n0mad1k
3542913689
- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN, HSTS max-age=0 for self-signed certs, split LAN vs public messages - Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact - Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream) - Module prompts: accept IPs for matrix/cloud/vault/media, hard error on email with IP, all_in_one skips certbot email for LAN - Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name - OS family guards: ansible_os_family == Debian on all apt tasks - SSH key path: expanduser().resolve() on user-provided key paths - Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API token — no browser auth needed, creates tunnel + credentials + DNS + systemd Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
90 lines
2.1 KiB
YAML
90 lines
2.1 KiB
YAML
---
|
|
# Pi-hole native installation (no Docker)
|
|
|
|
- name: Install Pi-hole prerequisites
|
|
apt:
|
|
name:
|
|
- curl
|
|
- git
|
|
- iproute2
|
|
- whiptail
|
|
- ca-certificates
|
|
- cron
|
|
state: present
|
|
update_cache: true
|
|
when: ansible_os_family == "Debian"
|
|
|
|
- name: Stop systemd-resolved (conflicts with Pi-hole on port 53)
|
|
service:
|
|
name: systemd-resolved
|
|
state: stopped
|
|
enabled: false
|
|
failed_when: false
|
|
|
|
- name: Set DNS fallback for installation
|
|
copy:
|
|
dest: /etc/resolv.conf
|
|
content: |
|
|
nameserver 9.9.9.9
|
|
nameserver 1.1.1.1
|
|
mode: "0644"
|
|
|
|
- name: Create Pi-hole config directory
|
|
file:
|
|
path: /etc/pihole
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Deploy setupVars.conf for unattended install
|
|
copy:
|
|
dest: /etc/pihole/setupVars.conf
|
|
content: |
|
|
PIHOLE_INTERFACE={{ ansible_default_ipv4.interface | default('eth0') }}
|
|
PIHOLE_DNS_1={{ pihole_upstream.split(';')[0] | default('9.9.9.9') }}
|
|
PIHOLE_DNS_2={{ pihole_upstream.split(';')[1] | default('149.112.112.112') }}
|
|
QUERY_LOGGING=false
|
|
INSTALL_WEB_SERVER=true
|
|
INSTALL_WEB_INTERFACE=true
|
|
LIGHTTPD_ENABLED=false
|
|
CACHE_SIZE=10000
|
|
DNS_FQDN_REQUIRED=true
|
|
DNS_BOGUS_PRIV=true
|
|
DNSSEC=true
|
|
BLOCKING_ENABLED=true
|
|
WEBPASSWORD=
|
|
mode: "0644"
|
|
|
|
- name: Clone Pi-hole repository
|
|
git:
|
|
repo: https://github.com/pi-hole/pi-hole.git
|
|
dest: /opt/pihole-install
|
|
version: master
|
|
depth: 1
|
|
|
|
- name: Run Pi-hole installer (unattended)
|
|
command: bash /opt/pihole-install/automated\ install/basic-install.sh --unattended
|
|
args:
|
|
creates: /usr/local/bin/pihole
|
|
environment:
|
|
PIHOLE_SKIP_OS_CHECK: "true"
|
|
|
|
- name: Allow DNS through UFW
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item.port }}"
|
|
proto: "{{ item.proto }}"
|
|
loop:
|
|
- { port: "53", proto: "tcp" }
|
|
- { port: "53", proto: "udp" }
|
|
|
|
- name: Allow Pi-hole admin from private networks only
|
|
ufw:
|
|
rule: allow
|
|
port: "80"
|
|
proto: tcp
|
|
from_ip: "{{ item }}"
|
|
loop:
|
|
- "10.0.0.0/8"
|
|
- "172.16.0.0/12"
|
|
- "192.168.0.0/16"
|