From fb0b3914086484d9284426985984e2c1699ba557 Mon Sep 17 00:00:00 2001
From: Elizabeth Hunt <elizabeth.hunt@simponic.xyz>
Date: Fri, 5 Jan 2024 16:13:01 -0500
Subject: ldap, internal CA, internal webserver, dns, etc.

---
 roles/pihole/tasks/main.yml                  | 36 ++++++++++++++++++++++++++++
 roles/pihole/templates/docker-compose.yml.j2 | 18 ++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 roles/pihole/tasks/main.yml
 create mode 100644 roles/pihole/templates/docker-compose.yml.j2

(limited to 'roles/pihole')

diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml
new file mode 100644
index 0000000..0467b80
--- /dev/null
+++ b/roles/pihole/tasks/main.yml
@@ -0,0 +1,36 @@
+---
+- name: ensure pihole docker/compose exist
+  file:
+    path: /etc/docker/compose/pihole
+    state: directory
+    owner: root
+    group: root
+    mode: 0700
+
+- name: build pihole docker-compose.yml.j2
+  template:
+    src: ../templates/docker-compose.yml.j2
+    dest: /etc/docker/compose/pihole/docker-compose.yml
+    owner: root
+    group: root
+    mode: u=rw,g=r,o=r
+
+- name: daemon-reload and enable pihole
+  ansible.builtin.systemd_service:
+    state: restarted
+    enabled: true
+    name: docker-compose@pihole
+
+- name: allow dns queries in vpn/tcp
+  ufw:
+    rule: allow
+    from: '100.64.0.0/10'
+    port: '53'
+    proto: 'tcp'
+
+- name: allow dns queries in vpn/udp
+  ufw:
+    rule: allow
+    from: '100.64.0.0/10'
+    port: '53'
+    proto: 'udp'
diff --git a/roles/pihole/templates/docker-compose.yml.j2 b/roles/pihole/templates/docker-compose.yml.j2
new file mode 100644
index 0000000..ed98d52
--- /dev/null
+++ b/roles/pihole/templates/docker-compose.yml.j2
@@ -0,0 +1,18 @@
+version: "3"
+
+services:
+  pihole:
+    container_name: pihole
+    image: pihole/pihole:latest
+    ports:
+      - "{{ johan_ip }}:53:53/tcp"
+      - "{{ johan_ip }}:53:53/udp"
+      - "127.0.0.1:53:53/tcp"
+      - "127.0.0.1:53:53/udp"
+      - "127.0.0.1:9135:80/tcp"
+    environment:
+      WEBPASSWORD: '{{ pihole_webpwd }}'
+    volumes:
+      - './etc-pihole:/etc/pihole'
+      - './etc-dnsmasq.d:/etc/dnsmasq.d'
+    restart: unless-stopped
-- 
cgit v1.2.3-70-g09d2