main.psd1.example

@{
    # Disclaimer: most comments are made with the help of copilot
    #region Global Stack Configuration
    # Container stack global settings that affect all services
    
    # Prefix for all container names in this stack. Only containers with this prefix will be managed.
    stackName          = "Pi-DNStack"
    
    # Select container engine
    # Officially supported: "docker". Other engines (e.g., "podman") may work if already installed, but "docker" is the only officially tested engine.
    containerEngine    = "docker"
    
    # Container restart policy.
    # For more details, visit: https://docs.docker.com/engine/containers/start-containers-automatically/#use-a-restart-policy
    # Options:
    # - "no": Never restart
    # - "always": Always restart
    # - "unless-stopped": Restart unless manually stopped
    # - "on-failure": Restart only on failure
    restartPolicy      = "unless-stopped"
    
    # Network configuration for container communication
    # For more details, visit: https://docs.docker.com/network/
    # Default "bridge" works for most setups. Other options:
    # - "host": Use host network (not recommended for security)
    # - "none": No networking
    containerNetwork   = "bridge"
    
    # Additional docker flags applied to all containers
    # Example: "--cap-add=NET_ADMIN" for network capabilities
    # For more details, visit: https://docs.docker.com/reference/cli/docker/container/run/#options
    commonFlags        = ""
    
    # Force redeployment of containers even without config changes
    # Useful when modifying non declarative settings (e.g., commonFlags)
    forceRedeploy      = $false

    # Log file path for stack operations
    logFile            = "~/.pi-dnstack.log"
    #endregion

    #region Pi-hole Configuration
    # Primary DNS server and ad-blocking service settings

    # container image
    piholeImage        = "pihole/pihole:latest"
    
    # Pi-hole web interface port (optional)
    # Example: piholeUiPort = "80"
    piholeUiPort       = "80"
    # External port for Pi-hole DNS access (optional)
    # Example: piholeDnsPort = "53"
    piholeDnsPort      = "53"
    
    # Pi-hole web interface password
    # !IMPORTANT! Change this to a secure password
    # Example: piholePassword = "MySecurePass123!"
    piholePassword     = "admin"
    
    # DNSSEC provides authentication and integrity to DNS responses
    # For more details, visit: https://docs.pi-hole.net/guides/misc/tor/dnssec/
    # Recommended to enable for enhanced security
    DNSSECEnabled      = $true
    
    # Persistent storage for Pi-hole
    # Format: @("host-path:/container-path", ...)
    # Example: piholeVolumes = @("/etc/pihole:/etc/pihole", "/etc-dnsmasq.d:/etc/dnsmasq.d")
    piholeVolumes      = @("/etc/pihole:/etc/pihole", "/etc-dnsmasq.d:/etc/dnsmasq.d")
    
    # Additional upstream DNS servers
    # Format: @("primary.dns.ip", "secondary.dns.ip", ...) or @() to only use unbound/cloudflared
    # Example: extraDNS = @("1.1.1.1", "8.8.8.8")
    extraDNS           = @()
    
    # Network interface configuration
    # For more details, visit: https://docs.pi-hole.net/ftldns/interfaces/
    # Options for 'listen':
    # - "": Default/Do not change
    # - "local": Respond to queries up to 1 hop away
    # - "all": Listen on all interfaces (not recommended for security)
    # - "bind": Bind to specific interface
    # - "single": Respond to queries on a single interface
    listen             = ""
    interface          = ""    # Specify interface name when using "bind" or "single", e.g., "eth0"
    
    # Container-specific docker flags (like commonFlags but only for Pi-hole)
    piholeFlags        = ""
    
    # List of adlist sources
    # Each URL provides a list of domains to block and pihole will periodically fetch and update them
    # Good sources to find more lists: https://firebog.net/
    # The default list include:
    # - General ads and trackers
    # - Privacy threats
    # - Malware domains
    # - Phishing sites
    # - Cryptocurrency miners
    adlists            = @(
        "https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts",
        "https://adaway.org/hosts.txt",
        "https://v.firebog.net/hosts/AdguardDNS.txt",
        "https://v.firebog.net/hosts/Admiral.txt",
        "https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt",
        "https://v.firebog.net/hosts/Easylist.txt",
        "https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&mimetype=plaintext",
        "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/UncheckyAds/hosts",
        "https://raw.githubusercontent.com/bigdargon/hostsVN/master/hosts",
        "https://v.firebog.net/hosts/Easyprivacy.txt",
        "https://v.firebog.net/hosts/Prigent-Ads.txt",
        "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.2o7Net/hosts",
        "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt",
        "https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt",
        "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt",
        "https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt",
        "https://v.firebog.net/hosts/Prigent-Crypto.txt",
        "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Risk/hosts",
        "https://bitbucket.org/ethanr/dns-blacklists/raw/8575c9f96e5b4a1308f2f12394abd86d0927a4a0/bad_lists/Mandiant_APT1_Report_Appendix_D.txt",
        "https://phishing.army/download/phishing_army_blocklist_extended.txt",
        "https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt",
        "https://raw.githubusercontent.com/Spam404/lists/master/main-blacklist.txt",
        "https://raw.githubusercontent.com/AssoEchap/stalkerware-indicators/master/generated/hosts",
        "https://urlhaus.abuse.ch/downloads/hostfile/",
        "https://raw.githubusercontent.com/PolishFiltersTeam/KADhosts/master/KADhosts.txt",
        "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Spam/hosts",
        "https://v.firebog.net/hosts/static/w3kbl.txt",
        "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt",
        "https://adguardteam.github.io/HostlistsRegistry/assets/filter_11.txt",
        "https://adguardteam.github.io/HostlistsRegistry/assets/filter_30.txt",
        "https://adguardteam.github.io/HostlistsRegistry/assets/filter_50.txt",
        "https://adguardteam.github.io/HostlistsRegistry/assets/filter_59.txt",
        "https://adguardteam.github.io/HostlistsRegistry/assets/filter_7.txt",
        "https://adguardteam.github.io/HostlistsRegistry/assets/filter_9.txt",
        "https://big.oisd.nl",
        "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt",
        "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.plus.txt",
        "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/tif.txt",
        "https://lists.cyberhost.uk/malware.txt",
        "https://media.githubusercontent.com/media/zachlagden/Pi-hole-Optimized-Blocklists/refs/heads/main/lists/comprehensive.txt",
        "https://media.githubusercontent.com/media/zachlagden/Pi-hole-Optimized-Blocklists/refs/heads/main/lists/suspicious.txt",
        "https://media.githubusercontent.com/media/zachlagden/Pi-hole-Optimized-Blocklists/refs/heads/main/lists/tracking.txt",
        "https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=1&mimetype=plaintext",
        "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/native.apple.txt",
        "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/native.winoffice.txt",
        "https://raw.githubusercontent.com/infinitytec/blocklists/master/adfilters.txt",
        "https://raw.githubusercontent.com/infinitytec/blocklists/master/ads-and-trackers.txt",
        "https://raw.githubusercontent.com/infinitytec/blocklists/master/annoyances.txt",
        "https://raw.githubusercontent.com/infinitytec/blocklists/master/scams-and-phishing.txt",
        "https://raw.githubusercontent.com/mike-trewartha/Pi-hole-Talos-Threat-Blocklist/refs/heads/main/talos-threats.list",
        "https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt",
        "https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt",
        "https://someonewhocares.org/hosts/hosts"
        )
    #endregion

    #region Unbound Configuration
    # Recursive DNS resolver settings
    # For more details, visit: https://docs.pi-hole.net/guides/dns/unbound/
    
    # Enable/disable Unbound DNS resolver
    unboundEnabled     = $true
    
    # Container images (default unbound image works only for x86/64 systems)
    unboundImage       = "mvance/unbound:latest"     # For x86/64 systems
    unboundArmImage    = "mvance/unbound-rpi"        # For ARM systems (e.g., Raspberry Pi)
    
    # External port for direct Unbound access (optional)
    unboundPort        = ""
    
    # Container-specific docker flags (like commonFlags but only for Unbound)
    unboundFlags       = ""
    #endregion

    #region Cloudflared Configuration
    # DNS-over-HTTPS proxy settings
    # For more details, visit: https://docs.docker.com/reference/cli/docker/container/exec/
    
    # Enable/disable Cloudflared DoH proxy
    cloudflaredEnabled = $true
    
    # Container image
    cloudflaredImage   = "cloudflare/cloudflared:latest"
    
    # External port for direct Cloudflared access (optional)
    cloudflaredPort    = ""
    
    # Container-specific docker flags (like commonFlags but only for Cloudflared)
    cloudflaredFlags   = ""
    #endregion

    #region DHCP Configuration
    # Automatically configure a Windows DHCP server to use Pi-hole as the primary DNS server
    # Important considerations:
    # 1. The Windows server must have the DHCP role installed and configured
    # 2. PowerShell remoting must be enabled on the Windows server
    # 3. Network connectivity must exist between DHCP server and Pi-hole
    # 4. Appropriate firewall rules must be configured
    # 5. When using bridge network mode, ensure piholeDnsPort is set to "53", we recommend using host network mode when using this feature
    # 6. Set appropriate Pi-hole listen configuration (e.g., listen = "all")
    
    # Set to $true to enable DHCP configuration or $false to disable
    configureDHCP      = $false

    # The hostname or IP address of the Windows DHCP server
    # Must be reachable from the management workstation
    # Example: dhcpServer = @("192.168.124.176")
    dhcpServer         = @()
    # The username to connect to the DHCP server
    # Example: dhcpUser = @("Administrator")
    dhcpUsers          = @()

    # DHCP Scope ID for specific scope configuration (optional)
    # Example: dhcpScopeId = "192.168.1.0"
    dhcpScopeId        = ""

    # DHCP Policy Name for policy-specific configuration (optional)
    # Example: dhcpPolicyName = "VPN Users"
    dhcpPolicyName     = ""
    #endregion
}