Hi Folks,
I tried this week to run a PiHole container in combination with Homeassistant and Traefik.
For this I had to make some changes to @jono’s configuration, which I would like to share with you.
My needs were…:
- …to run PiHole with an IPv4 and an IPv6 address.
(Because I can’t disable IPv6 on my router and therefore need an IPv6 capable DNS server)
–> For this I had to make the Traefik Docker network IPv6 capable first.
- …to make Homeassistant externally accessible via HTTPS and PiHole internally accessible via HTTP.
(Because PiHole currently supports, at least not without detours, only HTTP as frontend for administration and advertising blocking)
–> For this I had to disable the standard HTTP --> HTTPS forwarding used by @jono in Traefik and switch it on at container level in the docker-compose.yaml.
- …to make PiHole internally accessible via port 80
(Because PiHole needs the standard HTTP port for the correct display of the placeholders for blocked advertisements.)
–> For this I had to use a special frontendrule that I had found after some searching around.
Here are my steps to achieve these goals:
1. Goal) Run PiHole with an IPv4 and an IPv6
1.1 Deactivate all containers that already used the Traefik proxy network. In my case this was only Homeassistant and Traefik itself.
sudo docker rm -f YOUR_TRAEFIK_CONTAINER_ID
sudo docker rm -f YOUR_HOMEASSISTANT_CONTAINER_ID
1.2 Enable IPv6 support for Docker by edit /etc/docker/daemon.json and set the ipv6 key to true .
{{{ "ipv6": true }}}
Then Reload the Docker configuration file.
sudo systemctl reload docker
1.3 Remove the old Traefik proxy network and add a new one with IPV6 support
sudo docker network rm YOUR_TRAEFIK_PROXY_NETWORK
sudo docker network create --ipv6 --driver=bridge --subnet=172.20.0.0/16 --subnet=2002:ac14:0000::/48 --gateway=172.20.0.1 proxy
2. Goal) Make Homeassistant externally accessible via HTTPS and PiHole internally accessible via HTTP.
2.1 For this you only have to make some modifications in the Traefik.toml
Change this:
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
to this:
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
For more info you can have a look here: https://docs.traefik.io/user-guide/examples/
2.2 After that only two additional entries have to be made in the labels for Homeassistant in docker-compose.yaml.
- "traefik.frontend.headers.SSLRedirect=true"
- "traefik.frontend.entryPoints=http,https"
Only containers with these labels are now automatically redirected from HTTP to HTTPS. For all other containers there is no automatic redirection anymore!
3. Goal) Make PiHole internally accessible via port 80
3.1 For this you also need some additional labels for the PiHole container in the docker-compose.yaml
- "traefik.frontend.rule=HostRegexp:{catchall:.*}"
- "traefik.frontend.priority=1"
For more info you can have a look here: https://www.techjunktrunk.com/docker/2017/11/03/traefik-default-server-catch-all/
3.2 Last but not least you have to change to the docker-compose.yaml directory and execute it with a force recreate. Otherwise the newly created network would not be assigned correctly.
sudo docker-compose up -d --force-recreate
ATTENTION: Of course, the default settings for the PiHole container must also have been made beforehand. This is not described here.
More information about these settings can be found in the official info for the Pihole Container: https://hub.docker.com/r/pihole/pihole/
As an example I attach my current docker-compose.yaml here:
version: '3'
networks:
proxy:
external: true
services:
portainer:
container_name: portainer
restart: always
image: portainer/portainer
volumes:
- /home/docker_data/portainer:/data
- /var/run/docker.sock:/var/run/docker.sock
ports:
- "9000:9000"
reverse-proxy:
container_name: reverse-proxy
image: traefik
restart: always
command: --web --docker --docker.domain=YOUR_LAN_DOMAIN
networks:
- proxy
ports:
- 8080:8080
- 80:80
- 443:443
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /home/docker_data/traefik/traefik.toml:/traefik.toml
- /home/docker_data/traefik/acme.json:/acme.json
pihole:
container_name: pihole
image: pihole/pihole
restart: unless-stopped
ports:
- 53:53/tcp
- 53:53/udp
- 67:67/udp
- 8053:80/tcp
environment:
- ServerIP=YOUR_IPv4_SERVER_IP
- ServerIPv6=YOUR_IPv6_SERVER_IP
- IPv6=true
- PROXY_LOCATION=pihole
- VIRTUAL_HOST=pihole.YOUR_LAN_DOMAIN
- VIRTUAL_PORT=80
- TZ='Europe/Berlin'
- WEBPASSWORD=******
networks:
- proxy
volumes:
- /home/docker_data/pihole/pihole.log:/var/log/pihole.log
- /home/docker_data/pihole/etc-pihole/:/etc/pihole/
- /home/docker_data/pihole/etc-dnsmasqd/:/etc/dnsmasq.d/
labels:
- traefik.enable=true
- traefik.docker.network=proxy
- traefik.backend=pihole
- traefik.frontend.rule=HostRegexp:pihole.YOUR_LAN_DOMAIN,{catchall:.*}
- traefik.frontend.priority=1
- traefik.port=80
- traefik.frontend.entryPoints=http
postgres:
container_name: postgres
restart: unless-stopped
image: postgres
volumes:
- /home/docker_data/postgres:/var/lib/postgresql/data
- /etc/localtime:/etc/localtime:ro
environment:
- POSTGRES_USER=******
- POSTGRES_PASSWORD=******
ports:
- "5432:5432"
influxdb:
container_name: influxdb
restart: unless-stopped
image: influxdb
volumes:
- /home/docker_data/influxdb/influxdb.conf:/etc/influxdb/influxdb.conf:ro
- /home/docker_data/influxdb/db:/var/lib/influxdb
environment:
- INFLUX_GRAPHITE_ENABLED='true'
ports:
- "8086:8086"
grafana:
container_name: grafana
restart: unless-stopped
image: grafana/grafana
volumes:
- /home/docker_data/grafana:/var/lib/grafana
ports:
- "3000:3000"
homeassistant:
container_name: home-assistant
restart: always
image: homeassistant/home-assistant
depends_on:
- "reverse-proxy"
networks:
- proxy
ports:
- 8123:8123
volumes:
- /home/docker_data/homeassistant:/config
- /etc/localtime:/etc/localtime:ro
privileged: true
labels:
- "traefik.enable=true"
- "traefik.docker.network=proxy"
- "traefik.backend=home-assistant"
- "traefik.frontend.rule=Host:YOUR_WWW_DOMAIN"
- "traefik.port=8123"
- "traefik.default.protocol=http"
- "traefik.frontend.headers.SSLRedirect=true"
- "traefik.frontend.entryPoints=http,https"
I hope that this information can help one or the other.
Greeting.
