From ab811440e43174e5d567af0864c50351dc4455b5 Mon Sep 17 00:00:00 2001 From: librelad Date: Tue, 18 Aug 2026 02:30:13 +0100 Subject: [PATCH] fix(pihole): use the official image, ported to Pi-hole v6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The app shipped cbcrowe/pihole-unbound — a third-party bundle last rebuilt 841 days ago. Pi-hole itself is fine: the official pihole/pihole was rebuilt 42 days ago. We packaged an abandoned fork, not a dead project. Not a tag swap. The official image is v6, which replaced nearly every v5 environment variable with an FTLCONF_ equivalent — and the container ACCEPTS the old names and ignores them, so a v5-style block looks correct while configuring nothing, including the admin password: WEBPASSWORD -> FTLCONF_webserver_api_password WEBTHEME -> FTLCONF_webserver_interface_theme PIHOLE_DNS_ -> FTLCONF_dns_upstreams (";" separates values) DNSSEC -> FTLCONF_dns_dnssec DNSMASQ_LISTENING -> FTLCONF_dns_listeningMode REV_SERVER{,_TARGET,_DOMAIN,_CIDR} -> FTLCONF_dns_revServers, one combined ",,," FTLCONF_LOCAL_IPV4 -> gone in v6 listeningMode is ALL rather than the old "single": on a bridge network queries arrive via the docker gateway, and "single" drops them. The bundled unbound is gone, so PIHOLE_DNS_=127.0.0.1#5335 pointed at nothing. New CFG_PIHOLE_UPSTREAM_DNS defaults to Quad9, with the config documenting how to point it at the unbound app for full recursion. The freed port slot becomes the (disabled) DHCP port, which v6 supports. Volumes: v6 keeps config, databases and gravity under /etc/pihole, and ignores /etc/dnsmasq.d unless explicitly re-enabled — so the old two-mount layout is replaced by a single ./etc-pihole. Variable names taken from the official v5->v6 upgrade doc, not memory. Substitution verified end to end: every placeholder resolves and revServers renders in the documented format. Co-Authored-By: Claude Opus 5 --- containers/pihole/docker-compose.yml | 35 +++++++++++++++++----------- containers/pihole/pihole.config | 3 ++- 2 files changed, 24 insertions(+), 14 deletions(-) diff --git a/containers/pihole/docker-compose.yml b/containers/pihole/docker-compose.yml index 2cd4586..6e725c5 100755 --- a/containers/pihole/docker-compose.yml +++ b/containers/pihole/docker-compose.yml @@ -5,7 +5,7 @@ networks: services: pihole-service: #LIBREPORTAL|SERVICE_TAG_1|pihole-service container_name: pihole-service - image: cbcrowe/pihole-unbound:latest #LIBREPORTAL|PIHOLE_VERSION_TAG|latest + image: pihole/pihole:latest #LIBREPORTAL|PIHOLE_VERSION_TAG|latest restart: unless-stopped hostname: pihole # GLUETUN_OFF_BEGIN @@ -28,24 +28,33 @@ services: traefik.http.services.pihole-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1 traefik.http.routers.pihole-service.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1 # TRAEFIK_PORT_1_END + # Pi-hole v6 replaced almost every v5 variable with an FTLCONF_ equivalent + # matching its new TOML config. The old names are accepted by the container + # and then ignored, so a v5-style block looks fine and silently configures + # nothing — including the admin password. environment: - - FTLCONF_LOCAL_IPV4=PUBLIC_IP_DATA #LIBREPORTAL|PUBLIC_IP_TAG|PUBLIC_IP_DATA - TZ=TIMEZONE_DATA #LIBREPORTAL|TIMEZONE_TAG|TIMEZONE_DATA - - WEBPASSWORD=PIHOLE_ADMIN_PASSWORD_DATA #LIBREPORTAL|PIHOLE_ADMIN_PASSWORD_TAG|PIHOLE_ADMIN_PASSWORD_DATA - - WEBTHEME=PIHOLE_WEB_THEME_DATA #LIBREPORTAL|PIHOLE_WEB_THEME_TAG|PIHOLE_WEB_THEME_DATA - - REV_SERVER=true - - REV_SERVER_TARGET=PIHOLE_REV_SERVER_TARGET_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_TARGET_TAG|PIHOLE_REV_SERVER_TARGET_DATA - - REV_SERVER_DOMAIN=local - - REV_SERVER_CIDR=PIHOLE_REV_SERVER_CIDR_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_CIDR_TAG|PIHOLE_REV_SERVER_CIDR_DATA - - PIHOLE_DNS_=127.0.0.1#PORT_INTERNAL_DATA_5 #LIBREPORTAL|PORT_INTERNAL_TAG_5|PORT_INTERNAL_DATA_5 - - DNSSEC="true" - - DNSMASQ_LISTENING=single + - FTLCONF_webserver_api_password=PIHOLE_ADMIN_PASSWORD_DATA #LIBREPORTAL|PIHOLE_ADMIN_PASSWORD_TAG|PIHOLE_ADMIN_PASSWORD_DATA + - FTLCONF_webserver_interface_theme=PIHOLE_WEB_THEME_DATA #LIBREPORTAL|PIHOLE_WEB_THEME_TAG|PIHOLE_WEB_THEME_DATA + # Upstream resolver. The old image bundled unbound and pointed here at + # 127.0.0.1#5335; the official image bundles nothing, so this must be a + # real resolver. Set it to the unbound app's address for full recursion + # (no third party sees your queries) — see PIHOLE_UPSTREAM_DNS in the config. + - FTLCONF_dns_upstreams=PIHOLE_UPSTREAM_DNS_DATA #LIBREPORTAL|PIHOLE_UPSTREAM_DNS_TAG|PIHOLE_UPSTREAM_DNS_DATA + - FTLCONF_dns_dnssec=true + # ALL, not single: in a bridge network the queries arrive from the docker + # gateway rather than the container's own interface, and "single" drops them. + - FTLCONF_dns_listeningMode=ALL + # One combined value in v6: ,,, + - FTLCONF_dns_revServers=true,PIHOLE_REV_SERVER_CIDR_DATA,PIHOLE_REV_SERVER_TARGET_DATA,local #LIBREPORTAL|PIHOLE_REV_SERVER_CIDR_TAG|PIHOLE_REV_SERVER_CIDR_DATA #LIBREPORTAL|PIHOLE_REV_SERVER_TARGET_TAG|PIHOLE_REV_SERVER_TARGET_DATA healthcheck: disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA volumes: - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA - - "./pihole-dnsmasq-unbound:/etc/pihole:rw" - - "./pihole-unbound:/etc/dnsmasq:rw" + # v6 keeps everything (config, databases, gravity) under /etc/pihole. The + # old /etc/dnsmasq mount belonged to the bundled-unbound image and is no + # longer read — v6 ignores /etc/dnsmasq.d unless explicitly re-enabled. + - "./etc-pihole:/etc/pihole:rw" # GLUETUN_OFF_BEGIN networks: DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA diff --git a/containers/pihole/pihole.config b/containers/pihole/pihole.config index 62bf8f0..092e569 100755 --- a/containers/pihole/pihole.config +++ b/containers/pihole/pihole.config @@ -29,6 +29,7 @@ CFG_PIHOLE_MONITORING=false # CFG_PIHOLE_ADMIN_PASSWORD=RANDOMIZEDPASSWORD1 CFG_PIHOLE_WEB_THEME=default-dark +CFG_PIHOLE_UPSTREAM_DNS=9.9.9.9;149.112.112.112 # # ============================================================================= # METADATA @@ -75,5 +76,5 @@ CFG_PIHOLE_PORT_1="pihole-service|webui|random:80|private|tcp|false|false|true|A CFG_PIHOLE_PORT_2="pihole-service|dns-tcp|53:53|private|tcp|false|false|false|DNS Server (TCP)|" CFG_PIHOLE_PORT_3="pihole-service|dns-udp|53:53|private|udp|false|false|false|DNS Server (UDP)|" CFG_PIHOLE_PORT_4="pihole-service|https|random:443|disabled|tcp|false|false|false|HTTPS Interface|" -CFG_PIHOLE_PORT_5="pihole-service|unbound|random:5335|private|tcp|false|false|false|Unbound DNS Access|" +CFG_PIHOLE_PORT_5="pihole-service|dhcp|67:67|disabled|udp|false|false|false|DHCP Server (enable to let Pi-hole hand out leases)|" CFG_PIHOLE_PORT_6="pihole-exporter|metrics|9617:9617|disabled|tcp|false|false|false|Metrics Exporter (sidecar, docker-network only)|"