2023-11-13 09:33:28 -05:00
|
|
|
{#
|
2023-11-13 13:18:06 -05:00
|
|
|
SPDX-FileCopyrightText: 2022 - 2023 unman <unman@thirdeyesecurity.org>
|
2024-01-29 10:49:54 -05:00
|
|
|
SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
2023-11-13 09:33:28 -05:00
|
|
|
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
#}
|
|
|
|
|
|
|
|
{% if grains['nodename'] != 'dom0' %}
|
|
|
|
|
2024-04-12 12:13:55 -04:00
|
|
|
{% set pihole_tag = 'v5.18.2' -%}
|
2023-11-13 09:33:28 -05:00
|
|
|
|
|
|
|
include:
|
2024-03-18 11:29:01 -04:00
|
|
|
- utils.tools.common.update
|
2024-03-14 11:53:23 -04:00
|
|
|
- sys-cacher.uninstall-client
|
2024-06-13 12:01:08 -04:00
|
|
|
- sys-net.install-proxy
|
2023-11-13 09:33:28 -05:00
|
|
|
- dotfiles.copy-x11
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-installed":
|
|
|
|
pkg.installed:
|
2024-03-18 11:29:01 -04:00
|
|
|
- require:
|
|
|
|
- sls: utils.tools.common.update
|
2023-11-13 09:33:28 -05:00
|
|
|
- install_recommends: False
|
|
|
|
- skip_suggestions: True
|
|
|
|
- pkgs:
|
2024-05-10 21:31:49 -04:00
|
|
|
- fwupd-qubes-vm
|
2023-11-13 09:33:28 -05:00
|
|
|
- qubes-core-agent-passwordless-root
|
|
|
|
- qubes-core-agent-dom0-updates
|
|
|
|
- qubes-core-agent-networking
|
2023-12-23 15:05:24 -05:00
|
|
|
- systemd-timesyncd
|
2023-11-13 09:33:28 -05:00
|
|
|
- ca-certificates
|
|
|
|
- curl
|
|
|
|
- dnsutils
|
|
|
|
- git
|
|
|
|
- idn2
|
|
|
|
- lighttpd
|
|
|
|
- netcat-openbsd
|
|
|
|
- php-cgi
|
|
|
|
- php-common
|
|
|
|
- php-intl
|
|
|
|
- php-json
|
|
|
|
- php-sqlite3
|
|
|
|
- php-xml
|
|
|
|
- unzip
|
2023-12-26 13:46:35 -05:00
|
|
|
- bash-completion
|
2024-05-28 05:00:04 -04:00
|
|
|
- man-db
|
2023-11-13 09:33:28 -05:00
|
|
|
|
|
|
|
"{{ slsdotpath }}-disable-external-admin-interface":
|
|
|
|
file.managed:
|
|
|
|
- name: /etc/lighttpd/conf-available/50-pihole.conf
|
2023-12-19 15:55:45 -05:00
|
|
|
- source: salt://{{ slsdotpath }}/files/server/lighttpd/50-pihole.conf
|
2023-11-13 09:33:28 -05:00
|
|
|
- mode: '0644'
|
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- makedirs: True
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-disable-external-admin-interface-symlink":
|
|
|
|
file.symlink:
|
2023-12-24 15:23:29 -05:00
|
|
|
- require:
|
|
|
|
- file: "{{ slsdotpath }}-disable-external-admin-interface"
|
|
|
|
- name: /etc/lighttpd/conf-enabled/50-pihole.conf
|
|
|
|
- target: /etc/lighttpd/conf-available/50-pihole.conf
|
2023-11-13 09:33:28 -05:00
|
|
|
- force: True
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-disable-systemd-resolved":
|
|
|
|
service.disabled:
|
|
|
|
- name: systemd-resolved
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-setupVars.conf":
|
|
|
|
file.managed:
|
|
|
|
- name: /etc/pihole/setupVars.conf
|
2023-12-23 15:05:24 -05:00
|
|
|
- source: salt://{{ slsdotpath }}/files/server/pihole/setupVars.conf
|
2024-01-05 10:32:42 -05:00
|
|
|
- mode: '0644'
|
2023-11-13 09:33:28 -05:00
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- makedirs: True
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-git-clone":
|
|
|
|
git.latest:
|
|
|
|
- name: https://github.com/pi-hole/pi-hole.git
|
2024-03-14 11:53:23 -04:00
|
|
|
- rev: {{ pihole_tag }}
|
2023-11-13 09:33:28 -05:00
|
|
|
- user: root
|
|
|
|
- target: /root/pi-hole
|
|
|
|
- force_fetch: True
|
|
|
|
|
2024-01-03 12:07:49 -05:00
|
|
|
"{{ slsdotpath }}-gnupg-home":
|
2023-11-13 09:33:28 -05:00
|
|
|
file.directory:
|
|
|
|
- name: /root/.gnupg/pihole
|
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- mode: '0700'
|
|
|
|
- makedirs: True
|
|
|
|
|
2024-01-03 12:07:49 -05:00
|
|
|
"{{ slsdotpath }}-save-keys":
|
|
|
|
file.recurse:
|
|
|
|
- require:
|
|
|
|
- file: "{{ slsdotpath }}-gnupg-home"
|
|
|
|
- name: /root/.gnupg/pihole/download/
|
|
|
|
- source: salt://{{ slsdotpath }}/files/server/keys/
|
|
|
|
- user: user
|
|
|
|
- group: user
|
|
|
|
- file_mode: '0600'
|
|
|
|
- dir_mode: '0700'
|
|
|
|
- makedirs: True
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-import-keys":
|
|
|
|
cmd.run:
|
|
|
|
- require:
|
|
|
|
- file: "{{ slsdotpath }}-save-keys"
|
|
|
|
- name: gpg --status-fd=2 --homedir . --import download/*.asc
|
|
|
|
- cwd: /root/.gnupg/pihole
|
|
|
|
- runas: root
|
|
|
|
- success_stderr: IMPORT_OK
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-import-ownertrust":
|
|
|
|
cmd.run:
|
|
|
|
- require:
|
|
|
|
- cmd: "{{ slsdotpath }}-import-keys"
|
|
|
|
- name: gpg --homedir . --import-ownertrust download/otrust.txt
|
|
|
|
- cwd: /root/.gnupg/pihole
|
|
|
|
- runas: root
|
2023-11-13 09:33:28 -05:00
|
|
|
|
|
|
|
## The tag is annotated, using verify-commit instead.
|
|
|
|
"{{ slsdotpath }}-git-verify-tag-pihole":
|
|
|
|
cmd.run:
|
|
|
|
- require:
|
|
|
|
- git: "{{ slsdotpath }}-git-clone"
|
|
|
|
- name: GNUPGHOME="$HOME/.gnupg/pihole" git verify-commit {{ pihole_tag }}
|
|
|
|
- cwd: /root/pi-hole
|
|
|
|
- runas: root
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-git-checkout-tag-{{ pihole_tag }}":
|
|
|
|
cmd.run:
|
|
|
|
- name: git checkout {{ pihole_tag }}
|
|
|
|
- require:
|
|
|
|
- cmd: "{{ slsdotpath }}-git-verify-tag-pihole"
|
|
|
|
- cwd: /root/pi-hole
|
|
|
|
- runas: root
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-setup":
|
|
|
|
cmd.run:
|
|
|
|
- name: ./basic-install.sh --unattended
|
|
|
|
- require:
|
|
|
|
- cmd: "{{ slsdotpath }}-git-checkout-tag-{{ pihole_tag }}"
|
|
|
|
- cwd: '/root/pi-hole/automated install'
|
|
|
|
- runas: root
|
|
|
|
|
2023-12-26 13:46:35 -05:00
|
|
|
"{{ slsdotpath }}-firewall":
|
2023-11-13 09:33:28 -05:00
|
|
|
file.managed:
|
2023-12-26 13:46:35 -05:00
|
|
|
- name: /rw/config/qubes-firewall.d/50-sys-pihole
|
|
|
|
- source: salt://{{ slsdotpath }}/files/server/qubes-firewall.d/50-sys-pihole
|
2023-12-19 15:55:45 -05:00
|
|
|
- mode: '0755'
|
2023-11-13 09:33:28 -05:00
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- makedirs: True
|
|
|
|
|
2023-12-26 13:46:35 -05:00
|
|
|
"{{ slsdotpath }}-network-hooks":
|
2023-11-13 09:33:28 -05:00
|
|
|
file.managed:
|
2023-12-26 13:46:35 -05:00
|
|
|
- name: /rw/config/network-hooks.d/50-sys-pihole.sh
|
|
|
|
- source: salt://{{ slsdotpath }}/files/server/network-hooks.d/50-sys-pihole.sh
|
2023-12-19 15:55:45 -05:00
|
|
|
- mode: '0755'
|
2023-11-13 09:33:28 -05:00
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- makedirs: True
|
2023-12-19 15:55:45 -05:00
|
|
|
|
2023-12-26 13:46:35 -05:00
|
|
|
"{{ slsdotpath }}-dnsmasq":
|
2023-11-13 09:33:28 -05:00
|
|
|
file.managed:
|
2023-12-26 13:46:35 -05:00
|
|
|
- name: /etc/dnsmasq.d/00-pihole.conf
|
|
|
|
- source: salt://{{ slsdotpath }}/files/server/dnsmasq.d/00-pihole.conf
|
|
|
|
- mode: '0644'
|
2023-11-13 09:33:28 -05:00
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- makedirs: True
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-desktop-application-browser":
|
|
|
|
file.managed:
|
|
|
|
- name: /usr/share/applications/pihole-browser.desktop
|
|
|
|
- source: salt://{{ slsdotpath }}/files/server/pihole-browser.desktop
|
|
|
|
- mode: '0644'
|
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- makedirs: True
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-desktop-application-open-general":
|
|
|
|
file.managed:
|
|
|
|
- name: /usr/share/applications/pihole-browser-general.desktop
|
|
|
|
- source: salt://{{ slsdotpath }}/files/server/pihole-browser-general.desktop
|
|
|
|
- mode: '0644'
|
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- makedirs: True
|
|
|
|
|
|
|
|
"{{ slsdotpath }}-etc-mimeapps.list":
|
|
|
|
file.managed:
|
|
|
|
- name: /etc/xdg/mimeapps.list
|
|
|
|
- source: salt://{{ slsdotpath }}/files/server/mimeapps.list
|
|
|
|
- mode: '0644'
|
|
|
|
- user: root
|
|
|
|
- group: root
|
|
|
|
- makedirs: True
|
|
|
|
|
|
|
|
{% endif -%}
|