Fix Pi-hole DNS over Tailscale #7

Merged

backmeupplz merged 1 commit from codex/myg-kaneo-3-pihole-dns into master

2026-05-03 16:03:34 +00:00

backmeupplz commented

2026-05-03 15:53:34 +00:00

(Migrated from github.com)

Summary

switch Pi-hole to Tailscale sidecar namespace mode so its TCP/UDP 53 listeners are reachable on the Pi-hole tailnet IP while LAN port bindings remain published
document the LAN vs Tailscale DNS resolver addresses in Pi-hole post-install notes
harden exit-node Pi-hole DNS lookup to use the pihole_default Docker network instead of an arbitrary sidecar network IP

Validation

npm install --no-package-lock in web/ to satisfy local build prerequisites; web/node_modules remains ignored
npm run build in web/ to create ignored web/dist for Rust asset embedding
cargo test pihole_has_correct_metadata_and_storage passed
cargo test inject_sidecar_mode_exposes_pihole_dns_ports_on_sidecar passed
cargo test parse_pihole_inspect passed
cargo test passed: 276 lib tests, 6 main tests, 83 API tests, 12 ignored backup E2E tests

Manual QA

Required on a real MyGround/Tailscale deployment because tailnet reachability depends on Tailscale machine state and network routing. After deploying/regenerating the Pi-hole compose, verify:

dig +time=2 +tries=1 @<tailnet-pihole-ip> example.com A +stats returns over UDP
dig +tcp +time=2 +tries=1 @<tailnet-pihole-ip> example.com A +stats returns over TCP
dig +time=2 +tries=1 @192.168.1.145 example.com A +stats still returns quickly on LAN

Expected Tailscale resolver: the Pi-hole app Tailscale machine name or its 100.x tailnet IP on port 53.

## Summary - switch Pi-hole to Tailscale sidecar namespace mode so its TCP/UDP 53 listeners are reachable on the Pi-hole tailnet IP while LAN port bindings remain published - document the LAN vs Tailscale DNS resolver addresses in Pi-hole post-install notes - harden exit-node Pi-hole DNS lookup to use the `pihole_default` Docker network instead of an arbitrary sidecar network IP ## Validation - `npm install --no-package-lock` in `web/` to satisfy local build prerequisites; `web/node_modules` remains ignored - `npm run build` in `web/` to create ignored `web/dist` for Rust asset embedding - `cargo test pihole_has_correct_metadata_and_storage` passed - `cargo test inject_sidecar_mode_exposes_pihole_dns_ports_on_sidecar` passed - `cargo test parse_pihole_inspect` passed - `cargo test` passed: 276 lib tests, 6 main tests, 83 API tests, 12 ignored backup E2E tests ## Manual QA Required on a real MyGround/Tailscale deployment because tailnet reachability depends on Tailscale machine state and network routing. After deploying/regenerating the Pi-hole compose, verify: - `dig +time=2 +tries=1 @<tailnet-pihole-ip> example.com A +stats` returns over UDP - `dig +tcp +time=2 +tries=1 @<tailnet-pihole-ip> example.com A +stats` returns over TCP - `dig +time=2 +tries=1 @192.168.1.145 example.com A +stats` still returns quickly on LAN Expected Tailscale resolver: the Pi-hole app Tailscale machine name or its 100.x tailnet IP on port 53.