692659e22d
- Passwordless as it doesn't compromise security; - Firewall blocks access to the interface in case the pihole is exposed to the internet; - setupVars.conf needs to be 644 for non root commands to the pihole script to work, so the WEB_PASSWORD can be read as normal user, restricting root on pihole does not make sense, as it can modify the network setting via pihole web interface. |
||
|---|---|---|
| .. | ||
| files | ||
| appmenus.sls | ||
| appmenus.top | ||
| configure-browser.sls | ||
| configure-browser.top | ||
| create.sls | ||
| create.top | ||
| init.top | ||
| install.sls | ||
| install.top | ||
| prefs.sls | ||
| prefs.top | ||
| README.md | ||
sys-pihole
Pi-hole DNS Sinkhole in Qubes OS.
Table of Contents
Description
The package will create a standalone qube "sys-pihole". It blocks advertisements and internet trackers by providing a DNS sinkhole. It is a drop in replacement for sys-firewall.
The qube will be attached to the "netvm" of the "default_netvm", in other words, if you are using Qubes OS default setup, it will use "sys-net" as the "netvm", else it will try to figure out what is your upstream link and attach to it.
Installation
Pi-Hole commits and tags are not signed by individuals, but as they are done through the web interface, they have GitHub Web-Flow signature. This is the best verification we can get for Pi-Hole. If you don't trust the hosting provider however, don't install this package.
- Top:
qubesctl top.enable sys-pihole browser
qubesctl --targets=tpl-browser,sys-pihole-browser,sys-pihole state.apply
qubesctl top.disable sys-pihole browser
qubesctl state.apply sys-pihole.appmenus
- State:
qubesctl state.apply sys-pihole.create
qubesctl --skip-dom0 --targets=tpl-browser state.apply browser.install
qubesctl --skip-dom0 --targets=sys-pihole state.apply sys-pihole.install
qubesctl --skip-dom0 --targets=sys-pihole-browser state.apply sys-pihole.configure-browser
qubesctl state.apply sys-pihole.appmenus
If you want to change the global preferences updatevm and default_netvm
and the per-qube preference netvm of all qubes from sys-firewall to
sys-pihole, run:
qubesctl state.apply sys-pihole.prefs
Usage
Pi-hole will be installed with these default settings:
- The DNS provider is Quad9 (filtered, DNSSEC)
- Steven Black's Unified Hosts List is included
- Query logging is enabled to show everything.
You can change the settings via the admin interface:
- URL: http://localhost/admin
- There is no password (access allowed only through localhost)
If you want to view statistics or manage the server through a GUI, open
sys-pihole or sys-pihole-browser desktop file pihole-browser.desktop
from Dom0. Addresses starting with http or https will be redirected
to sys-pihole-browser.
The browser separation from the server is to avoid browsing malicious sites and exposing the browser to direct network on the same machine the server is running. The browser qube is offline and only has access to the admin interface. In other words, it has control over the server functions, if the browser is compromised, it can compromise the server.
You can clone sys-pihole. If you do, you must manually change the IP address
of the clone.
If you want to combine Pi-Hole with Tor, then you should reconfigure your netvm chaining (will break tor's client stream isolation) as such:
- qube -> sys-pihole -> Tor-gateway -> sys-firewall -> sys-net
If you encounter problems with DNS after having upstream netvm route changes,
restart Pi-Hole DNS from sys-pihole and run the following as root:
pihole restartdns