Pi-Hole HA using Gravity SYNC and Tailscale | Proxmox Home Server Series | Proxmox Home Lab

hello everyone and thank you much for watching this is me Mr P and this is another episode in a proximos home service series I believe this video going to be quite lengthy because I'm going to show you quite a few things main goal of this video is to set up py hole inside my Pro Mo Home Server and set up a second py hole somewhere in the cloud for this video I will show you how I will set up this inside the header my main procm server Pyle is running inside ionos and in UK ionos um I I think how that's how we pronounce them ionos um they offer one virtual private server Linux for1 pound a month one catch with this is that you need to sign 12month contract to get1 pound a month so you pay1 122 here in UK and you get straight away a visual private server for technically a pound a month instead of me setting this up and then basically paying £2 um for a year to how to get this configured I'm going to use the hner they're a bit more expensive expensive compared to ionas uh I'll be able to have virtual private server inside header for about less than A4 pound but it's much easier to show me inside the header because it's just going to be super easy to create one and then after this video is done I can basically delete and then remove this virtual server with no no more bills coming in if you know what I mean so one Pyle will run inside the proxmox second py hole will run inside the head both py hole instances will be able to talk to each other using tail skill network and to make sure that my my py hole main py hole inside my proxmox whatever changes I will do to this py hole they will be synced those changes configurations everything else will be synced to my header server and update that py hole using the gravity sync um feature which will make sure that two P holes are basically in sync so if my main py hole dies or prox decides to stop functioning and I'm out and about let's say my phone on my phone I'll still be able to utilize spy hole ad block and local DNS resolve feature because my phone will be connected to this tail skill Network which will then obviously will jump from the main pie hole to be used as this one so enough yapping let's start setting up by the way everything will be split in chapters so if you know for example how to St P already uh just jump to a chapter that is ready relevant for you that you just carry on setting this up so Point number one we need to set up the py hole inside the my main proxmox instant so I'm going to click create CT I will create a container instead of using a virtual machine and I'll name this py hole Das main I will use privilege container because I want to install tail scale inside this lxc container run alongside py hole and tail scale yes you can have tail scale running inside unprivileged container but this requires way more configuration where privilege container is just two extra lines you need to add into configuration file for everything to work so I'm going to use privilege container under templates I will select to BTU diss 8 GB is plenty CPU is one fine memory 512 megab is plenty for Pyle and tail scale to run network I want to get the the hcp IP address DNS I'll leave everything like it is and confirm just check if everything is here is fine yes I can no I don't need to start no cuz we need to amend the config file so while this is doing let me quickly get the config file I was supposed to be prepared for this but I'm just going to get this line two lines copied all the links that I'm going to use in this video will be in description below below the like button so you can follow follow these steps so Alexy container is created let's jump to my prox MOX instant and the shell I need to type Nano et/ Etc / pv/ LXE and then ID number of the the the lxc container in my case 104 press tab to Doom at the end yours might be different yours might be 102 or 112 just whatever you make sure that you're editing the actual container for the py hole so I'll go all the way down the end just below the swap 512 I'm going to paste those two in and these two com these two lines will allow privilege container to fully utilize or fully give permission tail scale to do a networking otherwise tail scale won't be able to start properly um inside the privilege container and like I said inside un privilege container there is a there is a way to run tail scale but it's just way more steps so I'm going to control press contrl X to close y to save enter to confirm and tail scale configuration has been saved so now I can go and run this lxc container so start and container started so default username is root and the password is the one I chose during the create CT process I'm logged in so first thing straight away I need to do is apt update and apt upgrade the system to make sure it's all up to date so while this is running I can go and prepare to get the download link for tail scale so click while you logged into your tail skill dashboard click on a download which will take you to download page it detects that Linux I'm using Linux because I'm using the the D XPS laptop running Linux Mint but yours might be different depending what system you're using so so you just select the Linux and make sure you copy this and here we are Alexy container contain updated upgraded so now I can go right click and paste the the command to install um tail skill yes it's going to com complain about curl I expected that let's delete all that not sure why I'm typing all this apt AP install curl so let's get Curl installed it's just 300 uh 3,000 kiloby so let it that's installed I can bring the the command to install tail skill and press enter so while tail skill installed let's go and prepare ourselves for pyo installation again all the links will be in description below I just need to copy this command go back here and this says is done so right now I'm going to say tail scale up enter and this is the command I need to copy oh actually I'm going to copy this and I'll have to recopy the uh P installation script so I copy the URL from the tail scale upcoming and which will open the login page I'm going to click on sign in with Google you just click whatever um the login process you used to create a tail skill account I'm going to choose my Google account when I say yes I'm happy to connect close that and now if I'm going to go into machines inside my tail skill dashboard press refresh that I should be able to see py home main showing up here so straight away I'm just going to click on the three dots and disable the key expiry and I think I'm going to do the same thing with dxps cuz I'm I forgot to do that earlier so right now all my my machine have a key expiry expiry disabled that means that I don't need to reauthenticate them again after I think is 90 days so py hole is installed and this is the IP address inside the tail net now I can go and copy the URL for py hole go back in the prox MOX inside the Pyle main container right click paste and press enter and now I'm going to start setting up the py hole installation there is a slight different between how the py hole be installed in this uh inside prox Mox and inside the virtual machine which I will show you when the time comes when we're going to start setting up ihle inside the header so this inst installer will transform your device into Network wide ad blocker when I say yes yes continue and now this is the difference between the um setting up inside the prox mo and setting up inside the header or any other virtual private server because that this is going to be used inside my local network I need to choose Etho Z or eth0 inside hna I will use tail scale because I want to Pyle to be communicated by via tail scale network instead of using the internal Network or public IP address so in this case as because I'm setting up this inside my proxmox I'm going to leave this as e0 and press select my Upstream DNS I choose Cloud FL you can choose whichever you want enter and then yes on that yes yes yes show all the logs yes and installation is carrying on so once installation is done it I will get a window showing up with my admin password you can obviously copy this password and use to log in as to an admin panel I'm just going to straight away change the Pyle password to something more easier for me to remember so this installation should be done here we go this is the password to use to access the um the admin panel I'm just going to go straight away and type py hole space- a space- p and enter new password and I saw the IP address was2 168 1781 194 SL admin and press that enter the new password I created and yes Save on that and this is my py hole which running inside the inside my um prox MOX so now we need to do the same thing inside VPS server so hna allows you to do a lot of things or rent Cloud basically this is the cloud virtual private server robot is basically you renting the actual bare metal server console H just to console DNS reord I'm going to click on a cloud log in with my credentials and I am inside the heads in the dashboard so now as you can see there is no projects active I'm going to click new project and name this proxmox Home Server series add the project and now the project is created I can click inside the project and start setting up up the uh servers I'm going to click add the server so right now first step I need to choose the closest location as I live in United Kingdom um any top any to any first free is a good option for me you can choose if you're for example from America you can choose one of these I'm going to leave this as a h Sy K which is selected by default next which image I choose obviously I will choose but let's say in the future if you wanted to set up something else inside hner there's options for apps like you can Swit away use Docker you can go and X set up an xcloud somewhere there is a WordPress uh here we go wire guard if you want I'm going to choose OS image and it's going to be Ubuntu 2204 I'm going to choose shared CPU virtual CPUs and I'll choose x86 and I'll choose the top one which is brings to 4.55 a month which is around just shy of4 a month scroll down I don't need this uh this one private primary IP address of a type to so you can basically add additional ones as you can see this is IP is chargeable which is being added to this but if you want you can obviously make sure that you can add yourself IPv6 I'm just going to use ipv4 if you have option or you already have your s Keys generated you can add that in for this video I'm not going to use I'm just SSH keys I'm just going to use a simple password volumes I don't need any volumes additional storage firewalls no backups no uh placement uh placements group no no just scroll down all the way to the bottom and server name ble dcloud and this is by the way not only the server name but this is going to be a host name as well so Pyle cloud and this one is called Pyle May main so I'm going to click create and buy now and hner will create this server in less than 5 minutes so I'm going to click on the Pyle cloud and now this is the dashboard of the Pyle Cloud uh Pyle Cloud visual server I I have 1 CPU 2 GB of RAM 20 GB of dis allocated so if I use one eurocent traffic 20 terabytes a month and this is our full price so right now I need to log the system I'm going to copy the IP address connect to this is going to be SSH root at an IP address of the server so it's right now asking for fingerprint and that's it it's asking me right now for the password but I don't have a password for H by the way all the setup is going to be different depending on what kind of the virtual private server provider you choose with hner once you create a VPS and you need to obviously you can connect via using S keys if you have that set up but you need to get yourself right now a root password to do that I need to click on the rescue and then I click on the reset root password yes I accept that and it's going to give me the new password and this is the password I need to use to log in so password is make sure it's copied go back inside s client and try to to connect again right click and paste the password enter and I am logged in inside this virtual private uh server so Pyle cloud is going to be my uh cloud and Pyle main on the prox MOX obviously is Pyle main so straight away first thing to do is the same as it done with the Alexi container is to update and upgrade everything and here we are update and upgrade completed so I can clean the screen and go into a browser and copy the download command to install tail scale so copy the same command that I used inside thex container go into s client which is connected to my head snap right click paste and install tail scale tail scale is installed inside hner and right now we can type tail scale up and for this virtual private server I need to put space-- SSH which will make the uh which will create basically option for me to SSH into the server via tail scale network instead of SSH via the public IP address so I'm going to press enter on that and this is the link that I need to use so copy the link into a browser open a new tab paste the link and I'm going to connect again with the same account that I used for LX container click connect connected successfully so I'm going to close that go into my tab where is my tail skill machines refresh and I do have a Pyle cloud with the T with the label showing up SSH so again straightway fre dots and click disable key expiry so right now I have Pyle Main and I have a Pyle Cloud but Pyle cloud has the S connected that's the difference between them so right now I need to go into P hole um install script right click copy into the terminal clean all this screen and right click paste and right now we're going to install the Pyle and installation process pretty much is the same as was inside XC container with just one difference that I will choose tail scale as the network to to access to the interface for p hole instead of eh eth so tail skill is selected select again cloudflow is going to be my Upstream DNS and then yes on that yes yes do you want to enable enable qu loging yes I want to see everything and the py installation continues and here we installation is finished it's giving me the IP Link that I need to use to access so it's 65181 1441 181 admin so I'm going to click Contin that and again straight away I'm going to change the password to something that I will remember instead of instead of something something just autogenerated so I can minimize the SSH client go inside the heads Tab and overview copy the IP address paste it in inside the new tab and put admin and I do have access to to the py hole so connect in save and I have the py hole running inside my heads so let's drag that up next to this so the where is my other py hole this is the py hole so this is the py hole for the local and this is py hole inside the cloud so before setting up the gravity syn I need to do a bit of configuration between these two um before doing it like all the syncing the main thing with the gravity sync is that both pies need both pie holes needs to be set up or configurations done the same way and there is a couple of things that I always like to change before um fully utilizing the py hole is first thing I'm going to go inside settings under DNS I want to make sure that it says permit all Origins this allows Pyle to qu to resolve all the DNS question DNS requests regard regardless from where it's coming from by default is um you can select as a e Etho because it's a local but then means that if I will try to query this using a tail scale Network I won't be able to do so I need to make sure that while I'm at home it's going to use a local network to do all the DNS queries and when I'm out and about on let's say laptop or my my phone or Galaxy tablet it's going to use tail skill and tail skill will be allowed so that's the change I done on the local and because I done this change on the local I need to do the same change inside the py hole which runs inside the cloud so again settings DNS permal Origins as you can see by default it was allow only local requests I need to make sure that permit Origins is stct and press save so right now this is one the one change that I do between these two py holes let's increase that a bit more so right now this pie hole and this py hole basically got set up and you can happily use this kind of setup from from this point um you have two py holes running and if you're using a tail skill Network you can assign both py hole IP addresses to be the first hit point of the DNS records I go into a tail skill and if I go to my cloud Pyle main click on IP address and choose copy the IP address you can choose like as you can see bps4 host name or full tailet name I'm just going to choose IP address actually let's CH choose this I go inside DNS and by default I had the cloud flare public setup I'm going to say add a new uh name server custom punch that in oh it doesn't want it wants IP address I forgot about that so machines main copy IP address this time DNS and the new one custom enter I'm going to delete Cloud flare so right now the Pyle main is being used to query so I go in the dashboard as you can see that was zero and now the numbers going up and this one the Pyle in the cloud is doing nothing so I need to go inside the tail scale go to machines Pyle Cloud copy IP address DNS and add that as the second option save and that's it so right now this one should start getting the information as well as soon as so open anything so let's say open reddit.com so.com opens as you can see Pyle in a cloud getting requests sorted for four blocks so far and my Pyle main is 13 143 now and it's seven blocked and they're both right now being hit by my tailet network when I'm basically browsing up internet all the DNS all the DNS resolves all that blocks happening on the both at the same time but I'm using the tail pile not only for as an ad block I'm using that for local DNS as well so I click on the local DNS click on the DNS records and this is IP address 191 for my proxmox I'm going to go back inside my py hole local and click on here right I'm going to type pt- PVE D.L and this I want to be the AP address this so 192 168 178 19 191 if I will hit yt- PVE Dolan I want this IP address to be resolved so click that so that's is done so technically what I should be able to do is open a new tab put https yt- PVE local. land sorry semicolon 886 that should open as you can see the um the my my um What's this called proxo instant because Pyle was used to resolve this domain into this IP address but the thing is right now let's say my Pyle main dies stops my prox MOX crashes or something happens to this LXE container and I can't use this Pyle anymore the Pyle in the cloud if I click on local DNS records knows nothing about this entry that I just did inside my P main it has nothing against the local local resolves like local DNS records so this is where the gravity sync comes into play Gravity sync will keep the both Raspberry p both raspberry pies both pie holes in sync so this is what we're going to set up now so first thing we're going to go scroll on this G Page by the way link will be in the description below click on install gravity sync and before you run this you need to click on a system requirements and check if your system meet the requirements you need to allow the C connection and allow passwordless um connection if you're using a user I'm going to use the uh root for this connection just to simplify the settings but if you want to use not a root but a user you need to make sure that the RO user has the passwordless Pudo permission activated so right now let's go back one step and copy all this command so this command is copied let's go inside my proxmox lxc container because this is the one that is main you need to install gravity sync on the pie hole that you will be that is will be called in your setup as a main as a master and another Pi will be called as remote Pi or let's say node Pi so I'm going to go and right click and choose paste so that is in and press enter so gravity sync is being installed and first question a remote Pyle host address so I can use for example straight away and say this is the remote address but in the next couple of steps I'm going to block access to this IP address from outside so this is why we set up the tail scale because tail scale is my private VPN or private Network and this is the one I'm going to use so Pyle Cloud I'm going to say to this gravity setup that pyol cloud is located at this address and press enter what's the us I'm going to use I'm going to say root if you planning to use a user with just pseudo permissions you need to set up and make sure that that user has a pseudo less uh permission activated enter and it's doing all the things automatically right now it's generating s keys and everything else and getting everything set up so gravity sync configuration completed in 45 seconds so gravity sync is working now to test it let's go back to a Pyle local and just to remind you I have a local DNS record inside my Pyle local entered which resolves my proxmox um proxmox server web guey using YT dpv Dolan but my py hole in a cloud as you can see has no data available under local DS records so back inside the Lexi container I'm going to put gravity and press tab to autocomplete so it says gravity sync let's actually clean all this so gravity sync push and press enter so what he doing now is pushing the settings as you see local DS records is one of them to this remote py hole bya tail scale Network remote Target Route at 192 Etc so it's doing this and this is taking slightly longer that we'll usually do because this is the first push so it's doing all the settings and as you can see is done in 17 seconds so now if I'm going to go to my Pyle in the cloud re reload this and this is showed up this is showing up here so right now if I will turn thei container off over my prox Mox server dies all the local DS records for example for other devices in my house for other Home servers and Etc will still be resolved because my both py holes right now are in sync and the way that is in sync that I'm doing that my py hole main will always push the records to my remote py hole and that is working great but right now we need to automate this and to automate this you we need to obviously reme remind ourselves what a command we run so it was gravity Das sync space push so I'm going to copy this command if I can so copy this command and inside my py hole main I need to type Nano space d SL Etc SL Chrome tab enter and this is the this is the file that um you can use to run the commands depending on the day month day of the month hours and minutes so we're going to go all the way down to the last line make a couple of more spaces I'm just going to put py hole sync and next line will be like this star sl15 space star space star space star space star that's it so right now I'm just going to type all that and then I'll explain what each of this thing does so what this is doing is instructing the Chron to run this command using root user permissions or use use run this command as a root every 15 minutes let's say I'm going to say let's say if you're updating the your P more often let's say you can say every 5 minutes run this but 15 minutes is pretty much okay for this so that means that I want every 50 minutes regardless what hour it is what day of the month it is what month it is or is it Monday Tuesday regardless of all this as long as is you run this every 15 minutes so contrl X to close y to write enter to confirm and that's it py hole main is set up right now with a py hole tail scale and gravity sync which will sync the all my configurations inside Pyle main to the actual Pyle in the cloud technically from now on my cloud can be ignored I don't need to log into this anymore it's just going to always be in sync one thing I want to just make sure before I'm just going to close and say that all this is done is this IP address so public IP address if we're going to go back inside the terminal and I'm will exit from SSH connection if I do root 651 I'm going to press end and let's log in I forgot to change the password okay so let's go back to a hner and do the rescue password again because I forgot to actually change the password once I loed in so just click on Rescue get myself a new password paste the password in enter and now I loged in as the rout so straight away pass WD make sure now I change the password that's it so go back to what I was was trying to say is that right now I'm going to use public IP address to log in so I'm logging in as a public IP address and I logged in and my password to be honest is quite simple so what if somebody will get actually gain access to this instant for using this public IP address and they going to start doing some naughty things I need to block that this is where ufw comes into play ufw is a firewall firewall package for Linux that you can set up to block or allow all sorts of stuff so that's what we're going to do first thing I want to make sure that the tail scale is always allowed so to do that I need to write ufw allow in on tail tail tail scale zero so that means that firewall allow every any connection in on this on this um interface and press enter so that's that's all right and now that's it the this is all I need so tail scale will be allowed to connect in next thing what I need to type is ufw default allow uh outgoing outgoing that means that by default I'm allowing anything that leaves the server is okay so leaving out is fine so default outgoing policy change to allow next thing I need to type UF ufw default deny incoming so that means that deny incoming in so right now no one can go into the server but can leave the server like a packet information can leave the server can I basic I will be able to still ping so first of all if I put ufw status it's going to say it's inactive so I need to activate this so we have W enable and yes I'm F fine with that it just gives you a warning that the stage might be disrupted and ufw uh reload so I enabled the ufw uh firewall and it started but just to make sure everything is fine I said reload so now if I type ufw status it's telling me that anywhere on tail scale zero is allow to anywhere uh to anywhere allowed from so basically ipv4 and access from public IP addresses is not allowed so right now what I need to do I need to go and exit this out so this is out so right now if I'm going to try to log in via public IP address as you can see nothing's happening because it's just stopped but if I'm going to go tail scale tail scale status let's find my Pyle in the cloud IP address copy that SSH root and try to connect V this as you can see asking me for fingerprint I'm going to say yes okay with that and permission denied and permission denied is because the tail scale right now is is controlling the access and tail scale by default has the firewall rule or ACL rule added that only the user it can connect to Itself by SSH we need to sort this out so go back inside the fire Firefox or inside my browser click on a tail scale and I click on the access controls so a couple of things you will see here that is different from your default one so this line I created the user speak to MRP gmail.com that is below ons to group admin and then tag owner tag HL which stands for home lab and tag Mr P belongs to a group admin and next one I'm going to create straight away is going to say tag p and this belongs to group admin so anybody who's in group admin has option to assign any tag to any tail skill device so that's in so I'm going to scroll down click save if you done any boo boo here and this errors you will get the message here telling you what's wrong go back to machines so this is why I have t tag HL and Mr P already assigned cuz I done some of them before so in the Pyle Cloud I'm going to click on three dots click on edit ACL tags and say this is is Pyle and Pyle main ACL it is Pyle and it's a part of my home lab yes that's in that is done back to access controls let's scroll down and see okay so ACLS right now is set up to anybody allows is allowed to connect to anybody just to make sure that this um properly connected or properly secured I'm going to say that is connect like this let's say uh tag HL so any anything with a tag home lab can connect to anything and I can comment it out so anything any tail scale node with a tag home lab or HL destination is anything so if I close that save so if I go back to my machines that means that docyt can connect to anything D XPS can connect to anything py hole in the cloud cannot because the this not belongs to a tag HL so py in a cloud cannot connect so back on a access controls I will add another record here and I will say delete the St the a here so tag Pyle can connect to tag Pyle on any port so save that so right now the way I change the ACLS is that both pyol can communicate to each other because they both have tag Pyle and I set up that Pyle can connect or tag Pyle owner or tag machine can connect to another machine that has a tag py hole so this is sorted next I'm going to click on access controls scroll down a bit and this is SSH this is where it all happens so now I'm going to copy all this as you can see here check autog group member can connect to itself as with root user or non-root user I'm going to drop the line down and paste it in now I need to write accept and now Source I'm going to delete all that I'm going to say tag HL so anything with the tag HL can connect to devices that are TAG HL and tag vle and they can connect regardless if it's root or not so accept the connection as long as the source is HL and destination is HL or P save and that's done so now if I'm going to go back inside the terminal and connect to this machine as you can see I'm connected and I connect it straight away without the password because if I exit that out and I connect again using the tail scale IP address using root press enter if I scroll up as you can see one of the message is authenticated on this IP address using none because I'm using a machine that has a tail skill installed and tail skill is a part of the same tail net to of the device that I'm connecting to it allows me to do all this connection and this is because the SSH tag is added if this not going to be added I will you connect using the normal stuff like a SSH keys or password but because I'm telling that this this node accepts s connections via tailet I do need any password you just punch that in and connects so that's it everything I believe is set up I'm not missing anything in this video I hope if I missed anything please check for pin comment cuz if I'll remember or if it turns out that I missed something to show in this video I will detail everything in the first pin comment just to help you out to set this up so for end um End chat just to let you know I have a py hole running inside my main proxo server and I have a py hole which runs inside the VPS you can choose you don't need to choose hner you can choose anything and uh I just chose hna because it's going to be much easier for me to do a cleanup after this video yes hna allows you to create the firewalls rules but I I gave you a demo how to do this inside the um Linux uh inside the Linux CLI because some of the VPS services will not don't have a feature or don't have a option for you to set up the um firewall rules outside the CLI so we went basically black and white kind of stuff to set up the U the firewall rules so the both py holes is talking to each other and they both are being in sync or my main py hole pushing the data to my py hole in the cloud so if I click on this and now if I add add admin at the end I'll get the access to the Pyle admin or by the way because we blocked access from outside network if I'm going to go into servers P cloud and try to do the same thing with the public IP address that I done before there you go ad as you can see it was some action happening with this IP address but if I'm going to try to connect now it's not going to happen because I have the firewall rule set up as default incoming is not allowed unless is origin origin connectionist comes from a tail scale and that is it I'm still by the way can go and ping google.com because outgoing packets are allowed incoming packets are not allowed in using the public IP address and I think that is it I hope this video is helpful um I got this set up on my main prox MOX instant and believe it believe me or not 2 hours later my main procm my main py Hole uh instant lxc container started to play up a bit or something happened so I'm glad that I did that because all my local DNS stuff and Etc was saved on another machine which I was be able to sync back to the freshly installed py hole on my main proxmox and by the way another thing is not EXA not all not everything will be synced uh you will obviously be able to sync your your white list and a black list your DNS DNS records or local DNS records and local C Name Records but all the conf configurations like a DHCP will not get synced but for this to properly work you need to have everything configured exactly on above right both Pyle instances so that is it I hope this video is not long I'm not sure how long I'm recording this anyway thank you very much for watching I hope you found this video useful if you did please consider to subscribe to my channel um I do this kind of stuff um I just became quite obsessed about the home lab self-service stuff and just tinkering with all kinds of machines and and the services and virtualizing everything under the sun and unless if you don't really want to subscribe just just click the like button it's going to take two seconds and it's going to make me happy anyway thank you much for watching I hope you enjoyed this video and I'll see you in the next one take care goodbye

Channel: MRP

Views: 4,360

Keywords: proxmox home server, pi-hole, gravity sync, hetzner, two pihole sync, mrp, home lab, home server, proxmox home lab, proxmox, pve

Id: q_wn_DdQvOY

Length: 38min 18sec (2298 seconds)

Published: Mon Nov 13 2023