From c7a4dfce1ad0b545b05a8043e321ad49e48873a6 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Wed, 17 Jun 2026 18:37:49 +0200
Subject: Refactor pi roles to use .home.arpa subdomains for services

---
 roles/pihole/defaults/main.yml              |  3 ++-
 roles/pihole/handlers/main.yml              | 12 ++++++++++++
 roles/pihole/meta/argument_specs.yml        | 13 +++++++++----
 roles/pihole/tasks/main.yml                 | 22 +++++++---------------
 roles/pihole/templates/pihole.nginx.conf.j2 | 17 +++++++++++++++++
 roles/pihole/templates/pihole.toml.j2       |  3 +++
 6 files changed, 50 insertions(+), 20 deletions(-)
 create mode 100644 roles/pihole/templates/pihole.nginx.conf.j2

(limited to 'roles/pihole')

diff --git a/roles/pihole/defaults/main.yml b/roles/pihole/defaults/main.yml
index 4e1d0bf7..d980c67c 100644
--- a/roles/pihole/defaults/main.yml
+++ b/roles/pihole/defaults/main.yml
@@ -16,4 +16,5 @@ pihole_dhcp_domain: "local"
 pihole_dhcp_hosts: []
 pihole_domain: ""
 pihole_port: "8081"
-pihole_by_nginx: false
+pihole_hostname: "dns.home.arpa"
+pihole_dns_hosts: []
diff --git a/roles/pihole/handlers/main.yml b/roles/pihole/handlers/main.yml
index 1cad8eff..d839828e 100644
--- a/roles/pihole/handlers/main.yml
+++ b/roles/pihole/handlers/main.yml
@@ -14,3 +14,15 @@
 - name: "Show install output"
   ansible.builtin.debug:
     var: pihole_install.stdout
+
+- name: "Restart pihole-FTL"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "pihole-FTL"
+    state: "restarted"
+
+- name: "Restart nginx"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "nginx"
+    state: "restarted"
diff --git a/roles/pihole/meta/argument_specs.yml b/roles/pihole/meta/argument_specs.yml
index adca47b9..40662436 100644
--- a/roles/pihole/meta/argument_specs.yml
+++ b/roles/pihole/meta/argument_specs.yml
@@ -63,7 +63,12 @@ argument_specs:
         type: "str"
         description: "The port to serve pihole on, when empty use pihole default 80,433"
         default: "8081"
-      pihole_by_nginx:
-        description: "Serve pihole behind nginx reverse proxy"
-        type: "bool"
-        default: false
+      pihole_hostname:
+        type: "str"
+        description: "FQDN for the pihole nginx vhost (e.g. 'dns.home.arpa')."
+        default: "dns.home.arpa"
+      pihole_dns_hosts:
+        type: "list"
+        description: "Custom DNS A records written to pihole.toml [dns] hosts (format: 'IP HOSTNAME')"
+        elements: "str"
+        default: []
diff --git a/roles/pihole/tasks/main.yml b/roles/pihole/tasks/main.yml
index 52ccafcf..66208bdf 100644
--- a/roles/pihole/tasks/main.yml
+++ b/roles/pihole/tasks/main.yml
@@ -149,25 +149,17 @@
   tags:
     - molecule-idempotence-notest
 
-- name: "Create pihole nginx configurations"
+- name: "Create pihole nginx vhost configuration"
   become: true
-  when: pihole_by_nginx is defined and pihole_by_nginx | bool
-  ansible.builtin.copy:
-    content: |
-      location /admin/ {
-        proxy_pass http://127.0.0.1:{{ pihole_port }}/admin/;
-      }
-      location /api/ {
-        proxy_pass http://127.0.0.1:{{ pihole_port }}/api/;
-      }
-    dest: "/etc/nginx/conf.d/pihole.conf"
+  when: pihole_hostname | length > 0
+  ansible.builtin.template:
+    src: "pihole.nginx.conf.j2"
+    dest: "/etc/nginx/vhosts.d/pihole.conf"
     owner: "root"
     group: "root"
     mode: "0644"
     backup: true
-    # workaround issue: https://github.com/ansible/ansible/issues/9112
-    # ref: https://serverfault.com/a/811520
     validate: >
-      bash -c 'echo "events { worker_connections 2; } http { server { include %s; } }" > /tmp/nginx.conf;
-        sudo nginx -T -c /tmp/nginx.conf; ec=$?; rm -f /tmp/nginx.conf; exit $ec'
+      bash -c 'echo "events { worker_connections 64; } http { include %s; }" > /tmp/nginx-vhost.conf;
+        sudo nginx -T -c /tmp/nginx-vhost.conf; ec=$?; rm -f /tmp/nginx-vhost.conf; exit $ec'
   notify: "Restart nginx"
diff --git a/roles/pihole/templates/pihole.nginx.conf.j2 b/roles/pihole/templates/pihole.nginx.conf.j2
new file mode 100644
index 00000000..91f0fea4
--- /dev/null
+++ b/roles/pihole/templates/pihole.nginx.conf.j2
@@ -0,0 +1,17 @@
+server {
+    listen 80;
+    listen [::]:80;
+
+    server_name {{ pihole_hostname }};
+
+    location = / {
+        return 301 /admin/;
+    }
+
+    location /admin/ {
+        proxy_pass http://127.0.0.1:{{ pihole_port }}/admin/;
+    }
+    location /api/ {
+        proxy_pass http://127.0.0.1:{{ pihole_port }}/api/;
+    }
+}
diff --git a/roles/pihole/templates/pihole.toml.j2 b/roles/pihole/templates/pihole.toml.j2
index 13f7ba1f..a755040b 100644
--- a/roles/pihole/templates/pihole.toml.j2
+++ b/roles/pihole/templates/pihole.toml.j2
@@ -37,6 +37,9 @@ interface = "{{ pihole_interface }}"
 #   - "NONE"
 #       Do not add any configuration concerning the listening mode to the dnsmasq config file.
 listeningMode = "LOCAL"
+{% if pihole_dns_hosts | length > 0 %}
+hosts = {{ pihole_dns_hosts | to_json }}
+{% endif %}
 
 [dns.cache]
 size = 10000    # Cache size of the DNS server.
-- 
cgit v1.2.3