socketblind/pihole-dns-sync

Description

It's a custom made Pi-Hole (Ad-blocker) syncing algorithm to fullfill my demands to manage Pi-Hole DNS entries and Ad-lists from a Windows Server DNS Service centrally. Somewhat similarly as in Gravity Sync to simplify deployment of new domains and Pi-Hole Ad-list configurations.

Use at your OWN RISK!

Whats the aim of this script?

Managing more than 1 instance of Pi-Hole DNS provider from a central location (in this case Windows Server DNS)

What's not the aim of this script?

File system security
Fullfill other people's demands :) (Feel free to modify any part of the code!)

What are the requirements?

Windows Server

PowerShell 7

Python 3

modules:

Package         Version
--------------- -------
bcrypt          3.2.0
cffi            1.15.0
cryptography    36.0.1
dnspython       2.1.0
numpy           1.21.5
pandas          1.3.5
paramiko        2.9.1
pip             21.2.4
pycparser       2.21
PyNaCl          1.4.0
python-dateutil 2.8.2
pytz            2021.3
setuptools      58.1.0
six             1.16.0

Pi-Hole docker instances (unlimited hosts)
- accessible SSH ports of the hosts
- same credentials to the hosts
- same deployment architecture (Ansible example at the bottom of the page)
- host access to configuration files (point above)
- NOPASSWD: sudo option necessary to the managing user

What does the script do?

Collecting the DNS Zones from Windows DNS
- Exporting DNS Zones from DNS Service
- Parsing DNS Zones files
- Sorting DNS records
- Connecting to remote servers via SSH
- Making sure files are exists and setting necessary permissions
- Pulling gravity.db and DNS zone files
Syncing DNS zones on the local server
- Creating a backup file (.bak)
- Parsing old DNS files
- Merging DNS files (overwriting or adding domains based on the configuration option in config.py)
Syncing Gravity database on the local server
- Creating a backup file (.bak)
- Connecting to local Gravity database file
- If overwriting is True drops the necessary tables and recreating them based on the existing schema with the necessary triggers
- If overwriting is False simply inserts the new adlists and domains
Disabling Remote Pi-Hole services
Pushing modified files to the remote servers
Restarting remote DNS server
Updating Gravity database engine
Enabling Remote Pi-Hole services

Improvement ideas

Separating credentials, include in hosts and separate them in real time running
Clearing tmp directory before execution (be aware of backup files!!!)

Known bugs

Pi-Hole Web interface after a time tends to not working for DNS entry deletition

Fix:

# Removing all entries!!!
echo "" > /opt/pihole/etc/custom.list
echo "" > /opt/pihole/dnsmasq.d/05-pihole-custom-cname.conf
docker restart pihole

Usage:

Install PowerShell 7
Install Python 3
Edit files accordingly:
- config.py
  - (parsed)zones
  - zone_files_path
  - target_hosts
  - credentials
  - commands if necessary
  - overwriting behavior
  - deployment paths
  - adlists
  - whitelisted domains
- start_sync.cmd
  - path of the script
Run start_sync.cmd (recommended to run from any command line interface to see the result .\start_sync)

Ansible example:

---
- hosts: all

  tasks:
  # Installing Pi-Hole
  - name: Create Pi-Hole Directory
    become: yes
    shell: |
      sudo mkdir -p /opt/pihole/{etc,dnsmasq.d}
      sudo chown -R {{ lookup('file', '.ssh/username') }}:{{ lookup('file', '.ssh/username') }} /opt/pihole
    args:
      executable: /bin/bash

    # .ssh/username
    ########################
    # <remote_user_with_nopasswd_sudo_and_docker_management_access>

  - name: Copy Pi-Hole Resolve Configuration
    copy:
      src: conf/resolv.conf
      dest: /opt/pihole/resolv.conf

    # conf/resolv.conf
    ########################
    # nameserver 127.0.0.1 
    # options ndots:0

  - name: Create Pi-Hole Network
    community.docker.docker_network:
      name: pihole

  - name: Deploy Pi-Hole
    community.docker.docker_container:
      name: pihole
      hostname: pihole
      image: pihole/pihole:2021.12.1
      capabilities:
        - net_admin
      ports:
        - "53:53/tcp"
        - "53:53/udp"
        - "67:67/udp"
        - "8080:80/tcp"
      networks:
        - name: pihole
      env:
        TZ: Europe/Budapest
        WEBPASSWORD: '<VERY_SECRET_WEB_PASSWORD>'
        DNSSEC: 'true'
        DNS_BOGUS_PRIV: 'true'
        DNS_FQDN_REQUIRED: 'true'
        REV_SERVER: 'false'
        DNSMASQ_LISTENING: "single"
      volumes:
        - /opt/pihole/resolv.conf:/etc/resolv.conf # Fix for Gravity Update DNS resolution error
        - /opt/pihole/etc:/etc/pihole
        - /opt/pihole/dnsmasq.d:/etc/dnsmasq.d
      healthcheck:
        test: ["CMD-SHELL", "dig +short +norecurse +retry=0 @127.0.0.1 pi.hole || exit 1"]
        # interval: 5s
        # start_period: 5s
        # retries: 3
        # timeout: 3s
      restart_policy: unless-stopped

socketblind / pihole-dns-sync