pihole-doh.yaml

- name: Install Pi-Hole with DNS over HTTPS (DoH)
  hosts: all
  gather_facts: true
  become: true
  handlers:
    - name: Reboot
      ansible.builtin.reboot:

    - name: Restart cloudflared
      ansible.builtin.service:
        name: cloudflared
        state: restarted

  tasks:
    - name: Get system network information
      ansible.builtin.set_fact:
        network_interface: "{{ ansible_default_ipv4.interface }}"
        network_gateway: "{{ ansible_default_ipv4.gateway }}"

    - name: This host requires static IP and DNS
      ansible.builtin.template:
        src: templates/dhcpcd.conf
        dest: /etc/dhcpcd.conf
        mode: '0664'
        owner: root
        group: root
      notify: Reboot

    - name: Force handlers
      ansible.builtin.meta: flush_handlers

    - name: Check if cloudfared is already started
      ansible.builtin.service:
        name: cloudflared
        state: started
      ignore_errors: true
      register: service_cloudflared

    - name: Check if pihole-FTL is already started
      ansible.builtin.service:
        name: pihole-FTL
        state: started
      ignore_errors: true
      register: service_piholeftl

    - name: If both services are already running, there's nothing else to do, exit here
      ansible.builtin.meta: end_host
      when:
        - not service_cloudflared.failed and service_cloudflared.status["ActiveState"] == "active"
        - not service_piholeftl.failed and service_piholeftl.status["ActiveState"] == "active"
      run_once: false

    - name: CloudflareD on Debian
      when: ansible_distribution == "Debian"
      block:
        - name: (Debian) Add cloudfared repo GPG key
          ansible.builtin.get_url:
            url: https://pkg.cloudflare.com/cloudflare-main.gpg
            dest: /usr/share/keyrings/cloudflare-main.gpg
            mode: '0644'

        - name: (Debian) Add cloudflared repo itself
          ansible.builtin.apt_repository:
            repo: "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared bookworm main"
            state: present

    - name: CloudflareD on Fedora
      when: ansible_distribution == "Fedora"
      block:
        - name: (Fedora) Add cloudfared repo
          ansible.builtin.get_url:
            url: https://pkg.cloudflare.com/cloudflared-ascii.repo
            dest: /etc/yum.repos.d/cloudflared.repo
            mode: '0644'

    - name: Install cloudfared package
      ansible.builtin.package:
        name: cloudflared

    - name: Add cloudflared user
      ansible.builtin.user:
        name: cloudflared
        shell: /usr/sbin/nologin
        system: true

    - name: Create the cloudflared log file
      ansible.builtin.file:
        path: /var/log/cloudflared.log
        state: touch
        mode: '0644'
        owner: cloudflared
        group: cloudflared
        modification_time: preserve
        access_time: preserve

    - name: Create cloudflared config file
      ansible.builtin.template:
        src: templates/cloudflared.conf
        dest: /etc/default/cloudflared
        mode: '0644'
        owner: cloudflared
        group: cloudflared
      notify: Restart cloudflared

    - name: Create cloudflared systemd unit
      ansible.builtin.copy:
        src: files/cloudflared.service
        dest: /etc/systemd/system/cloudflared.service
        mode: '0644'
      notify: Restart cloudflared

    - name: Start cloudflared service
      ansible.builtin.service:
        name: cloudflared
        state: started
        enabled: true

    - name: Fetch the Pi-Hole installer script
      ansible.builtin.get_url:
        url: https://raw.githubusercontent.com/pi-hole/pi-hole/master/automated%20install/basic-install.sh
        dest: /root/pi-hole-basic-install.sh
        mode: '0755'

    - name: Create Pi-Hole config directory
      ansible.builtin.file:
        path: /etc/pihole
        state: directory
        mode: '0775'

    - name: Land Pi-Hole setup variables
      ansible.builtin.copy:
        src: files/setupVars.conf
        dest: /etc/pihole/setupVars.conf
        mode: '0644'

    - name: Inform when SELinux is enabled
      when: ansible_selinux.status != "disabled"
      block:
        - name: Display notice about SELinux
          ansible.builtin.debug:
            msg: "NOTE: SELinux is enabled on {{ inventory_hostname }}. This is NOT supported by Pi-Hole. Continue at your own risk!"
        - name: Pause for 10 seconds (you can CTRL+C if you want)
          ansible.builtin.wait_for:
            timeout: 10

    - name: Install Pi-Hole unattended
      environment:
        PIHOLE_SELINUX: "true" # This is to workaround when SELinux is enabled
      ansible.builtin.command:
        cmd: /root/pi-hole-basic-install.sh --unattended
        creates: /etc/pihole/pihole-FTL.conf

    - name: Fix SELinux file contexts (when enabled)
      when: ansible_selinux.status != "disabled"
      ansible.builtin.command:
        cmd: restorecon -ir /var/www
      register: restorecon
      changed_when: restorecon.rc == 0
      failed_when: restorecon.rc != 0

    - name: Make sure pihole-FTL service will always start
      ansible.builtin.service:
        name: pihole-FTL
        state: started
        enabled: true