Howdy Everyone!
As I am setting up my infrastructure at home using docker I wanted to ask, is it better to have DNS, something like pi-hole, on my main docker swarm or would it be better to have it on a dedicated machine/docker host separate from the rest of my infrastructure?
Thanks for the input!
I have a quite rich selfhosted stack, and DNS is indeed part of it.
For such a critical piece of infrastructure I didn’t needed a container, just installed Unbound and did some setup for ad blocking and internal DNS rules.
Here my setup: https://wiki.gardiol.org/doku.php?id=router:dhcp-dns
You could go with an independent pihole maybe, but that would double the chances of a hardware failure…
Using one device for everything might seem risky, but actually has less chances of failure ;)
I run my Pi-Hole on a dedicated Raspberry Pi. I have another Pi that runs my SSH tarpit. These are the only 2 things I keep on separate devices, the rest is containerized on my main server.
AdGuard Home is a better choice than PiHole since it uses DNS-over-HTTPS by default. There’s also an app called AdGuardHome-Sync to sync settings between multiple instances.
I’d recommend running two DNS servers, and at least one of those separately from the rest of your infrastructure like on a Pi. That way, if you need to pull one of them offline, the internet still works.
You can accomplish the same with dnscrypt-proxy and Orbital Sync for Pi-Hole. You can also run a recursive DNS server using Unbound.
But why deal with separate software like dnscrypt-proxy when AdGuard Home has it built-in?
Why should I use a piece of software that’s controlled by a corporate entity in Russia?
I would say Pihole is a better choice than AdGuard home because PiHole just runs on top of dnsmasq. Throw Unbound on there too as your upstream recursive resolver and you’re set. You don’t even need to worry about an encrypted session to your upstream anymore because your upstream is now your loopback.
Throw Unbound on there too as your upstream recursive resolver
If you want to run your own recursive DNS server, why would you run two separate DNS servers?
You don’t even need to worry about an encrypted session to your upstream anymore because your upstream is now your loopback.
Your outbound queries will still be unencrypted, so your ISP can still log them and create an advertising profile based on them. One of the main points of DoH and DoT is to avoid that, so you’ll want them to be encrypted at least until they leave your ISP’s network.
If you want to run your own recursive DNS server, why would you run two separate DNS servers?
I’m not sure I understand your question. A recursive DNS server and a local DNS cache/forwarder/are two different things with two different purposes. You will always need both. You yourself are using AdguardHome and that is just connecting to recursive DNS server upstream. In my scenario you’re just running both yourself instead of you running one and then letting a 3rd party run the other for you.
Your outbound queries will still be unencrypted, so your ISP can still log them and create an advertising profile based on them.
You can encrypt the recursive queries through your ISP if you want to. Though the effectiveness of any profiling your ISP would do to you are minimized by Qname minimization that Unbound does by default.
If you’re just using DoH then you’re just shifting who’s making that advertising profile on you from your ISP to whoever is hosting your upstream recursive DNS server. It doesn’t matter how much encryption you do because on the other end of that encrypted connection is the entity who you’re giving all your queries to.
I would suggest 2 pi-hole + unbound stacks on different hardware, preferably on different switches. That way you can restart/fiddle with things without your family going crazy about “internet not working”.
I remember Watchtower helpfully stopping Pihole before pulling the new image when I only had the one instance running… All while I was out at work with the fiancée on her day off. So many teaching moments in so little time.
Why not both?
My primary DNS is pihole on a rpi dedicated to the task; but I run a second instance of pihole via my main docker stack for redundancy. Should one or the other be unavailable, there’s a second one to pick up the slack.
I just provide both DNS IPs to LAN clients via DHCP.
Gravity Sync is a great tool to keep both piholes settings/records/lists in sync.
Gravity sync looks cool but it looks like it was depreciated, any alternatives for it?
Oh damn, I hadn’t noticed. My setup is still functioning just fine.
There is an alternative though: Orbital-Sync
I haven’t actually used it, so I can’t say much about it; but I’ll probably look into replacing gravity-sync with that.
