diff --git a/docs/guides/nginx-configuration.md b/docs/guides/nginx-configuration.md new file mode 100644 index 0000000..92821c6 --- /dev/null +++ b/docs/guides/nginx-configuration.md @@ -0,0 +1,88 @@ +### Notes & Warnings +- If you're using php5, change all instances of `php7.0-fpm` to `php5-fpm` and change `/run/php/php7.0-fpm.sock` to `/var/run/php5-fpm.sock` + +### Basic requirements +1. Stop default lighttpd +`service lighttpd stop` +2. Install necessary packages +`apt-get -y install nginx php7.0-fpm php7.0-zip apache2-utils` +3. Disable lighttpd at startup +`systemctl disable lighttpd` +4. Enable php7.0-fpm at startup +`systemctl enable php7.0-fpm` +5. Enable nginx at startup +`systemctl enable nginx` +6. Edit `/etc/nginx/sites-available/default` to: + +``` +server { + listen 80 default_server; + listen [::]:80 default_server; + + root /var/www/html; + server_name _; + autoindex off; + + index pihole/index.php index.php index.html index.htm; + + location / { + expires max; + try_files $uri $uri/ =404; + } + + location ~ \.php$ { + include snippets/fastcgi-php.conf; + fastcgi_pass unix:/run/php/php7.0-fpm.sock; + auth_basic "Restricted"; #For Basic Auth + auth_basic_user_file /etc/nginx/.htpasswd; #For Basic Auth + } + + location /*.js { + index pihole/index.js; + auth_basic "Restricted"; #For Basic Auth + auth_basic_user_file /etc/nginx/.htpasswd; #For Basic Auth + } + + location /admin { + root /var/www/html; + index index.php index.html index.htm; + auth_basic "Restricted"; #For Basic Auth + auth_basic_user_file /etc/nginx/.htpasswd; #For Basic Auth + } + + location ~ /\.ht { + deny all; + } +} +``` + +7. Create username for authentication for the admin - we don't want other people in our network change our black and whitelist ;) +`htpasswd -c /etc/nginx/.htpasswd exampleuser` + +8. Change ownership of html directory to nginx user + `chown -R www-data:www-data /var/www/html` + +9. Make sure html directory is writable + `chmod -R 755 /var/www/html` + +10. Start php7.0-fpm daemon + `service php7.0-fpm start` + +11. Start nginx webserver + `service nginx start` + +### Optional configuration +- If you want to use your custom domain to access admin page (e.g.: `http://mydomain.internal/admin/settings.php` instead of `http://pi.hole/admin/settings.php`), make sure `mydomain.internal` is assigned to `server_name` in `/etc/nginx/sites-available/default`. E.g.: `server_name mydomain.internal;` + +- If you want to use block page for any blocked domain subpage (aka Nginx 404), add this to Pi-hole server block in your Nginx configuration file: +``` +error_page 404 /pihole/index.php +``` +- When using nginx to serve Pi-hole, Let's Encrypt can be used to directly configure nginx. Make sure to use your hostname instead of _ in `server_name _;` line above. +``` +add-apt-repository ppa:certbot/certbot +apt-get install certbot python-certbot-nginx + +certbot --nginx -m "$email" -d "$domain" -n --agree-tos --no-eff-email +``` + diff --git a/docs/guides/whitelist-blacklist.md b/docs/guides/whitelist-blacklist.md new file mode 100644 index 0000000..3d9ac13 --- /dev/null +++ b/docs/guides/whitelist-blacklist.md @@ -0,0 +1,85 @@ +### What to Whitelist or Blacklist + +[This extension for Google Chrome](https://chrome.google.com/webstore/detail/whitelist-assistant-by-dn/fdmpekabnlekabjlimjkfmdjajnddgpc) can help you in finding out which domains you need to whitelist. + + +### How to Whitelist or Blacklist + +There are scripts to aid users in adding or removing domains to the whitelist or blacklist. + +The scripts will first parse `whitelist.txt` or `blacklist.txt` for any changes, and if any additions or deletions are detected, it will reload `dnsmasq` so that they are effective immediately. + +Each script accepts the following parameters: + + + + + + + + + + + + + + + + + + + + + + + + +
[domain]Fully qualified domain name you wish to add or remove. You can pass any number of domains.
-dRemoval mode. Domains will be removed from the list, rather than added
-nrUpdate blacklist without refreshing dnsmasq
-fForce delete cached blocklist content
-qQuiet mode. Console output is minimal. Useful for calling from another script (see gravity.sh)
+ +Domains passed are parsed by the script to ensure they are valid domains. If a domain is invalid it will be ignored. + + +##### Example `pihole -w` usages + + + + + + + + + + + + + + + + +
pihole -w domain1 [domain2...]Attempt to add one or more domains to the whitelist and reload dnsmasq.
pihole -w -nr domain1 [domain2...]Attempt to add one or more domains to the whitelist, but do not reload dnsmasq.
pihole -w -f domain1 [domain2...]Attempt to add one or more domains to the whitelist and force dnsmasq to reload
+ +To remove domains from the whitelist: +Add `-d` as an additional argument (e.g `pihole -w -d domain1 [domain2...]`) + + +##### Example `pihole -b` usages + + + + + + + + + + + + + + + + +
pihole -b domain1 [domain2...]Attempt to add one or more domains to the blacklist and reload dnsmasq.
pihole -b -nr domain1 [domain2...]Attempt to add one or more domains to the blacklist, but do not reload dnsmasq.
pihole -b -f domain1 [domain2...]Attempt to add one or more domains to the blacklist and force dnsmasq to reload
+ +To remove domains from the blacklist: +Add `-d` as an additional argument (e.g `pihole -b -d domain1 [domain2...]`) \ No newline at end of file diff --git a/mkdocs.yml b/mkdocs.yml index 086d474..2ba67e2 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -63,6 +63,8 @@ pages: - 'Guides': - 'Pi-hole as All-Around DNS Solution': guides/unbound.md - 'Configuring DNS-Over-HTTPS on Pi-hole': guides/dns-over-https.md + - 'Editing Whitelist and Blacklist': guides/whitelist-blacklist.md + - 'Configuring NGINX for Pi-hole': guides/nginx-configuration.md - 'Configuring Caddy for Pi-hole': guides/caddy-configuration.md - 'Pi-hole and OpenVPN Server': - 'Overview': 'guides/vpn/overview.md'