{ myLib, ... }: { kubernetes.resources = { secrets.pihole.stringData.webPassword = "ref+sops://secrets/kubernetes.yaml#/pihole/password"; deployments.pihole.spec = { selector.matchLabels.app = "pihole"; template = { metadata.labels.app = "pihole"; spec = { containers.pihole = { image = "pihole/pihole:latest"; env = { TZ.value = "Europe/Amsterdam"; PIHOLE_DNS_.value = "192.168.30.1"; WEBPASSWORD.valueFrom.secretKeyRef = { name = "pihole"; key = "webPassword"; }; }; ports = { web.containerPort = 80; dns = { containerPort = 53; protocol = "UDP"; }; }; volumeMounts = [ { name = "data"; mountPath = "/etc/pihole"; } { name = "dnsmasq"; mountPath = "/etc/dnsmasq.d"; } ]; }; volumes = { data.persistentVolumeClaim.claimName = "pihole-data"; dnsmasq.persistentVolumeClaim.claimName = "pihole-dnsmasq"; }; securityContext = { fsGroup = 1000; fsGroupChangePolicy = "OnRootMismatch"; }; }; }; }; services = { pihole.spec = { type = "LoadBalancer"; loadBalancerIP = myLib.globals.piholeIPv4; selector.app = "pihole"; ports = { dns = { protocol = "UDP"; port = 53; targetPort = "dns"; }; web = { port = 80; targetPort = "web"; }; }; }; }; }; lab = { longhorn.persistentVolumeClaim = { pihole-data = { volumeName = "pihole-data"; storage = "750Mi"; }; pihole-dnsmasq = { volumeName = "pihole-dnsmasq"; storage = "16Mi"; }; }; tailscaleIngresses.tailscale-pihole = { host = "pihole"; service.name = "pihole"; }; }; }