Origamiofficial's Pihole-Unbound Community Applications Template

 

Welcome to the support page of the Origamiofficial's Pihole-Unbound Community Applications template. This template installs a supercharged Pi-Hole docker container with Unbound built-in.

 

Pi-hole includes a caching and forwarding DNS server, now known as FTLDNS. After applying the blocking lists, it forwards requests made by the clients to configured upstream DNS server(s). However, this leads to some privacy concerns as it ultimately raises questions about whom you trust with the all the dns lookup data from your household.

 

You have a few options of whom to trust:
 

1.  Your ISP

Pi-hole -> FTLDNS -> Your ISP -> Authoratative Server

• Pros - Easy.  Works out of the box.  Just plugin and turn on your ISP provided modem.
• Cons - Your ISP is collecting all your DNS searches, building a profile on you, and selling that data.

 

2. A third party DNS service (ie. Quad9, Cloudflare, Google, etc).

Pi-hole -> FTLDNS -> Cloudflare -> Authoratative Server

• Pros - You're circumventing your ISP
• Cons - You're still trusting a third party company, so choose carefully.  In this case Cloudflare would have the ability to collect all of your DNS lookups, because they are an intermediary between your home and the authoratative server.

 

3. Run your own recursive DNS server, like Unbound (.....this is what this container does!)

Pi-hole -> FTLDNS -> Unbound -> Authoritative Server

• Pros - You're self hosting Unbound which will cache DNS results locally.  If Unbound doesn't have the DNS record cached already, it'll go upstream directly to the Authoritative Server.  No intermediaries!  No trusting your ISP or a 3rd party service.
• Cons - Authoratative Servers do not currently support DOT/DOH.

 

I am happy to help to the best of my abilities, but I am only publishing this template to community apps to make it easy for other users.  See here for the official github page for the project and support documentation:

https://github.com/origamiofficial/docker-pihole-unbound

 

 

My personal setup howto:
I switched the docker container to my custom swag network.  Port 80 and 53 were already in use.

 

1. Update the timezone
2. Switch port 53 tcp & udp to something else.  Example:  65053
3. Switch port 80 to something else.  Example:  65080
4. Update the password
5. In my personal situation, Unbound fails to start and logs reflect an error in unbound.conf.  I jump to that line of the config (at the very end, in Local Zone section), and comment out the two offending lines:

 

nano /mnt/user/appdata/pihole-unbound-daily/unbound.conf

 

    ###########################################################################
    # LOCAL ZONE
    ###########################################################################

    # Include file for local-data and local-data-ptr
##COMMENT OUT##    include: /opt/unbound/etc/unbound/a-records.conf
##COMMENT OUT##    include: /opt/unbound/etc/unbound/srv-records.conf

    ###########################################################################
    # FORWARD ZONE
    ###########################################################################

 

 

 

Edited May 12, 20242 yr by TeddyTux

hello,

 

how to install install to unraid please ?

 

I can't find your model in the app and I'm not too familiar with docker compose

can you help me ?

thank you

 

HI there.

Thanks for this - works great out of the box. Almost ;).

 

I'd like to make my gravity.db persistent.

Which folder would I have to map in the unraid docker setup?

Edited July 8, 20241 yr by McFex

Good Morning - love the idea, failing for me.

First is the password in the config file, I really do not like having clear passwords in config files.

- I tried removing the line and then sudo pihole -a -p to add one, this worked until I restarted the container, and it fails back to nothing

Second the configuration is not persistent
- I set to resolve to OpenDNS and not use it's self as that does not work, and it starts to work. I reboot and I am back to the original config.

Probably not understanding how this is to work (I do run PiHole on a Pi for 5 years) but I will need to switch to another container as this one does not pass security or restoration tests.

 

let me know if I am missing anything.

On 7/7/2024 at 11:05 PM, McFex said:

HI there.

Thanks for this - works great out of the box. Almost ;).

 

I'd like to make my gravity.db persistent.

Which folder would I have to map in the unraid docker setup?

Same request.

I second that too. After each update I need to add all the blocking lists again. 

I just installed this a couple days ago, and was able to keep my settings. To keep blocking lists & white/black list persistent, I mapped the Container Path: /etc/pihole . I added a subfolder to the config folder so my Host Path is: /mnt/user/appdata/pihole-unbound-daily/etc_pihole-unbound . I haven't gone through a regular update yet, but my items remain after force updates (items were getting cleared out before making this adjustment)

 

 

Edited October 15, 20241 yr by Stanley

I also installed and set up Docker 2 days ago. Today there was an update and after that ALL settings were reset to the factory settings, i.e. block lists, statistics, client names, simply everything! I hope that with the remapping as described by @Stanley, I won't have this problem again in the future.

Thanks to maintainer and Stanley for path tip!
Just wish this had ssh so I could sync with another one, haven't tried installing it but I would assume it would be wiped on updates...?

On 10/6/2024 at 5:01 PM, Stanley said:

I just installed this a couple days ago, and was able to keep my settings. To keep blocking lists & white/black list persistent, I mapped the Container Path: /etc/pihole . I added a subfolder to the config folder so my Host Path is: /mnt/user/appdata/pihole-unbound-daily/etc_pihole-unbound . I haven't gone through a regular update yet, but my items remain after force updates (items were getting cleared out before making this adjustment)

 

 

 

NICE! That seems to be the solution, thank you! Blocklist is now consistent.

Just got this installed and configured today. I am getting DNS_PROBE_FINISHED_NXDOMAIN on most URLS now. I have been researching potential fixes but few mirror this setup with unraid+pihole+unbound. Any support to resolve this is appreciated. 

On 1/4/2025 at 8:53 PM, CaptainTrap said:

Just got this installed and configured today. I am getting DNS_PROBE_FINISHED_NXDOMAIN on most URLS now. I have been researching potential fixes but few mirror this setup with unraid+pihole+unbound. Any support to resolve this is appreciated. 

 

I'm facing the same error... please tell me that you've found a solution for this.... I'm troubleshooting for hours already and nothing.
I think it may just not work anymore

On 1/4/2025 at 1:53 PM, CaptainTrap said:

Just got this installed and configured today. I am getting DNS_PROBE_FINISHED_NXDOMAIN on most URLS now. I have been researching potential fixes but few mirror this setup with unraid+pihole+unbound. Any support to resolve this is appreciated. 

The number 1 search result says to turn off DNSSEC. Do you have that on? For troubleshooting, turn it off.

Edited February 9, 20251 yr by Stanley

Has anyone been able to update to v5.18.4? It was released over a month ago, and my container is still on 5.18.3. I guess it mirros the docker container, which is still on the old version?

Edited February 9, 20251 yr by Stanley

When I go to Settings - Network, I get "an unknown error occurred"

 

Everything else is working as it should

 

Can't update Pi-hole to 2025.2.4 Unraid downloads it, but it won't update the docker.

Is this project dead? I see lots of questions with no answers. I also see no solution to the update problem. Everything currently works as

advertised, just has a year old version.

It appears to be dead. Any good guides to get pihole and unbound setup instead of using this?

Edited February 25, 20251 yr by Parlett316

I haven't found any for UnRaid. UnRaid doesn't seem to have a Docker Image for Unbound. I have found lots if you want to set it up on a Pi or your own server with Ubuntu or similar. I've decided for now, to just go with what is here. It seems to work great. I like the older interface over the newer one that Pi-hole pushed to 2025.2.4

Yeah, I can't complain that it doesn't work.  The Settings - Network area being broken is the only real annoyance.

Gave up on it. I couldn't justify running on software that was a year old. Tried AdGuard home with Unbound, found it too slow and too many glitches. So, I went back to the straght PiHole install. I may look at unbound in a VM in Ubuntu or Debian.

Ended up with a Debian server and running the DNS service through https on Cloudflair. Found instructions on Pi-holes website. Has been working great. 

On 3/1/2025 at 5:47 PM, Toolcrazier said:

Gave up on it. I couldn't justify running on software that was a year old. Tried AdGuard home with Unbound, found it too slow and too many glitches. So, I went back to the straght PiHole install. I may look at unbound in a VM in Ubuntu or Debian.

 

why offer this good idea, but never maintain it?
anyone here, who can tell who to do this with docker composer?