Trim excess whitespace

Signed-off-by: a1346054 <36859588+a1346054@users.noreply.github.com>
2024-12-06 19:27:12 +01:00 · 2021-09-15 22:48:43 +00:00
parent 5f606a16e4
commit 93a501ab1b
15 changed files with 67 additions and 68 deletions
@@ -70,7 +70,7 @@ This is following the recommendation on [https://support.mozilla.org/en-US/kb/co

 #### `MAXLOGAGE=24.0` {#maxlogage data-toc-label='Max Log Age'}

-Up to how many hours of queries should be imported from the database and logs? Values greater than the hard-coded maximum of 24h need a locally compiled  `FTL` with a changed compile-time value.
+Up to how many hours of queries should be imported from the database and logs? Values greater than the hard-coded maximum of 24h need a locally compiled `FTL` with a changed compile-time value.

 #### `PRIVACYLEVEL=0|1|2|3` {#privacylevel data-toc-label='Privacy Level'}

@@ -20,7 +20,7 @@ This information may also be queried using `dig +short chaos txt cachesize.bind`

 The cache size is set in `/etc/dnsmasq.d/01-pihole.conf`. However, note that this setting does not survive Pi-hole updates. If you want to change the cache size permanently, add a setting

-``` plain
+```plain
 CACHE_SIZE=12345
 ```

@@ -32,7 +32,7 @@ By default, FTL binds the wildcard address, even when it is listening on only so

 If this is not what you want, you can add the option

-``` plain
+```plain
 bind-interfaces
 ```

@@ -37,7 +37,7 @@ Real-time signals are not guaranteed to have the same number on all operating sy

 Real-time signal can always be executed relative to the first (= minimum) real-time signal just like (for real-time signal 0):

-``` bash
+```bash
 sudo pkill -SIGRTMIN+0 pihole-FTL
 ```

@@ -25,13 +25,13 @@ Make sure to terminate any existing FTL process before starting FTL inside `valg

 You have to stop the regular `pihole-FTL` process before starting a `valgrind` debugging session:

-``` bash
+```bash
 sudo service pihole-FTL stop
 ```

 Furthermore, you'll have to strip the networking capabilities from the binary using:

-``` bash
+```bash
 sudo setcap -r /usr/bin/pihole-FTL
 ```

@@ -6,7 +6,7 @@ For each new client, the following steps must be taken. For the sake of simplici

 <!-- markdownlint-disable code-block-style -->
 ??? info "All commands described below at once"
-    ``` bash
+    ```bash
    sudo -i
    cd /etc/wireguard
    umask 077
@@ -40,7 +40,7 @@ For each new client, the following steps must be taken. For the sake of simplici

 We generate a key-pair for the client `NAME` (replace accordingly everywhere below):

-``` bash
+```bash
 sudo -i
 cd /etc/wireguard
 umask 077
@@ -52,7 +52,7 @@ wg genkey | tee "${name}.key" | wg pubkey > "${name}.pub"

 We furthermore recommend generating a pre-shared key (PSK) in addition to the keys above. This adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography and is mainly for post-quantum resistance. A pre-shared key should be generated for each peer pair and *should not be reused*.

-``` bash
+```bash
 wg genpsk > "${name}.psk"
 ```

@@ -60,7 +60,7 @@ wg genpsk > "${name}.psk"

 Add the new client by running the command:

-``` bash
+```bash
 echo "[Peer]" >> /etc/wireguard/wg0.conf
 echo "PublicKey = $(cat "${name}.pub")" >> /etc/wireguard/wg0.conf
 echo "PresharedKey = $(cat "${name}.psk")" >> /etc/wireguard/wg0.conf
@@ -74,13 +74,13 @@ echo "AllowedIPs = 10.100.0.2/32, fd08:4711::2/128" >> /etc/wireguard/wg0.conf

 Restart your server to load the new client config:

-``` bash
+```bash
 systemctl restart wg-quick@wg0
 ```

 After a restart, the server file should look like:

-``` plain
+```plain
 [Interface]
 Address = 10.100.0.1/24, fd08::1/128
 ListenPort = 47111
@@ -97,13 +97,13 @@ AllowedIPs = 10.100.0.2/32, fd08:4711::2/128

 The command

-``` bash
+```bash
 wg
 ```

 should tell you about your new client:

-``` plain
+```plain
 interface: wg0
  public key: XYZ123456ABC=          ⬅ Your server's public key will be different
  private key: (hidden)
@@ -118,7 +118,7 @@ peer: F+80gbmHVlOrU+es13S18oMEX2g=   ⬅ Your peer's public key will be differen

 Create a dedicated config file for your new client:

-``` bash
+```bash
 echo "[Interface]" > "${name}.conf"
 echo "Address = 10.100.0.2/32, fd08:4711::2/128" >> "${name}.conf" # May need editing
 echo "DNS = 10.100.0.1" >> "${name}.conf"                          # Your Pi-hole's IP
@@ -126,13 +126,13 @@ echo "DNS = 10.100.0.1" >> "${name}.conf"                          # Your Pi-hol

 and add the private key of this client

-``` bash
+```bash
 echo "PrivateKey = $(cat "${name}.key")" >> "${name}.conf"
 ```

 Next, add your server as peer for this client:

-``` plain
+```plain
 [Peer]
 AllowedIPs = 10.100.0.0/24, fd08::/64
 Endpoint = [your public IP or domain]:47111
@@ -141,7 +141,7 @@ PersistentKeepalive = 25

 Then add the public key of the server as well as the PSK for this connection:

-``` bash
+```bash
 echo "PublicKey = $(cat server.pub)" >> "${name}.conf"
 echo "PresharedKey = $(cat "${name}.psk")" >> "${name}.conf"
 exit
@@ -166,7 +166,7 @@ That's it.

 You can now copy the configuration file to your client (if you created the config on the server). If the client is a mobile device such as a phone, `qrencode` can be used to generate a scanable QR code:

-``` bash
+```bash
 sudo qrencode -t ansiutf8 -r "/etc/wireguard/${name}.conf"
 ```

@@ -180,13 +180,13 @@ After creating/copying the connection information over to your client, you may u

 You can check if your client successfully connected by, once again, running

-``` bash
+```bash
 sudo wg
 ```

 on the server. It should show some traffic for your client if everything works:

-``` plain
+```plain
 interface: wg0
  public key: XYZ123456ABC=          ⬅ Your server's public key will be different
  private key: (hidden)
@@ -9,13 +9,13 @@ Hostnames cannot be resolved during startup. This may lead to a five minutes del

 If the IP changes while the connection is running, resolving the new IP address fails often. Reconnect using

-``` bash
+```bash
 sudo ifdown wg0 && sudo ifup wg0
 ```

 To achieve a permanent solution, one can install a `cron` job which restarts the connection automatically whenever a change is detected. This avoids excessive restarts of the interface. Example script (taken from [Ubuntuusers Wiki](https://wiki.ubuntuusers.de/WireGuard)):

-``` bash
+```bash
 #!/bin/bash
 # Check state of wg0 interface
 wgstatus=$(wg)
@@ -42,11 +42,11 @@ fi

 Store this file as `/home/[user name]/wg-restart.sh` and add it to your `crontab`:

-``` bash
+```bash
 sudo crontab -e
 ```

-``` plain
+```plain
 */10 * * * * bash /home/[user name]/wg-restart.sh    # Runs the script every 10 minutes
 ```

@@ -54,7 +54,7 @@ sudo crontab -e

 Users of NetworkManager should make sure that it is not managing the WireGuard interface(s). For example, create the configuration file `/etc/NetworkManager/conf.d/unmanaged.conf` with content

-``` bash
+```bash
 [keyfile]
 unmanaged-devices=interface-name:wg*
 ```
@@ -77,7 +77,7 @@ The solution is to use networking software that supports `resolvconf`.

 Due to too low MTU (lower than 1280), `wg-quick` may fail to create the WireGuard interface. This can be solved by setting the MTU value in WireGuard configuration in the Interface section on the client:

-``` bash
+```bash
 [Interface]
 MTU = 1500
 ```
@@ -88,7 +88,7 @@ MTU = 1500

 If, e.g., after reboot, the `wg0` interface isn't up before Pi-hole is ready (more precisely, the `pihole-FTL` service is started), you may experience that Pi-hole doesn't listen on the Wireguard interface. This can be mitigated by artificially delaying the start of Pi-hole using, e.g., the config option

-``` plain
+```plain
 DELAY_STARTUP=5
 ```

@@ -4,7 +4,7 @@

 Enable IP forwarding on your server by removing the comments in front of

-``` plain
+```plain
 net.ipv4.ip_forward = 1
 net.ipv6.conf.all.forwarding = 1
 ```
@@ -13,13 +13,13 @@ in the file `/etc/sysctl.d/99-sysctl.conf`

 Then apply the new option with the command below.

-``` bash
+```bash
 sudo sysctl -p
 ```

 If you see the options repeated like

-``` plain
+```plain
 net.ipv4.ip_forward = 1
 net.ipv6.conf.all.forwarding = 1
 ```
@@ -49,7 +49,7 @@ The rules will then be cleared once the tunnel is down.

 <!-- markdownlint-disable code-block-style -->
 ??? info "Exemplary server config file with this change"
-    ``` plain
+    ```plain
    [Interface]
    PrivateKey = [your server's private key]
    Address = [Wireguard-internal IPs of the server, e.g. 10.100.0.1/24, fd08:4711::1/64]
@@ -73,7 +73,7 @@ The rules will then be cleared once the tunnel is down.

 In our standard configuration, we have configured the clients in such a way that they can only speak to the server. Add the network range of your local network in CIDR notation (e.g., `192.168.2.1 - 192.168.2.254` -> `192.168.2.0/24`) in the `[Peers]` section of all clients you want to have this feature:

-``` plain
+```plain
 [Peer]
 AllowedIPs = 10.0.0.0/24, fd08:4711::/64, 192.168.2.0/24
 ```
@@ -82,7 +82,7 @@ It is possible to add this only for a few clients, leaving the others isolated t

 <!-- markdownlint-disable code-block-style -->
 ??? info "Exemplary client config file with this change"
-    ``` plain
+    ```plain
    [Interface]
    PrivateKey = [your client's private key]
    Address = [Wireguard-internal IPs of your client, e.g. 10.100.0.2/32, fd08:4711::2/128]
@@ -16,13 +16,13 @@ Rerouting the Internet traffic through your Pi-hole will furthermore cause all o

 To route all traffic through the tunnel to a specific peer, add the default route (`0.0.0.0/0` for IPv4 and `::/0`for IPv6) to `AllowedIPs` in the `[Peer]` section of your clients's WireGuard config files:

-``` plain
+```plain
 AllowedIPs = 0.0.0.0/0, ::/0
 ```

 <!-- markdownlint-disable code-block-style -->
 ??? info "Exemplary client config file with this change"
-    ``` plain
+    ```plain
    [Interface]
    PrivateKey = [your client's private key]
    Address = [Wireguard-internal IPs of your client, e.g. 10.100.0.2/32, fd08:4711::2/128]
@@ -111,13 +111,13 @@ wg genkey | tee server.key | wg pubkey > server.pub

 Create a config file

-``` bash
+```bash
 sudo nano /etc/wireguard/wg0.conf
 ```

 and put the following into it:

-``` plain
+```plain
 [Interface]
 Address = 10.100.0.1/24, fd08:4711::1/64
 ListenPort = 47111
@@ -125,7 +125,7 @@ ListenPort = 47111

 Then run

-``` bash
+```bash
 echo "PrivateKey = $(cat server.key)" >> /etc/wireguard/wg0.conf
 exit # Exit the sudo session
 ```
@@ -177,7 +177,7 @@ You can either use the methods the corresponding providers recommend or use exis

 Register your server `wg0` as:

-``` bash
+```bash
 sudo systemctl enable wg-quick@wg0.service
 sudo systemctl daemon-reload
 sudo systemctl start wg-quick@wg0
@@ -189,14 +189,14 @@ If successful, you should not see any output.
 ??? warning "Error: RTNETLINK answers: Operation not supported"
    In case you get an error like

-    ``` plain
+    ```plain
    RTNETLINK answers: Operation not supported
    Unable to access interface: Protocol not supported
    ```

    you should check that the WireGuard kernel module is loaded with the command below:

-    ``` bash
+    ```bash
    sudo modprobe wireguard
    ```

@@ -205,7 +205,7 @@ If successful, you should not see any output.
 ??? warning "Error: RTNETLINK answers: File exists"
    In case you get an error like

-    ``` plain
+    ```plain
    RTNETLINK answers: File exists
    ```

@@ -217,13 +217,13 @@ If successful, you should not see any output.

 With the following command, you can check if your `wireguard` server is running:

-``` bash
+```bash
 sudo wg
 ```

 The output should look like the following:

-``` plain
+```plain
 interface: wg0
  public key: XYZ123456ABC=   ⬅ Your public key will be different
  private key: (hidden)
@@ -66,7 +66,7 @@ Due to the complexity of different ways of setting an IP address across differen

 !!! info
    The use of lighttpd on port _80_ is optional if you decide not to install the Web dashboard during installation.
-    The use of pihole-FTL  on ports _67_ or _547_ is optional, but required if you use the DHCP functions of Pi-hole.
+    The use of pihole-FTL on ports _67_ or _547_ is optional, but required if you use the DHCP functions of Pi-hole.

 ### Firewalls

@@ -26,7 +26,7 @@ The first command is to be preferred as it ensures that the DNS cache itself rem

 To ease the usage of regular expression filters in *FTL*DNS, we offer a regex debugging mode. Set

-``` plain
+```plain
 DEBUG_REGEX=true
 ```

@@ -6,19 +6,19 @@ You can amend the regular expressions by special keywords added at the end to fi

 Example:

-``` plain
+```plain
 abc;querytype=AAAA
 ```

 will block

-``` bash
+```bash
 dig AAAA abc
 ```

 but not

-``` bash
+```bash
 dig A abc
 ```

@@ -27,15 +27,15 @@ This allows you to do query type based black-/whitelisting.
 Some user-provided examples are:

 - `.*;querytype=!A`
-  
+
    A regex blacklist entry for blocking `AAAA` (in fact, everything else than `A`, call it "anti-`A`") requests for all clients assigned to the same group. This has been mentioned to be benefitial for devices like Chromecast. You may want to fine-tune this further to specific domains.

 - `.*;querytype=PTR`
-  
+
    A regex whitelist entry used to permit `PTR` lookups with the above "anti-`A`" regex

 - `.*;querytype=ANY`
-  
+
    A regex blacklist entry to block `ANY` request network wide.

 ## Invert matching
@@ -44,13 +44,13 @@ Sometimes, it may be useful to be able to invert a regular expression altogether

 For instance,

-``` plain
+```plain
 ^abc$;querytype=AAAA;invert
 ```

 will not block `abc` with type `AAAA` (but everything else) for the clients assigned to the same groups. This inversion is independent for the query type, e.g.

-``` plain
+```plain
 ^abc$;invert
 ```

@@ -74,21 +74,21 @@ Only one option should be specified. An exception to this rule are the last two

 - IPv4 only:

-  ``` plain
+  ```plain
  myregex;reply=1.2.3.4
  ```

  will result in `A 1.2.3.4` and `AAAA ::`
 - IPv6 only:

-  ``` plain
+  ```plain
  myregex;reply=fe80::1234
  ```

  will result in `A 0.0.0.0` and `AAAA fe80:1234`
 - IPv4 and IPv6:

-  ``` plain
+  ```plain
  myregex;reply=1.2.3.4;reply=fe80::1234
  ```

@@ -98,13 +98,13 @@ Only one option should be specified. An exception to this rule are the last two

 You can specify comments within your regex using the syntax

-``` plain
+```plain
 (?#some comment here)
 ```

 The comment can contain any characters except for a closing parenthesis `)` (for the sole reason being the terminating element). The text in the comment is completely ignored by the regex parser and it used solely for readability purposes.

-``` plain
+```plain
 $ pihole-FTL regex-test "doubleclick.net" "(^|\.)doubleclick\.(?#TODO: We need to maybe support more than just .net here)net$"

 FTL Regex test:
@@ -124,17 +124,17 @@ A back reference is a backslash followed by a single non-zero decimal digit `d`.

 Example:

-``` plain
+```plain
 "cat.foo.dog---cat%dog!foo" is matched by "(cat)\.(foo)\.(dog)---\1%\3!\2"
 ```

 Another (more complex example is):

-``` plain
+```plain
 (1234|4321)\.(foo)\.(dog)--\1
 ```

-``` plain
+```plain
   MATCH: 1234.foo.dog--1234
   MATCH: 4321.foo.dog--4321
 NO MATCH: 1234.foo.dog--4321
@@ -142,7 +142,7 @@ NO MATCH: 1234.foo.dog--4321

 Mind that the last line gives no match as `\1` matches **exactly** the same sequence the first character group matched. And `4321` is not the same as `1234` even when both are valid replies for `(1234|4321)` Back references are not defined for POSIX EREs (for BREs they are, surprisingly enough). We add them to ERE in the BRE style.

-``` plain
+```plain
 $ pihole-FTL regex-test "someverylongandmaybecomplexthing.foo.dog--someverylongandmaybecomplexthing" "(someverylongandmaybecomplexthing|somelesscomplexitem)\.(foo)\.(dog)--\1"

 FTL Regex test:
@@ -2,13 +2,13 @@

 In order to ease regex development, we added a regex test mode to `pihole-FTL` which can be invoked like

-``` bash
+```bash
 pihole-FTL regex-test doubleclick.net
 ```

 (test `doubleclick.net` against all regexs in the gravity database), or

-```  bash
+```bash
 pihole-FTL regex-test doubleclick.net "(^|\.)double"
 ```

@@ -21,7 +21,7 @@ Client -> Pi-hole -> Upstream DNS Server

 > Note:
 The Fritz!Box itself will use whatever is configured in Internet/Account Information/DNS server (see below).
-The Fritz!Box can be Pi-hole's upstream DNS server, as long Pi-hole itself is not the upstream server of the Fritz!Box. This would  cause a DNS loop.
+The Fritz!Box can be Pi-hole's upstream DNS server, as long Pi-hole itself is not the upstream server of the Fritz!Box. This would cause a DNS loop.

 To set it up, enter Pi-hole's IP as "Local DNS server" in

@@ -85,4 +85,3 @@ The following settings must be made:
    * **Local domain name (optional):** Fritz!Box uses **fritz.box**

 ![Screenshot der Conditional Forwarding Einstellungen](../images/conditional-forwarding.png)
-