Fix pihole for v6: pin digest, listeningMode=ALL, v6 password env, readiness probe

A fresh node pull of pihole:latest silently upgraded v5->v6 (Core v6.2.2).
v6's default listeningMode=LOCAL drops DNS from non-attached subnets, which
killed all cross-node svclb DNS the moment the pod rescheduled off its old
node. v6 also ignores the WEBPASSWORD env.

- image pinned by digest (Core v6.2.2)
- FTLCONF_dns_listeningMode=ALL
- admin password via FTLCONF_webserver_api_password <- pihole-admin secret
- tcpSocket:53 readiness probe so rollout status waits for FTL

Applied to the cluster via kubectl replace; DNS verified answering on all
four node IPs, admin API auth verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -0,0 +1,95 @@
+name: Validate and Deploy to K3s
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install kubectl
+        run: |
+          if ! command -v kubectl &> /dev/null; then
+            ARCH=$(uname -m)
+            if [ "$ARCH" = "aarch64" ]; then
+              ARCH="arm64"
+            elif [ "$ARCH" = "x86_64" ]; then
+              ARCH="amd64"
+            fi
+            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
+            chmod +x kubectl
+            sudo mv kubectl /usr/local/bin/
+          fi
+          kubectl version --client
+
+      - name: Configure kubectl
+        run: |
+          mkdir -p $HOME/.kube
+          echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
+          chmod 600 $HOME/.kube/config
+
+      - name: Server-side dry-run of full kustomization
+        run: |
+          kubectl apply -k . --dry-run=server
+
+  deploy:
+    needs: validate
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install kubectl
+        run: |
+          if ! command -v kubectl &> /dev/null; then
+            ARCH=$(uname -m)
+            if [ "$ARCH" = "aarch64" ]; then
+              ARCH="arm64"
+            elif [ "$ARCH" = "x86_64" ]; then
+              ARCH="amd64"
+            fi
+            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
+            chmod +x kubectl
+            sudo mv kubectl /usr/local/bin/
+          fi
+          kubectl version --client
+
+      - name: Configure kubectl
+        run: |
+          mkdir -p $HOME/.kube
+          echo "${{ secrets.KUBECONFIG }}" | base64 -d > $HOME/.kube/config
+          chmod 600 $HOME/.kube/config
+
+      - name: Apply kustomization
+        run: |
+          kubectl apply -k .
+
+      - name: Wait for rollouts
+        run: |
+          set -e
+          kubectl rollout status deploy/bitwarden-vaultwarden -n bitwarden --timeout=10m
+          kubectl rollout status deploy/searxng-1723974683 -n default --timeout=10m
+          kubectl rollout status deploy/home-assistant -n home-assistant --timeout=15m
+          kubectl rollout status deploy/nginx -n nginx --timeout=10m
+          kubectl rollout status deploy/pihole -n pihole --timeout=10m
+          kubectl rollout status deploy/unbound -n pihole --timeout=10m
+          kubectl rollout status deploy/unifiedstreaming -n unified-streaming --timeout=10m
+
+      - name: Deployment summary
+        if: always()
+        run: |
+          echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          for ns in bitwarden default home-assistant nginx pihole unified-streaming; do
+            kubectl get deployments -n $ns >> $GITHUB_STEP_SUMMARY || true
+          done
+          echo '```' >> $GITHUB_STEP_SUMMARY

.gitignore

@@ -1,3 +1,4 @@
 # Real secrets never go in git — only *.example.yaml templates do.
 apps/**/secret.yaml
 *.secret.yaml
+.deploy-kubeconfig.b64

README.md

@@ -43,21 +43,26 @@ Three apps read secrets that are NOT in git. Each app dir has a
 | `usp-license` | unified-streaming | `USP_LICENSE_KEY` |
 | `searxng-1723974683-config` | default | searxng `settings.yml` |
 
-**One-time migration (pihole + unified-streaming):** the live cluster (as of
+~~**One-time migration (pihole + unified-streaming)**~~ — DONE 2026-07-26:
-2026-07-26) has WEBPASSWORD / USP_LICENSE_KEY as inline plaintext `value`s.
+secrets `pihole-admin` and `usp-license` created in-cluster and both
-`kubectl apply` (client- or server-side) cannot patch an env var from `value`
+deployments switched to `secretKeyRef` via `kubectl replace` (a plain
-to `valueFrom` — the API rejects the merged object. Validated procedure:
+`kubectl apply` cannot patch an env var from `value` to `valueFrom`).
+`kubectl apply -k .` now converges cleanly (verified `--dry-run=server`).
 
-```sh
+## CI/CD (Gitea Actions)
-# 1. create the two secrets (see secret.example.yaml in each app dir)
-# 2. one-time replace (restarts the pods):
-kubectl replace -f apps/pihole/deployment-pihole.yaml
-kubectl replace -f apps/unified-streaming/deployment.yaml
-```
 
-After that, `kubectl apply -k .` works cleanly for everything (verified with
+`.gitea/workflows/deploy.yaml`, modeled on socktop-webterm's pipeline:
-`--dry-run=server` against the live cluster, 2026-07-26 — zero immutable-field
+
-conflicts).
+- **PRs** → `kubectl apply -k . --dry-run=server` (validation only)
+- **push to main** → `kubectl apply -k .` + `kubectl rollout status` on all
+  seven deployments
+
+Repo Actions secret required: `KUBECONFIG` — base64-encoded kubeconfig for the
+`gitea-deployer` ServiceAccount (same identity socktop-webterm deploys with;
+regenerate anytime from `default/gitea-deployer-token`). Its RBAC is
+`rbac/gitea-deployer.yaml` — admin-applied once, deliberately outside the root
+kustomization so the pipeline token cannot escalate itself; it has no access
+to secrets and no delete verbs.
 
 ## Cluster assumptions (state that lives outside these manifests)
 
@@ -80,7 +85,10 @@ conflicts).
 ## Known quirks (faithful to live state, fix at leisure)
 
 - Most images are `:latest`/`:stable` — deploys are not reproducible until
-  pinned. vaultwarden is pinned (1.35.4).
+  pinned. vaultwarden is pinned (1.35.4); pihole is pinned by digest (Core
+  v6.2.2) after `:latest` silently jumped v5→v6 on a fresh node pull
+  (2026-07-26) and broke DNS for cross-node sources (v6 defaults to
+  `listeningMode=LOCAL`) — fixed via `FTLCONF_dns_listeningMode=ALL`.
 - searxng keeps its helm-generated name suffix (`searxng-1723974683`) because
   deployment selectors are immutable; its helm release record still exists in
   the cluster — don't run `helm upgrade/uninstall` on it, this repo is the
@@ -98,4 +106,8 @@ conflicts).
   `rpi-master_undervoltage_CNI_corruption_incident-2026-07-25.md`.
 - 2026-07-26: initial import of manifests from live cluster; HA ingress
   defaultBackend fixed; unifiedstreaming-svc LoadBalancer→ClusterIP;
-  pihole/USP secrets moved to secretKeyRef (pending first apply).
+  pihole/USP secrets migrated to secretKeyRef in-cluster.
+- 2026-07-26: pihole surprise v5→v6 upgrade via `:latest` on a fresh node
+  pull; image pinned by digest, `FTLCONF_dns_listeningMode=ALL` +
+  `FTLCONF_webserver_api_password` (v6 ignores WEBPASSWORD), readiness probe
+  on :53 added. Gitea Actions pipeline + deployer RBAC added.

apps/pihole/deployment-pihole.yaml

@@ -1,7 +1,13 @@
-# DIVERGENCE from live state (intentional): the live deployment has WEBPASSWORD
+# Pi-hole v6 (image pinned by digest = Core v6.2.2 — :latest bit us on
-# as a plaintext env value. Here it comes from the `pihole-admin` secret —
+# 2026-07-26 when a fresh node pull silently jumped v5→v6).
-# create it (see secret.example.yaml) BEFORE applying this, or the pod will
+# v6 notes:
-# fail with CreateContainerConfigError.
+#  - FTLCONF_dns_listeningMode=ALL is REQUIRED in k8s: the v6 default (LOCAL)
+#    only answers queries from directly-attached subnets, which silently drops
+#    all cross-node svclb traffic.
+#  - v6 ignores the old WEBPASSWORD env; the admin password is
+#    FTLCONF_webserver_api_password, fed from the `pihole-admin` secret —
+#    create it (see secret.example.yaml) BEFORE applying.
+#  - Readiness probe on :53 so rollouts wait for FTL to actually serve DNS.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -40,12 +46,14 @@ spec:
                       - raspi
       containers:
         - name: pihole
-          image: pihole/pihole:latest
+          image: pihole/pihole@sha256:e28e239f55e648a9d32c8f065650acfe987ddebf1cd5f64f1c071e8716156ceb # Core v6.2.2
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ
               value: America/Los_Angeles
-            - name: WEBPASSWORD
+            - name: FTLCONF_dns_listeningMode
+              value: ALL
+            - name: FTLCONF_webserver_api_password
               valueFrom:
                 secretKeyRef:
                   name: pihole-admin
@@ -72,6 +80,12 @@ spec:
               memory: 2Gi
           securityContext:
             privileged: true
+          readinessProbe:
+            tcpSocket:
+              port: 53
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 3
           volumeMounts:
             - name: gv-pihole
               mountPath: /etc/pihole

rbac/gitea-deployer.yaml

@@ -0,0 +1,51 @@
+# RBAC for the Gitea Actions deploy pipeline.
+#
+# ADMIN BOOTSTRAP — applied once by a human with cluster-admin
+# (NOT part of the root kustomization: the pipeline's own token must not be
+# able to escalate its privileges):
+#   kubectl apply -f rbac/gitea-deployer.yaml
+#
+# Binds to the existing `gitea-deployer` ServiceAccount in `default`
+# (token secret: default/gitea-deployer-token — the same identity the
+# socktop-webterm pipeline uses).
+#
+# Deliberately granted: the resource kinds this repo contains, cluster-wide.
+# Deliberately NOT granted: secrets (app secrets are created out-of-band),
+# RBAC objects, nodes, or delete on anything.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: homelab-k3s-deployer
+rules:
+  - apiGroups: [""]
+    resources:
+      - namespaces
+      - persistentvolumes
+      - persistentvolumeclaims
+      - services
+    verbs: [get, list, watch, create, update, patch]
+  - apiGroups: [apps]
+    resources: [deployments]
+    verbs: [get, list, watch, create, update, patch]
+  - apiGroups: [networking.k8s.io]
+    resources: [ingresses]
+    verbs: [get, list, watch, create, update, patch]
+  - apiGroups: [apps]
+    resources: [replicasets]
+    verbs: [get, list, watch]
+  - apiGroups: [""]
+    resources: [pods, events]
+    verbs: [get, list, watch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: homelab-k3s-deployer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: homelab-k3s-deployer
+subjects:
+  - kind: ServiceAccount
+    name: gitea-deployer
+    namespace: default