nixos-servers/kubenix-modules/pihole.nix

{ myLib, ... }: {
  kubernetes.resources = {
    configMaps.pihole.data = {
      TZ = "Europe/Amsterdam";
      PIHOLE_DNS_ = "192.168.30.1";
    };

    secrets.pihole.stringData.webPassword = "ref+sops://secrets/kubernetes.yaml#/pihole/password";

    deployments.pihole = {
      metadata.labels.app = "pihole";

      spec = {
        selector.matchLabels.app = "pihole";

        template = {
          metadata.labels.app = "pihole";

          spec = {
            containers.pihole = {
              image = "pihole/pihole:latest";
              envFrom = [{ configMapRef.name = "pihole"; }];

              ports = {
                web.containerPort = 80;

                dns = {
                  containerPort = 53;
                  protocol = "UDP";
                };
              };

              env.WEBPASSWORD.valueFrom.secretKeyRef = {
                name = "pihole";
                key = "webPassword";
              };

              volumeMounts = [
                {
                  name = "data";
                  mountPath = "/etc/pihole";
                }
                {
                  name = "dnsmasq";
                  mountPath = "/etc/dnsmasq.d";
                }
              ];
            };

            volumes = {
              data.persistentVolumeClaim.claimName = "pihole-data";
              dnsmasq.persistentVolumeClaim.claimName = "pihole-dnsmasq";
            };

            securityContext = {
              fsGroup = 1000;
              fsGroupChangePolicy = "OnRootMismatch";
            };
          };
        };
      };
    };

    services = {
      pihole-web.spec = {
        selector.app = "pihole";

        ports.web = {
          port = 80;
          targetPort = "web";
        };
      };

      pihole-dns.spec = {
        type = "LoadBalancer";
        loadBalancerIP = myLib.globals.piholeIPv4;
        selector.app = "pihole";

        ports.dns = {
          protocol = "UDP";
          port = 53;
          targetPort = "dns";
        };
      };
    };
  };

  lab = {
    ingresses.pihole = {
      host = "pihole.kun.is";
      entrypoint = "localsecure";

      service = {
        name = "pihole-web";
        portName = "web";
      };
    };
  };
}