CT 100 – Pi-hole DNS
Host root for the Pi-hole LXC at 10.0.0.14.
The live service is stable and documented. Its declared state now lives in the
CT-scoped Ansible project ansible/. The project was adopted from
the observed pre-Ansible state: the Pi-hole Quadlet template is byte-identical
with the live file, the nftables and SSH templates differ only by the
documented deliberate changes (managed markers, AllowStreamLocalForwarding no,
DisableForwarding yes, ssh.socket deactivation, ansible-deploy account).
The read-only preflight verified the production LXC through the unprivileged
ghost-agent transport on 2026-10-16 with ok=18 changed=0 failed=0. The
privileged adoption steps (interactive bootstrap.yml, site.yml --check,
converge, verify-production.yml, second run with changed=0) are sequenced
in ansible/README.md and still require explicit
operator authorization.
Current review findings and acceptance evidence are documented in
../../../docs/platform/proxmox-server/lxc/ct-100-dns/GNAI-012-PLAN_Pi-hole-DNS-Handoff.md.
Do not store the Pi-hole web password, Podman secret contents, private SSH keys or DNS query data in this repository.