diff --git a/.github/workflows/calibreapp-image-actions.yml b/.github/workflows/calibreapp-image-actions.yml index c57da77..740931b 100644 --- a/.github/workflows/calibreapp-image-actions.yml +++ b/.github/workflows/calibreapp-image-actions.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repo - uses: actions/checkout@v3 + uses: actions/checkout@v3.0.2 - name: Compress Images uses: calibreapp/image-actions@1.1.0 # TODO: if they start using a tag like v1, switch to that diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1d81aaa..0ac327d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,19 +17,19 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v3.0.2 with: fetch-depth: 0 - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@v4.2.0 with: python-version: "${{ env.PYTHON_VERSION }}" architecture: "x64" cache: pip - name: Set up Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@v3.4.1 with: node-version: "${{ env.NODE }}" cache: npm diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 191e05e..f4a8126 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -10,10 +10,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v3.0.2 - name: Spell-Checking uses: codespell-project/actions-codespell@master with: ignore_words_file: .codespellignore - skip: ./docs/routers/fritzbox-de.md,./mkdocs.yml + skip: ./docs/routers/fritzbox-de.md,./mkdocs.yml,./package.json,./package-lock.json,./.markdownlint.json,./requirements.txt diff --git a/docs/ftldns/dnsmasq_warn.md b/docs/ftldns/dnsmasq_warn.md index 6dcbfd3..896f877 100644 --- a/docs/ftldns/dnsmasq_warn.md +++ b/docs/ftldns/dnsmasq_warn.md @@ -177,7 +177,7 @@ Warnings commonly seen in `dnsmasq`'s log file (`/var/log/pihole/pihole.log`) an Same as above but for a port rather than an address. -!!! warning "LOUD WARNING: listening on `ADDRESSS` may accept requests via interfaces other than `IFNAME`" +!!! warning "LOUD WARNING: listening on `ADDRESS` may accept requests via interfaces other than `IFNAME`" When using `bind-interfaces`, the only access control is the addresses `dnsmasq` is listening on. There's nothing to avoid a query to the address of an internal interface arriving via an external interface where we don't want to accept queries, except that in the usual case the addresses of internal interfaces are RFC1918. When `bind-interfaces` in use, and we listen on an address that looks like it's probably globally routeable, this warning is printed. diff --git a/docs/guides/dns/cloudflared.md b/docs/guides/dns/cloudflared.md index 7df5545..be063da 100644 --- a/docs/guides/dns/cloudflared.md +++ b/docs/guides/dns/cloudflared.md @@ -41,7 +41,7 @@ Here we are downloading the precompiled binary and copying it to the `/usr/local ```bash wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm -sudo cp ./cloudflared-linux-arm /usr/local/bin/cloudflared +sudo mv -f ./cloudflared-linux-arm /usr/local/bin/cloudflared sudo chmod +x /usr/local/bin/cloudflared cloudflared -v ``` @@ -52,7 +52,7 @@ Note: Users [have reported](https://github.com/cloudflare/cloudflared/issues/38) ```bash wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64 -sudo cp ./cloudflared-linux-arm64 /usr/local/bin/cloudflared +sudo mv -f ./cloudflared-linux-arm64 /usr/local/bin/cloudflared sudo chmod +x /usr/local/bin/cloudflared cloudflared -v ``` @@ -211,7 +211,7 @@ If you configured `cloudflared` manually (by writing a systemd unit yourself), t ```bash wget https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm sudo systemctl stop cloudflared -sudo cp ./cloudflared-linux-arm /usr/local/bin/cloudflared +sudo mv -f ./cloudflared-linux-arm /usr/local/bin/cloudflared sudo chmod +x /usr/local/bin/cloudflared sudo systemctl start cloudflared cloudflared -v diff --git a/docs/guides/vpn/wireguard/client.md b/docs/guides/vpn/wireguard/client.md index 414d7a3..3bf2769 100644 --- a/docs/guides/vpn/wireguard/client.md +++ b/docs/guides/vpn/wireguard/client.md @@ -199,7 +199,7 @@ That's it. You can now copy the configuration file to your client (if you created the config on the server). If the client is a mobile device such as a phone, `qrencode` can be used to generate a scanable QR code: ```bash -sudo qrencode -t ansiutf8 -r "/etc/wireguard/${name}.conf" +sudo qrencode -t ansiutf8 < "/etc/wireguard/${name}.conf" ``` (you may need to install `qrencode` using `sudo apt-get install qrencode`) diff --git a/docs/images/conditional-forwarding.png b/docs/images/routers/conditional-forwarding.png similarity index 100% rename from docs/images/conditional-forwarding.png rename to docs/images/routers/conditional-forwarding.png diff --git a/docs/images/fritzbox-advanced-de.png b/docs/images/routers/fritzbox-advanced-de.png similarity index 100% rename from docs/images/fritzbox-advanced-de.png rename to docs/images/routers/fritzbox-advanced-de.png diff --git a/docs/images/fritzbox-advanced.png b/docs/images/routers/fritzbox-advanced.png similarity index 100% rename from docs/images/fritzbox-advanced.png rename to docs/images/routers/fritzbox-advanced.png diff --git a/docs/images/fritzbox-dhcp-de.png b/docs/images/routers/fritzbox-dhcp-de.png similarity index 100% rename from docs/images/fritzbox-dhcp-de.png rename to docs/images/routers/fritzbox-dhcp-de.png diff --git a/docs/images/fritzbox-dhcp.png b/docs/images/routers/fritzbox-dhcp.png similarity index 100% rename from docs/images/fritzbox-dhcp.png rename to docs/images/routers/fritzbox-dhcp.png diff --git a/docs/images/fritzbox-wan-dns-de.png b/docs/images/routers/fritzbox-wan-dns-de.png similarity index 100% rename from docs/images/fritzbox-wan-dns-de.png rename to docs/images/routers/fritzbox-wan-dns-de.png diff --git a/docs/images/fritzbox-wan-dns.png b/docs/images/routers/fritzbox-wan-dns.png similarity index 100% rename from docs/images/fritzbox-wan-dns.png rename to docs/images/routers/fritzbox-wan-dns.png diff --git a/docs/images/routers/usg-lan-dhcp.png b/docs/images/routers/usg-lan-dhcp.png new file mode 100644 index 0000000..46d9bfe Binary files /dev/null and b/docs/images/routers/usg-lan-dhcp.png differ diff --git a/docs/images/routers/usg-lan-dhcpv6.png b/docs/images/routers/usg-lan-dhcpv6.png new file mode 100644 index 0000000..109cd4c Binary files /dev/null and b/docs/images/routers/usg-lan-dhcpv6.png differ diff --git a/docs/images/routers/usg-lan.png b/docs/images/routers/usg-lan.png new file mode 100644 index 0000000..fca7ec6 Binary files /dev/null and b/docs/images/routers/usg-lan.png differ diff --git a/docs/images/routers/usg-wan-advanced.png b/docs/images/routers/usg-wan-advanced.png new file mode 100644 index 0000000..2c1ea47 Binary files /dev/null and b/docs/images/routers/usg-wan-advanced.png differ diff --git a/docs/images/routers/usg-wan.png b/docs/images/routers/usg-wan.png new file mode 100644 index 0000000..5a4531e Binary files /dev/null and b/docs/images/routers/usg-wan.png differ diff --git a/docs/regex/pi-hole.md b/docs/regex/pi-hole.md index ac2c8d4..a30107c 100644 --- a/docs/regex/pi-hole.md +++ b/docs/regex/pi-hole.md @@ -28,7 +28,7 @@ Some user-provided examples are: - `.*;querytype=!A` - A regex blacklist entry for blocking `AAAA` (in fact, everything else than `A`, call it "anti-`A`") requests for all clients assigned to the same group. This has been mentioned to be benefitial for devices like Chromecast. You may want to fine-tune this further to specific domains. + A regex blacklist entry for blocking `AAAA` (in fact, everything else than `A`, call it "anti-`A`") requests for all clients assigned to the same group. This has been mentioned to be beneficial for devices like Chromecast. You may want to fine-tune this further to specific domains. - `.*;querytype=PTR` diff --git a/docs/routers/fritzbox-de.md b/docs/routers/fritzbox-de.md index e9b57f0..74859da 100644 --- a/docs/routers/fritzbox-de.md +++ b/docs/routers/fritzbox-de.md @@ -8,7 +8,7 @@ Diese Anleitung wurde für IPv4 geschrieben und muss für IPv6 Netwerke entsprec Einige dieser Einstellungen sind nur sichtbar, wenn voher die Ansicht auf "Erweitert" gesetzt wurde. Diese wird durch Umschalten (Klick) auf "Standard" am unteren linken Bildrand aktiviert. -![Screenshot der Fritz!Box DHCP Einstellungen](../images/fritzbox-advanced-de.png) +![Screenshot der Fritz!Box DHCP Einstellungen](../images/routers/fritzbox-advanced-de.png) ## Pi-hole als DNS Server via DHCP an Clients verteilen (LAN Seite) @@ -31,7 +31,7 @@ Heimnetz/Netzwerk/Netzwerkeinstellungen/IP-Adressen/IPv4-Konfiguration/Heimnetz eingetragen werden. -![Screenshot der Fritz!Box DHCP Einstellungen](../images/fritzbox-dhcp-de.png) +![Screenshot der Fritz!Box DHCP Einstellungen](../images/routers/fritzbox-dhcp-de.png) !!! warning Clients bemerken Änderungen an den DHCP Einstellungen erst, wenn der DHCP Lease erneuert wird. Der einfachste Weg dies zu erzwingen ist ein Unterbrechen und Wiederherstellen der Netzwerkverbindung. @@ -54,7 +54,7 @@ Internet/Zugangsdaten/DNS-Server eingetragen werden. -![Screenshot der Fritz!Box WAN DNS Konfiguration](../images/fritzbox-wan-dns-de.png) +![Screenshot der Fritz!Box WAN DNS Konfiguration](../images/routers/fritzbox-wan-dns-de.png) !!! warning Die Fritz!Box darf mit dieser Konfiguration nicht als Upstream DNS Server im Pi-hole eingestellt werden. Dies würde zu einem DNS Loop führen, da Pi-hole dann die Anfragen an die Fritz!Box senden würde, welche sie wiederum an Pi-hole senden würde. @@ -89,4 +89,4 @@ Folgende Einstellungen müssen dafür vorgenommen werden: * **IP address of your DHCP server (router):** IP-Adresse der Fritz!Box selbst, Standard ist **192.168.178.1** * **Local domain name (optional):** Name der lokalen Domän, für die Fritz!Box **fritz.box** -![Screenshot der Conditional Forwarding Einstellungen](../images/conditional-forwarding.png) +![Screenshot der Conditional Forwarding Einstellungen](../images/routers/conditional-forwarding.png) diff --git a/docs/routers/fritzbox.md b/docs/routers/fritzbox.md index 9b1d1d7..b69e9db 100644 --- a/docs/routers/fritzbox.md +++ b/docs/routers/fritzbox.md @@ -8,7 +8,7 @@ This guide is IPv4 only. You need to adjust for IPv6 accordingly. Some of the following settings might be visible only if advanced settings are enabled. Therefore, "View" has to be changed to advanced by clicking on "Standard" in the lower left corner. -![Screenshot der Fritz!Box DHCP Einstellungen](../images/fritzbox-advanced.png) +![Screenshot der Fritz!Box DHCP Einstellungen](../images/routers/fritzbox-advanced.png) ## Distribute Pi-hole as DNS server via DHCP @@ -29,7 +29,7 @@ To set it up, enter Pi-hole's IP as "Local DNS server" in Home Network/Network/Network Settings/IP Addresses/IPv4 Configuration/Home Network ``` -![Screenshot of Fritz!Box DHCP Settings](../images/fritzbox-dhcp.png) +![Screenshot of Fritz!Box DHCP Settings](../images/routers/fritzbox-dhcp.png) !!! warning Clients will notice changes in DHCP settings only after they acquired a new DHCP lease. The easiest way to force a renewal is to dis/reconnect the client from the network. @@ -51,7 +51,7 @@ To set it up, enter Pi-hole's IP as "Preferred DNSv4 server" **and** "Alternativ Internet/Account Information/DNS server ``` -![Screenshot of Fritz!Box WAN DNS Configuration](../images/fritzbox-wan-dns.png) +![Screenshot of Fritz!Box WAN DNS Configuration](../images/routers/fritzbox-wan-dns.png) !!! warning Don't set the Fritz!Box as upstream DNS server for Pi-hole if using this configuration! This will lead to a DNS loop as the Pi-hole will send the queries to the Fritz!Box which in turn will send them to Pi-hole. @@ -84,4 +84,4 @@ The following settings must be made: * **IP address of your DHCP server (router):** IP of the Fritz!Box, standard is **192.168.178.1** * **Local domain name (optional):** Fritz!Box uses **fritz.box** -![Screenshot der Conditional Forwarding Einstellungen](../images/conditional-forwarding.png) +![Screenshot der Conditional Forwarding Einstellungen](../images/routers/conditional-forwarding.png) diff --git a/docs/routers/ubiquiti-usg.md b/docs/routers/ubiquiti-usg.md new file mode 100644 index 0000000..092fb8f --- /dev/null +++ b/docs/routers/ubiquiti-usg.md @@ -0,0 +1,64 @@ +This guide was developed using a Ubiquiti Cloud Key v2 with UniFi Network v7.1.61. Following the first method below will have you adding your Pi-hole as a DNS server for all devices on your LAN. Following the second method below will have DNS queries route through your USG and then to your Pi-hole. Either option is valid, depending on your specific requirements, but it is recommended to choose one or the other - not both. + +> Note: +While this guide attempts to cover both IPv4 and IPv6, your mileage may vary. + +### Grab your IPv4 and IPv6 address from your Raspi + +SSH into your Raspi. A quick `ifconfig eth0` (substituting `eth0` for the applicable network interface) will get you the address information: + +``` +eth0: flags=4163 mtu 1500 + inet 192.168.0.9 netmask 255.255.255.0 broadcast 192.168.0.255 + inet6 2001:470:5:3::8ed prefixlen 128 scopeid 0x0 + inet6 2001:470:5:3:8d70:e92e:7030:6eef prefixlen 64 scopeid 0x0 + inet6 fe80::337f:710d:6781:4c85 prefixlen 64 scopeid 0x20 + ether dc:a6:32:0e:31:2d txqueuelen 1000 (Ethernet) + RX packets 1297459 bytes 1279521260 (1.1 GiB) + RX errors 0 dropped 0 overruns 0 frame 0 + TX packets 2315988 bytes 2766370095 (2.5 GiB) + TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 +``` + +Take note of the `inet` address, and the `inet6` address which starts with `fe` (denotes a local link or LAN address). Those are the IPs which you'll use as your DNS servers in the USG. For this example, we'll be using the `192.168.0.9` and `fe80::337f:710d:6781:4c85` IPs for the following directions. + +### Method 1: Distribute Pi-hole as DNS server via DHCP + +Choosing this option will have DNS queries taking the following path: + +``` +(Clients) -> Pi-hole -> Upstream DNS Server +``` + +Go to **Settings** --> **Networks** and click on the Network line that you want to modify: + +![Screenshot of USG LAN](../images/routers/usg-lan.png) + +Under **DHCP**, in the DHCP Server Management section click "Show options" to reveal the **DHCP DNS Server** section. Check the **Enable** box and enter your Raspi's IPv4 address here. + +![Screenshot of USG LAN DHCP settings](../images/routers/usg-lan-dhcp.png) + +Scroll down to **IPv6**, and under the **DHCPv6/RDNSS DNS Control** section, uncheck **Auto** if it's enabled and enter Raspi's IPv6 address here. Click **Apply Changes** to have the settings persistently saved. + +![Screenshot of USG LAN DHCPv6 settings](../images/routers/usg-lan-dhcpv6.png) + +All client devices on your network should now automatically be configured with a single IPv4 and single IPv6 address for DNS resolution. If you don't see your client devices update quickly enough, you *can* toggle Wi-Fi off/on or disconnect the Ethernet cable for a couple of seconds and then reconnect it. + +### Method 2: Using your Pi-hole as a resolve for your USG + +If you'd rather have your USG forward all DNS traffic to Pi-hole, you can complete this *alternative* step. Doing so will have DNS queries taking the following path: + +``` +(Clients) -> USG -> Pi-hole -> Upstream DNS Server +``` + +!!! warning + Keep in mind that if you are using your USG's IP address as an upstream resolver for your Pi-hole together with this configureation, ***this will cause a resolver loop***. Make sure to have another upstream DNS server(s) set in your Pi-hole's configuration, or use Pi-hole as [your own recursive DNS server with Unbound](https://docs.pi-hole.net/guides/dns/unbound/?h=unbound#configure-unbound). + +Log into your Unifi Cloud Key. Go to **Settings** -> **Internet**. Click on the WAN line that appears. + +![Screenshot of USG WAN](../images/routers/usg-wan.png) + +Under **Advanced**, in the DNS Server section uncheck the Auto box and add your Raspi's IPv4 address. This allows your USG to use Pi-hole for all DNS lookups. Click **Apply Changes** to have the settings persistently saved. + +![Screenshot of USG WAN Advanced settings](../images/routers/usg-wan-advanced.png) diff --git a/mkdocs.yml b/mkdocs.yml index 8ab123f..1a6708e 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -66,7 +66,8 @@ markdown_extensions: - pymdownx.details # Tabbed provides a syntax to easily add tabbed Markdown content. # https://facelessuser.github.io/pymdown-extensions/extensions/tabbed/ - - pymdownx.tabbed + - pymdownx.tabbed: + alternate_style: true # Adds syntax for defining footnotes in Markdown documents (https://python-markdown.github.io/extensions/footnotes/) - footnotes # Adds the ability to define abbreviations @@ -177,9 +178,10 @@ nav: - 'Caddy': guides/webserver/caddy.md - 'Traefik (not in Docker)': guides/webserver/traefik-nodocker.md - 'Router setup': + - 'ASUS router': routers/asus.md - 'Fritz!Box (EN)': routers/fritzbox.md - 'Fritz!Box (DE)': routers/fritzbox-de.md - - 'ASUS router': routers/asus.md + - 'Ubiquiti USG': routers/ubiquiti-usg.md - 'FAQ': main/faq.md - 'Community Projects': main/projects.md diff --git a/requirements.txt b/requirements.txt index 09d8a59..3bdfa4d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,5 @@ markdown-include==0.7.0 mkdocs==1.3.1 mkdocs-git-revision-date-localized-plugin==1.1.0 -mkdocs-material==8.3.9 -mkdocs-redirects==1.0.4 +mkdocs-material==8.4.0 +mkdocs-redirects==1.0.6