From c10b52fb07dd4c92e827b64bf3ac673c69d9d14f Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Sat, 13 Sep 2025 22:14:29 +0200
Subject: Add pihole port configurations and integration with nginx

---
 roles/pihole/defaults/main.yml        |  2 ++
 roles/pihole/meta/argument_specs.yml  |  8 ++++++++
 roles/pihole/tasks/main.yml           | 23 +++++++++++++++++++++++
 roles/pihole/templates/pihole.toml.j2 | 10 ++++++++++
 4 files changed, 43 insertions(+)

(limited to 'roles/pihole')

diff --git a/roles/pihole/defaults/main.yml b/roles/pihole/defaults/main.yml
index d3f8b09c..f5a5047c 100644
--- a/roles/pihole/defaults/main.yml
+++ b/roles/pihole/defaults/main.yml
@@ -18,3 +18,5 @@ pihole_dhcp_lease_time: ""
 pihole_dhcp_domain: "local"
 pihole_dhcp_hosts: []
 pihole_domain: ""
+pihole_port: "8081"
+pihole_by_nginx: false
diff --git a/roles/pihole/meta/argument_specs.yml b/roles/pihole/meta/argument_specs.yml
index 5ed8d528..e6ba264e 100644
--- a/roles/pihole/meta/argument_specs.yml
+++ b/roles/pihole/meta/argument_specs.yml
@@ -64,3 +64,11 @@ argument_specs:
         type: "str"
         description: "The domain name to be configured when the pi is exposed over the internet"
         default: ""
+      pihole_port:
+        type: "str"
+        description: "The port to serve pihole on, when empty use pihole default 80,433"
+        default: "8081"
+      pihole_by_nginx:
+        description: "Serve pihole behind nginx reverse proxy"
+        type: "bool"
+        default: false
diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml
index e0df5c2b..916200d6 100644
--- a/roles/pihole/tasks/main.yml
+++ b/roles/pihole/tasks/main.yml
@@ -106,3 +106,26 @@
         dest: "/etc/resolv.conf"
         state: "link"
         force: true
+
+- name: "Create pihole nginx configurations"
+  become: true
+  when: pihole_by_nginx is defined and pihole_by_nginx != ""
+  ansible.builtin.copy:
+    content: |
+      location /admin/ {
+        proxy_pass http://127.0.0.1:{{ pihole_port }}/admin/;
+      }
+      location /api/ {
+        proxy_pass http://127.0.0.1:{{ pihole_port }}/api/;
+      }
+    dest: "/etc/nginx/conf.d/pihole.conf"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+    backup: true
+    # workaround issue: https://github.com/ansible/ansible/issues/9112
+    # ref: https://serverfault.com/a/811520
+    validate: >
+      bash -c 'echo "events { worker_connections 2; } http { server { include %s; } }" > /tmp/nginx.conf;
+        sudo nginx -T -c /tmp/nginx.conf; ec=$?; rm -f /tmp/nginx.conf; exit $ec'
+  notify: "Restart nginx"
diff --git a/roles/pihole/templates/pihole.toml.j2 b/roles/pihole/templates/pihole.toml.j2
index 23c02b7c..13f7ba1f 100644
--- a/roles/pihole/templates/pihole.toml.j2
+++ b/roles/pihole/templates/pihole.toml.j2
@@ -61,8 +61,18 @@ hosts = {{ pihole_dhcp_hosts | to_nice_json }}
 domain = {{ pihole_domain }}
 {% endif %}
 
+{% if (pihole_port is defined) and (pihole_port != '')  %}
+port = "{{ pihole_port }}"
+[webserver.tls]
+cert = ""
+{% else %}
+port = "80,443s"
 [webserver.tls]
 cert = "/etc/pihole/tls.pem"
+{% endif %}
+
+[webserver.paths]
+webhome = "/admin/"
 
 [webserver.api]
 pwhash = "{{ pihole_password }}"    # valid double hashed string
-- 
cgit v1.2.3