···1313- [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
1414- [Chrysalis](https://github.com/keyboardio/Chrysalis), a graphical configurator for Kaleidoscope-powered keyboards. Available as [programs.chrysalis](#opt-programs.chrysalis.enable).
15151616+- [Pi-hole](https://pi-hole.net/), a DNS sinkhole for advertisements based on Dnsmasq. Available as [services.pihole-ftl](#opt-services.pihole-ftl.enable), and [services.pihole-web](#opt-services.pihole-web.enable) for the web GUI and API.
1717+1618- [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable).
17191820- [LACT](https://github.com/ilya-zlobintsev/LACT), a GPU monitoring and configuration tool, can now be enabled through [services.lact.enable](#opt-services.lact.enable).
···11+{
22+ cfg,
33+ config,
44+ lib,
55+ pkgs,
66+}:
77+88+let
99+ pihole = pkgs.pihole;
1010+ makePayload =
1111+ list:
1212+ builtins.toJSON {
1313+ inherit (list) type enabled;
1414+ address = list.url;
1515+ comment = list.description;
1616+ };
1717+ payloads = map makePayload cfg.lists;
1818+in
1919+''
2020+ # Can't use -u (unset) because api.sh uses API_URL before it is set
2121+ set -eo pipefail
2222+ pihole="${lib.getExe pihole}"
2323+ jq="${lib.getExe pkgs.jq}"
2424+2525+ # If the database doesn't exist, it needs to be created with gravity.sh
2626+ if [ ! -f '${cfg.stateDirectory}'/gravity.db ]; then
2727+ $pihole -g
2828+ # Send SIGRTMIN to FTL, which makes it reload the database, opening the newly created one
2929+ ${pkgs.procps}/bin/kill -s SIGRTMIN $(systemctl show --property MainPID --value ${config.systemd.services.pihole-ftl.name})
3030+ fi
3131+3232+ source ${pihole}/usr/share/pihole/advanced/Scripts/api.sh
3333+ source ${pihole}/usr/share/pihole/advanced/Scripts/utils.sh
3434+3535+ any_failed=0
3636+3737+ addList() {
3838+ local payload="$1"
3939+4040+ echo "Adding list: $payload"
4141+ local result=$(PostFTLData "lists" "$payload")
4242+4343+ local error="$($jq '.error' <<< "$result")"
4444+ if [[ "$error" != "null" ]]; then
4545+ echo "Error: $error"
4646+ any_failed=1
4747+ return
4848+ fi
4949+5050+ id="$($jq '.lists.[].id?' <<< "$result")"
5151+ if [[ "$id" == "null" ]]; then
5252+ any_failed=1
5353+ error="$($jq '.processed.errors.[].error' <<< "$result")"
5454+ echo "Error: $error"
5555+ return
5656+ fi
5757+5858+ echo "Added list ID $id: $result"
5959+ }
6060+6161+ for i in 1 2 3; do
6262+ (TestAPIAvailability) && break
6363+ echo "Retrying API shortly..."
6464+ ${pkgs.coreutils}/bin/sleep .5s
6565+ done;
6666+6767+ LoginAPI
6868+6969+ ${builtins.concatStringsSep "\n" (
7070+ map (
7171+ payload:
7272+ lib.pipe payload [
7373+ lib.strings.escapeShellArg
7474+ (payload: "addList ${payload}")
7575+ ]
7676+ ) payloads
7777+ )}
7878+7979+ # Run gravity.sh to load any new lists
8080+ $pihole -g
8181+ exit $any_failed
8282+''
+128
nixos/modules/services/networking/pihole-ftl.md
···11+# pihole-FTL {#module-services-networking-pihole-ftl}
22+33+*Upstream documentation*: <https://docs.pi-hole.net/ftldns/>
44+55+pihole-FTL is a fork of [Dnsmasq](index.html#module-services-networking-dnsmasq),
66+providing some additional features, including an API for analysis and
77+statistics.
88+99+Note that pihole-FTL and Dnsmasq cannot be enabled at
1010+the same time.
1111+1212+## Configuration {#module-services-networking-pihole-ftl-configuration}
1313+1414+pihole-FTL can be configured with [{option}`services.pihole-ftl.settings`](options.html#opt-services.pihole-ftl.settings), which controls the content of `pihole.toml`.
1515+1616+The template pihole.toml is provided in `pihole-ftl.passthru.settingsTemplate`,
1717+which describes all settings.
1818+1919+Example configuration:
2020+2121+```nix
2222+{
2323+ services.pihole-ftl = {
2424+ enable = true;
2525+ openFirewallDHCP = true;
2626+ queryLogDeleter.enable = true;
2727+ lists = [
2828+ {
2929+ url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
3030+ # Alternatively, use the file from nixpkgs. Note its contents won't be
3131+ # automatically updated by Pi-hole, as it would with an online URL.
3232+ # url = "file://${pkgs.stevenblack-blocklist}/hosts";
3333+ description = "Steven Black's unified adlist";
3434+ }
3535+ ];
3636+ settings = {
3737+ dns = {
3838+ domainNeeded = true;
3939+ expandHosts = true;
4040+ interface = "br-lan";
4141+ listeningMode = "BIND";
4242+ upstreams = [ "127.0.0.1#5053" ];
4343+ };
4444+ dhcp = {
4545+ active = true;
4646+ router = "192.168.10.1";
4747+ start = "192.168.10.2";
4848+ end = "192.168.10.254";
4949+ leaseTime = "1d";
5050+ ipv6 = true;
5151+ multiDNS = true;
5252+ hosts = [
5353+ # Static address for the current host
5454+ "aa:bb:cc:dd:ee:ff,192.168.10.1,${config.networking.hostName},infinite"
5555+ ];
5656+ rapidCommit = true;
5757+ };
5858+ misc.dnsmasq_lines = [
5959+ # This DHCP server is the only one on the network
6060+ "dhcp-authoritative"
6161+ # Source: https://data.iana.org/root-anchors/root-anchors.xml
6262+ "trust-anchor=.,38696,8,2,683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"
6363+ ];
6464+ };
6565+ };
6666+}
6767+```
6868+6969+### Inheriting configuration from Dnsmasq {#module-services-networking-pihole-ftl-configuration-inherit-dnsmasq}
7070+7171+If [{option}`services.pihole-ftl.useDnsmasqConfig`](options.html#opt-services.pihole-ftl.useDnsmasqConfig) is enabled, the configuration [options of the Dnsmasq
7272+module](index.html#module-services-networking-dnsmasq) will be automatically
7373+used by pihole-FTL. Note that this may cause duplicate option errors
7474+depending on pihole-FTL settings.
7575+7676+See the [Dnsmasq
7777+example](index.html#module-services-networking-dnsmasq-configuration-home) for
7878+an exemplar Dnsmasq configuration. Make sure to set
7979+[{option}`services.dnsmasq.enable`](options.html#opt-services.dnsmasq.enable) to false and
8080+[{option}`services.pihole-ftl.enable`](options.html#opt-services.pihole-ftl.enable) to true instead:
8181+8282+```nix
8383+{
8484+ services.pihole-ftl = {
8585+ enable = true;
8686+ useDnsmasqConfig = true;
8787+ };
8888+}
8989+```
9090+9191+### Serving on multiple interfaces {#module-services-networking-pihole-ftl-configuration-multiple-interfaces}
9292+9393+Pi-hole's configuration only supports specifying a single interface. If you want
9494+to configure additional interfaces with different configuration, use
9595+`misc.dnsmasq_lines` to append extra Dnsmasq options.
9696+9797+```nix
9898+{
9999+ services.pihole-ftl = {
100100+ settings.misc.dnsmasq_lines = [
101101+ # Specify the secondary interface
102102+ "interface=enp1s0"
103103+ # A different device is the router on this network, e.g. the one
104104+ # provided by your ISP
105105+ "dhcp-option=enp1s0,option:router,192.168.0.1"
106106+ # Specify the IPv4 ranges to allocate, with a 1-day lease time
107107+ "dhcp-range=enp1s0,192.168.0.10,192.168.0.253,1d"
108108+ # Enable IPv6
109109+ "dhcp-range=::f,::ff,constructor:enp1s0,ra-names,ra-stateless"
110110+ ];
111111+ };
112112+ };
113113+}
114114+```
115115+116116+## Administration {#module-services-networking-pihole-ftl-administration}
117117+118118+*pihole command documentation*: <https://docs.pi-hole.net/main/pihole-command>
119119+120120+Enabling pihole-FTL provides the `pihole` command, which can be used to control
121121+the daemon and some configuration.
122122+123123+Note that in NixOS the script has been patched to remove the reinstallation,
124124+update, and Dnsmasq configuration commands. In NixOS, Pi-hole's configuration is
125125+immutable and must be done with NixOS options.
126126+127127+For more convenient administration and monitoring, see [Pi-hole
128128+Dashboard](#module-services-web-apps-pihole-web)
+483
nixos/modules/services/networking/pihole-ftl.nix
···11+{
22+ config,
33+ lib,
44+ pkgs,
55+ ...
66+}:
77+88+with {
99+ inherit (lib)
1010+ elemAt
1111+ getExe
1212+ hasAttrByPath
1313+ mkEnableOption
1414+ mkIf
1515+ mkOption
1616+ strings
1717+ types
1818+ ;
1919+};
2020+2121+let
2222+ mkDefaults = lib.mapAttrsRecursive (n: v: lib.mkDefault v);
2323+2424+ cfg = config.services.pihole-ftl;
2525+2626+ piholeScript = pkgs.writeScriptBin "pihole" ''
2727+ sudo=exec
2828+ if [[ "$USER" != '${cfg.user}' ]]; then
2929+ sudo='exec /run/wrappers/bin/sudo -u ${cfg.user}'
3030+ fi
3131+ $sudo ${getExe cfg.piholePackage} "$@"
3232+ '';
3333+3434+ settingsFormat = pkgs.formats.toml { };
3535+ settingsFile = settingsFormat.generate "pihole.toml" cfg.settings;
3636+in
3737+{
3838+ options.services.pihole-ftl = {
3939+ enable = mkEnableOption "Pi-hole FTL";
4040+4141+ package = lib.mkPackageOption pkgs "pihole-ftl" { };
4242+ piholePackage = lib.mkPackageOption pkgs "pihole" { };
4343+4444+ privacyLevel = mkOption {
4545+ type = types.numbers.between 0 3;
4646+ description = ''
4747+ Level of detail in generated statistics. 0 enables full statistics, 3
4848+ shows only anonymous statistics.
4949+5050+ See [the documentation](https://docs.pi-hole.net/ftldns/privacylevels).
5151+5252+ Also see services.dnsmasq.settings.log-queries to completely disable
5353+ query logging.
5454+ '';
5555+ default = 0;
5656+ example = "3";
5757+ };
5858+5959+ openFirewallDHCP = mkOption {
6060+ type = types.bool;
6161+ default = false;
6262+ description = "Open ports in the firewall for pihole-FTL's DHCP server.";
6363+ };
6464+6565+ openFirewallWebserver = mkOption {
6666+ type = types.bool;
6767+ default = false;
6868+ description = ''
6969+ Open ports in the firewall for pihole-FTL's webserver, as configured in `settings.webserver.port`.
7070+ '';
7171+ };
7272+7373+ configDirectory = mkOption {
7474+ type = types.path;
7575+ default = "/etc/pihole";
7676+ internal = true;
7777+ readOnly = true;
7878+ description = ''
7979+ Path for pihole configuration.
8080+ pihole does not currently support any path other than /etc/pihole.
8181+ '';
8282+ };
8383+8484+ stateDirectory = mkOption {
8585+ type = types.path;
8686+ default = "/var/lib/pihole";
8787+ description = ''
8888+ Path for pihole state files.
8989+ '';
9090+ };
9191+9292+ logDirectory = mkOption {
9393+ type = types.path;
9494+ default = "/var/log/pihole";
9595+ description = "Path for Pi-hole log files";
9696+ };
9797+9898+ settings = mkOption {
9999+ type = settingsFormat.type;
100100+ description = ''
101101+ Configuration options for pihole.toml.
102102+ See the upstream [documentation](https://docs.pi-hole.net/ftldns/configfile).
103103+ '';
104104+ };
105105+106106+ useDnsmasqConfig = mkOption {
107107+ type = types.bool;
108108+ default = false;
109109+ description = ''
110110+ Import options defined in [](#opt-services.dnsmasq.settings) via
111111+ misc.dnsmasq_lines in Pi-hole's config.
112112+ '';
113113+ };
114114+115115+ pihole = mkOption {
116116+ type = types.package;
117117+ default = piholeScript;
118118+ internal = true;
119119+ description = "Pi-hole admin script";
120120+ };
121121+122122+ lists =
123123+ let
124124+ adlistType = types.submodule {
125125+ options = {
126126+ url = mkOption {
127127+ type = types.str;
128128+ description = "URL of the domain list";
129129+ };
130130+ type = mkOption {
131131+ type = types.enum [
132132+ "allow"
133133+ "block"
134134+ ];
135135+ default = "block";
136136+ description = "Whether domains on this list should be explicitly allowed, or blocked";
137137+ };
138138+ enabled = mkOption {
139139+ type = types.bool;
140140+ default = true;
141141+ description = "Whether this list is enabled";
142142+ };
143143+ description = mkOption {
144144+ type = types.str;
145145+ description = "Description of the list";
146146+ default = "";
147147+ };
148148+ };
149149+ };
150150+ in
151151+ mkOption {
152152+ type = with types; listOf adlistType;
153153+ description = "Deny (or allow) domain lists to use";
154154+ default = [ ];
155155+ example = [
156156+ {
157157+ url = "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts";
158158+ }
159159+ ];
160160+ };
161161+162162+ user = mkOption {
163163+ type = types.str;
164164+ default = "pihole";
165165+ description = "User to run the service as.";
166166+ };
167167+168168+ group = mkOption {
169169+ type = types.str;
170170+ default = "pihole";
171171+ description = "Group to run the service as.";
172172+ };
173173+174174+ queryLogDeleter = {
175175+ enable = mkEnableOption ("Pi-hole FTL DNS query log deleter");
176176+177177+ age = mkOption {
178178+ type = types.int;
179179+ default = 90;
180180+ description = ''
181181+ Delete DNS query logs older than this many days, if
182182+ [](#opt-services.pihole-ftl.queryLogDeleter.enable) is on.
183183+ '';
184184+ };
185185+186186+ interval = mkOption {
187187+ type = types.str;
188188+ default = "weekly";
189189+ description = ''
190190+ How often the query log deleter is run. See systemd.time(7) for more
191191+ information about the format.
192192+ '';
193193+ };
194194+ };
195195+ };
196196+197197+ config = mkIf cfg.enable {
198198+ assertions = [
199199+ {
200200+ assertion = !config.services.dnsmasq.enable;
201201+ message = "pihole-ftl conflicts with dnsmasq. Please disable one of them.";
202202+ }
203203+204204+ {
205205+ assertion =
206206+ builtins.length cfg.lists == 0
207207+ || (
208208+ (hasAttrByPath [ "webserver" "port" ] cfg.settings)
209209+ && !builtins.elem cfg.settings.webserver.port [
210210+ ""
211211+ null
212212+ ]
213213+ );
214214+ message = ''
215215+ The Pi-hole webserver must be enabled for lists set in services.pihole-ftl.lists to be automatically loaded on startup via the web API.
216216+ services.pihole-ftl.settings.port must be defined, e.g. by enabling services.pihole-web.enable and defining services.pihole-web.port.
217217+ '';
218218+ }
219219+220220+ {
221221+ assertion =
222222+ builtins.length cfg.lists == 0
223223+ || !(hasAttrByPath [ "webserver" "api" "cli_pw" ] cfg.settings)
224224+ || cfg.settings.webserver.api.cli_pw == true;
225225+ message = ''
226226+ services.pihole-ftl.settings.webserver.api.cli_pw must be true for lists set in services.pihole-ftl.lists to be automatically loaded on startup.
227227+ This enables an ephemeral password used by the pihole command.
228228+ '';
229229+ }
230230+ ];
231231+232232+ services.pihole-ftl.settings = lib.mkMerge [
233233+ # Defaults
234234+ (mkDefaults {
235235+ misc.readOnly = true; # Prevent config changes via API or CLI by default
236236+ webserver.port = ""; # Disable the webserver by default
237237+ misc.privacyLevel = cfg.privacyLevel;
238238+ })
239239+240240+ # Move state files to cfg.stateDirectory
241241+ {
242242+ # TODO: Pi-hole currently hardcodes dhcp-leasefile this in its
243243+ # generated dnsmasq.conf, and we can't override it
244244+ misc.dnsmasq_lines = [
245245+ # "dhcp-leasefile=${cfg.stateDirectory}/dhcp.leases"
246246+ # "hostsdir=${cfg.stateDirectory}/hosts"
247247+ ];
248248+249249+ files = {
250250+ database = "${cfg.stateDirectory}/pihole-FTL.db";
251251+ gravity = "${cfg.stateDirectory}/gravity.db";
252252+ macvendor = "${cfg.stateDirectory}/gravity.db";
253253+ log.ftl = "${cfg.logDirectory}/FTL.log";
254254+ log.dnsmasq = "${cfg.logDirectory}/pihole.log";
255255+ log.webserver = "${cfg.logDirectory}/webserver.log";
256256+ };
257257+258258+ webserver.tls = "${cfg.stateDirectory}/tls.pem";
259259+ }
260260+261261+ (lib.optionalAttrs cfg.useDnsmasqConfig {
262262+ misc.dnsmasq_lines = lib.pipe config.services.dnsmasq.configFile [
263263+ builtins.readFile
264264+ (lib.strings.splitString "\n")
265265+ (builtins.filter (s: s != ""))
266266+ ];
267267+ })
268268+ ];
269269+270270+ systemd.tmpfiles.rules = [
271271+ "d ${cfg.configDirectory} 0700 ${cfg.user} ${cfg.group} - -"
272272+ "d ${cfg.stateDirectory} 0700 ${cfg.user} ${cfg.group} - -"
273273+ "d ${cfg.logDirectory} 0700 ${cfg.user} ${cfg.group} - -"
274274+ ];
275275+276276+ systemd.services = {
277277+ pihole-ftl =
278278+ let
279279+ setupService = config.systemd.services.pihole-ftl-setup.name;
280280+ in
281281+ {
282282+ description = "Pi-hole FTL";
283283+284284+ after = [ "network.target" ];
285285+ before = [ setupService ];
286286+287287+ wantedBy = [ "multi-user.target" ];
288288+ wants = [ setupService ];
289289+290290+ environment = {
291291+ # Currently unused, but allows the service to be reloaded
292292+ # automatically when the config is changed.
293293+ PIHOLE_CONFIG = settingsFile;
294294+295295+ # pihole is executed by the /actions/gravity API endpoint
296296+ PATH = lib.mkForce (
297297+ lib.makeBinPath [
298298+ cfg.piholePackage
299299+ ]
300300+ );
301301+ };
302302+303303+ serviceConfig = {
304304+ Type = "simple";
305305+ User = cfg.user;
306306+ Group = cfg.group;
307307+ AmbientCapabilities = [
308308+ "CAP_NET_BIND_SERVICE"
309309+ "CAP_NET_RAW"
310310+ "CAP_NET_ADMIN"
311311+ "CAP_SYS_NICE"
312312+ "CAP_IPC_LOCK"
313313+ "CAP_CHOWN"
314314+ "CAP_SYS_TIME"
315315+ ];
316316+ ExecStart = "${getExe cfg.package} no-daemon";
317317+ Restart = "on-failure";
318318+ RestartSec = 1;
319319+ # Hardening
320320+ NoNewPrivileges = true;
321321+ PrivateTmp = true;
322322+ PrivateDevices = true;
323323+ DevicePolicy = "closed";
324324+ ProtectSystem = "strict";
325325+ ProtectHome = "read-only";
326326+ ProtectControlGroups = true;
327327+ ProtectKernelModules = true;
328328+ ProtectKernelTunables = true;
329329+ ReadWritePaths = [
330330+ cfg.configDirectory
331331+ cfg.stateDirectory
332332+ cfg.logDirectory
333333+ ];
334334+ RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
335335+ RestrictNamespaces = true;
336336+ RestrictRealtime = true;
337337+ RestrictSUIDSGID = true;
338338+ MemoryDenyWriteExecute = true;
339339+ LockPersonality = true;
340340+ };
341341+ };
342342+343343+ pihole-ftl-setup = {
344344+ description = "Pi-hole FTL setup";
345345+ # Wait for network so lists can be downloaded
346346+ after = [ "network-online.target" ];
347347+ requires = [ "network-online.target" ];
348348+ serviceConfig = {
349349+ Type = "oneshot";
350350+ User = cfg.user;
351351+ Group = cfg.group;
352352+353353+ # Hardening
354354+ NoNewPrivileges = true;
355355+ PrivateTmp = true;
356356+ PrivateDevices = true;
357357+ DevicePolicy = "closed";
358358+ ProtectSystem = "strict";
359359+ ProtectHome = "read-only";
360360+ ProtectControlGroups = true;
361361+ ProtectKernelModules = true;
362362+ ProtectKernelTunables = true;
363363+ ReadWritePaths = [
364364+ cfg.configDirectory
365365+ cfg.stateDirectory
366366+ cfg.logDirectory
367367+ ];
368368+ RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
369369+ RestrictNamespaces = true;
370370+ RestrictRealtime = true;
371371+ RestrictSUIDSGID = true;
372372+ MemoryDenyWriteExecute = true;
373373+ LockPersonality = true;
374374+ };
375375+ script = import ./pihole-ftl-setup-script.nix {
376376+ inherit
377377+ cfg
378378+ config
379379+ lib
380380+ pkgs
381381+ ;
382382+ };
383383+ };
384384+385385+ pihole-ftl-log-deleter = mkIf cfg.queryLogDeleter.enable {
386386+ description = "Pi-hole FTL DNS query log deleter";
387387+ serviceConfig = {
388388+ Type = "oneshot";
389389+ User = cfg.user;
390390+ Group = cfg.group;
391391+ # Hardening
392392+ NoNewPrivileges = true;
393393+ PrivateTmp = true;
394394+ PrivateDevices = true;
395395+ DevicePolicy = "closed";
396396+ ProtectSystem = "strict";
397397+ ProtectHome = "read-only";
398398+ ProtectControlGroups = true;
399399+ ProtectKernelModules = true;
400400+ ProtectKernelTunables = true;
401401+ ReadWritePaths = [ cfg.stateDirectory ];
402402+ RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
403403+ RestrictNamespaces = true;
404404+ RestrictRealtime = true;
405405+ RestrictSUIDSGID = true;
406406+ MemoryDenyWriteExecute = true;
407407+ LockPersonality = true;
408408+ };
409409+ script =
410410+ let
411411+ days = toString cfg.queryLogDeleter.age;
412412+ database = "${cfg.stateDirectory}/pihole-FTL.db";
413413+ in
414414+ ''
415415+ set -euo pipefail
416416+417417+ echo "Deleting query logs older than ${days} days"
418418+ ${getExe cfg.package} sqlite3 "${database}" "DELETE FROM query_storage WHERE timestamp <= CAST(strftime('%s', date('now', '-${days} day')) AS INT); select changes() from query_storage limit 1"
419419+ '';
420420+ };
421421+ };
422422+423423+ systemd.timers.pihole-ftl-log-deleter = mkIf cfg.queryLogDeleter.enable {
424424+ description = "Pi-hole FTL DNS query log deleter";
425425+ before = [
426426+ config.systemd.services.pihole-ftl.name
427427+ config.systemd.services.pihole-ftl-setup.name
428428+ ];
429429+ wantedBy = [ "timers.target" ];
430430+ timerConfig = {
431431+ OnCalendar = cfg.queryLogDeleter.interval;
432432+ Unit = "pihole-ftl-log-deleter.service";
433433+ };
434434+ };
435435+436436+ networking.firewall = lib.mkMerge [
437437+ (mkIf cfg.openFirewallDHCP {
438438+ allowedUDPPorts = [ 53 ];
439439+ allowedTCPPorts = [ 53 ];
440440+ })
441441+442442+ (mkIf cfg.openFirewallWebserver {
443443+ allowedTCPPorts = lib.pipe cfg.settings.webserver.port [
444444+ (lib.splitString ",")
445445+ (map (
446446+ port:
447447+ lib.pipe port [
448448+ (builtins.split "[[:alpha:]]+")
449449+ builtins.head
450450+ lib.toInt
451451+ ]
452452+ ))
453453+ ];
454454+ })
455455+ ];
456456+457457+ users.users.${cfg.user} = {
458458+ group = cfg.group;
459459+ isSystemUser = true;
460460+ };
461461+462462+ users.groups.${cfg.group} = { };
463463+464464+ environment.etc."pihole/pihole.toml" = {
465465+ source = settingsFile;
466466+ user = cfg.user;
467467+ group = cfg.group;
468468+ mode = "400";
469469+ };
470470+471471+ environment.systemPackages = [ cfg.pihole ];
472472+473473+ services.logrotate.settings.pihole-ftl = {
474474+ enable = true;
475475+ files = [ "${cfg.logDirectory}/FTL.log" ];
476476+ };
477477+ };
478478+479479+ meta = {
480480+ doc = ./pihole-ftl.md;
481481+ maintainers = with lib.maintainers; [ williamvds ];
482482+ };
483483+}
+19
nixos/modules/services/web-apps/pihole-web.md
···11+# Pi-hole Web Dashboard {#module-services-web-apps-pihole-web}
22+33+The Pi-hole suite provides a web GUI for controlling and monitoring
44+[pihole-FTL](index.html#module-services-networking-pihole-ftl).
55+66+## Configuration {#module-services-web-apps-pihole-web-configuration}
77+88+Example configuration:
99+1010+```nix
1111+{
1212+ services.pihole-web = {
1313+ enable = true;
1414+ ports = [ 80 ];
1515+ };
1616+}
1717+```
1818+1919+The dashboard can be configured using [{option}`services.pihole-ftl.settings`](options.html#opt-services.pihole-ftl.settings), in particular the `webserver` subsection.
+104
nixos/modules/services/web-apps/pihole-web.nix
···11+{
22+ config,
33+ lib,
44+ pkgs,
55+ ...
66+}:
77+88+let
99+ cfg = config.services.pihole-web;
1010+in
1111+{
1212+ options.services.pihole-web = {
1313+ enable = lib.mkEnableOption "Pi-hole dashboard";
1414+1515+ package = lib.mkPackageOption pkgs "pihole-web" { };
1616+1717+ hostName = lib.mkOption {
1818+ type = lib.types.str;
1919+ description = "Domain name for the website.";
2020+ default = "pi.hole";
2121+ };
2222+2323+ ports =
2424+ let
2525+ portType = lib.types.submodule {
2626+ options = {
2727+ port = lib.mkOption {
2828+ type = lib.types.port;
2929+ description = "Port to bind";
3030+ };
3131+ optional = lib.mkOption {
3232+ type = lib.types.bool;
3333+ default = false;
3434+ description = "Skip the port if it cannot be bound";
3535+ };
3636+ redirectSSL = lib.mkOption {
3737+ type = lib.types.bool;
3838+ default = false;
3939+ description = "Redirect from this port to the first configured SSL port";
4040+ };
4141+ ssl = lib.mkOption {
4242+ type = lib.types.bool;
4343+ default = false;
4444+ description = "Serve SSL on the port";
4545+ };
4646+ };
4747+ };
4848+ in
4949+ lib.mkOption {
5050+ type = lib.types.listOf (
5151+ lib.types.oneOf [
5252+ lib.types.port
5353+ lib.types.str
5454+ portType
5555+ ]
5656+ );
5757+ description = ''
5858+ Port(s) for the webserver to serve on.
5959+6060+ If provided as a string, optionally append suffixes to control behaviour:
6161+6262+ - `o`: to make the port is optional - failure to bind will not be an error.
6363+ - `s`: for the port to be used for SSL.
6464+ - `r`: for a non-SSL port to redirect to the first available SSL port.
6565+ '';
6666+ example = [
6767+ "80r"
6868+ "443s"
6969+ ];
7070+ apply =
7171+ values:
7272+ let
7373+ convert =
7474+ value:
7575+ if (builtins.typeOf) value == "int" then
7676+ toString value
7777+ else if builtins.typeOf value == "set" then
7878+ lib.strings.concatStrings [
7979+ (toString value.port)
8080+ (lib.optionalString value.optional "o")
8181+ (lib.optionalString value.redirectSSL "r")
8282+ (lib.optionalString value.ssl "s")
8383+ ]
8484+ else
8585+ value;
8686+ in
8787+ lib.strings.concatStringsSep "," (map convert values);
8888+ };
8989+ };
9090+9191+ config = lib.mkIf cfg.enable {
9292+ services.pihole-ftl.settings.webserver = {
9393+ domain = cfg.hostName;
9494+ port = cfg.ports;
9595+ paths.webroot = "${cfg.package}/share/";
9696+ paths.webhome = "/";
9797+ };
9898+ };
9999+100100+ meta = {
101101+ doc = ./pihole-web.md;
102102+ maintainers = with lib.maintainers; [ williamvds ];
103103+ };
104104+}
···21212222 doCheck = true;
23232424- meta = with lib; {
2424+ meta = {
2525 description = "Command line pastebin for sharing terminal output";
2626 longDescription = ''
2727 Fiche is a command line pastebin server for sharing terminal output.
···34343535 homepage = "https://github.com/solusipse/fiche";
3636 changelog = "https://github.com/solusipse/fiche/releases/tag/${version}";
3737- license = licenses.mit;
3838- maintainers = [ maintainers.pinpox ];
3939- platforms = platforms.all;
3737+ license = lib.licenses.mit;
3838+ maintainers = [ lib.maintainers.pinpox ];
3939+ platforms = lib.platforms.all;
4040 mainProgram = "fiche";
4141 };
4242}
+3-3
pkgs/by-name/fi/fierce/package.nix
···27272828 pythonImportsCheck = [ "fierce" ];
29293030- meta = with lib; {
3030+ meta = {
3131 description = "DNS reconnaissance tool for locating non-contiguous IP space";
3232 homepage = "https://github.com/mschwager/fierce";
3333 changelog = "https://github.com/mschwager/fierce/blob/${version}/CHANGELOG.md";
3434- license = licenses.gpl3Plus;
3535- maintainers = with maintainers; [ c0bw3b ];
3434+ license = lib.licenses.gpl3Plus;
3535+ maintainers = with lib.maintainers; [ c0bw3b ];
3636 mainProgram = "fierce";
3737 };
3838}
+3-3
pkgs/by-name/fi/fim-rs/package.nix
···4242 # There is a failure while the binary is checked
4343 doCheck = false;
44444545- meta = with lib; {
4545+ meta = {
4646 description = "Host-based file integrity monitoring tool";
4747 longDescription = ''
4848 FIM is a File Integrity Monitoring tool that tracks any event over your
···5656 '';
5757 homepage = "https://github.com/Achiefs/fim";
5858 changelog = "https://github.com/Achiefs/fim/releases/tag/v${version}";
5959- license = licenses.gpl3Only;
6060- maintainers = with maintainers; [ fab ];
5959+ license = lib.licenses.gpl3Only;
6060+ maintainers = with lib.maintainers; [ fab ];
6161 mainProgram = "fim";
6262 };
6363}
+3-3
pkgs/by-name/fi/findomain/package.nix
···3838 installManPage findomain.1
3939 '';
40404141- meta = with lib; {
4141+ meta = {
4242 description = "Fastest and cross-platform subdomain enumerator";
4343 homepage = "https://github.com/Findomain/Findomain";
4444 changelog = "https://github.com/Findomain/Findomain/releases/tag/${version}";
4545- license = licenses.gpl3Plus;
4646- maintainers = with maintainers; [
4545+ license = lib.licenses.gpl3Plus;
4646+ maintainers = with lib.maintainers; [
4747 Br1ght0ne
4848 figsoda
4949 ];
+3-3
pkgs/by-name/fi/fingerprintx/package.nix
···2525 # Tests require network access
2626 doCheck = false;
27272828- meta = with lib; {
2828+ meta = {
2929 description = "Standalone utility for service discovery on open ports";
3030 mainProgram = "fingerprintx";
3131 homepage = "https://github.com/praetorian-inc/fingerprintx";
3232 changelog = "https://github.com/praetorian-inc/fingerprintx/releases/tag/v${version}";
3333- license = licenses.asl20;
3434- maintainers = with maintainers; [ fab ];
3333+ license = lib.licenses.asl20;
3434+ maintainers = with lib.maintainers; [ fab ];
3535 };
3636}
···4343 # depends on cpu instructions that may not be available on builders
4444 doCheck = false;
45454646- meta = with lib; {
4646+ meta = {
4747 description = "Small programming language for writing short programs processing textual data";
4848 mainProgram = "frawk";
4949 homepage = "https://github.com/ezrosent/frawk";
5050 changelog = "https://github.com/ezrosent/frawk/releases/tag/v${version}";
5151- license = with licenses; [
5151+ license = with lib.licenses; [
5252 mit # or
5353 asl20
5454 ];
5555- maintainers = with maintainers; [ figsoda ];
5555+ maintainers = with lib.maintainers; [ figsoda ];
5656 };
5757}
+3-3
pkgs/by-name/fr/fre/package.nix
···1818 useFetchCargoVendor = true;
1919 cargoHash = "sha256-07qKG4ju2UOkTcgWAl2U0uqQZyiosK1UH/M2BvwMAaU=";
20202121- meta = with lib; {
2121+ meta = {
2222 description = "CLI tool for tracking your most-used directories and files";
2323 homepage = "https://github.com/camdencheek/fre";
2424 changelog = "https://github.com/camdencheek/fre/blob/${version}/CHANGELOG.md";
2525- license = with licenses; [ mit ];
2626- maintainers = with maintainers; [ gaykitty ];
2525+ license = with lib.licenses; [ mit ];
2626+ maintainers = with lib.maintainers; [ gaykitty ];
2727 mainProgram = "fre";
2828 };
2929}
+3-3
pkgs/by-name/fr/freenukum/package.nix
···7070 install -Dm644 "${desktopItem}/share/applications/"* -t $out/share/applications/
7171 '';
72727373- meta = with lib; {
7373+ meta = {
7474 description = "Clone of the original Duke Nukum 1 Jump'n Run game";
7575 homepage = "https://salsa.debian.org/silwol/freenukum";
7676 changelog = "https://salsa.debian.org/silwol/freenukum/-/blob/v${version}/CHANGELOG.md";
7777- license = licenses.agpl3Plus;
7878- maintainers = with maintainers; [ _0x4A6F ];
7777+ license = lib.licenses.agpl3Plus;
7878+ maintainers = with lib.maintainers; [ _0x4A6F ];
7979 broken = stdenv.hostPlatform.isDarwin;
8080 };
8181}
+4-4
pkgs/by-name/fr/freetds/package.nix
···3131 pkg-config
3232 ];
33333434- meta = with lib; {
3434+ meta = {
3535 description = "Libraries to natively talk to Microsoft SQL Server and Sybase databases";
3636 homepage = "https://www.freetds.org";
3737 changelog = "https://github.com/FreeTDS/freetds/releases/tag/v${version}";
3838- license = licenses.lgpl2;
3939- maintainers = with maintainers; [ peterhoeg ];
4040- platforms = platforms.all;
3838+ license = lib.licenses.lgpl2;
3939+ maintainers = with lib.maintainers; [ peterhoeg ];
4040+ platforms = lib.platforms.all;
4141 };
4242}
+4-4
pkgs/by-name/fr/frotz/package.nix
···48484949 installFlags = [ "PREFIX=$(out)" ];
50505151- meta = with lib; {
5151+ meta = {
5252 homepage = "https://davidgriffith.gitlab.io/frotz/";
5353 changelog = "https://gitlab.com/DavidGriffith/frotz/-/raw/${version}/NEWS";
5454 description = "Z-machine interpreter for Infocom games and other interactive fiction";
5555 mainProgram = "frotz";
5656- platforms = platforms.unix;
5757- maintainers = with maintainers; [
5656+ platforms = lib.platforms.unix;
5757+ maintainers = with lib.maintainers; [
5858 nicknovitski
5959 ddelabru
6060 ];
6161- license = licenses.gpl2Plus;
6161+ license = lib.licenses.gpl2Plus;
6262 };
6363}
+4-4
pkgs/by-name/ga/galene/package.nix
···3838 tests.vm = nixosTests.galene.basic;
3939 };
40404141- meta = with lib; {
4141+ meta = {
4242 description = "Videoconferencing server that is easy to deploy, written in Go";
4343 homepage = "https://github.com/jech/galene";
4444 changelog = "https://github.com/jech/galene/raw/galene-${version}/CHANGES";
4545- license = licenses.mit;
4646- platforms = platforms.linux;
4545+ license = lib.licenses.mit;
4646+ platforms = lib.platforms.linux;
4747 teams = [ lib.teams.ngi ];
4848- maintainers = with maintainers; [
4848+ maintainers = with lib.maintainers; [
4949 rgrunbla
5050 erdnaxe
5151 ];
+3-3
pkgs/by-name/ga/galer/package.nix
···17171818 vendorHash = "sha256-BS7ZUq8/swZpTaYGjiF5OuZXQpoosZ3mdF9v1euijxo=";
19192020- meta = with lib; {
2020+ meta = {
2121 description = "Tool to fetch URLs from HTML attributes";
2222 homepage = "https://github.com/dwisiswant0/galer";
2323 changelog = "https://github.com/dwisiswant0/galer/releases/tag/v${version}";
2424- license = licenses.mit;
2525- maintainers = with maintainers; [ fab ];
2424+ license = lib.licenses.mit;
2525+ maintainers = with lib.maintainers; [ fab ];
2626 mainProgram = "galer";
2727 };
2828}
+4-4
pkgs/by-name/ga/gallia/package.nix
···46464747 pythonImportsCheck = [ "gallia" ];
48484949- meta = with lib; {
4949+ meta = {
5050 description = "Extendable Pentesting Framework for the Automotive Domain";
5151 homepage = "https://github.com/Fraunhofer-AISEC/gallia";
5252 changelog = "https://github.com/Fraunhofer-AISEC/gallia/releases/tag/v${version}";
5353- license = with licenses; [ asl20 ];
5454- maintainers = with maintainers; [
5353+ license = with lib.licenses; [ asl20 ];
5454+ maintainers = with lib.maintainers; [
5555 fab
5656 rumpelsepp
5757 ];
5858- platforms = platforms.linux;
5858+ platforms = lib.platforms.linux;
5959 };
6060}
+3-3
pkgs/by-name/ga/gam/package.nix
···6363 runHook postCheck
6464 '';
65656666- meta = with lib; {
6666+ meta = {
6767 description = "Command line management for Google Workspace";
6868 mainProgram = "gam";
6969 homepage = "https://github.com/GAM-team/GAM/wiki";
7070 changelog = "https://github.com/GAM-team/GAM/releases/tag/v${version}";
7171- license = licenses.asl20;
7272- maintainers = with maintainers; [ thanegill ];
7171+ license = lib.licenses.asl20;
7272+ maintainers = with lib.maintainers; [ thanegill ];
7373 };
74747575}
+4-4
pkgs/by-name/ga/game-rs/package.nix
···23232424 propagatedBuildInputs = [ steam-run ];
25252626- meta = with lib; {
2626+ meta = {
2727 description = "Minimal CLI game launcher for linux";
2828 homepage = "https://github.com/amanse/game-rs";
2929 changelog = "https://github.com/Amanse/game-rs/releases/tag/v${version}";
3030- license = with licenses; [ mit ];
3131- maintainers = with maintainers; [ amanse ];
3232- platforms = platforms.linux;
3030+ license = with lib.licenses; [ mit ];
3131+ maintainers = with lib.maintainers; [ amanse ];
3232+ platforms = lib.platforms.linux;
3333 };
3434}
+3-3
pkgs/by-name/ga/gato/package.nix
···4040 "gato"
4141 ];
42424343- meta = with lib; {
4343+ meta = {
4444 description = "GitHub Self-Hosted Runner Enumeration and Attack Tool";
4545 homepage = "https://github.com/praetorian-inc/gato";
4646 changelog = "https://github.com/praetorian-inc/gato/releases/tag/${version}";
4747- license = licenses.asl20;
4848- maintainers = with maintainers; [ fab ];
4747+ license = lib.licenses.asl20;
4848+ maintainers = with lib.maintainers; [ fab ];
4949 mainProgram = "gato";
5050 };
5151}
···165165166166 passthru.tests = { inherit (nixosTests) mediatomb; };
167167168168- meta = with lib; {
168168+ meta = {
169169 homepage = "https://docs.gerbera.io/";
170170 changelog = "https://github.com/gerbera/gerbera/releases/tag/v${version}";
171171 description = "UPnP Media Server for 2024";
···174174 It allows to stream your digital media through your home network and consume it on all kinds
175175 of UPnP supporting devices.
176176 '';
177177- license = licenses.gpl2Only;
178178- maintainers = with maintainers; [ ardumont ];
179179- platforms = platforms.linux;
177177+ license = lib.licenses.gpl2Only;
178178+ maintainers = with lib.maintainers; [ ardumont ];
179179+ platforms = lib.platforms.linux;
180180 mainProgram = "gerbera";
181181 };
182182}
···30303131 doCheck = true;
32323333- meta = with lib; {
3333+ meta = {
3434 description = "Go symbol recovery tool";
3535 mainProgram = "GoReSym";
3636 homepage = "https://github.com/mandiant/GoReSym";
3737 changelog = "https://github.com/mandiant/GoReSym/releases/tag/v${version}";
3838- license = licenses.mit;
3939- maintainers = with maintainers; [ pyrox0 ];
3838+ license = lib.licenses.mit;
3939+ maintainers = with lib.maintainers; [ pyrox0 ];
4040 };
4141}
+3-3
pkgs/by-name/go/gorilla-cli/package.nix
···3030 # no tests
3131 doCheck = false;
32323333- meta = with lib; {
3333+ meta = {
3434 description = "LLMs for your CLI";
3535 homepage = "https://github.com/gorilla-llm/gorilla-cli";
3636 changelog = "https://github.com/gorilla-llm/gorilla-cli/releases/tag/${version}";
3737- license = licenses.asl20;
3838- maintainers = with maintainers; [ happysalada ];
3737+ license = lib.licenses.asl20;
3838+ maintainers = with lib.maintainers; [ happysalada ];
3939 mainProgram = "gorilla";
4040 };
4141}
+4-4
pkgs/by-name/go/goss/package.nix
···6060 updateScript = nix-update-script { };
6161 };
62626363- meta = with lib; {
6363+ meta = {
6464 homepage = "https://github.com/goss-org/goss/";
6565 changelog = "https://github.com/goss-org/goss/releases/tag/v${version}";
6666 description = "Quick and easy server validation";
···6969 It eases the process of writing tests by allowing the user to generate tests from the current system state.
7070 Once the test suite is written they can be executed, waited-on, or served as a health endpoint.
7171 '';
7272- license = licenses.asl20;
7272+ license = lib.licenses.asl20;
7373 mainProgram = "goss";
7474- maintainers = with maintainers; [
7474+ maintainers = with lib.maintainers; [
7575 hyzual
7676 jk
7777 anthonyroussel
7878 ];
7979- platforms = platforms.linux ++ platforms.darwin;
7979+ platforms = lib.platforms.linux ++ lib.platforms.darwin;
8080 };
8181}
+3-3
pkgs/by-name/go/gotestfmt/package.nix
···17171818 vendorHash = null;
19192020- meta = with lib; {
2020+ meta = {
2121 description = "Go test output for humans";
2222 homepage = "https://github.com/gotesttools/gotestfmt";
2323 changelog = "https://github.com/GoTestTools/gotestfmt/releases/tag/v${version}";
2424- license = licenses.unlicense;
2525- maintainers = with maintainers; [ urandom ];
2424+ license = lib.licenses.unlicense;
2525+ maintainers = with lib.maintainers; [ urandom ];
2626 };
2727}
+3-3
pkgs/by-name/go/gotestwaf/package.nix
···33333434 versionCheckProgramArg = "--version";
35353636- meta = with lib; {
3636+ meta = {
3737 description = "Tool for API and OWASP attack simulation";
3838 homepage = "https://github.com/wallarm/gotestwaf";
3939 changelog = "https://github.com/wallarm/gotestwaf/releases/tag/v${version}";
4040- license = licenses.mit;
4141- maintainers = with maintainers; [ fab ];
4040+ license = lib.licenses.mit;
4141+ maintainers = with lib.maintainers; [ fab ];
4242 mainProgram = "gotestwaf";
4343 };
4444}
+3-3
pkgs/by-name/go/gotosocial/package.nix
···62626363 passthru.tests.gotosocial = nixosTests.gotosocial;
64646565- meta = with lib; {
6565+ meta = {
6666 homepage = "https://gotosocial.org";
6767 changelog = "https://codeberg.org/superseriousbusiness/gotosocial/releases/tag/v${version}";
6868 description = "Fast, fun, ActivityPub server, powered by Go";
···7373 advertised to! A light-weight alternative to Mastodon
7474 and Pleroma, with support for clients!
7575 '';
7676- maintainers = with maintainers; [ blakesmith ];
7777- license = licenses.agpl3Only;
7676+ maintainers = with lib.maintainers; [ blakesmith ];
7777+ license = lib.licenses.agpl3Only;
7878 };
7979}
+3-3
pkgs/by-name/go/goverview/package.nix
···3535 # Tests require network access
3636 doCheck = false;
37373838- meta = with lib; {
3838+ meta = {
3939 description = "Tool to get an overview of the list of URLs";
4040 mainProgram = "goverview";
4141 homepage = "https://github.com/j3ssie/goverview";
4242 changelog = "https://github.com/j3ssie/goverview/releases/tag/v${version}";
4343- license = licenses.mit;
4444- maintainers = with maintainers; [ fab ];
4343+ license = lib.licenses.mit;
4444+ maintainers = with lib.maintainers; [ fab ];
4545 };
4646}
+3-3
pkgs/by-name/go/govulncheck/package.nix
···3737 "-w"
3838 ];
39394040- meta = with lib; {
4040+ meta = {
4141 homepage = "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck";
4242 downloadPage = "https://github.com/golang/vuln";
4343 changelog = "https://github.com/golang/vuln/releases/tag/v${version}";
···6464 example, a dependency with a Windows-specific vulnerability will not be
6565 reported for a Linux build.
6666 '';
6767- license = with licenses; [ bsd3 ];
6868- maintainers = with maintainers; [
6767+ license = with lib.licenses; [ bsd3 ];
6868+ maintainers = with lib.maintainers; [
6969 jk
7070 SuperSandro2000
7171 ];
+3-3
pkgs/by-name/gr/grafana-dash-n-grab/package.nix
···2828 # you don't have grafana running.
2929 doCheck = false;
30303131- meta = with lib; {
3131+ meta = {
3232 description = "Grafana Dash-n-Grab (gdg) -- backup and restore Grafana dashboards, datasources, and other entities";
3333- license = licenses.bsd3;
3333+ license = lib.licenses.bsd3;
3434 homepage = "https://github.com/esnet/gdg";
3535- teams = [ teams.bitnomial ];
3535+ teams = [ lib.teams.bitnomial ];
3636 mainProgram = "gdg";
3737 changelog = "https://github.com/esnet/gdg/releases/tag/v${version}";
3838 };
+3-3
pkgs/by-name/gr/grafana-loki/package.nix
···6969 "-X ${t}.Revision=unknown"
7070 ];
71717272- meta = with lib; {
7272+ meta = {
7373 description = "Like Prometheus, but for logs";
7474 mainProgram = "promtail";
7575- license = with licenses; [
7575+ license = with lib.licenses; [
7676 agpl3Only
7777 asl20
7878 ];
7979 homepage = "https://grafana.com/oss/loki/";
8080 changelog = "https://github.com/grafana/loki/releases/tag/v${version}";
8181- maintainers = with maintainers; [
8181+ maintainers = with lib.maintainers; [
8282 willibutz
8383 globin
8484 mmahut
+3-3
pkgs/by-name/gr/granted/package.nix
···85858686 passthru.updateScript = nix-update-script { };
87878888- meta = with lib; {
8888+ meta = {
8989 description = "Easiest way to access your cloud";
9090 homepage = "https://github.com/common-fate/granted";
9191 changelog = "https://github.com/common-fate/granted/releases/tag/${version}";
9292- license = licenses.mit;
9393- maintainers = with maintainers; [
9292+ license = lib.licenses.mit;
9393+ maintainers = with lib.maintainers; [
9494 jlbribeiro
9595 ];
9696 };
+3-3
pkgs/by-name/gr/graphinder/package.nix
···4747 "test_is_gql_endpoint"
4848 ];
49495050- meta = with lib; {
5050+ meta = {
5151 description = "Tool to find GraphQL endpoints using subdomain enumeration";
5252 mainProgram = "graphinder";
5353 homepage = "https://github.com/Escape-Technologies/graphinder";
5454 changelog = "https://github.com/Escape-Technologies/graphinder/releases/tag/v${version}";
5555- license = with licenses; [ mit ];
5656- maintainers = with maintainers; [ fab ];
5555+ license = with lib.licenses; [ mit ];
5656+ maintainers = with lib.maintainers; [ fab ];
5757 };
5858}
+3-3
pkgs/by-name/gr/greenmask/package.nix
···3939 --replace-fail "TestS3Storage" "SkipTestS3Storage"
4040 '';
41414242- meta = with lib; {
4242+ meta = {
4343 description = "PostgreSQL database anonymization tool";
4444 homepage = "https://github.com/GreenmaskIO/greenmask";
4545 changelog = "https://github.com/GreenmaskIO/greenmask/releases/tag/v${version}";
4646- license = licenses.asl20;
4747- maintainers = with maintainers; [ fab ];
4646+ license = lib.licenses.asl20;
4747+ maintainers = with lib.maintainers; [ fab ];
4848 mainProgram = "greenmask";
4949 };
5050}
+3-3
pkgs/by-name/gr/grex/package.nix
···2323 $out/bin/grex --help > /dev/null
2424 '';
25252626- meta = with lib; {
2626+ meta = {
2727 description = "Command-line tool for generating regular expressions from user-provided test cases";
2828 homepage = "https://github.com/pemistahl/grex";
2929 changelog = "https://github.com/pemistahl/grex/releases/tag/v${version}";
3030- license = licenses.asl20;
3030+ license = lib.licenses.asl20;
3131 mainProgram = "grex";
3232- maintainers = with maintainers; [
3232+ maintainers = with lib.maintainers; [
3333 SuperSandro2000
3434 mfrw
3535 ];
···7979 rev-prefix = "24.35.30872.";
8080 };
81818282- meta = with lib; {
8282+ meta = {
8383 description = "Intel Graphics Compute Runtime oneAPI Level Zero and OpenCL with support for Gen8, Gen9 and Gen11 GPUs";
8484 mainProgram = "ocloc";
8585 homepage = "https://github.com/intel/compute-runtime";
8686 changelog = "https://github.com/intel/compute-runtime/releases/tag/${version}";
8787- license = licenses.mit;
8787+ license = lib.licenses.mit;
8888 platforms = [ "x86_64-linux" ];
8989- maintainers = with maintainers; [ fleaz ];
8989+ maintainers = with lib.maintainers; [ fleaz ];
9090 };
9191}
+3-3
pkgs/by-name/in/intel-compute-runtime/package.nix
···6969 $out/lib/intel-opencl/libigdrcl.so
7070 '';
71717272- meta = with lib; {
7272+ meta = {
7373 description = "Intel Graphics Compute Runtime oneAPI Level Zero and OpenCL, supporting 12th Gen and newer";
7474 mainProgram = "ocloc";
7575 homepage = "https://github.com/intel/compute-runtime";
7676 changelog = "https://github.com/intel/compute-runtime/releases/tag/${version}";
7777- license = licenses.mit;
7777+ license = lib.licenses.mit;
7878 platforms = [
7979 "x86_64-linux"
8080 "aarch64-linux"
8181 ];
8282- maintainers = with maintainers; [ SuperSandro2000 ];
8282+ maintainers = with lib.maintainers; [ SuperSandro2000 ];
8383 };
8484}
+3-3
pkgs/by-name/in/intel-gpu-tools/package.nix
···98989999 hardeningDisable = [ "bindnow" ];
100100101101- meta = with lib; {
101101+ meta = {
102102 changelog = "https://gitlab.freedesktop.org/drm/igt-gpu-tools/-/blob/v${version}/NEWS";
103103 homepage = "https://drm.pages.freedesktop.org/igt-gpu-tools/";
104104 description = "Tools for development and testing of the Intel DRM driver";
105105- license = licenses.mit;
105105+ license = lib.licenses.mit;
106106 platforms = [
107107 "x86_64-linux"
108108 "i686-linux"
109109 ];
110110- maintainers = with maintainers; [ pSub ];
110110+ maintainers = with lib.maintainers; [ pSub ];
111111 };
112112}
+4-4
pkgs/by-name/in/intel-media-driver/package.nix
···7272 inherit (pkgsi686Linux) intel-media-driver;
7373 };
74747575- meta = with lib; {
7575+ meta = {
7676 description = "Intel Media Driver for VAAPI — Broadwell+ iGPUs";
7777 longDescription = ''
7878 The Intel Media Driver for VAAPI is a new VA-API (Video Acceleration API)
···8181 '';
8282 homepage = "https://github.com/intel/media-driver";
8383 changelog = "https://github.com/intel/media-driver/releases/tag/intel-media-${version}";
8484- license = with licenses; [
8484+ license = with lib.licenses; [
8585 bsd3
8686 mit
8787 ];
8888- platforms = platforms.linux;
8989- maintainers = with maintainers; [ SuperSandro2000 ];
8888+ platforms = lib.platforms.linux;
8989+ maintainers = with lib.maintainers; [ SuperSandro2000 ];
9090 };
9191}
+3-3
pkgs/by-name/in/interactsh/package.nix
···2626 # Test files are not part of the release tarball
2727 doCheck = false;
28282929- meta = with lib; {
2929+ meta = {
3030 description = "Out of bounds interaction gathering server and client library";
3131 longDescription = ''
3232 Interactsh is an Open-Source Solution for Out of band Data Extraction,
···3535 '';
3636 homepage = "https://github.com/projectdiscovery/interactsh";
3737 changelog = "https://github.com/projectdiscovery/interactsh/releases/tag/v${version}";
3838- license = licenses.mit;
3939- maintainers = with maintainers; [ hanemile ];
3838+ license = lib.licenses.mit;
3939+ maintainers = with lib.maintainers; [ hanemile ];
4040 };
4141}
···17171818 vendorHash = null;
19192020- meta = with lib; {
2020+ meta = {
2121 description = "ircdog is a simple wrapper over the raw IRC protocol that can respond to pings, and interprets formatting codes";
2222 mainProgram = "ircdog";
2323 homepage = "https://github.com/ergochat/ircdog";
2424 changelog = "https://github.com/ergochat/ircdog/releases/tag/v${version}";
2525- license = licenses.isc;
2626- maintainers = with maintainers; [ hexa ];
2525+ license = lib.licenses.isc;
2626+ maintainers = with lib.maintainers; [ hexa ];
2727 };
2828}
+4-4
pkgs/by-name/ir/irqbalance/package.nix
···4949 --replace-fail ' $IRQBALANCE_ARGS' ""
5050 '';
51515252- meta = with lib; {
5252+ meta = {
5353 homepage = "https://github.com/Irqbalance/irqbalance";
5454 changelog = "https://github.com/Irqbalance/irqbalance/releases/tag/v${version}";
5555 description = "Daemon to help balance the cpu load generated by interrupts across all of a systems cpus";
5656- license = licenses.gpl2Only;
5757- platforms = platforms.linux;
5858- maintainers = with maintainers; [ moni ];
5656+ license = lib.licenses.gpl2Only;
5757+ platforms = lib.platforms.linux;
5858+ maintainers = with lib.maintainers; [ moni ];
5959 };
6060}
+3-3
pkgs/by-name/ir/irrd/package.nix
···174174 "test_050_non_json_response"
175175 ];
176176177177- meta = with lib; {
177177+ meta = {
178178 changelog = "https://irrd.readthedocs.io/en/v${version}/releases/";
179179 description = "Internet Routing Registry database server, processing IRR objects in the RPSL format";
180180- license = licenses.mit;
180180+ license = lib.licenses.mit;
181181 homepage = "https://github.com/irrdnet/irrd";
182182- teams = [ teams.wdz ];
182182+ teams = [ lib.teams.wdz ];
183183 };
184184}
+3-3
pkgs/by-name/ja/jaeles/package.nix
···2020 # Tests want to download signatures
2121 doCheck = false;
22222323- meta = with lib; {
2323+ meta = {
2424 description = "Tool for automated Web application testing";
2525 mainProgram = "jaeles";
2626 homepage = "https://github.com/jaeles-project/jaeles";
2727 changelog = "https://github.com/jaeles-project/jaeles/releases/tag/beta-v${version}";
2828- license = licenses.mit;
2929- maintainers = with maintainers; [ fab ];
2828+ license = lib.licenses.mit;
2929+ maintainers = with lib.maintainers; [ fab ];
3030 };
3131}
···6262 --zsh <($out/bin/ko completion zsh)
6363 '';
64646565- meta = with lib; {
6565+ meta = {
6666 homepage = "https://github.com/ko-build/ko";
6767 changelog = "https://github.com/ko-build/ko/releases/tag/v${version}";
6868 description = "Build and deploy Go applications";
···7373 ko builds images by effectively executing go build on your local machine, and as such doesn't require docker to be installed. This can make it a good fit for lightweight CI/CD use cases.
7474 ko makes multi-platform builds easy, produces SBOMs by default, and includes support for simple YAML templating which makes it a powerful tool for Kubernetes applications.
7575 '';
7676- license = licenses.asl20;
7777- maintainers = with maintainers; [
7676+ license = lib.licenses.asl20;
7777+ maintainers = with lib.maintainers; [
7878 nickcao
7979 jk
8080 vdemeester
+3-3
pkgs/by-name/ko/konstraint/package.nix
···4343 runHook postInstallCheck
4444 '';
45454646- meta = with lib; {
4646+ meta = {
4747 homepage = "https://github.com/plexsystems/konstraint";
4848 changelog = "https://github.com/plexsystems/konstraint/releases/tag/v${version}";
4949 description = "Policy management tool for interacting with Gatekeeper";
···5353 Gatekeeper. Automatically copy Rego to the ConstraintTemplate. Automatically update all ConstraintTemplates with
5454 library changes. Enable writing the same policies for Conftest and Gatekeeper.
5555 '';
5656- license = licenses.mit;
5757- maintainers = with maintainers; [ jk ];
5656+ license = lib.licenses.mit;
5757+ maintainers = with lib.maintainers; [ jk ];
5858 };
5959}
···9898 updateScript = nix-update-script { };
9999 };
100100101101- meta = with lib; {
101101+ meta = {
102102 homepage = "https://github.com/koreader/koreader";
103103 changelog = "https://github.com/koreader/koreader/releases/tag/v${version}";
104104 description = "An ebook reader application supporting PDF, DjVu, EPUB, FB2 and many more formats, running on Cervantes, Kindle, Kobo, PocketBook and Android devices";
105105 mainProgram = "koreader";
106106- sourceProvenance = with sourceTypes; [ binaryNativeCode ];
106106+ sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
107107 platforms = [
108108 "aarch64-linux"
109109 "armv7l-linux"
110110 "x86_64-linux"
111111 ];
112112- license = licenses.agpl3Only;
113113- maintainers = with maintainers; [
112112+ license = lib.licenses.agpl3Only;
113113+ maintainers = with lib.maintainers; [
114114 contrun
115115 neonfuz
116116 liberodark
+3-3
pkgs/by-name/ku/kube-bench/package.nix
···4444 runHook postInstallCheck
4545 '';
46464747- meta = with lib; {
4747+ meta = {
4848 homepage = "https://github.com/aquasecurity/kube-bench";
4949 changelog = "https://github.com/aquasecurity/kube-bench/releases/tag/v${version}";
5050 description = "Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark";
5151 mainProgram = "kube-bench";
5252- license = licenses.asl20;
5353- maintainers = with maintainers; [ jk ];
5252+ license = lib.licenses.asl20;
5353+ maintainers = with lib.maintainers; [ jk ];
5454 };
5555}
+3-3
pkgs/by-name/ku/kube-capacity/package.nix
···17171818 vendorHash = "sha256-YME4AXpHvr1bNuc/HoHxam+7ZkwLzjhIvFSfD4hga1A=";
19192020- meta = with lib; {
2020+ meta = {
2121 description = "A simple CLI that provides an overview of the resource requests, limits, and utilization in a Kubernetes cluster";
2222 mainProgram = "kube-capacity";
2323 homepage = "https://github.com/robscott/kube-capacity";
2424 changelog = "https://github.com/robscott/kube-capacity/releases/tag/v${version}";
2525- license = licenses.asl20;
2626- maintainers = [ maintainers.bryanasdev000 ];
2525+ license = lib.licenses.asl20;
2626+ maintainers = [ lib.maintainers.bryanasdev000 ];
2727 };
2828}
···6464 # Project has no tests
6565 doCheck = false;
66666767- meta = with lib; {
6767+ meta = {
6868 description = "Network based LED effect controller with support for advanced real-time audio effects";
6969 homepage = "https://github.com/LedFx/LedFx";
7070 changelog = "https://github.com/LedFx/LedFx/blob/${version}/CHANGELOG.rst";
7171- license = licenses.gpl3Only;
7272- teams = [ teams.c3d2 ];
7171+ license = lib.licenses.gpl3Only;
7272+ teams = [ lib.teams.c3d2 ];
7373 mainProgram = "ledfx";
7474 };
7575}
+3-3
pkgs/by-name/le/ledger-autosync/package.nix
···3333 python3Packages.pytestCheckHook
3434 ];
35353636- meta = with lib; {
3636+ meta = {
3737 homepage = "https://github.com/egh/ledger-autosync";
3838 changelog = "https://github.com/egh/ledger-autosync/releases/tag/v${version}";
3939 description = "OFX/CSV autosync for ledger and hledger";
4040- license = licenses.gpl3Plus;
4141- maintainers = with maintainers; [ eamsden ];
4040+ license = lib.licenses.gpl3Plus;
4141+ maintainers = with lib.maintainers; [ eamsden ];
4242 };
4343}
+4-4
pkgs/by-name/le/ledger/package.nix
···108108 installShellCompletion --cmd ledger --bash $src/contrib/ledger-completion.bash
109109 '';
110110111111- meta = with lib; {
111111+ meta = {
112112 description = "Double-entry accounting system with a command-line reporting interface";
113113 mainProgram = "ledger";
114114 homepage = "https://www.ledger-cli.org/";
115115 changelog = "https://github.com/ledger/ledger/raw/v${version}/NEWS.md";
116116- license = licenses.bsd3;
116116+ license = lib.licenses.bsd3;
117117 longDescription = ''
118118 Ledger is a powerful, double-entry accounting system that is accessed
119119 from the UNIX command-line. This may put off some users, as there is
120120 no flashy UI, but for those who want unparalleled reporting access to
121121 their data, there really is no alternative.
122122 '';
123123- platforms = platforms.all;
124124- maintainers = with maintainers; [ jwiegley ];
123123+ platforms = lib.platforms.all;
124124+ maintainers = with lib.maintainers; [ jwiegley ];
125125 };
126126}
+3-3
pkgs/by-name/le/leetgo/package.nix
···3535 --zsh <($out/bin/leetgo completion zsh)
3636 '';
37373838- meta = with lib; {
3838+ meta = {
3939 description = "A command-line tool for LeetCode";
4040 homepage = "https://github.com/j178/leetgo";
4141 changelog = "https://github.com/j178/leetgo/releases/tag/v${version}";
4242- license = licenses.mit;
4343- maintainers = with maintainers; [ Ligthiago ];
4242+ license = lib.licenses.mit;
4343+ maintainers = with lib.maintainers; [ Ligthiago ];
4444 mainProgram = "leetgo";
4545 };
4646}
+3-3
pkgs/by-name/le/legba/package.nix
···3434 # Paho C test fails due to permission issue
3535 doCheck = false;
36363737- meta = with lib; {
3737+ meta = {
3838 description = "Multiprotocol credentials bruteforcer / password sprayer and enumerator";
3939 homepage = "https://github.com/evilsocket/legba";
4040 changelog = "https://github.com/evilsocket/legba/releases/tag/v${version}";
4141- license = licenses.gpl3Only;
4242- maintainers = with maintainers; [ mikaelfangel ];
4141+ license = lib.licenses.gpl3Only;
4242+ maintainers = with lib.maintainers; [ mikaelfangel ];
4343 mainProgram = "legba";
4444 };
4545}
+3-3
pkgs/by-name/le/legitify/package.nix
···2727 rm e2e/e2e_test.go # tests requires network
2828 '';
29293030- meta = with lib; {
3030+ meta = {
3131 description = "Tool to detect and remediate misconfigurations and security risks of GitHub assets";
3232 homepage = "https://github.com/Legit-Labs/legitify";
3333 changelog = "https://github.com/Legit-Labs/legitify/releases/tag/v${version}";
3434- license = licenses.asl20;
3535- maintainers = with maintainers; [ fab ];
3434+ license = lib.licenses.asl20;
3535+ maintainers = with lib.maintainers; [ fab ];
3636 mainProgram = "legitify";
3737 };
3838}
+3-3
pkgs/by-name/le/lemmeknow/package.nix
···1616 useFetchCargoVendor = true;
1717 cargoHash = "sha256-65PPIYfwVO8O4K8yr499vRQScpAREiBZ8O0rrDMCXB8=";
18181919- meta = with lib; {
1919+ meta = {
2020 description = "Tool to identify anything";
2121 homepage = "https://github.com/swanandx/lemmeknow";
2222 changelog = "https://github.com/swanandx/lemmeknow/releases/tag/v${version}";
2323- license = licenses.mit;
2424- maintainers = with maintainers; [
2323+ license = lib.licenses.mit;
2424+ maintainers = with lib.maintainers; [
2525 figsoda
2626 Br1ght0ne
2727 ];
+3-3
pkgs/by-name/le/lemmy-help/package.nix
···2020 useFetchCargoVendor = true;
2121 cargoHash = "sha256-ZuLbdsZadEkY5M4LoHBn6gnKYklVbXpRa60EocYUH+A=";
22222323- meta = with lib; {
2323+ meta = {
2424 description = "CLI for generating vim help docs from emmylua comments";
2525 longDescription = ''
2626 `lemmy-help` is an emmylua parser as well as a CLI which takes that parsed tree and converts it into vim help docs.
2727 '';
2828 homepage = "https://github.com/numToStr/lemmy-help";
2929 changelog = "https://github.com/numToStr/lemmy-help/releases/tag/v${version}";
3030- license = with licenses; [ mit ];
3131- maintainers = with maintainers; [ figsoda ];
3030+ license = with lib.licenses; [ mit ];
3131+ maintainers = with lib.maintainers; [ figsoda ];
3232 mainProgram = "lemmy-help";
3333 };
3434}
···5757 tests = { inherit (nixosTests) listmonk; };
5858 };
59596060- meta = with lib; {
6060+ meta = {
6161 description = "High performance, self-hosted, newsletter and mailing list manager with a modern dashboard";
6262 mainProgram = "listmonk";
6363 homepage = "https://github.com/knadh/listmonk";
6464 changelog = "https://github.com/knadh/listmonk/releases/tag/v${version}";
6565- maintainers = with maintainers; [ raitobezarius ];
6666- license = licenses.agpl3Only;
6565+ maintainers = with lib.maintainers; [ raitobezarius ];
6666+ license = lib.licenses.agpl3Only;
6767 };
6868}
+3-3
pkgs/by-name/li/listmonk/stuffbin.nix
···2323 "-X main.version=${version}"
2424 ];
25252626- meta = with lib; {
2626+ meta = {
2727 description = "Compress and embed static files and assets into Go binaries and access them with a virtual file system in production";
2828 homepage = "https://github.com/knadh/stuffbin";
2929 changelog = "https://github.com/knadh/stuffbin/releases/tag/v${version}";
3030- maintainers = with maintainers; [ raitobezarius ];
3131- license = licenses.mit;
3030+ maintainers = with lib.maintainers; [ raitobezarius ];
3131+ license = lib.licenses.mit;
3232 };
3333}
···34343535 versionCheckProgramArg = "-version";
36363737- meta = with lib; {
3737+ meta = {
3838 description = "Fast SYN/CONNECT port scanner";
3939 longDescription = ''
4040 Naabu is a port scanning tool written in Go that allows you to enumerate
···4444 '';
4545 homepage = "https://github.com/projectdiscovery/naabu";
4646 changelog = "https://github.com/projectdiscovery/naabu/releases/tag/v${version}";
4747- license = licenses.asl20;
4848- maintainers = with maintainers; [ fab ];
4747+ license = lib.licenses.asl20;
4848+ maintainers = with lib.maintainers; [ fab ];
4949 mainProgram = "naabu";
5050 };
5151}
+3-3
pkgs/by-name/na/namespace-cli/package.nix
···2929 "-X namespacelabs.dev/foundation/internal/cli/version.Tag=v${version}"
3030 ];
31313232- meta = with lib; {
3232+ meta = {
3333 mainProgram = "nsc";
3434- maintainers = with maintainers; [ techknowlogick ];
3535- license = licenses.asl20;
3434+ maintainers = with lib.maintainers; [ techknowlogick ];
3535+ license = lib.licenses.asl20;
3636 changelog = "https://github.com/namespacelabs/foundation/releases/tag/v${version}";
3737 homepage = "https://github.com/namespacelabs/foundation";
3838 description = "Command line interface for the Namespaces platform";
+3-3
pkgs/by-name/na/nanodbc/package.nix
···3232 else
3333 [ "-DBUILD_SHARED_LIBS=ON" ];
34343535- meta = with lib; {
3535+ meta = {
3636 homepage = "https://github.com/nanodbc/nanodbc";
3737 changelog = "https://github.com/nanodbc/nanodbc/raw/v${version}/CHANGELOG.md";
3838 description = "Small C++ wrapper for the native C ODBC API";
3939- license = licenses.mit;
4040- maintainers = [ maintainers.bzizou ];
3939+ license = lib.licenses.mit;
4040+ maintainers = [ lib.maintainers.bzizou ];
4141 };
4242}
···11+[dns]
22+ # Array of upstream DNS servers used by Pi-hole
33+ # Example: [ "8.8.8.8", "127.0.0.1#5335", "docker-resolver" ]
44+ #
55+ # Possible values are:
66+ # array of IP addresses and/or hostnames, optionally with a port (#...)
77+ upstreams = []
88+99+ # Use this option to control deep CNAME inspection. Disabling it might be beneficial
1010+ # for very low-end devices
1111+ CNAMEdeepInspect = true
1212+1313+ # Should _esni. subdomains be blocked by default? Encrypted Server Name Indication
1414+ # (ESNI) is certainly a good step into the right direction to enhance privacy on the
1515+ # web. It prevents on-path observers, including ISPs, coffee shop owners and
1616+ # firewalls, from intercepting the TLS Server Name Indication (SNI) extension by
1717+ # encrypting it. This prevents the SNI from being used to determine which websites
1818+ # users are visiting.
1919+ # ESNI will obviously cause issues for pixelserv-tls which will be unable to generate
2020+ # matching certificates on-the-fly when it cannot read the SNI. Cloudflare and Firefox
2121+ # are already enabling ESNI. According to the IEFT draft (link above), we can easily
2222+ # restore piselserv-tls's operation by replying NXDOMAIN to _esni. subdomains of
2323+ # blocked domains as this mimics a "not configured for this domain" behavior.
2424+ blockESNI = true
2525+2626+ # Should we overwrite the query source when client information is provided through
2727+ # EDNS0 client subnet (ECS) information? This allows Pi-hole to obtain client IPs even
2828+ # if they are hidden behind the NAT of a router. This feature has been requested and
2929+ # discussed on Discourse where further information how to use it can be found:
3030+ # https://discourse.pi-hole.net/t/support-for-add-subnet-option-from-dnsmasq-ecs-edns0-client-subnet/35940
3131+ EDNS0ECS = true
3232+3333+ # Should FTL hide queries made by localhost?
3434+ ignoreLocalhost = false
3535+3636+ # Should FTL analyze and show internally generated DNSSEC queries?
3737+ showDNSSEC = true
3838+3939+ # Should FTL analyze *only* A and AAAA queries?
4040+ analyzeOnlyAandAAAA = false
4141+4242+ # Controls whether and how FTL will reply with for address for which a local interface
4343+ # exists. Changing this setting causes FTL to restart.
4444+ #
4545+ # Possible values are:
4646+ # - "NONE"
4747+ # Pi-hole will not respond automatically on PTR requests to local interface
4848+ # addresses. Ensure pi.hole and/or hostname records exist elsewhere.
4949+ # - "HOSTNAME"
5050+ # Serve the machine's hostname. The hostname is queried from the kernel through
5151+ # uname(2)->nodename. If the machine has multiple network interfaces, it can
5252+ # also have multiple nodenames. In this case, it is unspecified and up to the
5353+ # kernel which one will be returned. On Linux, the returned string is what has
5454+ # been set using sethostname(2) which is typically what has been set in
5555+ # /etc/hostname.
5656+ # - "HOSTNAMEFQDN"
5757+ # Serve the machine's hostname (see limitations above) as fully qualified domain
5858+ # by adding the local domain. If no local domain has been defined (config option
5959+ # dns.domain), FTL tries to query the domain name from the kernel using
6060+ # getdomainname(2). If this fails, FTL appends ".no_fqdn_available" to the
6161+ # hostname.
6262+ # - "PI.HOLE"
6363+ # Respond with "pi.hole".
6464+ piholePTR = "PI.HOLE"
6565+6666+ # How should FTL handle queries when the gravity database is not available?
6767+ #
6868+ # Possible values are:
6969+ # - "BLOCK"
7070+ # Block all queries when the database is busy.
7171+ # - "ALLOW"
7272+ # Allow all queries when the database is busy.
7373+ # - "REFUSE"
7474+ # Refuse all queries which arrive while the database is busy.
7575+ # - "DROP"
7676+ # Just drop the queries, i.e., never reply to them at all. Despite "REFUSE"
7777+ # sounding similar to "DROP", it turned out that many clients will just
7878+ # immediately retry, causing up to several thousands of queries per second. This
7979+ # does not happen in "DROP" mode.
8080+ replyWhenBusy = "ALLOW"
8181+8282+ # FTL's internal TTL to be handed out for blocked queries in seconds. This settings
8383+ # allows users to select a value different from the dnsmasq config option local-ttl.
8484+ # This is useful in context of locally used hostnames that are known to stay constant
8585+ # over long times (printers, etc.).
8686+ # Note that large values may render whitelisting ineffective due to client-side
8787+ # caching of blocked queries.
8888+ blockTTL = 2
8989+9090+ # Array of custom DNS records
9191+ # Example: hosts = [ "127.0.0.1 mylocal", "192.168.0.1 therouter" ]
9292+ #
9393+ # Possible values are:
9494+ # Array of custom DNS records each one in HOSTS form: "IP HOSTNAME"
9595+ hosts = []
9696+9797+ # If set, A and AAAA queries for plain names, without dots or domain parts, are never
9898+ # forwarded to upstream nameservers
9999+ domainNeeded = false
100100+101101+ # If set, the domain is added to simple names (without a period) in /etc/hosts in the
102102+ # same way as for DHCP-derived names
103103+ expandHosts = false
104104+105105+ # The DNS domain used by your Pi-hole.
106106+ #
107107+ # This DNS domain is purely local. FTL may answer queries from its local cache and
108108+ # configuration but *never* forwards any requests upstream *unless* you have
109109+ # configured a dns.revServer exactly for this domain. In the latter case, all queries
110110+ # for this domain are sent exclusively to this server (including reverse lookups).
111111+ #
112112+ # For DHCP, this has two effects; firstly it causes the DHCP server to return the
113113+ # domain to any hosts which request it, and secondly it sets the domain which it is
114114+ # legal for DHCP-configured hosts to claim. The intention is to constrain hostnames so
115115+ # that an untrusted host on the LAN cannot advertise its name via DHCP as e.g.
116116+ # "google.com" and capture traffic not meant for it. If no domain suffix is specified,
117117+ # then any DHCP hostname with a domain part (ie with a period) will be disallowed and
118118+ # logged. If a domain is specified, then hostnames with a domain part are allowed,
119119+ # provided the domain part matches the suffix. In addition, when a suffix is set then
120120+ # hostnames without a domain part have the suffix added as an optional domain part.
121121+ # For instance, we can set domain=mylab.com and have a machine whose DHCP hostname is
122122+ # "laptop". The IP address for that machine is available both as "laptop" and
123123+ # "laptop.mylab.com".
124124+ #
125125+ # You can disable setting a domain by setting this option to an empty string.
126126+ #
127127+ # Possible values are:
128128+ # <any valid domain>
129129+ domain = "lan"
130130+131131+ # Should all reverse lookups for private IP ranges (i.e., 192.168.x.y, etc) which are
132132+ # not found in /etc/hosts or the DHCP leases file be answered with "no such domain"
133133+ # rather than being forwarded upstream?
134134+ bogusPriv = true
135135+136136+ # Validate DNS replies using DNSSEC?
137137+ dnssec = false
138138+139139+ # Interface to use for DNS (see also dnsmasq.listening.mode) and DHCP (if enabled)
140140+ #
141141+ # Possible values are:
142142+ # a valid interface name
143143+ interface = ""
144144+145145+ # Add A, AAAA and PTR records to the DNS. This adds one or more names to the DNS with
146146+ # associated IPv4 (A) and IPv6 (AAAA) records
147147+ #
148148+ # Possible values are:
149149+ # <name>[,<name>....],[<IPv4-address>],[<IPv6-address>][,<TTL>]
150150+ hostRecord = ""
151151+152152+ # Pi-hole interface listening modes
153153+ #
154154+ # Possible values are:
155155+ # - "LOCAL"
156156+ # Allow only local requests. This setting accepts DNS queries only from hosts
157157+ # whose address is on a local subnet, i.e., a subnet for which an interface
158158+ # exists on the server. It is intended to be set as a default on installation,
159159+ # to allow unconfigured installations to be useful but also safe from being used
160160+ # for DNS amplification attacks if (accidentally) running public.
161161+ # - "SINGLE"
162162+ # Permit all origins, accept only on the specified interface. Respond only to
163163+ # queries arriving on the specified interface. The loopback (lo) interface is
164164+ # automatically added to the list of interfaces to use when this option is used.
165165+ # Make sure your Pi-hole is properly firewalled!
166166+ # - "BIND"
167167+ # By default, FTL binds the wildcard address. If this is not what you want, you
168168+ # can use this option as it forces FTL to really bind only the interfaces it is
169169+ # listening on. Note that this may result in issues when the interface may go
170170+ # down (cable unplugged, etc.). About the only time when this is useful is when
171171+ # running another nameserver on the same port on the same machine. This may also
172172+ # happen if you run a virtualization API such as libvirt. When this option is
173173+ # used, IP alias interface labels (e.g. enp2s0:0) are checked rather than
174174+ # interface names.
175175+ # - "ALL"
176176+ # Permit all origins, accept on all interfaces. Make sure your Pi-hole is
177177+ # properly firewalled! This truly allows any traffic to be replied to and is a
178178+ # dangerous thing to do as your Pi-hole could become an open resolver. You
179179+ # should always ask yourself if the first option doesn't work for you as well.
180180+ # - "NONE"
181181+ # Do not add any configuration concerning the listening mode to the dnsmasq
182182+ # configuration file. This is useful if you want to manually configure the
183183+ # listening mode in auxiliary configuration files. This option is really meant
184184+ # for advanced users only, support for this option may be limited.
185185+ listeningMode = "LOCAL"
186186+187187+ # Log DNS queries and replies to pihole.log
188188+ queryLogging = true
189189+190190+ # List of CNAME records which indicate that <cname> is really <target>. If the <TTL> is
191191+ # given, it overwrites the value of local-ttl
192192+ #
193193+ # Possible values are:
194194+ # Array of CNAMEs each on in one of the following forms: "<cname>,<target>[,<TTL>]"
195195+ cnameRecords = []
196196+197197+ # Port used by the DNS server
198198+ port = 53
199199+200200+ # Reverse server (former also called "conditional forwarding") feature
201201+ # Array of reverse servers each one in one of the following forms:
202202+ # "<enabled>,<ip-address>[/<prefix-len>],<server>[#<port>][,<domain>]"
203203+ #
204204+ # Individual components:
205205+ #
206206+ # <enabled>: either "true" or "false"
207207+ #
208208+ # <ip-address>[/<prefix-len>]: Address range for the reverse server feature in CIDR
209209+ # notation. If the prefix length is omitted, either 32 (IPv4) or 128 (IPv6) are
210210+ # substituted (exact address match). This is almost certainly not what you want here.
211211+ # Example: "192.168.0.0/24" for the range 192.168.0.1 - 192.168.0.255
212212+ #
213213+ # <server>[#<port>]: Target server to be used for the reverse server feature
214214+ # Example: "192.168.0.1#53"
215215+ #
216216+ # <domain>: Domain used for the reverse server feature (e.g., "fritz.box")
217217+ # Example: "fritz.box"
218218+ #
219219+ # Possible values are:
220220+ # array of reverse servers each one in one of the following forms:
221221+ # "<enabled>,<ip-address>[/<prefix-len>],<server>[#<port>][,<domain>]", e.g.,
222222+ # "true,192.168.0.0/24,192.168.0.1,fritz.box"
223223+ revServers = []
224224+225225+ [dns.cache]
226226+ # Cache size of the DNS server. Note that expiring cache entries naturally make room
227227+ # for new insertions over time. Setting this number too high will have an adverse
228228+ # effect as not only more space is needed, but also lookup speed gets degraded in the
229229+ # 10,000+ range. dnsmasq may issue a warning when you go beyond 10,000+ cache entries.
230230+ size = 10000
231231+232232+ # Query cache optimizer: If a DNS name exists in the cache, but its time-to-live has
233233+ # expired only recently, the data will be used anyway (a refreshing from upstream is
234234+ # triggered). This can improve DNS query delays especially over unreliable Internet
235235+ # connections. This feature comes at the expense of possibly sometimes returning
236236+ # out-of-date data and less efficient cache utilization, since old data cannot be
237237+ # flushed when its TTL expires, so the cache becomes mostly least-recently-used. To
238238+ # mitigate issues caused by massively outdated DNS replies, the maximum overaging of
239239+ # cached records is limited. We strongly recommend staying below 86400 (1 day) with
240240+ # this option.
241241+ # Setting the TTL excess time to zero will serve stale cache data regardless how long
242242+ # it has expired. This is not recommended as it may lead to stale data being served
243243+ # for a long time. Setting this option to any negative value will disable this feature
244244+ # altogether.
245245+ optimizer = 3600
246246+247247+ # This setting allows you to specify the TTL used for queries blocked upstream. Once
248248+ # the TTL expires, the query will be forwarded to the upstream server again to check
249249+ # if the block is still valid. Defaults to caching for one day (86400 seconds).
250250+ # Setting this value to zero disables caching of queries blocked upstream.
251251+ upstreamBlockedTTL = 86400
252252+253253+ [dns.blocking]
254254+ # Should FTL block queries?
255255+ active = true
256256+257257+ # How should FTL reply to blocked queries?
258258+ #
259259+ # Possible values are:
260260+ # - "NULL"
261261+ # In NULL mode, which is both the default and recommended mode for Pi-hole
262262+ # FTLDNS, blocked queries will be answered with the "unspecified address"
263263+ # (0.0.0.0 or ::). The "unspecified address" is a reserved IP address specified
264264+ # by RFC 3513 - Internet Protocol Version 6 (IPv6) Addressing Architecture,
265265+ # section 2.5.2.
266266+ # - "IP_NODATA_AAAA"
267267+ # In IP-NODATA-AAAA mode, blocked queries will be answered with the local IPv4
268268+ # addresses of your Pi-hole. Blocked AAAA queries will be answered with
269269+ # NODATA-IPV6 and clients will only try to reach your Pi-hole over its static
270270+ # IPv4 address.
271271+ # - "IP"
272272+ # In IP mode, blocked queries will be answered with the local IP addresses of
273273+ # your Pi-hole.
274274+ # - "NX"
275275+ # In NXDOMAIN mode, blocked queries will be answered with an empty response
276276+ # (i.e., there won't be an answer section) and status NXDOMAIN. A NXDOMAIN
277277+ # response should indicate that there is no such domain to the client making the
278278+ # query.
279279+ # - "NODATA"
280280+ # In NODATA mode, blocked queries will be answered with an empty response (no
281281+ # answer section) and status NODATA. A NODATA response indicates that the domain
282282+ # exists, but there is no record for the requested query type.
283283+ mode = "NULL"
284284+285285+ # Should FTL enrich blocked replies with EDNS0 information?
286286+ #
287287+ # Possible values are:
288288+ # - "NONE"
289289+ # In NONE mode, no additional EDNS information is added to blocked queries
290290+ # - "CODE"
291291+ # In CODE mode, blocked queries will be enriched with EDNS info-code BLOCKED (15)
292292+ # - "TEXT"
293293+ # In TEXT mode, blocked queries will be enriched with EDNS info-code BLOCKED (15)
294294+ # and a text message describing the reason for the block
295295+ edns = "TEXT"
296296+297297+ [dns.specialDomains]
298298+ # Should Pi-hole always reply with NXDOMAIN to A and AAAA queries of
299299+ # use-application-dns.net to disable Firefox automatic DNS-over-HTTP? This is
300300+ # following the recommendation on
301301+ # https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https
302302+ mozillaCanary = true
303303+304304+ # Should Pi-hole always reply with NXDOMAIN to A and AAAA queries of mask.icloud.com
305305+ # and mask-h2.icloud.com to disable Apple's iCloud Private Relay to prevent Apple
306306+ # devices from bypassing Pi-hole? This is following the recommendation on
307307+ # https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay
308308+ iCloudPrivateRelay = true
309309+310310+ # Should Pi-hole always reply with NODATA to all queries to zone resolver.arpa to
311311+ # prevent devices from bypassing Pi-hole using Discovery of Designated Resolvers? This
312312+ # is based on recommendations at the end of RFC 9462, section 4.
313313+ designatedResolver = true
314314+315315+ [dns.reply.host]
316316+ # Use a specific IPv4 address for the Pi-hole host? By default, FTL determines the
317317+ # address of the interface a query arrived on and uses this address for replying to A
318318+ # queries with the most suitable address for the requesting client. This setting can
319319+ # be used to use a fixed, rather than the dynamically obtained, address when Pi-hole
320320+ # responds to the following names: [ "pi.hole", "<the device's hostname>",
321321+ # "pi.hole.<local domain>", "<the device's hostname>.<local domain>" ]
322322+ force4 = false
323323+324324+ # Custom IPv4 address for the Pi-hole host
325325+ #
326326+ # Possible values are:
327327+ # <valid IPv4 address> or empty string ("")
328328+ IPv4 = ""
329329+330330+ # Use a specific IPv6 address for the Pi-hole host? See description for the IPv4
331331+ # variant above for further details.
332332+ force6 = false
333333+334334+ # Custom IPv6 address for the Pi-hole host
335335+ #
336336+ # Possible values are:
337337+ # <valid IPv6 address> or empty string ("")
338338+ IPv6 = ""
339339+340340+ [dns.reply.blocking]
341341+ # Use a specific IPv4 address in IP blocking mode? By default, FTL determines the
342342+ # address of the interface a query arrived on and uses this address for replying to A
343343+ # queries with the most suitable address for the requesting client. This setting can
344344+ # be used to use a fixed, rather than the dynamically obtained, address when Pi-hole
345345+ # responds in the following cases: IP blocking mode is used and this query is to be
346346+ # blocked, regular expressions with the ;reply=IP regex extension.
347347+ force4 = false
348348+349349+ # Custom IPv4 address for IP blocking mode
350350+ #
351351+ # Possible values are:
352352+ # <valid IPv4 address> or empty string ("")
353353+ IPv4 = ""
354354+355355+ # Use a specific IPv6 address in IP blocking mode? See description for the IPv4 variant
356356+ # above for further details.
357357+ force6 = false
358358+359359+ # Custom IPv6 address for IP blocking mode
360360+ #
361361+ # Possible values are:
362362+ # <valid IPv6 address> or empty string ("")
363363+ IPv6 = ""
364364+365365+ [dns.rateLimit]
366366+ # Rate-limited queries are answered with a REFUSED reply and not further processed by
367367+ # FTL.
368368+ # The default settings for FTL's rate-limiting are to permit no more than 1000 queries
369369+ # in 60 seconds. Both numbers can be customized independently. It is important to note
370370+ # that rate-limiting is happening on a per-client basis. Other clients can continue to
371371+ # use FTL while rate-limited clients are short-circuited at the same time.
372372+ # For this setting, both numbers, the maximum number of queries within a given time,
373373+ # and the length of the time interval (seconds) have to be specified. For instance, if
374374+ # you want to set a rate limit of 1 query per hour, the option should look like
375375+ # RATE_LIMIT=1/3600. The time interval is relative to when FTL has finished starting
376376+ # (start of the daemon + possible delay by DELAY_STARTUP) then it will advance in
377377+ # steps of the rate-limiting interval. If a client reaches the maximum number of
378378+ # queries it will be blocked until the end of the current interval. This will be
379379+ # logged to /var/log/pihole/FTL.log, e.g. Rate-limiting 10.0.1.39 for at least 44
380380+ # seconds. If the client continues to send queries while being blocked already and
381381+ # this number of queries during the blocking exceeds the limit the client will
382382+ # continue to be blocked until the end of the next interval (FTL.log will contain
383383+ # lines like Still rate-limiting 10.0.1.39 as it made additional 5007 queries). As
384384+ # soon as the client requests less than the set limit, it will be unblocked (Ending
385385+ # rate-limitation of 10.0.1.39).
386386+ # Rate-limiting may be disabled altogether by setting both values to zero (this
387387+ # results in the same behavior as before FTL v5.7).
388388+ # How many queries are permitted...
389389+ count = 1000
390390+391391+ # ... in the set interval before rate-limiting?
392392+ interval = 60
393393+394394+[dhcp]
395395+ # Is the embedded DHCP server enabled?
396396+ active = false
397397+398398+ # Start address of the DHCP address pool
399399+ #
400400+ # Possible values are:
401401+ # <valid IPv4 address> or empty string (""), e.g., "192.168.0.10"
402402+ start = ""
403403+404404+ # End address of the DHCP address pool
405405+ #
406406+ # Possible values are:
407407+ # <valid IPv4 address> or empty string (""), e.g., "192.168.0.250"
408408+ end = ""
409409+410410+ # Address of the gateway to be used (typically the address of your router in a home
411411+ # installation)
412412+ #
413413+ # Possible values are:
414414+ # <valid IPv4 address> or empty string (""), e.g., "192.168.0.1"
415415+ router = ""
416416+417417+ # The netmask used by your Pi-hole. For directly connected networks (i.e., networks on
418418+ # which the machine running Pi-hole has an interface) the netmask is optional and may
419419+ # be set to an empty string (""): it will then be determined from the interface
420420+ # configuration itself. For networks which receive DHCP service via a relay agent, we
421421+ # cannot determine the netmask itself, so it should explicitly be specified, otherwise
422422+ # Pi-hole guesses based on the class (A, B or C) of the network address.
423423+ #
424424+ # Possible values are:
425425+ # <any valid netmask> (e.g., "255.255.255.0") or empty string ("") for
426426+ # auto-discovery
427427+ netmask = ""
428428+429429+ # If the lease time is given, then leases will be given for that length of time. If not
430430+ # given, the default lease time is one hour for IPv4 and one day for IPv6.
431431+ #
432432+ # Possible values are:
433433+ # The lease time can be in seconds, or minutes (e.g., "45m") or hours (e.g., "1h")
434434+ # or days (like "2d") or even weeks ("1w"). You may also use "infinite" as string
435435+ # but be aware of the drawbacks
436436+ leaseTime = ""
437437+438438+ # Should Pi-hole make an attempt to also satisfy IPv6 address requests (be aware that
439439+ # IPv6 works a whole lot different than IPv4)
440440+ ipv6 = false
441441+442442+ # Enable DHCPv4 Rapid Commit Option specified in RFC 4039. Should only be enabled if
443443+ # either the server is the only server for the subnet to avoid conflicts
444444+ rapidCommit = false
445445+446446+ # Advertise DNS server multiple times to clients. Some devices will add their own
447447+ # proprietary DNS servers to the list of DNS servers, which can cause issues with
448448+ # Pi-hole. This option will advertise the Pi-hole DNS server multiple times to
449449+ # clients, which should prevent this from happening.
450450+ multiDNS = false
451451+452452+ # Enable logging for DHCP. This will log all relevant DHCP-related activity, including,
453453+ # e.g., all the options sent to DHCP clients and the tags used to determine them (if
454454+ # any). This can be useful for debugging DHCP issues. The generated output is saved to
455455+ # the file specified by files.log.dnsmasq below.
456456+ logging = false
457457+458458+ # Ignore unknown DHCP clients.
459459+ # If this option is set, Pi-hole ignores all clients which are not explicitly
460460+ # configured through dhcp.hosts. This can be useful to prevent unauthorized clients
461461+ # from getting an IP address from the DHCP server.
462462+ # It should be noted that this option is not a security feature, as clients can still
463463+ # assign themselves an IP address and use the network. It is merely a convenience
464464+ # feature to prevent unknown clients from getting a valid IP configuration assigned
465465+ # automatically.
466466+ # Note that you will need to configure new clients manually in dhcp.hosts before they
467467+ # can use the network when this feature is enabled.
468468+ ignoreUnknownClients = false
469469+470470+ # Per host parameters for the DHCP server. This allows a machine with a particular
471471+ # hardware address to be always allocated the same hostname, IP address and lease time
472472+ # or to specify static DHCP leases
473473+ #
474474+ # Possible values are:
475475+ # Array of static leases each on in one of the following forms:
476476+ # "[<hwaddr>][,id:<client_id>|*][,set:<tag>][,tag:<tag>][,<ipaddr>][,<hostname>][,<lease_time>][,ignore]"
477477+ hosts = []
478478+479479+ [ntp.ipv4]
480480+ # Should FTL act as network time protocol (NTP) server (IPv4)?
481481+ active = true
482482+483483+ # IPv4 address to listen on for NTP requests
484484+ #
485485+ # Possible values are:
486486+ # <valid IPv4 address> or empty string ("") for wildcard (0.0.0.0)
487487+ address = ""
488488+489489+ [ntp.ipv6]
490490+ # Should FTL act as network time protocol (NTP) server (IPv6)?
491491+ active = true
492492+493493+ # IPv6 address to listen on for NTP requests
494494+ #
495495+ # Possible values are:
496496+ # <valid IPv6 address> or empty string ("") for wildcard (::)
497497+ address = ""
498498+499499+ [ntp.sync]
500500+ # Should FTL try to synchronize the system time with an upstream NTP server?
501501+ active = true
502502+503503+ # NTP upstream server to sync with, e.g., "pool.ntp.org". Note that the NTP server
504504+ # should be located as close as possible to you in order to minimize the time offset
505505+ # possibly introduced by different routing paths.
506506+ #
507507+ # Possible values are:
508508+ # valid NTP upstream server
509509+ server = "pool.ntp.org"
510510+511511+ # Interval in seconds between successive synchronization attempts with the NTP server
512512+ interval = 3600
513513+514514+ # Number of NTP syncs to perform and average before updating the system time
515515+ count = 8
516516+517517+ [ntp.sync.rtc]
518518+ # Should FTL update a real-time clock (RTC) if available?
519519+ set = false
520520+521521+ # Path to the RTC device to update. Leave empty for auto-discovery
522522+ #
523523+ # Possible values are:
524524+ # Path to the RTC device, e.g., "/dev/rtc0"
525525+ device = ""
526526+527527+ # Should the RTC be set to UTC?
528528+ utc = true
529529+530530+[resolver]
531531+ # Should FTL try to resolve IPv4 addresses to hostnames?
532532+ resolveIPv4 = true
533533+534534+ # Should FTL try to resolve IPv6 addresses to hostnames?
535535+ resolveIPv6 = true
536536+537537+ # Control whether FTL should use the fallback option to try to obtain client names from
538538+ # checking the network table. This behavior can be disabled with this option.
539539+ # Assume an IPv6 client without a host names. However, the network table knows -
540540+ # though the client's MAC address - that this is the same device where we have a host
541541+ # name for another IP address (e.g., a DHCP server managed IPv4 address). In this
542542+ # case, we use the host name associated to the other address as this is the same
543543+ # device.
544544+ networkNames = true
545545+546546+ # With this option, you can change how (and if) hourly PTR requests are made to check
547547+ # for changes in client and upstream server hostnames.
548548+ #
549549+ # Possible values are:
550550+ # - "IPV4_ONLY"
551551+ # Do hourly PTR lookups only for IPv4 addresses. This is the new default since
552552+ # Pi-hole FTL v5.3.2. It should resolve issues with more and more very
553553+ # short-lived PE IPv6 addresses coming up in a lot of networks.
554554+ # - "ALL"
555555+ # Do hourly PTR lookups for all addresses. This was the default until FTL
556556+ # v5.3(.1). It has been replaced as it can create a lot of PTR queries for those
557557+ # with many IPv6 addresses in their networks.
558558+ # - "UNKNOWN"
559559+ # Only resolve unknown hostnames. Already existing hostnames are never refreshed,
560560+ # i.e., there will be no PTR queries made for clients where hostnames are known.
561561+ # This also means that known hostnames will not be updated once known.
562562+ # - "NONE"
563563+ # Don't do any hourly PTR lookups. This means we look host names up exactly once
564564+ # (when we first see a client) and never again. You may miss future changes of
565565+ # host names.
566566+ refreshNames = "IPV4_ONLY"
567567+568568+[database]
569569+ # Should FTL load information from the database on startup to be aware of the most
570570+ # recent history?
571571+ DBimport = true
572572+573573+ # How long should queries be stored in the database [days]?
574574+ # Setting this value to 0 will disable the database.
575575+ maxDBdays = 91
576576+577577+ # How often do we store queries in FTL's database [seconds]?
578578+ DBinterval = 60
579579+580580+ # Should FTL enable Write-Ahead Log (WAL) mode for the on-disk query database
581581+ # (configured via files.database)?
582582+ # It is recommended to leave this setting enabled for performance reasons. About the
583583+ # only reason to disable WAL mode is if you are experiencing specific issues with it,
584584+ # e.g., when using a database that is accessed from multiple hosts via a network
585585+ # share. When this setting is disabled, FTL will use SQLite3's default journal mode
586586+ # (rollback journal in DELETE mode).
587587+ useWAL = true
588588+589589+ [database.network]
590590+ # Should FTL analyze the local ARP cache? When disabled, client identification and the
591591+ # network table will stop working reliably.
592592+ parseARPcache = true
593593+594594+ # How long should IP addresses be kept in the network_addresses table [days]? IP
595595+ # addresses (and associated host names) older than the specified number of days are
596596+ # removed to avoid dead entries in the network overview table.
597597+ expire = 91
598598+599599+[webserver]
600600+ # On which domain is the web interface served?
601601+ #
602602+ # Possible values are:
603603+ # <valid domain>
604604+ domain = "pi.hole"
605605+606606+ # Webserver access control list (ACL) allowing for restrictions to be put on the list
607607+ # of IP addresses which have access to the web server. The ACL is a comma separated
608608+ # list of IP subnets, where each subnet is prepended by either a - or a + sign. A plus
609609+ # sign means allow, where a minus sign means deny. If a subnet mask is omitted, such
610610+ # as -1.2.3.4, this means to deny only that single IP address. If this value is not
611611+ # set (empty string), all accesses are allowed. Otherwise, the default setting is to
612612+ # deny all accesses. On each request the full list is traversed, and the last (!)
613613+ # match wins. IPv6 addresses may be specified in CIDR-form [a:b::c]/64.
614614+ #
615615+ # Example 1: acl = "+127.0.0.1,+[::1]"
616616+ # ---> deny all access, except from 127.0.0.1 and ::1,
617617+ # Example 2: acl = "+192.168.0.0/16"
618618+ # ---> deny all accesses, except from the 192.168.0.0/16 subnet,
619619+ # Example 3: acl = "+[::]/0" ---> allow only IPv6 access.
620620+ #
621621+ # Possible values are:
622622+ # <valid ACL>
623623+ acl = ""
624624+625625+ # Ports to be used by the webserver.
626626+ # Comma-separated list of ports to listen on. It is possible to specify an IP address
627627+ # to bind to. In this case, an IP address and a colon must be prepended to the port
628628+ # number. For example, to bind to the loopback interface on port 80 (IPv4) and to all
629629+ # interfaces port 8080 (IPv4), use "127.0.0.1:80,8080". "[::]:80" can be used to
630630+ # listen to IPv6 connections to port 80. IPv6 addresses of network interfaces can be
631631+ # specified as well, e.g. "[::1]:80" for the IPv6 loopback interface. [::]:80 will
632632+ # bind to port 80 IPv6 only.
633633+ # In order to use port 80 for all interfaces, both IPv4 and IPv6, use either the
634634+ # configuration "80,[::]:80" (create one socket for IPv4 and one for IPv6 only), or
635635+ # "+80" (create one socket for both, IPv4 and IPv6). The '+' notation to use IPv4 and
636636+ # IPv6 will only work if no network interface is specified. Depending on your
637637+ # operating system version and IPv6 network environment, some configurations might not
638638+ # work as expected, so you have to test to find the configuration most suitable for
639639+ # your needs. In case "+80" does not work for your environment, you need to use
640640+ # "80,[::]:80".
641641+ # If the port is TLS/SSL, a letter 's' (secure) must be appended, for example,
642642+ # "80,443s" will open port 80 and port 443, and connections on port 443 will be
643643+ # encrypted. For non-encrypted ports, it is allowed to append letter 'r' (as in
644644+ # redirect). Redirected ports will redirect all their traffic to the first configured
645645+ # SSL port. For example, if webserver.port is "80r,443s", then all HTTP traffic coming
646646+ # at port 80 will be redirected to HTTPS port 443.
647647+ # When specifying 'o' (optional) behind a port, inability to use this port is not
648648+ # considered an error. For instance, specifying "80o,8080o" will allow the webserver
649649+ # to listen on either 80, 8080, both or even none of the two ports. This flag may be
650650+ # combined with 'r' and 's' like "80or,443os,8080,4443s" (80 redirecting to SSL if
651651+ # available, 443 encrypted if available, 8080 mandatory and unencrypted, 4443
652652+ # mandatory and encrypted).
653653+ # If this value is not set (empty string), the web server will not be started and,
654654+ # hence, the API will not be available.
655655+ #
656656+ # Possible values are:
657657+ # comma-separated list of <[ip_address:]port>
658658+ port = "80o,443os,[::]:80o,[::]:443os"
659659+660660+ # Maximum number of worker threads allowed.
661661+ # The Pi-hole web server handles each incoming connection in a separate thread.
662662+ # Therefore, the value of this option is effectively the number of concurrent HTTP
663663+ # connections that can be handled. Any other connections are queued until they can be
664664+ # processed by a unoccupied thread.
665665+ # The total number of threads you see may be lower than the configured value as
666666+ # threads are only created when needed due to incoming connections.
667667+ # The value 0 means the number of threads is 50 (as per default settings of CivetWeb)
668668+ # for backwards-compatible behavior.
669669+ threads = 50
670670+671671+ # Additional HTTP headers added to the web server responses.
672672+ # The headers are added to all responses, including those for the API.
673673+ # Note about the default additional headers:
674674+ # - X-DNS-Prefetch-Control: off: Usually browsers proactively perform domain name
675675+ # resolution on links that the user may choose to follow. We disable DNS prefetching
676676+ # here.
677677+ # - Content-Security-Policy: [...] 'unsafe-inline' is both required by Chart.js
678678+ # styling some elements directly, and index.html containing some inlined Javascript
679679+ # code.
680680+ # - X-Frame-Options: DENY: The page can not be displayed in a frame, regardless of the
681681+ # site attempting to do so.
682682+ # - X-Xss-Protection: 0: Disables XSS filtering in browsers that support it. This
683683+ # header is usually enabled by default in browsers, and is not recommended as it can
684684+ # hurt the security of the site.
685685+ # (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection).
686686+ # - X-Content-Type-Options: nosniff: Marker used by the server to indicate that the
687687+ # MIME types advertised in the Content-Type headers should not be changed and be
688688+ # followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a
689689+ # way to say that the webmasters knew what they were doing. Site security testers
690690+ # usually expect this header to be set.
691691+ # - Referrer-Policy: strict-origin-when-cross-origin: A referrer will be sent for
692692+ # same-site origins, but cross-origin requests will send no referrer information.
693693+ # The latter four headers are set as expected by https://securityheaders.io
694694+ #
695695+ # Possible values are:
696696+ # array of HTTP headers
697697+ headers = [
698698+ "X-DNS-Prefetch-Control: off",
699699+ "Content-Security-Policy: default-src 'self' 'unsafe-inline';",
700700+ "X-Frame-Options: DENY",
701701+ "X-XSS-Protection: 0",
702702+ "X-Content-Type-Options: nosniff",
703703+ "Referrer-Policy: strict-origin-when-cross-origin"
704704+ ]
705705+706706+ # Should the web server serve all files in webserver.paths.webroot directory? If
707707+ # disabled, only files within the path defined through webserver.paths.webhome and
708708+ # /api will be served.
709709+ serve_all = false
710710+711711+ [webserver.session]
712712+ # Session timeout in seconds. If a session is inactive for more than this time, it will
713713+ # be terminated. Sessions are continuously refreshed by the web interface, preventing
714714+ # sessions from timing out while the web interface is open.
715715+ # This option may also be used to make logins persistent for long times, e.g. 86400
716716+ # seconds (24 hours), 604800 seconds (7 days) or 2592000 seconds (30 days). Note that
717717+ # the total number of concurrent sessions is limited so setting this value too high
718718+ # may result in users being rejected and unable to log in if there are already too
719719+ # many sessions active.
720720+ timeout = 1800
721721+722722+ # Should Pi-hole backup and restore sessions from the database? This is useful if you
723723+ # want to keep your sessions after a restart of the web interface.
724724+ restore = true
725725+726726+ [webserver.tls]
727727+ # Path to the TLS (SSL) certificate file. All directories along the path must be
728728+ # readable and accessible by the user running FTL (typically 'pihole'). This option is
729729+ # only required when at least one of webserver.port is TLS. The file must be in PEM
730730+ # format, and it must have both, private key and certificate (the *.pem file created
731731+ # must contain a 'CERTIFICATE' section as well as a 'RSA PRIVATE KEY' section).
732732+ # The *.pem file can be created using
733733+ # cp server.crt server.pem
734734+ # cat server.key >> server.pem
735735+ # if you have these files instead
736736+ #
737737+ # Possible values are:
738738+ # <valid TLS certificate file (*.pem)>
739739+ cert = "/etc/pihole/tls.pem"
740740+741741+ [webserver.paths]
742742+ # Server root on the host
743743+ #
744744+ # Possible values are:
745745+ # <valid path>
746746+ webroot = "/var/www/html"
747747+748748+ # Sub-directory of the root containing the web interface
749749+ #
750750+ # Possible values are:
751751+ # <valid subpath>, both slashes are needed!
752752+ webhome = "/admin/"
753753+754754+ # Prefix where the web interface is served
755755+ # This is useful when you are using a reverse proxy serving the web interface, e.g.,
756756+ # at http://<ip>/pihole/admin/ instead of http://<ip>/admin/. In this example, the
757757+ # prefix would be "/pihole". Note that the prefix has to be stripped away by the
758758+ # reverse proxy, e.g., for traefik:
759759+ # - traefik.http.routers.pihole.rule=PathPrefix(`/pihole`)
760760+ # - traefik.http.middlewares.piholehttp.stripprefix.prefixes=/pihole
761761+ # The prefix should start with a slash. If you don't use a prefix, leave this field
762762+ # empty. Setting this field to an incorrect value may result in the web interface not
763763+ # being accessible.
764764+ # Don't use this setting if you are not using a reverse proxy!
765765+ #
766766+ # Possible values are:
767767+ # valid URL prefix or empty
768768+ prefix = ""
769769+770770+ [webserver.interface]
771771+ # Should the web interface use the boxed layout?
772772+ boxed = true
773773+774774+ # Theme used by the Pi-hole web interface
775775+ #
776776+ # Possible values are:
777777+ # - "default-auto"
778778+ # Pi-hole auto
779779+ # - "default-light"
780780+ # Pi-hole day
781781+ # - "default-dark"
782782+ # Pi-hole midnight
783783+ # - "default-darker"
784784+ # Pi-hole deep-midnight
785785+ # - "high-contrast"
786786+ # High-contrast light
787787+ # - "high-contrast-dark"
788788+ # High-contrast dark
789789+ # - "lcars"
790790+ # Star Trek LCARS
791791+ theme = "default-auto"
792792+793793+ [webserver.api]
794794+ # Number of concurrent sessions allowed for the API. If the number of sessions exceeds
795795+ # this value, no new sessions will be allowed until the number of sessions drops due
796796+ # to session expiration or logout. Note that the number of concurrent sessions is
797797+ # irrelevant if authentication is disabled as no sessions are used in this case.
798798+ max_sessions = 16
799799+800800+ # Should FTL prettify the API output (add extra spaces, newlines and indentation)?
801801+ prettyJSON = false
802802+803803+ # API password hash
804804+ #
805805+ # Possible values are:
806806+ # <valid Pi-hole password hash>
807807+ pwhash = ""
808808+809809+ # Pi-hole 2FA TOTP secret. When set to something different than "", 2FA authentication
810810+ # will be enforced for the API and the web interface. This setting is write-only, you
811811+ # can not read the secret back.
812812+ #
813813+ # Possible values are:
814814+ # <valid TOTP secret (20 Bytes in Base32 encoding)>
815815+ totp_secret = ""
816816+817817+ # Pi-hole application password.
818818+ # After you turn on two-factor (2FA) verification and set up an Authenticator app, you
819819+ # may run into issues if you use apps or other services that don't support two-step
820820+ # verification. In this case, you can create and use an app password to sign in. An
821821+ # app password is a long, randomly generated password that can be used instead of your
822822+ # regular password + TOTP token when signing in to the API. The app password can be
823823+ # generated through the API and will be shown only once. You can revoke the app
824824+ # password at any time. If you revoke the app password, be sure to generate a new one
825825+ # and update your app with the new password.
826826+ #
827827+ # Possible values are:
828828+ # <valid Pi-hole password hash>
829829+ app_pwhash = ""
830830+831831+ # Should application password API sessions be allowed to modify config settings?
832832+ # Setting this to true allows third-party applications using the application password
833833+ # to modify settings, e.g., the upstream DNS servers, DHCP server settings, or
834834+ # changing passwords. This setting should only be enabled if really needed and only if
835835+ # you trust the applications using the application password.
836836+ app_sudo = false
837837+838838+ # Should FTL create a temporary CLI password? This password is stored in clear in
839839+ # /etc/pihole and can be used by the CLI (pihole ... commands) to authenticate
840840+ # against the API. Note that the password is only valid for the current session and
841841+ # regenerated on each FTL restart. Sessions initiated with this password cannot modify
842842+ # the Pi-hole configuration (change passwords, etc.) for security reasons but can
843843+ # still use the API to query data and manage lists.
844844+ cli_pw = true
845845+846846+ # Array of clients to be excluded from certain API responses (regex):
847847+ # - Query Log (/api/queries)
848848+ # - Top Clients (/api/stats/top_clients)
849849+ # This setting accepts both IP addresses (IPv4 and IPv6) as well as hostnames.
850850+ # Note that backslashes "\" need to be escaped, i.e. "\\" in this setting
851851+ #
852852+ # Example: [ "^192\\.168\\.2\\.56$", "^fe80::341:[0-9a-f]*$", "^localhost$" ]
853853+ #
854854+ # Possible values are:
855855+ # array of regular expressions describing clients
856856+ excludeClients = []
857857+858858+ # Array of domains to be excluded from certain API responses (regex):
859859+ # - Query Log (/api/queries)
860860+ # - Top Clients (/api/stats/top_domains)
861861+ # Note that backslashes "\" need to be escaped, i.e. "\\" in this setting
862862+ #
863863+ # Example: [ "(^|\\.)\\.google\\.de$", "\\.pi-hole\\.net$" ]
864864+ #
865865+ # Possible values are:
866866+ # array of regular expressions describing domains
867867+ excludeDomains = []
868868+869869+ # How much history should be imported from the database and returned by the API
870870+ # [seconds]? (max 24*60*60 = 86400)
871871+ maxHistory = 86400
872872+873873+ # Up to how many clients should be returned in the activity graph endpoint
874874+ # (/api/history/clients)?
875875+ # This setting can be overwritten at run-time using the parameter N. Setting this to 0
876876+ # will always send all clients. Be aware that this may be challenging for the GUI if
877877+ # you have many (think > 1.000 clients) in your network
878878+ maxClients = 10
879879+880880+ # How should the API compute the most active clients? If set to true, the API will
881881+ # return the clients with the most queries globally (within 24 hours). If set to
882882+ # false, the API will return the clients with the most queries per time slot
883883+ # individually.
884884+ client_history_global_max = true
885885+886886+ # Allow destructive API calls (e.g. deleting all queries, powering off the system, ...)
887887+ allow_destructive = true
888888+889889+ [webserver.api.temp]
890890+ # Which upper temperature limit should be used by Pi-hole? Temperatures above this
891891+ # limit will be shown as "hot". The number specified here is in the unit defined below
892892+ limit = 60.000000
893893+894894+ # Which temperature unit should be used for temperatures processed by FTL?
895895+ #
896896+ # Possible values are:
897897+ # - "C"
898898+ # Celsius
899899+ # - "F"
900900+ # Fahrenheit
901901+ # - "K"
902902+ # Kelvin
903903+ unit = "C"
904904+905905+[files]
906906+ # The file which contains the PID of FTL's main process.
907907+ #
908908+ # Possible values are:
909909+ # <any writable file>
910910+ pid = "/run/pihole-FTL.pid"
911911+912912+ # The location of FTL's long-term database
913913+ #
914914+ # Possible values are:
915915+ # <any FTL database>
916916+ database = "/etc/pihole/pihole-FTL.db"
917917+918918+ # The location of Pi-hole's gravity database
919919+ #
920920+ # Possible values are:
921921+ # <any Pi-hole gravity database>
922922+ gravity = "/etc/pihole/gravity.db"
923923+924924+ # A temporary directory where Pi-hole can store files during gravity updates. This
925925+ # directory must be writable by the user running gravity (typically pihole).
926926+ #
927927+ # Possible values are:
928928+ # <any existing world-writable writable directory>
929929+ gravity_tmp = "/tmp"
930930+931931+ # The database containing MAC -> Vendor information for the network table
932932+ #
933933+ # Possible values are:
934934+ # <any Pi-hole macvendor database>
935935+ macvendor = "/etc/pihole/macvendor.db"
936936+937937+ # The old config file of Pi-hole used before v6.0
938938+ #
939939+ # Possible values are:
940940+ # <any Pi-hole setupVars file>
941941+ setupVars = "/etc/pihole/setupVars.conf"
942942+943943+ # An optional file containing a pcap capture of the network traffic. This file is used
944944+ # for debugging purposes only. If you don't know what this is, you don't need it.
945945+ # Setting this to an empty string disables pcap recording. The file must be writable
946946+ # by the user running FTL (typically pihole). Failure to write to this file will
947947+ # prevent the DNS resolver from starting. The file is appended to if it already
948948+ # exists.
949949+ #
950950+ # Possible values are:
951951+ # <any writable pcap file>
952952+ pcap = ""
953953+954954+ [files.log]
955955+ # The location of FTL's log file
956956+ #
957957+ # Possible values are:
958958+ # <any writable file>
959959+ ftl = "/var/log/pihole/FTL.log"
960960+961961+ # The log file used by the embedded dnsmasq DNS server
962962+ #
963963+ # Possible values are:
964964+ # <any writable file>
965965+ dnsmasq = "/var/log/pihole/pihole.log"
966966+967967+ # The log file used by the webserver
968968+ #
969969+ # Possible values are:
970970+ # <any writable file>
971971+ webserver = "/var/log/pihole/webserver.log"
972972+973973+[misc]
974974+ # Using privacy levels you can specify which level of detail you want to see in your
975975+ # Pi-hole statistics. Changing this setting will trigger a restart of FTL
976976+ #
977977+ # Possible values are:
978978+ # - 0
979979+ # Don't hide anything, all statistics are available.
980980+ # - 1
981981+ # Hide domains. This setting disables Top Domains and Top Ads
982982+ # - 2
983983+ # Hide domains and clients. This setting disables Top Domains, Top Ads, Top
984984+ # Clients and Clients over time.
985985+ # - 3
986986+ # Anonymize everything. This setting disabled almost any statistics and query
987987+ # analysis. There will be no long-term database logging and no Query Log. You
988988+ # will also loose most regex features.
989989+ privacylevel = 0
990990+991991+ # During startup, in some configurations, network interfaces appear only late during
992992+ # system startup and are not ready when FTL tries to bind to them. Therefore, you may
993993+ # want FTL to wait a given amount of time before trying to start the DNS revolver.
994994+ # This setting takes any integer value between 0 and 300 seconds. To prevent delayed
995995+ # startup while the system is already running and FTL is restarted, the delay only
996996+ # takes place within the first 180 seconds (hard-coded) after booting.
997997+ delay_startup = 0
998998+999999+ # Set niceness of pihole-FTL. Defaults to -10 and can be disabled altogether by setting
10001000+ # a value of -999. The nice value is an attribute that can be used to influence the
10011001+ # CPU scheduler to favor or disfavor a process in scheduling decisions. The range of
10021002+ # the nice value varies across UNIX systems. On modern Linux, the range is -20 (high
10031003+ # priority = not very nice to other processes) to +19 (low priority).
10041004+ nice = -10
10051005+10061006+ # Should FTL translate its own stack addresses into code lines during the bug
10071007+ # backtrace? This improves the analysis of crashed significantly. It is recommended to
10081008+ # leave the option enabled. This option should only be disabled when addr2line is
10091009+ # known to not be working correctly on the machine because, in this case, the
10101010+ # malfunctioning addr2line can prevent from generating any backtrace at all.
10111011+ addr2line = true
10121012+10131013+ # Should FTL load additional dnsmasq configuration files from /etc/dnsmasq.d/?
10141014+ # Warning: This is an advanced setting and should only be used with care.
10151015+ # Incorrectly formatted or config files specifying options which can only be defined
10161016+ # once can result in conflicts with the automatic configuration of Pi-hole (see
10171017+ # /etc/pihole/dnsmasq.conf) and may stop DNS resolution from working.
10181018+ etc_dnsmasq_d = false
10191019+10201020+ # Additional lines to inject into the generated dnsmasq configuration.
10211021+ # Warning: This is an advanced setting and should only be used with care. Incorrectly
10221022+ # formatted or duplicated lines as well as lines conflicting with the automatic
10231023+ # configuration of Pi-hole can break the embedded dnsmasq and will stop DNS resolution
10241024+ # from working.
10251025+ # Use this option with extra care.
10261026+ #
10271027+ # Possible values are:
10281028+ # array of valid dnsmasq config line options
10291029+ dnsmasq_lines = []
10301030+10311031+ # Log additional information about queries and replies to pihole.log
10321032+ # When this setting is enabled, the log has extra information at the start of each
10331033+ # line. This consists of a serial number which ties together the log lines associated
10341034+ # with an individual query, and the IP address of the requestor. This setting is only
10351035+ # effective if dns.queryLogging is enabled, too. This option is only useful for
10361036+ # debugging and is not recommended for normal use.
10371037+ extraLogging = false
10381038+10391039+ # Put configuration into read-only mode. This will prevent any changes to the
10401040+ # configuration file via the API or CLI. This setting useful when a configuration is
10411041+ # to be forced/modified by some third-party application (like infrastructure-as-code
10421042+ # providers) and should not be changed by any means.
10431043+ readOnly = false
10441044+10451045+ [misc.check]
10461046+ # Pi-hole is very lightweight on resources. Nevertheless, this does not mean that you
10471047+ # should run Pi-hole on a server that is otherwise extremely busy as queuing on the
10481048+ # system can lead to unnecessary delays in DNS operation as the system becomes less
10491049+ # and less usable as the system load increases because all resources are permanently
10501050+ # in use. To account for this, FTL regularly checks the system load. To bring this to
10511051+ # your attention, FTL warns about excessive load when the 15 minute system load
10521052+ # average exceeds the number of cores.
10531053+ # This check can be disabled with this setting.
10541054+ load = true
10551055+10561056+ # FTL stores history in shared memory to allow inter-process communication with forked
10571057+ # dedicated TCP workers. If FTL runs out of memory, it cannot continue to work as
10581058+ # queries cannot be analyzed any further. Hence, FTL checks if enough shared memory is
10591059+ # available on your system and warns you if this is not the case.
10601060+ # By default, FTL warns if the shared-memory usage exceeds 90%. You can set any
10611061+ # integer limit between 0 to 100 (interpreted as percentages) where 0 means that
10621062+ # checking of shared-memory usage is disabled.
10631063+ shmem = 90
10641064+10651065+ # FTL stores its long-term history in a database file on disk. Furthermore, FTL stores
10661066+ # log files. By default, FTL warns if usage of the disk holding any crucial file
10671067+ # exceeds 90%. You can set any integer limit between 0 to 100 (interpreted as
10681068+ # percentages) where 0 means that checking of disk usage is disabled.
10691069+ disk = 90
10701070+10711071+[debug]
10721072+ # Print debugging information about database actions. This prints performed SQL
10731073+ # statements as well as some general information such as the time it took to store the
10741074+ # queries and how many have been saved to the database.
10751075+ database = false
10761076+10771077+ # Prints a list of the detected interfaces on the startup of pihole-FTL. Also, prints
10781078+ # whether these interfaces are IPv4 or IPv6 interfaces.
10791079+ networking = false
10801080+10811081+ # Print information about shared memory locks. Messages will be generated when waiting,
10821082+ # obtaining, and releasing a lock.
10831083+ locks = false
10841084+10851085+ # Print extensive query information (domains, types, replies, etc.). This has always
10861086+ # been part of the legacy debug mode of pihole-FTL.
10871087+ queries = false
10881088+10891089+ # Print flags of queries received by the DNS hooks. Only effective when DEBUG_QUERIES
10901090+ # is enabled as well.
10911091+ flags = false
10921092+10931093+ # Print information about shared memory buffers. Messages are either about creating or
10941094+ # enlarging shmem objects or string injections.
10951095+ shmem = false
10961096+10971097+ # Print information about garbage collection (GC): What is to be removed, how many have
10981098+ # been removed and how long did GC take.
10991099+ gc = false
11001100+11011101+ # Print information about ARP table processing: How long did parsing take, whether read
11021102+ # MAC addresses are valid, and if the macvendor.db file exists.
11031103+ arp = false
11041104+11051105+ # Controls if FTLDNS should print extended details about regex matching into FTL.log.
11061106+ regex = false
11071107+11081108+ # Print extra debugging information concerning API calls. This includes the request,
11091109+ # the request parameters, and the internal details about how the algorithms decide
11101110+ # which data to present and in what form. This very verbose output should only be used
11111111+ # when debugging specific API issues and can be helpful, e.g., when a client cannot
11121112+ # connect due to an obscure API error. Furthermore, this setting enables logging of
11131113+ # all API requests (auth log) and details about user authentication attempts.
11141114+ api = false
11151115+11161116+ # Print extra debugging information about TLS connections. This includes the TLS
11171117+ # version, the cipher suite, the certificate chain and much more. This very verbose
11181118+ # output should only be used when debugging specific TLS issues and can be helpful,
11191119+ # e.g., when a client cannot connect due to an obscure TLS error as modern browsers do
11201120+ # not provide much information about the underlying TLS connection and most often give
11211121+ # only very generic error messages without much/any underlying technical information.
11221122+ tls = false
11231123+11241124+ # Print information about overTime memory operations, such as initializing or moving
11251125+ # overTime slots.
11261126+ overtime = false
11271127+11281128+ # Print information about status changes for individual queries. This can be useful to
11291129+ # identify unexpected unknown queries.
11301130+ status = false
11311131+11321132+ # Print information about capabilities granted to the pihole-FTL process. The current
11331133+ # capabilities are printed on receipt of SIGHUP, i.e., the current set of capabilities
11341134+ # can be queried without restarting pihole-FTL (by setting DEBUG_CAPS=true and
11351135+ # thereafter sending killall -HUP pihole-FTL).
11361136+ caps = false
11371137+11381138+ # Print information about DNSSEC activity
11391139+ dnssec = false
11401140+11411141+ # FTL uses dynamically allocated vectors for various tasks. This config option enables
11421142+ # extensive debugging information such as information about allocation, referencing,
11431143+ # deletion, and appending.
11441144+ vectors = false
11451145+11461146+ # Extensive information about hostname resolution like which DNS servers are used in
11471147+ # the first and second hostname resolving tries (only affecting internally generated
11481148+ # PTR queries).
11491149+ resolver = false
11501150+11511151+ # Print debugging information about received EDNS(0) data.
11521152+ edns0 = false
11531153+11541154+ # Log various important client events such as change of interface (e.g., client
11551155+ # switching from WiFi to wired or VPN connection), as well as extensive reporting
11561156+ # about how clients were assigned to its groups.
11571157+ clients = false
11581158+11591159+ # Log information related to alias-client processing.
11601160+ aliasclients = false
11611161+11621162+ # Log information regarding FTL's embedded event handling queue.
11631163+ events = false
11641164+11651165+ # Log information about script helpers, e.g., due to dhcp-script.
11661166+ helper = false
11671167+11681168+ # Print config parsing details
11691169+ config = false
11701170+11711171+ # Debug monitoring of /etc/pihole filesystem events
11721172+ inotify = false
11731173+11741174+ # Debug monitoring of the webserver (CivetWeb) events
11751175+ webserver = false
11761176+11771177+ # Temporary flag that may print additional information. This debug flag is meant to be
11781178+ # used whenever needed for temporary investigations. The logged content may change
11791179+ # without further notice at any time.
11801180+ extra = false
11811181+11821182+ # Reserved debug flag
11831183+ reserved = false
11841184+11851185+ # Print information about NTP synchronization
11861186+ ntp = false
11871187+11881188+ # Print information about netlink communication and parsing
11891189+ netlink = false
11901190+11911191+ # Set all debug flags at once. This is a convenience option to enable all debug flags
11921192+ # at once. Note that this option is not persistent, setting it to true will enable all
11931193+ # *remaining* debug flags but unsetting it will disable *all* debug flags.
11941194+ all = false
+51
pkgs/by-name/pi/pihole-web/package.nix
···11+{
22+ stdenv,
33+ lib,
44+ fetchFromGitHub,
55+ pihole,
66+ pihole-ftl,
77+ procps,
88+ ...
99+}:
1010+1111+stdenv.mkDerivation (finalAttrs: {
1212+ pname = "pihole-web";
1313+ version = "6.1";
1414+1515+ src = fetchFromGitHub {
1616+ owner = "pi-hole";
1717+ repo = "web";
1818+ tag = "v${finalAttrs.version}";
1919+ hash = "sha256-+h4cPDsTAKR8MM+Za0mp2nOX1cHW8LRlFmLqvrBHfbs=";
2020+ };
2121+2222+ propagatedBuildInputs = [
2323+ pihole
2424+ pihole-ftl
2525+ procps
2626+ ];
2727+2828+ installPhase = ''
2929+ runHook preInstall
3030+3131+ mkdir -p $out/share
3232+ cp -r -t $out/share *.lp img/ scripts/ style/ vendor/
3333+3434+ mkdir -p $out/share/doc/$name/
3535+ cp README.md $out/share/doc/$name/
3636+3737+ runHook postInstall
3838+ '';
3939+4040+ meta = {
4141+ description = "Pi-hole web dashboard displaying stats and more";
4242+ longDescription = ''
4343+ Pi-hole's Web interface (based off of AdminLTE) provides a central
4444+ location to manage your Pi-hole and review the statistics generated by
4545+ FTLDNS.
4646+ '';
4747+ license = lib.licenses.eupl12;
4848+ maintainers = with lib.maintainers; [ williamvds ];
4949+ platforms = lib.platforms.linux;
5050+ };
5151+})
+32
pkgs/by-name/pi/pihole/0001-Remove-sudo.patch
···11+From a2b3aa45d6e073272608506b1d27e4f43f2b0032 Mon Sep 17 00:00:00 2001
22+From: williamvds <william@williamvds.me>
33+Date: Sun, 6 Apr 2025 23:00:41 +0100
44+Subject: [PATCH 1/3] Remove sudo
55+66+Rely on polkit and sensible permissions
77+---
88+ pihole | 8 --------
99+ 1 file changed, 8 deletions(-)
1010+1111+diff --git a/pihole b/pihole
1212+index 1d5093c..6afc48a 100755
1313+--- a/pihole
1414++++ b/pihole
1515+@@ -570,14 +570,6 @@ if [[ -z ${USER} ]]; then
1616+ USER=$(whoami)
1717+ fi
1818+1919+-# Check if the current user is neither root nor pihole and if the command
2020+-# requires root. If so, exit with an error message.
2121+-if [[ $EUID -ne 0 && ${USER} != "pihole" && need_root -eq 1 ]];then
2222+- echo -e " ${CROSS} The Pi-hole command requires root privileges, try:"
2323+- echo -e " ${COL_GREEN}sudo pihole $*${COL_NC}"
2424+- exit 1
2525+-fi
2626+-
2727+ # Handle redirecting to specific functions based on arguments
2828+ case "${1}" in
2929+ "allow" | "allowlist" ) listFunc "$@";;
3030+--
3131+2.48.1
3232+
···134134 # APEI Generic Hardware Error Source
135135 ACPI_APEI_GHES = (option yes);
136136137137+ # Without this, on some hardware the kernel fails at some
138138+ # point after the EFI stub has executed but before a console
139139+ # is set up. Regardless, it's good to have the extra debug
140140+ # anyway.
141141+ ACPI_DEBUG = yes;
142142+137143 # Enable lazy RCUs for power savings:
138144 # https://lore.kernel.org/rcu/20221019225138.GA2499943@paulmck-ThinkPad-P17-Gen-1/
139145 # RCU_LAZY depends on RCU_NOCB_CPU depends on NO_HZ_FULL