89 lines
3.2 KiB
YAML
Executable File
89 lines
3.2 KiB
YAML
Executable File
# =============================================================================
|
||
# 02_stack-dns.yml – Phase 2
|
||
# DNS-Stack: unbound (rekursiver Resolver) + pihole (DNS-Filter)
|
||
# =============================================================================
|
||
#
|
||
# Starten in dieser Reihenfolge (depends_on erzwingt das bereits):
|
||
# 1. unbound hoch + healthy abwarten
|
||
# 2. dann pihole hoch
|
||
#
|
||
# WICHTIG vor dem Start:
|
||
# - Wenn pihole dein einziger DNS-Server ist:
|
||
# Router-DNS kurz auf 1.1.1.1 setzen, migrieren, zurücksetzen
|
||
# - pihole macht bei dir kein DHCP → bridge (dns_net) ist korrekt
|
||
# - Port 53 muss öffentlich bleiben (DNS-Dienst für LAN)
|
||
#
|
||
# =============================================================================
|
||
|
||
networks:
|
||
dns_net:
|
||
external: true
|
||
|
||
services:
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# UNBOUND – Rekursiver DNS-Resolver
|
||
# Braucht Outbound ins Internet (rekursive Auflösung zu Root-Servern).
|
||
# dns_net ist daher nicht internal:true.
|
||
# Kein eingehender Host-Port — pihole erreicht unbound per DNS-Name.
|
||
# ---------------------------------------------------------------------------
|
||
unbound:
|
||
image: kutzilla/unbound:latest
|
||
container_name: unbound
|
||
restart: unless-stopped
|
||
security_opt:
|
||
- no-new-privileges:true
|
||
networks:
|
||
dns_net:
|
||
ipv4_address: 172.23.0.10
|
||
healthcheck:
|
||
test: ["CMD-SHELL", "drill @127.0.0.1 cloudflare.com || exit 1"]
|
||
interval: 30s
|
||
timeout: 10s
|
||
retries: 3
|
||
start_period: 10s
|
||
labels:
|
||
net.unraid.docker.managed: "dockerman"
|
||
net.unraid.docker.icon: "https://raw.githubusercontent.com/kutzilla/unraid-templates/master/images/unbound.png"
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# PIHOLE – DNS-Filter
|
||
# Upstream: "unbound#53" → Docker-DNS löst "unbound" → 172.23.0.10
|
||
# Port 53 bleibt öffentlich (DNS-Dienst für LAN ist zwingend nötig).
|
||
# Admin-UI auf Port 8155 bleibt direkt erreichbar (DNS muss auch ohne
|
||
# Proxy funktionieren — Henne-Ei-Problem mit Traefik vermeiden).
|
||
# ---------------------------------------------------------------------------
|
||
binhex-official-pihole:
|
||
image: pihole/pihole:2026.02.0 # gepinnt auf bekannte stabile Version
|
||
container_name: binhex-official-pihole
|
||
restart: unless-stopped
|
||
depends_on:
|
||
unbound:
|
||
condition: service_healthy
|
||
networks:
|
||
dns_net:
|
||
ipv4_address: 172.23.0.20
|
||
ports:
|
||
- "53:53/tcp"
|
||
- "53:53/udp"
|
||
- "8155:80/tcp"
|
||
volumes:
|
||
- /mnt/user/appdata/official-pihole/pihole:/etc/pihole
|
||
- /mnt/user/appdata/official-pihole/pihole/dnsmasq:/etc/dnsmasq.d
|
||
environment:
|
||
TZ: "Europe/Berlin"
|
||
WEBPASSWORD: "${PIHOLE_WEBPASSWORD}"
|
||
PIHOLE_DNS_: "unbound#53"
|
||
DNSSEC: "true"
|
||
DNSMASQ_LISTENING: "all"
|
||
healthcheck:
|
||
test: ["CMD", "curl", "-sf", "http://localhost/admin/"]
|
||
interval: 30s
|
||
timeout: 10s
|
||
retries: 3
|
||
start_period: 20s
|
||
labels:
|
||
net.unraid.docker.managed: "dockerman"
|
||
net.unraid.docker.icon: "https://raw.githubusercontent.com/binhex/docker-templates/master/binhex/images/official-pihole-icon.png"
|
||
net.unraid.docker.webui: "http://[IP]:[PORT:8155]/admin"
|