Pihole + Unbound Docker Compose file

Submitted ⁨⁨2⁩ ⁨months⁩ ago⁩ by ⁨Octavusss@lemm.ee⁩ to ⁨selfhosted@lemmy.world⁩

Hi friends.

I’ve been trying to find docker-compose.yaml for pihole+unbound so I can use pihole as both a recursive dns server and as local dns alongside Nginx Proxy Manager. But since v6 of pihole all the old files I could find don’t work properly or at all.

Does anyone here use pihole+unbound in docker?

source

Comments

Sort:hotnew top

chris@lemmy.grey.fail ⁨2⁩ ⁨months⁩ ago

services:

  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    hostname: sheldon
    environment:
      HOST_CONTAINERNAME: pihole
      TZ: ${TZ}
      WEBPASSWORD: ${WEBPASSWORD}
      DNSMASQ_LISTENING: "all"
      PIHOLE_DNS_1: "unbound#53"
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp" # Only required if you are using Pi-hole as your DHCP server
      - "8080:80/tcp"
    # network_mode: host
    dns:
      - 127.0.0.1
    networks:
      dns:
        ipv4_address: 172.22.0.2
    volumes:
      - /mnt/appdata/pihole/etc-pihole:/etc/pihole
      - /mnt/appdata/pihole/etc-dnsmasq.d:/etc/dnsmasq.d
    restart: unless-stopped
    depends_on:
      unbound:
        condition: service_healthy

  unbound:
    container_name: unbound
    image: klutchell/unbound:latest
    networks:
      dns:
        ipv4_address: 172.22.0.3
    volumes:
      - /mnt/appdata/unbound:/opt/unbound/etc/unbound/custom
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "dig", "google.com", "@127.0.0.1"]
      interval: 10s
      timeout: 5s
      retries: 5

  wg-easy:
    container_name: wg-easy
    image: ghcr.io/wg-easy/wg-easy:15
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    # environment:
    #   TZ: ${TZ}
    #   LANG: en
    #   WG_HOST: ${WG_HOST}
    #   PASSWORD_HASH: ${PASSWORD_HASH}
    #   WG_DEFAULT_DNS: 172.22.0.2
    #   WG_MTU: 1420
    networks:
      dns:
        ipv4_address: 172.22.0.4
    volumes:
      - /mnt/appdata/wg-easy:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1
    restart: unless-stopped

networks:
  dns:
    external: true

Feel free to just delete the wg-easy service.

source

Outwit1294@lemmy.today ⁨2⁩ ⁨months⁩ ago
You seem knowledgeable. I have a question about this. I have ran this type of setup before. Every time, I ended up ditching unbound because it throws DNSSEC error. I have tried troubleshooting but it doesn’t work.

source
- Zanathos@lemmy.world ⁨2⁩ ⁨months⁩ ago
  I just went through my setup to verify dnssec settings in unbound to troubleshoot strange latency when removing random names while browsing. Did you verify the unbound certificate file was created and had the proper permissions? There are also a couple other configuration items in unbound related to dnssec that can be tweaked to improve the implementation.
  
  source
  - -> View More Comments
- chris@lemmy.grey.fail ⁨2⁩ ⁨months⁩ ago
  Is your ISP interfering?
  
  source
  - -> View More Comments
irmadlad@lemmy.world ⁨2⁩ ⁨months⁩ ago
How well does that run in docker? I’ve always liked docker, but it seems to me that certain apps should touch metal than be containerized. Maybe I’m too old school.

source
- chris@lemmy.grey.fail ⁨2⁩ ⁨months⁩ ago
  I love the portability of running this in Docker. I rsync a backup of this and the Appdata folder every night. When or if this server fails, I can be up and running again in minutes on another machine.
  
  source
  - -> View More Comments
- B0rax@feddit.org ⁨2⁩ ⁨months⁩ ago
  I have all these services in docker as well (although not with the docker compose file here) and they run perfectly fine with a very low resource footprint.
  
  source
  - -> View More Comments
- Appoxo@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago
  Focker container in host mode is sufficient for most cases requiring bare deployment.
  
  source
  - -> View More Comments
Octavusss@lemm.ee ⁨2⁩ ⁨months⁩ ago
Thank you very much.

source
- chris@lemmy.grey.fail ⁨2⁩ ⁨months⁩ ago
  How’d it work out?
  
  source
  - -> View More Comments

thagoat@lemmy.sdf.org ⁨2⁩ ⁨months⁩ ago
github.com/IAmStoxe/wirehole

source
- Vanilla_PuddinFudge@infosec.pub ⁨2⁩ ⁨months⁩ ago
  
  3 years ago
  
  2 years ago
  
  uh, nah
  
  source
  - thagoat@lemmy.sdf.org ⁨2⁩ ⁨months⁩ ago
    That’s when the compose file was written. The docker images named in the file are updated constantly. Fear not ad-block seeker!
    
    source
    -> View More Comments
slackarr@piefed.ca ⁨2⁩ ⁨months⁩ ago
I used to use a pihole+unbound single container docker image but technitium is just easier for me. Might be worth exploring other options like adguard home also.

source
numblyscabbyeach@lemmy.zip ⁨2⁩ ⁨months⁩ ago
community-scripts.github.io/ProxmoxVE/scripts?id=…

source