Skip to content

Commit

Permalink
dietpi-software: Pi-hole: add support for v6 (#7421)
Browse files Browse the repository at this point in the history
  • Loading branch information
MichaIng authored Feb 21, 2025
1 parent 2e45ac3 commit aefa380
Show file tree
Hide file tree
Showing 3 changed files with 140 additions and 124 deletions.
60 changes: 60 additions & 0 deletions .update/patches
Original file line number Diff line number Diff line change
Expand Up @@ -2112,6 +2112,66 @@ Patch_9_10()
fi
}

Patch_9_11()
{
# Software updates, migrations and patches
if [[ -f '/boot/dietpi/.installed' ]]
then
# Pi-hole v6 migration
# - /etc/pihole/pihole.toml indicates that Pi-hole has been upgraded to v6 already.
# - The /var/www/pihole symlink indicates that an instance installed via dietpi-software has not been migrated yet.
if [[ -f '/etc/pihole/pihole.toml' && -L '/var/www/pihole' ]] && grep -q '^[[:blank:]]*aSOFTWARE_INSTALL_STATE\[93\]=2' /boot/dietpi/.installed
then
# Remove DietPi specific v5 files
# - Symlinks
G_EXEC rm /var/www/pihole
[[ -L '/var/www/admin' ]] && G_EXEC rm /var/www/admin
# - Webserver configs
[[ -d '/etc/apache2/sites-available' ]] && G_EXEC rm -f /etc/apache2/sites-{available,enabled}/dietpi-pihole*
[[ -d '/etc/lighttpd/conf-available' ]] && G_EXEC rm -f /etc/lighttpd/conf-{available,enabled}/99-dietpi-pihole*
[[ -d '/etc/nginx/sites-dietpi' ]] && G_EXEC rm -f /etc/nginx/sites-dietpi/dietpi-pihole*

# Remove www-data user from pihole group
getent group pihole > /dev/null && G_EXEC usermod -rG pihole www-data

# Change web UI port to 8089 to avoid conflict with webservers and other web applications
G_EXEC pihole-FTL --config webserver.port 8089

# Inform user about differences to stock Pi-hole installation
G_WHIP_MSG "[ INFO ] Pi-hole network port changed to 8089
\nTo align migrated Pi-hole v6 instances with fresh installs, and avoid possible conflicts with dedicated webservers, the network port has been changed to 8089. Your Pi-hole instance will hence be available at:
- http://$(G_GET_NET ip):8089/admin/
\nThis can be changed via web UI or following console command:
- pihole-FTL --config webserver.port XXXX"

# Offer to uninstall websever and PHP if no dependant is installed
# - If only PHP or only a webserver is installed, one has been uninstalled already, and the other is assumed to be still needed for something else.
if grep -q '^[[:blank:]]*aSOFTWARE_INSTALL_STATE\[89\]=2' /boot/dietpi/.installed && grep -Eq '^[[:blank:]]*aSOFTWARE_INSTALL_STATE\[(83|84|85)\]=2' /boot/dietpi/.installed
then
G_WHIP_CHECKLIST_ARRAY=()
# - webserver
if ! /boot/dietpi/dietpi-software list | grep -q '| =2 |.*+webserver'
then
grep -q '^[[:blank:]]*aSOFTWARE_INSTALL_STATE\[83\]=2' /boot/dietpi/.installed && G_WHIP_CHECKLIST_ARRAY+=(83 'Apache webserver' off)
grep -q '^[[:blank:]]*aSOFTWARE_INSTALL_STATE\[84\]=2' /boot/dietpi/.installed && G_WHIP_CHECKLIST_ARRAY+=(84 'Lighttpd webserver' off)
grep -q '^[[:blank:]]*aSOFTWARE_INSTALL_STATE\[85\]=2' /boot/dietpi/.installed && G_WHIP_CHECKLIST_ARRAY+=(85 'Nginx webserver' off)
fi
# - PHP: Exclude webserver stacks which are meta selections only
/boot/dietpi/dietpi-software list | grep '| =2 |.*+PHP' | grep -vEq '^.\[32mID (75|76|78|79|81|82)' || G_WHIP_CHECKLIST_ARRAY+=(89 'PHP server' off)
if (( ${#G_WHIP_CHECKLIST_ARRAY[@]} ))
then
G_WHIP_BUTTON_CANCEL_TEXT='Skip'
# shellcheck disable=SC2086
G_WHIP_CHECKLIST '[ INFO ] Possibly obsolete webserver and/or PHP installation detected
\nYou recently updated Pi-hole to v6, which now does not require any webserver or PHP anymore.
\nWe detected a webserver and/or PHP installation on your system, but no dependant among installed dietpi-software options.
\nIf you are sure that you do not require the webserver and/or PHP anymore, you can select them for uninstall below. Use the space bar to (de)select the ones which shall be uninstalled:' && /boot/dietpi/dietpi-software uninstall $G_WHIP_RETURNED_VALUE
fi
fi
fi
fi
}

# v6.35 => v7 migration
if (( $G_DIETPI_VERSION_CORE == 6 && $G_DIETPI_VERSION_SUB > 34 ))
then
Expand Down
1 change: 1 addition & 0 deletions CHANGELOG.txt
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ Bug fixes:
- DietPi-FirstBoot | Resolved an issue, where the automatic first run setup could have failed, if the network adapter, wpa_supplicant or DHCP client took a little longer to receive an IP address, without "ifup" further halting the script. In case of "AUTO_SETUP_AUTOMATED=1" in dietpi.txt, the very first network check is assured to try at least 4 times, with a 5 seconds delay between each attempt.
- DietPi-Config | Resolved an issue where selecting the linux-image-rpi-v8 kernel on 32-bit images failed. Many thanks to @SOULV1CE for reporting this issue: https://github.com/MichaIng/DietPi/issues/7402
- DietPi-Software | Fail2Ban: Resolved an issue where the install failed while downloading updated Dropbear filters. Many thanks to @Stream5710 for reporting this issue: https://github.com/MichaIng/DietPi/issues/7413
- DietPi-Software | Pi-hole: Support for Pi-hole v6 was added. During the DietPi update, we check whether your Pi-hole has been updated already, and in case perform some migration and cleanup of DietPi-specific configs. Also, since Pi-hole v6 ships with its internal webserver and PHP interpreter, if a webserver and PHP are installed without any dependant among dietpi-software options, it is offered to uninstall them.

As always, many smaller code performance and stability improvements, visual and spelling fixes have been done, too much to list all of them here. Check out all code changes of this release on GitHub: https://github.com/MichaIng/DietPi/pull/ADDME

Expand Down
203 changes: 79 additions & 124 deletions dietpi/dietpi-software
Original file line number Diff line number Diff line change
Expand Up @@ -1405,7 +1405,7 @@ Available commands:
aSOFTWARE_DESC[$software_id]='block adverts for any device on your network'
aSOFTWARE_CATX[$software_id]=13
aSOFTWARE_DOCS[$software_id]='https://dietpi.com/docs/software/dns_servers/#pi-hole'
aSOFTWARE_DEPS[$software_id]='17 89 webserver'
aSOFTWARE_DEPS[$software_id]='17'
aSOFTWARE_INTERACTIVE[$software_id]=1
aSOFTWARE_CONFLICTS[$software_id]='126'
#------------------
Expand Down Expand Up @@ -5770,6 +5770,12 @@ _EOF_
if (( ${aSOFTWARE_INSTALL_STATE[93]} == 2 ))
then
G_DIETPI-NOTIFY 2 'Configuring Pi-hole to use Unbound'
# v6
if [[ $(pihole-FTL -v) == 'v6'* ]]
then
G_EXEC pihole-FTL --config dns.upstreams '[ "127.0.0.1#5335" ]'
fi
# v5
if [[ -f '/etc/dnsmasq.d/01-pihole.conf' ]]
then
G_EXEC sed --follow-symlinks -i '/^[[:blank:]]*server=/d' /etc/dnsmasq.d/01-pihole.conf
Expand Down Expand Up @@ -5801,8 +5807,9 @@ _EOF_

if To_Install 93 pihole-FTL # Pi-hole
then
local url='https://raw.githubusercontent.com/pi-hole/pi-hole/master/automated%20install/basic-install.sh'
G_CHECK_URL "$url"
# Download
G_EXEC curl -sSfLo install.sh 'https://raw.githubusercontent.com/pi-hole/pi-hole/master/automated%20install/basic-install.sh'
G_EXEC chmod +x install.sh

# Check free available memory. Increase swap size to prevent gravity running out of memory.
if (( $(free -m | mawk '/^Mem:/{print $7;exit}') < 512 && $(free -m | mawk '/^Swap:/{print $2;exit}') < 512 ))
Expand All @@ -5811,9 +5818,6 @@ _EOF_
/boot/dietpi/func/dietpi-set_swapfile 512
fi

# Dependencies: https://github.com/pi-hole/pi-hole/blob/development/automated%20install/basic-install.sh#L250
G_AGI "php$PHP_VERSION-"{xml,sqlite3,intl}

# Unbound: Switch port to 5335 if it was installed before, else it got just configured within its install step above
if (( ${aSOFTWARE_INSTALL_STATE[182]} == 2 )) && grep -q '^[[:blank:]]*port:[[:blank:]][[:blank:]]*53$' /etc/unbound/unbound.conf.d/dietpi.conf
then
Expand All @@ -5825,130 +5829,56 @@ _EOF_
fi

# Install
G_EXEC curl -sSfLo install.sh "$url"
G_EXEC chmod +x install.sh
# - Skip web interface dialogue (which defaults to "true"), since we install a web server and PHP anyway
# - Skip query logging dialogue (which affects file logging only, not database>web UI) and set to "false"
# - Skip supported OS check. We do not support Debian testing but we are testing it already now.
# - Workaround "dialog" issues with "xterm" by faking "linux" terminal
# - Skip web server install, since we allow to choose and install it prior to Pi-hole
G_EXEC sed --follow-symlinks -Ei '/^[[:blank:]]*set(AdminFla|Loggin)g$/d' install.sh
G_EXEC sed --follow-symlinks -i 's/QUERY_LOGGING=true/QUERY_LOGGING=false/' install.sh
export PIHOLE_SKIP_OS_CHECK=true
local retry TERM_old=
[[ $TERM == 'xterm' ]] && { TERM_old=$TERM; export TERM=linux; }
while :
# - Skip supported OS check. We do not fully support Debian testing either but we are testing it already now.
export PIHOLE_SKIP_OS_CHECK=true
# - Skip query logging dialogue and set to "false", which affects file logging only, not database>web UI.
G_EXEC sed --follow-symlinks -i '/^[[:blank:]]*setLogging$/d' install.sh
G_EXEC sed --follow-symlinks -i '/^QUERY_LOGGING=$/c\QUERY_LOGGING=false' install.sh
# - Skip final completion dialogue since we show our own
# shellcheck disable=SC2016
G_EXEC sed --follow-symlinks -i '/^[[:blank:]]*displayFinalMessage "${pw}"/d' install.sh
until ./install.sh
do
./install.sh --disable-install-webserver && break
(( $G_INTERACTIVE )) && read -rp 'The Pi-hole installer failed. Do you want to retry? [yN]: ' retry
[[ $retry =~ ^[yY]([eE][sS])?$ ]] || { aSOFTWARE_INSTALL_STATE[$software_id]=0; break; }
done
G_EXEC rm install.sh
[[ $TERM_old ]] && TERM=$TERM_old
unset -v retry TERM_old

# Skip setup if installer errored out
if (( ${aSOFTWARE_INSTALL_STATE[$software_id]} == 1 )); then

# Apply most resource friendly and officially recommended NULL blocking: https://docs.pi-hole.net/ftldns/blockingmode/
G_CONFIG_INJECT 'BLOCKINGMODE=' 'BLOCKINGMODE=NULL' /etc/pihole/pihole-FTL.conf

# Disable pihole.log query logging: https://github.com/pi-hole/FTL/issues/614#issuecomment-510564476
G_EXEC pihole -l off

# Unbound: Configure Pi-hole to use it
if (( ${aSOFTWARE_INSTALL_STATE[182]} > 0 ))
# Skip further setup if installer failed
if (( ${aSOFTWARE_INSTALL_STATE[$software_id]} == 1 ))
then
G_DIETPI-NOTIFY 2 'Configuring Pi-hole to use Unbound'
G_EXEC sed --follow-symlinks -i '/^[[:blank:]]*server=/d' /etc/dnsmasq.d/01-pihole.conf
G_CONFIG_INJECT 'server=' 'server=127.0.0.1#5335' /etc/dnsmasq.d/01-pihole.conf
systemctl -q is-active pihole-FTL && G_EXEC systemctl restart pihole-FTL
G_CONFIG_INJECT 'PIHOLE_DNS_1=' 'PIHOLE_DNS_1=127.0.0.1#5335' /etc/pihole/setupVars.conf
G_EXEC sed --follow-symlinks -i '/^[[:blank:]]*PIHOLE_DNS_2=/d' /etc/pihole/setupVars.conf
fi
# Set web UI password: https://github.com/MichaIng/DietPi/issues/662
G_EXEC_PRE_FUNC(){ acommand[2]=$GLOBAL_PW; }
G_EXEC pihole setpassword "${GLOBAL_PW//?/X}"

# Enable required PHP modules: https://github.com/pi-hole/pi-hole/blob/development/automated%20install/basic-install.sh#L250
G_EXEC phpenmod xml sqlite3 intl
# Disable pihole.log query logging: https://github.com/pi-hole/FTL/issues/614#issuecomment-510564476
G_EXEC pihole-FTL --config dns.queryLogging 'false'

# Webserver configs
# - Lighttpd
if (( ${aSOFTWARE_INSTALL_STATE[84]} > 0 ))
then
# Enable required modules
[[ -f '/etc/lighttpd/conf-enabled/05-setenv.conf' ]] || G_EXEC lighty-enable-mod setenv
# Unbound: Configure Pi-hole to use it
(( ${aSOFTWARE_INSTALL_STATE[182]} > 0 )) && G_EXEC pihole-FTL --config dns.upstreams '[ "127.0.0.1#5335" ]'

# Add and enable Pi-hole config
dps_index=$software_id Download_Install 'lighttpd.pihole.conf' /etc/lighttpd/conf-available/99-dietpi-pihole.conf
G_EXEC_POST_FUNC(){ [[ $exit_code == 2 ]] && exit_code=0; } # Do not fail if modules are enabled already
G_EXEC lighty-enable-mod dietpi-pihole
# Apply most resource friendly and officially recommended NULL blocking: https://docs.pi-hole.net/ftldns/blockingmode/
G_EXEC pihole-FTL --config dns.blocking.mode 'NULL'

# Optional config to block public access to admin panel
dps_index=$software_id Download_Install 'lighttpd.block_public_admin.conf' /etc/lighttpd/conf-available/99-dietpi-pihole-block_public_admin.conf
local enable_cmd='lighty-enable-mod dietpi-pihole-block_public_admin'
local disable_cmd='lighty-disable-mod dietpi-pihole-block_public_admin'
# Reduce long-term database TTL: https://github.com/MichaIng/DietPi-Docs/issues/476
G_EXEC pihole-FTL --config database.maxDBdays 2

# - Apache
elif (( ${aSOFTWARE_INSTALL_STATE[83]} > 0 ))
then
# Enable required modules
G_EXEC a2enmod headers

# Add and enable Pi-hole config
dps_index=$software_id Download_Install 'apache.pihole.conf' /etc/apache2/sites-available/dietpi-pihole.conf
G_EXEC a2ensite dietpi-pihole

# Optional config to block public access to admin panel
dps_index=$software_id Download_Install 'apache.block_public_admin.conf' /etc/apache2/sites-available/dietpi-pihole-block_public_admin.conf
local enable_cmd='a2ensite dietpi-pihole-block_public_admin'
local disable_cmd='a2dissite dietpi-pihole-block_public_admin'

# - Nginx
elif (( ${aSOFTWARE_INSTALL_STATE[85]} > 0 ))
then
# Add Pi-hole config
dps_index=$software_id Download_Install 'nginx.pihole.conf' /etc/nginx/sites-dietpi/dietpi-pihole.conf

# Optional config to block public access to admin panel
dps_index=$software_id Download_Install 'nginx.block_public_admin.conf' /etc/nginx/sites-dietpi/dietpi-pihole-block_public_admin.off
local enable_cmd='mv /etc/nginx/sites-dietpi/dietpi-pihole-block_public_admin.{off,on}'
local disable_cmd='mv /etc/nginx/sites-dietpi/dietpi-pihole-block_public_admin.{on,off}'
fi

# Ask user if they want to block public access to the admin panel
G_WHIP_BUTTON_OK_TEXT='YES'
G_WHIP_BUTTON_CANCEL_TEXT='NO'
G_WHIP_YESNO "In order to increase security, it is recommended to block public access to the Pi-hole admin panel, so that only connections from within your LAN or via VPN are possible.
\nPractically this means to deny access from all IPs that do not match the reserved loopback and LAN ranges:
- 127.*
- 192.168.*
- 10.*
- 172.16.* - 172.31.*
- ::1
- fe80:* - febf:* (LLAs)
- fc00:* - fdff:* (ULAs)
\nNote that if you use IPv6 and hostnames within your LAN, but no ULAs (Unique Local Addresses), this might also block accesses from within your LAN, as then GUAs (Global Unicast Addresses) are used, which cannot be distinguished from public accesses.
\nYou can always enable/disable this later using the commands:
- $enable_cmd
- $disable_cmd
\nDo you want to block public access to the admin panel now?" && eval "$enable_cmd"

# Create symlinks to align Pi-hole admin and 404 page relative to webroot
[[ -e '/var/www/admin' && ! -L '/var/www/admin' ]] && G_EXEC mv /var/www/admin{,.bak}
G_EXEC ln -sf /var/www/{html/,}admin
[[ -e '/var/www/pihole' && ! -L '/var/www/pihole' ]] && G_EXEC mv /var/www/pihole{,.bak}
G_EXEC ln -sf /var/www/{html/,}pihole

# Add webserver user to pihole group to allow gravity.db access from web UI: https://github.com/MichaIng/DietPi/issues/3391
G_EXEC usermod -aG pihole www-data

# Set web interface PW: https://github.com/MichaIng/DietPi/issues/662
pihole -a -p "$GLOBAL_PW"

# Reduce long-term database TTL: https://github.com/MichaIng/DietPi-Docs/issues/476
G_DIETPI-NOTIFY 2 'The DNS query database logging duration is reduced to 2 days. If you require long-term query logs, read our docs about how to change the log duration:
- https://dietpi.com/docs/software/dns_servers/#pi-hole'
G_CONFIG_INJECT 'MAXDBDAYS=' 'MAXDBDAYS=2' /etc/pihole/pihole-FTL.conf
# Change web UI port to 8089 to avoid conflict with webservers and other web applications
G_EXEC pihole-FTL --config webserver.port 8089

# Inform user about differences to stock Pi-hole installation
G_WHIP_MSG "[ INFO ] Differences to stock Pi-hole installation
\nCompared to installing Pi-hole via official one-line installer, DietPi applied the following changes:
- The Pi-hole web UI can be reached on port 8089, i.e. via: http://$(G_GET_NET ip):8089/admin/
- The Pi-hole web UI is secured with the global software password you chose during first run setup, default: \"dietpi\"
- DNS query logging to /var/log/pihole/pihole.log has been disabled. This does not affect the query logs in the web UI and database, but the \"pihole -t\"/\"pihole tail\" command does not work anymore. If you want to use this command or need query logs in /var/log/pihole/pihole.log for other reasons, it can be re-enabled via web UI privacy settings or \"pihole -l on\".
- DNS query logging to database (as shown in web UI) has been reduced to 2 days. This can be changed via web UI privacy settings or e.g. \"pihole-FTL --config database.maxDBdays 7\" to raise it to 7 days.
\nFor further details, read our online docs: https://dietpi.com/docs/software/dns_servers/#pi-hole"
fi
fi

Expand Down Expand Up @@ -12753,6 +12683,27 @@ _EOF_
if To_Uninstall 182 # Unbound
then
# Pi-hole: Assure that it does not resolve via Unbound anymore
# - v6
if [[ $(pihole-FTL -v) == 'v6'* ]]
then
G_DIETPI-NOTIFY 2 'Removing Unbound from Pi-hole upstream DNS servers, and in case add Quad9 as new one.'
local upstreams=() i
read -ra upstreams < <(pihole-FTL --config dns.upstreams)
# Remove array brackets
unset -v 'upstreams[0]' 'upstreams[${#upstreams[@]}]'
for i in "${!upstreams[@]}"
do
# Remove loopback IP (Unbound)
[[ ${upstreams[i]} == '127.0.0.1'* ]] && { unset -v 'upstreams[i]'; break; }
# Remove trailing comma and readd double-quotes removed from pihole-FTL output
upstreams[i]="\"${upstreams[i]%,}\""
done
# Add Quad9 if no upstream DNS server is left
(( ${#upstreams[@]} )) || upstreams=('"9.9.9.9"')
upstreams[0]=${upstreams[*]}
G_EXEC pihole-FTL --config dns.upstreams "[ ${upstreams[0]// /,} ]"
fi
# - v5
if [[ -f '/etc/dnsmasq.d/01-pihole.conf' ]] && grep -q '^[[:blank:]]*server=127.0.0.1' /etc/dnsmasq.d/01-pihole.conf
then
G_DIETPI-NOTIFY 2 'The Pi-hole upstream DNS server has been changed to Quad9 due to Unbound being uninstalled.'
Expand Down Expand Up @@ -13072,29 +13023,33 @@ _EOF_

if To_Uninstall 93 # Pi-hole
then
# Uninstaller
# - Skip dialogue
[[ -f '/opt/pihole/uninstall.sh' ]] && G_EXEC sed --follow-symlinks -i '/^[[:blank:]]*read -rp .*Are you sure you would like to remove.* answer$/c\answer=y' /opt/pihole/uninstall.sh
command -v pihole > /dev/null && G_EXEC_OUTPUT=1 G_EXEC pihole uninstall
# - Call script directly if pihole command was not available (anymore)
[[ -f '/opt/pihole/uninstall.sh' ]] && G_EXEC_OUTPUT=1 G_EXEC /opt/pihole/uninstall.sh

# pihole-FTL service+binary
Remove_Service pihole-FTL
# Cleanup if uninstaller was not available (anymore)
# - Service
Remove_Service pihole-FTL pihole pihole
# - Files
[[ -f '/usr/bin/pihole-FTL' ]] && G_EXEC rm /usr/bin/pihole-FTL

# Dirs
[[ -e '/usr/local/bin/pihole' ]] && G_EXEC rm /usr/local/bin/pihole
# - Dirs
[[ -d '/etc/pihole' ]] && G_EXEC rm -R /etc/pihole
[[ -d '/etc/.pihole' ]] && G_EXEC rm -R /etc/.pihole
[[ -d '/opt/pihole' ]] && G_EXEC rm -R /opt/pihole
[[ -d '/var/www/html/admin' ]] && G_EXEC rm -R /var/www/html/admin
[[ -d '/var/www/html/pihole' ]] && G_EXEC rm -R /var/www/html/pihole

# Symlinks
# v5
# - Symlinks
[[ -L '/var/www/pihole' ]] && G_EXEC rm /var/www/pihole
[[ -L '/var/www/admin' ]] && G_EXEC rm /var/www/admin

# Disable and remove webserver configs
# - Apache
[[ -d '/etc/apache2/sites-available' ]] && G_EXEC rm -f /etc/apache2/sites-{available,enabled}/dietpi-pihole{,-block_public_admin}.conf
# - Lighttpd
[[ -d '/etc/lighttpd/conf-available' ]] && G_EXEC rm -f /etc/lighttpd/conf-{available,enabled}/99-dietpi-pihole{,-block_public_admin}.conf
# - Nginx
# - Webserver configs
[[ -d '/etc/apache2/sites-available' ]] && G_EXEC rm -f /etc/apache2/sites-{available,enabled}/dietpi-pihole*
[[ -d '/etc/lighttpd/conf-available' ]] && G_EXEC rm -f /etc/lighttpd/conf-{available,enabled}/99-dietpi-pihole*
[[ -d '/etc/nginx/sites-dietpi' ]] && G_EXEC rm -f /etc/nginx/sites-dietpi/dietpi-pihole*

# Unbound: Switch port to 53 if it is still installed
Expand Down

0 comments on commit aefa380

Please sign in to comment.