ansible-pihole-dnscrypt

Ansible playbook to install and configure Pi-hole + DNSCrypt-proxy, with dnscrypt-proxy on 127.0.0.1:5053 and Pi-hole upstream set to 127.0.0.1#5053, and systemd socket activation support.

Overview

This repository automates:

• system preparation (apt update/upgrade)
• install required dependencies
• install Pi-hole (unattended)
• install dnscrypt-proxy via package
• configure dnscrypt-proxy (/etc/dnscrypt-proxy/dnscrypt-proxy.toml)
• configure systemd socket override to listen on 127.0.0.1:5053
• configure Pi-hole upstream DNS (/etc/pihole/setupVars.conf)
• restart and enable services (dnscrypt-proxy.socket, dnscrypt-proxy.service, pihole-FTL)

Directory structure

• pihole.yml : main playbook
• hosts : inventory with group testpi
• roles/system/tasks/main.yml
• roles/dependencies/tasks/main.yml
• roles/pihole/tasks/main.yml
• roles/dnscrypt-proxy/tasks/main.yml
• roles/dnscrypt-proxy/files/dnscrypt-proxy.toml
• vars/vars.yml

Prerequisites

• Control machine with Ansible installed
• SSH key access to target host
• Target host should be Debian/Ubuntu based

Quick start

1. Clone repo:

   git clone git@github.com:<your-user>/ansible-pihole-dnscrypt.git
   cd ansible-pihole-dnscrypt

2. Edit hosts with your target:

   [testpi]
   192.168.1.10 ansible_user=ansibleuser

3. Run playbook:

   ansible-playbook pihole.yml --limit testpi

Verify

• Check services:

  ssh ansibleuser@192.168.1.10 "sudo systemctl status dnscrypt-proxy dnscrypt-proxy.socket pihole-FTL"

• DNS query tests:

  ssh ansibleuser@192.168.1.10 "dig @127.0.0.1 google.com"
  ssh ansibleuser@192.168.1.10 "dig @127.0.0.1 doubleclick.net"

• Pi-hole upstream:

  ssh ansibleuser@192.168.1.10 "sudo pihole-FTL --config dns.upstreams"

Notes

• dnscrypt-proxy in this playbook uses systemd socket activation and config listen_addresses = [].
• Pi-hole is set to query 127.0.0.1#5053, ensuring encrypted upstream via DNSCrypt.
• If dnscrypt-proxy.socket is masked, playbook unmask and applies override.

License

MIT