From a4130834a788aca5b8a0ca585cc6afc68b3f572b Mon Sep 17 00:00:00 2001 From: Tim Baumann Date: Wed, 28 Oct 2026 07:34:53 +0100 Subject: [PATCH] docs: record upstream detection fix --- CHANGELOG.md | 4 ++++ README.de.md | 2 +- README.md | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9be1358..99f2a80 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -27,6 +27,10 @@ All notable changes to this project will be documented in this file. - Console menu Exit moved from [7] to [8] to accommodate new Rescue entry - `action_check_mode()` in console menu now also validates rescue_menu availability +### Fixed +- Read Pi-hole's configured DNS upstream through the suite service's existing read-only `pihole` group access, avoiding a `sudo` call that failed under systemd hardening. +- Removed the now-unneeded upstream-helper sudoers permission. + ### Security - Bound DNS-log line parsing and keep the browser API key in memory only. - Grant the suite service read access to Pi-hole logs through its supplementary group. diff --git a/README.de.md b/README.de.md index f63a9b4..b34ab6d 100644 --- a/README.de.md +++ b/README.de.md @@ -34,7 +34,7 @@ Pi-hole blockiert Werbung und Tracker. Unbound löst DNS-Anfragen rekursiv auf **Dokumentation zuletzt geprüft:** 2026-10-28 -**Letztes Projektupdate:** 2026-10-28 — [PR #35](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/35) aktualisiert die Dokumentation und entfernt veraltete Repository-Artefakte. Die Dashboard- und Wartungsupdates sind in [PR #32](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/32), [PR #33](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/33) und [PR #34](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/34) dokumentiert. +**Letztes Projektupdate:** 2026-10-28 — [PR #37](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/37) behebt die Upstream-Erkennung unter dem Systemd-Hardening. Die README-Aktualisierung und Bereinigung veralteter Artefakte stehen in [PR #35](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/35); Dashboard und Wartungsoberfläche sind in [PR #32](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/32), [PR #33](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/33) und [PR #34](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/34) dokumentiert. - Das lesende DNS-Dashboard wurde mit der authentifizierten Wartungsoberfläche integriert. - Updates wurden abgesichert, DNS-Logzeilen begrenzt, der API-Key aus dauerhaftem Browser-Speicher entfernt und der Logzugriff auf eine Leseberechtigung beschränkt. diff --git a/README.md b/README.md index b4d226b..5a47e9b 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ Pi-hole handles ad/tracker blocking; Unbound handles recursive DNS resolution wi **Documentation last checked:** 2026-10-28 -**Latest project update:** 2026-10-28 — [PR #35](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/35) refreshes the documentation and removes stale repository artifacts. The dashboard and maintenance updates are documented in [PR #32](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/32), [PR #33](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/33), and [PR #34](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/34). +**Latest project update:** 2026-10-28 — [PR #37](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/37) fixes upstream detection under systemd hardening. The README refresh and stale-artifact cleanup are in [PR #35](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/35); the dashboard and maintenance updates are in [PR #32](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/32), [PR #33](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/33), and [PR #34](https://github.com/TimInTech/Pi-hole-Unbound-PiAlert-Setup/pull/34). - Integrated the read-only DNS dashboard with the authenticated maintenance panel. - Hardened upgrades, bounded DNS-log parsing, kept the API key out of persistent browser storage, and enabled least-privilege log access.