New install on QNAP TVS-471, QTS 4.3.5, Container Station 1.9.35.27
DNS available to LAN on eth1 (not eth0).
All help appreciated.
Actual Behaviour:
Pi-hole is running and blocking sites, activity is showing on the GUI Query Log.
When accessing the GUI Settings I receive a red banner:
Error
There was a problem applying your settings.
Debugging information:
PHP error (2): parse_ini_file(/etc/pihole/setupVars.conf): failed to open stream: Permission denied in /var/www/html/admin/settings.php:11
Reading through debug shows apparent errors with PHP permissions ... ? The docker bridge and container were built with the script below.
Pi-hole process daemons not active ... ?
IPv4 bound to eth0. I don't understand how this works at all looking at the bridge image below, however I when i try docker run with '-e INTERFACE=eth1' i am unable to see pi-hole from the LAN.
Build script:
#!/bin/sh
# pi-hole data persist in current working directory
DOCKER_CONFIGS="$(pwd)"
DOCKER_BRIDGE=pihole-static-bridge
DOCKER_BRIDGE_NIC=eth1
DOCKER_IP=192.168.1.202
DOCKER_PASSWORD=tempblah
# Not using DHCP, not sure if needed but this avoids an error in the run log
# cp ${DOCKER_CONFIGS}/pihole/dhcp.leases.blank ${DOCKER_CONFIGS}/pihole/dhcp.leases
# Create a Static IP
docker network create \
-d qnet \
--ipam-driver=qnet \
--ipam-opt=iface=${DOCKER_BRIDGE_NIC} \
--subnet=192.168.1.0/24 \
--gateway=192.168.1.1 \
${DOCKER_BRIDGE}
# Create Container
# -e INTERFACE=${DOCKER_BRIDGE_NIC} \
docker run --name pihole \
-h PIHOLE \
-v ${DOCKER_CONFIGS}/pihole/:/etc/pihole/:rw \
-v ${DOCKER_CONFIGS}/dnsmasq.d/:/etc/dnsmasq.d/:rw \
-p ${DOCKER_IP}:53:53/tcp \
-p ${DOCKER_IP}:53:53/udp \
-p ${DOCKER_IP}:80:80 \
-p ${DOCKER_IP}:443:443 \
-e ServerIP=${DOCKER_IP} \
-e TZ=Australia/Melbourne \
-e IPv6=False \
-e WEBPASSWORD=${DOCKER_PASSWORD} \
--net ${DOCKER_BRIDGE} \
--ip=${DOCKER_IP} \
--dns=127.0.0.1 \
--dns=1.1.1.1 \
--restart=unless-stopped \
-d -t -i \
pihole/pihole:latest
I'm not too concerned about the strange networking since the error is permission denied on a file, lets focus on that.
The customized installation of Container station is not something I'm familiar with and any non default docker install always gives me concerns. Not owning a container station or having seen this exact problem before I'm afraid I'm not much help and can only make guesses.
Permission denied in /var/www/html/admin/settings.php:11 - /var/www, not being a volume, stores all it's data in Docker's root dir. Your docker info reports : Docker Root Dir: /share/CACHEDEV1_DATA/Container/container-station-data/lib/docker - so that directory has some some-folder for container data, and under some container ID folder is probably the /var/www/html/admin/settings.php file.
There maybe some security or permission mechanism in place causing this permission denied. You could try looking into container station forums for similar errors within docker (search generically leaving off paths to files).
If you're comfortable docker try using docker exec -it <pihole_container> bash to jump into the container and poke around looking at permissions and trying to manipulate files by hand after installing vim or something similar.
Here is how it looks from a clean install. Debug token lnab3j6exs
Nether user pihole or www-data appear to have permission to access the pihole directory. I did not have any luck manually changing permissions on /etc/pihole/ &/or setupVars.conf, the admin gui continued to throw up the error parsing /etc/pihole/setupVars.conf.
Which user is active for the GUI process and should have permission?
Is the FTL processes supposed to be running as root:dip?
Other stuff at least answers the question of eth0 vs eth1, but raises the question of why there is an IP mismatch error in the debug results.
It is possible there is confusion over frame of reference, ie.one test is looking at the container eth0 (192.168.1.202) and another test is looking at the host eth0 (192.168.1.12)?
edit: Similar confusion could explain the blank debug response to pihole processes?
root@PIHOLE:/# ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
43: eth0@if44: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 02:42:76:3f:cd:3d brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 192.168.1.202/24 scope global eth0
valid_lft forever preferred_lft forever
root@PIHOLE:/# netstat -tanp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.11:35167 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:4711 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN -
tcp6 0 0 :::53 :::* LISTEN -
Edit follow-up:
Looking further I opened all permissions and still get the parsing error on setupVars.conf, along with errors accessing the long term database.
root@PIHOLE:/# chmod -R 777 /etc/pi*
root@PIHOLE:/# ls -la /etc/pi*
total 7508
drwxrwxrwx+ 2 pihole pihole 4096 Nov 2 14:23 .
drwxrwxr-x 1 root root 4096 Nov 2 14:11 ..
-rwxrwxrwx+ 1 root root 14 Nov 2 14:11 GitHubVersions
-rwxrwxrwx+ 1 root root 381 Nov 2 14:04 adlists.list
-rwxrwxrwx+ 1 root root 2933646 Nov 2 14:11 gravity.list
-rwxrwxrwx+ 1 root root 1297 Nov 2 14:11 install.log
-rwxrwxrwx 1 root root 1606823 Nov 2 14:11 list.0.raw.githubusercontent.com.domains
-rwxrwxrwx 1 root root 595071 Nov 2 14:11 list.1.mirror1.malwaredomains.com.domains
-rwxrwxrwx 1 root root 638705 Nov 2 14:11 list.2.sysctl.org.domains
-rwxrwxrwx 1 root root 7199 Nov 2 14:11 list.3.zeustracker.abuse.ch.domains
-rwxrwxrwx 1 root root 613 Nov 2 14:11 list.4.s3.amazonaws.com.domains
-rwxrwxrwx 1 root root 43642 Nov 2 14:11 list.5.s3.amazonaws.com.domains
-rwxrwxrwx 1 root root 1772415 Nov 2 14:11 list.6.hosts-file.net.domains
-rwxrwxrwx+ 1 root root 43 Nov 2 14:11 local.list
-rwxrwxrwx+ 1 root root 14 Nov 2 14:20 localbranches
-rwxrwxrwx+ 1 root root 37 Nov 2 14:20 localversions
-rwxrwxrwx+ 1 root root 234 Nov 2 14:11 logrotate
-rwxrwxrwx 1 pihole pihole 0 Nov 2 14:04 pihole-FTL.conf
-rwxrwxrwx+ 1 root root 24576 Nov 2 14:23 pihole-FTL.db
-rwxrwxrwx 1 pihole pihole 0 Nov 2 14:04 regex.list
-rwxrwxrwx+ 1 root root 274 Nov 2 14:11 setupVars.conf
-rwxrwxrwx+ 1 root root 270 Nov 2 14:11 setupVars.conf.update.bak
root@PIHOLE:/# pihole -r
A somewhat similar permission issue came up here :
The fix was a reinstall of container station. QNAP Container station has been hit or miss for several people, I don't know what causes it exactly but they do some special directory / permission setup for docker.
Stock docker is all I have to work with unfortunately so if there are any code fixes that are needed I'll need some direction from community members custom hacking the image (or maybe container station) to see what fixes things.
This may turn out to be one of those Doh!! moments, I realized I have not entered the webpassword anywhere, and cannot find anywhere in the gui to login.
Three different browsers, all take me straight to the gui without login.
Entering a blank password makes no differences to the gui error.
No, simply opening the admin web page there is no prompt to enter a password and I cannot see where to enter the password.
It made me think it was part working due to processes running as root, and part not working due to lack of a password.
This made me try 'pihole -a -p' to blank/remove the password, but this made no difference, I still get the error on the Settings menu from a couple of posts above.
Ok, you don't have a web interface password set, so you don't need to log in. That is not related to the error you are seeing. Have you visited the link @diginc shared?
I think you misunderstood, I do have a password set in the 'docker run' command in the first post, but was not able to enter it anywhere.
Then I tried removing the password with the 'pihole' command, no change to the error.
Yes I looked at the link, I have removed/reinstalled container station and directories several times along the way to clean up after I have manually changed permissions.
The web password rendering is definitely weird but I'm thinking it's confused since it can't even read your settings still most likely.
Do you use volumes on a QNAP folder share for pi-hole's data? Also is it NFS or CIFS? After you ran chmod 777 did you re-try your docker exec test of docker exec -it -u www-data piholecon bash ? That should work for sure and is the crux of our problem having the web interface parse your setupVars.
Sorry for so many questions, I started digging around QNAP forums a bit. This post caught my eye and makes a bit of sense to me.
Pointing a docker volume to a QNAP-NAS shared folder may have permission issues depending on the guest access. I think guest access is roughly equivalent to the last permission bit / other permission which at a minimum has to be read for setupVars.conf.
NAS ACL permission systems may have higher priority than linux file permissions, hence 777 linux perms still resulting in permission denied.
So I'd say make sure guest have at least read priv on your shared folder containing volumes to see if that fixes it.
Another useful command you might have on your QNAP os (but no inside pi-hole container) is getfacl to inspect permissions of your volume folder, or the docker root storage for containers ing eneral (part of your docker info output: Docker Root Dir: /share/CACHEDEV1_DATA/Container/container-station-data/lib/docker)
Your last post sent me in the right direction.
After many false attempts I found this thread write in shared volumes docker - Stack Overflow which was part way there.
The remaining step was to remove ACLs on the QNAP host directory, as they appear to also be propagated into the docker with the bind mount.
Success!! I now get the login screen and subsequent functions, inc donation button
Thanks very much for your help.
#!/bin/sh
# For installation on QNAP, assuming you do not use these ports for other services
# free up port 443 by Control Panel -> System -> System Administration -> HTTPS port number=<not_443>
# free up port 80 by Control Panel -> Applications -> Web Server -> Enable Web Server -> Port number=<not_80>
# stop redirect of <qnap_ip>:80 to <qnap_ip>:8080 by placing an empty or valid php file at /share/Web/index.php
# pi-hole data persist in current working directory
DOCKER_CONFIGS="$(pwd)"
DOCKER_BRIDGE=pihole-static-bridge
DOCKER_BRIDGE_NIC=eth1
DOCKER_BRIDGE_IP=192.168.1.202
DOCKER_HOST_IP=192.168.1.202
DOCKER_PASSWORD=tempblah
# Open permissions and remove ACL before the bind mount
chmod 777 ${DOCKER_CONFIGS}
setfacl -b ${DOCKER_CONFIGS}
# Create a Static IP
docker network create \
-d qnet \
--ipam-driver=qnet \
--ipam-opt=iface=${DOCKER_BRIDGE_NIC} \
--subnet=192.168.1.0/24 \
--gateway=192.168.1.1 \
${DOCKER_BRIDGE}
# Create Container
# -e PH_VERBOSE=1 \
docker run -d \
-h PIHOLE \
-p 53:53/tcp \
-p 53:53/udp \
-p 80:80 \
-p 443:443 \
-e ServerIP=${DOCKER_HOST_IP} \
-e TZ=Australia/Melbourne \
-e IPv6=False \
-e DNS1=1.1.1.1 \
-e DNS2=1.0.0.1 \
-e WEBPASSWORD=${DOCKER_PASSWORD} \
--name piholecon \
--net ${DOCKER_BRIDGE} \
--ip=${DOCKER_BRIDGE_IP} \
--restart=unless-stopped \
--cap-add=NET_ADMIN \
--dns=127.0.0.1 \
--dns=1.1.1.1 \
-v ${DOCKER_CONFIGS}/pihole/:/etc/pihole/:rw \
-v ${DOCKER_CONFIGS}/dnsmasq.d/:/etc/dnsmasq.d/:rw \
pihole/pihole:latest
