From 90f8483dbbfa422eced5076ae13ca3299c256676 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Wed, 1 Jul 2026 12:21:48 +0200
Subject: Update the README for gateway and pihole setup with details about
 ipv6

---
 roles/gateway/README.md | 17 +++++++++++++
 roles/pihole/README.md  | 67 ++++++++++++++++++++++++++++++++++++-------------
 2 files changed, 67 insertions(+), 17 deletions(-)

diff --git a/roles/gateway/README.md b/roles/gateway/README.md
index ee6488c4..cfbe49d3 100644
--- a/roles/gateway/README.md
+++ b/roles/gateway/README.md
@@ -17,6 +17,23 @@ gateway_local_ipv4_subnet: "192.168.1.0/24"
 gateway_router_interface: "end0"
 ```
 
+### IPv6 Support (Optional)
+
+IPv6 gateway is enabled by setting both `network_ipv6_address` and `gateway_local_ipv6_subnet`:
+
+```yaml
+network_ipv6_address: "2a02:xxxx:xxxx:xxxx::254/64"   # Pi's IPv6 address
+gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet
+```
+
+To disable IPv6 entirely, remove both variables from `host_vars`. The role will:
+- Omit `accept_ra` sysctl (no IPv6 interface key written)
+- Skip IPv6 iptables masquerade rules (`gateway_local_ipv6_subnet` defaults to `""`)
+- Leave `net.ipv6.conf.all.forwarding=0`
+
+**Note:** `accept_ra` is set per-interface (`gateway_router_interface`) only when IPv6 is enabled.
+This prevents rogue RA acceptance on WireGuard and LAN interfaces.
+
 ## Network Architecture
 
 ```txt
diff --git a/roles/pihole/README.md b/roles/pihole/README.md
index 7cc8033d..319424a7 100644
--- a/roles/pihole/README.md
+++ b/roles/pihole/README.md
@@ -16,20 +16,53 @@ This role configure the [pihole](https://github.com/pi-hole/pi-hole) DNS Sinkhol
 
 ### [FRITZ!Box](https://docs.pi-hole.net/routers/fritzbox/)
 
-Update the following
-
-- Home Network > Network > Network Settings > Change Advanced Network Settings >
-  - IPv4 > DHCP > Enable DHCP server > Disabled
-  - IPv6 > DNSv6 Server in the Home Network > Router advertisement enable in the LAN > Disabled
-  - IPv6 > DNSv6 Server in the Home Network > Disable DHCPv6 server in the FRITZ!Box >
-    - There are no other DHCPv6 servers in the home network.
-- Internet > Filter > Lists > Network Applications > Add Network Application >
-  - Name: DNS, Protocol: UDP, Source Port: Any, Destination Port: 53
-  - Name: DNS, Protocol: TCP, Source Port: Any, Destination Port: 53
-- Internet > Prioritization > Real-Time Applications > Create New Rule
-  - Device: {{ pihole_device_name }}, Application: DNS
-- Internet > Account Information > IPv6 > IPv6 Support > Disabled
-- Internet > Account Information > DNS Server > DNSv4 Server >
-  - Use Other DNSv4 Servers > {{ pihole_ipv4 }}
-- Internet > Filter > Unrestricted > Add Device > {{ pihole_device_name }}
-- Internet > Filter > Standard > Restrictions > Filters > Add Exception > DNS
+- Home Network > Network > Network Settings > Change Advanced Network Settings > IPv4 >
+  - Home network > 
+    - IPv4 address > {{ router_ipv4 }}
+    - Subnet mask > {{ router_subnet_mask }}
+  - DHCP > Enable DHCP server > ❌
+
+- Internet > Filter >
+  - Lists > Network Applications > Add Network Application >
+    - Name: DNS, Protocol: UDP, Source Port: Any, Destination Port: 53
+    - Name: DNS, Protocol: TCP, Source Port: Any, Destination Port: 53
+
+  - Prioritization > Real-Time Applications > Create New Rule
+    - Device: {{ pihole_device_name }}, Application: DNS
+
+  - Parental Controls > Unrestricted > Add Device > {{ pihole_device_name }}
+  - Parental Controls > Standard > Edit > Filters >
+    - Filter for network applications > all network applications are permitted
+    - Add Exceptions > DNS
+
+- Internet > Account Information > DNS Server > DNSv4 Server > Use Other DNSv4 Servers > {{ pihole_ipv4 }}
+
+#### No IPv6 Support
+
+- Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 >
+  - Router advertisement enable in the LAN > ❌
+  - DNSv6 Server in the Home Network > Also announce DNSv6 server via router advertisement (RFC5006) > ❌
+
+- Internet > Account Information > IPv6 > IPv6 Support > ❌
+
+#### With IPv6 Support
+
+- Home Network > Network > Network Settings > Change Advanced Network Settings > IPv6 >
+  - Router advertisement enable in the LAN > ✅
+    - Always assign unique local addresses (ULA) > ❌
+    - Allow IPv6 prefixes announced by other IPv6 routers in the home network > ❌
+    - This FRITZ!Box provides the standard internet connection > ✅
+    - Set the priority of the router advertisement > High
+  - DNSv6 Server in the Home Network >
+    - Also announce DNSv6 server via router advertisement (RFC5006) > ✅
+    - Local DNSv6 server > {{ pihole_ipv6 }}
+  - DHCPv6 Server in the home network >
+    - Enable DHCPv6 server in the FRITZ!Box for the home network > ✅
+      - Only assign DNS server > ✅
+
+- Internet > Account Information >
+  - IPv6 > IPv6 Support > ✅
+  - IPv6 > IPv6 Connectivity > Native IPv6 connection
+  - IPv6 > Connection Settings > Automatically negotiate a global address
+  - IPv6 > Connection Settings > Use DHCPv6 Rapid Commit > ✅
+  - DNS Server > DNSv6 Server > Use Other DNSv6 Servers > {{ pihole_ipv6 }}
-- 
cgit v1.2.3