6 ms·

Setting up a secondary Pi-Hole on my home network

79 points by ingve 3y ago

Humphrey 3y ago
I am also running a Pi-Hole and have wondered about what happens when/if the Pi-Hole goes down. Is there a simple way to have a failover/fallback DNS configured rather than requiring two Pi's? On failure, I'd like my DNS to just fallback to my routers default DNS - yes I'd get ad's but I think that's acceptable.
- leipert 3y ago
  Usually in your router/DHCP you can configure two DNS servers. Define the PiHole as the first, and whatever upstream fallback IP you want as the second.
  - Fb24k 3y ago
    Note that this quite often results in round robin between the two DNS servers, not a primary and fallback as intended.
    - rahimnathwani 3y ago
      There are two ways a home router can control your DNS: A) Each client has one DNS server: the router's local IP address. The router runs dnsmasq or whatever to proxy the DNS requests. B) Each client has one or more DNS servers, with the router's IP address not listed, or listed last. If you set up B, I think most operating systems will usually use the servers in order, i.e. only fall back to the second (ISP) server if the primary (pi-hole) doesn't respond.
      - Humphrey 3y ago
        Nice. I'm using method B, but I cannot remember if I added a second IP or not. I'll need to try this when nobody else is at home.
      - aconfer 3y ago
        At least on macOS I found that if: DNS Server 1 = Pi-Hole DNS Server 2 = ISP DNS Service, OpenDNS, your router whatever when pi-hole blocks the ad's DNS query, macOS will treat that as a DNS failure and use DNS Server 2 as a fallback. Resulting in the ad being shown. Doing (A) was my first attempt and at least using a Ubiquiti router, if Pi-hole blocked a DNS query it would always fallback to the secondary DNS server. In my environment, the only way I was able to get pi-hole to work consistently was to set the pi-hole server as the only DNS server in the DHCP server.
        Narkov 3y ago
        > when pi-hole blocks the ad's DNS query, macOS will treat that as a DNS failure and use DNS Server 2 as a fallback. Resulting in the ad being shown. My experience with OSX and Pi-Hole doesn't match your experience. There's a difference between appearing to be in a failure mode (i.e. timing out) and returning blocked (null/0.0.0.0) results.
        aconfer 3y ago
        I set this up a few years ago and now that time has passed I'm not confident enough to claim what exactly led me to that conclusion. I never got around to setting up a second pi-hole server which is what led me to click on the article above. 3 years in and I've never had a blip in service so I just haven't prioritized it. I did go and test this now, and agree with you. On macOS I set my primary DNS to pi-hole and secondary to 8.8.8.8. running dig on api.segment.io (blocked on pi-hole by default), it resolved to 0.0.0.0 via pi-hole and did not try 8.8.8.8 on any attempt. So my earlier comment is incorrect above and setting a secondary DNS server as a back-up may work.
      - deberon 3y ago
        FWIW I had to undo B) just yesterday. I thought the same thing about resolving records in order but it does not. I didn’t dive too far in, but my proxy server would occasionally query my router instead of the pihole for DNS requests. Maybe I just did it wrong :) For the record I was assigning these DNS server IPs via docker compose. So perhaps that makes a difference.
- willis936 3y ago
  Even better than failover is reliability. I fought with pi-holes for years. Now I have a pfsense firewall and I'm no longer hacking together half solutions to networking challenges or rerolling an OS on a new SD card once a year.
- outworlder 3y ago
  DNS isn't really suitable for an active/backup solution. Generally, you can't do that without some automation or some explicit support from the device, which is basically non-existent. In my mikrotik device I do have a small script to replace my DNS entry with Cloudflare in case it becomes unresponsive (and then back again once it's up). That is not very transparent though and devices will get errors until the switch happens.
- jaredhallen 3y ago
  It seems like concern over reliability of the PiHole is a common concern (between the original post and the comments). I guess I'm just not sure why. I just run one, and have for quite a while. I've never had any issues, which suggests to me that the probability of failure is pretty low. But more importantly, the impact of failure is (in my opinion) almost zero. It's a home network. If the PiHole has a problem, either fix it, or change your DHCP server to hand out a different DNS server and renew a few leases.
  - sokoloff 3y ago
    If you have other, less technical family members on your network, this becomes a bigger problem, especially if you work from an office or take business trips. What’s a 60 second side quest for us is a “wifi’s down” for them. (Any outage at my house is reported as a WiFi problem.)
  - NotYourLawyer 3y ago
    I’ve had problems a couple of times in several years. Part of the issue is that it is rare—so that when it does happen, I just figure the ISP is being flaky instead of my mind immediately jumping to DNS problems.
- BizarroLand 3y ago
  With my new home network setup, my main pihole will run on docker, but my failover will be running on an old raspi that I have no other good use for. If the first goes down I'll know because my heimdall page won't load, and I'll set up some sort of ping check for the second just in case it goes down.
Havoc 3y ago
Recently did similar except set it up on a VPS. With IP filtering so that it’s not an open resolver. (Easy in my case given static ip) Theory being that it’ll provide a bit more resilience than dual locals
- oakwhiz 3y ago
  Why not use a tunnel like Wireguard so that you don't need an IP filter on the rental box side? That way if your home public IP is reassigned you don't have so much work to do. Bonus encryption for DNS traffic, too.
  - justsomehnguy 3y ago
    It's something what not everyone cn do, despite the simplicity (in our eyes)
troad 3y ago
I recently set up a Pi-Hole for the first time, but I spun it down pretty quickly. On desktop / mobile I already have client-side ad-blocking, and it's not like the Pi-Hole can block embedded ads in adware apps like YouTube on iOS, so I just couldn't really justify keeping it powered. I suppose if you have a house full of Samsung / Huawei / etc. IoTs that you really need to keep connected to the Internet for whatever reason, I could sort of see it, but I don't and I genuinely can't figure out other use cases for it. I'm far from a networking whiz though. Am I missing something?
- vizzier 3y ago
  I run a pair as my DNS. For me they're mostly there to block tracking over ads. Approx 10% of my DNS lookups get eaten by it using the standard ad list. Ublock / privacy badger grabs a bunch, the piholes still kill a bunch more.
- arrakeenrevived 3y ago
  There's a lot of advertising activity that ublock doesn't catch, but Pi-Hole does. Usually it's tracking APIs rather than ads themselves. It's also useful for clients where I can't install client-side adblocking, ie smart TVs (which try to phone home a _ton_ of advertising/analytics information). I also don't use client-side adblock on my work laptop (can't install unapproved extensions) nor my iPhone, so Pi-Hole still lets me browse ad-free on those.
  - illusive4080 3y ago
    Your work laptop allows use of local DNS? Lucky you! My work laptop gets to hit all the trackers.
    - anonymousiam 3y ago
      Back when I was working (a few years ago now), my company laptop had some lame Cisco DNS proxy installed in the name of "security." The laptop ignored the DNS servers provided by DHCP and the proxy used a pinned company DNS server. Any DNS requests that could not be resolved would redirect to some questionable server on the open Internet that also happened to have an ssh server on port 22. None of this bothered me until the time I tried to ssh into one of my local boxes, was and redirected to the bogus server, which prompted me for my password, which I stupidly provided out of habit. So now some random server on the open Internet has collected the hostname, username, and password for my local machine. I reported this to the company IT department and their response was a shrug.
reboot81 3y ago
Having two main servers hosting Pi-Home works great - until both of them are offline for any random reason. So I added a third Pi-Hole following Techno Tims easy to follow guide. By using keepalived and VIP I can update, restart and tinker with the two servers as much as I want. https://youtu.be/hPfk0qd4xEY https://youtu.be/hPfk0qd4xEY
- arrakeenrevived 3y ago
  But what if all three go offline for any random reason? Are you planning to add a fourth?
  - liquidpele 3y ago
    It’s pi holes all the way down.
  - karlshea 3y ago
    Obviously the fourth instance should be hosted on AWS connected to your local Tailnet.
    - Mustachio 3y ago
      But what if AWS has an outage as well?
      - okwhateverdude 3y ago
        Are you really web scale if you aren't multi-cloud with accounts in GCP and Azure?
- nirav72 3y ago
  Alternatively - if someone want to deal with setting up Keepalived and VIP - they can use GravitySync. It's a easy setup. https://github.com/vmstan/gravity-sync https://github.com/vmstan/gravity-sync
PenguinCoder 3y ago
This line/'service'; Really?! Why? Finally, since 32GB is a relatively small disk, I installed a daily cron job to clean the apt cache[0]: Which is a Debian package to run `apt-get clean` that the author of the blog created. Here you go, no package required: # printf 'apt-get clean\n\n' > /etc/cron.daily/daily-apt-clean && chmod +x /etc/cron.daily/daily-apt-clean` [0] - https://github.com/cdzombak/apt-daily-clean https://github.com/cdzombak/apt-daily-clean
- colechristensen 3y ago
  Way back this was a solid way of systems management, write a collection of packages that did things and then system config would be a matter of installing a list of packages.
  - TeMPOraL 3y ago
    System as declarative configuration? It sure does seem we've been spinning in circles for the past few decades, creating a complexity stack of failed attempts at solving the same problems. Wonder how much of that is social. E.g. processes and function calls are effectively equivalent: command line arguments are effectively positional or named parameters, while environmental variables are equivalent to dynamic binding - a powerful technique all but excised from programming languages, except for the Lisp family. And yes, this makes the shell a REPL. The main difference between a program and a function then feels like the relationship with programmers: a program is expected to be a named thing to distribute and sign with your name; a function is more ephemeral. But does this difference warrant having each in a separate, distinct, complex layer?
Narkov 3y ago
A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare circumstance that the Pi-Hole device is down, you fallback and get the "normal" ISP DNS service.
- malfist 3y ago
  That's exactly what I do. Never been concerned about downtime with my pihole, except the odd smart TV is something that won't using the secondary dns
- g96alqdm0x 3y ago
  The problem is that many devices instantly spill over to the secondary Pi-Hole. And rogue devices bypass the primary altogether once they begin to get blocked for a short period of time. Having a secondary without blocking nearly negates the benefit of having the primary pi-hole, for the devices that it matters for most.
  - master_crab 3y ago
    This is why you need a port 53 ban on your network that blocks all traffic except to your piholes ips. Keeps rogue machines from reaching the internet for queries
- josho 3y ago
  I did that. Then saw that filtering was inconsistent. It turns out that some systems treat the DNS list as alternatives, not as primary and failover. The spec only says the dns IPs should be specified in preference order. Nothing says to treat it as primary and failover.
  - geerlingguy 3y ago
    Yeah, far too many devices and apps seem to use DNS in a more round robin fashion. Too inconsistent for my liking.
  - magicalhippo 3y ago
firecall 3y ago
If anyone wants a redundant system and is happy not to self-host, then I can recommend NextDNS. Works great, but not free over a certain number of requests. Can’t speak to its privacy levels though - as with anything, assume records will be supplied to authorities when required. But overall it has been great - provides network wide DNS filtering and has clients for mobile and desktop devices! With a good dashboard, reporting and setting too. Cost is minimal and I’ve been happy to pay for it. A local PiHole is probably faster, but NDNS is set and forget.
- UberFly 3y ago
  I agree. I use Pi for inside my network, and NextDNS as the upstream/failover and the in-the-wild DNS for my phones. For like $10 a year is good stuff.
- dustincoates 3y ago
  I switched last year from NextDNS to ControlD and highly recommend it. NextDNS continually gave me issues and the support is non-existent (not "oh, support is slow" but more "there is no support"). May be less of an issue for the HN crowd, but it got to be too much of a hassle. The product seems to be pretty stagnant as well, whereas ControlD has been improving on a regular clip. I _think_ it's more expensive than NextDNS, but I don't remember it being extremely so. (Not so expensive that I know the price offhand, after all.)
  - firecall 3y ago
    I’d not heard of Ctrl D, so will definitely check it out!
- hnaiobsession 3y ago
  NextDNS seems to be maintaining its DNS infrastructure, but the mobile apps are almost abandoned and don’t even work many a times. The NextDNS forums have a lot of posts without any assistance or response from the main team. To me, it seems like the founders are not focused on customer support or making the NextDNS ecosystem better.
nunez 3y ago
> I have never used macvlan (or ipvlan) networking with Docker, I don’t know how to set it up, and I’ve read conflicting and confusing reports about how easy it is to use with Pi-Hole macvlan is cool in theory. it lets you broadcast a "real" MAC address through your container's veth. this allows it to get a real IP from your router. you can even use VLAN trunking to assign the MAC to a VLAN on your physical NIC. that said, i only learned about it to discuss it in my course. my dockerized Adguard Home instance uses host-mode networking since that binds the physical ifaces into the container and is just as fast as any other networked process. it's also WAY WAY WAY easier than trying to get pi-hole working in bridge mode, I've found. (I used to use pi.hole for a long time but AdGuard Home is nicer and updates itself automatically out of the box.) macvlan can help get you slightly better networking performance by avoiding internal SNAT but it's marginal at best in most cases compared to the work required to maintain macvlan/ipvlan containers. it's also, as you pointed out, not very well documented (because it's not used very often). This feature along with storage drivers are relics from a time when Docker was poised to own the container orchestration space with Swarm. All of the third-party contributions to Docker Engine basically died once Kubernetes reached critical mass, which was somewhere between 2018 and 2020. Weaveworks was probably the only company with an actively maintained networking driver for Docker Engine, but they are gone now :(
- justsomehnguy 3y ago
  > macvlan can help get you slightly better networking performance Negligible on anything what can run Docker ATM. The main benefit is what you really get the real MAC which: totally skips Docker NAT shenanigans provide a single MAC/IP on any node, which is useful for the single instance/multiple nodes/ shared storage situations
senectus1 3y ago
I run a pihole but I've also got a OPNSense router. I was thinking of turning on the AdGuard Home thats fully supported in OPNSense as a secondary. in fact I think this is just prompted me to do that.
- spants 3y ago
  I used to do it that way. However, when I did a restore to my opnsense server it could not reach the internet to update or install the adguard package because the dns wouldn't resolve!. I had to do the extra steps to move the dns externally, update/install adguard and then reimport the backup settings (or change the dns to adguard again). I settled on virtualising Opnsense and Adguard separately on a proxmox instance.
gasparto 3y ago
Mine still runs happily on a PI Model B Plus with no downtime except for maintenance. Some DNS/Netwrk fallbacks on the DSL Router. Imho the risk/consequences of a downtime don't justify having some hardware draining power. If all goes down ansible will have provisioned a new pi in no time. Nevertheless i applaud the effort and am happy to have learned some things from the article
NortySpock 3y ago
I have two PiHole instances plugged on opposite sides of the house. Instead of the mentioned GravitySync, I just occasionally copy the backup file from the primary to the secondary pihole instance (both of which are dockerized on Raspberry Pi hardware) Works great. Rarely need to think of it. I recommend looking up the recommended whitelist and adding anything there that looks relevant to you. Last downtime was a month ago when external circumstances forced me to move both servers. Yhe RPi, lacking a real time clock or its neighbor to bootstrap DNS, couldn't get the current time ir dns, and thus had out-of-date certificates for dnssec... Solution was to add the direct ip address to an NTP server temporarily to the list of websites to use for NTP.
- roach360 3y ago
  If you've got a machine running docker on your network, I definitely suggest checking out Orbital-Sync. It's a container that syncs a 'primary' pihole to as many other piholes as you need. It was a breeze to configure.
TacticalCoder 3y ago
> Having a single DNS server for your network is very stressful Common... He's talking about a home network. I also have one of my Pi set up as a DNS server (running unbound directly not PiHole though) and this thing is rock stable solid. We're talking about Linux here. I've had a Linux server reach years of uptime (kids: don't try this at home, it's not secure but it was a test of Linux's stability). Redundancy is great though but I really wouldn't lose sleep over it. If anything you can "dd" the Pi's SD card to another one and just replace the Pi (or the SD card) should anything go wrong.
- WirelessGigabit 3y ago
  My local DNS is Adguard running in Docker. It is exposed on :53 and handed out with the DHCP. If my Docker setup goes down (and it did the other day with Docker's network bug on v25) I have no DNS available. And having a firewall rule capturing ALL DNS traffic and redirecting it to this endpoint doesn't make it easy to quickly recover from. So I like this idea. All machines get the
anonymousiam 3y ago
Redundancy is good and I considered doing this too, but my pi-hole runs as a VM on the same hypervisor that hosts my router, so any hardware failure takes down the whole network anyway.
gigel82 3y ago
I have AdGuardHome running in a Docker on the PVE that also hosts my router (OpnSense) in a VM. They both have an uptime of 341 days (which was the last time I did a scheduled kernel upgrade on the host machine). There is no reason for a redundant DNS server on a typical home network.
mobilemidget 3y ago
Unfortunately still no FreeBSD port for pi-hole. This post did make me setup a void-zones-tools BSD jail on the LAN and testing it now. Seems to be very similar just without web admin.

79 points by ingve 3y ago

I am also running a Pi-Hole and have wondered about what happens when/if the Pi-Hole goes down. Is there a simple way to have a failover/fallback DNS configured rather than requiring two Pi's? On failure, I'd like my DNS to just fallback to my routers default DNS - yes I'd get ad's but I think that's acceptable.

leipert 3y ago
Usually in your router/DHCP you can configure two DNS servers. Define the PiHole as the first, and whatever upstream fallback IP you want as the second.
- Fb24k 3y ago
  Note that this quite often results in round robin between the two DNS servers, not a primary and fallback as intended.
  - rahimnathwani 3y ago
    There are two ways a home router can control your DNS: A) Each client has one DNS server: the router's local IP address. The router runs dnsmasq or whatever to proxy the DNS requests. B) Each client has one or more DNS servers, with the router's IP address not listed, or listed last. If you set up B, I think most operating systems will usually use the servers in order, i.e. only fall back to the second (ISP) server if the primary (pi-hole) doesn't respond.
    - Humphrey 3y ago
      Nice. I'm using method B, but I cannot remember if I added a second IP or not. I'll need to try this when nobody else is at home.
    - aconfer 3y ago
      At least on macOS I found that if: DNS Server 1 = Pi-Hole DNS Server 2 = ISP DNS Service, OpenDNS, your router whatever when pi-hole blocks the ad's DNS query, macOS will treat that as a DNS failure and use DNS Server 2 as a fallback. Resulting in the ad being shown. Doing (A) was my first attempt and at least using a Ubiquiti router, if Pi-hole blocked a DNS query it would always fallback to the secondary DNS server. In my environment, the only way I was able to get pi-hole to work consistently was to set the pi-hole server as the only DNS server in the DHCP server.
      - Narkov 3y ago
        > when pi-hole blocks the ad's DNS query, macOS will treat that as a DNS failure and use DNS Server 2 as a fallback. Resulting in the ad being shown. My experience with OSX and Pi-Hole doesn't match your experience. There's a difference between appearing to be in a failure mode (i.e. timing out) and returning blocked (null/0.0.0.0) results.
        aconfer 3y ago
        I set this up a few years ago and now that time has passed I'm not confident enough to claim what exactly led me to that conclusion. I never got around to setting up a second pi-hole server which is what led me to click on the article above. 3 years in and I've never had a blip in service so I just haven't prioritized it. I did go and test this now, and agree with you. On macOS I set my primary DNS to pi-hole and secondary to 8.8.8.8. running dig on api.segment.io (blocked on pi-hole by default), it resolved to 0.0.0.0 via pi-hole and did not try 8.8.8.8 on any attempt. So my earlier comment is incorrect above and setting a secondary DNS server as a back-up may work.
    - deberon 3y ago
      FWIW I had to undo B) just yesterday. I thought the same thing about resolving records in order but it does not. I didn’t dive too far in, but my proxy server would occasionally query my router instead of the pihole for DNS requests. Maybe I just did it wrong :) For the record I was assigning these DNS server IPs via docker compose. So perhaps that makes a difference.
willis936 3y ago
Even better than failover is reliability. I fought with pi-holes for years. Now I have a pfsense firewall and I'm no longer hacking together half solutions to networking challenges or rerolling an OS on a new SD card once a year.
outworlder 3y ago
DNS isn't really suitable for an active/backup solution. Generally, you can't do that without some automation or some explicit support from the device, which is basically non-existent. In my mikrotik device I do have a small script to replace my DNS entry with Cloudflare in case it becomes unresponsive (and then back again once it's up). That is not very transparent though and devices will get errors until the switch happens.
jaredhallen 3y ago
It seems like concern over reliability of the PiHole is a common concern (between the original post and the comments). I guess I'm just not sure why. I just run one, and have for quite a while. I've never had any issues, which suggests to me that the probability of failure is pretty low. But more importantly, the impact of failure is (in my opinion) almost zero. It's a home network. If the PiHole has a problem, either fix it, or change your DHCP server to hand out a different DNS server and renew a few leases.
- sokoloff 3y ago
  If you have other, less technical family members on your network, this becomes a bigger problem, especially if you work from an office or take business trips. What’s a 60 second side quest for us is a “wifi’s down” for them. (Any outage at my house is reported as a WiFi problem.)
- NotYourLawyer 3y ago
  I’ve had problems a couple of times in several years. Part of the issue is that it is rare—so that when it does happen, I just figure the ISP is being flaky instead of my mind immediately jumping to DNS problems.
BizarroLand 3y ago
With my new home network setup, my main pihole will run on docker, but my failover will be running on an old raspi that I have no other good use for. If the first goes down I'll know because my heimdall page won't load, and I'll set up some sort of ping check for the second just in case it goes down.

Havoc 3y ago

Recently did similar except set it up on a VPS. With IP filtering so that it’s not an open resolver. (Easy in my case given static ip) Theory being that it’ll provide a bit more resilience than dual locals

oakwhiz 3y ago
Why not use a tunnel like Wireguard so that you don't need an IP filter on the rental box side? That way if your home public IP is reassigned you don't have so much work to do. Bonus encryption for DNS traffic, too.
- justsomehnguy 3y ago
  It's something what not everyone cn do, despite the simplicity (in our eyes)

troad 3y ago

I recently set up a Pi-Hole for the first time, but I spun it down pretty quickly. On desktop / mobile I already have client-side ad-blocking, and it's not like the Pi-Hole can block embedded ads in adware apps like YouTube on iOS, so I just couldn't really justify keeping it powered. I suppose if you have a house full of Samsung / Huawei / etc. IoTs that you really need to keep connected to the Internet for whatever reason, I could sort of see it, but I don't and I genuinely can't figure out other use cases for it. I'm far from a networking whiz though. Am I missing something?

vizzier 3y ago
I run a pair as my DNS. For me they're mostly there to block tracking over ads. Approx 10% of my DNS lookups get eaten by it using the standard ad list. Ublock / privacy badger grabs a bunch, the piholes still kill a bunch more.
arrakeenrevived 3y ago
There's a lot of advertising activity that ublock doesn't catch, but Pi-Hole does. Usually it's tracking APIs rather than ads themselves. It's also useful for clients where I can't install client-side adblocking, ie smart TVs (which try to phone home a _ton_ of advertising/analytics information). I also don't use client-side adblock on my work laptop (can't install unapproved extensions) nor my iPhone, so Pi-Hole still lets me browse ad-free on those.
- illusive4080 3y ago
  Your work laptop allows use of local DNS? Lucky you! My work laptop gets to hit all the trackers.
  - anonymousiam 3y ago
    Back when I was working (a few years ago now), my company laptop had some lame Cisco DNS proxy installed in the name of "security." The laptop ignored the DNS servers provided by DHCP and the proxy used a pinned company DNS server. Any DNS requests that could not be resolved would redirect to some questionable server on the open Internet that also happened to have an ssh server on port 22. None of this bothered me until the time I tried to ssh into one of my local boxes, was and redirected to the bogus server, which prompted me for my password, which I stupidly provided out of habit. So now some random server on the open Internet has collected the hostname, username, and password for my local machine. I reported this to the company IT department and their response was a shrug.

reboot81 3y ago

Having two main servers hosting Pi-Home works great - until both of them are offline for any random reason. So I added a third Pi-Hole following Techno Tims easy to follow guide. By using keepalived and VIP I can update, restart and tinker with the two servers as much as I want. https://youtu.be/hPfk0qd4xEY https://youtu.be/hPfk0qd4xEY

arrakeenrevived 3y ago
But what if all three go offline for any random reason? Are you planning to add a fourth?
- liquidpele 3y ago
  It’s pi holes all the way down.
- karlshea 3y ago
  Obviously the fourth instance should be hosted on AWS connected to your local Tailnet.
  - Mustachio 3y ago
    But what if AWS has an outage as well?
    - okwhateverdude 3y ago
      Are you really web scale if you aren't multi-cloud with accounts in GCP and Azure?
nirav72 3y ago
Alternatively - if someone want to deal with setting up Keepalived and VIP - they can use GravitySync. It's a easy setup. https://github.com/vmstan/gravity-sync https://github.com/vmstan/gravity-sync

PenguinCoder 3y ago

This line/'service'; Really?! Why? Finally, since 32GB is a relatively small disk, I installed a daily cron job to clean the apt cache[0]: Which is a Debian package to run `apt-get clean` that the author of the blog created. Here you go, no package required: # printf 'apt-get clean\n\n' > /etc/cron.daily/daily-apt-clean && chmod +x /etc/cron.daily/daily-apt-clean` [0] - https://github.com/cdzombak/apt-daily-clean https://github.com/cdzombak/apt-daily-clean

colechristensen 3y ago
Way back this was a solid way of systems management, write a collection of packages that did things and then system config would be a matter of installing a list of packages.
- TeMPOraL 3y ago
  System as declarative configuration? It sure does seem we've been spinning in circles for the past few decades, creating a complexity stack of failed attempts at solving the same problems. Wonder how much of that is social. E.g. processes and function calls are effectively equivalent: command line arguments are effectively positional or named parameters, while environmental variables are equivalent to dynamic binding - a powerful technique all but excised from programming languages, except for the Lisp family. And yes, this makes the shell a REPL. The main difference between a program and a function then feels like the relationship with programmers: a program is expected to be a named thing to distribute and sign with your name; a function is more ephemeral. But does this difference warrant having each in a separate, distinct, complex layer?

Narkov 3y ago

A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare circumstance that the Pi-Hole device is down, you fallback and get the "normal" ISP DNS service.

malfist 3y ago
That's exactly what I do. Never been concerned about downtime with my pihole, except the odd smart TV is something that won't using the secondary dns
g96alqdm0x 3y ago
The problem is that many devices instantly spill over to the secondary Pi-Hole. And rogue devices bypass the primary altogether once they begin to get blocked for a short period of time. Having a secondary without blocking nearly negates the benefit of having the primary pi-hole, for the devices that it matters for most.
- master_crab 3y ago
  This is why you need a port 53 ban on your network that blocks all traffic except to your piholes ips. Keeps rogue machines from reaching the internet for queries
josho 3y ago
I did that. Then saw that filtering was inconsistent. It turns out that some systems treat the DNS list as alternatives, not as primary and failover. The spec only says the dns IPs should be specified in preference order. Nothing says to treat it as primary and failover.
- geerlingguy 3y ago
  Yeah, far too many devices and apps seem to use DNS in a more round robin fashion. Too inconsistent for my liking.
- magicalhippo 3y ago

firecall 3y ago

If anyone wants a redundant system and is happy not to self-host, then I can recommend NextDNS. Works great, but not free over a certain number of requests. Can’t speak to its privacy levels though - as with anything, assume records will be supplied to authorities when required. But overall it has been great - provides network wide DNS filtering and has clients for mobile and desktop devices! With a good dashboard, reporting and setting too. Cost is minimal and I’ve been happy to pay for it. A local PiHole is probably faster, but NDNS is set and forget.

UberFly 3y ago
I agree. I use Pi for inside my network, and NextDNS as the upstream/failover and the in-the-wild DNS for my phones. For like $10 a year is good stuff.
dustincoates 3y ago
I switched last year from NextDNS to ControlD and highly recommend it. NextDNS continually gave me issues and the support is non-existent (not "oh, support is slow" but more "there is no support"). May be less of an issue for the HN crowd, but it got to be too much of a hassle. The product seems to be pretty stagnant as well, whereas ControlD has been improving on a regular clip. I _think_ it's more expensive than NextDNS, but I don't remember it being extremely so. (Not so expensive that I know the price offhand, after all.)
- firecall 3y ago
  I’d not heard of Ctrl D, so will definitely check it out!
hnaiobsession 3y ago
NextDNS seems to be maintaining its DNS infrastructure, but the mobile apps are almost abandoned and don’t even work many a times. The NextDNS forums have a lot of posts without any assistance or response from the main team. To me, it seems like the founders are not focused on customer support or making the NextDNS ecosystem better.

nunez 3y ago

> I have never used macvlan (or ipvlan) networking with Docker, I don’t know how to set it up, and I’ve read conflicting and confusing reports about how easy it is to use with Pi-Hole macvlan is cool in theory. it lets you broadcast a "real" MAC address through your container's veth. this allows it to get a real IP from your router. you can even use VLAN trunking to assign the MAC to a VLAN on your physical NIC. that said, i only learned about it to discuss it in my course. my dockerized Adguard Home instance uses host-mode networking since that binds the physical ifaces into the container and is just as fast as any other networked process. it's also WAY WAY WAY easier than trying to get pi-hole working in bridge mode, I've found. (I used to use pi.hole for a long time but AdGuard Home is nicer and updates itself automatically out of the box.) macvlan can help get you slightly better networking performance by avoiding internal SNAT but it's marginal at best in most cases compared to the work required to maintain macvlan/ipvlan containers. it's also, as you pointed out, not very well documented (because it's not used very often). This feature along with storage drivers are relics from a time when Docker was poised to own the container orchestration space with Swarm. All of the third-party contributions to Docker Engine basically died once Kubernetes reached critical mass, which was somewhere between 2018 and 2020. Weaveworks was probably the only company with an actively maintained networking driver for Docker Engine, but they are gone now :(

justsomehnguy 3y ago
> macvlan can help get you slightly better networking performance Negligible on anything what can run Docker ATM. The main benefit is what you really get the real MAC which: totally skips Docker NAT shenanigans provide a single MAC/IP on any node, which is useful for the single instance/multiple nodes/ shared storage situations

senectus1 3y ago

I run a pihole but I've also got a OPNSense router. I was thinking of turning on the AdGuard Home thats fully supported in OPNSense as a secondary. in fact I think this is just prompted me to do that.

spants 3y ago
I used to do it that way. However, when I did a restore to my opnsense server it could not reach the internet to update or install the adguard package because the dns wouldn't resolve!. I had to do the extra steps to move the dns externally, update/install adguard and then reimport the backup settings (or change the dns to adguard again). I settled on virtualising Opnsense and Adguard separately on a proxmox instance.

gasparto 3y ago

Mine still runs happily on a PI Model B Plus with no downtime except for maintenance. Some DNS/Netwrk fallbacks on the DSL Router. Imho the risk/consequences of a downtime don't justify having some hardware draining power. If all goes down ansible will have provisioned a new pi in no time. Nevertheless i applaud the effort and am happy to have learned some things from the article

NortySpock 3y ago

I have two PiHole instances plugged on opposite sides of the house. Instead of the mentioned GravitySync, I just occasionally copy the backup file from the primary to the secondary pihole instance (both of which are dockerized on Raspberry Pi hardware) Works great. Rarely need to think of it. I recommend looking up the recommended whitelist and adding anything there that looks relevant to you. Last downtime was a month ago when external circumstances forced me to move both servers. Yhe RPi, lacking a real time clock or its neighbor to bootstrap DNS, couldn't get the current time ir dns, and thus had out-of-date certificates for dnssec... Solution was to add the direct ip address to an NTP server temporarily to the list of websites to use for NTP.

roach360 3y ago
If you've got a machine running docker on your network, I definitely suggest checking out Orbital-Sync. It's a container that syncs a 'primary' pihole to as many other piholes as you need. It was a breeze to configure.

TacticalCoder 3y ago

> Having a single DNS server for your network is very stressful Common... He's talking about a home network. I also have one of my Pi set up as a DNS server (running unbound directly not PiHole though) and this thing is rock stable solid. We're talking about Linux here. I've had a Linux server reach years of uptime (kids: don't try this at home, it's not secure but it was a test of Linux's stability). Redundancy is great though but I really wouldn't lose sleep over it. If anything you can "dd" the Pi's SD card to another one and just replace the Pi (or the SD card) should anything go wrong.

WirelessGigabit 3y ago
My local DNS is Adguard running in Docker. It is exposed on :53 and handed out with the DHCP. If my Docker setup goes down (and it did the other day with Docker's network bug on v25) I have no DNS available. And having a firewall rule capturing ALL DNS traffic and redirecting it to this endpoint doesn't make it easy to quickly recover from. So I like this idea. All machines get the

anonymousiam 3y ago

Redundancy is good and I considered doing this too, but my pi-hole runs as a VM on the same hypervisor that hosts my router, so any hardware failure takes down the whole network anyway.

gigel82 3y ago

I have AdGuardHome running in a Docker on the PVE that also hosts my router (OpnSense) in a VM. They both have an uptime of 341 days (which was the last time I did a scheduled kernel upgrade on the host machine). There is no reason for a redundant DNS server on a typical home network.

mobilemidget 3y ago

Unfortunately still no FreeBSD port for pi-hole. This post did make me setup a void-zones-tools BSD jail on the LAN and testing it now. Seems to be very similar just without web admin.