git selinux fixes, added pihole container

ansible/roles/podman/tasks/configuration-nginx-http.yml

@@ -62,7 +62,7 @@
     mode: 0644
   loop:
     - "{{ ci_server_name }}.http.conf"
-    # - "{{ pi_server_name }}.conf"
+    - "{{ pi_server_name }}.conf"
     - "{{ home_server_name }}.conf"
     - "{{ assistant_server_name }}.conf"
     - "{{ video_server_name }}.conf"
@@ -83,7 +83,7 @@
     state: link
   loop:
     - "{{ ci_server_name }}.http.conf"
-    # - "{{ pi_server_name }}.conf"
+    - "{{ pi_server_name }}.conf"
     - "{{ parts_server_name }}.conf"
     - "{{ home_server_name }}.conf"
     - "{{ assistant_server_name }}.conf"

ansible/roles/podman/tasks/container-pihole.yml

@@ -0,0 +1,54 @@
+---
+- name: create required pihole volumes
+  become: true
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ podman_user }}"
+    group: "{{ podman_user }}"
+    mode: 0755
+  notify: restorecon podman
+  loop:
+    - "{{ pihole_path }}/config"
+    - "{{ pihole_path }}/dnsmasq"
+  tags: pihole
+
+- name: flush handlers
+  ansible.builtin.meta: flush_handlers
+  tags: pihole
+
+- name: create pihole container
+  become: true
+  become_user: "{{ podman_user }}"
+  containers.podman.podman_container:
+    name: pihole
+    image: docker.io/pihole/pihole:2022.04.3
+    recreate: false
+    restart: true
+    restart_policy: on-failure
+    log_driver: journald
+    cap_add:
+      - CAP_NET_BIND_SERVICE
+      - NET_ADMIN
+    network:
+      - host
+    env:
+      DNSMASQ_USER: "root"
+      PIHOLE_UID: 0
+      TZ: "America/New_York"
+      WEBPASSWORD: "{{ pihole_password }}"
+      WEB_PORT: 8082
+    volumes:
+      - "{{ pihole_path }}/config:/etc/pihole"
+      - "{{ pihole_path }}/dnsmasq:/etc/dnsmasq.d"
+    ports:
+      - 53:53/udp
+      - 53:53/tcp
+      - 8082:80
+  tags: pihole
+
+- name: create systemd startup job for pihole
+  include_tasks: systemd-generate.yml
+  vars:
+    container_name: pihole
+  tags: pihole

ansible/roles/podman/tasks/firewall.yml

@@ -6,6 +6,8 @@
     permanent: true
     state: enabled
   loop:
+    - 53/tcp
+    - 53/udp
     - 80/tcp
     - 443/tcp
     - "{{ syslog_udp_default }}/udp"

ansible/roles/podman/tasks/main.yml

@@ -6,5 +6,6 @@
 - import_tasks: container-drone.yml
 - import_tasks: container-hass.yml
 - import_tasks: container-partkeepr.yml
-- import_tasks: container-nginx.yml
 - import_tasks: container-graylog.yml
+- import_tasks: container-pihole.yml
+- import_tasks: container-nginx.yml

ansible/roles/podman/tasks/podman.yml

@@ -91,7 +91,7 @@
   become: true
   ansible.posix.sysctl:
     name: net.ipv4.ip_unprivileged_port_start
-    value: "80"
+    value: "53"
     sysctl_set: true
     state: present
     reload: true

ansible/roles/podman/tasks/systemd-generate.yml

@@ -5,7 +5,7 @@
   changed_when: false
   ansible.builtin.shell: |
     podman generate systemd --name {{ container_name }} > {{ podman_home }}/.config/systemd/user/{{ container_name }}.service
-  tags: systemd
+  tags: always
 
 - name: enable systemd startup job for {{ container_name }}
   become: true
@@ -21,4 +21,4 @@
   delay: 1
   until: result is not failed
   ignore_errors: true
-  tags: systemd
+  tags: always