# ServiceDefinition: pihole
# Source of truth: spec docs/13-service-catalog.md, row 6.
# internal | egress internet | config on Longhorn (DR-critical config) | auth forward-auth.
# Also a platform DNS dependency (docs/09). Validates against schemas/servicedefinition.schema.json.
name: pihole
kind: container
source:
  image: pihole/pihole
exposure: internal            # LAN-only admin UI (docs/13 row 6; R-DNS/R-NET)
egress: internet              # normal WAN egress (docs/03; R-NET-05)
storage:
  - name: config
    size: 2Gi
    class: longhorn           # replicated config state; DR-critical (docs/04 line 118; R-STATE-02/03)
dependencies: []              # default-deny: reaches only DNS; it PROVIDES DNS (docs/03; R-NET-01/02)
ingressRoutes:
  - host: pihole.home.keithjackson.dev
    port: 80                  # admin web UI, protected at the Gateway by forward-auth (docs/09)
auth:
  mode: forward-auth          # oauth2-proxy -> Keycloak; bare UI, no native OIDC (docs/15; R-IDP-02)
  groups:
    - platform-admins         # sensitive admin UI: authenticated AND in group (R-IDP-06)
update:
  channel: stable             # R-UPD-01
  range: ">=2024.0.0"
  cadence: "0 4 * * *"
  autoRollbackOnFailedHealth: true   # R-UPD-03
observability:
  metrics: true
  slis:
    - up                      # R-OBS-01
backup:
  policy: daily-offcluster    # PiHole config is DR-critical (docs/04 line 118; R-STATE-03)