~

nixos/modules/docker/default.nix

@@ -0,0 +1,5 @@
+{ ... }: {
+	imports = [
+		./pihole
+	];
+}

nixos/modules/docker/pihole/default.nix

@@ -0,0 +1,48 @@
+{ pkgs, lib, config, ... }: let
+	cfg = config.r5e.containers.pihole;
+in with lib; {
+	options.r5e.containers.pihole = {
+		enable = mkEnableOption "Pi-hole";
+		openFirewall = mkOption {
+			type = types.bool;
+			default = false;
+		};
+		listenPortHTTP = mkOption {
+			type = types.int;
+			default = 80;
+		};
+		listenPortHTTPS = mkOption {
+			type = types.int;
+			default = 443;
+		};
+		api-password = mkOption {
+			type = types.str;
+			default = "";
+		};
+
+		dhcp = {
+			enable = mkEnableOption "the Pi-hole DHCP server";
+		};
+	};
+
+	config = mkIf cfg.enable (mkMerge [
+		(import ./docker-compose.nix { inherit pkgs lib; })
+		{
+			virtualisation.oci-containers.containers.pihole = {
+				environment = {
+					TZ = config.time.timeZone;
+					FTLCONF_webserver_api_password = mkIf (cfg.api-password != "") cfg.api-password;
+				};
+				ports = [
+					(builtins.toString cfg.listenPortHTTP + ":80/tcp")
+					(builtins.toString cfg.listenPortHTTPS + ":443/tcp")
+				] ++ (optional cfg.dhcp.enable "67:67/udp");
+			};
+
+			networking.firewall = mkIf cfg.openFirewall {
+				allowedTCPPorts = [ 53 cfg.listenPortHTTP cfg.listenPortHTTPS ];
+				allowedUDPPorts = [ 53 ] ++ (optional cfg.dhcp.enable 67);
+			};
+		}
+	]);
+}

nixos/modules/docker/pihole/docker-compose.nix

@@ -0,0 +1,80 @@
+# Auto-generated using compose2nix v0.3.1.
+{ pkgs, lib, ... }:
+
+{
+  # Runtime
+  virtualisation.docker = {
+    enable = true;
+    autoPrune.enable = true;
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  # Containers
+  virtualisation.oci-containers.containers."pihole" = {
+    image = "pihole/pihole:latest";
+    environment = {
+      "FTLCONF_dns_listeningMode" = "all";
+    };
+    volumes = [
+      "/etc/pihole:/etc/pihole:rw"
+    ];
+    ports = [
+      "53:53/tcp"
+      "53:53/udp"
+      "80:80/tcp"
+      "443:443/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--cap-add=NET_ADMIN"
+      "--cap-add=SYS_NICE"
+      "--network-alias=pihole"
+      "--network=pihole_default"
+    ];
+  };
+  systemd.services."docker-pihole" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    after = [
+      "docker-network-pihole_default.service"
+    ];
+    requires = [
+      "docker-network-pihole_default.service"
+    ];
+    partOf = [
+      "docker-compose-pihole-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-pihole-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."docker-network-pihole_default" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "docker network rm -f pihole_default";
+    };
+    script = ''
+      docker network inspect pihole_default || docker network create pihole_default
+    '';
+    partOf = [ "docker-compose-pihole-root.target" ];
+    wantedBy = [ "docker-compose-pihole-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."docker-compose-pihole-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

nixos/modules/docker/pihole/docker-compose.yml

@@ -0,0 +1,36 @@
+# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
+name: pihole
+services:
+  pihole:
+    container_name: pihole
+    image: pihole/pihole:latest
+    ports:
+      # DNS Ports
+      - "53:53/tcp"
+      - "53:53/udp"
+      # Default HTTP Port
+      - "80:80/tcp"
+      # Default HTTPs Port. FTL will generate a self-signed certificate
+      - "443:443/tcp"
+      # Uncomment the line below if you are using Pi-hole as your DHCP server
+      #- "67:67/udp"
+      # Uncomment the line below if you are using Pi-hole as your NTP server
+      #- "123:123/udp"
+    environment:
+      # If using Docker's default `bridge` network setting the dns listening mode should be set to 'all'
+      FTLCONF_dns_listeningMode: 'all'
+    # Volumes store your data between container upgrades
+    volumes:
+      # For persisting Pi-hole's databases and common configuration file
+      - '/etc/pihole:/etc/pihole'
+      # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
+      #- './etc-dnsmasq.d:/etc/dnsmasq.d'
+    cap_add:
+      # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
+      # Required if you are using Pi-hole as your DHCP server, else not needed
+      - NET_ADMIN
+      # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
+      # - SYS_TIME
+      # Optional, if Pi-hole should get some more processing time
+      - SYS_NICE
+    restart: unless-stopped