move.yml b/pi-hole/.github/move.yml new file mode 100644 index 0000000..0c2276a --- /dev/null +++ b/pi-hole/.github/move.yml @@ -0,0 +1,20 @@ +--- +# Delete the command comment when it contains no other content +deleteCommand: true + +# Close the source issue after moving +closeSourceIssue: true + +# Lock the source issue after moving +lockSourceIssue: true + +# Mention issue and comment authors +mentionAuthors: true + +# Preserve mentions in the issue content +keepContentMentions: false + +# Set custom aliases for targets +# aliases: +# r: repo +# or: owner/repo diff --git a/pi-hole/.github/no-response.yml b/pi-hole/.github/no-response.yml new file mode 100644 index 0000000..bb9f0f2 --- /dev/null +++ b/pi-hole/.github/no-response.yml @@ -0,0 +1,13 @@ +--- +# Configuration for probot-no-response - https://github.com/probot/no-response +# Number of days of inactivity before an Issue is closed for lack of response +daysUntilClose: 14 +# Label requiring a response +responseRequiredLabel: "Status: Awaiting response" +# Comment to post when closing an Issue for lack of response. Set to `false` to disable +closeComment: > + This issue has been automatically closed because there has been no response + to our request for more information from the original author. With only the + information that is currently in the issue, we don't have enough information + to take action. Please reach out if you have or find the answers we need so + that we can investigate further. diff --git a/pi-hole/.github/potential-duplicates.yml b/pi-hole/.github/potential-duplicates.yml new file mode 100644 index 0000000..00c7c0f --- /dev/null +++ b/pi-hole/.github/potential-duplicates.yml @@ -0,0 +1,14 @@ +--- +# Label name and color to set, when potential duplicates are detected +issueLabel: "Potential duplicate" +labelColor: e6e6e6 + +# If similarity is higher than this threshold, issue will be marked as duplicate +threshold: 0.70 + +# Comment to post when potential duplicates are detected +referenceComment: > + Potential duplicates found: + {{#issues}} + - [#{{ number }}] {{ title }} ({{ accuracy }}%) + {{/issues}} diff --git a/pi-hole/.github/settings.yml b/pi-hole/.github/settings.yml new file mode 100644 index 0000000..589574a --- /dev/null +++ b/pi-hole/.github/settings.yml @@ -0,0 +1,150 @@ +--- +repository: + description: "Pi-hole - Home Assistant Community Add-ons" + homepage: https://addons.community + topics: pihole, pi-hole, adblock, adblocker, addon, addons, home-assistant, homeassistant + private: false + has_issues: true + has_projects: false + has_wiki: false + has_downloads: false + default_branch: master + allow_squash_merge: true + allow_merge_commit: false + allow_rebase_merge: true +labels: + # Priority labels + - name: "Priority: Critical" + color: ee0701 + description: "This should be dealt with ASAP. Not fixing this issue would be a serious error." + - name: "Priority: High" + color: b60205 + description: "After critical issues are fixed, these should be dealt with before any further issues." + - name: "Priority: Medium" + color: 0e8a16 + description: "This issue may be useful, and needs some attention." + - name: "Priority: Low" + color: e4ea8a + description: "Nice addition, maybe... someday..." + + # Type labels + - name: "Type: Bug" + color: ee0701 + description: "Inconsistencies or issues which will cause a problem for users or implementors." + - name: "Type: Documentation" + color: 0052cc + description: "Solely about the documentation of the project." + - name: "Type: Enhancement" + color: 1d76db + description: "Enhancement of the code, not introducing new features." + - name: "Type: Feature" + color: 0e8a16 + description: "New features or options." + - name: "Type: Support" + color: 5319e7 + description: "Marks an issue as a support ticket." + - name: "Type: Discussion" + color: d4c5f9 + description: "Marks an issue as a generic discussion ticket." + - name: "Type: Maintenance" + color: 2af79e + description: "Generic maintenance tasks, e.g., package updates." + + # Additional markers + - name: "Security" + color: ee0701 + description: "Marks a security issue that needs to be resolved asap." + - name: "Idea" + color: fef2c0 + description: "Marks an idea, which might be excepted and implemented." + - name: "Incomplete" + color: fef2c0 + description: "Marks a PR or issue that is missing information." + - name: "Pull request" + color: fbca04 + description: "There is an PR opened for this issue." + - name: "Accepted" + color: c2e0c6 + description: "This issue or PR has been accepted." + - name: "Declined" + color: f9d0c4 + description: "This issue or PR has been declined." + - name: "Potential duplicate" + color: e6e6e6 + description: "This issue has been automatically marked as a potential duplicate." + + # Ongoing Status labels + - name: "Status: Triage" + color: fbca04 + description: "This issue needs to be triaged." + - name: "Status: On hold" + color: cccccc + description: "Issue or PR that has been placed on hold for now." + - name: "Status: In progress" + color: fbca04 + description: "Issue is currently being resolved by a developer." + - name: "Status: Stale" + color: fef2c0 + description: "There has not been activity on this issue or PR for quite some time." + - name: "Status: Awaiting response" + color: fef2c0 + description: "Issue or PR awaits response from the creator." + - name: "Status: Blocked" + color: fef2c0 + description: "Progress on this issue is currently not possible." + + # Closing status labels + - name: "Closed: Known limitation" + color: e6e6e6 + description: "Issue is closed, it is a known limitation." + - name: "Closed: Expected behavior" + color: e6e6e6 + description: "Issues is closed, it is expected behavior." + - name: "Closed: Duplicate" + color: e6e6e6 + description: "Issue is closed, duplicate of an existing issue." + - name: "Closed: Invalid" + color: e6e6e6 + description: "Issue is closed, marked as not a valid issue (e.g., an user error)." + - name: "Closed: Wrong repository" + color: e6e6e6 + description: "Issue is closed, was created in the wrong repository." + - name: "Closed: Won't Fix" + color: e6e6e6 + description: "Issue is closed, it won't be fixed." + - name: "Closed: Done" + color: c2e0c6 + description: "Issue closed, work on this issue has been marked complete." + + # Others + - name: "Beginner Friendly" + color: 0e8a16 + description: "Good first issue for people wanting to contribute to the project." + - name: "Help wanted" + color: 0e8a16 + description: "We need some extra helping hands or expertise in order to resolve this." + - name: "Hacktoberfest" + description: "Issues/PRs are participating in the Hacktoberfest" + color: fbca04 + +branches: + - name: master + protection: + required_pull_request_reviews: + # required_approving_review_count: 1 + dismiss_stale_reviews: true + require_code_owner_reviews: true + dismissal_restrictions: + users: [] + teams: + - Admins + - Masters + required_status_checks: + strict: false + contexts: [] + enforce_admins: false + restrictions: + users: [] + teams: + - Admins + - Masters diff --git a/pi-hole/.github/stale.yml b/pi-hole/.github/stale.yml new file mode 100644 index 0000000..36938bb --- /dev/null +++ b/pi-hole/.github/stale.yml @@ -0,0 +1,61 @@ +--- +# Configuration for probot-stale - https://github.com/probot/stale + +# Number of days of inactivity before an Issue or Pull Request becomes stale +daysUntilStale: 60 + +# Number of days of inactivity before a stale Issue or Pull Request is closed. +# Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale. +daysUntilClose: 7 + +# Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable +exemptLabels: + - "Status: On hold" + - "Status: In progress" + - "Status: Awaiting response" + - "Status: Blocked" + - "Idea" + - "Security" + +# Set to true to ignore issues in a project (defaults to false) +exemptProjects: false + +# Set to true to ignore issues in a milestone (defaults to false) +exemptMilestones: false + +# Label to use when marking as stale +staleLabel: "Status: Stale" + +# Comment to post when marking as stale. Set to `false` to disable +markComment: > + This issue has been automatically marked as stale because it has not had + recent activity. It will be closed if no further activity occurs. Thank you + for your contributions. + +# Comment to post when removing the stale label. +# unmarkComment: > +# Your comment here. +unmarkComment: false + +# Comment to post when closing a stale Issue or Pull Request. +# closeComment: > +# Your comment here. +closeComment: false + +# Limit the number of actions per hour, from 1-30. Default is 30 +limitPerRun: 30 + +# Limit to only `issues` or `pulls` +only: issues + +# Optionally, specify configuration settings that are specific to just 'issues' or 'pulls': +# pulls: +# daysUntilStale: 30 +# markComment: > +# This pull request has been automatically marked as stale because it has not had +# recent activity. It will be closed if no further activity occurs. Thank you +# for your contributions. + +# issues: +# exemptLabels: +# - confirmed diff --git a/pi-hole/.github/support.yml b/pi-hole/.github/support.yml new file mode 100644 index 0000000..9f0cb87 --- /dev/null +++ b/pi-hole/.github/support.yml @@ -0,0 +1,22 @@ +--- +# Configuration for support-requests - https://github.com/dessant/support-requests + +# Label used to mark issues as support requests +supportLabel: "Type: Support" + +# Comment to post on issues marked as support requests. Add a link +# to a support page, or set to `false` to disable +supportComment: > + :wave: We use the issue tracker exclusively for bug reports and feature requests. + However, this issue appears to be a support request. Please use our + support channels to get help with the project. + + Head over to the + [Home Assistant community forum](https://community.home-assistant.io/t/home-assistant-community-add-on-pi-hole/33817?u=frenck) + or join our [Discord](https://discord.me/hassioaddons) chat. + +# Close issues marked as support requests +close: true + +# Lock issues marked as support requests +lock: false diff --git a/pi-hole/.gitignore b/pi-hole/.gitignore new file mode 100644 index 0000000..e69de29 diff --git a/pi-hole/.gitlab-ci.yml b/pi-hole/.gitlab-ci.yml new file mode 100644 index 0000000..d8a4017 --- /dev/null +++ b/pi-hole/.gitlab-ci.yml @@ -0,0 +1,13 @@ +--- +include: https://raw.githubusercontent.com/hassio-addons/organization/master/gitlabci/addon.yml + +variables: + ADDON_GITHUB_REPO: "hassio-addons/addon-pi-hole" + ADDON_SLUG: "pi-hole" + ADDON_TARGET: "pi-hole" + + ADDON_AARCH64_BASE: "hassioaddons/base-aarch64:7.0.5" + ADDON_AMD64_BASE: "hassioaddons/base-amd64:7.0.5" + ADDON_ARMHF_BASE: "hassioaddons/base-armhf:7.0.5" + ADDON_ARMV7_BASE: "hassioaddons/base-armv7:7.0.5" + ADDON_I386_BASE: "hassioaddons/base-i386:7.0.5" diff --git a/pi-hole/.mdlrc b/pi-hole/.mdlrc new file mode 100644 index 0000000..2b0128d --- /dev/null +++ b/pi-hole/.mdlrc @@ -0,0 +1 @@ +rules "~MD024" \ No newline at end of file diff --git a/pi-hole/.yamllint b/pi-hole/.yamllint new file mode 100644 index 0000000..f4bc5a4 --- /dev/null +++ b/pi-hole/.yamllint @@ -0,0 +1,66 @@ +--- +rules: + braces: + level: error + min-spaces-inside: 0 + max-spaces-inside: 1 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: -1 + brackets: + level: error + min-spaces-inside: 0 + max-spaces-inside: 0 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: -1 + colons: + level: error + max-spaces-before: 0 + max-spaces-after: 1 + commas: + level: error + max-spaces-before: 0 + min-spaces-after: 1 + max-spaces-after: 1 + comments: + level: error + require-starting-space: true + min-spaces-from-content: 2 + comments-indentation: + level: error + document-end: + level: error + present: false + document-start: + level: error + present: true + empty-lines: + level: error + max: 1 + max-start: 0 + max-end: 1 + hyphens: + level: error + max-spaces-after: 1 + indentation: + level: error + spaces: 2 + indent-sequences: true + check-multi-line-strings: false + key-duplicates: + level: error + line-length: + ignore: | + .github/support.yml + level: warning + max: 120 + allow-non-breakable-words: true + allow-non-breakable-inline-mappings: true + new-line-at-end-of-file: + level: error + new-lines: + level: error + type: unix + trailing-spaces: + level: error + truthy: + level: error diff --git a/pi-hole/CODE_OF_CONDUCT.md b/pi-hole/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..0ac232b --- /dev/null +++ b/pi-hole/CODE_OF_CONDUCT.md @@ -0,0 +1,74 @@ +# Code of conduct + +## Our pledge + +In the interest of fostering an open and welcoming environment, we as +contributors and maintainers pledge to making participation in our project and +our community a harassment-free experience for everyone, regardless of age, body +size, disability, ethnicity, gender identity and expression, level of experience, +nationality, personal appearance, race, religion, or sexual identity and +orientation. + +## Our standards + +Examples of behavior that contributes to creating a positive environment +include: + +- Using welcoming and inclusive language +- Being respectful of differing viewpoints and experiences +- Gracefully accepting constructive criticism +- Focusing on what is best for the community +- Showing empathy towards other community members + +Examples of unacceptable behavior by participants include: + +- The use of sexualized language or imagery and unwelcome sexual attention + or advances +- Trolling, insulting/derogatory comments, and personal or political attacks +- Public or private harassment +- Publishing others' private information, such as a physical or + electronic address, without explicit permission +- Other conduct which could reasonably be considered inappropriate + in a professional setting + +## Our responsibilities + +Project maintainers are responsible for clarifying the standards of acceptable +behavior and are expected to take appropriate and fair corrective action in +response to any instances of unacceptable behavior. + +Project maintainers have the right and responsibility to remove, edit, or +reject comments, commits, code, wiki edits, issues, and other contributions +that are not aligned to this Code of Conduct, or to ban temporarily or +permanently any contributor for other behaviors that they deem inappropriate, +threatening, offensive, or harmful. + +## Scope + +This Code of Conduct applies both within project spaces and in public spaces +when an individual is representing the project or its community. Examples of +representing a project or community include using an official project e-mail +address, posting via an official social media account, or acting as an appointed +representative at an online or offline event. Representation of a project may be +further defined and clarified by project maintainers. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported by contacting the project lead at frenck@addons.community. All +complaints will be reviewed and investigated and will result in a response that +is deemed necessary and appropriate to the circumstances. The project lead is +obligated to maintain confidentiality with regard to the reporter of an incident. +Further details of specific enforcement policies may be posted separately. + +Project maintainers who do not follow or enforce the Code of Conduct in good +faith may face temporary or permanent repercussions as determined by other +members of the project's leadership. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 1.4, available at [http://contributor-covenant.org/version/1/4][version] + +[homepage]: http://contributor-covenant.org +[version]: http://contributor-covenant.org/version/1/4/ diff --git a/pi-hole/CONTRIBUTING.md b/pi-hole/CONTRIBUTING.md new file mode 100644 index 0000000..1a7c5a9 --- /dev/null +++ b/pi-hole/CONTRIBUTING.md @@ -0,0 +1,29 @@ +# Contributing + +When contributing to this repository, please first discuss the change you wish +to make via issue, email, or any other method with the owners of this repository +before making a change. + +Please note we have a code of conduct, please follow it in all your interactions +with the project. + +## Issues and feature requests + +You've found a bug in the source code, a mistake in the documentation or maybe +you'd like a new feature? You can help us by submitting an issue to our +[GitHub Repository][github]. Before you create an issue, make sure you search +the archive, maybe your question was already answered. + +Even better: You could submit a pull request with a fix / new feature! + +## Pull request process + +1. Search our repository for open or closed [pull requests][prs] that relates + to your submission. You don't want to duplicate effort. + +1. You may merge the pull request in once you have the sign-off of two other + developers, or if you do not have permission to do that, you may request + the second reviewer to merge it for you. + +[github]: https://github.com/hassio-addons/addon-pi-hole/issues +[prs]: https://github.com/hassio-addons/addon-pi-hole/pulls \ No newline at end of file diff --git a/pi-hole/LICENSE.md b/pi-hole/LICENSE.md new file mode 100644 index 0000000..bb9881b --- /dev/null +++ b/pi-hole/LICENSE.md @@ -0,0 +1,21 @@ +# MIT License + +Copyright (c) 2017-2020 Franck Nijhof + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/pi-hole/README.md b/pi-hole/README.md new file mode 100644 index 0000000..c1dc0f7 --- /dev/null +++ b/pi-hole/README.md @@ -0,0 +1,340 @@ +# Home Assistant Community Add-on: Pi-hole + +[![GitHub Release][releases-shield]][releases] +![Project Stage][project-stage-shield] +[![License][license-shield]](LICENSE.md) + +![Supports aarch64 Architecture][aarch64-shield] +![Supports amd64 Architecture][amd64-shield] +![Supports armhf Architecture][armhf-shield] +![Supports armv7 Architecture][armv7-shield] +![Supports i386 Architecture][i386-shield] + +[![GitLab CI][gitlabci-shield]][gitlabci] +![Project Maintenance][maintenance-shield] +[![GitHub Activity][commits-shield]][commits] + +[![Discord][discord-shield]][discord] +[![Community Forum][forum-shield]][forum] + +[![Sponsor Frenck via GitHub Sponsors][github-sponsors-shield]][github-sponsors] + +[![Support Frenck on Patreon][patreon-shield]][patreon] + +Network-wide ad blocking + +## Deprecation warning + +**This add-on is in a deprecated state!** + +The Pi-hole add-on is now deprecated and will no longer be supported, maintained +and will not receive future updates or fixes. + +Pi-hole used to be a great solution to filter network traffic, but it has been +a challenge to keep/get it in a working state as an add-on. + +Meanwhile, the AdGuard team published an alternative: +[AdGuard Home](https://github.com/hassio-addons/addon-adguard-home). + +AdGuard Home as surpassed Pi-hole in terms of capabilities, features, +and stability, and Home Assistant provides a good integration with AdGuard. +Above all, the AdGuard Home team has been supportive in developing the add-on. + +For those reasons, it is no longer viable to keep maintaining the Pi-hole +add-on, which has been problematic at best. + +We strongly recommend migrating to the AdGuard Home add-on, which is available +in the add-on store. + +## About + +[Pi-hole][pi-hole] is an advertising-aware DNS- and web server, meant to be run +on a dedicated Raspberry Pi connected to your home network. Pi-hole lets you +block advertisements for every device that connects to your network without the +need for any client-side software. + +This add-on is a port of Pi-hole to be able to run on Home Assistant and is +based on Alpine Linux and is using Docker. + +## Installation + +The installation of this add-on is pretty straightforward and not different in +comparison to installing any other Home Assistant add-on. + +1. **Ensure your Home Assistant device has a + [static IP and static external DNS servers!](https://github.com/home-assistant/hassos/blob/dev/Documentation/network.md#static-ip)** +1. Search for the "Pi-hole" add-on in the Supervisor add-on store + and install it. +1. Start the "Pi-hole" add-on +1. Check the logs of the "Pi-hole" add-on to see it in action. + +## Configuration + +**Note**: _Remember to restart the add-on when the configuration is changed._ + +Example add-on configuration: + +```yaml +log_level: info +update_lists_on_start: true +ssl: false +certfile: fullchain.pem +keyfile: privkey.pem +interface: eth0 +ipv6: true +ipv4_address: '' +ipv6_address: '' +hosts: + - name: printer.local + ip: 192.168.1.5 + - name: router.local + ip: 192.168.1.1 + - name: router.local + ip: "FE80:0000:0000:0000:0202:B3FF:FE1E:8329" +``` + +**Note**: _This is just an example, don't copy and paste it! Create your own!_ + +### Option: `log_level` + +The `log_level` option controls the level of log output by the addon and can +be changed to be more or less verbose, which might be useful when you are +dealing with an unknown issue. Possible values are: + +- `trace`: Show every detail, like all called internal functions. +- `debug`: Shows detailed debug information. +- `info`: Normal (usually) interesting events. +- `warning`: Exceptional occurrences that are not errors. +- `error`: Runtime errors that do not require immediate action. +- `fatal`: Something went terribly wrong. Add-on becomes unusable. + +Please note that each level automatically includes log messages from a +more severe level, e.g., `debug` also shows `info` messages. By default, +the `log_level` is set to `info`, which is the recommended setting unless +you are troubleshooting. + +Using `trace` or `debug` log levels puts the dnsmasq daemon into debug mode, +allowing you to see all DNS requests in the add-on log. + +### Option: `update_lists_on_start` + +Download and process all configured ad block lists on add-on startup by setting +this option to `true`. This will add startup time to your add-on but will give +you the most recent versions of the ad block lists on start. + +When this option is set to `false` you will still get updated lists once in a +while. A scheduled task will take care of that. + +**Note**: _When starting the add-on for the very first time, the lists will be +updated, regardless of the value of this option._ + +### Option: `ssl` + +Enables/Disables SSL (HTTPS) on the web interface of Pi-hole. Set it `true` to +enable it, `false` otherwise. + +### Option: `certfile` + +The certificate file to use for SSL. + +**Note**: _The file MUST be stored in `/ssl/`, which is the default_ + +### Option: `keyfile` + +The private key file to use for SSL. + +**Note**: _The file MUST be stored in `/ssl/`, which is the default_ + +### Option: `interface` + +Configures the interface the Pi-hole DNS server should be listening to. By +leaving it empty, the add-on will try to auto-detect the interface to use. + +**Note**: _This option is in place in case auto-detection fails on your setup._ + +### Option: `ipv6` + +Set this option to `false` to disable IPv6 support. + +### Option: `ipv4_address` + +Manually set the IPv4 address for Pi-hole to use. By leaving it empty, the +add-on will try to auto-detect the interface to use. + +**Note**: _This option is in place in case auto-detection fails on your setup._ + +### Option: `ipv6_address` + +Manually set the IPv6 address for Pi-hole to use. By leaving it empty, the +add-on will try to auto-detect the interface to use. + +**Note**: _This option is in place in case auto-detection fails on your setup._ + +### Option: `hosts` + +This option allows you create your own DNS entries for your LAN. This +capability can be handy for pointing easy to remember hostnames to an IP +(e.g., point `printer.local` to the IP address of your printer). + +Add a list of hosts you want to add. Some hosts can have both IPv4 and IPv6 +addresses. In that case, simply add the host twice (with both addresses). + +See the example above this chapter for a more visual representation. + +#### Sub-option: `name` + +This option specifies the DNS name of the host you are adding. Its value could +be a short style hostname like: `printer` or a longer one `printer.local`. + +#### Sub-option: `ip` + +The IP address this specified host must point to. Its value must be an IPv6 or +IPv4 IP address. + +### Option: `leave_front_door_open` + +Adding this option to the add-on configuration allows you to disable +authentication on the admin interface by setting it to `true` and leaving the +password empty. + +**Note**: _We STRONGLY suggest, not to use this, even if this add-on is +only exposed to your internal network. USE AT YOUR OWN RISK!_ + +## Using the Pi-hole integration in Home Assistant + +Home Assistant offers a [Pi-hole integration][pi-hole-integration] that allows +you to retrieve statistics and interact with your Pi-hole installation. + +To enable this integration, add the following lines to your `configuration.yaml` +file: + +```yaml +# Example configuration.yaml entry +pi_hole: + host: localhost:4865 + api_key: "" +``` + +For more information and documentation about configuring this sensor, please +check the [documentation of Home Assistant][pi-hole-integration]. + +## Changelog & Releases + +This repository keeps a change log using [GitHub's releases][releases] +functionality. The format of the log is based on +[Keep a Changelog][keepchangelog]. + +Releases are based on [Semantic Versioning][semver], and use the format +of ``MAJOR.MINOR.PATCH``. In a nutshell, the version will be incremented +based on the following: + +- ``MAJOR``: Incompatible or major changes. +- ``MINOR``: Backwards-compatible new features and enhancements. +- ``PATCH``: Backwards-compatible bugfixes and package updates. + +## Support + +Got questions? + +You have several options to get them answered: + +- The [Home Assistant Community Add-ons Discord chat server][discord] for add-on + support and feature requests. +- The [Home Assistant Discord chat server][discord-ha] for general Home + Assistant discussions and questions. +- The Home Assistant [Community Forum][forum]. +- Join the [Reddit subreddit][reddit] in [/r/homeassistant][reddit] + +You could also [open an issue here][issue] GitHub. + +## Contributing + +This is an active open-source project. We are always open to people who want to +use the code or contribute to it. + +We have set up a separate document containing our +[contribution guidelines](CONTRIBUTING.md). + +Thank you for being involved! :heart_eyes: + +## Authors & contributors + +The original setup of this repository is by [Franck Nijhof][frenck]. + +For a full list of all authors and contributors, +check [the contributor's page][contributors]. + +## We have got some Home Assistant add-ons for you + +Want some more functionality to your Home Assistant instance? + +We have created multiple add-ons for Home Assistant. For a full list, check out +our [GitHub Repository][repository]. + +## Trademark legal notice + +This add-on is not created, developed, affiliated, supported, maintained +or endorsed by Pi-hole LLC. + +All product names, logos, brands, trademarks and registered trademarks are +property of their respective owners. All company, product, and service names +used are for identification purposes only. + +Use of these names, logos, trademarks, and brands does not imply endorsement. + +## License + +MIT License + +Copyright (c) 2017-2020 Franck Nijhof + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +[aarch64-shield]: https://img.shields.io/badge/aarch64-yes-green.svg +[amd64-shield]: https://img.shields.io/badge/amd64-yes-green.svg +[armhf-shield]: https://img.shields.io/badge/armhf-yes-green.svg +[armv7-shield]: https://img.shields.io/badge/armv7-yes-green.svg +[commits-shield]: https://img.shields.io/github/commit-activity/y/hassio-addons/addon-pi-hole.svg +[commits]: https://github.com/hassio-addons/addon-pi-hole/commits/master +[contributors]: https://github.com/hassio-addons/addon-pi-hole/graphs/contributors +[discord-ha]: https://discord.gg/c5DvZ4e +[discord-shield]: https://img.shields.io/discord/478094546522079232.svg +[discord]: https://discord.me/hassioaddons +[forum-shield]: https://img.shields.io/badge/community-forum-brightgreen.svg +[forum]: https://community.home-assistant.io/t/home-assistant-community-add-on-pi-hole/33817?u=frenck +[frenck]: https://github.com/frenck +[github-sponsors-shield]: https://frenck.dev/wp-content/uploads/2019/12/github_sponsor.png +[github-sponsors]: https://github.com/sponsors/frenck +[gitlabci-shield]: https://gitlab.com/hassio-addons/addon-pi-hole/badges/master/pipeline.svg +[gitlabci]: https://gitlab.com/hassio-addons/addon-pi-hole/pipelines +[i386-shield]: https://img.shields.io/badge/i386-yes-green.svg +[issue]: https://github.com/hassio-addons/addon-pi-hole/issues +[keepchangelog]: http://keepachangelog.com/en/1.0.0/ +[license-shield]: https://img.shields.io/github/license/hassio-addons/addon-pi-hole.svg +[maintenance-shield]: https://img.shields.io/maintenance/yes/2020.svg +[patreon-shield]: https://frenck.dev/wp-content/uploads/2019/12/patreon.png +[patreon]: https://www.patreon.com/frenck +[pi-hole-integration]: https://www.home-assistant.io/components/pi_hole/ +[pi-hole]: https://pi-hole.net/ +[project-stage-shield]: https://img.shields.io/badge/project%20stage-%20!%20DEPRECATED%20%20%20!-ff0000.svg +[reddit]: https://reddit.com/r/homeassistant +[releases-shield]: https://img.shields.io/github/release/hassio-addons/addon-pi-hole.svg +[releases]: https://github.com/hassio-addons/addon-pi-hole/releases +[repository]: https://github.com/hassio-addons/repository +[semver]: http://semver.org/spec/v2.0.0.html diff --git a/pi-hole/pi-hole/.README.j2 b/pi-hole/pi-hole/.README.j2 new file mode 100644 index 0000000..d02d84e --- /dev/null +++ b/pi-hole/pi-hole/.README.j2 @@ -0,0 +1,100 @@ +# Home Assistant Community Add-on: Pi-hole + +[![Release][release-shield]][release] ![Project Stage][project-stage-shield] ![Project Maintenance][maintenance-shield] + +[![Discord][discord-shield]][discord] [![Community Forum][forum-shield]][forum] + +[![Sponsor Frenck via GitHub Sponsors][github-sponsors-shield]][github-sponsors] + +[![Support Frenck on Patreon][patreon-shield]][patreon] + +Network-wide ad blocking + +## Deprecation warning + +**This add-on is in a deprecated state!** + +The Pi-hole add-on is now deprecated and will no longer be supported, maintained +and will not receive future updates or fixes. + +Pi-hole used to be a great solution to filter network traffic, but it has been +a challenge to keep/get it in a working state as an add-on. + +Meanwhile, the AdGuard team published an alternative: +[AdGuard Home](https://github.com/hassio-addons/addon-adguard-home). + +AdGuard Home as surpassed Pi-hole in terms of capabilities, features, +and stability, and Home Assistant provides a good integration with AdGuard. +Above all, the AdGuard Home team has been supportive in developing the add-on. + +For those reasons, it is no longer viable to keep maintaining the Pi-hole +add-on, which has been problematic at best. + +We strongly recommend migrating to the AdGuard Home add-on, which is available +in the add-on store. + +## About + +[Pi-hole][pi-hole] is an advertising-aware DNS- and web server, meant to be run +on a dedicated Raspberry Pi connected to your home network. Pi-hole lets you +block advertisements for every device that connects to your network without the +need for any client-side software. + +This add-on is a port of Pi-hole to be able to run on Home Assistant and +is based on Alpine Linux and is using Docker. + +[Click here for the full documentation][docs] + +{% if channel == "edge" %} +## WARNING! THIS IS AN EDGE VERSION! + +This Home Assistant Add-ons repository contains edge builds of add-ons. +Edge builds add-ons are based upon the latest development version. + +- They may not work at all. +- They might stop working at any time. +- They could have a negative impact on your system. + +This repository was created for: + +- Anybody willing to test. +- Anybody interested in trying out upcoming add-ons or add-on features. +- Developers. + +If you are more interested in stable releases of our add-ons: + + + +{% endif %} +{% if channel == "beta" %} +## WARNING! THIS IS A BETA VERSION! + +This Home Assistant Add-ons repository contains beta releases of add-ons. + +- They might stop working at any time. +- They could have a negative impact on your system. + +This repository was created for: + +- Anybody willing to test. +- Anybody interested in trying out upcoming add-ons or add-on features. + +If you are more interested in stable releases of our add-ons: + + + +{% endif %} +[discord-shield]: https://img.shields.io/discord/478094546522079232.svg +[discord]: https://discord.me/hassioaddons +[docs]: {{ repo }}/blob/{{ version }}/README.md +[forum-shield]: https://img.shields.io/badge/community-forum-brightgreen.svg +[forum]: https://community.home-assistant.io/t/home-assistant-community-add-on-pi-hole/33817?u=frenck +[github-sponsors-shield]: https://frenck.dev/wp-content/uploads/2019/12/github_sponsor.png +[github-sponsors]: https://github.com/sponsors/frenck +[maintenance-shield]: https://img.shields.io/maintenance/yes/2020.svg +[patreon-shield]: https://frenck.dev/wp-content/uploads/2019/12/patreon.png +[patreon]: https://www.patreon.com/frenck +[pi-hole]: https://pi-hole.net/ +[project-stage-shield]: https://img.shields.io/badge/project%20stage-%20!%20DEPRECATED%20%20%20!-ff0000.svg +[release-shield]: https://img.shields.io/badge/version-{{ version }}-blue.svg +[release]: {{ repo }}/tree/{{ version }} diff --git a/pi-hole/pi-hole/Dockerfile b/pi-hole/pi-hole/Dockerfile new file mode 100644 index 0000000..1abe1a2 --- /dev/null +++ b/pi-hole/pi-hole/Dockerfile @@ -0,0 +1,124 @@ +ARG BUILD_FROM=hassioaddons/base:7.0.5 +# hadolint ignore=DL3006 +FROM ${BUILD_FROM} + +# Set shell +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +ENV PATH="${PATH}:/opt/pihole" \ + CORE_TAG="v4.4" \ + WEB_TAG="v4.3.3" \ + FTL_TAG="v4.3.1" + +# We need to copy in the patches need during build +COPY rootfs/patches /patches + +# Setup base +# hadolint ignore=DL3003 +RUN \ + apk add --no-cache --virtual .build-dependencies \ + gcc=9.2.0-r4 \ + make=4.2.1-r2 \ + musl-dev=1.1.24-r2 \ + libexecinfo-dev=1.1-r1 \ + linux-headers=4.19.36-r0 \ + nettle-dev=3.5.1-r0 \ + build-base=0.5-r1 \ + \ + && apk add --no-cache \ + bc=1.07.1-r1 \ + bind-tools=9.14.8-r5 \ + coreutils=8.31-r0 \ + git=2.24.1-r0 \ + grep=3.3-r0 \ + libcap=2.27-r0 \ + libxml2=2.9.10-r2 \ + logrotate=3.15.1-r0 \ + lua-resty-http=0.15-r0 \ + ncurses=6.1_p20200118-r2 \ + nettle=3.5.1-r0 \ + nginx-mod-http-lua=1.16.1-r6 \ + nginx=1.16.1-r6 \ + openssl=1.1.1d-r3 \ + perl=5.30.1-r0 \ + php7-fileinfo=7.3.16-r0 \ + php7-fpm=7.3.16-r0 \ + php7-json=7.3.16-r0 \ + php7-opcache=7.3.16-r00 \ + php7-openssl=7.3.16-r0 \ + php7-phar=7.3.16-r0 \ + php7-session=7.3.16-r0 \ + php7-sockets=7.3.16-r0\ + php7-sqlite3=7.3.16-r0 \ + php7-zip=7.3.16-r0 \ + procps=3.3.16-r0 \ + psmisc=23.3-r0 \ + sed=4.7-r0 \ + sqlite=3.30.1-r1 \ + sudo=1.8.31-r0 \ + wget=1.20.3-r0 \ + \ + && addgroup -S pihole \ + && adduser -S -s /sbin/nologin pihole pihole \ + && addgroup pihole nginx \ + \ + && git clone --branch "${CORE_TAG}" --depth=1 \ + https://github.com/pi-hole/pi-hole.git /etc/.pihole \ + && git -C /etc/.pihole checkout -b master \ + \ + && git clone --branch "${WEB_TAG}" --depth=1 \ + https://github.com/pi-hole/AdminLTE.git /var/www/html/admin \ + && git -C /var/www/html/admin checkout -b master \ + \ + && git clone --branch "${FTL_TAG}" --depth=1 \ + https://github.com/pi-hole/FTL.git /root/FTL \ + && git -C /root/FTL checkout -b master \ + \ + && cd /root/FTL \ + && patch -p1 < /patches/FTL/fix-nettle-3.5-compat.patch \ + && patch -p1 < /patches/FTL/fix-poll-h-include-warning-on-musl.patch \ + && patch -p1 < /patches/FTL/no-backtrace-on-musl.patch \ + && make \ + && mv /root/FTL/pihole-FTL /usr/bin \ + && cd - \ + \ + && install -o pihole -Dm755 -d "/opt/pihole" \ + && install -o pihole -Dm755 -t "/opt/pihole" /etc/.pihole/gravity.sh \ + && install -o pihole -Dm755 -t "/opt/pihole" /etc/.pihole/advanced/Scripts/*.sh \ + && install -o pihole -Dm755 -t "/opt/pihole" /etc/.pihole/advanced/Scripts/COL_TABLE \ + \ + && cd /etc/.pihole/ \ + && patch -p1 < /patches/pihole/fix-killall-brain-damage.patch \ + && install -o pihole -Dm755 -t "/usr/local/bin" /etc/.pihole/pihole \ + \ + && apk del --purge .build-dependencies \ + && rm -fr \ + /etc/nginx \ + /root/FTL + +# Copy root filesystem +COPY rootfs / + +# Build arguments +ARG BUILD_ARCH +ARG BUILD_DATE +ARG BUILD_REF +ARG BUILD_VERSION + +# Labels +LABEL \ + io.hass.name="Pi-hole" \ + io.hass.description="Network-wide ad blocking" \ + io.hass.arch="${BUILD_ARCH}" \ + io.hass.type="addon" \ + io.hass.version=${BUILD_VERSION} \ + maintainer="Franck Nijhof " \ + org.label-schema.description="Network-wide ad blocking" \ + org.label-schema.build-date=${BUILD_DATE} \ + org.label-schema.name="Pi-hole" \ + org.label-schema.schema-version="1.0" \ + org.label-schema.url="https://community.home-assistant.io/t/home-assistant-community-add-on-pi-hole/33817?u=frenck" \ + org.label-schema.usage="https://github.com/hassio-addons/addon-pi-hole/tree/master/README.md" \ + org.label-schema.vcs-ref=${BUILD_REF} \ + org.label-schema.vcs-url="https://github.com/hassio-addons/addon-pi-hole" \ + org.label-schema.vendor="Home Assistant Community Add-ons" diff --git a/pi-hole/pi-hole/build.json b/pi-hole/pi-hole/build.json new file mode 100644 index 0000000..34071b5 --- /dev/null +++ b/pi-hole/pi-hole/build.json @@ -0,0 +1,11 @@ +{ + "squash": false, + "build_from": { + "aarch64": "hassioaddons/base-aarch64:7.0.5", + "amd64": "hassioaddons/base-amd64:7.0.5", + "armhf": "hassioaddons/base-armhf:7.0.5", + "armv7": "hassioaddons/base-armv7:7.0.5", + "i386": "hassioaddons/base-i386:7.0.5" + }, + "args": {} +} diff --git a/pi-hole/pi-hole/config.json b/pi-hole/pi-hole/config.json new file mode 100644 index 0000000..e7916a6 --- /dev/null +++ b/pi-hole/pi-hole/config.json @@ -0,0 +1,61 @@ +{ + "name": "Pi-hole (DEPRECATED!)", + "stage": "deprecated", + "version": "dev", + "slug": "pi-hole", + "description": "The Pi-hole add-on is deprecated, use the AdGuard Home add-on instead.", + "url": "https://github.com/hassio-addons/addon-pi-hole", + "webui": "[PROTO:ssl]://[HOST]:[PORT:4865]", + "ingress": true, + "ingress_port": 61478, + "panel_icon": "mdi:pi-hole", + "startup": "system", + "arch": ["aarch64", "amd64", "armhf", "armv7", "i386"], + "ports": { + "53/udp": 53, + "80/tcp": null, + "4865/tcp": 4865 + }, + "ports_description": { + "53/udp": "DNS server port", + "80/tcp": "Web interface (Not required for Ingress)", + "4865/tcp": "API endpoint (For HA integration)" + }, + "boot": "auto", + "host_network": true, + "hassio_api": true, + "hassio_role": "default", + "auth_api": true, + "privileged": ["NET_ADMIN"], + "map": ["config", "ssl"], + "options": { + "update_lists_on_start": false, + "ssl": true, + "certfile": "fullchain.pem", + "keyfile": "privkey.pem", + "interface": "", + "ipv6": true, + "ipv4_address": "", + "ipv6_address": "", + "hosts": [] + }, + "schema": { + "log_level": "list(trace|debug|info|notice|warning|error|fatal)?", + "update_lists_on_start": "bool", + "ssl": "bool", + "certfile": "str", + "keyfile": "str", + "interface": "str", + "ipv6": "bool", + "ipv4_address": "str", + "ipv6_address": "str", + + "hosts": [ + { + "name": "str", + "ip": "match(((^\\s*((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))\\s*$)|(^\\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)){3}))|:)))(%.+)?\\s*$)))" + } + ], + "leave_front_door_open": "bool?" + } +} diff --git a/pi-hole/pi-hole/icon.png b/pi-hole/pi-hole/icon.png new file mode 100644 index 0000000..1a1b4d0 Binary files /dev/null and b/pi-hole/pi-hole/icon.png differ diff --git a/pi-hole/pi-hole/logo.png b/pi-hole/pi-hole/logo.png new file mode 100644 index 0000000..b63eee7 Binary files /dev/null and b/pi-hole/pi-hole/logo.png differ diff --git a/pi-hole/pi-hole/rootfs/etc/cont-init.d/nginx.sh b/pi-hole/pi-hole/rootfs/etc/cont-init.d/nginx.sh new file mode 100644 index 0000000..bc7b3fc --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/cont-init.d/nginx.sh @@ -0,0 +1,49 @@ +#!/usr/bin/with-contenv bashio +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# This file sets up and configures DNS +# ============================================================================== +declare api_port +declare admin_port +declare certfile +declare dns_host +declare ingress_interface +declare ingress_port +declare ingress_url +declare keyfile + +admin_port=$(bashio::addon.port 80) +if bashio::var.has_value "${admin_port}"; then + bashio::config.require.ssl + + if bashio::config.true 'ssl'; then + certfile=$(bashio::config 'certfile') + keyfile=$(bashio::config 'keyfile') + + mv /etc/nginx/servers/direct-ssl.disabled /etc/nginx/servers/direct.conf + sed -i "s#%%certfile%%#${certfile}#g" /etc/nginx/servers/direct.conf + sed -i "s#%%keyfile%%#${keyfile}#g" /etc/nginx/servers/direct.conf + + else + mv /etc/nginx/servers/direct.disabled /etc/nginx/servers/direct.conf + fi + + sed -i "s/%%port%%/${admin_port}/g" /etc/nginx/servers/direct.conf +fi + +ingress_port=$(bashio::addon.ingress_port) +ingress_interface=$(bashio::addon.ip_address) +ingress_url=$(bashio::addon.ingress_url) +sed -i "s/%%port%%/${ingress_port}/g" /etc/nginx/servers/ingress.conf +sed -i "s/%%interface%%/${ingress_interface}/g" /etc/nginx/servers/ingress.conf +sed -i "s#%%url%%#${ingress_url}#g" /etc/nginx/servers/ingress.conf + +api_port=$(bashio::addon.port 4865) +if bashio::var.has_value "${api_port}"; then + mv /etc/nginx/servers/api.disabled /etc/nginx/servers/api.conf + sed -i "s/%%api_port%%/${api_port}/g" /etc/nginx/servers/api.conf +fi + +dns_host=$(bashio::dns.host) +sed -i "s/%%dns_host%%/${dns_host}/g" /etc/nginx/includes/resolver.conf + diff --git a/pi-hole/pi-hole/rootfs/etc/cont-init.d/patches.sh b/pi-hole/pi-hole/rootfs/etc/cont-init.d/patches.sh new file mode 100644 index 0000000..c5b124a --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/cont-init.d/patches.sh @@ -0,0 +1,36 @@ +#!/usr/bin/with-contenv bashio +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Applies patches to Pi-hole +# ============================================================================== +readonly base=/var/www/html/admin +declare hostname + +hostname="hassio" +if bashio::supervisor.ping; then + hostname=$(bashio::host.hostname) +elif bashio::fs.file_exists '/data/hostname'; then + hostname=$( /dev/null /dev/null /etc/pihole/localversions + +bashio::log.debug "Ensure extra information for query log is enabled" +sed -i "s/log-queri.*/log-queries=extra/" /etc/dnsmasq.d/01-pihole.conf + +bashio::log.debug 'Setting dnsmasq port' +port=$(bashio::addon.port "53/udp") + +bashio::log.debug "Setting dnsmasq port to: ${port}" +sed -i "s/port=.*/port=${port}/" /etc/dnsmasq.d/99-addon.conf + +if ! bashio::fs.directory_exists '/var/run/pihole'; then + mkdir -p /var/run/pihole + chmod 775 /var/run/pihole + chown pihole /var/run/pihole +fi + +if ! bashio::fs.file_exists '/var/run/pihole-FTL.port'; then + touch /var/run/pihole-FTL.port + chmod 644 /var/run/pihole-FTL.port + chown pihole:root /var/run/pihole-FTL.port +fi + +if bashio::supervisor.ping; then + bashio::host.hostname > /data/hostname +fi + +# Add pi.hole to hosts +echo "127.0.0.1 pi.hole" >> /etc/hosts + +mkdir -p /data/log +if ! bashio::fs.file_exists '/data/log/pihole.log'; then + touch /data/log/pihole.log + chmod 644 /data/log/pihole.log + chown pihole:root /data/log/pihole.log +fi + +ln -sf /data/log/pihole.log /var/log/pihole.log +if ! bashio::fs.file_exists '/data/log/pihole-FTL.log'; then + touch /data/log/pihole-FTL.log + chmod 644 /data/log/pihole-FTL.log + chown pihole:root /data/log/pihole-FTL.log +fi + +ln -sf /data/log/pihole-FTL.log /var/log/pihole-FTL.log + +for host in $(bashio::config 'hosts|keys'); do + name=$(bashio::config "hosts[${host}].name") + ip=$(bashio::config "hosts[${host}].ip") + bashio::log.debug "Adding host: ${name} resolves to ${ip}" + echo "${ip} ${name}" >> /etc/hosts.list +done + +# We use HA Auth now, disable Pi-Hole password +pihole -a -p "" + +if bashio::config.true 'update_lists_on_start' \ + || ! bashio::fs.file_exists "/data/pihole/gravity.list"; +then + bashio::log.debug 'Generating block lists' + s6-setuidgid pihole pihole-FTL & + sleep 2 + gravity.sh + kill -9 "$(pgrep pihole-FTL)" || true +fi diff --git a/pi-hole/pi-hole/rootfs/etc/cron.d/pihole b/pi-hole/pi-hole/rootfs/etc/cron.d/pihole new file mode 100644 index 0000000..8b0b0b3 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/cron.d/pihole @@ -0,0 +1,27 @@ +# Pi-hole: A black hole for Internet advertisements +# (c) 2017 Pi-hole, LLC (https://pi-hole.net) +# Network-wide ad blocking via your own hardware. +# +# Updates ad sources every week +# +# This file is copyright under the latest version of the EUPL. +# Please see LICENSE file for your rights under this license. +# +# +# +# This file is under source-control of the Pi-hole installation and update +# scripts, any changes made to this file will be overwritten when the softare +# is updated or re-installed. Please make any changes to the appropriate crontab +# or other cron file snippets. + +# Pi-hole: Update the ad sources once a week on Sunday at 01:59 +# Download any updates from the adlists +59 1 * * 7 root PATH="$PATH:/usr/local/bin/" pihole updateGravity + +# Pi-hole: Flush the log daily at 00:00 +# The flush script will use logrotate if available +# parameter "once": logrotate only once (default is twice) +# parameter "quiet": don't print messages +00 00 * * * root PATH="$PATH:/usr/local/bin/" pihole flush once quiet + +@reboot root /usr/sbin/logrotate /etc/logrotate.d/pihole diff --git a/pi-hole/pi-hole/rootfs/etc/dnsmasq.conf b/pi-hole/pi-hole/rootfs/etc/dnsmasq.conf new file mode 100644 index 0000000..73e54f3 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/dnsmasq.conf @@ -0,0 +1,666 @@ +# Configuration file for dnsmasq. +# +# Format is one option per line, legal options are the same +# as the long options legal on the command line. See +# "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details. + +# Listen on this specific port instead of the standard DNS port +# (53). Setting this to zero completely disables DNS function, +# leaving only DHCP and/or TFTP. +#port=5353 + +# The following two options make you a better netizen, since they +# tell dnsmasq to filter out queries which the public DNS cannot +# answer, and which load the servers (especially the root servers) +# unnecessarily. If you have a dial-on-demand link they also stop +# these requests from bringing up the link unnecessarily. + +# Never forward plain names (without a dot or domain part) +#domain-needed +# Never forward addresses in the non-routed address spaces. +#bogus-priv + +# Uncomment these to enable DNSSEC validation and caching: +# (Requires dnsmasq to be built with DNSSEC option.) +#conf-file=%%PREFIX%%/share/dnsmasq/trust-anchors.conf +#dnssec + +# Replies which are not DNSSEC signed may be legitimate, because the domain +# is unsigned, or may be forgeries. Setting this option tells dnsmasq to +# check that an unsigned reply is OK, by finding a secure proof that a DS +# record somewhere between the root and the domain does not exist. +# The cost of setting this is that even queries in unsigned domains will need +# one or more extra DNS queries to verify. +#dnssec-check-unsigned + +# Uncomment this to filter useless windows-originated DNS requests +# which can trigger dial-on-demand links needlessly. +# Note that (amongst other things) this blocks all SRV requests, +# so don't use it if you use eg Kerberos, SIP, XMMP or Google-talk. +# This option only affects forwarding, SRV records originating for +# dnsmasq (via srv-host= lines) are not suppressed by it. +#filterwin2k + +# Change this line if you want dns to get its upstream servers from +# somewhere other that /etc/resolv.conf +#resolv-file= + +# By default, dnsmasq will send queries to any of the upstream +# servers it knows about and tries to favour servers to are known +# to be up. Uncommenting this forces dnsmasq to try each query +# with each server strictly in the order they appear in +# /etc/resolv.conf +#strict-order + +# If you don't want dnsmasq to read /etc/resolv.conf or any other +# file, getting its servers from this file instead (see below), then +# uncomment this. +#no-resolv + +# If you don't want dnsmasq to poll /etc/resolv.conf or other resolv +# files for changes and re-read them then uncomment this. +#no-poll + +# Add other name servers here, with domain specs if they are for +# non-public domains. +#server=/localnet/192.168.0.1 + +# Example of routing PTR queries to nameservers: this will send all +# address->name queries for 192.168.3/24 to nameserver 10.1.2.3 +#server=/3.168.192.in-addr.arpa/10.1.2.3 + +# Add local-only domains here, queries in these domains are answered +# from /etc/hosts or DHCP only. +#local=/localnet/ + +# Add domains which you want to force to an IP address here. +# The example below send any host in double-click.net to a local +# web-server. +#address=/double-click.net/127.0.0.1 + +# --address (and --server) work with IPv6 addresses too. +#address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83 + +# Add the IPs of all queries to yahoo.com, google.com, and their +# subdomains to the vpn and search ipsets: +#ipset=/yahoo.com/google.com/vpn,search + +# You can control how dnsmasq talks to a server: this forces +# queries to 10.1.2.3 to be routed via eth1 +# server=10.1.2.3@eth1 + +# and this sets the source (ie local) address used to talk to +# 10.1.2.3 to 192.168.1.1 port 55 (there must be an interface with that +# IP on the machine, obviously). +# server=10.1.2.3@192.168.1.1#55 + +# If you want dnsmasq to change uid and gid to something other +# than the default, edit the following lines. +#user= +#group= + +# If you want dnsmasq to listen for DHCP and DNS requests only on +# specified interfaces (and the loopback) give the name of the +# interface (eg eth0) here. +# Repeat the line for more than one interface. +#interface= +# Or you can specify which interface _not_ to listen on +#except-interface= +# Or which to listen on by address (remember to include 127.0.0.1 if +# you use this.) +#listen-address= +# If you want dnsmasq to provide only DNS service on an interface, +# configure it as shown above, and then use the following line to +# disable DHCP and TFTP on it. +#no-dhcp-interface= + +# On systems which support it, dnsmasq binds the wildcard address, +# even when it is listening on only some interfaces. It then discards +# requests that it shouldn't reply to. This has the advantage of +# working even when interfaces come and go and change address. If you +# want dnsmasq to really bind only the interfaces it is listening on, +# uncomment this option. About the only time you may need this is when +# running another nameserver on the same machine. +#bind-interfaces + +# If you don't want dnsmasq to read /etc/hosts, uncomment the +# following line. +#no-hosts +# or if you want it to read another file, as well as /etc/hosts, use +# this. +#addn-hosts=/etc/banner_add_hosts + +# Set this (and domain: see below) if you want to have a domain +# automatically added to simple names in a hosts-file. +#expand-hosts + +# Set the domain for dnsmasq. this is optional, but if it is set, it +# does the following things. +# 1) Allows DHCP hosts to have fully qualified domain names, as long +# as the domain part matches this setting. +# 2) Sets the "domain" DHCP option thereby potentially setting the +# domain of all systems configured by DHCP +# 3) Provides the domain part for "expand-hosts" +#domain=thekelleys.org.uk + +# Set a different domain for a particular subnet +#domain=wireless.thekelleys.org.uk,192.168.2.0/24 + +# Same idea, but range rather then subnet +#domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200 + +# Uncomment this to enable the integrated DHCP server, you need +# to supply the range of addresses available for lease and optionally +# a lease time. If you have more than one network, you will need to +# repeat this for each network on which you want to supply DHCP +# service. +#dhcp-range=192.168.0.50,192.168.0.150,12h + +# This is an example of a DHCP range where the netmask is given. This +# is needed for networks we reach the dnsmasq DHCP server via a relay +# agent. If you don't know what a DHCP relay agent is, you probably +# don't need to worry about this. +#dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h + +# This is an example of a DHCP range which sets a tag, so that +# some DHCP options may be set only for this network. +#dhcp-range=set:red,192.168.0.50,192.168.0.150 + +# Use this DHCP range only when the tag "green" is set. +#dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h + +# Specify a subnet which can't be used for dynamic address allocation, +# is available for hosts with matching --dhcp-host lines. Note that +# dhcp-host declarations will be ignored unless there is a dhcp-range +# of some type for the subnet in question. +# In this case the netmask is implied (it comes from the network +# configuration on the machine running dnsmasq) it is possible to give +# an explicit netmask instead. +#dhcp-range=192.168.0.0,static + +# Enable DHCPv6. Note that the prefix-length does not need to be specified +# and defaults to 64 if missing/ +#dhcp-range=1234::2, 1234::500, 64, 12h + +# Do Router Advertisements, BUT NOT DHCP for this subnet. +#dhcp-range=1234::, ra-only + +# Do Router Advertisements, BUT NOT DHCP for this subnet, also try and +# add names to the DNS for the IPv6 address of SLAAC-configured dual-stack +# hosts. Use the DHCPv4 lease to derive the name, network segment and +# MAC address and assume that the host will also have an +# IPv6 address calculated using the SLAAC algorithm. +#dhcp-range=1234::, ra-names + +# Do Router Advertisements, BUT NOT DHCP for this subnet. +# Set the lifetime to 46 hours. (Note: minimum lifetime is 2 hours.) +#dhcp-range=1234::, ra-only, 48h + +# Do DHCP and Router Advertisements for this subnet. Set the A bit in the RA +# so that clients can use SLAAC addresses as well as DHCP ones. +#dhcp-range=1234::2, 1234::500, slaac + +# Do Router Advertisements and stateless DHCP for this subnet. Clients will +# not get addresses from DHCP, but they will get other configuration information. +# They will use SLAAC for addresses. +#dhcp-range=1234::, ra-stateless + +# Do stateless DHCP, SLAAC, and generate DNS names for SLAAC addresses +# from DHCPv4 leases. +#dhcp-range=1234::, ra-stateless, ra-names + +# Do router advertisements for all subnets where we're doing DHCPv6 +# Unless overridden by ra-stateless, ra-names, et al, the router +# advertisements will have the M and O bits set, so that the clients +# get addresses and configuration from DHCPv6, and the A bit reset, so the +# clients don't use SLAAC addresses. +#enable-ra + +# Supply parameters for specified hosts using DHCP. There are lots +# of valid alternatives, so we will give examples of each. Note that +# IP addresses DO NOT have to be in the range given above, they just +# need to be on the same network. The order of the parameters in these +# do not matter, it's permissible to give name, address and MAC in any +# order. + +# Always allocate the host with Ethernet address 11:22:33:44:55:66 +# The IP address 192.168.0.60 +#dhcp-host=11:22:33:44:55:66,192.168.0.60 + +# Always set the name of the host with hardware address +# 11:22:33:44:55:66 to be "fred" +#dhcp-host=11:22:33:44:55:66,fred + +# Always give the host with Ethernet address 11:22:33:44:55:66 +# the name fred and IP address 192.168.0.60 and lease time 45 minutes +#dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m + +# Give a host with Ethernet address 11:22:33:44:55:66 or +# 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume +# that these two Ethernet interfaces will never be in use at the same +# time, and give the IP address to the second, even if it is already +# in use by the first. Useful for laptops with wired and wireless +# addresses. +#dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.60 + +# Give the machine which says its name is "bert" IP address +# 192.168.0.70 and an infinite lease +#dhcp-host=bert,192.168.0.70,infinite + +# Always give the host with client identifier 01:02:02:04 +# the IP address 192.168.0.60 +#dhcp-host=id:01:02:02:04,192.168.0.60 + +# Always give the InfiniBand interface with hardware address +# 80:00:00:48:fe:80:00:00:00:00:00:00:f4:52:14:03:00:28:05:81 the +# ip address 192.168.0.61. The client id is derived from the prefix +# ff:00:00:00:00:00:02:00:00:02:c9:00 and the last 8 pairs of +# hex digits of the hardware address. +#dhcp-host=id:ff:00:00:00:00:00:02:00:00:02:c9:00:f4:52:14:03:00:28:05:81,192.168.0.61 + +# Always give the host with client identifier "marjorie" +# the IP address 192.168.0.60 +#dhcp-host=id:marjorie,192.168.0.60 + +# Enable the address given for "judge" in /etc/hosts +# to be given to a machine presenting the name "judge" when +# it asks for a DHCP lease. +#dhcp-host=judge + +# Never offer DHCP service to a machine whose Ethernet +# address is 11:22:33:44:55:66 +#dhcp-host=11:22:33:44:55:66,ignore + +# Ignore any client-id presented by the machine with Ethernet +# address 11:22:33:44:55:66. This is useful to prevent a machine +# being treated differently when running under different OS's or +# between PXE boot and OS boot. +#dhcp-host=11:22:33:44:55:66,id:* + +# Send extra options which are tagged as "red" to +# the machine with Ethernet address 11:22:33:44:55:66 +#dhcp-host=11:22:33:44:55:66,set:red + +# Send extra options which are tagged as "red" to +# any machine with Ethernet address starting 11:22:33: +#dhcp-host=11:22:33:*:*:*,set:red + +# Give a fixed IPv6 address and name to client with +# DUID 00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2 +# Note the MAC addresses CANNOT be used to identify DHCPv6 clients. +# Note also that the [] around the IPv6 address are obligatory. +#dhcp-host=id:00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2, fred, [1234::5] + +# Ignore any clients which are not specified in dhcp-host lines +# or /etc/ethers. Equivalent to ISC "deny unknown-clients". +# This relies on the special "known" tag which is set when +# a host is matched. +#dhcp-ignore=tag:!known + +# Send extra options which are tagged as "red" to any machine whose +# DHCP vendorclass string includes the substring "Linux" +#dhcp-vendorclass=set:red,Linux + +# Send extra options which are tagged as "red" to any machine one +# of whose DHCP userclass strings includes the substring "accounts" +#dhcp-userclass=set:red,accounts + +# Send extra options which are tagged as "red" to any machine whose +# MAC address matches the pattern. +#dhcp-mac=set:red,00:60:8C:*:*:* + +# If this line is uncommented, dnsmasq will read /etc/ethers and act +# on the ethernet-address/IP pairs found there just as if they had +# been given as --dhcp-host options. Useful if you keep +# MAC-address/host mappings there for other purposes. +#read-ethers + +# Send options to hosts which ask for a DHCP lease. +# See RFC 2132 for details of available options. +# Common options can be given to dnsmasq by name: +# run "dnsmasq --help dhcp" to get a list. +# Note that all the common settings, such as netmask and +# broadcast address, DNS server and default route, are given +# sane defaults by dnsmasq. You very likely will not need +# any dhcp-options. If you use Windows clients and Samba, there +# are some options which are recommended, they are detailed at the +# end of this section. + +# Override the default route supplied by dnsmasq, which assumes the +# router is the same machine as the one running dnsmasq. +#dhcp-option=3,1.2.3.4 + +# Do the same thing, but using the option name +#dhcp-option=option:router,1.2.3.4 + +# Override the default route supplied by dnsmasq and send no default +# route at all. Note that this only works for the options sent by +# default (1, 3, 6, 12, 28) the same line will send a zero-length option +# for all other option numbers. +#dhcp-option=3 + +# Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5 +#dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5 + +# Send DHCPv6 option. Note [] around IPv6 addresses. +#dhcp-option=option6:dns-server,[1234::77],[1234::88] + +# Send DHCPv6 option for namservers as the machine running +# dnsmasq and another. +#dhcp-option=option6:dns-server,[::],[1234::88] + +# Ask client to poll for option changes every six hours. (RFC4242) +#dhcp-option=option6:information-refresh-time,6h + +# Set option 58 client renewal time (T1). Defaults to half of the +# lease time if not specified. (RFC2132) +#dhcp-option=option:T1,1m + +# Set option 59 rebinding time (T2). Defaults to 7/8 of the +# lease time if not specified. (RFC2132) +#dhcp-option=option:T2,2m + +# Set the NTP time server address to be the same machine as +# is running dnsmasq +#dhcp-option=42,0.0.0.0 + +# Set the NIS domain name to "welly" +#dhcp-option=40,welly + +# Set the default time-to-live to 50 +#dhcp-option=23,50 + +# Set the "all subnets are local" flag +#dhcp-option=27,1 + +# Send the etherboot magic flag and then etherboot options (a string). +#dhcp-option=128,e4:45:74:68:00:00 +#dhcp-option=129,NIC=eepro100 + +# Specify an option which will only be sent to the "red" network +# (see dhcp-range for the declaration of the "red" network) +# Note that the tag: part must precede the option: part. +#dhcp-option = tag:red, option:ntp-server, 192.168.1.1 + +# The following DHCP options set up dnsmasq in the same way as is specified +# for the ISC dhcpcd in +# http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt +# adapted for a typical dnsmasq installation where the host running +# dnsmasq is also the host running samba. +# you may want to uncomment some or all of them if you use +# Windows clients and Samba. +#dhcp-option=19,0 # option ip-forwarding off +#dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s) +#dhcp-option=45,0.0.0.0 # netbios datagram distribution server +#dhcp-option=46,8 # netbios node type + +# Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave. +#dhcp-option=252,"\n" + +# Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client +# probably doesn't support this...... +#dhcp-option=option:domain-search,eng.apple.com,marketing.apple.com + +# Send RFC-3442 classless static routes (note the netmask encoding) +#dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8 + +# Send vendor-class specific options encapsulated in DHCP option 43. +# The meaning of the options is defined by the vendor-class so +# options are sent only when the client supplied vendor class +# matches the class given here. (A substring match is OK, so "MSFT" +# matches "MSFT" and "MSFT 5.0"). This example sets the +# mtftp address to 0.0.0.0 for PXEClients. +#dhcp-option=vendor:PXEClient,1,0.0.0.0 + +# Send microsoft-specific option to tell windows to release the DHCP lease +# when it shuts down. Note the "i" flag, to tell dnsmasq to send the +# value as a four-byte integer - that's what microsoft wants. See +# http://technet2.microsoft.com/WindowsServer/en/library/a70f1bb7-d2d4-49f0-96d6-4b7414ecfaae1033.mspx?mfr=true +#dhcp-option=vendor:MSFT,2,1i + +# Send the Encapsulated-vendor-class ID needed by some configurations of +# Etherboot to allow is to recognise the DHCP server. +#dhcp-option=vendor:Etherboot,60,"Etherboot" + +# Send options to PXELinux. Note that we need to send the options even +# though they don't appear in the parameter request list, so we need +# to use dhcp-option-force here. +# See http://syslinux.zytor.com/pxe.php#special for details. +# Magic number - needed before anything else is recognised +#dhcp-option-force=208,f1:00:74:7e +# Configuration file name +#dhcp-option-force=209,configs/common +# Path prefix +#dhcp-option-force=210,/tftpboot/pxelinux/files/ +# Reboot time. (Note 'i' to send 32-bit value) +#dhcp-option-force=211,30i + +# Set the boot filename for netboot/PXE. You will only need +# this if you want to boot machines over the network and you will need +# a TFTP server; either dnsmasq's built-in TFTP server or an +# external one. (See below for how to enable the TFTP server.) +#dhcp-boot=pxelinux.0 + +# The same as above, but use custom tftp-server instead machine running dnsmasq +#dhcp-boot=pxelinux,server.name,192.168.1.100 + +# Boot for iPXE. The idea is to send two different +# filenames, the first loads iPXE, and the second tells iPXE what to +# load. The dhcp-match sets the ipxe tag for requests from iPXE. +#dhcp-boot=undionly.kpxe +#dhcp-match=set:ipxe,175 # iPXE sends a 175 option. +#dhcp-boot=tag:ipxe,http://boot.ipxe.org/demo/boot.php + +# Encapsulated options for iPXE. All the options are +# encapsulated within option 175 +#dhcp-option=encap:175, 1, 5b # priority code +#dhcp-option=encap:175, 176, 1b # no-proxydhcp +#dhcp-option=encap:175, 177, string # bus-id +#dhcp-option=encap:175, 189, 1b # BIOS drive code +#dhcp-option=encap:175, 190, user # iSCSI username +#dhcp-option=encap:175, 191, pass # iSCSI password + +# Test for the architecture of a netboot client. PXE clients are +# supposed to send their architecture as option 93. (See RFC 4578) +#dhcp-match=peecees, option:client-arch, 0 #x86-32 +#dhcp-match=itanics, option:client-arch, 2 #IA64 +#dhcp-match=hammers, option:client-arch, 6 #x86-64 +#dhcp-match=mactels, option:client-arch, 7 #EFI x86-64 + +# Do real PXE, rather than just booting a single file, this is an +# alternative to dhcp-boot. +#pxe-prompt="What system shall I netboot?" +# or with timeout before first available action is taken: +#pxe-prompt="Press F8 for menu.", 60 + +# Available boot services. for PXE. +#pxe-service=x86PC, "Boot from local disk" + +# Loads /pxelinux.0 from dnsmasq TFTP server. +#pxe-service=x86PC, "Install Linux", pxelinux + +# Loads /pxelinux.0 from TFTP server at 1.2.3.4. +# Beware this fails on old PXE ROMS. +#pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4 + +# Use bootserver on network, found my multicast or broadcast. +#pxe-service=x86PC, "Install windows from RIS server", 1 + +# Use bootserver at a known IP address. +#pxe-service=x86PC, "Install windows from RIS server", 1, 1.2.3.4 + +# If you have multicast-FTP available, +# information for that can be passed in a similar way using options 1 +# to 5. See page 19 of +# http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf + + +# Enable dnsmasq's built-in TFTP server +#enable-tftp + +# Set the root directory for files available via FTP. +#tftp-root=/var/ftpd + +# Do not abort if the tftp-root is unavailable +#tftp-no-fail + +# Make the TFTP server more secure: with this set, only files owned by +# the user dnsmasq is running as will be send over the net. +#tftp-secure + +# This option stops dnsmasq from negotiating a larger blocksize for TFTP +# transfers. It will slow things down, but may rescue some broken TFTP +# clients. +#tftp-no-blocksize + +# Set the boot file name only when the "red" tag is set. +#dhcp-boot=tag:red,pxelinux.red-net + +# An example of dhcp-boot with an external TFTP server: the name and IP +# address of the server are given after the filename. +# Can fail with old PXE ROMS. Overridden by --pxe-service. +#dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3 + +# If there are multiple external tftp servers having a same name +# (using /etc/hosts) then that name can be specified as the +# tftp_servername (the third option to dhcp-boot) and in that +# case dnsmasq resolves this name and returns the resultant IP +# addresses in round robin fashion. This facility can be used to +# load balance the tftp load among a set of servers. +#dhcp-boot=/var/ftpd/pxelinux.0,boothost,tftp_server_name + +# Set the limit on DHCP leases, the default is 150 +#dhcp-lease-max=150 + +# The DHCP server needs somewhere on disk to keep its lease database. +# This defaults to a sane location, but if you want to change it, use +# the line below. +#dhcp-leasefile=/var/lib/misc/dnsmasq.leases + +# Set the DHCP server to authoritative mode. In this mode it will barge in +# and take over the lease for any client which broadcasts on the network, +# whether it has a record of the lease or not. This avoids long timeouts +# when a machine wakes up on a new network. DO NOT enable this if there's +# the slightest chance that you might end up accidentally configuring a DHCP +# server for your campus/company accidentally. The ISC server uses +# the same option, and this URL provides more information: +# http://www.isc.org/files/auth.html +#dhcp-authoritative + +# Run an executable when a DHCP lease is created or destroyed. +# The arguments sent to the script are "add" or "del", +# then the MAC address, the IP address and finally the hostname +# if there is one. +#dhcp-script=/bin/echo + +# Set the cachesize here. +#cache-size=150 + +# If you want to disable negative caching, uncomment this. +#no-negcache + +# Normally responses which come from /etc/hosts and the DHCP lease +# file have Time-To-Live set as zero, which conventionally means +# do not cache further. If you are happy to trade lower load on the +# server for potentially stale date, you can set a time-to-live (in +# seconds) here. +#local-ttl= + +# If you want dnsmasq to detect attempts by Verisign to send queries +# to unregistered .com and .net hosts to its sitefinder service and +# have dnsmasq instead return the correct NXDOMAIN response, uncomment +# this line. You can add similar lines to do the same for other +# registries which have implemented wildcard A records. +#bogus-nxdomain=64.94.110.11 + +# If you want to fix up DNS results from upstream servers, use the +# alias option. This only works for IPv4. +# This alias makes a result of 1.2.3.4 appear as 5.6.7.8 +#alias=1.2.3.4,5.6.7.8 +# and this maps 1.2.3.x to 5.6.7.x +#alias=1.2.3.0,5.6.7.0,255.255.255.0 +# and this maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40 +#alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0 + +# Change these lines if you want dnsmasq to serve MX records. + +# Return an MX record named "maildomain.com" with target +# servermachine.com and preference 50 +#mx-host=maildomain.com,servermachine.com,50 + +# Set the default target for MX records created using the localmx option. +#mx-target=servermachine.com + +# Return an MX record pointing to the mx-target for all local +# machines. +#localmx + +# Return an MX record pointing to itself for all local machines. +#selfmx + +# Change the following lines if you want dnsmasq to serve SRV +# records. These are useful if you want to serve ldap requests for +# Active Directory and other windows-originated DNS requests. +# See RFC 2782. +# You may add multiple srv-host lines. +# The fields are ,,,, +# If the domain part if missing from the name (so that is just has the +# service and protocol sections) then the domain given by the domain= +# config option is used. (Note that expand-hosts does not need to be +# set for this to work.) + +# A SRV record sending LDAP for the example.com domain to +# ldapserver.example.com port 389 +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389 + +# A SRV record sending LDAP for the example.com domain to +# ldapserver.example.com port 389 (using domain=) +#domain=example.com +#srv-host=_ldap._tcp,ldapserver.example.com,389 + +# Two SRV records for LDAP, each with different priorities +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,1 +#srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,2 + +# A SRV record indicating that there is no LDAP server for the domain +# example.com +#srv-host=_ldap._tcp.example.com + +# The following line shows how to make dnsmasq serve an arbitrary PTR +# record. This is useful for DNS-SD. (Note that the +# domain-name expansion done for SRV records _does_not +# occur for PTR records.) +#ptr-record=_http._tcp.dns-sd-services,"New Employee Page._http._tcp.dns-sd-services" + +# Change the following lines to enable dnsmasq to serve TXT records. +# These are used for things like SPF and zeroconf. (Note that the +# domain-name expansion done for SRV records _does_not +# occur for TXT records.) + +#Example SPF. +#txt-record=example.com,"v=spf1 a -all" + +#Example zeroconf +#txt-record=_http._tcp.example.com,name=value,paper=A4 + +# Provide an alias for a "local" DNS name. Note that this _only_ works +# for targets which are names from DHCP or /etc/hosts. Give host +# "bert" another name, bertrand +#cname=bertand,bert + +# For debugging purposes, log each DNS query as it passes through +# dnsmasq. +#log-queries + +# Log lots of extra information about DHCP transactions. +#log-dhcp + +# Include another lot of configuration options. +#conf-file=/etc/dnsmasq.more.conf +#conf-dir=/etc/dnsmasq.d + +# Include all the files in a directory except those ending in .bak +#conf-dir=/etc/dnsmasq.d,.bak + +# Include all files in a directory which end in .conf +conf-dir=/etc/dnsmasq.d/,*.conf diff --git a/pi-hole/pi-hole/rootfs/etc/dnsmasq.d/01-pihole.conf b/pi-hole/pi-hole/rootfs/etc/dnsmasq.d/01-pihole.conf new file mode 100644 index 0000000..5edc02d --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/dnsmasq.d/01-pihole.conf @@ -0,0 +1,47 @@ +# Pi-hole: A black hole for Internet advertisements +# (c) 2015, 2016 by Jacob Salmela +# Network-wide ad blocking via your Raspberry Pi +# http://pi-hole.net +# dnsmasq config for Pi-hole +# +# Pi-hole is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 2 of the License, or +# (at your option) any later version. + +############################################################################### +# FILE AUTOMATICALLY POPULATED BY PI-HOLE INSTALL/UPDATE PROCEDURE. # +# ANY CHANGES MADE TO THIS FILE AFTER INSTALL WILL BE LOST ON THE NEXT UPDATE # +# # +# IF YOU WISH TO CHANGE THE UPSTREAM SERVERS, CHANGE THEM IN: # +# /etc/pihole/setupVars.conf # +# # +# ANY OTHER CHANGES SHOULD BE MADE IN A SEPERATE CONFIG FILE # +# OR IN /etc/dnsmasq.conf # +############################################################################### + +addn-hosts=/etc/pihole/gravity.list +addn-hosts=/etc/pihole/local.list +addn-hosts=/etc/pihole/black.list + +domain-needed + +localise-queries + +bogus-priv + +no-resolv + +server=8.8.8.8 +server=8.8.4.4 + +interface=eth0 + +cache-size=10000 + +log-queries=extra +log-facility=/data/log/pihole.log + +local-ttl=2 + +log-async diff --git a/pi-hole/pi-hole/rootfs/etc/dnsmasq.d/99-addon.conf b/pi-hole/pi-hole/rootfs/etc/dnsmasq.d/99-addon.conf new file mode 100644 index 0000000..fa01eb4 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/dnsmasq.d/99-addon.conf @@ -0,0 +1,5 @@ +user=pihole +group=pihole +no-hosts +addn-hosts=/etc/hosts.list +port=53 diff --git a/pi-hole/pi-hole/rootfs/etc/fix-attrs.d/permissions b/pi-hole/pi-hole/rootfs/etc/fix-attrs.d/permissions new file mode 100644 index 0000000..b7dd7b1 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/fix-attrs.d/permissions @@ -0,0 +1,11 @@ +/data/log/pihole-FTL.log false pihole:root 0644 0755 +/data/log/pihole.log false pihole:root 0644 0755 +/data/pihole/dhcp.leases false pihole:root 0644 0755 +/data/pihole/pihole-FTL.db false pihole:root 0644 0755 +/etc/logrotate.d/pihole false root 0644 0644 +/etc/resolv.conf false doesntexist,0:1000 0664 0664 +/etc/sudoers.d true root 0640 0750 +/usr/bin/pihole-FTL false root 0755 0755 +/var/log/nginx true nginx 0755 0644 +/var/run/pihole true pihole:root 0644 0755 +/var/www/html false nginx 0755 0755 diff --git a/pi-hole/pi-hole/rootfs/etc/hosts.list b/pi-hole/pi-hole/rootfs/etc/hosts.list new file mode 100644 index 0000000..e69de29 diff --git a/pi-hole/pi-hole/rootfs/etc/logrotate.d/pihole b/pi-hole/pi-hole/rootfs/etc/logrotate.d/pihole new file mode 100644 index 0000000..7685e29 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/logrotate.d/pihole @@ -0,0 +1,19 @@ +/data/log/pihole.log { + daily + copytruncate + rotate 5 + compress + delaycompress + notifempty + nomail +} + +/data/log/pihole-FTL.log { + weekly + copytruncate + rotate 3 + compress + delaycompress + notifempty + nomail +} diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/includes/fastcgi_params.conf b/pi-hole/pi-hole/rootfs/etc/nginx/includes/fastcgi_params.conf new file mode 100644 index 0000000..e2269cd --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/includes/fastcgi_params.conf @@ -0,0 +1,26 @@ +fastcgi_param QUERY_STRING $query_string; +fastcgi_param REQUEST_METHOD $request_method; +fastcgi_param CONTENT_TYPE $content_type; +fastcgi_param CONTENT_LENGTH $content_length; + +fastcgi_param SCRIPT_NAME $fastcgi_script_name; +fastcgi_param REQUEST_URI $request_uri; +fastcgi_param DOCUMENT_URI $document_uri; +fastcgi_param DOCUMENT_ROOT $document_root; +fastcgi_param SERVER_PROTOCOL $server_protocol; +fastcgi_param REQUEST_SCHEME $scheme; +fastcgi_param HTTPS $https if_not_empty; + +fastcgi_param GATEWAY_INTERFACE CGI/1.1; +fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + +fastcgi_param REMOTE_ADDR $remote_addr; +fastcgi_param REMOTE_PORT $remote_port; +fastcgi_param SERVER_ADDR $server_addr; +fastcgi_param SERVER_PORT $server_port; +fastcgi_param SERVER_NAME $server_name; + +# PHP only, required if PHP was built with --enable-force-cgi-redirect +fastcgi_param REDIRECT_STATUS 200; +# Add explicit HTTP_HOST for PHP to fix header checking +fastcgi_param HTTP_HOST pi.hole; diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/includes/mime.types b/pi-hole/pi-hole/rootfs/etc/nginx/includes/mime.types new file mode 100644 index 0000000..7c7cdef --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/includes/mime.types @@ -0,0 +1,96 @@ +types { + text/html html htm shtml; + text/css css; + text/xml xml; + image/gif gif; + image/jpeg jpeg jpg; + application/javascript js; + application/atom+xml atom; + application/rss+xml rss; + + text/mathml mml; + text/plain txt; + text/vnd.sun.j2me.app-descriptor jad; + text/vnd.wap.wml wml; + text/x-component htc; + + image/png png; + image/svg+xml svg svgz; + image/tiff tif tiff; + image/vnd.wap.wbmp wbmp; + image/webp webp; + image/x-icon ico; + image/x-jng jng; + image/x-ms-bmp bmp; + + font/woff woff; + font/woff2 woff2; + + application/java-archive jar war ear; + application/json json; + application/mac-binhex40 hqx; + application/msword doc; + application/pdf pdf; + application/postscript ps eps ai; + application/rtf rtf; + application/vnd.apple.mpegurl m3u8; + application/vnd.google-earth.kml+xml kml; + application/vnd.google-earth.kmz kmz; + application/vnd.ms-excel xls; + application/vnd.ms-fontobject eot; + application/vnd.ms-powerpoint ppt; + application/vnd.oasis.opendocument.graphics odg; + application/vnd.oasis.opendocument.presentation odp; + application/vnd.oasis.opendocument.spreadsheet ods; + application/vnd.oasis.opendocument.text odt; + application/vnd.openxmlformats-officedocument.presentationml.presentation + pptx; + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet + xlsx; + application/vnd.openxmlformats-officedocument.wordprocessingml.document + docx; + application/vnd.wap.wmlc wmlc; + application/x-7z-compressed 7z; + application/x-cocoa cco; + application/x-java-archive-diff jardiff; + application/x-java-jnlp-file jnlp; + application/x-makeself run; + application/x-perl pl pm; + application/x-pilot prc pdb; + application/x-rar-compressed rar; + application/x-redhat-package-manager rpm; + application/x-sea sea; + application/x-shockwave-flash swf; + application/x-stuffit sit; + application/x-tcl tcl tk; + application/x-x509-ca-cert der pem crt; + application/x-xpinstall xpi; + application/xhtml+xml xhtml; + application/xspf+xml xspf; + application/zip zip; + + application/octet-stream bin exe dll; + application/octet-stream deb; + application/octet-stream dmg; + application/octet-stream iso img; + application/octet-stream msi msp msm; + + audio/midi mid midi kar; + audio/mpeg mp3; + audio/ogg ogg; + audio/x-m4a m4a; + audio/x-realaudio ra; + + video/3gpp 3gpp 3gp; + video/mp2t ts; + video/mp4 mp4; + video/mpeg mpeg mpg; + video/quicktime mov; + video/webm webm; + video/x-flv flv; + video/x-m4v m4v; + video/x-mng mng; + video/x-ms-asf asx asf; + video/x-ms-wmv wmv; + video/x-msvideo avi; +} diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/includes/resolver.conf b/pi-hole/pi-hole/rootfs/etc/nginx/includes/resolver.conf new file mode 100644 index 0000000..d864899 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/includes/resolver.conf @@ -0,0 +1 @@ +resolver %%dns_host%%; diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/includes/server_params.conf b/pi-hole/pi-hole/rootfs/etc/nginx/includes/server_params.conf new file mode 100644 index 0000000..27415af --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/includes/server_params.conf @@ -0,0 +1,15 @@ +server_name $hostname; +index index.php; + +add_header X-Content-Type-Options nosniff; +add_header X-XSS-Protection "1; mode=block"; +add_header X-Robots-Tag none; +client_max_body_size 64M; + +location ~* .(jpg|jpeg|png|gif|ico|css|js)$ { + expires 365d; +} + +location ~ /\.ht { + deny all; +} diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/includes/ssl_params.conf b/pi-hole/pi-hole/rootfs/etc/nginx/includes/ssl_params.conf new file mode 100644 index 0000000..6f15005 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/includes/ssl_params.conf @@ -0,0 +1,9 @@ +ssl_protocols TLSv1.2; +ssl_prefer_server_ciphers on; +ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA; +ssl_ecdh_curve secp384r1; +ssl_session_timeout 10m; +ssl_session_cache shared:SSL:10m; +ssl_session_tickets off; +ssl_stapling on; +ssl_stapling_verify on; diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/lua/ha-auth.lua b/pi-hole/pi-hole/rootfs/etc/nginx/lua/ha-auth.lua new file mode 100644 index 0000000..a2c633c --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/lua/ha-auth.lua @@ -0,0 +1,83 @@ +local http = require "resty.http" +local auths = ngx.shared.auths + +function authenticate() + + --- Test Authentication header is set and with a value + local header = ngx.req.get_headers()['Authorization'] + if header == nil or header:find(" ") == nil then + return false + end + + local divider = header:find(' ') + if header:sub(0, divider-1) ~= 'Basic' then + return false + end + + local auth = ngx.decode_base64(header:sub(divider+1)) + if auth == nil or auth:find(':') == nil then + return false + end + + divider = auth:find(':') + local username = auth:sub(0, divider-1) + local password = auth:sub(divider+1) + + --- Check if authentication is cached + if auths:get(username) == password then + ngx.log(ngx.DEBUG, "Authenticated user against Home Assistant (cache).") + return true + end + + --- HTTP request against the Supervisor API + local httpc = http.new() + local res, err = httpc:request_uri("http://supervisor.local.hass.io/auth", { + method = "POST", + body = ngx.encode_args({["username"]=username, ["password"]=password}), + headers = { + ["Content-Type"] = "application/x-www-form-urlencoded", + ["X-Supervisor-Token"] = os.getenv("SUPERVISOR_TOKEN"), + }, + keepalive_timeout = 60, + keepalive_pool = 10 + }) + + --- Error during API request + if err then + ngx.log(ngx.WARN, "Error during Home Assistant user authentication.", err) + return false + end + + --- No result? Something went wrong... + if not res then + ngx.log(ngx.WARN, "Error during Home Assistant user authentication.") + return false + end + + --- Valid response, the username/password is valid + if res.status == 200 then + ngx.log(ngx.INFO, "Authenticated user against Home Assistant.") + auths:set(username, password, 60) + return true + end + + --- Whatever the response is, it is invalid + ngx.log(ngx.WARN, "Authentication against Home Assistant failed!") + return false +end + +-- Only authenticate if its not disabled +if not os.getenv('DISABLE_HA_AUTHENTICATION') then + + --- Try to authenticate against HA + local authenticated = authenticate() + + --- If authentication failed, throw a basic auth + if not authenticated then + ngx.header.content_type = 'text/plain' + ngx.header.www_authenticate = 'Basic realm="Home Assistant"' + ngx.status = ngx.HTTP_UNAUTHORIZED + ngx.say('401 Access Denied') + ngx.exit(ngx.HTTP_UNAUTHORIZED) + end +end diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/modules/ndk_http.conf b/pi-hole/pi-hole/rootfs/etc/nginx/modules/ndk_http.conf new file mode 100644 index 0000000..2663122 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/modules/ndk_http.conf @@ -0,0 +1 @@ +load_module "/usr/lib/nginx/modules/ndk_http_module.so"; diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/modules/ngx_http_lua.conf b/pi-hole/pi-hole/rootfs/etc/nginx/modules/ngx_http_lua.conf new file mode 100644 index 0000000..f885ed9 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/modules/ngx_http_lua.conf @@ -0,0 +1 @@ +load_module "/usr/lib/nginx/modules/ngx_http_lua_module.so"; diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/nginx.conf b/pi-hole/pi-hole/rootfs/etc/nginx/nginx.conf new file mode 100644 index 0000000..1530e14 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/nginx.conf @@ -0,0 +1,58 @@ +# Run nginx in foreground. +daemon off; + +# This is run inside Docker. +user root; + +# Pid storage location. +pid /var/run/nginx.pid; + +# Set number of worker processes. +worker_processes 1; + +# Enables the use of JIT for regular expressions to speed-up their processing. +pcre_jit on; + +# Write error log to the add-on log. +error_log /proc/1/fd/1 error; + +# Load allowed environment vars +env SUPERVISOR_TOKEN; +env DISABLE_HA_AUTHENTICATION; + +# Load dynamic modules. +include /etc/nginx/modules/*.conf; + +# Max num of simultaneous connections by a worker process. +events { + worker_connections 512; +} + +http { + include /etc/nginx/includes/mime.types; + + log_format homeassistant '[$time_local] $status ' + '$http_x_forwarded_for($remote_addr) ' + '$request ($http_user_agent)'; + + access_log /proc/1/fd/1 homeassistant; + client_max_body_size 4G; + default_type application/octet-stream; + gzip on; + keepalive_timeout 65; + lua_load_resty_core off; + lua_shared_dict auths 16k; + sendfile on; + server_tokens off; + tcp_nodelay on; + tcp_nopush on; + + map $http_upgrade $connection_upgrade { + default upgrade; + '' close; + } + + include /etc/nginx/includes/resolver.conf; + + include /etc/nginx/servers/*.conf; +} diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/servers/api.disabled b/pi-hole/pi-hole/rootfs/etc/nginx/servers/api.disabled new file mode 100644 index 0000000..17be5ff --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/servers/api.disabled @@ -0,0 +1,22 @@ +server { + listen %%api_port%% default_server; + include /etc/nginx/includes/server_params.conf; + + root /var/www/html/; + + allow 127.0.0.1; + deny all; + + location / { + deny all; + } + + location = /admin/api.php { + fastcgi_pass 127.0.0.1:17276; + fastcgi_read_timeout 900; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include /etc/nginx/includes/fastcgi_params.conf; + } +} diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/servers/direct-ssl.disabled b/pi-hole/pi-hole/rootfs/etc/nginx/servers/direct-ssl.disabled new file mode 100644 index 0000000..fc681b4 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/servers/direct-ssl.disabled @@ -0,0 +1,29 @@ +server { + listen %%port%% default_server ssl http2; + + include /etc/nginx/includes/ssl_params.conf; + + ssl_certificate /ssl/%%certfile%%; + ssl_certificate_key /ssl/%%keyfile%%; + + include /etc/nginx/includes/server_params.conf; + + root /var/www/html/admin; + + access_by_lua_file /etc/nginx/lua/ha-auth.lua; + + proxy_set_header Accept-Encoding ""; + sub_filter '/admin/queries.php?' '/queries.php?'; + sub_filter '/admin/scripts/pi-hole' '/scripts/pi-hole'; + sub_filter_types application/javascript; + sub_filter_once off; + + location ~ .php$ { + fastcgi_pass 127.0.0.1:17276; + fastcgi_read_timeout 900; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include /etc/nginx/includes/fastcgi_params.conf; + } +} diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/servers/direct.disabled b/pi-hole/pi-hole/rootfs/etc/nginx/servers/direct.disabled new file mode 100644 index 0000000..f29b030 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/servers/direct.disabled @@ -0,0 +1,24 @@ +server { + listen %%port%% default_server; + + include /etc/nginx/includes/server_params.conf; + + root /var/www/html/admin; + + access_by_lua_file /etc/nginx/lua/ha-auth.lua; + + proxy_set_header Accept-Encoding ""; + sub_filter '/admin/queries.php?' '/queries.php?'; + sub_filter '/admin/scripts/pi-hole' '/scripts/pi-hole'; + sub_filter_types application/javascript; + sub_filter_once off; + + location ~ .php$ { + fastcgi_pass 127.0.0.1:17276; + fastcgi_read_timeout 900; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include /etc/nginx/includes/fastcgi_params.conf; + } +} diff --git a/pi-hole/pi-hole/rootfs/etc/nginx/servers/ingress.conf b/pi-hole/pi-hole/rootfs/etc/nginx/servers/ingress.conf new file mode 100644 index 0000000..32ce147 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/nginx/servers/ingress.conf @@ -0,0 +1,25 @@ +server { + listen %%interface%%:%%port%% default_server; + + include /etc/nginx/includes/server_params.conf; + + root /var/www/html/admin; + + allow 172.30.32.2; + deny all; + + proxy_set_header Accept-Encoding ""; + sub_filter '/admin/queries.php?' '%%url%%queries.php?'; + sub_filter '/admin/scripts/pi-hole' '%%url%%scripts/pi-hole'; + sub_filter_types application/javascript; + sub_filter_once off; + + location ~ .php$ { + fastcgi_pass 127.0.0.1:17276; + fastcgi_read_timeout 900; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include /etc/nginx/includes/fastcgi_params.conf; + } +} diff --git a/pi-hole/pi-hole/rootfs/etc/php7/conf.d/99-pihole.ini b/pi-hole/pi-hole/rootfs/etc/php7/conf.d/99-pihole.ini new file mode 100644 index 0000000..28f1026 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/php7/conf.d/99-pihole.ini @@ -0,0 +1,8 @@ +[general] +max_execution_time = 900 +opcache.enable=1 +opcache.interned_strings_buffer=8 +opcache.max_accelerated_files=4096 +opcache.memory_consumption=32 +opcache.revalidate_freq=0 +opcache.validate_timestamps=0 diff --git a/pi-hole/pi-hole/rootfs/etc/php7/php-fpm.d/www.conf b/pi-hole/pi-hole/rootfs/etc/php7/php-fpm.d/www.conf new file mode 100644 index 0000000..cf6a150 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/php7/php-fpm.d/www.conf @@ -0,0 +1,11 @@ +[www] +user = nginx +group = nginx +listen = 127.0.0.1:17276 +pm = dynamic +pm.max_children = 10 +pm.start_servers = 3 +pm.min_spare_servers = 2 +pm.max_spare_servers = 5 +pm.max_requests = 1024 +clear_env = no diff --git a/pi-hole/pi-hole/rootfs/etc/pihole/GitHubVersions b/pi-hole/pi-hole/rootfs/etc/pihole/GitHubVersions new file mode 100644 index 0000000..e3f23b4 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/pihole/GitHubVersions @@ -0,0 +1 @@ +X X X \ No newline at end of file diff --git a/pi-hole/pi-hole/rootfs/etc/pihole/adlists.list b/pi-hole/pi-hole/rootfs/etc/pihole/adlists.list new file mode 100644 index 0000000..f91d702 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/pihole/adlists.list @@ -0,0 +1,22 @@ +# The below list amalgamates several lists we used previously. +# See `https://github.com/StevenBlack/hosts` for details +##StevenBlack's list +https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts + +##MalwareDomains +https://mirror1.malwaredomains.com/files/justdomains + +##Cameleon +http://sysctl.org/cameleon/hosts + +##Zeustracker +https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist + +##Disconnect.me Tracking +https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt + +##Disconnect.me Ads +https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt + +##Hosts-file.net +https://hosts-file.net/ad_servers.txt diff --git a/pi-hole/pi-hole/rootfs/etc/pihole/black.list b/pi-hole/pi-hole/rootfs/etc/pihole/black.list new file mode 100644 index 0000000..e69de29 diff --git a/pi-hole/pi-hole/rootfs/etc/pihole/dns-servers.conf b/pi-hole/pi-hole/rootfs/etc/pihole/dns-servers.conf new file mode 100644 index 0000000..cf6fc39 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/pihole/dns-servers.conf @@ -0,0 +1,10 @@ +Home Assistant DNS;%%dns_host%%;; +Google (ECS);8.8.8.8;8.8.4.4;2001:4860:4860:0:0:0:0:8888;2001:4860:4860:0:0:0:0:8844 +OpenDNS (ECS);208.67.222.222;208.67.220.220;2620:0:ccc::2;2620:0:ccd::2 +Level3;4.2.2.1;4.2.2.2;; +Comodo;8.26.56.26;8.20.247.20;; +DNS.WATCH;84.200.69.80;84.200.70.40;2001:1608:10:25:0:0:1c04:b12f;2001:1608:10:25:0:0:9249:d69b +Quad9 (filtered, DNSSEC);9.9.9.9;149.112.112.112;2620:fe::fe;2620:fe::9 +Quad9 (unfiltered, no DNSSEC);9.9.9.10;149.112.112.10;2620:fe::10;2620:fe::fe:10 +Quad9 (filtered + ECS);9.9.9.11;149.112.112.11;2620:fe::11; +Cloudflare;1.1.1.1;1.0.0.1;2606:4700:4700::1111;2606:4700:4700::1001 diff --git a/pi-hole/pi-hole/rootfs/etc/pihole/local.list b/pi-hole/pi-hole/rootfs/etc/pihole/local.list new file mode 100644 index 0000000..e69de29 diff --git a/pi-hole/pi-hole/rootfs/etc/pihole/localbranches b/pi-hole/pi-hole/rootfs/etc/pihole/localbranches new file mode 100644 index 0000000..4d80e12 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/pihole/localbranches @@ -0,0 +1 @@ +master master master \ No newline at end of file diff --git a/pi-hole/pi-hole/rootfs/etc/pihole/pihole-FTL.conf b/pi-hole/pi-hole/rootfs/etc/pihole/pihole-FTL.conf new file mode 100644 index 0000000..6a852f8 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/pihole/pihole-FTL.conf @@ -0,0 +1,84 @@ +### This file contains parameters for FTL behavior. +### At install, all parameters are commented out. The user can select desired options. +### Options shown are the default configuration. No modification is needed for most +### installations. +### Visit https://docs.pi-hole.net/ftldns/configfile/ for more detailed parameter explanations + +## Socket Listening +## Listen only for local socket connections or permit all connections +## Options: localonly, all +#SOCKET_LISTENING=localonly + +## Query Display +## Display all queries? Set to no to hide query display +## Options: yes, no +#QUERY_DISPLAY=yes + +## AAA Query Analysis +## Allow FTL to analyze AAAA queries from pihole.log? +## Options: yes, no +#AAAA_QUERY_ANALYSIS=yes + +## Resolve IPv6 +## Should FTL try to resolve IPv6 addresses to host names? +## Options: yes, no +#RESOLVE_IPV6=yes + +## Resolve IPv4 +## Should FTL try to resolve IPv4 addresses to host names? +## Options: yes, no +#RESOLVE_IPV4=yes + +## Max Database Days +## How long should queries be stored in the database in days +## Setting this to 0 disables the database +## See: https://docs.pi-hole.net/ftldns/database/ +## Options: number of days +#MAXDBDAYS=365 + +## Database Interval +## How often do we store queries in FTL's database minutes +## See: https://docs.pi-hole.net/ftldns/database/ +## Options: number of minutes +#DBINTERVAL=1.0 + +## Database File +## Specify path and filename of FTL's SQLite3 long-term database. +## Setting this to DBFILE= disables the database altogether +## See: https://docs.pi-hole.net/ftldns/database/ +## Option: path to db file +#DBFILE=/etc/pihole/pihole-FTL.db + +## Max Log Age +## Up to how many hours of queries should be imported from the database and logs in hours +## Maximum is 744 = 31 days +## Options: number of days +#MAXLOGAGE=24.0 + +## FTL Port +## On which port should FTL be listening? +## Options: tcp port +#FTLPORT=4711 + +## Privacy Level +## Which privacy level is used? +## See: https://docs.pi-hole.net/ftldns/privacylevels/ +## Options: 0, 1, 2, 3 +#PRIVACYLEVEL=0 + +## Ignore Localhost +## Should FTL ignore queries coming from the local machine? +## Options: yes, no +#IGNORE_LOCALHOST=no + +## Blocking Mode +## How should FTL reply to blocked queries? +## See: https://docs.pi-hole.net/ftldns/blockingmode/ +## Options: NULL, IP-AAAA-NODATA, IP, NXDOMAIN +#BLOCKINGMODE=NULL + +## Regex Debug Mode +## Controls if FTLDNS should print extended details about regex matching into pihole-FTL.log. +## See: https://docs.pi-hole.net/ftldns/regex/overview/ +## Options: true, false +#REGEX_DEBUGMODE=false diff --git a/pi-hole/pi-hole/rootfs/etc/pihole/setupVars.conf b/pi-hole/pi-hole/rootfs/etc/pihole/setupVars.conf new file mode 100644 index 0000000..ff8daad --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/pihole/setupVars.conf @@ -0,0 +1,6 @@ +PIHOLE_INTERFACE=eth0 +IPV4_ADDRESS=0.0.0.0 +IPV6_ADDRESS=0:0:0:0:0:0 +PIHOLE_DNS_1=8.8.8.8 +PIHOLE_DNS_2=8.8.4.4 +QUERY_LOGGING=true diff --git a/pi-hole/pi-hole/rootfs/etc/services.d/crond/finish b/pi-hole/pi-hole/rootfs/etc/services.d/crond/finish new file mode 100644 index 0000000..077bb9c --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/services.d/crond/finish @@ -0,0 +1,9 @@ +#!/usr/bin/execlineb -S0 +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Take down the S6 supervision tree when crond fails +# ============================================================================== +if -n { s6-test $# -ne 0 } +if -n { s6-test ${1} -eq 256 } + +s6-svscanctl -t /var/run/s6/services diff --git a/pi-hole/pi-hole/rootfs/etc/services.d/crond/run b/pi-hole/pi-hole/rootfs/etc/services.d/crond/run new file mode 100644 index 0000000..02a7161 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/services.d/crond/run @@ -0,0 +1,6 @@ +#!/usr/bin/with-contenv bashio +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Runs the cron daemon +# ============================================================================== +exec fdmove -c 2 1 /usr/sbin/crond -f -L /var/log/cron -l 0 -c /etc/crontabs diff --git a/pi-hole/pi-hole/rootfs/etc/services.d/nginx/finish b/pi-hole/pi-hole/rootfs/etc/services.d/nginx/finish new file mode 100644 index 0000000..ae9a2fb --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/services.d/nginx/finish @@ -0,0 +1,9 @@ +#!/usr/bin/execlineb -S0 +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Take down the S6 supervision tree when Nginx fails +# ============================================================================== +if -n { s6-test $# -ne 0 } +if -n { s6-test ${1} -eq 256 } + +s6-svscanctl -t /var/run/s6/services diff --git a/pi-hole/pi-hole/rootfs/etc/services.d/nginx/run b/pi-hole/pi-hole/rootfs/etc/services.d/nginx/run new file mode 100644 index 0000000..b541566 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/services.d/nginx/run @@ -0,0 +1,12 @@ +#!/usr/bin/with-contenv bashio +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Runs the Nginx daemon +# ============================================================================== + +# Wait for PHP-FPM to become available +bashio::net.wait_for 17276 + +bashio::log.info "Starting NGinx...." + +exec nginx diff --git a/pi-hole/pi-hole/rootfs/etc/services.d/php-fpm/finish b/pi-hole/pi-hole/rootfs/etc/services.d/php-fpm/finish new file mode 100644 index 0000000..cc93bcb --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/services.d/php-fpm/finish @@ -0,0 +1,9 @@ +#!/usr/bin/execlineb -S0 +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Take down the S6 supervision tree when PHP FPM fails +# ============================================================================== +if -n { s6-test $# -ne 0 } +if -n { s6-test ${1} -eq 256 } + +s6-svscanctl -t /var/run/s6/services diff --git a/pi-hole/pi-hole/rootfs/etc/services.d/php-fpm/run b/pi-hole/pi-hole/rootfs/etc/services.d/php-fpm/run new file mode 100644 index 0000000..0d3889b --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/services.d/php-fpm/run @@ -0,0 +1,9 @@ +#!/usr/bin/with-contenv bashio +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Runs the PHP-FPM daemon +# ============================================================================== + +bashio::log.info "Starting PHP-FPM..." +export PHP_ERROR_LOG=/dev/stderr +exec php-fpm7 --nodaemonize diff --git a/pi-hole/pi-hole/rootfs/etc/services.d/pihole-FTL/finish b/pi-hole/pi-hole/rootfs/etc/services.d/pihole-FTL/finish new file mode 100644 index 0000000..5d6c070 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/services.d/pihole-FTL/finish @@ -0,0 +1,9 @@ +#!/usr/bin/execlineb -S0 +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Take down the S6 supervision tree when Pi-hole FTL fails +# ============================================================================== +if -n { s6-test $# -ne 0 } +if -n { s6-test ${1} -eq 256 } + +s6-svscanctl -t /var/run/s6/services diff --git a/pi-hole/pi-hole/rootfs/etc/services.d/pihole-FTL/run b/pi-hole/pi-hole/rootfs/etc/services.d/pihole-FTL/run new file mode 100644 index 0000000..5fce41d --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/services.d/pihole-FTL/run @@ -0,0 +1,15 @@ +#!/usr/bin/with-contenv bashio +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Runs the Pi-hole FTL daemon +# ============================================================================== +mkdir -p /var/run/pihole +chown pihole:pihole /var/run/pihole + +bashio::log.info "Starting Pi-Hole FTL..." + +if bashio::debug; then + exec s6-setuidgid pihole pihole-FTL debug +else + exec s6-setuidgid pihole pihole-FTL no-daemon +fi diff --git a/pi-hole/pi-hole/rootfs/etc/sudoers.d/pihole b/pi-hole/pi-hole/rootfs/etc/sudoers.d/pihole new file mode 100644 index 0000000..be02066 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/etc/sudoers.d/pihole @@ -0,0 +1,11 @@ +# Pi-hole: A black hole for Internet advertisements +# (c) 2017 Pi-hole, LLC (https://pi-hole.net) +# Network-wide ad blocking via your own hardware. +# +# Allows the WebUI to use Pi-hole commands +# +# This file is copyright under the latest version of the EUPL. +# Please see LICENSE file for your rights under this license. +# +nginx ALL=NOPASSWD: /usr/local/bin/pihole, /usr/bin/restart_addon, /usr/bin/stop_addon +Defaults secure_path = /usr/bin:/sbin:/bin:/usr/sbin:/usr/local/bin diff --git a/pi-hole/pi-hole/rootfs/opt/pihole/.gitkeep b/pi-hole/pi-hole/rootfs/opt/pihole/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/pi-hole/pi-hole/rootfs/patches/FTL/fix-nettle-3.5-compat.patch b/pi-hole/pi-hole/rootfs/patches/FTL/fix-nettle-3.5-compat.patch new file mode 100644 index 0000000..5d01e5c --- /dev/null +++ b/pi-hole/pi-hole/rootfs/patches/FTL/fix-nettle-3.5-compat.patch @@ -0,0 +1,35 @@ +diff --git a/Makefile b/Makefile +index 009e18f..94b12e4 100644 +--- a/Makefile ++++ b/Makefile +@@ -98,7 +98,7 @@ CCFLAGS=-std=gnu11 -I$(IDIR) $(WARNFLAGS) -D_FILE_OFFSET_BITS=64 $(HARDENING_FLA + # for dnsmasq we need the nettle crypto library and the gmp maths library + # We link the two libraries statically. Although this increases the binary file size by about 1 MB, it saves about 5 MB of shared libraries and makes deployment easier + #LIBS=-pthread -lnettle -lgmp -lhogweed +-LIBS=-pthread -lrt -Wl,-Bstatic -L/usr/local/lib -lhogweed -lgmp -lnettle -Wl,-Bdynamic ++LIBS=-pthread -lrt -Wl,-lhogweed -lgmp -lnettle -Wl,-Bdynamic + # Flags for compiling with libidn : -lidn + # Flags for compiling with libidn2: -lidn2 + +diff --git a/dnsmasq/crypto.c b/dnsmasq/crypto.c +index 3b98974..f21caef 100644 +--- a/dnsmasq/crypto.c ++++ b/dnsmasq/crypto.c +@@ -294,7 +294,7 @@ static int dnsmasq_ecdsa_verify(struct blockdata *key_data, unsigned int key_len + if (!(key_256 = whine_malloc(sizeof(struct ecc_point)))) + return 0; + +- nettle_ecc_point_init(key_256, &nettle_secp_256r1); ++ nettle_ecc_point_init(key_256, nettle_get_secp_256r1()); + } + + key = key_256; +@@ -307,7 +307,7 @@ static int dnsmasq_ecdsa_verify(struct blockdata *key_data, unsigned int key_len + if (!(key_384 = whine_malloc(sizeof(struct ecc_point)))) + return 0; + +- nettle_ecc_point_init(key_384, &nettle_secp_384r1); ++ nettle_ecc_point_init(key_384, nettle_get_secp_384r1()); + } + + key = key_384; diff --git a/pi-hole/pi-hole/rootfs/patches/FTL/fix-poll-h-include-warning-on-musl.patch b/pi-hole/pi-hole/rootfs/patches/FTL/fix-poll-h-include-warning-on-musl.patch new file mode 100644 index 0000000..b433067 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/patches/FTL/fix-poll-h-include-warning-on-musl.patch @@ -0,0 +1,14 @@ +diff --git a/dnsmasq/dnsmasq.h b/dnsmasq/dnsmasq.h +index 10ef7ee..69f4ee1 100644 +--- a/dnsmasq/dnsmasq.h ++++ b/dnsmasq/dnsmasq.h +@@ -88,7 +88,7 @@ typedef unsigned long long u64; + #if defined(HAVE_SOLARIS_NETWORK) + # include + #endif +-#include ++#include + #include + #include + #include + diff --git a/pi-hole/pi-hole/rootfs/patches/FTL/no-backtrace-on-musl.patch b/pi-hole/pi-hole/rootfs/patches/FTL/no-backtrace-on-musl.patch new file mode 100644 index 0000000..af55c38 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/patches/FTL/no-backtrace-on-musl.patch @@ -0,0 +1,29 @@ +diff --git a/signals.c b/signals.c +index 0fa70d5..fd5a15c 100644 +--- a/signals.c ++++ b/signals.c +@@ -40,24 +40,6 @@ static void SIGSEGV_handler(int sig, siginfo_t *si, void *unused) + default: logg(" with code: Unknown (%i), ",si->si_code); break; + } + +- // Try to obtain backtrace. This may not always be helpful, but it is better than nothing +- void *buffer[255]; +- const int calls = backtrace(buffer, sizeof(buffer)/sizeof(void *)); +- char ** bcktrace = backtrace_symbols(buffer, calls); +- if(bcktrace == NULL) +- { +- logg("Unable to obtain backtrace (%i)!",calls); +- } +- else +- { +- logg("Backtrace:"); +- int j; +- for (j = 0; j < calls; j++) +- { +- logg("B[%04i]: %s",j,bcktrace[j]); +- } +- } +- free(bcktrace); + + logg("Thank you for helping us to improve our FTL engine!"); + diff --git a/pi-hole/pi-hole/rootfs/patches/pihole/fix-killall-brain-damage.patch b/pi-hole/pi-hole/rootfs/patches/pihole/fix-killall-brain-damage.patch new file mode 100644 index 0000000..280ced0 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/patches/pihole/fix-killall-brain-damage.patch @@ -0,0 +1,13 @@ +diff --git a/pihole b/pihole +index d2ff364..38e09d0 100755 +--- a/pihole ++++ b/pihole +@@ -105,7 +105,7 @@ restartDNS() { + if [[ "${svcOption}" =~ "reload" ]]; then + # Reload has been requested + # Note: This will NOT re-read any *.conf files +- svc="killall -s SIGHUP ${resolver}" ++ svc="kill -s SIGHUP $(pgrep ${resolver})" + else + # A full restart has been requested + svc="service ${resolver} restart" diff --git a/pi-hole/pi-hole/rootfs/usr/bin/restart_addon b/pi-hole/pi-hole/rootfs/usr/bin/restart_addon new file mode 100755 index 0000000..20336f7 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/usr/bin/restart_addon @@ -0,0 +1,11 @@ +#!/usr/bin/env bashio +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Restarts the add-on +# ============================================================================== + +echo "Restarting add-on in 15 seconds" + +sleep 15 + +bashio::addon.restart diff --git a/pi-hole/pi-hole/rootfs/usr/bin/stop_addon b/pi-hole/pi-hole/rootfs/usr/bin/stop_addon new file mode 100755 index 0000000..e2ea8e9 --- /dev/null +++ b/pi-hole/pi-hole/rootfs/usr/bin/stop_addon @@ -0,0 +1,10 @@ +#!/usr/bin/env bashio +# ============================================================================== +# Home Assistant Community Add-on: Pi-hole +# Stops the add-on +# ============================================================================== +echo "Stopping add-on in 15 seconds" + +sleep 15 + +bashio::addon.stop diff --git a/pi-hole/renovate.json b/pi-hole/renovate.json new file mode 100644 index 0000000..58ca74e --- /dev/null +++ b/pi-hole/renovate.json @@ -0,0 +1,11 @@ +{ + "extends": [ + "config:base" + ], + "commitMessageAction": "Updates", + "commitMessageTopic": "{{depName}}", + "commitMessagePrefix": ":arrow_up:", + "labels": [ + "Type: Maintenance" + ] +}