playbook.yml

---
# Automated Self-Updating (Public) Pihole Installation by Freek.ws
# Project home: https://github.com/Freekers/automated-pihole
# Tested on Ubuntu Server 18.04.2 LTS (Minimal) with Ansible 2.8

# This Ansible playbook installs a Pihole instance from scratch/bare-metal.
# You can choose between a Public Pihole or a Personal/Private one.
# Both use 'unbound' instead of public upstream DNS servers and unattended OS updates.
# Also adds my (auto-updated) whitelist for your websurfing convenience
# and deploys (by default, configurable) the uber adlist/blocklist by OISD.nl 
# If deploying a public Pihole, it includes LetsEncrypt to the secure admin interface
# with valid certificate over HTTPS and basic protection against DNS Amplification attacks.
# Docker is used to automate the updating process, so OpenVZ VPSes are NOT supported

# Usage Instructions:
# 1. Install Ansible (https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html#latest-releases-via-apt-ubuntu)
# 2. Clone repository (git clone https://github.com/Freekers/automated-pihole.git)
# 3. Edit 'hosts' and '.env' file to reflect your setup, i.e. change domains, IP etc. 'playbook.yml' does NOT need to be changed!
# 4. Install required roles from Ansible Galaxy roles using 'ansible-galaxy install -r requirements.yml'
# 5. Start playbook using 'ansible-playbook playbook.yml --ask-become-pass'

- hosts: pihole
  vars:
    env_path: '{{ playbook_dir }}/files/.env'
    values:
       - timezone
       - cron_ouroboros
       - webpassword
       - custom_name
       - hostname
       - letsencrypt_email

  tasks:
  - name: Validate variables
    fail: msg="You cannot setup a PUBLIC Pi-hole with DHCP Enabled!"
    when: dhcp == "yes" and type == "public"

  # Let's get started
  - name: Update and upgrade apt packages
    become: true
    apt:
       update_cache: yes
       upgrade: yes

  # Install Basic Packages
  - name: Install Basic Packages
    become: true
    apt:
      name: "{{ packages }}"
    vars:
      packages:
      - nano
      - git
      - resolvconf
      - tzdata
      - python3-pip
      - python3-setuptools

  - name: install galaxy roles
    command: ansible-galaxy install -r "{{ playbook_dir }}/requirements.yml"
    delegate_to: localhost
    become: false

  # Set timezone (yes, all this code is needed for that...)
  - name: Read values from Docker environment file
    delegate_to: localhost
    shell: "source {{ env_path }}; echo ${{ item|upper }}"
    register: output
    with_items: "{{ values }}"
    args:
      executable: /bin/bash
    changed_when: false

  - name: Store read value as variable
    set_fact:
      "{{ item.0 }}": "{{ item.1.stdout }}"
    when: '{{ item.0 }} is undefined'
    with_together:
      - "{{ values }}"
      - "{{ output.results }}"
    changed_when: false

  - name: Set system timezone to match timezone specified in .env file
    become: true
    timezone:
      name: "{{ timezone }}"
       
  - block:
      - name: Install Docker and docker-compose
        include_role:
          name: geerlingguy.docker
        vars:
         - docker_package_state: latest
         - docker_install_compose: true
         - docker_compose_version: "1.25.5"
    become: true

  - name: Install docker and docker-compose, for use with Ansible docker module
    become: true
    pip:
      name: 
        - docker
        - docker-compose      

  - name: Create directories if they don't exist
    become: true
    file:
      path: "{{ item }}"
      state: directory
    with_items:
      - /opt/automated-pihole
      - /opt/automated-pihole/etc-pihole
      - /opt/automated-pihole/etc-dnsmasq
      - /opt/automated-pihole/unbound
      
  - name: Touch pihole.log
    become: true
    file:
      path: /opt/automated-pihole/pihole.log
      state: touch
 
 # For some reason, this requires at least chmod 666 to work, no clue why. 
  - name: Touch lighttpd_error.log
    become: true
    file:
      path: /opt/automated-pihole/lighttpd_error.log
      state: touch
      mode: '0666'
      
  # Deploy Pi-hole and Ouroboros using Docker-Compose
  - name: Copy .env file
    become: true
    copy:
      src: .env
      dest: /opt/automated-pihole/.env
      
  - name: Copy Docker Compose
    become: true
    copy:
      src: docker-compose.yml
      dest: /opt/automated-pihole/docker-compose.yml

  - name: Copy advanced-01-pihole config file
    become: true
    copy:
      src: advanced-01-pihole.conf
      dest: /opt/automated-pihole/advanced-01-pihole.conf
      
#################################################################################    

  # Code below is ONLY ran when instance type is set to PRIVATE in 'hosts' file
      
  - name: Add DHCP port to Docker-Compose (User configurable)
    become: true
    when: dhcp == "yes"
    lineinfile:
      dest: /opt/automated-pihole/docker-compose.yml
      line: '    - "67:67/udp"'
      insertbefore: '    - "80:80/tcp"'
      firstmatch: yes
      
  - name: Add cap_add and NET_ADMIN to Docker-Compose (DHCP dependency)
    become: true
    when: dhcp == "yes"
    blockinfile:
      path: /opt/automated-pihole/docker-compose.yml
      block: |
         cap_add:
          - NET_ADMIN  
      insertbefore: '   dns:'

#################################################################################
#XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX#
#################################################################################

   # Code below is ONLY ran when instance type is set to PUBLIC in 'hosts' file
   # Yes, this is super ugly but I couldn't get this to work using templates. 

  - name: Copy Docker Compose Appendix
    become: true
    when: type == "public"
    copy:
      src: docker-compose-appendix.yml
      dest: /tmp/docker-compose-appendix.yml
     
  - name: Add nginx and letsencrypt to Docker-Compose (User configurable)
    become: true
    when: type == "public"
    shell: cat /tmp/docker-compose-appendix.yml >> /opt/automated-pihole/docker-compose.yml

  - name: Remove Temporary Docker Compose Appendix
    become: true
    when: type == "public"
    file:
      path: /tmp/docker-compose-appendix.yml
      state: absent
    
  - name: Add expose section
    become: true
    when: type == "public"
    lineinfile:
      dest: /opt/automated-pihole/docker-compose.yml
      line: '   expose:'
      insertafter: '    - VIRTUAL_PORT=80'
      firstmatch: yes
      
  - name: Remove port mapping for port 80, nginx reverse proxy will take over
    become: true
    when: type == "public"
    replace:
      path: /opt/automated-pihole/docker-compose.yml
      regexp: '    - "80:80/tcp"'
      before: '  unbound:'
      
  - name: Remove port mapping for port 443, nginx reverse proxy will take over
    become: true
    when: type == "public"
    replace:
      path: /opt/automated-pihole/docker-compose.yml
      regexp: '    - "443:443/tcp"'
      before: '  unbound:'
  
  - name: Expose port 80
    become: true
    when: type == "public"
    lineinfile:
      dest: /opt/automated-pihole/docker-compose.yml
      line: '    - 80'
      insertafter: '   expose:'
      firstmatch: yes
      
  - name: Add nginx-proxy network to Pihole
    become: true
    when: type == "public"
    lineinfile:
      dest: /opt/automated-pihole/docker-compose.yml
      line: '     nginx-proxy:'
      insertafter: '       ipv4_address: 10.0.0.3'
      firstmatch: yes
      
  - name: Add Modern SSL Policy to Pihole
    become: true
    when: type == "public"
    lineinfile:
      dest: /opt/automated-pihole/docker-compose.yml
      line: '    - SSL_POLICY=Mozilla-Modern'
      insertafter: '    - VIRTUAL_PORT=80'
      firstmatch: yes
      
  - name: Add nginx-proxy network to Docker
    become: true
    when: type == "public"
    lineinfile:
      dest: /opt/automated-pihole/docker-compose.yml
      line: '  nginx-proxy:'
      insertafter: 'networks:'
      firstmatch: yes
      
  - name: Still adding nginx-proxy network to Docker
    become: true
    when: type == "public"
    lineinfile:
      dest: /opt/automated-pihole/docker-compose.yml
      line: '      external:'
      insertafter: '  nginx-proxy:'
      firstmatch: yes
      
  - name: Added the nginx-proxy network to Docker
    become: true
    when: type == "public"
    lineinfile:
      dest: /opt/automated-pihole/docker-compose.yml
      line: '          name: nginxproxy_default'
      insertafter: '      external:'
      firstmatch: yes
      
  - name: Create a nginx-proxy network
    when: type == "public"
    become: true
    docker_network:
      name: nginxproxy_default

  - name: Touch nginx_error.log
    become: true
    when: type == "public"
    file:
      path: /opt/automated-pihole/nginx_error.log
      state: touch
      
#################################################################################

  - name: Copy Unbound config file
    become: true
    copy:
      src: pi-hole.conf
      dest: /opt/automated-pihole/unbound/pi-hole.conf
      
  # I specifically have chosen not to uninstall (and purge) any services
  # If you don't need/use them, I suggest you remove them, but I leave that up to you.
  - name: Stop conflicting services that occupy needed ports (53,80,443)
    become: true
    service:
      name: "{{ item }}"
      enabled: no
      state: stopped
    register: results
    loop:
      - systemd-resolved
      - dnsmasq
      - apache2
      - lighttpd
      - nginx
    failed_when: >-
     results is failed and
     "Could not find the requested service" not in results.msg|default('')
     
  - name: Backup current resolvconf head (just in case you need it)
    become: true
    command: mv /etc/resolvconf/resolv.conf.d/head /etc/resolvconf/resolv.conf.d/head.bak
      
  - name: Temporarily use these nameservers during initial config and setup
    become: true
    lineinfile:
      dest: /etc/resolvconf/resolv.conf.d/head
      line: 'nameserver 80.80.80.80'
      create: yes
      mode: '0644'
      owner: root
      group: root
      
  - name: Restart resolvconf
    become: true
    service:
      name: resolvconf
      state: restarted
      enabled: yes
        
  - name: Schedule root.hints update as monthly cronjob
    become: true
    cron: 
      name: Update root.hints - Monthly
      minute: "5"
      hour: "5"
      day: "5"
      month: "*"
      weekday: "*"
      job: "curl -so /opt/automated-pihole/unbound/root.hints https://www.internic.net/domain/named.root && docker restart unbound"
      user: root
      
  - name: Download root.hints once manually
    become: true
    get_url:
      url: https://www.internic.net/domain/named.root
      dest: /opt/automated-pihole/unbound/root.hints

  - name: Deploy Stack using Docker Compose
    become: true
    docker_service:
      project_src: /opt/automated-pihole
      state: present

   # Deploy auto-updating Whitelist
  - name: Checkout Whitelist Repo
    become: true
    git:
      repo: https://github.com/Freekers/whitelist.git
      dest: /opt/automated-pihole/whitelist
      force: yes
      
  - name: Make Whitelist script executable
    become: true
    file: 
      dest: /opt/automated-pihole/whitelist/scripts/whitelist.sh
      mode: a+x
  
  - name: Schedule Whitelist script as hourly cron
    become: true
    cron: 
      name: Update Whitelist - Hourly
      minute: "3"
      hour: "*"
      day: "*"
      month: "*"
      weekday: "*"
      job: docker exec -d pihole '/opt/whitelist/scripts/whitelist.sh'
      user: root

  # Deploy Adlists
  - name: Copy Adlists to Docker
    become: true
    copy:
      src: adlists.list
      dest: /opt/automated-pihole/etc-pihole/adlists.list
    
#################################################################################
    
  # Code below is ONLY ran when instance type is set to PUBLIC in 'hosts' file 
  
  # Install Additional Packages
  - name: Install Additional Packages
    when: type == "public"
    become: true
    apt:
      name: "{{ packages }}"
    vars:
      packages:
      - ufw
      - rsyslog
      - fail2ban
      
  - name: Create auth.log, if it doesnt exist already
    become: true
    file:
      path: /var/log/auth.log
      state: touch
      mode: '0640'
      owner: syslog
      group: adm
    when: 
      - type == "public"
  
  # Basic protection against DNS Amplification attacks 
  - name: Basic protection against DNS Amplification attacks using fail2ban
    when: type == "public"
    become: true
    blockinfile:
      path: /etc/fail2ban/jail.d/pihole-dns.conf
      block: |
       [pihole-dns]
       enabled = true
       port     = 53
       action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
                  %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
       logpath = /opt/automated-pihole/pihole.log
       findtime = 60
       maxretry = 5
       bantime = 3600
      insertafter: EOF
      create: yes
    
  - name: Create filter file
    when: type == "public"
    become: true
    blockinfile:
      path: /etc/fail2ban/filter.d/pihole-dns.conf
      block: |
       # Fail2Ban configuration file
       #
       [INCLUDES]
       
       # Read common prefixes. If any customizations available -- read them from
       # common.local
       before = common.conf
       
       
       [Definition]
       
       _daemon = dnsmasq
       
       # log example from /opt/automated-pihole/pihole.log
       #Feb 26 04:41:28 dnsmasq[1887]: query[A] 21cl93vlx5n9p.aikoaiko.net from 67.21.36.3
       #(?:DAY )?MON Day 24hour:Minute:Second(?:\.Microseconds)?(?: Year)?       
       
       failregex =  .*query\[ANY\].*from <HOST>
       
       ignoreregex =
      insertafter: EOF
      create: yes
      
  - name: Add more jails to fail2ban
    when: type == "public"
    become: true
    blockinfile:
      path: /etc/fail2ban/jail.local
      block: |
       [nginx-http-auth]
       enabled = true
       filter = nginx-http-auth
       logpath = /opt/automated-pihole/nginx_error.log
       
       [nginx-botsearch]
       enabled = true
       filter = nginx-botsearch
       logpath = /opt/automated-pihole/nginx_error.log
       
       [lighttpd-auth]
       enabled = true
       filter = lighttpd-auth
       logpath = /opt/automated-pihole/lighttpd_error.log
       
       [sshd]
       enabled = true
       filter = sshd
       mode = aggressive
      insertafter: EOF
      create: yes

  # Firewall Rules
  - name: Allow services in Firewall
    when: type == "public"
    become: true
    ufw:
      rule: allow
      proto: any
      port: '{{ item }}'
    loop:
      - "22"
      - "53"
      - "80"
      - "443"
      
  - name: Set default firewall policy and start on boot
    when: type == "public"
    become: true
    ufw: 
      state: enabled
      policy: reject
      
  - name: update-rc.d fail2ban defaults
    when: type == "public"
    become: true
    command: update-rc.d fail2ban defaults
    
  - name: Restart fail2ban
    when: type == "public"
    become: true
    service:
      name: fail2ban
      state: restarted
      enabled: yes
      
#################################################################################

  # Pack it up, we're done here  
  - name: Use Pihole as resolver for localhost
    become: true
    replace:
      path: /etc/resolvconf/resolv.conf.d/head
      regexp: 'nameserver 80.80.80.80'
      replace: 'nameserver 127.0.0.1'
      
  - name: Restart resolvconf
    become: true
    service:
      name: resolvconf
      state: restarted
      enabled: yes
      
  - name: Execute Whitelist script once manually (also runs pihole updateGravity)
    become: true
    command: docker exec -d pihole '/opt/whitelist/scripts/whitelist.sh'
    
  - name: Remove useless packages from the cache and dependencies that are no longer required
    become: true
    apt:
      autoclean: yes
      autoremove: yes
 
  # Configure Unattended (Security) Updates for OS
- hosts: pihole  
  roles:
  - role: jnv.unattended-upgrades
    become: true
    unattended_remove_unused_dependencies: true
    unattended_automatic_reboot: autoreboot
    unattended_automatic_reboot_time: autoreboottime