n0mad1k
7484a0e034
- Dual-mode operation: standalone + c2itall integrated (env var detection)
- SSH keys moved to ~/.ssh/c2deploy_ph-{id} with per-deployment known_hosts
- Ansible output streaming with filtered console + full log capture
- Deployment management menu: discover, SSH, teardown existing deployments
- Cert setup script (setup-cert.sh) deployed to servers for post-DNS LE certs
- Matrix hardening: unique secrets, SSRF protection, rate limits, nginx security headers
- Base hardening: fail2ban systemd backend (Debian 12), SSH limits, nginx jails
- Add-matrix-user helper script deployed to all Matrix servers
- .env support for standalone credential storage
- Config key rename: deploy_id → deployment_id (with backward compat)
- Provider cleanup playbooks for teardown
- Test suite with 50 tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
89 lines
2.0 KiB
YAML
89 lines
2.0 KiB
YAML
---
|
|
# Pi-hole native installation (no Docker)
|
|
|
|
- name: Install Pi-hole prerequisites
|
|
apt:
|
|
name:
|
|
- curl
|
|
- git
|
|
- iproute2
|
|
- whiptail
|
|
- ca-certificates
|
|
- cron
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Stop systemd-resolved (conflicts with Pi-hole on port 53)
|
|
service:
|
|
name: systemd-resolved
|
|
state: stopped
|
|
enabled: false
|
|
failed_when: false
|
|
|
|
- name: Set DNS fallback for installation
|
|
copy:
|
|
dest: /etc/resolv.conf
|
|
content: |
|
|
nameserver 9.9.9.9
|
|
nameserver 1.1.1.1
|
|
mode: "0644"
|
|
|
|
- name: Create Pi-hole config directory
|
|
file:
|
|
path: /etc/pihole
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Deploy setupVars.conf for unattended install
|
|
copy:
|
|
dest: /etc/pihole/setupVars.conf
|
|
content: |
|
|
PIHOLE_INTERFACE={{ ansible_default_ipv4.interface | default('eth0') }}
|
|
PIHOLE_DNS_1={{ pihole_upstream.split(';')[0] | default('9.9.9.9') }}
|
|
PIHOLE_DNS_2={{ pihole_upstream.split(';')[1] | default('149.112.112.112') }}
|
|
QUERY_LOGGING=false
|
|
INSTALL_WEB_SERVER=true
|
|
INSTALL_WEB_INTERFACE=true
|
|
LIGHTTPD_ENABLED=false
|
|
CACHE_SIZE=10000
|
|
DNS_FQDN_REQUIRED=true
|
|
DNS_BOGUS_PRIV=true
|
|
DNSSEC=true
|
|
BLOCKING_ENABLED=true
|
|
WEBPASSWORD=
|
|
mode: "0644"
|
|
|
|
- name: Clone Pi-hole repository
|
|
git:
|
|
repo: https://github.com/pi-hole/pi-hole.git
|
|
dest: /opt/pihole-install
|
|
version: master
|
|
depth: 1
|
|
|
|
- name: Run Pi-hole installer (unattended)
|
|
command: bash /opt/pihole-install/automated\ install/basic-install.sh --unattended
|
|
args:
|
|
creates: /usr/local/bin/pihole
|
|
environment:
|
|
PIHOLE_SKIP_OS_CHECK: "true"
|
|
|
|
- name: Allow DNS through UFW
|
|
ufw:
|
|
rule: allow
|
|
port: "{{ item.port }}"
|
|
proto: "{{ item.proto }}"
|
|
loop:
|
|
- { port: "53", proto: "tcp" }
|
|
- { port: "53", proto: "udp" }
|
|
|
|
- name: Allow Pi-hole admin from private networks only
|
|
ufw:
|
|
rule: allow
|
|
port: "80"
|
|
proto: tcp
|
|
from_ip: "{{ item }}"
|
|
loop:
|
|
- "10.0.0.0/8"
|
|
- "172.16.0.0/12"
|
|
- "192.168.0.0/16"
|