Webstar/LibrePortal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(pihole): use the official image, ported to Pi-hole v6

Browse Source 
The app shipped cbcrowe/pihole-unbound — a third-party bundle last
rebuilt 841 days ago. Pi-hole itself is fine: the official
pihole/pihole was rebuilt 42 days ago. We packaged an abandoned fork,
not a dead project.

Not a tag swap. The official image is v6, which replaced nearly every
v5 environment variable with an FTLCONF_ equivalent — and the container
ACCEPTS the old names and ignores them, so a v5-style block looks
correct while configuring nothing, including the admin password:

  WEBPASSWORD         -> FTLCONF_webserver_api_password
  WEBTHEME            -> FTLCONF_webserver_interface_theme
  PIHOLE_DNS_         -> FTLCONF_dns_upstreams   (";" separates values)
  DNSSEC              -> FTLCONF_dns_dnssec
  DNSMASQ_LISTENING   -> FTLCONF_dns_listeningMode
  REV_SERVER{,_TARGET,_DOMAIN,_CIDR} -> FTLCONF_dns_revServers, one
                         combined "<enabled>,<cidr>,<target>,<domain>"
  FTLCONF_LOCAL_IPV4  -> gone in v6

listeningMode is ALL rather than the old "single": on a bridge network
queries arrive via the docker gateway, and "single" drops them.

The bundled unbound is gone, so PIHOLE_DNS_=127.0.0.1#5335 pointed at
nothing. New CFG_PIHOLE_UPSTREAM_DNS defaults to Quad9, with the config
documenting how to point it at the unbound app for full recursion. The
freed port slot becomes the (disabled) DHCP port, which v6 supports.

Volumes: v6 keeps config, databases and gravity under /etc/pihole, and
ignores /etc/dnsmasq.d unless explicitly re-enabled — so the old
two-mount layout is replaced by a single ./etc-pihole.

Variable names taken from the official v5->v6 upgrade doc, not memory.
Substitution verified end to end: every placeholder resolves and
revServers renders in the documented format.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
librelad 2026-08-18 02:30:13 +01:00
parent ca266e9391
commit ab811440e4
2 changed files with 24 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
containers/pihole/docker-compose.yml
View File

@ -5,7 +5,7 @@ networks:
services:
pihole-service: #LIBREPORTAL|SERVICE_TAG_1|pihole-service
container_name: pihole-service
image: cbcrowe/pihole-unbound:latest #LIBREPORTAL|PIHOLE_VERSION_TAG|latest
image: pihole/pihole:latest #LIBREPORTAL|PIHOLE_VERSION_TAG|latest
restart: unless-stopped
hostname: pihole
# GLUETUN_OFF_BEGIN
@ -28,24 +28,33 @@ services:
traefik.http.services.pihole-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
traefik.http.routers.pihole-service.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1
# TRAEFIK_PORT_1_END
# Pi-hole v6 replaced almost every v5 variable with an FTLCONF_ equivalent
# matching its new TOML config. The old names are accepted by the container
# and then ignored, so a v5-style block looks fine and silently configures
# nothing — including the admin password.
environment:
- FTLCONF_LOCAL_IPV4=PUBLIC_IP_DATA #LIBREPORTAL|PUBLIC_IP_TAG|PUBLIC_IP_DATA
- TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA
- WEBPASSWORD=PIHOLE_ADMIN_PASSWORD_DATA #LIBREPORTAL|PIHOLE_ADMIN_PASSWORD_TAG|PIHOLE_ADMIN_PASSWORD_DATA
- WEBTHEME=PIHOLE_WEB_THEME_DATA #LIBREPORTAL|PIHOLE_WEB_THEME_TAG|PIHOLE_WEB_THEME_DATA
- REV_SERVER=true
- REV_SERVER_TARGET=PIHOLE_REV_SERVER_TARGET_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_TARGET_TAG|PIHOLE_REV_SERVER_TARGET_DATA
- REV_SERVER_DOMAIN=local
- REV_SERVER_CIDR=PIHOLE_REV_SERVER_CIDR_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_CIDR_TAG|PIHOLE_REV_SERVER_CIDR_DATA
- PIHOLE_DNS_=127.0.0.1#PORT_INTERNAL_DATA_5 #LIBREPORTAL|PORT_INTERNAL_TAG_5|PORT_INTERNAL_DATA_5
- DNSSEC="true"
- DNSMASQ_LISTENING=single
- FTLCONF_webserver_api_password=PIHOLE_ADMIN_PASSWORD_DATA #LIBREPORTAL|PIHOLE_ADMIN_PASSWORD_TAG|PIHOLE_ADMIN_PASSWORD_DATA
- FTLCONF_webserver_interface_theme=PIHOLE_WEB_THEME_DATA #LIBREPORTAL|PIHOLE_WEB_THEME_TAG|PIHOLE_WEB_THEME_DATA
# Upstream resolver. The old image bundled unbound and pointed here at
# 127.0.0.1#5335; the official image bundles nothing, so this must be a
# real resolver. Set it to the unbound app's address for full recursion
# (no third party sees your queries) — see PIHOLE_UPSTREAM_DNS in the config.
- FTLCONF_dns_upstreams=PIHOLE_UPSTREAM_DNS_DATA #LIBREPORTAL|PIHOLE_UPSTREAM_DNS_TAG|PIHOLE_UPSTREAM_DNS_DATA
- FTLCONF_dns_dnssec=true
# ALL, not single: in a bridge network the queries arrive from the docker
# gateway rather than the container's own interface, and "single" drops them.
- FTLCONF_dns_listeningMode=ALL
# One combined value in v6: <enabled>,<cidr>,<target>,<domain>
- FTLCONF_dns_revServers=true,PIHOLE_REV_SERVER_CIDR_DATA,PIHOLE_REV_SERVER_TARGET_DATA,local #LIBREPORTAL|PIHOLE_REV_SERVER_CIDR_TAG|PIHOLE_REV_SERVER_CIDR_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_TARGET_TAG|PIHOLE_REV_SERVER_TARGET_DATA
healthcheck:
disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
volumes:
- SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
- "./pihole-dnsmasq-unbound:/etc/pihole:rw"
- "./pihole-unbound:/etc/dnsmasq:rw"
# v6 keeps everything (config, databases, gravity) under /etc/pihole. The
# old /etc/dnsmasq mount belonged to the bundled-unbound image and is no
# longer read — v6 ignores /etc/dnsmasq.d unless explicitly re-enabled.
- "./etc-pihole:/etc/pihole:rw"
# GLUETUN_OFF_BEGIN
networks:
DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA

3
containers/pihole/pihole.config
View File

@ -29,6 +29,7 @@ CFG_PIHOLE_MONITORING=false
#
CFG_PIHOLE_ADMIN_PASSWORD=RANDOMIZEDPASSWORD1
CFG_PIHOLE_WEB_THEME=default-dark
CFG_PIHOLE_UPSTREAM_DNS=9.9.9.9;149.112.112.112
#
# =============================================================================
# METADATA
@ -75,5 +76,5 @@ CFG_PIHOLE_PORT_1="pihole-service|webui|random:80|private|tcp|false|false|true|A
CFG_PIHOLE_PORT_2="pihole-service|dns-tcp|53:53|private|tcp|false|false|false|DNS Server (TCP)|"
CFG_PIHOLE_PORT_3="pihole-service|dns-udp|53:53|private|udp|false|false|false|DNS Server (UDP)|"
CFG_PIHOLE_PORT_4="pihole-service|https|random:443|disabled|tcp|false|false|false|HTTPS Interface|"
CFG_PIHOLE_PORT_5="pihole-service|unbound|random:5335|private|tcp|false|false|false|Unbound DNS Access|"
CFG_PIHOLE_PORT_5="pihole-service|dhcp|67:67|disabled|udp|false|false|false|DHCP Server (enable to let Pi-hole hand out leases)|"
CFG_PIHOLE_PORT_6="pihole-exporter|metrics|9617:9617|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|"