harden pihole arp parsing and improve namecoin bootstrap

README.md

@@ -7,6 +7,7 @@ The stack now uses safer defaults for production:
 * Sensitive passwords are loaded from Docker secrets instead of inline values.
 * Admin/monitoring ports are bound to `127.0.0.1` on the host.
 * 3proxy now requires authentication (`auth strong`).
+* Pi-hole ARP cache parsing is disabled in Docker (`FTLCONF_database_network_parseARPcache=false`) to prevent recurring netlink `neigh`/ARP errors.
 
 Before starting in production, set these secret files:
 
@@ -19,6 +20,11 @@ printf 'YOUR_STRONG_GRAFANA_PASSWORD\n' > secrets/grafana_admin_password.txt
 SOCKS clients must now authenticate to 3proxy with credentials from
 `secrets/3proxy_users.txt`.
 
+Pi-hole note: disabling ARP parsing avoids noisy `Failed to read ARP cache`
+messages in containerized setups where neighbor-table netlink operations are not
+supported. This only affects Pi-hole's network-table enrichment, not DNS
+blocking/forwarding behavior.
+
 This container runs the following vontainers in the stack.
 
 3proxy-eagle - Socks5/http proxy

docker-compose.yml

@@ -182,6 +182,7 @@ services:
       WEBTHEME: lcars
       WEBPASSWORD_FILE: /run/secrets/PIHOLE_WEBPASSWORD
       FTLCONF_dns_upstreams: coredns
+      FTLCONF_database_network_parseARPcache: 'false'
     secrets:
       - PIHOLE_WEBPASSWORD
     # Volumes store your data between container upgrades
@@ -251,6 +252,13 @@ services:
       - "-rpcpassword=CHANGE_ME_NAMECOIN_RPC_PASSWORD"
       - "-printtoconsole"
       - "-txindex=1"
+      - "-dnsseed=1"
+      - "-addnode=162.212.154.52:8334"
+      - "-addnode=162.210.196.27:8334"
+      - "-addnode=23.108.191.178:8334"
+      - "-addnode=3.228.193.128:8334"
+      - "-addnode=3.66.245.44:8334"
+      - "-addnode=212.51.144.42:8334"
     volumes:
       - namecoin_data:/namecoin
     sysctls: