This site has been blocked by your administrator.
-Contact your administrator to request an exception.
+ +
+
+
\ No newline at end of file
diff --git a/template/caddy/Caddyfile b/template/caddy/Caddyfile
index d2982ed..9ff25c7 100644
--- a/template/caddy/Caddyfile
+++ b/template/caddy/Caddyfile
@@ -10,11 +10,13 @@
}
}
+# Redirect all plain HTTP to blocked page
http:// {
bind {$PIHOLE_PROXY_BIND_ADDR}
redir http://blocked.enclave
}
+# Serve cert files over HTTP
http://dnsfilter.enclave {
bind {$PIHOLE_PROXY_BIND_ADDR}
route {
@@ -28,11 +30,38 @@ http://dnsfilter.enclave {
header * Content-Disposition "attachment"
file_server
}
+ redir * https://{host}/admin/
+ }
+}
+
+# Catch-all HTTPS handler for certs, blocked page, and redirects
+https:// {
+ bind {$PIHOLE_PROXY_BIND_ADDR}
+ tls internal {
+ on_demand
+ }
- redir * https://{host}
+ @dnsfilter host dnsfilter.enclave
+ handle @dnsfilter {
+ redir * https://{host}:444/admin
+ }
+
+ @blocked host blocked.enclave
+ handle @blocked {
+ header {
+ X-Frame-Options "DENY"
+ }
+ root * /blockpage
+ file_server
+ }
+
+ # Default fallback for all other HTTPS access
+ handle {
+ redir https://blocked.enclave
}
}
+# Load-balanced access to pihole admin dashboard. Always targets the primary first as config is replicated.
https://dnsfilter.enclave:444 {
bind {$PIHOLE_PROXY_BIND_ADDR}
tls internal
@@ -47,40 +76,3 @@ https://dnsfilter.enclave:444 {
fail_duration 30s
}
}
-
-# This is the 'end' of the chain; and points at the actual running pihole instance on the local host.
-http://:9999 {
- bind {$PIHOLE_PROXY_BIND_ADDR}
-
- reverse_proxy http://localhost:1080
- rewrite * /admin/{path}
-}
-
-https:// {
-
- bind {$PIHOLE_PROXY_BIND_ADDR}
-
- tls internal {
- on_demand
- }
-
- @dnsfilter host dnsfilter.enclave
-
- handle @dnsfilter {
- redir * https://{host}:444
- }
-
- @blocked host blocked.enclave
-
- handle @blocked {
- header {
- X-Frame-Options "DENY"
- }
- root * /blockpage
- file_server
- }
-
- handle {
- redir https://blocked.enclave
- }
-}
\ No newline at end of file
diff --git a/template/docker-compose.primary.yml b/template/docker-compose.primary.yml
index b8b2fec..db69967 100644
--- a/template/docker-compose.primary.yml
+++ b/template/docker-compose.primary.yml
@@ -41,7 +41,9 @@ services:
- ./etc/pihole:/etc/pihole
- etc-dnsmasq:/etc/dnsmasq.d
hostname: ${PIHOLE_HOSTNAME}
- mem_limit: 150M
+ # mem_limit: 300M
+ cap_add:
+ - CAP_SYS_TIME
restart: unless-stopped
ports:
- "${ENCLAVE_LOCAL_PORT}:${ENCLAVE_LOCAL_PORT}/tcp"
@@ -54,19 +56,16 @@ services:
gw-net:
environment:
TZ: 'Europe/London'
- WEBPASSWORD: ''
- WEB_PORT: 1080
- # Traffic to the pihole admin interface is
- # proxied through caddy (to apply HTTPS and handle redirects).
- # Restrict the web interface to only be available via that proxy.
- WEB_BIND_ADDR: 127.0.0.1
- CORS_HOSTS: dnsfilter.enclave
- DNSMASQ_LISTENING: all
- FTLCONF_LOCAL_IPV4: ${ENCLAVE_VIRTUAL_IP}
- FTLCONF_BLOCK_IPV4: ${ENCLAVE_VIRTUAL_IP}
- FTLCONF_BLOCKINGMODE: IP-NODATA-AAAA
- FTLCONF_PIHOLE_PTR: NONE
- FTLCONF_MAXDBDAYS: 30
+ FTLCONF_webserver_api_password: ''
+ FTLCONF_webserver_port: 1080
+ FTLCONF_dns_interface: '127.0.0.1'
+ FTLCONF_dns_domain: 'dnsfilter.enclave'
+ FTLCONF_dns_piholePTR: NONE
+ FTLCONF_dns_listeningMode: all
+ FTLCONF_dns_blocking_mode: IP_NODATA_AAAA
+ FTLCONF_dns_reply_host_IPv4: ${ENCLAVE_VIRTUAL_IP}
+ FTLCONF_dns_reply_blocking_IPv4: ${ENCLAVE_VIRTUAL_IP}
+ FTLCONF_database_maxDBdays: 30
pihole-enclave-sync:
image: enclavenetworks/pihole-enclave-sync:latest
@@ -101,11 +100,11 @@ services:
cpu_count: 1
environment:
PIHOLE_PROXY_BIND_ADDR: ${ENCLAVE_VIRTUAL_IP}
- PIHOLE_LB_UPSTREAM_LIST: http://primary.dns.internal:9999 http://secondary.dns.internal:9999
+ PIHOLE_LB_UPSTREAM_LIST: http://primary.dns.internal:1080 http://secondary.dns.internal:1080
# Only on primary
- orbital-sync:
- image: mattwebbio/orbital-sync:1
+ nebula-sync:
+ image: ghcr.io/lovelaze/nebula-sync:latest
network_mode: 'service:pihole'
mem_limit: 50M
depends_on:
@@ -115,27 +114,31 @@ services:
condition: service_started
cpu_count: 1
environment:
- PRIMARY_HOST_BASE_URL: 'http://primary.dns.internal:9999'
- PRIMARY_HOST_PASSWORD: ''
- PRIMARY_HOST_PATH: '/'
- SECONDARY_HOST_1_BASE_URL: 'http://secondary.dns.internal:9999'
- SECONDARY_HOST_1_PASSWORD: ''
- SECONDARY_HOST_1_PATH: '/'
- INTERVAL_MINUTES: 30
+ - PRIMARY=http://primary.dns.internal:1080|
+ - REPLICAS=http://secondary.dns.internal:1080|
+ - FULL_SYNC=false
+ - RUN_GRAVITY=true # Important, rebuilds gravity database after sync
+ - CRON=* * * * * # Or, run every hour: 0 * * * *
+ - CLIENT_SKIP_TLS_VERIFICATION=true
- # See https://github.com/mattwebbio/orbital-sync/blob/master/src/config/schema.ts
- SYNC_WHITELIST: true # Copies the whitelist
- SYNC_REGEX_WHITELIST: true # Copies the regex whitelist
- SYNC_BLACKLIST: true # Copies the blacklist
- SYNC_REGEXLIST: true # Copies the regex blacklist
- SYNC_ADLIST: true # Copies adlists
- SYNC_CLIENT: false # Copies clients
- SYNC_GROUP: true # Copies groups
- SYNC_AUDITLOG: true # Copies the audit log
- SYNC_STATICDHCPLEASES: true # Copies static DHCP leases
- SYNC_LOCALDNSRECORDS: false # Copies local DNS records
- SYNC_LOCALCNAMERECORDS: false # Copies local CNAME records
- SYNC_FLUSHTABLES: true # Clears existing data on the secondary (copy target) Pi-hole
+ # Config synchronisation
+ - SYNC_CONFIG_DNS=false # Keep false - Config items are set by ENV vars and cannot be changed. Produces a 400 from the far-side API if not set. DNS settings are host-specific
+ - SYNC_CONFIG_DHCP=false # Keep false - DHCP should only run on primary
+ - SYNC_CONFIG_NTP=true # Sync NTP settings
+ - SYNC_CONFIG_RESOLVER=true # Sync resolver settings for consistency
+ - SYNC_CONFIG_DATABASE=true # Keep false - Config items are set by ENV vars and cannot be changed
+ - SYNC_CONFIG_MISC=true # Sync miscellaneous settings like nice levels
+ - SYNC_CONFIG_DEBUG=false # Keep debug settings host-specific
+
+ # Gravity/blocking synchronisation
+ - SYNC_GRAVITY_GROUP=true # Sync groups for organisation
+ - SYNC_GRAVITY_AD_LIST=true # Sync blocklists/allowlists
+ - SYNC_GRAVITY_AD_LIST_BY_GROUP=true # Sync which lists apply to which groups
+ - SYNC_GRAVITY_DOMAIN_LIST=true # Sync individual blocked/allowed domains
+ - SYNC_GRAVITY_DOMAIN_LIST_BY_GROUP=true # Sync domain list group assignments
+ - SYNC_GRAVITY_CLIENT=true # Sync client definitions
+ - SYNC_GRAVITY_CLIENT_BY_GROUP=true # Sync client group assignments
+ - SYNC_GRAVITY_DHCP_LEASES=false # Don't sync DHCP leases between hosts
volumes:
enclave-config:
diff --git a/template/docker-compose.secondary.yml b/template/docker-compose.secondary.yml
index ddfe407..fb63f69 100644
--- a/template/docker-compose.secondary.yml
+++ b/template/docker-compose.secondary.yml
@@ -41,7 +41,9 @@ services:
- ./etc/pihole:/etc/pihole
- etc-dnsmasq:/etc/dnsmasq.d
hostname: ${PIHOLE_HOSTNAME}
- mem_limit: 150M
+ # mem_limit: 300M
+ cap_add:
+ - CAP_SYS_TIME
restart: unless-stopped
ports:
- "${ENCLAVE_LOCAL_PORT}:${ENCLAVE_LOCAL_PORT}/tcp"
@@ -54,19 +56,18 @@ services:
gw-net:
environment:
TZ: 'Europe/London'
- WEBPASSWORD: ''
- WEB_PORT: 1080
- # Traffic to the pihole admin interface is
- # proxied through caddy (to apply HTTPS and handle redirects).
- # Restrict the web interface to only be available via that proxy.
- WEB_BIND_ADDR: 127.0.0.1
- CORS_HOSTS: dnsfilter.enclave
- DNSMASQ_LISTENING: all
- FTLCONF_LOCAL_IPV4: ${ENCLAVE_VIRTUAL_IP}
- FTLCONF_BLOCK_IPV4: ${ENCLAVE_VIRTUAL_IP}
- FTLCONF_BLOCKINGMODE: IP-NODATA-AAAA
- FTLCONF_PIHOLE_PTR: NONE
- FTLCONF_MAXDBDAYS: 30
+ FTLCONF_webserver_api_password: ''
+ FTLCONF_webserver_port: 1080
+ # Traffic to the pi-hole admin interface is proxied through Caddy to apply HTTPS and handle redirects,
+ # so we restrict the pi-hole admin interface to only be available via the Caddy proxy.
+ FTLCONF_dns_interface: '127.0.0.1'
+ FTLCONF_dns_domain: 'dnsfilter.enclave'
+ FTLCONF_dns_piholePTR: NONE
+ FTLCONF_dns_listeningMode: all
+ FTLCONF_dns_blocking_mode: IP_NODATA_AAAA
+ FTLCONF_dns_reply_host_IPv4: ${ENCLAVE_VIRTUAL_IP}
+ FTLCONF_dns_reply_blocking_IPv4: ${ENCLAVE_VIRTUAL_IP}
+ FTLCONF_database_maxDBdays: 30
pihole-enclave-sync:
image: enclavenetworks/pihole-enclave-sync:latest
@@ -101,7 +102,7 @@ services:
cpu_count: 1
environment:
PIHOLE_PROXY_BIND_ADDR: ${ENCLAVE_VIRTUAL_IP}
- PIHOLE_LB_UPSTREAM_LIST: http://primary.dns.internal:9999 http://secondary.dns.internal:9999
+ PIHOLE_LB_UPSTREAM_LIST: http://primary.dns.internal:1080 http://secondary.dns.internal:1080
volumes:
enclave-config:
This site isn't accessible right now.
+Content filtering is actively protecting our network, and this website has been identified as inappropriate, potentially unsafe, or malicious.
+ +
+
-
+ Need to request access?
+-
+
- Raise a support ticket with the blocked website URL +
- Include your business justification for needing access +
- Tickets are typically reviewed within 24 hours +
+
+
+
+ To request access to this site, please raise a ticket at
https://example.com
+