{ kubernetes.resources = { configMaps.pihole.data = { TZ = "Europe/Amsterdam"; PIHOLE_DNS_ = "192.168.40.1"; }; secrets.pihole.stringData.webPassword = "ref+file:///home/pim/.config/home/vals.yaml#/pihole/password"; deployments.pihole = { metadata.labels.app = "pihole"; spec = { selector.matchLabels.app = "pihole"; template = { metadata.labels.app = "pihole"; spec = { containers.pihole = { image = "pihole/pihole:latest"; envFrom = [{ configMapRef.name = "pihole"; }]; ports = [ { containerPort = 80; protocol = "TCP"; } { containerPort = 53; protocol = "UDP"; } ]; env = [{ # TODO: simplify this by using env.WEBPASSWORD? name = "WEBPASSWORD"; valueFrom.secretKeyRef = { name = "pihole"; key = "webPassword"; }; }]; volumeMounts = [ { name = "data"; mountPath = "/etc/pihole"; } { name = "dnsmasq"; mountPath = "/etc/dnsmasq.d"; } ]; }; volumes = [ { name = "data"; persistentVolumeClaim.claimName = "pihole-data"; } { name = "dnsmasq"; persistentVolumeClaim.claimName = "pihole-dnsmasq"; } ]; }; }; }; }; persistentVolumes = { pihole-data.spec = { capacity.storage = "1Mi"; accessModes = [ "ReadWriteMany" ]; nfs = { server = "lewis.hyp"; path = "/mnt/data/nfs/pihole/data"; }; }; pihole-dnsmasq.spec = { capacity.storage = "1Mi"; accessModes = [ "ReadWriteMany" ]; nfs = { server = "lewis.hyp"; path = "/mnt/data/nfs/pihole/dnsmasq"; }; }; }; persistentVolumeClaims = { pihole-data.spec = { accessModes = [ "ReadWriteMany" ]; storageClassName = ""; resources.requests.storage = "1Mi"; volumeName = "pihole-data"; }; pihole-dnsmasq.spec = { accessModes = [ "ReadWriteMany" ]; storageClassName = ""; resources.requests.storage = "1Mi"; volumeName = "pihole-dnsmasq"; }; }; services = { pihole-web.spec = { selector.app = "pihole"; ports = [{ protocol = "TCP"; port = 80; targetPort = 80; }]; }; pihole-dns.spec = { type = "LoadBalancer"; loadBalancerIP = "192.168.30.131"; selector.app = "pihole"; ports = [{ protocol = "UDP"; port = 53; targetPort = 53; }]; }; }; ingresses.pihole-web = { metadata.annotations = { "cert-manager.io/cluster-issuer" = "letsencrypt"; "traefik.ingress.kubernetes.io/router.entrypoints" = "localsecure"; }; spec = { ingressClassName = "traefik"; rules = [{ host = "pihole.kun.is"; http.paths = [{ path = "/"; pathType = "Prefix"; backend.service = { name = "pihole-web"; port.number = 80; }; }]; }]; tls = [{ secretName = "pihole-tls"; hosts = [ "pihole.kun.is" ]; }]; }; }; }; }