blob: 7e0e7697b640fe0cb6b729b251056b8099ac16cd (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
---
- name: "Validate network_ipv*_dns params"
ansible.builtin.fail:
msg: "Pihole role cannot work when network_ipv4_dns or network_ipv6_dns are defined"
when: network_ipv4_dns is defined or network_ipv6_dns is defined
- name: "Crete Pi-hole user"
ansible.builtin.user:
name: "pihole"
system: true
shell: "/usr/sbin/nologin"
- name: "Create Pi-hole directories"
ansible.builtin.file:
path: "{{ item }}"
state: "directory"
owner: "pihole"
group: "pihole"
mode: "0755"
loop:
- "/etc/pihole"
- "/var/log/pihole"
- name: "Create Pi-hole configuration file"
ansible.builtin.template:
src: "pihole.toml.j2"
dest: "/etc/pihole/pihole.toml"
owner: "pihole"
group: "pihole"
mode: "0644"
notify: "Restart pihole"
# pihole.toml is being rewritten after successful setup
# This is why this task is not idempotent and can't be.
tags:
- molecule-idempotence-notest
- name: "Download Pi-hole installer"
ansible.builtin.get_url:
url: "https://install.pi-hole.net"
dest: "/tmp/install_pihole.sh"
mode: "0755"
- name: "Run Pi-hole installer"
ansible.builtin.command:
cmd: "/tmp/install_pihole.sh --unattended"
register: pihole_install
environment:
PIHOLE_SKIP_OS_CHECK: "true"
args:
creates: "/usr/local/bin/pihole"
- name: "Show install output"
ansible.builtin.debug:
var: pihole_install.stdout
- name: "Ensure Pi-hole started/enabled"
ansible.builtin.systemd_service:
name: "pihole-FTL"
enabled: true
state: "started"
daemon_reload: true
- name: "Update Pi-hole blocklists"
ansible.builtin.command:
cmd: "pihole -g"
changed_when: false
- name: "Configure pihole as system DNS"
tags:
# linking the systemd run files fails in molecule tests
# This is not relevant to the testing itself, so it's safe to ignore
# The other tasks override the network role configurations, this is
# by design, and intentional, which conflicts with molecule-idempotent test
# therefore it's safe and better to disable testing for these tasks
# as these tasks also can't be tested without inspecting pihole logs to
# verify that the DNS blocking is happening correctly
- molecule-notest
notify:
- "Restart NetworkManager"
- "Restart systemd-resolved"
block:
- name: "Configure NetworkManager to disable DNS management"
ansible.builtin.copy:
dest: "/etc/NetworkManager/NetworkManager.conf"
owner: "root"
group: "root"
mode: "0644"
content: |
[main]
dns=none
- name: "Configure systemd-resolved for Pi-hole"
ansible.builtin.copy:
dest: "/etc/systemd/resolved.conf"
owner: "root"
group: "root"
mode: "0644"
content: |
[Resolve]
DNS=127.0.0.1#53
DNSStubListener=no
- name: "Configure system DNS"
ansible.builtin.file:
src: "/run/systemd/resolve/resolv.conf"
dest: "/etc/resolv.conf"
state: "link"
force: true
- name: "Create pihole nginx configurations"
become: true
when: pihole_by_nginx is defined and pihole_by_nginx != ""
ansible.builtin.copy:
content: |
location /admin/ {
proxy_pass http://127.0.0.1:{{ pihole_port }}/admin/;
}
location /api/ {
proxy_pass http://127.0.0.1:{{ pihole_port }}/api/;
}
dest: "/etc/nginx/conf.d/pihole.conf"
owner: "root"
group: "root"
mode: "0644"
backup: true
# workaround issue: https://github.com/ansible/ansible/issues/9112
# ref: https://serverfault.com/a/811520
validate: >
bash -c 'echo "events { worker_connections 2; } http { server { include %s; } }" > /tmp/nginx.conf;
sudo nginx -T -c /tmp/nginx.conf; ec=$?; rm -f /tmp/nginx.conf; exit $ec'
notify: "Restart nginx"
|
