Repository: benbalter/pi-hole-cloudflared-docker-compose-ansible-caddy
Branch: main
Commit: 81b2bd025453
Files: 7
Total size: 11.0 KB

Directory structure:
gitextract_lhdn19qe/

├── Caddyfile
├── LICENSE.md
├── README.md
├── caddy.Dockerfile
├── docker-compose.yml
├── hosts.example.yml
└── playbook.yml

================================================
FILE CONTENTS
================================================

================================================
FILE: Caddyfile
================================================
dns.example.com

reverse_proxy 10.0.0.3:80

tls you@example.com {
  # I use cloudflare here for DNS, but you can use any provider
  dns cloudflare {env.CLOUDFLARE_API_TOKEN}
  resolvers 10.0.0.3
}

# Not necessary, but built-in compression can speed things up a bit
encode zstd gzip


================================================
FILE: LICENSE.md
================================================
MIT License

Copyright (c) 2021 Ben Balter

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.


================================================
FILE: README.md
================================================
# Example Docker Compose and Ansible configuration for running Pi-Hole, Cloudflared, and Caddy

Example configuration for using Pi-Hole, Cloudflared, Docker Compose, Ansible, and Caddy to over-engineer your home network for privacy and security.

## Details

See [How I re-over-engineered my home network for privacy and security](https://ben.balter.com/2021/09/01/how-i-re-over-engineered-my-home-network/) (and [How I over-engineered my home network for privacy and security](https://ben.balter.com/2020/12/04/over-engineered-home-network-for-privacy-and-security/)).

## Usage

1. Download the [Raspberry Pi Imager](https://www.raspberrypi.org/software/) and flash the latest version of Raspberry Pi OS *Lite*.
2. Run `ansible-playbook playbook.yml --inventory hosts.yml`
3. Sit back and wait until you have a fully configured PiHole running in about 5-10 minutes


================================================
FILE: caddy.Dockerfile
================================================
FROM caddy:builder AS builder

RUN xcaddy build \
    --with github.com/caddy-dns/cloudflare

FROM caddy:latest

COPY --from=builder /usr/bin/caddy /usr/bin/caddy


================================================
FILE: docker-compose.yml
================================================
version: "3"

services:
  cloudflared:
    container_name: cloudflared
    restart: unless-stopped
    # Cloudflared doesn't have an armvf image, so we build from source
    build: https://github.com/cloudflare/cloudflared.git
    command: proxy-dns
    environment:
      # Replace with your Cloudflare Gateway domain or a public DNS over HTTPS server
      TUNNEL_DNS_UPSTREAM: "https://XXX.cloudflare-gateway.com/dns-query"
      TUNNEL_DNS_BOOTSTRAP: "https://1.1.1.2/dns-query"
      TUNNEL_DNS_ADDRESS: "0.0.0.0"
      TUNNEL_DNS_PORT: "53"

    # I'm pretty sure cloudflared doesn't use the bootstrap server, so we define it here too
    dns:
      - 1.1.1.2
      - 1.0.0.2
    networks:
      net:
        ipv4_address: 10.0.0.2
    healthcheck:
      test: ["CMD", "cloudflared", "version"]

  pihole:
    container_name: pihole
    restart: unless-stopped
    image: pihole/pihole
    secrets:
      - pihole_web_password
    environment: 
      # Replace with your desired configuration
      TZ: America/New_York
      DNSSEC: "true"
      DNS_BOGUS_PRIV: "true"
      DNS_FQDN_REQUIRED: "true"
      TEMPERATUREUNIT: f
      PIHOLE_DNS_: "10.0.0.2"
      WEBPASSWORD_FILE: /run/secrets/pihole_web_password
      REV_SERVER: "true"
      REV_SERVER_TARGET: "192.168.1.1"
      REV_SERVER_CIDR: "192.168.0.0/16"
      VIRTUAL_HOST: dns.example.com
    ports: 
      - "53:53/tcp"
      - "53:53/udp"
    volumes:
      - './etc-pihole/:/etc/pihole/'
      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    networks:
      net:
        ipv4_address: 10.0.0.3
    dns:
      - "10.0.0.2"
    depends_on:
      - cloudflared
    healthcheck:
      test: ["CMD", "dig", "+norecurse", "+retry=0", "@127.0.0.1", "pi.hole"]
  caddy:
    build:
      context: .
      dockerfile: caddy.Dockerfile
    container_name: caddy
    restart: unless-stopped
    ports:
      - "80:80" # For HTTP -> HTTPS redirects
      - "443:443"
    volumes:
      - $PWD/Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    env_file:
      - .caddy.env
    dns:
      - 1.0.0.3
    healthcheck:
        test: ["CMD", "caddy", "version"]
    depends_on:
      - pihole
      - cloudflared
    networks:
      net: {}

volumes:
  caddy_data:
    external: true
  caddy_config:

networks:
  net:
    driver: bridge
    ipam:
     config:
       - subnet: 10.0.0.0/29

# PiHole Web password lives in a .pihole_web_password to keep it out of the config
secrets:
  pihole_web_password: 
    file: .pihole_web_password


================================================
FILE: hosts.example.yml
================================================
all:
  hosts:
    192.168.1.2:
      ansible_user: pi
      ansible_python_interpreter: auto


================================================
FILE: playbook.yml
================================================
- hosts: all
  tasks:
    # Allows you to SSH in to the PiHole via SSH, instead of password auth, pulling from your GitHub Public key
    - name: Ensure SSH Key is authorized
      authorized_key:
        user: pi
        state: present
        key: https://github.com/benbalter.keys

    # Ensure PiHole password is not the default
    # Here I'm using 1Password as my secret store, but you could use another source
    - name: Change pi user password
      become: true
      user:
        name: pi
        update_password: always
        password: "{{ lookup('community.general.onepassword', 'PiHole', field='Pi@ login') | password_hash('sha512') }}"
    
    # Update system-level dependencies
    - name: update and upgrade apt packages
      become: true
      apt:
        upgrade: dist
        update_cache: true
        
    # Set Static IP of PiHole so other devices can query it for DNS lookups
    - name: Install network manager
      become: true
      apt:
        name: network-manager
        state: present
    - name: configure network
      become: true
      community.general.nmcli:
        state: present
        conn_name: eth0
        ifname: eth0
        type: ethernet
        ip4: 192.168.1.2/24
        gw4: 192.168.1.1
        dns4:
          - 1.1.1.2
    
    # Ensure timestamps are in my local timezone
    - name: set timezone
      become: true
      community.general.timezone:
        name: America/New_York
        
    # A deploy key allows you to pull (or push) from a private GitHub repo
    - name: Ensure deploy key is present
      community.crypto.openssh_keypair:
        path: "~/.ssh/id_github"
        type: ed25519
      register: deploy_key

    # If a new deploy key is generated, authorize it for the repo
    # I'm using 1Password as my secret store, but you could use another source
    - name: Ensure deploy key is authorized
      community.general.github_deploy_key:
        key: "{{ deploy_key.public_key }}"
        name: Raspberry Pi
        state: present
        owner: benbalter
        repo: pi-hole
        token: "{{ lookup('community.general.onepassword', 'PiHole', field='GitHub Token') }}"
    
    - name: Install docker dependencies
      become: true
      apt:
        name: "{{ item }}"
        state: present
        update_cache: true
      loop:
        - apt-transport-https
        - ca-certificates
        - curl
        - gnupg
        - lsb-release
        - python3-pip
        - python3-setuptools
    - name: add Docker GPG key
      become: true
      apt_key:
        url: https://download.docker.com/linux/debian/gpg
        state: present
    - name: add docker repository to apt
      become: true
      apt_repository:
        repo: deb [arch=armhf signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian buster stable
        state: present
    - name: install docker
      become: true
      apt:
        name: "{{ item }}"
        state: present
      loop:
        - docker-ce
        - docker-ce-cli
        - containerd.io
    - name: Add user to docker group
      become: true
      user:
        name: pi
        groups: docker
        append: true
    - name: Enable & Start Docker service
      become: true
      service:
        name: docker
        enabled: true
        state: started
    - name: Install pip components
      pip:
        executable: pip3
        name:
          - docker
          - docker-compose
          - virtualenv

    # I version my config in a private Git Repo, so I clone it down using the deploy key
    # Note: This will not work without modification, as it's a private repo
    - name: Clone GitHub repo
      git:
        repo: git@github.com:benbalter/pi-hole.git
        dest: /home/pi/pi-hole/
        clone: true
        update: true
        key_file: ~/.ssh/id_github
        accept_hostkey: true
        
    # Automatically upgrade apt packages
    - name: install unattended upgrades
      become: true
      apt:
        name: unattended-upgrades
        state: present
    - name: Setup unattended upgrades
      debconf:
        name: unattended-upgrades
        question: unattended-upgrades/enable_auto_updates
        vtype: boolean
        value: "true"

    # Prevents SSH brute force attacks
    - name: install fail2ban
      become: true
      apt:
        name: fail2ban
        state: present
    
    # Install and enable NTP to ensure the clock remains accurate
    - name: install ntp
      become: true
      apt:
        name: ntp
        state: present
    - name: enable ntp
      service:
        name: ntp
        state: started
        enabled: true
        
    # Installs firewall
    - name: install ufw
      become: true
      apt:
        name: ufw
        state: present

    # Rate limits SSH attempts
    - name: limit ssh
      become: true
      community.general.ufw:
        rule: limit
        port: ssh
        proto: tcp

    # Firewall rules
    - name: Allow all access to SSH, DNS, and WWW
      become: true
      community.general.ufw:
        rule: allow
        app: '{{ item }}'
      loop:
        - SSH
        - DNS
        - WWW
        - WWW Secure
    - name: enable ufw and default to deny
      become: true
      ufw:
        state: enabled
        default: deny
    
    # Set PiHole (Web Admin) password, referenced above. 
    # I'm using 1Password, but you could use any secret store.
    - name: Set Pi-Hole secret
      copy:
        dest: /home/pi/pi-hole/.pihole_web_password
        content: "{{ lookup('community.general.onepassword', 'Raspberry pi', field='password') }}"
        
    - name: Set Caddy secret
      copy:
        dest: /home/pi/pi-hole/.caddy.env
        # I'm using 1Password here, but you could use any secret store you wanted
        content: "CLOUDFLARE_API_TOKEN={{ lookup('community.general.onepassword', 'Raspberry pi', field='Cloudflare Token') }}"
        mode: 0700

    - name: Create and start docker compose services
      community.docker.docker_compose:
        # Change to path to your docker-compose.yml. See below for how to clone a repo
        project_src: /home/pi/pi-hole
        pull: true
        build: true
        remove_orphans: true
      register: output